blob: fe73fb6f6ded3396a7055effe5481852c98383ca [file] [log] [blame]
Gilles Peskinee59236f2018-01-27 23:32:46 +01001/*
2 * PSA crypto layer on top of Mbed TLS crypto
3 */
Bence Szépkúti86974652020-06-15 11:59:37 +02004/*
Bence Szépkúti1e148272020-08-07 13:07:28 +02005 * Copyright The Mbed TLS Contributors
Gilles Peskinee59236f2018-01-27 23:32:46 +01006 * SPDX-License-Identifier: Apache-2.0
7 *
8 * Licensed under the Apache License, Version 2.0 (the "License"); you may
9 * not use this file except in compliance with the License.
10 * You may obtain a copy of the License at
11 *
12 * http://www.apache.org/licenses/LICENSE-2.0
13 *
14 * Unless required by applicable law or agreed to in writing, software
15 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
16 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17 * See the License for the specific language governing permissions and
18 * limitations under the License.
Gilles Peskinee59236f2018-01-27 23:32:46 +010019 */
20
Gilles Peskinedb09ef62020-06-03 01:43:33 +020021#include "common.h"
Ronald Cronafbc7ed2023-01-24 16:02:04 +010022#include "psa_crypto_core_common.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010023
24#if defined(MBEDTLS_PSA_CRYPTO_C)
mohammad160327010052018-07-03 13:16:15 +030025
John Durkop07cc04a2020-11-16 22:08:34 -080026#if defined(MBEDTLS_PSA_CRYPTO_CONFIG)
27#include "check_crypto_config.h"
28#endif
29
Gilles Peskinee59236f2018-01-27 23:32:46 +010030#include "psa/crypto.h"
Przemyslaw Stekiel705fb0f2021-11-24 08:47:29 +010031#include "psa/crypto_values.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010032
Ronald Crond6d28882020-12-14 14:56:02 +010033#include "psa_crypto_cipher.h"
Gilles Peskine039b90c2018-12-07 18:24:41 +010034#include "psa_crypto_core.h"
Gilles Peskine5e769522018-11-20 21:59:56 +010035#include "psa_crypto_invasive.h"
Steven Cooremancd84cb42020-07-16 20:28:36 +020036#include "psa_crypto_driver_wrappers.h"
Ronald Cron00b7bfc2020-11-25 15:25:26 +010037#include "psa_crypto_ecp.h"
Przemek Stekiel359f4622022-12-05 14:11:55 +010038#include "psa_crypto_ffdh.h"
Steven Cooreman5f88e772021-03-15 11:07:12 +010039#include "psa_crypto_hash.h"
Steven Cooreman82c66b62021-03-19 17:39:17 +010040#include "psa_crypto_mac.h"
Ronald Cron00b7bfc2020-11-25 15:25:26 +010041#include "psa_crypto_rsa.h"
Ronald Cron7023db52020-11-20 18:17:42 +010042#include "psa_crypto_ecp.h"
Gilles Peskinea8ade162019-06-26 11:24:49 +020043#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined0890212019-06-24 14:34:43 +020044#include "psa_crypto_se.h"
Gilles Peskinea8ade162019-06-26 11:24:49 +020045#endif
Gilles Peskine961849f2018-11-30 18:54:54 +010046#include "psa_crypto_slot_management.h"
Darryl Greend49a4992018-06-18 17:27:26 +010047/* Include internal declarations that are useful for implementing persistently
48 * stored keys. */
49#include "psa_crypto_storage.h"
50
Gilles Peskineb2b64d32020-12-14 16:43:58 +010051#include "psa_crypto_random_impl.h"
Gilles Peskine90edc992020-11-13 15:39:19 +010052
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010053#include <stdlib.h>
54#include <string.h>
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010055#include "mbedtls/platform.h"
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010056
Gilles Peskine1c49f1a2020-11-13 18:46:25 +010057#include "mbedtls/aes.h"
Gilles Peskine9a944802018-06-21 09:35:35 +020058#include "mbedtls/asn1.h"
Jaeden Amero25384a22019-01-10 10:23:21 +000059#include "mbedtls/asn1write.h"
Gilles Peskinea81d85b2018-06-26 16:10:23 +020060#include "mbedtls/bignum.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010061#include "mbedtls/camellia.h"
Gilles Peskine26869f22019-05-06 15:25:00 +020062#include "mbedtls/chacha20.h"
63#include "mbedtls/chachapoly.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010064#include "mbedtls/cipher.h"
65#include "mbedtls/ccm.h"
66#include "mbedtls/cmac.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010067#include "mbedtls/des.h"
Gilles Peskineb7ecdf02018-09-18 12:11:27 +020068#include "mbedtls/ecdh.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010069#include "mbedtls/ecp.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010070#include "mbedtls/entropy.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010071#include "mbedtls/error.h"
72#include "mbedtls/gcm.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010073#include "mbedtls/md5.h"
Gilles Peskine20035e32018-02-03 22:44:14 +010074#include "mbedtls/md.h"
Chris Jonesdaacb592021-03-09 17:03:29 +000075#include "md_wrap.h"
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010076#include "mbedtls/pk.h"
Chris Jonesdaacb592021-03-09 17:03:29 +000077#include "pk_wrap.h"
Gilles Peskine3f108122018-12-07 18:14:53 +010078#include "mbedtls/platform_util.h"
Janos Follath24eed8d2019-11-22 13:21:35 +000079#include "mbedtls/error.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010080#include "mbedtls/ripemd160.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010081#include "mbedtls/rsa.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010082#include "mbedtls/sha1.h"
83#include "mbedtls/sha256.h"
84#include "mbedtls/sha512.h"
Paul Elliott588f8ed2022-12-02 18:10:26 +000085#include "hash_info.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010086
Gilles Peskine449bd832023-01-11 14:50:10 +010087#define ARRAY_LENGTH(array) (sizeof(array) / sizeof(*(array)))
Gilles Peskine996deb12018-08-01 15:45:45 +020088
Przemek Stekiel75fe3fb2022-06-09 14:44:55 +020089#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF) || \
90 defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) || \
91 defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Przemek Stekiel69c46792022-06-10 12:59:51 +020092#define BUILTIN_ALG_ANY_HKDF 1
Przemek Stekiel75fe3fb2022-06-09 14:44:55 +020093#endif
94
Przemek Stekielfde11282023-03-13 16:06:09 +010095/* The only two JPAKE user/peer identifiers supported for the time being. */
96static const uint8_t jpake_server_id[] = { 's', 'e', 'r', 'v', 'e', 'r' };
97static const uint8_t jpake_client_id[] = { 'c', 'l', 'i', 'e', 'n', 't' };
Przemek Stekiel18cd6c92023-03-06 15:40:35 +010098
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010099/****************************************************************/
100/* Global data, support functions and library management */
101/****************************************************************/
102
Gilles Peskine449bd832023-01-11 14:50:10 +0100103static int key_type_is_raw_bytes(psa_key_type_t type)
Gilles Peskine48c0ea12018-06-21 14:15:31 +0200104{
Gilles Peskine449bd832023-01-11 14:50:10 +0100105 return PSA_KEY_TYPE_IS_UNSTRUCTURED(type);
Gilles Peskine48c0ea12018-06-21 14:15:31 +0200106}
107
Gilles Peskine5a3c50e2018-12-04 12:27:09 +0100108/* Values for psa_global_data_t::rng_state */
109#define RNG_NOT_INITIALIZED 0
110#define RNG_INITIALIZED 1
111#define RNG_SEEDED 2
Gilles Peskinec6b69072018-11-20 21:42:52 +0100112
Gilles Peskine449bd832023-01-11 14:50:10 +0100113typedef struct {
Gilles Peskinec6b69072018-11-20 21:42:52 +0100114 unsigned initialized : 1;
Gilles Peskine5a3c50e2018-12-04 12:27:09 +0100115 unsigned rng_state : 2;
Manuel Pégourié-Gonnard7abdf7e2023-03-09 11:17:43 +0100116 unsigned drivers_initialized : 1;
Gilles Peskine2d8a1822021-11-08 22:20:03 +0100117 mbedtls_psa_random_context_t rng;
Gilles Peskinee59236f2018-01-27 23:32:46 +0100118} psa_global_data_t;
119
120static psa_global_data_t global_data;
121
Gilles Peskine5894e8e2020-12-14 14:54:06 +0100122#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
123mbedtls_psa_drbg_context_t *const mbedtls_psa_random_state =
124 &global_data.rng.drbg;
125#endif
126
itayzafrir0adf0fc2018-09-06 16:24:41 +0300127#define GUARD_MODULE_INITIALIZED \
Gilles Peskine449bd832023-01-11 14:50:10 +0100128 if (global_data.initialized == 0) \
129 return PSA_ERROR_BAD_STATE;
itayzafrir0adf0fc2018-09-06 16:24:41 +0300130
Manuel Pégourié-Gonnard7abdf7e2023-03-09 11:17:43 +0100131int psa_can_do_hash(psa_algorithm_t hash_alg)
132{
133 (void) hash_alg;
134 return global_data.drivers_initialized;
135}
Przemek Stekiel53410502023-04-28 13:18:43 +0200136#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR) || \
137 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) || \
138 defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR)
Przemek Stekiel134cc2e2023-05-05 10:13:37 +0200139static int psa_is_dh_key_size_valid(size_t bits)
140{
Przemek Stekield1cf1ba2023-04-27 12:04:21 +0200141 if (bits != 2048 && bits != 3072 && bits != 4096 &&
142 bits != 6144 && bits != 8192) {
143 return 0;
144 }
145
146 return 1;
147}
Przemek Stekiel53410502023-04-28 13:18:43 +0200148#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR ||
149 MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY ||
150 PSA_WANT_KEY_TYPE_DH_KEY_PAIR */
Przemek Stekield1cf1ba2023-04-27 12:04:21 +0200151
Gilles Peskine449bd832023-01-11 14:50:10 +0100152psa_status_t mbedtls_to_psa_error(int ret)
Gilles Peskinee59236f2018-01-27 23:32:46 +0100153{
Gilles Peskinedbf68962021-01-06 20:04:23 +0100154 /* Mbed TLS error codes can combine a high-level error code and a
155 * low-level error code. The low-level error usually reflects the
156 * root cause better, so dispatch on that preferably. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100157 int low_level_ret = -(-ret & 0x007f);
158 switch (low_level_ret != 0 ? low_level_ret : ret) {
Gilles Peskinee59236f2018-01-27 23:32:46 +0100159 case 0:
Gilles Peskine449bd832023-01-11 14:50:10 +0100160 return PSA_SUCCESS;
Gilles Peskinea5905292018-02-07 20:59:33 +0100161
162 case MBEDTLS_ERR_AES_INVALID_KEY_LENGTH:
163 case MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100164 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine9a944802018-06-21 09:35:35 +0200165 case MBEDTLS_ERR_ASN1_OUT_OF_DATA:
166 case MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:
167 case MBEDTLS_ERR_ASN1_INVALID_LENGTH:
168 case MBEDTLS_ERR_ASN1_LENGTH_MISMATCH:
169 case MBEDTLS_ERR_ASN1_INVALID_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100170 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine9a944802018-06-21 09:35:35 +0200171 case MBEDTLS_ERR_ASN1_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100172 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskine9a944802018-06-21 09:35:35 +0200173 case MBEDTLS_ERR_ASN1_BUF_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100174 return PSA_ERROR_BUFFER_TOO_SMALL;
Gilles Peskine9a944802018-06-21 09:35:35 +0200175
Jaeden Amero93e21112019-02-20 13:57:28 +0000176#if defined(MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA)
Jaeden Amero892cd6d2019-02-11 12:21:12 +0000177 case MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA:
Jaeden Amero93e21112019-02-20 13:57:28 +0000178#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100179 case MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100180 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100181
182 case MBEDTLS_ERR_CCM_BAD_INPUT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100183 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100184 case MBEDTLS_ERR_CCM_AUTH_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100185 return PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskinea5905292018-02-07 20:59:33 +0100186
Gilles Peskine26869f22019-05-06 15:25:00 +0200187 case MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100188 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine26869f22019-05-06 15:25:00 +0200189
190 case MBEDTLS_ERR_CHACHAPOLY_BAD_STATE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100191 return PSA_ERROR_BAD_STATE;
Gilles Peskine26869f22019-05-06 15:25:00 +0200192 case MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100193 return PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskine26869f22019-05-06 15:25:00 +0200194
Gilles Peskinea5905292018-02-07 20:59:33 +0100195 case MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100196 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100197 case MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100198 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100199 case MBEDTLS_ERR_CIPHER_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100200 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskinea5905292018-02-07 20:59:33 +0100201 case MBEDTLS_ERR_CIPHER_INVALID_PADDING:
Gilles Peskine449bd832023-01-11 14:50:10 +0100202 return PSA_ERROR_INVALID_PADDING;
Gilles Peskinea5905292018-02-07 20:59:33 +0100203 case MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100204 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100205 case MBEDTLS_ERR_CIPHER_AUTH_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100206 return PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskinea5905292018-02-07 20:59:33 +0100207 case MBEDTLS_ERR_CIPHER_INVALID_CONTEXT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100208 return PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100209
Gilles Peskine449bd832023-01-11 14:50:10 +0100210#if !(defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) || \
211 defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE))
Gilles Peskinebee96c82020-11-23 21:00:09 +0100212 /* Only check CTR_DRBG error codes if underlying mbedtls_xxx
213 * functions are passed a CTR_DRBG instance. */
Gilles Peskinea5905292018-02-07 20:59:33 +0100214 case MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100215 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskinea5905292018-02-07 20:59:33 +0100216 case MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG:
217 case MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG:
Gilles Peskine449bd832023-01-11 14:50:10 +0100218 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100219 case MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100220 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskine82e57d12020-11-13 21:31:17 +0100221#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100222
223 case MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100224 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100225
Gilles Peskinee59236f2018-01-27 23:32:46 +0100226 case MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED:
227 case MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE:
228 case MBEDTLS_ERR_ENTROPY_SOURCE_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100229 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskinea5905292018-02-07 20:59:33 +0100230
231 case MBEDTLS_ERR_GCM_AUTH_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100232 return PSA_ERROR_INVALID_SIGNATURE;
Mateusz Starzykf28261f2021-09-30 16:39:07 +0200233 case MBEDTLS_ERR_GCM_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100234 return PSA_ERROR_BUFFER_TOO_SMALL;
Gilles Peskinea5905292018-02-07 20:59:33 +0100235 case MBEDTLS_ERR_GCM_BAD_INPUT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100236 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100237
Gilles Peskine82e57d12020-11-13 21:31:17 +0100238#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) && \
Gilles Peskine449bd832023-01-11 14:50:10 +0100239 defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE)
Gilles Peskinebee96c82020-11-23 21:00:09 +0100240 /* Only check HMAC_DRBG error codes if underlying mbedtls_xxx
241 * functions are passed a HMAC_DRBG instance. */
Gilles Peskine82e57d12020-11-13 21:31:17 +0100242 case MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100243 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskine82e57d12020-11-13 21:31:17 +0100244 case MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG:
245 case MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG:
Gilles Peskine449bd832023-01-11 14:50:10 +0100246 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine82e57d12020-11-13 21:31:17 +0100247 case MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100248 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskine82e57d12020-11-13 21:31:17 +0100249#endif
250
Gilles Peskinea5905292018-02-07 20:59:33 +0100251 case MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100252 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100253 case MBEDTLS_ERR_MD_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100254 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100255 case MBEDTLS_ERR_MD_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100256 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskinea5905292018-02-07 20:59:33 +0100257 case MBEDTLS_ERR_MD_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100258 return PSA_ERROR_STORAGE_FAILURE;
Gilles Peskinea5905292018-02-07 20:59:33 +0100259
Gilles Peskinef76aa772018-10-29 19:24:33 +0100260 case MBEDTLS_ERR_MPI_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100261 return PSA_ERROR_STORAGE_FAILURE;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100262 case MBEDTLS_ERR_MPI_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100263 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100264 case MBEDTLS_ERR_MPI_INVALID_CHARACTER:
Gilles Peskine449bd832023-01-11 14:50:10 +0100265 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100266 case MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100267 return PSA_ERROR_BUFFER_TOO_SMALL;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100268 case MBEDTLS_ERR_MPI_NEGATIVE_VALUE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100269 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100270 case MBEDTLS_ERR_MPI_DIVISION_BY_ZERO:
Gilles Peskine449bd832023-01-11 14:50:10 +0100271 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100272 case MBEDTLS_ERR_MPI_NOT_ACCEPTABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100273 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100274 case MBEDTLS_ERR_MPI_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100275 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100276
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100277 case MBEDTLS_ERR_PK_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100278 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100279 case MBEDTLS_ERR_PK_TYPE_MISMATCH:
280 case MBEDTLS_ERR_PK_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100281 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100282 case MBEDTLS_ERR_PK_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100283 return PSA_ERROR_STORAGE_FAILURE;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100284 case MBEDTLS_ERR_PK_KEY_INVALID_VERSION:
285 case MBEDTLS_ERR_PK_KEY_INVALID_FORMAT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100286 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100287 case MBEDTLS_ERR_PK_UNKNOWN_PK_ALG:
Gilles Peskine449bd832023-01-11 14:50:10 +0100288 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100289 case MBEDTLS_ERR_PK_PASSWORD_REQUIRED:
290 case MBEDTLS_ERR_PK_PASSWORD_MISMATCH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100291 return PSA_ERROR_NOT_PERMITTED;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100292 case MBEDTLS_ERR_PK_INVALID_PUBKEY:
Gilles Peskine449bd832023-01-11 14:50:10 +0100293 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100294 case MBEDTLS_ERR_PK_INVALID_ALG:
295 case MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE:
296 case MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100297 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100298 case MBEDTLS_ERR_PK_SIG_LEN_MISMATCH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100299 return PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskinef9f1bdf2021-06-23 20:32:27 +0200300 case MBEDTLS_ERR_PK_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100301 return PSA_ERROR_BUFFER_TOO_SMALL;
Gilles Peskinea5905292018-02-07 20:59:33 +0100302
Gilles Peskineff2d2002019-05-06 15:26:23 +0200303 case MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100304 return PSA_ERROR_HARDWARE_FAILURE;
Gilles Peskineff2d2002019-05-06 15:26:23 +0200305 case MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100306 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskineff2d2002019-05-06 15:26:23 +0200307
Gilles Peskinea5905292018-02-07 20:59:33 +0100308 case MBEDTLS_ERR_RSA_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100309 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100310 case MBEDTLS_ERR_RSA_INVALID_PADDING:
Gilles Peskine449bd832023-01-11 14:50:10 +0100311 return PSA_ERROR_INVALID_PADDING;
Gilles Peskinea5905292018-02-07 20:59:33 +0100312 case MBEDTLS_ERR_RSA_KEY_GEN_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100313 return PSA_ERROR_HARDWARE_FAILURE;
Gilles Peskinea5905292018-02-07 20:59:33 +0100314 case MBEDTLS_ERR_RSA_KEY_CHECK_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100315 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100316 case MBEDTLS_ERR_RSA_PUBLIC_FAILED:
317 case MBEDTLS_ERR_RSA_PRIVATE_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100318 return PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100319 case MBEDTLS_ERR_RSA_VERIFY_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100320 return PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskinea5905292018-02-07 20:59:33 +0100321 case MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100322 return PSA_ERROR_BUFFER_TOO_SMALL;
Gilles Peskinea5905292018-02-07 20:59:33 +0100323 case MBEDTLS_ERR_RSA_RNG_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100324 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Manuel Pégourié-Gonnard93c08472021-04-15 12:23:55 +0200325
itayzafrir5c753392018-05-08 11:18:38 +0300326 case MBEDTLS_ERR_ECP_BAD_INPUT_DATA:
itayzafrir7b30f8b2018-05-09 16:07:36 +0300327 case MBEDTLS_ERR_ECP_INVALID_KEY:
Gilles Peskine449bd832023-01-11 14:50:10 +0100328 return PSA_ERROR_INVALID_ARGUMENT;
itayzafrir7b30f8b2018-05-09 16:07:36 +0300329 case MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100330 return PSA_ERROR_BUFFER_TOO_SMALL;
itayzafrir7b30f8b2018-05-09 16:07:36 +0300331 case MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100332 return PSA_ERROR_NOT_SUPPORTED;
itayzafrir7b30f8b2018-05-09 16:07:36 +0300333 case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH:
334 case MBEDTLS_ERR_ECP_VERIFY_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100335 return PSA_ERROR_INVALID_SIGNATURE;
itayzafrir7b30f8b2018-05-09 16:07:36 +0300336 case MBEDTLS_ERR_ECP_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100337 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskine40d81602020-11-25 00:09:47 +0100338 case MBEDTLS_ERR_ECP_RANDOM_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100339 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskine40d81602020-11-25 00:09:47 +0100340
Paul Elliott588f8ed2022-12-02 18:10:26 +0000341 case MBEDTLS_ERR_ECP_IN_PROGRESS:
342 return PSA_OPERATION_INCOMPLETE;
343
Janos Follatha13b9052019-11-22 12:48:59 +0000344 case MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100345 return PSA_ERROR_CORRUPTION_DETECTED;
itayzafrir5c753392018-05-08 11:18:38 +0300346
Gilles Peskinee59236f2018-01-27 23:32:46 +0100347 default:
Gilles Peskine449bd832023-01-11 14:50:10 +0100348 return PSA_ERROR_GENERIC_ERROR;
Gilles Peskinee59236f2018-01-27 23:32:46 +0100349 }
350}
351
Paul Elliottdc42ca82023-02-24 18:11:59 +0000352/**
353 * \brief For output buffers which contain "tags"
354 * (outputs that may be checked for validity like
355 * hashes, MACs and signatures), fill the unused
356 * part of the output buffer (the whole buffer on
357 * error, the trailing part on success) with
358 * something that isn't a valid tag (barring an
359 * attack on the tag and deliberately-crafted
360 * input), in case the caller doesn't check the
361 * return status properly.
362 *
363 * \param output_buffer Pointer to buffer to wipe. May not be NULL
364 * unless \p output_buffer_size is zero.
365 * \param status Status of function called to generate
366 * output_buffer originally
367 * \param output_buffer_size Size of output buffer. If zero, \p output_buffer
368 * could be NULL.
369 * \param output_buffer_length Length of data written to output_buffer, must be
370 * less than \p output_buffer_size
371 */
372static void psa_wipe_tag_output_buffer(uint8_t *output_buffer, psa_status_t status,
Paul Elliott7118d172023-02-26 16:57:05 +0000373 size_t output_buffer_size, size_t output_buffer_length)
374{
Paul Elliottdc42ca82023-02-24 18:11:59 +0000375 size_t offset = 0;
376
377 if (output_buffer_size == 0) {
378 /* If output_buffer_size is 0 then we have nothing to do. We must not
379 call memset because output_buffer may be NULL in this case */
380 return;
381 }
382
383 if (status == PSA_SUCCESS) {
384 offset = output_buffer_length;
385 }
386
387 memset(output_buffer + offset, '!', output_buffer_size - offset);
388}
389
Gilles Peskineb0b255c2018-07-06 17:01:38 +0200390
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +0200391
392
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100393/****************************************************************/
394/* Key management */
395/****************************************************************/
396
Valerio Settid4a5d462023-04-05 18:19:01 +0200397#if defined(MBEDTLS_ECP_LIGHT)
Gilles Peskine449bd832023-01-11 14:50:10 +0100398mbedtls_ecp_group_id mbedtls_ecc_group_of_psa(psa_ecc_family_t curve,
399 size_t bits,
400 int bits_is_sloppy)
Gilles Peskine12313cd2018-06-20 00:20:32 +0200401{
Gilles Peskine449bd832023-01-11 14:50:10 +0100402 switch (curve) {
Paul Elliott8ff510a2020-06-02 17:19:28 +0100403 case PSA_ECC_FAMILY_SECP_R1:
Gilles Peskine449bd832023-01-11 14:50:10 +0100404 switch (bits) {
Gilles Peskinea1684f42021-03-23 13:12:34 +0100405#if defined(PSA_WANT_ECC_SECP_R1_192)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100406 case 192:
Gilles Peskine449bd832023-01-11 14:50:10 +0100407 return MBEDTLS_ECP_DP_SECP192R1;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100408#endif
409#if defined(PSA_WANT_ECC_SECP_R1_224)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100410 case 224:
Gilles Peskine449bd832023-01-11 14:50:10 +0100411 return MBEDTLS_ECP_DP_SECP224R1;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100412#endif
413#if defined(PSA_WANT_ECC_SECP_R1_256)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100414 case 256:
Gilles Peskine449bd832023-01-11 14:50:10 +0100415 return MBEDTLS_ECP_DP_SECP256R1;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100416#endif
417#if defined(PSA_WANT_ECC_SECP_R1_384)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100418 case 384:
Gilles Peskine449bd832023-01-11 14:50:10 +0100419 return MBEDTLS_ECP_DP_SECP384R1;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100420#endif
421#if defined(PSA_WANT_ECC_SECP_R1_521)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100422 case 521:
Gilles Peskine449bd832023-01-11 14:50:10 +0100423 return MBEDTLS_ECP_DP_SECP521R1;
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100424 case 528:
Gilles Peskine449bd832023-01-11 14:50:10 +0100425 if (bits_is_sloppy) {
426 return MBEDTLS_ECP_DP_SECP521R1;
427 }
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100428 break;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100429#endif
Gilles Peskine228abc52019-12-03 17:24:19 +0100430 }
431 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100432
Paul Elliott8ff510a2020-06-02 17:19:28 +0100433 case PSA_ECC_FAMILY_BRAINPOOL_P_R1:
Gilles Peskine449bd832023-01-11 14:50:10 +0100434 switch (bits) {
Gilles Peskinea1684f42021-03-23 13:12:34 +0100435#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100436 case 256:
Gilles Peskine449bd832023-01-11 14:50:10 +0100437 return MBEDTLS_ECP_DP_BP256R1;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100438#endif
439#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100440 case 384:
Gilles Peskine449bd832023-01-11 14:50:10 +0100441 return MBEDTLS_ECP_DP_BP384R1;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100442#endif
443#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100444 case 512:
Gilles Peskine449bd832023-01-11 14:50:10 +0100445 return MBEDTLS_ECP_DP_BP512R1;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100446#endif
Gilles Peskine228abc52019-12-03 17:24:19 +0100447 }
448 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100449
Paul Elliott8ff510a2020-06-02 17:19:28 +0100450 case PSA_ECC_FAMILY_MONTGOMERY:
Gilles Peskine449bd832023-01-11 14:50:10 +0100451 switch (bits) {
Gilles Peskinea1684f42021-03-23 13:12:34 +0100452#if defined(PSA_WANT_ECC_MONTGOMERY_255)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100453 case 255:
Gilles Peskine449bd832023-01-11 14:50:10 +0100454 return MBEDTLS_ECP_DP_CURVE25519;
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100455 case 256:
Gilles Peskine449bd832023-01-11 14:50:10 +0100456 if (bits_is_sloppy) {
457 return MBEDTLS_ECP_DP_CURVE25519;
458 }
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100459 break;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100460#endif
461#if defined(PSA_WANT_ECC_MONTGOMERY_448)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100462 case 448:
Gilles Peskine449bd832023-01-11 14:50:10 +0100463 return MBEDTLS_ECP_DP_CURVE448;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100464#endif
Gilles Peskine228abc52019-12-03 17:24:19 +0100465 }
466 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100467
Paul Elliott8ff510a2020-06-02 17:19:28 +0100468 case PSA_ECC_FAMILY_SECP_K1:
Gilles Peskine449bd832023-01-11 14:50:10 +0100469 switch (bits) {
Gilles Peskinea1684f42021-03-23 13:12:34 +0100470#if defined(PSA_WANT_ECC_SECP_K1_192)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100471 case 192:
Gilles Peskine449bd832023-01-11 14:50:10 +0100472 return MBEDTLS_ECP_DP_SECP192K1;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100473#endif
474#if defined(PSA_WANT_ECC_SECP_K1_224)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100475 case 224:
Gilles Peskine449bd832023-01-11 14:50:10 +0100476 return MBEDTLS_ECP_DP_SECP224K1;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100477#endif
478#if defined(PSA_WANT_ECC_SECP_K1_256)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100479 case 256:
Gilles Peskine449bd832023-01-11 14:50:10 +0100480 return MBEDTLS_ECP_DP_SECP256K1;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100481#endif
Gilles Peskine228abc52019-12-03 17:24:19 +0100482 }
483 break;
Gilles Peskine12313cd2018-06-20 00:20:32 +0200484 }
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100485
Gilles Peskine71f45ba2021-03-23 14:17:55 +0100486 (void) bits_is_sloppy;
Gilles Peskine449bd832023-01-11 14:50:10 +0100487 return MBEDTLS_ECP_DP_NONE;
Gilles Peskine12313cd2018-06-20 00:20:32 +0200488}
Valerio Settid4a5d462023-04-05 18:19:01 +0200489#endif /* MBEDTLS_ECP_LIGHT */
Gilles Peskine12313cd2018-06-20 00:20:32 +0200490
Gilles Peskine449bd832023-01-11 14:50:10 +0100491psa_status_t psa_validate_unstructured_key_bit_size(psa_key_type_t type,
492 size_t bits)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200493{
494 /* Check that the bit size is acceptable for the key type */
Gilles Peskine449bd832023-01-11 14:50:10 +0100495 switch (type) {
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200496 case PSA_KEY_TYPE_RAW_DATA:
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200497 case PSA_KEY_TYPE_HMAC:
Gilles Peskineea0fb492018-07-12 17:17:20 +0200498 case PSA_KEY_TYPE_DERIVE:
Neil Armstrong4b5710f2022-05-25 11:30:27 +0200499 case PSA_KEY_TYPE_PASSWORD:
500 case PSA_KEY_TYPE_PASSWORD_HASH:
Gilles Peskineea0fb492018-07-12 17:17:20 +0200501 break;
Ronald Cron1f0db802021-03-12 09:59:30 +0100502#if defined(PSA_WANT_KEY_TYPE_AES)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200503 case PSA_KEY_TYPE_AES:
Gilles Peskine449bd832023-01-11 14:50:10 +0100504 if (bits != 128 && bits != 192 && bits != 256) {
505 return PSA_ERROR_INVALID_ARGUMENT;
506 }
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200507 break;
508#endif
Gilles Peskine6c12a1e2021-09-21 11:59:39 +0200509#if defined(PSA_WANT_KEY_TYPE_ARIA)
510 case PSA_KEY_TYPE_ARIA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100511 if (bits != 128 && bits != 192 && bits != 256) {
512 return PSA_ERROR_INVALID_ARGUMENT;
513 }
Gilles Peskine6c12a1e2021-09-21 11:59:39 +0200514 break;
515#endif
Ronald Cron1f0db802021-03-12 09:59:30 +0100516#if defined(PSA_WANT_KEY_TYPE_CAMELLIA)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200517 case PSA_KEY_TYPE_CAMELLIA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100518 if (bits != 128 && bits != 192 && bits != 256) {
519 return PSA_ERROR_INVALID_ARGUMENT;
520 }
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200521 break;
522#endif
Ronald Cron1f0db802021-03-12 09:59:30 +0100523#if defined(PSA_WANT_KEY_TYPE_DES)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200524 case PSA_KEY_TYPE_DES:
Gilles Peskine449bd832023-01-11 14:50:10 +0100525 if (bits != 64 && bits != 128 && bits != 192) {
526 return PSA_ERROR_INVALID_ARGUMENT;
527 }
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200528 break;
529#endif
Ronald Cron1f0db802021-03-12 09:59:30 +0100530#if defined(PSA_WANT_KEY_TYPE_CHACHA20)
Gilles Peskine26869f22019-05-06 15:25:00 +0200531 case PSA_KEY_TYPE_CHACHA20:
Gilles Peskine449bd832023-01-11 14:50:10 +0100532 if (bits != 256) {
533 return PSA_ERROR_INVALID_ARGUMENT;
534 }
Gilles Peskine26869f22019-05-06 15:25:00 +0200535 break;
536#endif
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200537 default:
Gilles Peskine449bd832023-01-11 14:50:10 +0100538 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200539 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100540 if (bits % 8 != 0) {
541 return PSA_ERROR_INVALID_ARGUMENT;
542 }
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200543
Gilles Peskine449bd832023-01-11 14:50:10 +0100544 return PSA_SUCCESS;
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200545}
546
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100547/** Check whether a given key type is valid for use with a given MAC algorithm
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100548 *
Steven Cooremancd640932021-03-08 12:00:27 +0100549 * Upon successful return of this function, the behavior of #PSA_MAC_LENGTH
550 * when called with the validated \p algorithm and \p key_type is well-defined.
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100551 *
552 * \param[in] algorithm The specific MAC algorithm (can be wildcard).
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100553 * \param[in] key_type The key type of the key to be used with the
554 * \p algorithm.
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100555 *
556 * \retval #PSA_SUCCESS
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100557 * The \p key_type is valid for use with the \p algorithm
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100558 * \retval #PSA_ERROR_INVALID_ARGUMENT
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100559 * The \p key_type is not valid for use with the \p algorithm
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100560 */
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100561MBEDTLS_STATIC_TESTABLE psa_status_t psa_mac_key_can_do(
Steven Cooreman58c94d32021-03-02 21:31:17 +0100562 psa_algorithm_t algorithm,
Gilles Peskine449bd832023-01-11 14:50:10 +0100563 psa_key_type_t key_type)
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100564{
Gilles Peskine449bd832023-01-11 14:50:10 +0100565 if (PSA_ALG_IS_HMAC(algorithm)) {
566 if (key_type == PSA_KEY_TYPE_HMAC) {
567 return PSA_SUCCESS;
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100568 }
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100569 }
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100570
Gilles Peskine449bd832023-01-11 14:50:10 +0100571 if (PSA_ALG_IS_BLOCK_CIPHER_MAC(algorithm)) {
572 /* Check that we're calling PSA_BLOCK_CIPHER_BLOCK_LENGTH with a cipher
573 * key. */
574 if ((key_type & PSA_KEY_TYPE_CATEGORY_MASK) ==
575 PSA_KEY_TYPE_CATEGORY_SYMMETRIC) {
576 /* PSA_BLOCK_CIPHER_BLOCK_LENGTH returns 1 for stream ciphers and
577 * the block length (larger than 1) for block ciphers. */
578 if (PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type) > 1) {
579 return PSA_SUCCESS;
580 }
581 }
582 }
583
584 return PSA_ERROR_INVALID_ARGUMENT;
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100585}
586
Gilles Peskine449bd832023-01-11 14:50:10 +0100587psa_status_t psa_allocate_buffer_to_slot(psa_key_slot_t *slot,
588 size_t buffer_length)
Steven Cooreman75b74362020-07-28 14:30:13 +0200589{
Gilles Peskine449bd832023-01-11 14:50:10 +0100590 if (slot->key.data != NULL) {
591 return PSA_ERROR_ALREADY_EXISTS;
592 }
Steven Cooreman75b74362020-07-28 14:30:13 +0200593
Gilles Peskine449bd832023-01-11 14:50:10 +0100594 slot->key.data = mbedtls_calloc(1, buffer_length);
595 if (slot->key.data == NULL) {
596 return PSA_ERROR_INSUFFICIENT_MEMORY;
597 }
Steven Cooreman75b74362020-07-28 14:30:13 +0200598
Ronald Cronea0f8a62020-11-25 17:52:23 +0100599 slot->key.bytes = buffer_length;
Gilles Peskine449bd832023-01-11 14:50:10 +0100600 return PSA_SUCCESS;
Steven Cooreman75b74362020-07-28 14:30:13 +0200601}
602
Gilles Peskine449bd832023-01-11 14:50:10 +0100603psa_status_t psa_copy_key_material_into_slot(psa_key_slot_t *slot,
604 const uint8_t *data,
605 size_t data_length)
Steven Cooremanf7cebd42020-10-13 20:27:40 +0200606{
Gilles Peskine449bd832023-01-11 14:50:10 +0100607 psa_status_t status = psa_allocate_buffer_to_slot(slot,
608 data_length);
609 if (status != PSA_SUCCESS) {
610 return status;
611 }
Steven Cooremanf7cebd42020-10-13 20:27:40 +0200612
Gilles Peskine449bd832023-01-11 14:50:10 +0100613 memcpy(slot->key.data, data, data_length);
614 return PSA_SUCCESS;
Steven Cooremanf7cebd42020-10-13 20:27:40 +0200615}
616
Ronald Crona0fe59f2020-11-29 11:14:53 +0100617psa_status_t psa_import_key_into_slot(
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100618 const psa_key_attributes_t *attributes,
619 const uint8_t *data, size_t data_length,
620 uint8_t *key_buffer, size_t key_buffer_size,
Gilles Peskine449bd832023-01-11 14:50:10 +0100621 size_t *key_buffer_length, size_t *bits)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100622{
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100623 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
624 psa_key_type_t type = attributes->core.type;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100625
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200626 /* zero-length keys are never supported. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100627 if (data_length == 0) {
628 return PSA_ERROR_NOT_SUPPORTED;
629 }
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200630
Gilles Peskine449bd832023-01-11 14:50:10 +0100631 if (key_type_is_raw_bytes(type)) {
632 *bits = PSA_BYTES_TO_BITS(data_length);
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200633
Gilles Peskine449bd832023-01-11 14:50:10 +0100634 status = psa_validate_unstructured_key_bit_size(attributes->core.type,
635 *bits);
636 if (status != PSA_SUCCESS) {
637 return status;
638 }
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200639
Ronald Crondd04d422020-11-28 15:14:42 +0100640 /* Copy the key material. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100641 memcpy(key_buffer, data, data_length);
Ronald Crondd04d422020-11-28 15:14:42 +0100642 *key_buffer_length = data_length;
Gilles Peskine449bd832023-01-11 14:50:10 +0100643 (void) key_buffer_size;
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200644
Gilles Peskine449bd832023-01-11 14:50:10 +0100645 return PSA_SUCCESS;
646 } else if (PSA_KEY_TYPE_IS_ASYMMETRIC(type)) {
Przemek Stekiel6d85afa2023-04-28 11:42:17 +0200647#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR) || \
648 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY)
Przemek Stekiel472b3f32022-12-01 14:38:49 +0100649 if (PSA_KEY_TYPE_IS_DH(type)) {
Przemek Stekield1cf1ba2023-04-27 12:04:21 +0200650 if (psa_is_dh_key_size_valid(PSA_BYTES_TO_BITS(data_length)) == 0) {
Przemek Stekiel472b3f32022-12-01 14:38:49 +0100651 return PSA_ERROR_INVALID_ARGUMENT;
652 }
653
654 /* Copy the key material. */
655 memcpy(key_buffer, data, data_length);
656 *key_buffer_length = data_length;
657 *bits = PSA_BYTES_TO_BITS(data_length);
658 (void) key_buffer_size;
659
660 return PSA_SUCCESS;
661 }
Przemek Stekiel6d85afa2023-04-28 11:42:17 +0200662#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR) ||
663 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) */
John Durkop9814fa22020-11-04 12:28:15 -0800664#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
Gilles Peskine449bd832023-01-11 14:50:10 +0100665 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
666 if (PSA_KEY_TYPE_IS_ECC(type)) {
667 return mbedtls_psa_ecp_import_key(attributes,
668 data, data_length,
669 key_buffer, key_buffer_size,
670 key_buffer_length,
671 bits);
Steven Cooreman40120f62020-10-29 11:42:22 +0100672 }
John Durkop9814fa22020-11-04 12:28:15 -0800673#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
674 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
John Durkop0e005192020-10-31 22:06:54 -0700675#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
Gilles Peskine449bd832023-01-11 14:50:10 +0100676 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
677 if (PSA_KEY_TYPE_IS_RSA(type)) {
678 return mbedtls_psa_rsa_import_key(attributes,
679 data, data_length,
680 key_buffer, key_buffer_size,
681 key_buffer_length,
682 bits);
Steven Cooreman3ea0ce42020-10-23 11:37:05 +0200683 }
John Durkop9814fa22020-11-04 12:28:15 -0800684#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
685 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100686 }
Steven Cooreman40120f62020-10-29 11:42:22 +0100687
Gilles Peskine449bd832023-01-11 14:50:10 +0100688 return PSA_ERROR_NOT_SUPPORTED;
Darryl Green06fd18d2018-07-16 11:21:11 +0100689}
690
Gilles Peskinef603c712019-01-19 13:40:11 +0100691/** Calculate the intersection of two algorithm usage policies.
692 *
693 * Return 0 (which allows no operation) on incompatibility.
694 */
695static psa_algorithm_t psa_key_policy_algorithm_intersection(
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100696 psa_key_type_t key_type,
Gilles Peskinef603c712019-01-19 13:40:11 +0100697 psa_algorithm_t alg1,
Gilles Peskine449bd832023-01-11 14:50:10 +0100698 psa_algorithm_t alg2)
Gilles Peskinef603c712019-01-19 13:40:11 +0100699{
Gilles Peskine549ea862019-05-22 11:45:59 +0200700 /* Common case: both sides actually specify the same policy. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100701 if (alg1 == alg2) {
702 return alg1;
703 }
Steven Cooreman03488022021-02-18 12:07:20 +0100704 /* If the policies are from the same hash-and-sign family, check
705 * if one is a wildcard. If so the other has the specific algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100706 if (PSA_ALG_IS_SIGN_HASH(alg1) &&
707 PSA_ALG_IS_SIGN_HASH(alg2) &&
708 (alg1 & ~PSA_ALG_HASH_MASK) == (alg2 & ~PSA_ALG_HASH_MASK)) {
709 if (PSA_ALG_SIGN_GET_HASH(alg1) == PSA_ALG_ANY_HASH) {
710 return alg2;
711 }
712 if (PSA_ALG_SIGN_GET_HASH(alg2) == PSA_ALG_ANY_HASH) {
713 return alg1;
714 }
Steven Cooreman03488022021-02-18 12:07:20 +0100715 }
716 /* If the policies are from the same AEAD family, check whether
Steven Cooreman7de9e2d2021-02-22 17:05:56 +0100717 * one of them is a minimum-tag-length wildcard. Calculate the most
Steven Cooreman03488022021-02-18 12:07:20 +0100718 * restrictive tag length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100719 if (PSA_ALG_IS_AEAD(alg1) && PSA_ALG_IS_AEAD(alg2) &&
720 (PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg1, 0) ==
721 PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg2, 0))) {
722 size_t alg1_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg1);
723 size_t alg2_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg2);
Steven Cooremancd640932021-03-08 12:00:27 +0100724 size_t restricted_len = alg1_len > alg2_len ? alg1_len : alg2_len;
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100725
Steven Cooreman7de9e2d2021-02-22 17:05:56 +0100726 /* If both are wildcards, return most restrictive wildcard */
Gilles Peskine449bd832023-01-11 14:50:10 +0100727 if (((alg1 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
728 ((alg2 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0)) {
729 return PSA_ALG_AEAD_WITH_AT_LEAST_THIS_LENGTH_TAG(
730 alg1, restricted_len);
Steven Cooreman03488022021-02-18 12:07:20 +0100731 }
732 /* If only one is a wildcard, return specific algorithm if compatible. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100733 if (((alg1 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
734 (alg1_len <= alg2_len)) {
735 return alg2;
Steven Cooreman03488022021-02-18 12:07:20 +0100736 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100737 if (((alg2 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
738 (alg2_len <= alg1_len)) {
739 return alg1;
Steven Cooreman03488022021-02-18 12:07:20 +0100740 }
741 }
742 /* If the policies are from the same MAC family, check whether one
743 * of them is a minimum-MAC-length policy. Calculate the most
744 * restrictive tag length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100745 if (PSA_ALG_IS_MAC(alg1) && PSA_ALG_IS_MAC(alg2) &&
746 (PSA_ALG_FULL_LENGTH_MAC(alg1) ==
747 PSA_ALG_FULL_LENGTH_MAC(alg2))) {
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100748 /* Validate the combination of key type and algorithm. Since the base
749 * algorithm of alg1 and alg2 are the same, we only need this once. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100750 if (PSA_SUCCESS != psa_mac_key_can_do(alg1, key_type)) {
751 return 0;
752 }
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100753
Steven Cooreman31a876d2021-03-03 20:47:40 +0100754 /* Get the (exact or at-least) output lengths for both sides of the
755 * requested intersection. None of the currently supported algorithms
756 * have an output length dependent on the actual key size, so setting it
757 * to a bogus value of 0 is currently OK.
758 *
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100759 * Note that for at-least-this-length wildcard algorithms, the output
760 * length is set to the shortest allowed length, which allows us to
761 * calculate the most restrictive tag length for the intersection. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100762 size_t alg1_len = PSA_MAC_LENGTH(key_type, 0, alg1);
763 size_t alg2_len = PSA_MAC_LENGTH(key_type, 0, alg2);
Steven Cooremancd640932021-03-08 12:00:27 +0100764 size_t restricted_len = alg1_len > alg2_len ? alg1_len : alg2_len;
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100765
Steven Cooremana1d83222021-02-25 10:20:29 +0100766 /* If both are wildcards, return most restrictive wildcard */
Gilles Peskine449bd832023-01-11 14:50:10 +0100767 if (((alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
768 ((alg2 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0)) {
769 return PSA_ALG_AT_LEAST_THIS_LENGTH_MAC(alg1, restricted_len);
Steven Cooreman03488022021-02-18 12:07:20 +0100770 }
Steven Cooreman31a876d2021-03-03 20:47:40 +0100771
772 /* If only one is an at-least-this-length policy, the intersection would
773 * be the other (fixed-length) policy as long as said fixed length is
774 * equal to or larger than the shortest allowed length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100775 if ((alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) {
776 return (alg1_len <= alg2_len) ? alg2 : 0;
Steven Cooreman03488022021-02-18 12:07:20 +0100777 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100778 if ((alg2 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) {
779 return (alg2_len <= alg1_len) ? alg1 : 0;
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100780 }
Steven Cooreman31a876d2021-03-03 20:47:40 +0100781
Steven Cooremancd640932021-03-08 12:00:27 +0100782 /* If none of them are wildcards, check whether they define the same tag
783 * length. This is still possible here when one is default-length and
784 * the other specific-length. Ensure to always return the
785 * specific-length version for the intersection. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100786 if (alg1_len == alg2_len) {
787 return PSA_ALG_TRUNCATED_MAC(alg1, alg1_len);
788 }
Gilles Peskinef603c712019-01-19 13:40:11 +0100789 }
790 /* If the policies are incompatible, allow nothing. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100791 return 0;
Gilles Peskinef603c712019-01-19 13:40:11 +0100792}
793
Gilles Peskine449bd832023-01-11 14:50:10 +0100794static int psa_key_algorithm_permits(psa_key_type_t key_type,
795 psa_algorithm_t policy_alg,
796 psa_algorithm_t requested_alg)
Gilles Peskined6f371b2019-05-10 19:33:38 +0200797{
Gilles Peskine549ea862019-05-22 11:45:59 +0200798 /* Common case: the policy only allows requested_alg. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100799 if (requested_alg == policy_alg) {
800 return 1;
801 }
Steven Cooreman03488022021-02-18 12:07:20 +0100802 /* If policy_alg is a hash-and-sign with a wildcard for the hash,
803 * and requested_alg is the same hash-and-sign family with any hash,
804 * then requested_alg is compliant with policy_alg. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100805 if (PSA_ALG_IS_SIGN_HASH(requested_alg) &&
806 PSA_ALG_SIGN_GET_HASH(policy_alg) == PSA_ALG_ANY_HASH) {
807 return (policy_alg & ~PSA_ALG_HASH_MASK) ==
808 (requested_alg & ~PSA_ALG_HASH_MASK);
Steven Cooreman03488022021-02-18 12:07:20 +0100809 }
810 /* If policy_alg is a wildcard AEAD algorithm of the same base as
811 * the requested algorithm, check the requested tag length to be
812 * equal-length or longer than the wildcard-specified length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100813 if (PSA_ALG_IS_AEAD(policy_alg) &&
814 PSA_ALG_IS_AEAD(requested_alg) &&
815 (PSA_ALG_AEAD_WITH_SHORTENED_TAG(policy_alg, 0) ==
816 PSA_ALG_AEAD_WITH_SHORTENED_TAG(requested_alg, 0)) &&
817 ((policy_alg & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0)) {
818 return PSA_ALG_AEAD_GET_TAG_LENGTH(policy_alg) <=
819 PSA_ALG_AEAD_GET_TAG_LENGTH(requested_alg);
Steven Cooreman03488022021-02-18 12:07:20 +0100820 }
Steven Cooremancd640932021-03-08 12:00:27 +0100821 /* If policy_alg is a MAC algorithm of the same base as the requested
822 * algorithm, check whether their MAC lengths are compatible. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100823 if (PSA_ALG_IS_MAC(policy_alg) &&
824 PSA_ALG_IS_MAC(requested_alg) &&
825 (PSA_ALG_FULL_LENGTH_MAC(policy_alg) ==
826 PSA_ALG_FULL_LENGTH_MAC(requested_alg))) {
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100827 /* Validate the combination of key type and algorithm. Since the policy
828 * and requested algorithms are the same, we only need this once. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100829 if (PSA_SUCCESS != psa_mac_key_can_do(policy_alg, key_type)) {
830 return 0;
831 }
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100832
Steven Cooreman31a876d2021-03-03 20:47:40 +0100833 /* Get both the requested output length for the algorithm which is to be
834 * verified, and the default output length for the base algorithm.
835 * Note that none of the currently supported algorithms have an output
836 * length dependent on actual key size, so setting it to a bogus value
837 * of 0 is currently OK. */
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100838 size_t requested_output_length = PSA_MAC_LENGTH(
Gilles Peskine449bd832023-01-11 14:50:10 +0100839 key_type, 0, requested_alg);
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100840 size_t default_output_length = PSA_MAC_LENGTH(
Gilles Peskine449bd832023-01-11 14:50:10 +0100841 key_type, 0,
842 PSA_ALG_FULL_LENGTH_MAC(requested_alg));
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100843
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100844 /* If the policy is default-length, only allow an algorithm with
845 * a declared exact-length matching the default. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100846 if (PSA_MAC_TRUNCATED_LENGTH(policy_alg) == 0) {
847 return requested_output_length == default_output_length;
848 }
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100849
850 /* If the requested algorithm is default-length, allow it if the policy
Steven Cooremancd640932021-03-08 12:00:27 +0100851 * length exactly matches the default length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100852 if (PSA_MAC_TRUNCATED_LENGTH(requested_alg) == 0 &&
853 PSA_MAC_TRUNCATED_LENGTH(policy_alg) == default_output_length) {
854 return 1;
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100855 }
856
Steven Cooremancd640932021-03-08 12:00:27 +0100857 /* If policy_alg is an at-least-this-length wildcard MAC algorithm,
858 * check for the requested MAC length to be equal to or longer than the
859 * minimum allowed length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100860 if ((policy_alg & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) {
861 return PSA_MAC_TRUNCATED_LENGTH(policy_alg) <=
862 requested_output_length;
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100863 }
Gilles Peskined6f371b2019-05-10 19:33:38 +0200864 }
Steven Cooremance48e852020-10-05 16:02:45 +0200865 /* If policy_alg is a generic key agreement operation, then using it for
Steven Cooremanfa5e6312020-10-15 17:07:12 +0200866 * a key derivation with that key agreement should also be allowed. This
867 * behaviour is expected to be defined in a future specification version. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100868 if (PSA_ALG_IS_RAW_KEY_AGREEMENT(policy_alg) &&
869 PSA_ALG_IS_KEY_AGREEMENT(requested_alg)) {
870 return PSA_ALG_KEY_AGREEMENT_GET_BASE(requested_alg) ==
871 policy_alg;
Steven Cooremance48e852020-10-05 16:02:45 +0200872 }
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100873 /* If it isn't explicitly permitted, it's forbidden. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100874 return 0;
Gilles Peskined6f371b2019-05-10 19:33:38 +0200875}
876
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100877/** Test whether a policy permits an algorithm.
878 *
879 * The caller must test usage flags separately.
Steven Cooreman7e39f052021-02-23 14:18:32 +0100880 *
Steven Cooreman5a172672021-03-02 21:27:42 +0100881 * \note This function requires providing the key type for which the policy is
882 * being validated, since some algorithm policy definitions (e.g. MAC)
883 * have different properties depending on what kind of cipher it is
884 * combined with.
885 *
Steven Cooreman7e39f052021-02-23 14:18:32 +0100886 * \retval PSA_SUCCESS When \p alg is a specific algorithm
887 * allowed by the \p policy.
888 * \retval PSA_ERROR_INVALID_ARGUMENT When \p alg is not a specific algorithm
889 * \retval PSA_ERROR_NOT_PERMITTED When \p alg is a specific algorithm, but
890 * the \p policy does not allow it.
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100891 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100892static psa_status_t psa_key_policy_permits(const psa_key_policy_t *policy,
893 psa_key_type_t key_type,
894 psa_algorithm_t alg)
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100895{
Steven Cooremand788fab2021-02-25 11:29:17 +0100896 /* '0' is not a valid algorithm */
Gilles Peskine449bd832023-01-11 14:50:10 +0100897 if (alg == 0) {
898 return PSA_ERROR_INVALID_ARGUMENT;
899 }
Steven Cooremand788fab2021-02-25 11:29:17 +0100900
Steven Cooreman7e39f052021-02-23 14:18:32 +0100901 /* A requested algorithm cannot be a wildcard. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100902 if (PSA_ALG_IS_WILDCARD(alg)) {
903 return PSA_ERROR_INVALID_ARGUMENT;
904 }
Steven Cooreman7e39f052021-02-23 14:18:32 +0100905
Gilles Peskine449bd832023-01-11 14:50:10 +0100906 if (psa_key_algorithm_permits(key_type, policy->alg, alg) ||
907 psa_key_algorithm_permits(key_type, policy->alg2, alg)) {
908 return PSA_SUCCESS;
909 } else {
910 return PSA_ERROR_NOT_PERMITTED;
911 }
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100912}
913
Gilles Peskinef603c712019-01-19 13:40:11 +0100914/** Restrict a key policy based on a constraint.
915 *
Steven Cooreman5a172672021-03-02 21:27:42 +0100916 * \note This function requires providing the key type for which the policy is
917 * being restricted, since some algorithm policy definitions (e.g. MAC)
918 * have different properties depending on what kind of cipher it is
919 * combined with.
920 *
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100921 * \param[in] key_type The key type for which to restrict the policy
Gilles Peskinef603c712019-01-19 13:40:11 +0100922 * \param[in,out] policy The policy to restrict.
923 * \param[in] constraint The policy constraint to apply.
924 *
925 * \retval #PSA_SUCCESS
926 * \c *policy contains the intersection of the original value of
927 * \c *policy and \c *constraint.
928 * \retval #PSA_ERROR_INVALID_ARGUMENT
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100929 * \c key_type, \c *policy and \c *constraint are incompatible.
Gilles Peskinef603c712019-01-19 13:40:11 +0100930 * \c *policy is unchanged.
931 */
932static psa_status_t psa_restrict_key_policy(
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100933 psa_key_type_t key_type,
Gilles Peskinef603c712019-01-19 13:40:11 +0100934 psa_key_policy_t *policy,
Gilles Peskine449bd832023-01-11 14:50:10 +0100935 const psa_key_policy_t *constraint)
Gilles Peskinef603c712019-01-19 13:40:11 +0100936{
937 psa_algorithm_t intersection_alg =
Gilles Peskine449bd832023-01-11 14:50:10 +0100938 psa_key_policy_algorithm_intersection(key_type, policy->alg,
939 constraint->alg);
Gilles Peskined6f371b2019-05-10 19:33:38 +0200940 psa_algorithm_t intersection_alg2 =
Gilles Peskine449bd832023-01-11 14:50:10 +0100941 psa_key_policy_algorithm_intersection(key_type, policy->alg2,
942 constraint->alg2);
943 if (intersection_alg == 0 && policy->alg != 0 && constraint->alg != 0) {
944 return PSA_ERROR_INVALID_ARGUMENT;
945 }
946 if (intersection_alg2 == 0 && policy->alg2 != 0 && constraint->alg2 != 0) {
947 return PSA_ERROR_INVALID_ARGUMENT;
948 }
Gilles Peskinef603c712019-01-19 13:40:11 +0100949 policy->usage &= constraint->usage;
950 policy->alg = intersection_alg;
Gilles Peskined6f371b2019-05-10 19:33:38 +0200951 policy->alg2 = intersection_alg2;
Gilles Peskine449bd832023-01-11 14:50:10 +0100952 return PSA_SUCCESS;
Gilles Peskinef603c712019-01-19 13:40:11 +0100953}
954
Przemek Stekiel061f6942022-11-30 10:51:35 +0100955/** Get the description of a key given its identifier and policy constraints
956 * and lock it.
957 *
958 * The key must have allow all the usage flags set in \p usage. If \p alg is
959 * nonzero, the key must allow operations with this algorithm. If \p alg is
960 * zero, the algorithm is not checked.
961 *
962 * In case of a persistent key, the function loads the description of the key
963 * into a key slot if not already done.
964 *
965 * On success, the returned key slot is locked. It is the responsibility of
966 * the caller to unlock the key slot when it does not access it anymore.
967 */
968static psa_status_t psa_get_and_lock_key_slot_with_policy(
Ronald Cron5c522922020-11-14 16:35:34 +0100969 mbedtls_svc_key_id_t key,
970 psa_key_slot_t **p_slot,
971 psa_key_usage_t usage,
Gilles Peskine449bd832023-01-11 14:50:10 +0100972 psa_algorithm_t alg)
Darryl Green06fd18d2018-07-16 11:21:11 +0100973{
Ronald Cronf95a2b12020-10-22 15:24:49 +0200974 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel9a5b8122022-12-22 13:34:47 +0100975 psa_key_slot_t *slot = NULL;
Darryl Green06fd18d2018-07-16 11:21:11 +0100976
Gilles Peskine449bd832023-01-11 14:50:10 +0100977 status = psa_get_and_lock_key_slot(key, p_slot);
978 if (status != PSA_SUCCESS) {
979 return status;
980 }
Ronald Cronf95a2b12020-10-22 15:24:49 +0200981 slot = *p_slot;
Darryl Green06fd18d2018-07-16 11:21:11 +0100982
983 /* Enforce that usage policy for the key slot contains all the flags
984 * required by the usage parameter. There is one exception: public
985 * keys can always be exported, so we treat public key objects as
986 * if they had the export flag. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100987 if (PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type)) {
Darryl Green06fd18d2018-07-16 11:21:11 +0100988 usage &= ~PSA_KEY_USAGE_EXPORT;
Gilles Peskine449bd832023-01-11 14:50:10 +0100989 }
Ronald Cronf95a2b12020-10-22 15:24:49 +0200990
Gilles Peskine449bd832023-01-11 14:50:10 +0100991 if ((slot->attr.policy.usage & usage) != usage) {
Steven Cooreman328f11c2021-03-02 11:44:51 +0100992 status = PSA_ERROR_NOT_PERMITTED;
Ronald Cronf95a2b12020-10-22 15:24:49 +0200993 goto error;
Steven Cooreman328f11c2021-03-02 11:44:51 +0100994 }
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100995
Shaun Case8b0ecbc2021-12-20 21:14:10 -0800996 /* Enforce that the usage policy permits the requested algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100997 if (alg != 0) {
998 status = psa_key_policy_permits(&slot->attr.policy,
999 slot->attr.type,
1000 alg);
1001 if (status != PSA_SUCCESS) {
Steven Cooreman7e39f052021-02-23 14:18:32 +01001002 goto error;
Gilles Peskine449bd832023-01-11 14:50:10 +01001003 }
Steven Cooreman7e39f052021-02-23 14:18:32 +01001004 }
Darryl Green06fd18d2018-07-16 11:21:11 +01001005
Gilles Peskine449bd832023-01-11 14:50:10 +01001006 return PSA_SUCCESS;
Ronald Cronf95a2b12020-10-22 15:24:49 +02001007
1008error:
1009 *p_slot = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01001010 psa_unlock_key_slot(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02001011
Gilles Peskine449bd832023-01-11 14:50:10 +01001012 return status;
Darryl Green06fd18d2018-07-16 11:21:11 +01001013}
Darryl Green940d72c2018-07-13 13:18:51 +01001014
Ronald Cron5c522922020-11-14 16:35:34 +01001015/** Get a key slot containing a transparent key and lock it.
Gilles Peskine28f8f302019-07-24 13:30:31 +02001016 *
1017 * A transparent key is a key for which the key material is directly
Ronald Cronddae0f52021-08-24 15:39:44 +02001018 * available, as opposed to a key in a secure element and/or to be used
1019 * by a secure element.
Gilles Peskine28f8f302019-07-24 13:30:31 +02001020 *
Ronald Cronddae0f52021-08-24 15:39:44 +02001021 * This is a temporary function that may be used instead of
1022 * psa_get_and_lock_key_slot_with_policy() when there is no opaque key support
1023 * for a cryptographic operation.
Ronald Cronf95a2b12020-10-22 15:24:49 +02001024 *
Ronald Cron5c522922020-11-14 16:35:34 +01001025 * On success, the returned key slot is locked. It is the responsibility of the
1026 * caller to unlock the key slot when it does not access it anymore.
Gilles Peskine28f8f302019-07-24 13:30:31 +02001027 */
Ronald Cron5c522922020-11-14 16:35:34 +01001028static psa_status_t psa_get_and_lock_transparent_key_slot_with_policy(
1029 mbedtls_svc_key_id_t key,
1030 psa_key_slot_t **p_slot,
1031 psa_key_usage_t usage,
Gilles Peskine449bd832023-01-11 14:50:10 +01001032 psa_algorithm_t alg)
Gilles Peskine28f8f302019-07-24 13:30:31 +02001033{
Gilles Peskine449bd832023-01-11 14:50:10 +01001034 psa_status_t status = psa_get_and_lock_key_slot_with_policy(key, p_slot,
1035 usage, alg);
1036 if (status != PSA_SUCCESS) {
1037 return status;
Gilles Peskine28f8f302019-07-24 13:30:31 +02001038 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02001039
Gilles Peskine449bd832023-01-11 14:50:10 +01001040 if (psa_key_lifetime_is_external((*p_slot)->attr.lifetime)) {
1041 psa_unlock_key_slot(*p_slot);
1042 *p_slot = NULL;
1043 return PSA_ERROR_NOT_SUPPORTED;
1044 }
1045
1046 return PSA_SUCCESS;
Gilles Peskine28f8f302019-07-24 13:30:31 +02001047}
Gilles Peskine28f8f302019-07-24 13:30:31 +02001048
Gilles Peskine449bd832023-01-11 14:50:10 +01001049psa_status_t psa_remove_key_data_from_memory(psa_key_slot_t *slot)
Darryl Green40225ba2018-11-15 14:48:15 +00001050{
Ronald Cronea0f8a62020-11-25 17:52:23 +01001051 /* Data pointer will always be either a valid pointer or NULL in an
1052 * initialized slot, so we can just free it. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001053 if (slot->key.data != NULL) {
1054 mbedtls_platform_zeroize(slot->key.data, slot->key.bytes);
1055 }
Ronald Cronea0f8a62020-11-25 17:52:23 +01001056
Gilles Peskine449bd832023-01-11 14:50:10 +01001057 mbedtls_free(slot->key.data);
Ronald Cronea0f8a62020-11-25 17:52:23 +01001058 slot->key.data = NULL;
1059 slot->key.bytes = 0;
Darryl Green40225ba2018-11-15 14:48:15 +00001060
Gilles Peskine449bd832023-01-11 14:50:10 +01001061 return PSA_SUCCESS;
Darryl Green40225ba2018-11-15 14:48:15 +00001062}
1063
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001064/** Completely wipe a slot in memory, including its policy.
1065 * Persistent storage is not affected. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001066psa_status_t psa_wipe_key_slot(psa_key_slot_t *slot)
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001067{
Gilles Peskine449bd832023-01-11 14:50:10 +01001068 psa_status_t status = psa_remove_key_data_from_memory(slot);
Ronald Cronddd3d052020-10-30 14:07:07 +01001069
Gilles Peskine449bd832023-01-11 14:50:10 +01001070 /*
1071 * As the return error code may not be handled in case of multiple errors,
1072 * do our best to report an unexpected lock counter. Assert with
1073 * MBEDTLS_TEST_HOOK_TEST_ASSERT that the lock counter is equal to one:
1074 * if the MBEDTLS_TEST_HOOKS configuration option is enabled and the
1075 * function is called as part of the execution of a test suite, the
1076 * execution of the test suite is stopped in error if the assertion fails.
1077 */
1078 if (slot->lock_count != 1) {
1079 MBEDTLS_TEST_HOOK_TEST_ASSERT(slot->lock_count == 1);
Ronald Cronddd3d052020-10-30 14:07:07 +01001080 status = PSA_ERROR_CORRUPTION_DETECTED;
1081 }
1082
Gilles Peskine3f7cd622019-08-13 15:01:08 +02001083 /* Multipart operations may still be using the key. This is safe
1084 * because all multipart operation objects are independent from
1085 * the key slot: if they need to access the key after the setup
1086 * phase, they have a copy of the key. Note that this means that
1087 * key material can linger until all operations are completed. */
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001088 /* At this point, key material and other type-specific content has
1089 * been wiped. Clear remaining metadata. We can call memset and not
1090 * zeroize because the metadata is not particularly sensitive. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001091 memset(slot, 0, sizeof(*slot));
1092 return status;
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001093}
1094
Gilles Peskine449bd832023-01-11 14:50:10 +01001095psa_status_t psa_destroy_key(mbedtls_svc_key_id_t key)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001096{
Gilles Peskine2f060a82018-12-04 17:12:32 +01001097 psa_key_slot_t *slot;
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001098 psa_status_t status; /* status of the last operation */
1099 psa_status_t overall_status = PSA_SUCCESS;
Gilles Peskine354f7672019-07-12 23:46:38 +02001100#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1101 psa_se_drv_table_entry_t *driver;
1102#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001103
Gilles Peskine449bd832023-01-11 14:50:10 +01001104 if (mbedtls_svc_key_id_is_null(key)) {
1105 return PSA_SUCCESS;
1106 }
Gilles Peskine1841cf42019-10-08 15:48:25 +02001107
Ronald Cronf2911112020-10-29 17:51:10 +01001108 /*
Ronald Cron19daca92020-11-10 18:08:03 +01001109 * Get the description of the key in a key slot. In case of a persistent
Ronald Cronf2911112020-10-29 17:51:10 +01001110 * key, this will load the key description from persistent memory if not
1111 * done yet. We cannot avoid this loading as without it we don't know if
1112 * the key is operated by an SE or not and this information is needed by
1113 * the current implementation.
1114 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001115 status = psa_get_and_lock_key_slot(key, &slot);
1116 if (status != PSA_SUCCESS) {
1117 return status;
1118 }
Gilles Peskine354f7672019-07-12 23:46:38 +02001119
Ronald Cronf2911112020-10-29 17:51:10 +01001120 /*
1121 * If the key slot containing the key description is under access by the
1122 * library (apart from the present access), the key cannot be destroyed
1123 * yet. For the time being, just return in error. Eventually (to be
1124 * implemented), the key should be destroyed when all accesses have
1125 * stopped.
1126 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001127 if (slot->lock_count > 1) {
1128 psa_unlock_key_slot(slot);
1129 return PSA_ERROR_GENERIC_ERROR;
Ronald Cronf2911112020-10-29 17:51:10 +01001130 }
1131
Gilles Peskine449bd832023-01-11 14:50:10 +01001132 if (PSA_KEY_LIFETIME_IS_READ_ONLY(slot->attr.lifetime)) {
Gilles Peskine6687cd02021-04-21 22:32:05 +02001133 /* Refuse the destruction of a read-only key (which may or may not work
1134 * if we attempt it, depending on whether the key is merely read-only
1135 * by policy or actually physically read-only).
Gilles Peskinef9a046e2021-06-07 23:27:54 +02001136 * Just do the best we can, which is to wipe the copy in memory
1137 * (done in this function's cleanup code). */
1138 overall_status = PSA_ERROR_NOT_PERMITTED;
1139 goto exit;
Gilles Peskine6687cd02021-04-21 22:32:05 +02001140 }
1141
Gilles Peskine354f7672019-07-12 23:46:38 +02001142#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001143 driver = psa_get_se_driver_entry(slot->attr.lifetime);
1144 if (driver != NULL) {
Gilles Peskine60450a42019-07-25 11:32:45 +02001145 /* For a key in a secure element, we need to do three things:
1146 * remove the key file in internal storage, destroy the
1147 * key inside the secure element, and update the driver's
1148 * persistent data. Start a transaction that will encompass these
1149 * three actions. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001150 psa_crypto_prepare_transaction(PSA_CRYPTO_TRANSACTION_DESTROY_KEY);
Gilles Peskine8e338702019-07-30 20:06:31 +02001151 psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
Gilles Peskine449bd832023-01-11 14:50:10 +01001152 psa_crypto_transaction.key.slot = psa_key_slot_get_slot_number(slot);
Gilles Peskine8e338702019-07-30 20:06:31 +02001153 psa_crypto_transaction.key.id = slot->attr.id;
Gilles Peskine449bd832023-01-11 14:50:10 +01001154 status = psa_crypto_save_transaction();
1155 if (status != PSA_SUCCESS) {
1156 (void) psa_crypto_stop_transaction();
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001157 /* We should still try to destroy the key in the secure
1158 * element and the key metadata in storage. This is especially
1159 * important if the error is that the storage is full.
1160 * But how to do it exactly without risking an inconsistent
1161 * state after a reset?
1162 * https://github.com/ARMmbed/mbed-crypto/issues/215
1163 */
1164 overall_status = status;
1165 goto exit;
Gilles Peskinefc762652019-07-22 19:30:34 +02001166 }
1167
Gilles Peskine449bd832023-01-11 14:50:10 +01001168 status = psa_destroy_se_key(driver,
1169 psa_key_slot_get_slot_number(slot));
1170 if (overall_status == PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001171 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001172 }
Gilles Peskinefc762652019-07-22 19:30:34 +02001173 }
Gilles Peskine354f7672019-07-12 23:46:38 +02001174#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1175
Darryl Greend49a4992018-06-18 17:27:26 +01001176#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001177 if (!PSA_KEY_LIFETIME_IS_VOLATILE(slot->attr.lifetime)) {
1178 status = psa_destroy_persistent_key(slot->attr.id);
1179 if (overall_status == PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001180 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001181 }
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001182
Gilles Peskine9ce31c42019-08-13 15:14:20 +02001183 /* TODO: other slots may have a copy of the same key. We should
1184 * invalidate them.
1185 * https://github.com/ARMmbed/mbed-crypto/issues/214
1186 */
Darryl Greend49a4992018-06-18 17:27:26 +01001187 }
1188#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
Gilles Peskine354f7672019-07-12 23:46:38 +02001189
Gilles Peskinefc762652019-07-22 19:30:34 +02001190#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001191 if (driver != NULL) {
1192 status = psa_save_se_persistent_data(driver);
1193 if (overall_status == PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001194 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001195 }
1196 status = psa_crypto_stop_transaction();
1197 if (overall_status == PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001198 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001199 }
Gilles Peskinefc762652019-07-22 19:30:34 +02001200 }
1201#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1202
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001203exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001204 status = psa_wipe_key_slot(slot);
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001205 /* Prioritize CORRUPTION_DETECTED from wiping over a storage error */
Gilles Peskine449bd832023-01-11 14:50:10 +01001206 if (status != PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001207 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001208 }
1209 return overall_status;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001210}
1211
John Durkop07cc04a2020-11-16 22:08:34 -08001212#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
John Durkop0e005192020-10-31 22:06:54 -07001213 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Gilles Peskineb699f072019-04-26 16:06:02 +02001214static psa_status_t psa_get_rsa_public_exponent(
1215 const mbedtls_rsa_context *rsa,
Gilles Peskine449bd832023-01-11 14:50:10 +01001216 psa_key_attributes_t *attributes)
Gilles Peskineb699f072019-04-26 16:06:02 +02001217{
1218 mbedtls_mpi mpi;
Janos Follath24eed8d2019-11-22 13:21:35 +00001219 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskineb699f072019-04-26 16:06:02 +02001220 uint8_t *buffer = NULL;
1221 size_t buflen;
Gilles Peskine449bd832023-01-11 14:50:10 +01001222 mbedtls_mpi_init(&mpi);
Gilles Peskineb699f072019-04-26 16:06:02 +02001223
Gilles Peskine449bd832023-01-11 14:50:10 +01001224 ret = mbedtls_rsa_export(rsa, NULL, NULL, NULL, NULL, &mpi);
1225 if (ret != 0) {
Gilles Peskineb699f072019-04-26 16:06:02 +02001226 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001227 }
1228 if (mbedtls_mpi_cmp_int(&mpi, 65537) == 0) {
Gilles Peskine772c8b12019-04-26 17:37:21 +02001229 /* It's the default value, which is reported as an empty string,
1230 * so there's nothing to do. */
1231 goto exit;
1232 }
Gilles Peskineb699f072019-04-26 16:06:02 +02001233
Gilles Peskine449bd832023-01-11 14:50:10 +01001234 buflen = mbedtls_mpi_size(&mpi);
1235 buffer = mbedtls_calloc(1, buflen);
1236 if (buffer == NULL) {
Gilles Peskineb699f072019-04-26 16:06:02 +02001237 ret = MBEDTLS_ERR_MPI_ALLOC_FAILED;
1238 goto exit;
1239 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001240 ret = mbedtls_mpi_write_binary(&mpi, buffer, buflen);
1241 if (ret != 0) {
Gilles Peskineb699f072019-04-26 16:06:02 +02001242 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001243 }
Gilles Peskineb699f072019-04-26 16:06:02 +02001244 attributes->domain_parameters = buffer;
1245 attributes->domain_parameters_size = buflen;
1246
1247exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001248 mbedtls_mpi_free(&mpi);
1249 if (ret != 0) {
1250 mbedtls_free(buffer);
1251 }
1252 return mbedtls_to_psa_error(ret);
Gilles Peskineb699f072019-04-26 16:06:02 +02001253}
John Durkop07cc04a2020-11-16 22:08:34 -08001254#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
John Durkop9814fa22020-11-04 12:28:15 -08001255 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Gilles Peskineb699f072019-04-26 16:06:02 +02001256
Gilles Peskinebfd322f2019-07-23 11:58:03 +02001257/** Retrieve all the publicly-accessible attributes of a key.
1258 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001259psa_status_t psa_get_key_attributes(mbedtls_svc_key_id_t key,
1260 psa_key_attributes_t *attributes)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001261{
Ronald Cronf95a2b12020-10-22 15:24:49 +02001262 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01001263 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01001264 psa_key_slot_t *slot;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001265
Gilles Peskine449bd832023-01-11 14:50:10 +01001266 psa_reset_key_attributes(attributes);
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001267
Gilles Peskine449bd832023-01-11 14:50:10 +01001268 status = psa_get_and_lock_key_slot_with_policy(key, &slot, 0, 0);
1269 if (status != PSA_SUCCESS) {
1270 return status;
1271 }
Gilles Peskineb870b182018-07-06 16:02:09 +02001272
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001273 attributes->core = slot->attr;
Gilles Peskine449bd832023-01-11 14:50:10 +01001274 attributes->core.flags &= (MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY |
1275 MBEDTLS_PSA_KA_MASK_DUAL_USE);
Gilles Peskinec8000c02019-08-02 20:15:51 +02001276
1277#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001278 if (psa_get_se_driver_entry(slot->attr.lifetime) != NULL) {
1279 psa_set_key_slot_number(attributes,
1280 psa_key_slot_get_slot_number(slot));
1281 }
Gilles Peskinec8000c02019-08-02 20:15:51 +02001282#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskineb699f072019-04-26 16:06:02 +02001283
Gilles Peskine449bd832023-01-11 14:50:10 +01001284 switch (slot->attr.type) {
John Durkop07cc04a2020-11-16 22:08:34 -08001285#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
John Durkop0e005192020-10-31 22:06:54 -07001286 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Gilles Peskinec93b80c2019-05-16 19:39:54 +02001287 case PSA_KEY_TYPE_RSA_KEY_PAIR:
Gilles Peskineb699f072019-04-26 16:06:02 +02001288 case PSA_KEY_TYPE_RSA_PUBLIC_KEY:
Janos Follath1d57a202019-08-13 12:15:34 +01001289 /* TODO: reporting the public exponent for opaque keys
Gilles Peskinec9d7f942019-08-13 16:17:16 +02001290 * is not yet implemented.
1291 * https://github.com/ARMmbed/mbed-crypto/issues/216
1292 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001293 if (!psa_key_lifetime_is_external(slot->attr.lifetime)) {
Steven Cooremana2371e52020-07-28 14:30:39 +02001294 mbedtls_rsa_context *rsa = NULL;
Steven Cooremana01795d2020-07-24 22:48:15 +02001295
Ronald Cron90857082020-11-25 14:58:33 +01001296 status = mbedtls_psa_rsa_load_representation(
Gilles Peskine449bd832023-01-11 14:50:10 +01001297 slot->attr.type,
1298 slot->key.data,
1299 slot->key.bytes,
1300 &rsa);
1301 if (status != PSA_SUCCESS) {
Steven Cooremana01795d2020-07-24 22:48:15 +02001302 break;
Gilles Peskine449bd832023-01-11 14:50:10 +01001303 }
Steven Cooremana01795d2020-07-24 22:48:15 +02001304
Gilles Peskine449bd832023-01-11 14:50:10 +01001305 status = psa_get_rsa_public_exponent(rsa,
1306 attributes);
1307 mbedtls_rsa_free(rsa);
1308 mbedtls_free(rsa);
Steven Cooremana01795d2020-07-24 22:48:15 +02001309 }
Gilles Peskineb699f072019-04-26 16:06:02 +02001310 break;
John Durkop07cc04a2020-11-16 22:08:34 -08001311#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
John Durkop9814fa22020-11-04 12:28:15 -08001312 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Gilles Peskineb699f072019-04-26 16:06:02 +02001313 default:
1314 /* Nothing else to do. */
1315 break;
1316 }
1317
Gilles Peskine449bd832023-01-11 14:50:10 +01001318 if (status != PSA_SUCCESS) {
1319 psa_reset_key_attributes(attributes);
1320 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02001321
Gilles Peskine449bd832023-01-11 14:50:10 +01001322 unlock_status = psa_unlock_key_slot(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02001323
Gilles Peskine449bd832023-01-11 14:50:10 +01001324 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001325}
1326
Gilles Peskinec8000c02019-08-02 20:15:51 +02001327#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1328psa_status_t psa_get_key_slot_number(
1329 const psa_key_attributes_t *attributes,
Gilles Peskine449bd832023-01-11 14:50:10 +01001330 psa_key_slot_number_t *slot_number)
Gilles Peskinec8000c02019-08-02 20:15:51 +02001331{
Gilles Peskine449bd832023-01-11 14:50:10 +01001332 if (attributes->core.flags & MBEDTLS_PSA_KA_FLAG_HAS_SLOT_NUMBER) {
Gilles Peskinec8000c02019-08-02 20:15:51 +02001333 *slot_number = attributes->slot_number;
Gilles Peskine449bd832023-01-11 14:50:10 +01001334 return PSA_SUCCESS;
1335 } else {
1336 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinec8000c02019-08-02 20:15:51 +02001337 }
Gilles Peskinec8000c02019-08-02 20:15:51 +02001338}
1339#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1340
Gilles Peskine449bd832023-01-11 14:50:10 +01001341static psa_status_t psa_export_key_buffer_internal(const uint8_t *key_buffer,
1342 size_t key_buffer_size,
1343 uint8_t *data,
1344 size_t data_size,
1345 size_t *data_length)
Steven Cooremana01795d2020-07-24 22:48:15 +02001346{
Gilles Peskine449bd832023-01-11 14:50:10 +01001347 if (key_buffer_size > data_size) {
1348 return PSA_ERROR_BUFFER_TOO_SMALL;
1349 }
1350 memcpy(data, key_buffer, key_buffer_size);
1351 memset(data + key_buffer_size, 0,
1352 data_size - key_buffer_size);
Ronald Crond18b5f82020-11-25 16:46:05 +01001353 *data_length = key_buffer_size;
Gilles Peskine449bd832023-01-11 14:50:10 +01001354 return PSA_SUCCESS;
Steven Cooremana01795d2020-07-24 22:48:15 +02001355}
1356
Ronald Cron7285cda2020-11-26 14:46:37 +01001357psa_status_t psa_export_key_internal(
Ronald Crond18b5f82020-11-25 16:46:05 +01001358 const psa_key_attributes_t *attributes,
1359 const uint8_t *key_buffer, size_t key_buffer_size,
Gilles Peskine449bd832023-01-11 14:50:10 +01001360 uint8_t *data, size_t data_size, size_t *data_length)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001361{
Ronald Crond18b5f82020-11-25 16:46:05 +01001362 psa_key_type_t type = attributes->core.type;
1363
Gilles Peskine449bd832023-01-11 14:50:10 +01001364 if (key_type_is_raw_bytes(type) ||
1365 PSA_KEY_TYPE_IS_RSA(type) ||
Przemek Stekiel472b3f32022-12-01 14:38:49 +01001366 PSA_KEY_TYPE_IS_ECC(type) ||
1367 PSA_KEY_TYPE_IS_DH(type)) {
Gilles Peskine449bd832023-01-11 14:50:10 +01001368 return psa_export_key_buffer_internal(
1369 key_buffer, key_buffer_size,
1370 data, data_size, data_length);
1371 } else {
Ronald Cron9486f9d2020-11-26 13:36:23 +01001372 /* This shouldn't happen in the reference implementation, but
1373 it is valid for a special-purpose implementation to omit
1374 support for exporting certain key types. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001375 return PSA_ERROR_NOT_SUPPORTED;
Ronald Cron9486f9d2020-11-26 13:36:23 +01001376 }
1377}
1378
Gilles Peskine449bd832023-01-11 14:50:10 +01001379psa_status_t psa_export_key(mbedtls_svc_key_id_t key,
1380 uint8_t *data,
1381 size_t data_size,
1382 size_t *data_length)
Ronald Cron9486f9d2020-11-26 13:36:23 +01001383{
1384 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
1385 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
1386 psa_key_slot_t *slot;
1387
Ronald Crone907e552021-01-18 13:22:38 +01001388 /* Reject a zero-length output buffer now, since this can never be a
1389 * valid key representation. This way we know that data must be a valid
1390 * pointer and we can do things like memset(data, ..., data_size). */
Gilles Peskine449bd832023-01-11 14:50:10 +01001391 if (data_size == 0) {
1392 return PSA_ERROR_BUFFER_TOO_SMALL;
1393 }
Ronald Crone907e552021-01-18 13:22:38 +01001394
Ronald Cron9486f9d2020-11-26 13:36:23 +01001395 /* Set the key to empty now, so that even when there are errors, we always
1396 * set data_length to a value between 0 and data_size. On error, setting
1397 * the key to empty is a good choice because an empty key representation is
1398 * unlikely to be accepted anywhere. */
Jaeden Amerof24c7f82018-06-27 17:20:43 +01001399 *data_length = 0;
1400
Ronald Cron9486f9d2020-11-26 13:36:23 +01001401 /* Export requires the EXPORT flag. There is an exception for public keys,
1402 * which don't require any flag, but
1403 * psa_get_and_lock_key_slot_with_policy() takes care of this.
1404 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001405 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
1406 PSA_KEY_USAGE_EXPORT, 0);
1407 if (status != PSA_SUCCESS) {
1408 return status;
1409 }
mohammad160306e79202018-03-28 13:17:44 +03001410
Ronald Crond18b5f82020-11-25 16:46:05 +01001411 psa_key_attributes_t attributes = {
1412 .core = slot->attr
1413 };
Gilles Peskine449bd832023-01-11 14:50:10 +01001414 status = psa_driver_wrapper_export_key(&attributes,
1415 slot->key.data, slot->key.bytes,
1416 data, data_size, data_length);
Ronald Cron9486f9d2020-11-26 13:36:23 +01001417
Gilles Peskine449bd832023-01-11 14:50:10 +01001418 unlock_status = psa_unlock_key_slot(slot);
Ronald Cron9486f9d2020-11-26 13:36:23 +01001419
Gilles Peskine449bd832023-01-11 14:50:10 +01001420 return (status == PSA_SUCCESS) ? unlock_status : status;
Ronald Cron9486f9d2020-11-26 13:36:23 +01001421}
1422
Ronald Cron7285cda2020-11-26 14:46:37 +01001423psa_status_t psa_export_public_key_internal(
Ronald Crond18b5f82020-11-25 16:46:05 +01001424 const psa_key_attributes_t *attributes,
1425 const uint8_t *key_buffer,
1426 size_t key_buffer_size,
1427 uint8_t *data,
1428 size_t data_size,
Gilles Peskine449bd832023-01-11 14:50:10 +01001429 size_t *data_length)
Ronald Cron9486f9d2020-11-26 13:36:23 +01001430{
Ronald Crond18b5f82020-11-25 16:46:05 +01001431 psa_key_type_t type = attributes->core.type;
Ronald Crond18b5f82020-11-25 16:46:05 +01001432
Przemek Stekiel6fd72b62023-04-27 10:20:56 +02001433 if (PSA_KEY_TYPE_IS_PUBLIC_KEY(type) &&
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001434 (PSA_KEY_TYPE_IS_RSA(type) || PSA_KEY_TYPE_IS_ECC(type) ||
1435 PSA_KEY_TYPE_IS_DH(type))) {
Przemek Stekiel6fd72b62023-04-27 10:20:56 +02001436 /* Exporting public -> public */
1437 return psa_export_key_buffer_internal(
1438 key_buffer, key_buffer_size,
1439 data, data_size, data_length);
1440 } else if (PSA_KEY_TYPE_IS_RSA(type)) {
John Durkop0e005192020-10-31 22:06:54 -07001441#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001442 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
1443 return mbedtls_psa_rsa_export_public_key(attributes,
1444 key_buffer,
1445 key_buffer_size,
1446 data,
1447 data_size,
1448 data_length);
Darryl Green9e2d7a02018-07-24 16:33:30 +01001449#else
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001450 /* We don't know how to convert a private RSA key to public. */
1451 return PSA_ERROR_NOT_SUPPORTED;
John Durkop9814fa22020-11-04 12:28:15 -08001452#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
1453 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Przemek Stekiel6fd72b62023-04-27 10:20:56 +02001454 } else if (PSA_KEY_TYPE_IS_ECC(type)) {
John Durkop6ba40d12020-11-10 08:50:04 -08001455#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001456 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
1457 return mbedtls_psa_ecp_export_public_key(attributes,
1458 key_buffer,
1459 key_buffer_size,
1460 data,
1461 data_size,
1462 data_length);
Steven Cooreman560c28a2020-07-24 23:20:24 +02001463#else
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001464 /* We don't know how to convert a private ECC key to public */
1465 return PSA_ERROR_NOT_SUPPORTED;
John Durkop9814fa22020-11-04 12:28:15 -08001466#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
1467 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
Przemek Stekiel6fd72b62023-04-27 10:20:56 +02001468 } else if (PSA_KEY_TYPE_IS_DH(type)) {
Przemek Stekiel6d85afa2023-04-28 11:42:17 +02001469#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR) || \
1470 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY)
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001471 return mbedtls_psa_export_ffdh_public_key(attributes,
1472 key_buffer,
1473 key_buffer_size,
1474 data, data_size,
1475 data_length);
Przemek Stekiel472b3f32022-12-01 14:38:49 +01001476#else
Przemek Stekiel472b3f32022-12-01 14:38:49 +01001477 return PSA_ERROR_NOT_SUPPORTED;
Przemek Stekiel6d85afa2023-04-28 11:42:17 +02001478#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR) ||
1479 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) */
Gilles Peskine449bd832023-01-11 14:50:10 +01001480 } else {
Gilles Peskine449bd832023-01-11 14:50:10 +01001481 return PSA_ERROR_NOT_SUPPORTED;
Steven Cooreman560c28a2020-07-24 23:20:24 +02001482 }
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001483}
Ronald Crond18b5f82020-11-25 16:46:05 +01001484
Gilles Peskine449bd832023-01-11 14:50:10 +01001485psa_status_t psa_export_public_key(mbedtls_svc_key_id_t key,
1486 uint8_t *data,
1487 size_t data_size,
1488 size_t *data_length)
Moran Pekerdd4ea382018-04-03 15:30:03 +03001489{
Ronald Cronf95a2b12020-10-22 15:24:49 +02001490 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01001491 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01001492 psa_key_slot_t *slot;
Darryl Greendd8fb772018-11-07 16:00:44 +00001493
Ronald Crone907e552021-01-18 13:22:38 +01001494 /* Reject a zero-length output buffer now, since this can never be a
1495 * valid key representation. This way we know that data must be a valid
1496 * pointer and we can do things like memset(data, ..., data_size). */
Gilles Peskine449bd832023-01-11 14:50:10 +01001497 if (data_size == 0) {
1498 return PSA_ERROR_BUFFER_TOO_SMALL;
1499 }
Ronald Crone907e552021-01-18 13:22:38 +01001500
Darryl Greendd8fb772018-11-07 16:00:44 +00001501 /* Set the key to empty now, so that even when there are errors, we always
1502 * set data_length to a value between 0 and data_size. On error, setting
1503 * the key to empty is a good choice because an empty key representation is
1504 * unlikely to be accepted anywhere. */
1505 *data_length = 0;
1506
1507 /* Exporting a public key doesn't require a usage flag. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001508 status = psa_get_and_lock_key_slot_with_policy(key, &slot, 0, 0);
1509 if (status != PSA_SUCCESS) {
1510 return status;
1511 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02001512
Gilles Peskine449bd832023-01-11 14:50:10 +01001513 if (!PSA_KEY_TYPE_IS_ASYMMETRIC(slot->attr.type)) {
1514 status = PSA_ERROR_INVALID_ARGUMENT;
1515 goto exit;
Ronald Cron9486f9d2020-11-26 13:36:23 +01001516 }
1517
Ronald Crond18b5f82020-11-25 16:46:05 +01001518 psa_key_attributes_t attributes = {
1519 .core = slot->attr
1520 };
Ronald Cron67227982020-11-26 15:16:05 +01001521 status = psa_driver_wrapper_export_public_key(
Ronald Crond18b5f82020-11-25 16:46:05 +01001522 &attributes, slot->key.data, slot->key.bytes,
Gilles Peskine449bd832023-01-11 14:50:10 +01001523 data, data_size, data_length);
Ronald Cron9486f9d2020-11-26 13:36:23 +01001524
1525exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001526 unlock_status = psa_unlock_key_slot(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02001527
Gilles Peskine449bd832023-01-11 14:50:10 +01001528 return (status == PSA_SUCCESS) ? unlock_status : status;
Moran Pekerdd4ea382018-04-03 15:30:03 +03001529}
1530
Tom Cosgrove6ef9bb32023-03-08 14:19:51 +00001531MBEDTLS_STATIC_ASSERT(
1532 (MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE) == 0,
1533 "One or more key attribute flag is listed as both external-only and dual-use")
1534MBEDTLS_STATIC_ASSERT(
1535 (PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE) == 0,
1536 "One or more key attribute flag is listed as both internal-only and dual-use")
1537MBEDTLS_STATIC_ASSERT(
1538 (PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY) == 0,
1539 "One or more key attribute flag is listed as both internal-only and external-only")
Gilles Peskine91e8c332019-08-02 19:19:39 +02001540
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001541/** Validate that a key policy is internally well-formed.
1542 *
1543 * This function only rejects invalid policies. It does not validate the
1544 * consistency of the policy with respect to other attributes of the key
1545 * such as the key type.
1546 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001547static psa_status_t psa_validate_key_policy(const psa_key_policy_t *policy)
Gilles Peskine4747d192019-04-17 15:05:45 +02001548{
Gilles Peskine449bd832023-01-11 14:50:10 +01001549 if ((policy->usage & ~(PSA_KEY_USAGE_EXPORT |
1550 PSA_KEY_USAGE_COPY |
1551 PSA_KEY_USAGE_ENCRYPT |
1552 PSA_KEY_USAGE_DECRYPT |
1553 PSA_KEY_USAGE_SIGN_MESSAGE |
1554 PSA_KEY_USAGE_VERIFY_MESSAGE |
1555 PSA_KEY_USAGE_SIGN_HASH |
1556 PSA_KEY_USAGE_VERIFY_HASH |
1557 PSA_KEY_USAGE_VERIFY_DERIVATION |
1558 PSA_KEY_USAGE_DERIVE)) != 0) {
1559 return PSA_ERROR_INVALID_ARGUMENT;
1560 }
Gilles Peskine4747d192019-04-17 15:05:45 +02001561
Gilles Peskine449bd832023-01-11 14:50:10 +01001562 return PSA_SUCCESS;
Gilles Peskine4747d192019-04-17 15:05:45 +02001563}
1564
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001565/** Validate the internal consistency of key attributes.
1566 *
1567 * This function only rejects invalid attribute values. If does not
1568 * validate the consistency of the attributes with any key data that may
1569 * be involved in the creation of the key.
1570 *
1571 * Call this function early in the key creation process.
1572 *
1573 * \param[in] attributes Key attributes for the new key.
1574 * \param[out] p_drv On any return, the driver for the key, if any.
1575 * NULL for a transparent key.
1576 *
1577 */
1578static psa_status_t psa_validate_key_attributes(
1579 const psa_key_attributes_t *attributes,
Gilles Peskine449bd832023-01-11 14:50:10 +01001580 psa_se_drv_table_entry_t **p_drv)
Darryl Green0c6575a2018-11-07 16:05:30 +00001581{
Steven Cooreman81fe7c32020-06-08 18:37:19 +02001582 psa_status_t status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine449bd832023-01-11 14:50:10 +01001583 psa_key_lifetime_t lifetime = psa_get_key_lifetime(attributes);
1584 mbedtls_svc_key_id_t key = psa_get_key_id(attributes);
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001585
Gilles Peskine449bd832023-01-11 14:50:10 +01001586 status = psa_validate_key_location(lifetime, p_drv);
1587 if (status != PSA_SUCCESS) {
1588 return status;
Ronald Crond2ed4812020-07-17 16:11:30 +02001589 }
1590
Gilles Peskine449bd832023-01-11 14:50:10 +01001591 status = psa_validate_key_persistence(lifetime);
1592 if (status != PSA_SUCCESS) {
1593 return status;
1594 }
1595
1596 if (PSA_KEY_LIFETIME_IS_VOLATILE(lifetime)) {
1597 if (MBEDTLS_SVC_KEY_ID_GET_KEY_ID(key) != 0) {
1598 return PSA_ERROR_INVALID_ARGUMENT;
1599 }
1600 } else {
1601 if (!psa_is_valid_key_id(psa_get_key_id(attributes), 0)) {
1602 return PSA_ERROR_INVALID_ARGUMENT;
1603 }
1604 }
1605
1606 status = psa_validate_key_policy(&attributes->core.policy);
1607 if (status != PSA_SUCCESS) {
1608 return status;
1609 }
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001610
1611 /* Refuse to create overly large keys.
1612 * Note that this doesn't trigger on import if the attributes don't
1613 * explicitly specify a size (so psa_get_key_bits returns 0), so
1614 * psa_import_key() needs its own checks. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001615 if (psa_get_key_bits(attributes) > PSA_MAX_KEY_BITS) {
1616 return PSA_ERROR_NOT_SUPPORTED;
1617 }
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001618
Gilles Peskine91e8c332019-08-02 19:19:39 +02001619 /* Reject invalid flags. These should not be reachable through the API. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001620 if (attributes->core.flags & ~(MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY |
1621 MBEDTLS_PSA_KA_MASK_DUAL_USE)) {
1622 return PSA_ERROR_INVALID_ARGUMENT;
1623 }
Gilles Peskine91e8c332019-08-02 19:19:39 +02001624
Gilles Peskine449bd832023-01-11 14:50:10 +01001625 return PSA_SUCCESS;
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001626}
1627
Gilles Peskine4747d192019-04-17 15:05:45 +02001628/** Prepare a key slot to receive key material.
1629 *
1630 * This function allocates a key slot and sets its metadata.
1631 *
1632 * If this function fails, call psa_fail_key_creation().
1633 *
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001634 * This function is intended to be used as follows:
1635 * -# Call psa_start_key_creation() to allocate a key slot, prepare
Ronald Croncf56a0a2020-08-04 09:51:30 +02001636 * it with the specified attributes, and in case of a volatile key assign it
1637 * a volatile key identifier.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001638 * -# Populate the slot with the key material.
1639 * -# Call psa_finish_key_creation() to finalize the creation of the slot.
1640 * In case of failure at any step, stop the sequence and call
1641 * psa_fail_key_creation().
1642 *
Ronald Cron5c522922020-11-14 16:35:34 +01001643 * On success, the key slot is locked. It is the responsibility of the caller
1644 * to unlock the key slot when it does not access it anymore.
Ronald Cronf95a2b12020-10-22 15:24:49 +02001645 *
Gilles Peskinedf179142019-07-15 22:02:14 +02001646 * \param method An identification of the calling function.
Gilles Peskine011e4282019-06-26 18:34:38 +02001647 * \param[in] attributes Key attributes for the new key.
Gilles Peskine011e4282019-06-26 18:34:38 +02001648 * \param[out] p_slot On success, a pointer to the prepared slot.
1649 * \param[out] p_drv On any return, the driver for the key, if any.
1650 * NULL for a transparent key.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001651 *
1652 * \retval #PSA_SUCCESS
1653 * The key slot is ready to receive key material.
1654 * \return If this function fails, the key slot is an invalid state.
1655 * You must call psa_fail_key_creation() to wipe and free the slot.
Gilles Peskine4747d192019-04-17 15:05:45 +02001656 */
1657static psa_status_t psa_start_key_creation(
Gilles Peskinedf179142019-07-15 22:02:14 +02001658 psa_key_creation_method_t method,
Gilles Peskine4747d192019-04-17 15:05:45 +02001659 const psa_key_attributes_t *attributes,
Gilles Peskine011e4282019-06-26 18:34:38 +02001660 psa_key_slot_t **p_slot,
Gilles Peskine449bd832023-01-11 14:50:10 +01001661 psa_se_drv_table_entry_t **p_drv)
Gilles Peskine4747d192019-04-17 15:05:45 +02001662{
1663 psa_status_t status;
Ronald Cron2a993152020-07-17 14:13:26 +02001664 psa_key_id_t volatile_key_id;
Gilles Peskine4747d192019-04-17 15:05:45 +02001665 psa_key_slot_t *slot;
1666
Gilles Peskinedf179142019-07-15 22:02:14 +02001667 (void) method;
Gilles Peskine011e4282019-06-26 18:34:38 +02001668 *p_drv = NULL;
1669
Gilles Peskine449bd832023-01-11 14:50:10 +01001670 status = psa_validate_key_attributes(attributes, p_drv);
1671 if (status != PSA_SUCCESS) {
1672 return status;
1673 }
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001674
Gilles Peskine449bd832023-01-11 14:50:10 +01001675 status = psa_get_empty_key_slot(&volatile_key_id, p_slot);
1676 if (status != PSA_SUCCESS) {
1677 return status;
1678 }
Gilles Peskine4747d192019-04-17 15:05:45 +02001679 slot = *p_slot;
1680
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001681 /* We're storing the declared bit-size of the key. It's up to each
1682 * creation mechanism to verify that this information is correct.
1683 * It's automatically correct for mechanisms that use the bit-size as
Gilles Peskineb46bef22019-07-30 21:32:04 +02001684 * an input (generate, device) but not for those where the bit-size
Ronald Cronc4d1b512020-07-31 11:26:37 +02001685 * is optional (import, copy). In case of a volatile key, assign it the
1686 * volatile key identifier associated to the slot returned to contain its
1687 * definition. */
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001688
1689 slot->attr = attributes->core;
Gilles Peskine449bd832023-01-11 14:50:10 +01001690 if (PSA_KEY_LIFETIME_IS_VOLATILE(slot->attr.lifetime)) {
Ronald Cronc4d1b512020-07-31 11:26:37 +02001691#if !defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER)
1692 slot->attr.id = volatile_key_id;
1693#else
1694 slot->attr.id.key_id = volatile_key_id;
1695#endif
1696 }
Gilles Peskinec744d992019-07-30 17:26:54 +02001697
Gilles Peskine91e8c332019-08-02 19:19:39 +02001698 /* Erase external-only flags from the internal copy. To access
Gilles Peskine013f5472019-08-07 15:42:14 +02001699 * external-only flags, query `attributes`. Thanks to the check
1700 * in psa_validate_key_attributes(), this leaves the dual-use
Gilles Peskineedbed562019-08-07 18:19:59 +02001701 * flags and any internal flag that psa_get_empty_key_slot()
Gilles Peskine013f5472019-08-07 15:42:14 +02001702 * may have set. */
1703 slot->attr.flags &= ~MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY;
Gilles Peskine91e8c332019-08-02 19:19:39 +02001704
Gilles Peskinecbaff462019-07-12 23:46:04 +02001705#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined7729582019-08-05 15:55:54 +02001706 /* For a key in a secure element, we need to do three things
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001707 * when creating or registering a persistent key:
Gilles Peskine60450a42019-07-25 11:32:45 +02001708 * create the key file in internal storage, create the
1709 * key inside the secure element, and update the driver's
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001710 * persistent data. This is done by starting a transaction that will
1711 * encompass these three actions.
1712 * For registering a volatile key, we just need to find an appropriate
1713 * slot number inside the SE. Since the key is designated volatile, creating
1714 * a transaction is not required. */
Gilles Peskine60450a42019-07-25 11:32:45 +02001715 /* The first thing to do is to find a slot number for the new key.
1716 * We save the slot number in persistent storage as part of the
1717 * transaction data. It will be needed to recover if the power
1718 * fails during the key creation process, to clean up on the secure
1719 * element side after restarting. Obtaining a slot number from the
1720 * secure element driver updates its persistent state, but we do not yet
1721 * save the driver's persistent state, so that if the power fails,
Gilles Peskinefc762652019-07-22 19:30:34 +02001722 * we can roll back to a state where the key doesn't exist. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001723 if (*p_drv != NULL) {
Ronald Cronea0f8a62020-11-25 17:52:23 +01001724 psa_key_slot_number_t slot_number;
Gilles Peskine449bd832023-01-11 14:50:10 +01001725 status = psa_find_se_slot_for_key(attributes, method, *p_drv,
1726 &slot_number);
1727 if (status != PSA_SUCCESS) {
1728 return status;
1729 }
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001730
Gilles Peskine449bd832023-01-11 14:50:10 +01001731 if (!PSA_KEY_LIFETIME_IS_VOLATILE(attributes->core.lifetime)) {
1732 psa_crypto_prepare_transaction(PSA_CRYPTO_TRANSACTION_CREATE_KEY);
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001733 psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
Ronald Cronea0f8a62020-11-25 17:52:23 +01001734 psa_crypto_transaction.key.slot = slot_number;
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001735 psa_crypto_transaction.key.id = slot->attr.id;
Gilles Peskine449bd832023-01-11 14:50:10 +01001736 status = psa_crypto_save_transaction();
1737 if (status != PSA_SUCCESS) {
1738 (void) psa_crypto_stop_transaction();
1739 return status;
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001740 }
Gilles Peskine66be51c2019-07-25 18:02:52 +02001741 }
Ronald Cronea0f8a62020-11-25 17:52:23 +01001742
1743 status = psa_copy_key_material_into_slot(
Gilles Peskine449bd832023-01-11 14:50:10 +01001744 slot, (uint8_t *) (&slot_number), sizeof(slot_number));
Darryl Green0c6575a2018-11-07 16:05:30 +00001745 }
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001746
Gilles Peskine449bd832023-01-11 14:50:10 +01001747 if (*p_drv == NULL && method == PSA_KEY_CREATION_REGISTER) {
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001748 /* Key registration only makes sense with a secure element. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001749 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001750 }
Gilles Peskinecbaff462019-07-12 23:46:04 +02001751#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1752
Gilles Peskine449bd832023-01-11 14:50:10 +01001753 return PSA_SUCCESS;
Darryl Green0c6575a2018-11-07 16:05:30 +00001754}
Gilles Peskine4747d192019-04-17 15:05:45 +02001755
1756/** Finalize the creation of a key once its key material has been set.
1757 *
1758 * This entails writing the key to persistent storage.
1759 *
1760 * If this function fails, call psa_fail_key_creation().
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001761 * See the documentation of psa_start_key_creation() for the intended use
1762 * of this function.
Gilles Peskine4747d192019-04-17 15:05:45 +02001763 *
Ronald Cron5c522922020-11-14 16:35:34 +01001764 * If the finalization succeeds, the function unlocks the key slot (it was
1765 * locked by psa_start_key_creation()) and the key slot cannot be accessed
1766 * anymore as part of the key creation process.
Ronald Cron50972942020-11-14 11:28:25 +01001767 *
Gilles Peskine011e4282019-06-26 18:34:38 +02001768 * \param[in,out] slot Pointer to the slot with key material.
1769 * \param[in] driver The secure element driver for the key,
1770 * or NULL for a transparent key.
Ronald Cron81709fc2020-11-14 12:10:32 +01001771 * \param[out] key On success, identifier of the key. Note that the
1772 * key identifier is also stored in the key slot.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001773 *
1774 * \retval #PSA_SUCCESS
Ronald Croncf56a0a2020-08-04 09:51:30 +02001775 * The key was successfully created.
Gilles Peskineed733552023-02-14 19:21:09 +01001776 * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription
1777 * \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription
1778 * \retval #PSA_ERROR_ALREADY_EXISTS \emptydescription
1779 * \retval #PSA_ERROR_DATA_INVALID \emptydescription
1780 * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription
1781 * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription
gabor-mezei-arm452b0a32020-11-09 17:42:55 +01001782 *
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001783 * \return If this function fails, the key slot is an invalid state.
1784 * You must call psa_fail_key_creation() to wipe and free the slot.
Gilles Peskine4747d192019-04-17 15:05:45 +02001785 */
Gilles Peskine011e4282019-06-26 18:34:38 +02001786static psa_status_t psa_finish_key_creation(
1787 psa_key_slot_t *slot,
Ronald Cron81709fc2020-11-14 12:10:32 +01001788 psa_se_drv_table_entry_t *driver,
1789 mbedtls_svc_key_id_t *key)
Gilles Peskine4747d192019-04-17 15:05:45 +02001790{
1791 psa_status_t status = PSA_SUCCESS;
Gilles Peskine30afafd2019-04-25 13:47:40 +02001792 (void) slot;
Gilles Peskine011e4282019-06-26 18:34:38 +02001793 (void) driver;
Gilles Peskine4747d192019-04-17 15:05:45 +02001794
1795#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001796 if (!PSA_KEY_LIFETIME_IS_VOLATILE(slot->attr.lifetime)) {
Gilles Peskine1df83d42019-07-23 16:13:14 +02001797#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001798 if (driver != NULL) {
Gilles Peskineb46bef22019-07-30 21:32:04 +02001799 psa_se_key_data_storage_t data;
Ronald Cronea0f8a62020-11-25 17:52:23 +01001800 psa_key_slot_number_t slot_number =
Gilles Peskine449bd832023-01-11 14:50:10 +01001801 psa_key_slot_get_slot_number(slot);
Ronald Cronea0f8a62020-11-25 17:52:23 +01001802
Tom Cosgrove6ef9bb32023-03-08 14:19:51 +00001803 MBEDTLS_STATIC_ASSERT(sizeof(slot_number) ==
1804 sizeof(data.slot_number),
1805 "Slot number size does not match psa_se_key_data_storage_t");
1806
Gilles Peskine449bd832023-01-11 14:50:10 +01001807 memcpy(&data.slot_number, &slot_number, sizeof(slot_number));
1808 status = psa_save_persistent_key(&slot->attr,
1809 (uint8_t *) &data,
1810 sizeof(data));
1811 } else
Gilles Peskine1df83d42019-07-23 16:13:14 +02001812#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1813 {
Steven Cooreman40120f62020-10-29 11:42:22 +01001814 /* Key material is saved in export representation in the slot, so
1815 * just pass the slot buffer for storage. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001816 status = psa_save_persistent_key(&slot->attr,
1817 slot->key.data,
1818 slot->key.bytes);
Gilles Peskine1df83d42019-07-23 16:13:14 +02001819 }
Gilles Peskine4747d192019-04-17 15:05:45 +02001820 }
Darryl Green0c6575a2018-11-07 16:05:30 +00001821#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
1822
Gilles Peskinecbaff462019-07-12 23:46:04 +02001823#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined7729582019-08-05 15:55:54 +02001824 /* Finish the transaction for a key creation. This does not
1825 * happen when registering an existing key. Detect this case
1826 * by checking whether a transaction is in progress (actual
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001827 * creation of a persistent key in a secure element requires a transaction,
1828 * but registration or volatile key creation doesn't use one). */
Gilles Peskine449bd832023-01-11 14:50:10 +01001829 if (driver != NULL &&
1830 psa_crypto_transaction.unknown.type == PSA_CRYPTO_TRANSACTION_CREATE_KEY) {
1831 status = psa_save_se_persistent_data(driver);
1832 if (status != PSA_SUCCESS) {
1833 psa_destroy_persistent_key(slot->attr.id);
1834 return status;
Gilles Peskinecbaff462019-07-12 23:46:04 +02001835 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001836 status = psa_crypto_stop_transaction();
Gilles Peskinecbaff462019-07-12 23:46:04 +02001837 }
1838#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1839
Gilles Peskine449bd832023-01-11 14:50:10 +01001840 if (status == PSA_SUCCESS) {
Ronald Cron81709fc2020-11-14 12:10:32 +01001841 *key = slot->attr.id;
Gilles Peskine449bd832023-01-11 14:50:10 +01001842 status = psa_unlock_key_slot(slot);
1843 if (status != PSA_SUCCESS) {
Ronald Cron81709fc2020-11-14 12:10:32 +01001844 *key = MBEDTLS_SVC_KEY_ID_INIT;
Gilles Peskine449bd832023-01-11 14:50:10 +01001845 }
Ronald Cron81709fc2020-11-14 12:10:32 +01001846 }
Ronald Cron50972942020-11-14 11:28:25 +01001847
Gilles Peskine449bd832023-01-11 14:50:10 +01001848 return status;
Gilles Peskine4747d192019-04-17 15:05:45 +02001849}
1850
1851/** Abort the creation of a key.
1852 *
1853 * You may call this function after calling psa_start_key_creation(),
1854 * or after psa_finish_key_creation() fails. In other circumstances, this
1855 * function may not clean up persistent storage.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001856 * See the documentation of psa_start_key_creation() for the intended use
1857 * of this function.
Gilles Peskine4747d192019-04-17 15:05:45 +02001858 *
Gilles Peskine011e4282019-06-26 18:34:38 +02001859 * \param[in,out] slot Pointer to the slot with key material.
1860 * \param[in] driver The secure element driver for the key,
1861 * or NULL for a transparent key.
Gilles Peskine4747d192019-04-17 15:05:45 +02001862 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001863static void psa_fail_key_creation(psa_key_slot_t *slot,
1864 psa_se_drv_table_entry_t *driver)
Gilles Peskine4747d192019-04-17 15:05:45 +02001865{
Gilles Peskine011e4282019-06-26 18:34:38 +02001866 (void) driver;
1867
Gilles Peskine449bd832023-01-11 14:50:10 +01001868 if (slot == NULL) {
Gilles Peskine4747d192019-04-17 15:05:45 +02001869 return;
Gilles Peskine449bd832023-01-11 14:50:10 +01001870 }
Gilles Peskine011e4282019-06-26 18:34:38 +02001871
1872#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Janos Follath1d57a202019-08-13 12:15:34 +01001873 /* TODO: If the key has already been created in the secure
Gilles Peskine011e4282019-06-26 18:34:38 +02001874 * element, and the failure happened later (when saving metadata
1875 * to internal storage), we need to destroy the key in the secure
Gilles Peskinec9d7f942019-08-13 16:17:16 +02001876 * element.
1877 * https://github.com/ARMmbed/mbed-crypto/issues/217
1878 */
Gilles Peskinefc762652019-07-22 19:30:34 +02001879
Gilles Peskined7729582019-08-05 15:55:54 +02001880 /* Abort the ongoing transaction if any (there may not be one if
1881 * the creation process failed before starting one, or if the
1882 * key creation is a registration of a key in a secure element).
1883 * Earlier functions must already have done what it takes to undo any
1884 * partial creation. All that's left is to update the transaction data
1885 * itself. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001886 (void) psa_crypto_stop_transaction();
Gilles Peskine011e4282019-06-26 18:34:38 +02001887#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1888
Gilles Peskine449bd832023-01-11 14:50:10 +01001889 psa_wipe_key_slot(slot);
Gilles Peskine4747d192019-04-17 15:05:45 +02001890}
1891
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001892/** Validate optional attributes during key creation.
1893 *
1894 * Some key attributes are optional during key creation. If they are
1895 * specified in the attributes structure, check that they are consistent
1896 * with the data in the slot.
1897 *
1898 * This function should be called near the end of key creation, after
1899 * the slot in memory is fully populated but before saving persistent data.
1900 */
1901static psa_status_t psa_validate_optional_attributes(
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001902 const psa_key_slot_t *slot,
Gilles Peskine449bd832023-01-11 14:50:10 +01001903 const psa_key_attributes_t *attributes)
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001904{
Gilles Peskine449bd832023-01-11 14:50:10 +01001905 if (attributes->core.type != 0) {
1906 if (attributes->core.type != slot->attr.type) {
1907 return PSA_ERROR_INVALID_ARGUMENT;
1908 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001909 }
1910
Gilles Peskine449bd832023-01-11 14:50:10 +01001911 if (attributes->domain_parameters_size != 0) {
John Durkop0e005192020-10-31 22:06:54 -07001912#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01001913 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
1914 if (PSA_KEY_TYPE_IS_RSA(slot->attr.type)) {
Steven Cooremana2371e52020-07-28 14:30:39 +02001915 mbedtls_rsa_context *rsa = NULL;
Steven Cooreman75b74362020-07-28 14:30:13 +02001916 mbedtls_mpi actual, required;
Steven Cooreman6d839f02020-07-30 11:36:45 +02001917 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Steven Cooremana01795d2020-07-24 22:48:15 +02001918
Ronald Cron90857082020-11-25 14:58:33 +01001919 psa_status_t status = mbedtls_psa_rsa_load_representation(
Gilles Peskine449bd832023-01-11 14:50:10 +01001920 slot->attr.type,
1921 slot->key.data,
1922 slot->key.bytes,
1923 &rsa);
1924 if (status != PSA_SUCCESS) {
1925 return status;
1926 }
Steven Cooreman75b74362020-07-28 14:30:13 +02001927
Gilles Peskine449bd832023-01-11 14:50:10 +01001928 mbedtls_mpi_init(&actual);
1929 mbedtls_mpi_init(&required);
1930 ret = mbedtls_rsa_export(rsa,
1931 NULL, NULL, NULL, NULL, &actual);
1932 mbedtls_rsa_free(rsa);
1933 mbedtls_free(rsa);
1934 if (ret != 0) {
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001935 goto rsa_exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001936 }
1937 ret = mbedtls_mpi_read_binary(&required,
1938 attributes->domain_parameters,
1939 attributes->domain_parameters_size);
1940 if (ret != 0) {
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001941 goto rsa_exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001942 }
1943 if (mbedtls_mpi_cmp_mpi(&actual, &required) != 0) {
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001944 ret = MBEDTLS_ERR_RSA_BAD_INPUT_DATA;
Gilles Peskine449bd832023-01-11 14:50:10 +01001945 }
1946rsa_exit:
1947 mbedtls_mpi_free(&actual);
1948 mbedtls_mpi_free(&required);
1949 if (ret != 0) {
1950 return mbedtls_to_psa_error(ret);
1951 }
1952 } else
John Durkop9814fa22020-11-04 12:28:15 -08001953#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
1954 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001955 {
Gilles Peskine449bd832023-01-11 14:50:10 +01001956 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001957 }
1958 }
1959
Gilles Peskine449bd832023-01-11 14:50:10 +01001960 if (attributes->core.bits != 0) {
1961 if (attributes->core.bits != slot->attr.bits) {
1962 return PSA_ERROR_INVALID_ARGUMENT;
1963 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001964 }
1965
Gilles Peskine449bd832023-01-11 14:50:10 +01001966 return PSA_SUCCESS;
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001967}
1968
Gilles Peskine449bd832023-01-11 14:50:10 +01001969psa_status_t psa_import_key(const psa_key_attributes_t *attributes,
1970 const uint8_t *data,
1971 size_t data_length,
1972 mbedtls_svc_key_id_t *key)
Gilles Peskine4747d192019-04-17 15:05:45 +02001973{
1974 psa_status_t status;
1975 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02001976 psa_se_drv_table_entry_t *driver = NULL;
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01001977 size_t bits;
Archanad8a83dc2021-06-14 10:04:16 +05301978 size_t storage_size = data_length;
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001979
Ronald Cron81709fc2020-11-14 12:10:32 +01001980 *key = MBEDTLS_SVC_KEY_ID_INIT;
1981
Gilles Peskine0f84d622019-09-12 19:03:13 +02001982 /* Reject zero-length symmetric keys (including raw data key objects).
1983 * This also rejects any key which might be encoded as an empty string,
1984 * which is never valid. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001985 if (data_length == 0) {
1986 return PSA_ERROR_INVALID_ARGUMENT;
1987 }
Gilles Peskine0f84d622019-09-12 19:03:13 +02001988
Archana449608b2021-09-08 15:36:05 +05301989 /* Ensure that the bytes-to-bits conversion cannot overflow. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001990 if (data_length > SIZE_MAX / 8) {
1991 return PSA_ERROR_NOT_SUPPORTED;
1992 }
Archana6ed4bda2021-08-04 10:47:15 +05301993
Gilles Peskine449bd832023-01-11 14:50:10 +01001994 status = psa_start_key_creation(PSA_KEY_CREATION_IMPORT, attributes,
1995 &slot, &driver);
1996 if (status != PSA_SUCCESS) {
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001997 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001998 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001999
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01002000 /* In the case of a transparent key or an opaque key stored in local
Archana449608b2021-09-08 15:36:05 +05302001 * storage ( thus not in the case of importing a key in a secure element
2002 * with storage ( MBEDTLS_PSA_CRYPTO_SE_C ) ),we have to allocate a
2003 * buffer to hold the imported key material. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002004 if (slot->key.data == NULL) {
2005 if (psa_key_lifetime_is_external(attributes->core.lifetime)) {
Archana449608b2021-09-08 15:36:05 +05302006 status = psa_driver_wrapper_get_key_buffer_size_from_key_data(
Gilles Peskine449bd832023-01-11 14:50:10 +01002007 attributes, data, data_length, &storage_size);
2008 if (status != PSA_SUCCESS) {
Archanad8a83dc2021-06-14 10:04:16 +05302009 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002010 }
Archanad8a83dc2021-06-14 10:04:16 +05302011 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002012 status = psa_allocate_buffer_to_slot(slot, storage_size);
2013 if (status != PSA_SUCCESS) {
Gilles Peskineb46bef22019-07-30 21:32:04 +02002014 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002015 }
Gilles Peskine5d309672019-07-12 23:47:28 +02002016 }
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01002017
2018 bits = slot->attr.bits;
Gilles Peskine449bd832023-01-11 14:50:10 +01002019 status = psa_driver_wrapper_import_key(attributes,
2020 data, data_length,
2021 slot->key.data,
2022 slot->key.bytes,
2023 &slot->key.bytes, &bits);
2024 if (status != PSA_SUCCESS) {
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01002025 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002026 }
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01002027
Gilles Peskine449bd832023-01-11 14:50:10 +01002028 if (slot->attr.bits == 0) {
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01002029 slot->attr.bits = (psa_key_bits_t) bits;
Gilles Peskine449bd832023-01-11 14:50:10 +01002030 } else if (bits != slot->attr.bits) {
Steven Cooremanac3434f2021-01-15 17:36:02 +01002031 status = PSA_ERROR_INVALID_ARGUMENT;
2032 goto exit;
Gilles Peskine5d309672019-07-12 23:47:28 +02002033 }
Ronald Cron2ebfdcc2020-11-28 15:54:54 +01002034
Archana6ed4bda2021-08-04 10:47:15 +05302035 /* Enforce a size limit, and in particular ensure that the bit
2036 * size fits in its representation type.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01002037 if (bits > PSA_MAX_KEY_BITS) {
Archana6ed4bda2021-08-04 10:47:15 +05302038 status = PSA_ERROR_NOT_SUPPORTED;
2039 goto exit;
2040 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002041 status = psa_validate_optional_attributes(slot, attributes);
2042 if (status != PSA_SUCCESS) {
Gilles Peskine18017402019-07-24 20:25:59 +02002043 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002044 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002045
Gilles Peskine449bd832023-01-11 14:50:10 +01002046 status = psa_finish_key_creation(slot, driver, key);
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002047exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002048 if (status != PSA_SUCCESS) {
2049 psa_fail_key_creation(slot, driver);
2050 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02002051
Gilles Peskine449bd832023-01-11 14:50:10 +01002052 return status;
Gilles Peskine4747d192019-04-17 15:05:45 +02002053}
2054
Gilles Peskined7729582019-08-05 15:55:54 +02002055#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
2056psa_status_t mbedtls_psa_register_se_key(
Gilles Peskine449bd832023-01-11 14:50:10 +01002057 const psa_key_attributes_t *attributes)
Gilles Peskined7729582019-08-05 15:55:54 +02002058{
2059 psa_status_t status;
2060 psa_key_slot_t *slot = NULL;
2061 psa_se_drv_table_entry_t *driver = NULL;
Ronald Croncf56a0a2020-08-04 09:51:30 +02002062 mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT;
Gilles Peskined7729582019-08-05 15:55:54 +02002063
2064 /* Leaving attributes unspecified is not currently supported.
2065 * It could make sense to query the key type and size from the
2066 * secure element, but not all secure elements support this
2067 * and the driver HAL doesn't currently support it. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002068 if (psa_get_key_type(attributes) == PSA_KEY_TYPE_NONE) {
2069 return PSA_ERROR_NOT_SUPPORTED;
2070 }
2071 if (psa_get_key_bits(attributes) == 0) {
2072 return PSA_ERROR_NOT_SUPPORTED;
2073 }
Gilles Peskined7729582019-08-05 15:55:54 +02002074
Gilles Peskine449bd832023-01-11 14:50:10 +01002075 status = psa_start_key_creation(PSA_KEY_CREATION_REGISTER, attributes,
2076 &slot, &driver);
2077 if (status != PSA_SUCCESS) {
Gilles Peskined7729582019-08-05 15:55:54 +02002078 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002079 }
Gilles Peskined7729582019-08-05 15:55:54 +02002080
Gilles Peskine449bd832023-01-11 14:50:10 +01002081 status = psa_finish_key_creation(slot, driver, &key);
Gilles Peskined7729582019-08-05 15:55:54 +02002082
2083exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002084 if (status != PSA_SUCCESS) {
2085 psa_fail_key_creation(slot, driver);
2086 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02002087
Gilles Peskined7729582019-08-05 15:55:54 +02002088 /* Registration doesn't keep the key in RAM. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002089 psa_close_key(key);
2090 return status;
Gilles Peskined7729582019-08-05 15:55:54 +02002091}
2092#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
2093
Gilles Peskine449bd832023-01-11 14:50:10 +01002094psa_status_t psa_copy_key(mbedtls_svc_key_id_t source_key,
2095 const psa_key_attributes_t *specified_attributes,
2096 mbedtls_svc_key_id_t *target_key)
Gilles Peskinef603c712019-01-19 13:40:11 +01002097{
Ronald Cronf95a2b12020-10-22 15:24:49 +02002098 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01002099 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinef603c712019-01-19 13:40:11 +01002100 psa_key_slot_t *source_slot = NULL;
2101 psa_key_slot_t *target_slot = NULL;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002102 psa_key_attributes_t actual_attributes = *specified_attributes;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02002103 psa_se_drv_table_entry_t *driver = NULL;
Archana8a180362021-07-05 02:18:48 +05302104 size_t storage_size = 0;
Gilles Peskinef603c712019-01-19 13:40:11 +01002105
Ronald Cron81709fc2020-11-14 12:10:32 +01002106 *target_key = MBEDTLS_SVC_KEY_ID_INIT;
2107
Archana8a180362021-07-05 02:18:48 +05302108 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002109 source_key, &source_slot, PSA_KEY_USAGE_COPY, 0);
2110 if (status != PSA_SUCCESS) {
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002111 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002112 }
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002113
Gilles Peskine449bd832023-01-11 14:50:10 +01002114 status = psa_validate_optional_attributes(source_slot,
2115 specified_attributes);
2116 if (status != PSA_SUCCESS) {
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002117 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002118 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002119
Archana9d17bf42021-09-10 06:22:44 +05302120 /* The target key type and number of bits have been validated by
2121 * psa_validate_optional_attributes() to be either equal to zero or
2122 * equal to the ones of the source key. So it is safe to inherit
2123 * them from the source key now."
Archana374fe5b2021-09-08 15:50:28 +05302124 * */
Archana9d17bf42021-09-10 06:22:44 +05302125 actual_attributes.core.bits = source_slot->attr.bits;
2126 actual_attributes.core.type = source_slot->attr.type;
Archana374fe5b2021-09-08 15:50:28 +05302127
2128
Gilles Peskine449bd832023-01-11 14:50:10 +01002129 status = psa_restrict_key_policy(source_slot->attr.type,
2130 &actual_attributes.core.policy,
2131 &source_slot->attr.policy);
2132 if (status != PSA_SUCCESS) {
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002133 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002134 }
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002135
Gilles Peskine449bd832023-01-11 14:50:10 +01002136 status = psa_start_key_creation(PSA_KEY_CREATION_COPY, &actual_attributes,
2137 &target_slot, &driver);
2138 if (status != PSA_SUCCESS) {
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002139 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002140 }
2141 if (PSA_KEY_LIFETIME_GET_LOCATION(target_slot->attr.lifetime) !=
2142 PSA_KEY_LIFETIME_GET_LOCATION(source_slot->attr.lifetime)) {
Archana8a180362021-07-05 02:18:48 +05302143 /*
Archana9d17bf42021-09-10 06:22:44 +05302144 * If the source and target keys are stored in different locations,
Archana8a180362021-07-05 02:18:48 +05302145 * the source key would need to be exported as plaintext and re-imported
2146 * in the other location. This has security implications which have not
Archana449608b2021-09-08 15:36:05 +05302147 * been fully mapped. For now, this can be achieved through
Archana8a180362021-07-05 02:18:48 +05302148 * appropriate API invocations from the application, if needed.
2149 * */
Gilles Peskinef4ee6622019-07-24 13:44:30 +02002150 status = PSA_ERROR_NOT_SUPPORTED;
2151 goto exit;
Gilles Peskinef603c712019-01-19 13:40:11 +01002152 }
Archana8a180362021-07-05 02:18:48 +05302153 /*
2154 * When the source and target keys are within the same location,
Archana449608b2021-09-08 15:36:05 +05302155 * - For transparent keys it is a blind copy without any driver invocation,
Archana8a180362021-07-05 02:18:48 +05302156 * - For opaque keys this translates to an invocation of the drivers'
2157 * copy_key entry point through the dispatch layer.
2158 * */
Gilles Peskine449bd832023-01-11 14:50:10 +01002159 if (psa_key_lifetime_is_external(actual_attributes.core.lifetime)) {
2160 status = psa_driver_wrapper_get_key_buffer_size(&actual_attributes,
2161 &storage_size);
2162 if (status != PSA_SUCCESS) {
Archana8a180362021-07-05 02:18:48 +05302163 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002164 }
Archana374fe5b2021-09-08 15:50:28 +05302165
Gilles Peskine449bd832023-01-11 14:50:10 +01002166 status = psa_allocate_buffer_to_slot(target_slot, storage_size);
2167 if (status != PSA_SUCCESS) {
Archana8a180362021-07-05 02:18:48 +05302168 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002169 }
Archana374fe5b2021-09-08 15:50:28 +05302170
Gilles Peskine449bd832023-01-11 14:50:10 +01002171 status = psa_driver_wrapper_copy_key(&actual_attributes,
2172 source_slot->key.data,
2173 source_slot->key.bytes,
2174 target_slot->key.data,
2175 target_slot->key.bytes,
2176 &target_slot->key.bytes);
2177 if (status != PSA_SUCCESS) {
Archana8a180362021-07-05 02:18:48 +05302178 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002179 }
2180 } else {
2181 status = psa_copy_key_material_into_slot(target_slot,
Archana9d17bf42021-09-10 06:22:44 +05302182 source_slot->key.data,
Gilles Peskine449bd832023-01-11 14:50:10 +01002183 source_slot->key.bytes);
2184 if (status != PSA_SUCCESS) {
Archana8a180362021-07-05 02:18:48 +05302185 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002186 }
Archana8a180362021-07-05 02:18:48 +05302187 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002188 status = psa_finish_key_creation(target_slot, driver, target_key);
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002189exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002190 if (status != PSA_SUCCESS) {
2191 psa_fail_key_creation(target_slot, driver);
2192 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02002193
Gilles Peskine449bd832023-01-11 14:50:10 +01002194 unlock_status = psa_unlock_key_slot(source_slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02002195
Gilles Peskine449bd832023-01-11 14:50:10 +01002196 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskinef603c712019-01-19 13:40:11 +01002197}
2198
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02002199
2200
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01002201/****************************************************************/
Gilles Peskine20035e32018-02-03 22:44:14 +01002202/* Message digests */
2203/****************************************************************/
2204
Gilles Peskine449bd832023-01-11 14:50:10 +01002205psa_status_t psa_hash_abort(psa_hash_operation_t *operation)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002206{
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002207 /* Aborting a non-active operation is allowed */
Gilles Peskine449bd832023-01-11 14:50:10 +01002208 if (operation->id == 0) {
2209 return PSA_SUCCESS;
2210 }
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002211
Gilles Peskine449bd832023-01-11 14:50:10 +01002212 psa_status_t status = psa_driver_wrapper_hash_abort(operation);
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002213 operation->id = 0;
2214
Gilles Peskine449bd832023-01-11 14:50:10 +01002215 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002216}
2217
Gilles Peskine449bd832023-01-11 14:50:10 +01002218psa_status_t psa_hash_setup(psa_hash_operation_t *operation,
2219 psa_algorithm_t alg)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002220{
Dave Rodgman685b6a72021-06-24 11:49:14 +01002221 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002222
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002223 /* A context must be freshly initialized before it can be set up. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002224 if (operation->id != 0) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002225 status = PSA_ERROR_BAD_STATE;
2226 goto exit;
2227 }
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002228
Gilles Peskine449bd832023-01-11 14:50:10 +01002229 if (!PSA_ALG_IS_HASH(alg)) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002230 status = PSA_ERROR_INVALID_ARGUMENT;
2231 goto exit;
2232 }
Jaeden Amero36ee5d02019-02-19 09:25:10 +00002233
Steven Cooremanb6bf4bb2021-03-15 19:00:14 +01002234 /* Ensure all of the context is zeroized, since PSA_HASH_OPERATION_INIT only
2235 * directly zeroes the int-sized dummy member of the context union. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002236 memset(&operation->ctx, 0, sizeof(operation->ctx));
Steven Cooreman893232f2021-03-15 12:23:37 +01002237
Gilles Peskine449bd832023-01-11 14:50:10 +01002238 status = psa_driver_wrapper_hash_setup(operation, alg);
Dave Rodgman685b6a72021-06-24 11:49:14 +01002239
2240exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002241 if (status != PSA_SUCCESS) {
2242 psa_hash_abort(operation);
2243 }
Dave Rodgman685b6a72021-06-24 11:49:14 +01002244
2245 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002246}
2247
Gilles Peskine449bd832023-01-11 14:50:10 +01002248psa_status_t psa_hash_update(psa_hash_operation_t *operation,
2249 const uint8_t *input,
2250 size_t input_length)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002251{
Dave Rodgman685b6a72021-06-24 11:49:14 +01002252 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2253
Gilles Peskine449bd832023-01-11 14:50:10 +01002254 if (operation->id == 0) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002255 status = PSA_ERROR_BAD_STATE;
2256 goto exit;
2257 }
Gilles Peskine94e44542018-07-12 16:58:43 +02002258
Steven Cooremanc8288352021-03-04 14:02:19 +01002259 /* Don't require hash implementations to behave correctly on a
2260 * zero-length input, which may have an invalid pointer. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002261 if (input_length == 0) {
2262 return PSA_SUCCESS;
2263 }
Steven Cooremanc8288352021-03-04 14:02:19 +01002264
Gilles Peskine449bd832023-01-11 14:50:10 +01002265 status = psa_driver_wrapper_hash_update(operation, input, input_length);
Dave Rodgman685b6a72021-06-24 11:49:14 +01002266
2267exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002268 if (status != PSA_SUCCESS) {
2269 psa_hash_abort(operation);
2270 }
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002271
Gilles Peskine449bd832023-01-11 14:50:10 +01002272 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002273}
2274
Gilles Peskine449bd832023-01-11 14:50:10 +01002275psa_status_t psa_hash_finish(psa_hash_operation_t *operation,
2276 uint8_t *hash,
2277 size_t hash_size,
2278 size_t *hash_length)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002279{
Steven Cooremanfbe09282021-03-08 18:41:12 +01002280 *hash_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01002281 if (operation->id == 0) {
2282 return PSA_ERROR_BAD_STATE;
2283 }
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002284
Steven Cooreman1e582352021-02-18 17:24:37 +01002285 psa_status_t status = psa_driver_wrapper_hash_finish(
Gilles Peskine449bd832023-01-11 14:50:10 +01002286 operation, hash, hash_size, hash_length);
2287 psa_hash_abort(operation);
2288 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002289}
2290
Gilles Peskine449bd832023-01-11 14:50:10 +01002291psa_status_t psa_hash_verify(psa_hash_operation_t *operation,
2292 const uint8_t *hash,
2293 size_t hash_length)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002294{
Ronald Cron69a63422021-10-18 09:47:58 +02002295 uint8_t actual_hash[PSA_HASH_MAX_SIZE];
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002296 size_t actual_hash_length;
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002297 psa_status_t status = psa_hash_finish(
Gilles Peskine449bd832023-01-11 14:50:10 +01002298 operation,
2299 actual_hash, sizeof(actual_hash),
2300 &actual_hash_length);
Dave Rodgman685b6a72021-06-24 11:49:14 +01002301
Gilles Peskine449bd832023-01-11 14:50:10 +01002302 if (status != PSA_SUCCESS) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002303 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002304 }
Dave Rodgman685b6a72021-06-24 11:49:14 +01002305
Gilles Peskine449bd832023-01-11 14:50:10 +01002306 if (actual_hash_length != hash_length) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002307 status = PSA_ERROR_INVALID_SIGNATURE;
2308 goto exit;
2309 }
2310
Gilles Peskine449bd832023-01-11 14:50:10 +01002311 if (mbedtls_psa_safer_memcmp(hash, actual_hash, actual_hash_length) != 0) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002312 status = PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskine449bd832023-01-11 14:50:10 +01002313 }
Dave Rodgman685b6a72021-06-24 11:49:14 +01002314
2315exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002316 mbedtls_platform_zeroize(actual_hash, sizeof(actual_hash));
2317 if (status != PSA_SUCCESS) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002318 psa_hash_abort(operation);
Gilles Peskine449bd832023-01-11 14:50:10 +01002319 }
Dave Rodgman685b6a72021-06-24 11:49:14 +01002320
Gilles Peskine449bd832023-01-11 14:50:10 +01002321 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002322}
2323
Gilles Peskine449bd832023-01-11 14:50:10 +01002324psa_status_t psa_hash_compute(psa_algorithm_t alg,
2325 const uint8_t *input, size_t input_length,
2326 uint8_t *hash, size_t hash_size,
2327 size_t *hash_length)
Gilles Peskine0a749c82019-11-28 19:33:58 +01002328{
Steven Cooremanfbe09282021-03-08 18:41:12 +01002329 *hash_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01002330 if (!PSA_ALG_IS_HASH(alg)) {
2331 return PSA_ERROR_INVALID_ARGUMENT;
2332 }
Steven Cooremanf66d5fd2021-03-08 18:40:40 +01002333
Gilles Peskine449bd832023-01-11 14:50:10 +01002334 return psa_driver_wrapper_hash_compute(alg, input, input_length,
2335 hash, hash_size, hash_length);
Gilles Peskine0a749c82019-11-28 19:33:58 +01002336}
2337
Gilles Peskine449bd832023-01-11 14:50:10 +01002338psa_status_t psa_hash_compare(psa_algorithm_t alg,
2339 const uint8_t *input, size_t input_length,
2340 const uint8_t *hash, size_t hash_length)
Gilles Peskine0a749c82019-11-28 19:33:58 +01002341{
Ronald Cron69a63422021-10-18 09:47:58 +02002342 uint8_t actual_hash[PSA_HASH_MAX_SIZE];
Steven Cooreman84d670d2021-02-18 16:22:53 +01002343 size_t actual_hash_length;
Steven Cooremanf66d5fd2021-03-08 18:40:40 +01002344
Gilles Peskine449bd832023-01-11 14:50:10 +01002345 if (!PSA_ALG_IS_HASH(alg)) {
2346 return PSA_ERROR_INVALID_ARGUMENT;
2347 }
Steven Cooremanf66d5fd2021-03-08 18:40:40 +01002348
Steven Cooreman1e582352021-02-18 17:24:37 +01002349 psa_status_t status = psa_driver_wrapper_hash_compute(
Gilles Peskine449bd832023-01-11 14:50:10 +01002350 alg, input, input_length,
2351 actual_hash, sizeof(actual_hash),
2352 &actual_hash_length);
2353 if (status != PSA_SUCCESS) {
Gilles Peskine60aebec2021-12-13 12:33:18 +01002354 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002355 }
2356 if (actual_hash_length != hash_length) {
Gilles Peskine60aebec2021-12-13 12:33:18 +01002357 status = PSA_ERROR_INVALID_SIGNATURE;
2358 goto exit;
2359 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002360 if (mbedtls_psa_safer_memcmp(hash, actual_hash, actual_hash_length) != 0) {
Gilles Peskine60aebec2021-12-13 12:33:18 +01002361 status = PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskine449bd832023-01-11 14:50:10 +01002362 }
Gilles Peskine60aebec2021-12-13 12:33:18 +01002363
2364exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002365 mbedtls_platform_zeroize(actual_hash, sizeof(actual_hash));
2366 return status;
Gilles Peskine0a749c82019-11-28 19:33:58 +01002367}
2368
Gilles Peskine449bd832023-01-11 14:50:10 +01002369psa_status_t psa_hash_clone(const psa_hash_operation_t *source_operation,
2370 psa_hash_operation_t *target_operation)
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002371{
Gilles Peskine449bd832023-01-11 14:50:10 +01002372 if (source_operation->id == 0 ||
2373 target_operation->id != 0) {
2374 return PSA_ERROR_BAD_STATE;
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002375 }
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002376
Gilles Peskine449bd832023-01-11 14:50:10 +01002377 psa_status_t status = psa_driver_wrapper_hash_clone(source_operation,
2378 target_operation);
2379 if (status != PSA_SUCCESS) {
2380 psa_hash_abort(target_operation);
2381 }
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002382
Gilles Peskine449bd832023-01-11 14:50:10 +01002383 return status;
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002384}
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002385
2386
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002387/****************************************************************/
Gilles Peskine8c9def32018-02-08 10:02:12 +01002388/* MAC */
2389/****************************************************************/
2390
Gilles Peskine449bd832023-01-11 14:50:10 +01002391psa_status_t psa_mac_abort(psa_mac_operation_t *operation)
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002392{
Steven Cooremane6804192021-03-19 18:28:56 +01002393 /* Aborting a non-active operation is allowed */
Gilles Peskine449bd832023-01-11 14:50:10 +01002394 if (operation->id == 0) {
2395 return PSA_SUCCESS;
2396 }
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002397
Gilles Peskine449bd832023-01-11 14:50:10 +01002398 psa_status_t status = psa_driver_wrapper_mac_abort(operation);
Steven Cooreman72f736a2021-05-07 14:14:37 +02002399 operation->mac_size = 0;
2400 operation->is_sign = 0;
Steven Cooremane6804192021-03-19 18:28:56 +01002401 operation->id = 0;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002402
Gilles Peskine449bd832023-01-11 14:50:10 +01002403 return status;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002404}
2405
Ronald Cron2dff3b22021-06-17 16:33:22 +02002406static psa_status_t psa_mac_finalize_alg_and_key_validation(
2407 psa_algorithm_t alg,
Ronald Cron79bdd822021-06-17 16:46:44 +02002408 const psa_key_attributes_t *attributes,
Gilles Peskine449bd832023-01-11 14:50:10 +01002409 uint8_t *mac_size)
Gilles Peskine8c9def32018-02-08 10:02:12 +01002410{
Ronald Cronf95a2b12020-10-22 15:24:49 +02002411 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine449bd832023-01-11 14:50:10 +01002412 psa_key_type_t key_type = psa_get_key_type(attributes);
2413 size_t key_bits = psa_get_key_bits(attributes);
Steven Cooreman77e2cc52021-03-19 17:05:52 +01002414
Gilles Peskine449bd832023-01-11 14:50:10 +01002415 if (!PSA_ALG_IS_MAC(alg)) {
2416 return PSA_ERROR_INVALID_ARGUMENT;
2417 }
Steven Cooremane6804192021-03-19 18:28:56 +01002418
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +01002419 /* Validate the combination of key type and algorithm */
Gilles Peskine449bd832023-01-11 14:50:10 +01002420 status = psa_mac_key_can_do(alg, key_type);
2421 if (status != PSA_SUCCESS) {
2422 return status;
2423 }
Steven Cooreman15472f82021-03-02 16:16:22 +01002424
Steven Cooremand1a68f12021-05-10 11:13:41 +02002425 /* Get the output length for the algorithm and key combination */
Gilles Peskine449bd832023-01-11 14:50:10 +01002426 *mac_size = PSA_MAC_LENGTH(key_type, key_bits, alg);
Steven Cooreman15472f82021-03-02 16:16:22 +01002427
Gilles Peskine449bd832023-01-11 14:50:10 +01002428 if (*mac_size < 4) {
Steven Cooreman15472f82021-03-02 16:16:22 +01002429 /* A very short MAC is too short for security since it can be
2430 * brute-forced. Ancient protocols with 32-bit MACs do exist,
2431 * so we make this our minimum, even though 32 bits is still
2432 * too small for security. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002433 return PSA_ERROR_NOT_SUPPORTED;
Steven Cooreman15472f82021-03-02 16:16:22 +01002434 }
Gilles Peskineab1d7ab2018-07-06 16:07:47 +02002435
Gilles Peskine449bd832023-01-11 14:50:10 +01002436 if (*mac_size > PSA_MAC_LENGTH(key_type, key_bits,
2437 PSA_ALG_FULL_LENGTH_MAC(alg))) {
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +01002438 /* It's impossible to "truncate" to a larger length than the full length
2439 * of the algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002440 return PSA_ERROR_INVALID_ARGUMENT;
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +01002441 }
2442
Gilles Peskine449bd832023-01-11 14:50:10 +01002443 if (*mac_size > PSA_MAC_MAX_SIZE) {
Gilles Peskinea9b6c802022-03-16 13:54:49 +01002444 /* PSA_MAC_LENGTH returns the correct length even for a MAC algorithm
2445 * that is disabled in the compile-time configuration. The result can
2446 * therefore be larger than PSA_MAC_MAX_SIZE, which does take the
2447 * configuration into account. In this case, force a return of
2448 * PSA_ERROR_NOT_SUPPORTED here. Otherwise psa_mac_verify(), or
2449 * psa_mac_compute(mac_size=PSA_MAC_MAX_SIZE), would return
2450 * PSA_ERROR_BUFFER_TOO_SMALL for an unsupported algorithm whose MAC size
2451 * is larger than PSA_MAC_MAX_SIZE, which is misleading and which breaks
2452 * systematically generated tests. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002453 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea9b6c802022-03-16 13:54:49 +01002454 }
2455
Gilles Peskine449bd832023-01-11 14:50:10 +01002456 return PSA_SUCCESS;
Ronald Cron2dff3b22021-06-17 16:33:22 +02002457}
2458
Gilles Peskine449bd832023-01-11 14:50:10 +01002459static psa_status_t psa_mac_setup(psa_mac_operation_t *operation,
2460 mbedtls_svc_key_id_t key,
2461 psa_algorithm_t alg,
2462 int is_sign)
Gilles Peskinee59236f2018-01-27 23:32:46 +01002463{
2464 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2465 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Dave Rodgman54648242021-06-24 11:49:45 +01002466 psa_key_slot_t *slot = NULL;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002467
2468 /* A context must be freshly initialized before it can be set up. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002469 if (operation->id != 0) {
Dave Rodgman54648242021-06-24 11:49:45 +01002470 status = PSA_ERROR_BAD_STATE;
2471 goto exit;
2472 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002473
2474 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002475 key,
2476 &slot,
2477 is_sign ? PSA_KEY_USAGE_SIGN_MESSAGE : PSA_KEY_USAGE_VERIFY_MESSAGE,
2478 alg);
2479 if (status != PSA_SUCCESS) {
Dave Rodgman54648242021-06-24 11:49:45 +01002480 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002481 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002482
2483 psa_key_attributes_t attributes = {
2484 .core = slot->attr
2485 };
2486
Gilles Peskine449bd832023-01-11 14:50:10 +01002487 status = psa_mac_finalize_alg_and_key_validation(alg, &attributes,
2488 &operation->mac_size);
2489 if (status != PSA_SUCCESS) {
Gilles Peskine8c9def32018-02-08 10:02:12 +01002490 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002491 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002492
2493 operation->is_sign = is_sign;
Steven Cooremane6804192021-03-19 18:28:56 +01002494 /* Dispatch the MAC setup call with validated input */
Gilles Peskine449bd832023-01-11 14:50:10 +01002495 if (is_sign) {
2496 status = psa_driver_wrapper_mac_sign_setup(operation,
2497 &attributes,
2498 slot->key.data,
2499 slot->key.bytes,
2500 alg);
2501 } else {
2502 status = psa_driver_wrapper_mac_verify_setup(operation,
2503 &attributes,
2504 slot->key.data,
2505 slot->key.bytes,
2506 alg);
Gilles Peskine8c9def32018-02-08 10:02:12 +01002507 }
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002508
Gilles Peskinefbfac682018-07-08 20:51:54 +02002509exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002510 if (status != PSA_SUCCESS) {
2511 psa_mac_abort(operation);
2512 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02002513
Gilles Peskine449bd832023-01-11 14:50:10 +01002514 unlock_status = psa_unlock_key_slot(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02002515
Gilles Peskine449bd832023-01-11 14:50:10 +01002516 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002517}
2518
Gilles Peskine449bd832023-01-11 14:50:10 +01002519psa_status_t psa_mac_sign_setup(psa_mac_operation_t *operation,
2520 mbedtls_svc_key_id_t key,
2521 psa_algorithm_t alg)
Gilles Peskine89167cb2018-07-08 20:12:23 +02002522{
Gilles Peskine449bd832023-01-11 14:50:10 +01002523 return psa_mac_setup(operation, key, alg, 1);
Gilles Peskine89167cb2018-07-08 20:12:23 +02002524}
2525
Gilles Peskine449bd832023-01-11 14:50:10 +01002526psa_status_t psa_mac_verify_setup(psa_mac_operation_t *operation,
2527 mbedtls_svc_key_id_t key,
2528 psa_algorithm_t alg)
Gilles Peskine89167cb2018-07-08 20:12:23 +02002529{
Gilles Peskine449bd832023-01-11 14:50:10 +01002530 return psa_mac_setup(operation, key, alg, 0);
Gilles Peskine89167cb2018-07-08 20:12:23 +02002531}
2532
Gilles Peskine449bd832023-01-11 14:50:10 +01002533psa_status_t psa_mac_update(psa_mac_operation_t *operation,
2534 const uint8_t *input,
2535 size_t input_length)
Gilles Peskine8c9def32018-02-08 10:02:12 +01002536{
Gilles Peskine449bd832023-01-11 14:50:10 +01002537 if (operation->id == 0) {
2538 return PSA_ERROR_BAD_STATE;
2539 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002540
Steven Cooreman6e7f2912021-03-19 18:38:46 +01002541 /* Don't require hash implementations to behave correctly on a
2542 * zero-length input, which may have an invalid pointer. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002543 if (input_length == 0) {
2544 return PSA_SUCCESS;
2545 }
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03002546
Gilles Peskine449bd832023-01-11 14:50:10 +01002547 psa_status_t status = psa_driver_wrapper_mac_update(operation,
2548 input, input_length);
2549 if (status != PSA_SUCCESS) {
2550 psa_mac_abort(operation);
2551 }
Steven Cooreman6e7f2912021-03-19 18:38:46 +01002552
Gilles Peskine449bd832023-01-11 14:50:10 +01002553 return status;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002554}
2555
Gilles Peskine449bd832023-01-11 14:50:10 +01002556psa_status_t psa_mac_sign_finish(psa_mac_operation_t *operation,
2557 uint8_t *mac,
2558 size_t mac_size,
2559 size_t *mac_length)
mohammad16036df908f2018-04-02 08:34:15 -07002560{
Steven Cooremana5b860a2021-03-19 19:04:39 +01002561 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2562 psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED;
Steven Cooreman77e2cc52021-03-19 17:05:52 +01002563
Gilles Peskine449bd832023-01-11 14:50:10 +01002564 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002565 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002566 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002567 }
Jaeden Amero252ef282019-02-15 14:05:35 +00002568
Gilles Peskine449bd832023-01-11 14:50:10 +01002569 if (!operation->is_sign) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002570 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002571 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002572 }
Steven Cooreman72f736a2021-05-07 14:14:37 +02002573
Steven Cooreman8af5c5c2021-05-11 11:09:13 +02002574 /* Sanity check. This will guarantee that mac_size != 0 (and so mac != NULL)
2575 * once all the error checks are done. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002576 if (operation->mac_size == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002577 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002578 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002579 }
Steven Cooreman8af5c5c2021-05-11 11:09:13 +02002580
Gilles Peskine449bd832023-01-11 14:50:10 +01002581 if (mac_size < operation->mac_size) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002582 status = PSA_ERROR_BUFFER_TOO_SMALL;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002583 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002584 }
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002585
Gilles Peskine449bd832023-01-11 14:50:10 +01002586 status = psa_driver_wrapper_mac_sign_finish(operation,
2587 mac, operation->mac_size,
2588 mac_length);
Steven Cooreman72f736a2021-05-07 14:14:37 +02002589
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002590exit:
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002591 /* In case of success, set the potential excess room in the output buffer
2592 * to an invalid value, to avoid potentially leaking a longer MAC.
2593 * In case of error, set the output length and content to a safe default,
2594 * such that in case the caller misses an error check, the output would be
2595 * an unachievable MAC.
2596 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002597 if (status != PSA_SUCCESS) {
Steven Cooreman72f736a2021-05-07 14:14:37 +02002598 *mac_length = mac_size;
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002599 operation->mac_size = 0;
Steven Cooreman72f736a2021-05-07 14:14:37 +02002600 }
mohammad16036df908f2018-04-02 08:34:15 -07002601
Paul Elliottdc42ca82023-02-24 18:11:59 +00002602 psa_wipe_tag_output_buffer(mac, status, mac_size, *mac_length);
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002603
Gilles Peskine449bd832023-01-11 14:50:10 +01002604 abort_status = psa_mac_abort(operation);
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002605
Gilles Peskine449bd832023-01-11 14:50:10 +01002606 return status == PSA_SUCCESS ? abort_status : status;
mohammad16036df908f2018-04-02 08:34:15 -07002607}
2608
Gilles Peskine449bd832023-01-11 14:50:10 +01002609psa_status_t psa_mac_verify_finish(psa_mac_operation_t *operation,
2610 const uint8_t *mac,
2611 size_t mac_length)
Gilles Peskine8c9def32018-02-08 10:02:12 +01002612{
Steven Cooremana5b860a2021-03-19 19:04:39 +01002613 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2614 psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED;
Steven Cooreman77e2cc52021-03-19 17:05:52 +01002615
Gilles Peskine449bd832023-01-11 14:50:10 +01002616 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002617 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002618 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002619 }
Jaeden Amero252ef282019-02-15 14:05:35 +00002620
Gilles Peskine449bd832023-01-11 14:50:10 +01002621 if (operation->is_sign) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002622 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002623 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002624 }
Steven Cooreman72f736a2021-05-07 14:14:37 +02002625
Gilles Peskine449bd832023-01-11 14:50:10 +01002626 if (operation->mac_size != mac_length) {
Steven Cooreman72f736a2021-05-07 14:14:37 +02002627 status = PSA_ERROR_INVALID_SIGNATURE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002628 goto exit;
Steven Cooreman72f736a2021-05-07 14:14:37 +02002629 }
2630
Gilles Peskine449bd832023-01-11 14:50:10 +01002631 status = psa_driver_wrapper_mac_verify_finish(operation,
2632 mac, mac_length);
Steven Cooreman72f736a2021-05-07 14:14:37 +02002633
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002634exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002635 abort_status = psa_mac_abort(operation);
mohammad16036df908f2018-04-02 08:34:15 -07002636
Gilles Peskine449bd832023-01-11 14:50:10 +01002637 return status == PSA_SUCCESS ? abort_status : status;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002638}
2639
Gilles Peskine449bd832023-01-11 14:50:10 +01002640static psa_status_t psa_mac_compute_internal(mbedtls_svc_key_id_t key,
2641 psa_algorithm_t alg,
2642 const uint8_t *input,
2643 size_t input_length,
2644 uint8_t *mac,
2645 size_t mac_size,
2646 size_t *mac_length,
2647 int is_sign)
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002648{
2649 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron51131b52021-06-17 17:17:20 +02002650 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
2651 psa_key_slot_t *slot;
2652 uint8_t operation_mac_size = 0;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002653
Ronald Cron51131b52021-06-17 17:17:20 +02002654 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002655 key,
2656 &slot,
2657 is_sign ? PSA_KEY_USAGE_SIGN_MESSAGE : PSA_KEY_USAGE_VERIFY_MESSAGE,
2658 alg);
2659 if (status != PSA_SUCCESS) {
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002660 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002661 }
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002662
Ronald Cron51131b52021-06-17 17:17:20 +02002663 psa_key_attributes_t attributes = {
2664 .core = slot->attr
2665 };
2666
Gilles Peskine449bd832023-01-11 14:50:10 +01002667 status = psa_mac_finalize_alg_and_key_validation(alg, &attributes,
2668 &operation_mac_size);
2669 if (status != PSA_SUCCESS) {
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002670 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002671 }
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002672
Gilles Peskine449bd832023-01-11 14:50:10 +01002673 if (mac_size < operation_mac_size) {
Ronald Cron51131b52021-06-17 17:17:20 +02002674 status = PSA_ERROR_BUFFER_TOO_SMALL;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002675 goto exit;
Ronald Cron51131b52021-06-17 17:17:20 +02002676 }
2677
2678 status = psa_driver_wrapper_mac_compute(
Gilles Peskine449bd832023-01-11 14:50:10 +01002679 &attributes,
2680 slot->key.data, slot->key.bytes,
2681 alg,
2682 input, input_length,
2683 mac, operation_mac_size, mac_length);
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002684
2685exit:
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002686 /* In case of success, set the potential excess room in the output buffer
2687 * to an invalid value, to avoid potentially leaking a longer MAC.
2688 * In case of error, set the output length and content to a safe default,
2689 * such that in case the caller misses an error check, the output would be
2690 * an unachievable MAC.
2691 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002692 if (status != PSA_SUCCESS) {
Ronald Cron51131b52021-06-17 17:17:20 +02002693 *mac_length = mac_size;
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002694 operation_mac_size = 0;
Ronald Cron51131b52021-06-17 17:17:20 +02002695 }
Paul Elliottdc42ca82023-02-24 18:11:59 +00002696
2697 psa_wipe_tag_output_buffer(mac, status, mac_size, *mac_length);
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002698
Gilles Peskine449bd832023-01-11 14:50:10 +01002699 unlock_status = psa_unlock_key_slot(slot);
Ronald Cron51131b52021-06-17 17:17:20 +02002700
Gilles Peskine449bd832023-01-11 14:50:10 +01002701 return (status == PSA_SUCCESS) ? unlock_status : status;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002702}
2703
Gilles Peskine449bd832023-01-11 14:50:10 +01002704psa_status_t psa_mac_compute(mbedtls_svc_key_id_t key,
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002705 psa_algorithm_t alg,
2706 const uint8_t *input,
2707 size_t input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002708 uint8_t *mac,
2709 size_t mac_size,
2710 size_t *mac_length)
2711{
2712 return psa_mac_compute_internal(key, alg,
2713 input, input_length,
2714 mac, mac_size, mac_length, 1);
2715}
2716
2717psa_status_t psa_mac_verify(mbedtls_svc_key_id_t key,
2718 psa_algorithm_t alg,
2719 const uint8_t *input,
2720 size_t input_length,
2721 const uint8_t *mac,
2722 size_t mac_length)
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002723{
2724 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Crona587cbc2021-06-18 14:51:29 +02002725 uint8_t actual_mac[PSA_MAC_MAX_SIZE];
2726 size_t actual_mac_length;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002727
Gilles Peskine449bd832023-01-11 14:50:10 +01002728 status = psa_mac_compute_internal(key, alg,
2729 input, input_length,
2730 actual_mac, sizeof(actual_mac),
2731 &actual_mac_length, 0);
2732 if (status != PSA_SUCCESS) {
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002733 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002734 }
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002735
Gilles Peskine449bd832023-01-11 14:50:10 +01002736 if (mac_length != actual_mac_length) {
Ronald Crona587cbc2021-06-18 14:51:29 +02002737 status = PSA_ERROR_INVALID_SIGNATURE;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002738 goto exit;
Ronald Crona587cbc2021-06-18 14:51:29 +02002739 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002740 if (mbedtls_psa_safer_memcmp(mac, actual_mac, actual_mac_length) != 0) {
Ronald Crona587cbc2021-06-18 14:51:29 +02002741 status = PSA_ERROR_INVALID_SIGNATURE;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002742 goto exit;
Ronald Crona587cbc2021-06-18 14:51:29 +02002743 }
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002744
2745exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002746 mbedtls_platform_zeroize(actual_mac, sizeof(actual_mac));
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002747
Gilles Peskine449bd832023-01-11 14:50:10 +01002748 return status;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002749}
Gilles Peskinee59236f2018-01-27 23:32:46 +01002750
Gilles Peskinee59236f2018-01-27 23:32:46 +01002751/****************************************************************/
2752/* Asymmetric cryptography */
2753/****************************************************************/
2754
Gilles Peskine449bd832023-01-11 14:50:10 +01002755static psa_status_t psa_sign_verify_check_alg(int input_is_message,
2756 psa_algorithm_t alg)
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002757{
Gilles Peskine449bd832023-01-11 14:50:10 +01002758 if (input_is_message) {
2759 if (!PSA_ALG_IS_SIGN_MESSAGE(alg)) {
2760 return PSA_ERROR_INVALID_ARGUMENT;
2761 }
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002762
Gilles Peskine449bd832023-01-11 14:50:10 +01002763 if (PSA_ALG_IS_SIGN_HASH(alg)) {
2764 if (!PSA_ALG_IS_HASH(PSA_ALG_SIGN_GET_HASH(alg))) {
2765 return PSA_ERROR_INVALID_ARGUMENT;
2766 }
2767 }
2768 } else {
2769 if (!PSA_ALG_IS_SIGN_HASH(alg)) {
2770 return PSA_ERROR_INVALID_ARGUMENT;
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002771 }
2772 }
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002773
Gilles Peskine449bd832023-01-11 14:50:10 +01002774 return PSA_SUCCESS;
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002775}
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002776
Gilles Peskine449bd832023-01-11 14:50:10 +01002777static psa_status_t psa_sign_internal(mbedtls_svc_key_id_t key,
2778 int input_is_message,
2779 psa_algorithm_t alg,
2780 const uint8_t *input,
2781 size_t input_length,
2782 uint8_t *signature,
2783 size_t signature_size,
2784 size_t *signature_length)
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002785{
2786 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2787 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
2788 psa_key_slot_t *slot;
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002789
2790 *signature_length = 0;
2791
Gilles Peskine449bd832023-01-11 14:50:10 +01002792 status = psa_sign_verify_check_alg(input_is_message, alg);
2793 if (status != PSA_SUCCESS) {
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002794 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01002795 }
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002796
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002797 /* Immediately reject a zero-length signature buffer. This guarantees
gabor-mezei-arm12b4f342021-05-05 13:54:55 +02002798 * that signature must be a valid pointer. (On the other hand, the input
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002799 * buffer can in principle be empty since it doesn't actually have
2800 * to be a hash.) */
Gilles Peskine449bd832023-01-11 14:50:10 +01002801 if (signature_size == 0) {
2802 return PSA_ERROR_BUFFER_TOO_SMALL;
2803 }
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002804
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002805 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002806 key, &slot,
2807 input_is_message ? PSA_KEY_USAGE_SIGN_MESSAGE :
2808 PSA_KEY_USAGE_SIGN_HASH,
2809 alg);
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002810
Gilles Peskine449bd832023-01-11 14:50:10 +01002811 if (status != PSA_SUCCESS) {
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002812 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002813 }
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002814
Gilles Peskine449bd832023-01-11 14:50:10 +01002815 if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) {
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002816 status = PSA_ERROR_INVALID_ARGUMENT;
2817 goto exit;
2818 }
2819
2820 psa_key_attributes_t attributes = {
Gilles Peskine449bd832023-01-11 14:50:10 +01002821 .core = slot->attr
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002822 };
2823
Gilles Peskine449bd832023-01-11 14:50:10 +01002824 if (input_is_message) {
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002825 status = psa_driver_wrapper_sign_message(
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002826 &attributes, slot->key.data, slot->key.bytes,
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002827 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002828 signature, signature_size, signature_length);
2829 } else {
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002830
2831 status = psa_driver_wrapper_sign_hash(
2832 &attributes, slot->key.data, slot->key.bytes,
2833 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002834 signature, signature_size, signature_length);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002835 }
2836
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002837
2838exit:
Paul Elliott59200a22023-02-21 15:07:40 +00002839 psa_wipe_tag_output_buffer(signature, status, signature_size,
2840 *signature_length);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002841
Gilles Peskine449bd832023-01-11 14:50:10 +01002842 unlock_status = psa_unlock_key_slot(slot);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002843
Gilles Peskine449bd832023-01-11 14:50:10 +01002844 return (status == PSA_SUCCESS) ? unlock_status : status;
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002845}
2846
Gilles Peskine449bd832023-01-11 14:50:10 +01002847static psa_status_t psa_verify_internal(mbedtls_svc_key_id_t key,
2848 int input_is_message,
2849 psa_algorithm_t alg,
2850 const uint8_t *input,
2851 size_t input_length,
2852 const uint8_t *signature,
2853 size_t signature_length)
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002854{
2855 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2856 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
2857 psa_key_slot_t *slot;
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002858
Gilles Peskine449bd832023-01-11 14:50:10 +01002859 status = psa_sign_verify_check_alg(input_is_message, alg);
2860 if (status != PSA_SUCCESS) {
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002861 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01002862 }
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002863
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002864 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002865 key, &slot,
2866 input_is_message ? PSA_KEY_USAGE_VERIFY_MESSAGE :
2867 PSA_KEY_USAGE_VERIFY_HASH,
2868 alg);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002869
Gilles Peskine449bd832023-01-11 14:50:10 +01002870 if (status != PSA_SUCCESS) {
2871 return status;
2872 }
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002873
2874 psa_key_attributes_t attributes = {
Gilles Peskine449bd832023-01-11 14:50:10 +01002875 .core = slot->attr
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002876 };
2877
Gilles Peskine449bd832023-01-11 14:50:10 +01002878 if (input_is_message) {
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002879 status = psa_driver_wrapper_verify_message(
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002880 &attributes, slot->key.data, slot->key.bytes,
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002881 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002882 signature, signature_length);
2883 } else {
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002884 status = psa_driver_wrapper_verify_hash(
2885 &attributes, slot->key.data, slot->key.bytes,
2886 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002887 signature, signature_length);
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002888 }
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002889
Gilles Peskine449bd832023-01-11 14:50:10 +01002890 unlock_status = psa_unlock_key_slot(slot);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002891
Gilles Peskine449bd832023-01-11 14:50:10 +01002892 return (status == PSA_SUCCESS) ? unlock_status : status;
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002893
2894}
2895
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02002896psa_status_t psa_sign_message_builtin(
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002897 const psa_key_attributes_t *attributes,
2898 const uint8_t *key_buffer,
2899 size_t key_buffer_size,
2900 psa_algorithm_t alg,
2901 const uint8_t *input,
2902 size_t input_length,
2903 uint8_t *signature,
2904 size_t signature_size,
Gilles Peskine449bd832023-01-11 14:50:10 +01002905 size_t *signature_length)
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002906{
2907 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002908
Gilles Peskine449bd832023-01-11 14:50:10 +01002909 if (PSA_ALG_IS_SIGN_HASH(alg)) {
gabor-mezei-armf9820f92021-05-03 16:26:20 +02002910 size_t hash_length;
2911 uint8_t hash[PSA_HASH_MAX_SIZE];
2912
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002913 status = psa_driver_wrapper_hash_compute(
Gilles Peskine449bd832023-01-11 14:50:10 +01002914 PSA_ALG_SIGN_GET_HASH(alg),
2915 input, input_length,
2916 hash, sizeof(hash), &hash_length);
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002917
Gilles Peskine449bd832023-01-11 14:50:10 +01002918 if (status != PSA_SUCCESS) {
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002919 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01002920 }
gabor-mezei-armf9820f92021-05-03 16:26:20 +02002921
2922 return psa_driver_wrapper_sign_hash(
Gilles Peskine449bd832023-01-11 14:50:10 +01002923 attributes, key_buffer, key_buffer_size,
2924 alg, hash, hash_length,
2925 signature, signature_size, signature_length);
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002926 }
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002927
Gilles Peskine449bd832023-01-11 14:50:10 +01002928 return PSA_ERROR_NOT_SUPPORTED;
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002929}
2930
Gilles Peskine449bd832023-01-11 14:50:10 +01002931psa_status_t psa_sign_message(mbedtls_svc_key_id_t key,
2932 psa_algorithm_t alg,
2933 const uint8_t *input,
2934 size_t input_length,
2935 uint8_t *signature,
2936 size_t signature_size,
2937 size_t *signature_length)
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002938{
2939 return psa_sign_internal(
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002940 key, 1, alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002941 signature, signature_size, signature_length);
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002942}
2943
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02002944psa_status_t psa_verify_message_builtin(
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002945 const psa_key_attributes_t *attributes,
2946 const uint8_t *key_buffer,
2947 size_t key_buffer_size,
2948 psa_algorithm_t alg,
2949 const uint8_t *input,
2950 size_t input_length,
2951 const uint8_t *signature,
Gilles Peskine449bd832023-01-11 14:50:10 +01002952 size_t signature_length)
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002953{
2954 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002955
Gilles Peskine449bd832023-01-11 14:50:10 +01002956 if (PSA_ALG_IS_SIGN_HASH(alg)) {
gabor-mezei-armf9820f92021-05-03 16:26:20 +02002957 size_t hash_length;
2958 uint8_t hash[PSA_HASH_MAX_SIZE];
2959
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002960 status = psa_driver_wrapper_hash_compute(
Gilles Peskine449bd832023-01-11 14:50:10 +01002961 PSA_ALG_SIGN_GET_HASH(alg),
2962 input, input_length,
2963 hash, sizeof(hash), &hash_length);
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002964
Gilles Peskine449bd832023-01-11 14:50:10 +01002965 if (status != PSA_SUCCESS) {
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002966 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01002967 }
gabor-mezei-armf9820f92021-05-03 16:26:20 +02002968
2969 return psa_driver_wrapper_verify_hash(
Gilles Peskine449bd832023-01-11 14:50:10 +01002970 attributes, key_buffer, key_buffer_size,
2971 alg, hash, hash_length,
2972 signature, signature_length);
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002973 }
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002974
Gilles Peskine449bd832023-01-11 14:50:10 +01002975 return PSA_ERROR_NOT_SUPPORTED;
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002976}
2977
Gilles Peskine449bd832023-01-11 14:50:10 +01002978psa_status_t psa_verify_message(mbedtls_svc_key_id_t key,
2979 psa_algorithm_t alg,
2980 const uint8_t *input,
2981 size_t input_length,
2982 const uint8_t *signature,
2983 size_t signature_length)
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002984{
2985 return psa_verify_internal(
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002986 key, 1, alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002987 signature, signature_length);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002988}
2989
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02002990psa_status_t psa_sign_hash_builtin(
Ronald Cron18659932020-12-08 16:32:23 +01002991 const psa_key_attributes_t *attributes,
2992 const uint8_t *key_buffer, size_t key_buffer_size,
2993 psa_algorithm_t alg, const uint8_t *hash, size_t hash_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002994 uint8_t *signature, size_t signature_size, size_t *signature_length)
Gilles Peskinee59236f2018-01-27 23:32:46 +01002995{
Gilles Peskine449bd832023-01-11 14:50:10 +01002996 if (attributes->core.type == PSA_KEY_TYPE_RSA_KEY_PAIR) {
2997 if (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) ||
2998 PSA_ALG_IS_RSA_PSS(alg)) {
Ronald Cron4501c982021-03-19 20:09:32 +01002999#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01003000 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
3001 return mbedtls_psa_rsa_sign_hash(
3002 attributes,
3003 key_buffer, key_buffer_size,
3004 alg, hash, hash_length,
3005 signature, signature_size, signature_length);
Ronald Cron4501c982021-03-19 20:09:32 +01003006#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
3007 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
Gilles Peskine449bd832023-01-11 14:50:10 +01003008 } else {
3009 return PSA_ERROR_INVALID_ARGUMENT;
Steven Cooremanacda8342020-07-24 23:09:52 +02003010 }
Gilles Peskine449bd832023-01-11 14:50:10 +01003011 } else if (PSA_KEY_TYPE_IS_ECC(attributes->core.type)) {
3012 if (PSA_ALG_IS_ECDSA(alg)) {
Ronald Cron4501c982021-03-19 20:09:32 +01003013#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01003014 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
3015 return mbedtls_psa_ecdsa_sign_hash(
3016 attributes,
3017 key_buffer, key_buffer_size,
3018 alg, hash, hash_length,
3019 signature, signature_size, signature_length);
Gilles Peskinee59236f2018-01-27 23:32:46 +01003020#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3021 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Gilles Peskine449bd832023-01-11 14:50:10 +01003022 } else {
3023 return PSA_ERROR_INVALID_ARGUMENT;
Ronald Cron4501c982021-03-19 20:09:32 +01003024 }
Ronald Cron8a494f32021-02-17 09:49:51 +01003025 }
Ronald Cron4501c982021-03-19 20:09:32 +01003026
Gilles Peskine449bd832023-01-11 14:50:10 +01003027 (void) key_buffer;
3028 (void) key_buffer_size;
3029 (void) hash;
3030 (void) hash_length;
3031 (void) signature;
3032 (void) signature_size;
3033 (void) signature_length;
Ronald Cron4501c982021-03-19 20:09:32 +01003034
Gilles Peskine449bd832023-01-11 14:50:10 +01003035 return PSA_ERROR_NOT_SUPPORTED;
Ronald Cron18659932020-12-08 16:32:23 +01003036}
Gilles Peskinee59236f2018-01-27 23:32:46 +01003037
Gilles Peskine449bd832023-01-11 14:50:10 +01003038psa_status_t psa_sign_hash(mbedtls_svc_key_id_t key,
3039 psa_algorithm_t alg,
3040 const uint8_t *hash,
3041 size_t hash_length,
3042 uint8_t *signature,
3043 size_t signature_size,
3044 size_t *signature_length)
Gilles Peskinee59236f2018-01-27 23:32:46 +01003045{
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003046 return psa_sign_internal(
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02003047 key, 0, alg, hash, hash_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003048 signature, signature_size, signature_length);
itayzafrir5c753392018-05-08 11:18:38 +03003049}
3050
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02003051psa_status_t psa_verify_hash_builtin(
Ronald Cron18659932020-12-08 16:32:23 +01003052 const psa_key_attributes_t *attributes,
3053 const uint8_t *key_buffer, size_t key_buffer_size,
3054 psa_algorithm_t alg, const uint8_t *hash, size_t hash_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003055 const uint8_t *signature, size_t signature_length)
itayzafrir5c753392018-05-08 11:18:38 +03003056{
Gilles Peskine449bd832023-01-11 14:50:10 +01003057 if (PSA_KEY_TYPE_IS_RSA(attributes->core.type)) {
3058 if (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) ||
3059 PSA_ALG_IS_RSA_PSS(alg)) {
Ronald Cron4501c982021-03-19 20:09:32 +01003060#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01003061 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
3062 return mbedtls_psa_rsa_verify_hash(
3063 attributes,
3064 key_buffer, key_buffer_size,
3065 alg, hash, hash_length,
3066 signature, signature_length);
Ronald Cron4501c982021-03-19 20:09:32 +01003067#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
3068 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
Gilles Peskine449bd832023-01-11 14:50:10 +01003069 } else {
3070 return PSA_ERROR_INVALID_ARGUMENT;
Steven Cooremanacda8342020-07-24 23:09:52 +02003071 }
Gilles Peskine449bd832023-01-11 14:50:10 +01003072 } else if (PSA_KEY_TYPE_IS_ECC(attributes->core.type)) {
3073 if (PSA_ALG_IS_ECDSA(alg)) {
Ronald Cron4501c982021-03-19 20:09:32 +01003074#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01003075 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
3076 return mbedtls_psa_ecdsa_verify_hash(
3077 attributes,
3078 key_buffer, key_buffer_size,
3079 alg, hash, hash_length,
3080 signature, signature_length);
Ronald Cron4501c982021-03-19 20:09:32 +01003081#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3082 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Gilles Peskine449bd832023-01-11 14:50:10 +01003083 } else {
3084 return PSA_ERROR_INVALID_ARGUMENT;
Ronald Cron4501c982021-03-19 20:09:32 +01003085 }
Ronald Cron8a494f32021-02-17 09:49:51 +01003086 }
Ronald Cron4501c982021-03-19 20:09:32 +01003087
Gilles Peskine449bd832023-01-11 14:50:10 +01003088 (void) key_buffer;
3089 (void) key_buffer_size;
3090 (void) hash;
3091 (void) hash_length;
3092 (void) signature;
3093 (void) signature_length;
Ronald Cron4501c982021-03-19 20:09:32 +01003094
Gilles Peskine449bd832023-01-11 14:50:10 +01003095 return PSA_ERROR_NOT_SUPPORTED;
Ronald Cron18659932020-12-08 16:32:23 +01003096}
3097
Gilles Peskine449bd832023-01-11 14:50:10 +01003098psa_status_t psa_verify_hash(mbedtls_svc_key_id_t key,
3099 psa_algorithm_t alg,
3100 const uint8_t *hash,
3101 size_t hash_length,
3102 const uint8_t *signature,
3103 size_t signature_length)
itayzafrir5c753392018-05-08 11:18:38 +03003104{
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003105 return psa_verify_internal(
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02003106 key, 0, alg, hash, hash_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003107 signature, signature_length);
Gilles Peskinee59236f2018-01-27 23:32:46 +01003108}
3109
Gilles Peskine449bd832023-01-11 14:50:10 +01003110psa_status_t psa_asymmetric_encrypt(mbedtls_svc_key_id_t key,
3111 psa_algorithm_t alg,
3112 const uint8_t *input,
3113 size_t input_length,
3114 const uint8_t *salt,
3115 size_t salt_length,
3116 uint8_t *output,
3117 size_t output_size,
3118 size_t *output_length)
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003119{
Ronald Cronf95a2b12020-10-22 15:24:49 +02003120 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01003121 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01003122 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003123
Darryl Green5cc689a2018-07-24 15:34:10 +01003124 (void) input;
3125 (void) input_length;
3126 (void) salt;
3127 (void) output;
3128 (void) output_size;
3129
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03003130 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003131
Gilles Peskine449bd832023-01-11 14:50:10 +01003132 if (!PSA_ALG_IS_RSA_OAEP(alg) && salt_length != 0) {
3133 return PSA_ERROR_INVALID_ARGUMENT;
3134 }
Gilles Peskineb3fc05d2018-06-30 19:04:35 +02003135
Ronald Cron5c522922020-11-14 16:35:34 +01003136 status = psa_get_and_lock_transparent_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01003137 key, &slot, PSA_KEY_USAGE_ENCRYPT, alg);
3138 if (status != PSA_SUCCESS) {
3139 return status;
3140 }
3141 if (!(PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type) ||
3142 PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type))) {
Ronald Cronf95a2b12020-10-22 15:24:49 +02003143 status = PSA_ERROR_INVALID_ARGUMENT;
3144 goto exit;
3145 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003146
Przemyslaw Stekiel19e61422021-12-09 11:09:11 +01003147 psa_key_attributes_t attributes = {
Gilles Peskine449bd832023-01-11 14:50:10 +01003148 .core = slot->attr
Przemyslaw Stekiel19e61422021-12-09 11:09:11 +01003149 };
Steven Cooremana2371e52020-07-28 14:30:39 +02003150
Przemyslaw Stekiel19e61422021-12-09 11:09:11 +01003151 status = psa_driver_wrapper_asymmetric_encrypt(
3152 &attributes, slot->key.data, slot->key.bytes,
3153 alg, input, input_length, salt, salt_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003154 output, output_size, output_length);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003155exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01003156 unlock_status = psa_unlock_key_slot(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003157
Gilles Peskine449bd832023-01-11 14:50:10 +01003158 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine5b051bc2018-05-31 13:25:48 +02003159}
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003160
Gilles Peskine449bd832023-01-11 14:50:10 +01003161psa_status_t psa_asymmetric_decrypt(mbedtls_svc_key_id_t key,
3162 psa_algorithm_t alg,
3163 const uint8_t *input,
3164 size_t input_length,
3165 const uint8_t *salt,
3166 size_t salt_length,
3167 uint8_t *output,
3168 size_t output_size,
3169 size_t *output_length)
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003170{
Ronald Cronf95a2b12020-10-22 15:24:49 +02003171 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01003172 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01003173 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003174
Darryl Green5cc689a2018-07-24 15:34:10 +01003175 (void) input;
3176 (void) input_length;
3177 (void) salt;
3178 (void) output;
3179 (void) output_size;
3180
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03003181 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003182
Gilles Peskine449bd832023-01-11 14:50:10 +01003183 if (!PSA_ALG_IS_RSA_OAEP(alg) && salt_length != 0) {
3184 return PSA_ERROR_INVALID_ARGUMENT;
3185 }
Gilles Peskineb3fc05d2018-06-30 19:04:35 +02003186
Ronald Cron5c522922020-11-14 16:35:34 +01003187 status = psa_get_and_lock_transparent_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01003188 key, &slot, PSA_KEY_USAGE_DECRYPT, alg);
3189 if (status != PSA_SUCCESS) {
3190 return status;
3191 }
3192 if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) {
Ronald Cronf95a2b12020-10-22 15:24:49 +02003193 status = PSA_ERROR_INVALID_ARGUMENT;
3194 goto exit;
3195 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003196
Przemyslaw Stekiel8d45c002021-12-13 08:58:19 +01003197 psa_key_attributes_t attributes = {
Gilles Peskine449bd832023-01-11 14:50:10 +01003198 .core = slot->attr
Przemyslaw Stekiel8d45c002021-12-13 08:58:19 +01003199 };
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003200
Przemyslaw Stekiel8d45c002021-12-13 08:58:19 +01003201 status = psa_driver_wrapper_asymmetric_decrypt(
3202 &attributes, slot->key.data, slot->key.bytes,
3203 alg, input, input_length, salt, salt_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003204 output, output_size, output_length);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003205
3206exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01003207 unlock_status = psa_unlock_key_slot(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003208
Gilles Peskine449bd832023-01-11 14:50:10 +01003209 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine5b051bc2018-05-31 13:25:48 +02003210}
Gilles Peskinee59236f2018-01-27 23:32:46 +01003211
Paul Elliott9fe12f62022-11-30 19:16:02 +00003212/****************************************************************/
3213/* Asymmetric interruptible cryptography */
3214/****************************************************************/
3215
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003216static uint32_t psa_interruptible_max_ops = PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED;
3217
Paul Elliott9fe12f62022-11-30 19:16:02 +00003218void psa_interruptible_set_max_ops(uint32_t max_ops)
3219{
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003220 psa_interruptible_max_ops = max_ops;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003221}
3222
3223uint32_t psa_interruptible_get_max_ops(void)
3224{
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003225 return psa_interruptible_max_ops;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003226}
3227
Paul Elliott9fe12f62022-11-30 19:16:02 +00003228uint32_t psa_sign_hash_get_num_ops(
3229 const psa_sign_hash_interruptible_operation_t *operation)
3230{
Paul Elliott296ede92022-12-15 17:00:30 +00003231 return operation->num_ops;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003232}
3233
3234uint32_t psa_verify_hash_get_num_ops(
3235 const psa_verify_hash_interruptible_operation_t *operation)
3236{
Paul Elliott296ede92022-12-15 17:00:30 +00003237 return operation->num_ops;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003238}
3239
Paul Elliott59ad9452022-12-18 15:09:02 +00003240static psa_status_t psa_sign_hash_abort_internal(
3241 psa_sign_hash_interruptible_operation_t *operation)
3242{
3243 if (operation->id == 0) {
3244 /* The object has (apparently) been initialized but it is not (yet)
3245 * in use. It's ok to call abort on such an object, and there's
3246 * nothing to do. */
3247 return PSA_SUCCESS;
3248 }
3249
3250 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3251
3252 status = psa_driver_wrapper_sign_hash_abort(operation);
3253
3254 operation->id = 0;
3255
Paul Elliotte6145dc2023-02-07 12:51:21 +00003256 /* Do not clear either the error_occurred or num_ops elements here as they
3257 * only want to be cleared by the application calling abort, not by abort
3258 * being called at completion of an operation. */
3259
Paul Elliott59ad9452022-12-18 15:09:02 +00003260 return status;
3261}
3262
Paul Elliott9fe12f62022-11-30 19:16:02 +00003263psa_status_t psa_sign_hash_start(
3264 psa_sign_hash_interruptible_operation_t *operation,
3265 mbedtls_svc_key_id_t key, psa_algorithm_t alg,
3266 const uint8_t *hash, size_t hash_length)
3267{
3268 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3269 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
3270 psa_key_slot_t *slot;
3271
Paul Elliottc9774412023-02-06 15:14:07 +00003272 /* Check that start has not been previously called, or operation has not
3273 * previously errored. */
3274 if (operation->id != 0 || operation->error_occurred) {
Paul Elliott9fe12f62022-11-30 19:16:02 +00003275 return PSA_ERROR_BAD_STATE;
3276 }
3277
Paul Elliott9fe12f62022-11-30 19:16:02 +00003278 status = psa_sign_verify_check_alg(0, alg);
3279 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003280 operation->error_occurred = 1;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003281 return status;
3282 }
3283
3284 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
3285 PSA_KEY_USAGE_SIGN_HASH,
3286 alg);
3287
3288 if (status != PSA_SUCCESS) {
3289 goto exit;
3290 }
3291
3292 if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) {
3293 status = PSA_ERROR_INVALID_ARGUMENT;
3294 goto exit;
3295 }
3296
3297 psa_key_attributes_t attributes = {
3298 .core = slot->attr
3299 };
3300
Paul Elliott296ede92022-12-15 17:00:30 +00003301 /* Ensure ops count gets reset, in case of operation re-use. */
3302 operation->num_ops = 0;
3303
Paul Elliott9fe12f62022-11-30 19:16:02 +00003304 status = psa_driver_wrapper_sign_hash_start(operation, &attributes,
3305 slot->key.data,
3306 slot->key.bytes, alg,
3307 hash, hash_length);
3308exit:
3309
3310 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003311 operation->error_occurred = 1;
Paul Elliott59ad9452022-12-18 15:09:02 +00003312 psa_sign_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003313 }
3314
3315 unlock_status = psa_unlock_key_slot(slot);
3316
Paul Elliottc9774412023-02-06 15:14:07 +00003317 if (unlock_status != PSA_SUCCESS) {
3318 operation->error_occurred = 1;
3319 }
Paul Elliott9fe12f62022-11-30 19:16:02 +00003320
Paul Elliottc9774412023-02-06 15:14:07 +00003321 return (status == PSA_SUCCESS) ? unlock_status : status;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003322}
3323
3324
3325psa_status_t psa_sign_hash_complete(
3326 psa_sign_hash_interruptible_operation_t *operation,
3327 uint8_t *signature, size_t signature_size,
3328 size_t *signature_length)
3329{
3330 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3331
3332 *signature_length = 0;
3333
Paul Elliottc9774412023-02-06 15:14:07 +00003334 /* Check that start has been called first, and that operation has not
3335 * previously errored. */
3336 if (operation->id == 0 || operation->error_occurred) {
Paul Elliott9fe12f62022-11-30 19:16:02 +00003337 status = PSA_ERROR_BAD_STATE;
3338 goto exit;
3339 }
3340
Paul Elliott096abc42023-02-03 18:33:23 +00003341 /* Immediately reject a zero-length signature buffer. This guarantees that
3342 * signature must be a valid pointer. */
Paul Elliott9fe12f62022-11-30 19:16:02 +00003343 if (signature_size == 0) {
3344 status = PSA_ERROR_BUFFER_TOO_SMALL;
3345 goto exit;
3346 }
3347
3348 status = psa_driver_wrapper_sign_hash_complete(operation, signature,
3349 signature_size,
3350 signature_length);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003351
Paul Elliott296ede92022-12-15 17:00:30 +00003352 /* Update ops count with work done. */
Paul Elliottde1114c2023-02-07 12:43:11 +00003353 operation->num_ops = psa_driver_wrapper_sign_hash_get_num_ops(operation);
Paul Elliott296ede92022-12-15 17:00:30 +00003354
Paul Elliottebe225c2023-02-10 14:32:53 +00003355exit:
3356
Paul Elliott59200a22023-02-21 15:07:40 +00003357 psa_wipe_tag_output_buffer(signature, status, signature_size,
3358 *signature_length);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003359
Paul Elliott53bb3122023-02-10 14:22:22 +00003360 if (status != PSA_OPERATION_INCOMPLETE) {
Paul Elliottc9774412023-02-06 15:14:07 +00003361 if (status != PSA_SUCCESS) {
3362 operation->error_occurred = 1;
3363 }
3364
Paul Elliott59ad9452022-12-18 15:09:02 +00003365 psa_sign_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003366 }
3367
3368 return status;
3369}
3370
3371psa_status_t psa_sign_hash_abort(
3372 psa_sign_hash_interruptible_operation_t *operation)
3373{
Paul Elliott59ad9452022-12-18 15:09:02 +00003374 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3375
3376 status = psa_sign_hash_abort_internal(operation);
3377
3378 /* We clear the number of ops done here, so that it is not cleared when
3379 * the operation fails or succeeds, only on manual abort. */
3380 operation->num_ops = 0;
3381
Paul Elliottc9774412023-02-06 15:14:07 +00003382 /* Likewise, failure state. */
3383 operation->error_occurred = 0;
3384
Paul Elliott59ad9452022-12-18 15:09:02 +00003385 return status;
3386}
3387
3388static psa_status_t psa_verify_hash_abort_internal(
3389 psa_verify_hash_interruptible_operation_t *operation)
3390{
Paul Elliott9fe12f62022-11-30 19:16:02 +00003391 if (operation->id == 0) {
3392 /* The object has (apparently) been initialized but it is not (yet)
3393 * in use. It's ok to call abort on such an object, and there's
3394 * nothing to do. */
3395 return PSA_SUCCESS;
3396 }
3397
Paul Elliott59ad9452022-12-18 15:09:02 +00003398 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3399
3400 status = psa_driver_wrapper_verify_hash_abort(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003401
3402 operation->id = 0;
3403
Paul Elliotte6145dc2023-02-07 12:51:21 +00003404 /* Do not clear either the error_occurred or num_ops elements here as they
3405 * only want to be cleared by the application calling abort, not by abort
3406 * being called at completion of an operation. */
3407
Paul Elliott59ad9452022-12-18 15:09:02 +00003408 return status;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003409}
3410
3411psa_status_t psa_verify_hash_start(
3412 psa_verify_hash_interruptible_operation_t *operation,
3413 mbedtls_svc_key_id_t key, psa_algorithm_t alg,
3414 const uint8_t *hash, size_t hash_length,
3415 const uint8_t *signature, size_t signature_length)
3416{
3417 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3418 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
3419 psa_key_slot_t *slot;
3420
Paul Elliottc9774412023-02-06 15:14:07 +00003421 /* Check that start has not been previously called, or operation has not
3422 * previously errored. */
3423 if (operation->id != 0 || operation->error_occurred) {
Paul Elliott9fe12f62022-11-30 19:16:02 +00003424 return PSA_ERROR_BAD_STATE;
3425 }
3426
3427 status = psa_sign_verify_check_alg(0, alg);
3428 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003429 operation->error_occurred = 1;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003430 return status;
3431 }
3432
3433 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
3434 PSA_KEY_USAGE_VERIFY_HASH,
3435 alg);
3436
3437 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003438 operation->error_occurred = 1;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003439 return status;
3440 }
3441
3442 psa_key_attributes_t attributes = {
3443 .core = slot->attr
3444 };
3445
Paul Elliott296ede92022-12-15 17:00:30 +00003446 /* Ensure ops count gets reset, in case of operation re-use. */
3447 operation->num_ops = 0;
3448
Paul Elliott9fe12f62022-11-30 19:16:02 +00003449 status = psa_driver_wrapper_verify_hash_start(operation, &attributes,
3450 slot->key.data,
3451 slot->key.bytes,
3452 alg, hash, hash_length,
3453 signature, signature_length);
3454
3455 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003456 operation->error_occurred = 1;
Paul Elliott59ad9452022-12-18 15:09:02 +00003457 psa_verify_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003458 }
3459
3460 unlock_status = psa_unlock_key_slot(slot);
3461
Paul Elliottc9774412023-02-06 15:14:07 +00003462 if (unlock_status != PSA_SUCCESS) {
3463 operation->error_occurred = 1;
3464 }
Paul Elliott9fe12f62022-11-30 19:16:02 +00003465
Paul Elliottc9774412023-02-06 15:14:07 +00003466 return (status == PSA_SUCCESS) ? unlock_status : status;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003467}
3468
3469psa_status_t psa_verify_hash_complete(
3470 psa_verify_hash_interruptible_operation_t *operation)
3471{
3472 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3473
Paul Elliottc9774412023-02-06 15:14:07 +00003474 /* Check that start has been called first, and that operation has not
3475 * previously errored. */
3476 if (operation->id == 0 || operation->error_occurred) {
Paul Elliott9fe12f62022-11-30 19:16:02 +00003477 status = PSA_ERROR_BAD_STATE;
3478 goto exit;
3479 }
3480
3481 status = psa_driver_wrapper_verify_hash_complete(operation);
3482
Paul Elliott296ede92022-12-15 17:00:30 +00003483 /* Update ops count with work done. */
Paul Elliottde1114c2023-02-07 12:43:11 +00003484 operation->num_ops = psa_driver_wrapper_verify_hash_get_num_ops(
Paul Elliott296ede92022-12-15 17:00:30 +00003485 operation);
3486
Paul Elliottebe225c2023-02-10 14:32:53 +00003487exit:
3488
Paul Elliott9fe12f62022-11-30 19:16:02 +00003489 if (status != PSA_OPERATION_INCOMPLETE) {
Paul Elliottc9774412023-02-06 15:14:07 +00003490 if (status != PSA_SUCCESS) {
3491 operation->error_occurred = 1;
3492 }
3493
Paul Elliott59ad9452022-12-18 15:09:02 +00003494 psa_verify_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003495 }
3496
3497 return status;
3498}
3499
3500psa_status_t psa_verify_hash_abort(
3501 psa_verify_hash_interruptible_operation_t *operation)
3502{
Paul Elliott59ad9452022-12-18 15:09:02 +00003503 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003504
Paul Elliott59ad9452022-12-18 15:09:02 +00003505 status = psa_verify_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003506
Paul Elliott59ad9452022-12-18 15:09:02 +00003507 /* We clear the number of ops done here, so that it is not cleared when
3508 * the operation fails or succeeds, only on manual abort. */
3509 operation->num_ops = 0;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003510
Paul Elliottc9774412023-02-06 15:14:07 +00003511 /* Likewise, failure state. */
3512 operation->error_occurred = 0;
3513
Paul Elliott59ad9452022-12-18 15:09:02 +00003514 return status;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003515}
3516
Paul Elliott588f8ed2022-12-02 18:10:26 +00003517/****************************************************************/
3518/* Asymmetric interruptible cryptography internal */
3519/* implementations */
3520/****************************************************************/
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02003521
Paul Elliott588f8ed2022-12-02 18:10:26 +00003522void mbedtls_psa_interruptible_set_max_ops(uint32_t max_ops)
3523{
Paul Elliott7cc4e812023-01-10 17:14:11 +00003524
Paul Elliott588f8ed2022-12-02 18:10:26 +00003525#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3526 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3527 defined(MBEDTLS_ECP_RESTARTABLE)
3528
3529 /* Internal implementation uses zero to indicate infinite number max ops,
3530 * therefore avoid this value, and set to minimum possible. */
3531 if (max_ops == 0) {
3532 max_ops = 1;
3533 }
3534
Paul Elliott588f8ed2022-12-02 18:10:26 +00003535 mbedtls_ecp_set_max_ops(max_ops);
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003536#else
3537 (void) max_ops;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003538#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3539 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3540 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3541}
3542
Paul Elliott588f8ed2022-12-02 18:10:26 +00003543uint32_t mbedtls_psa_sign_hash_get_num_ops(
Paul Elliottf8e5b562023-02-19 18:43:45 +00003544 const mbedtls_psa_sign_hash_interruptible_operation_t *operation)
Paul Elliott588f8ed2022-12-02 18:10:26 +00003545{
3546#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3547 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3548 defined(MBEDTLS_ECP_RESTARTABLE)
3549
Paul Elliott93d9ca82023-02-15 18:14:21 +00003550 return operation->num_ops;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003551#else
3552 (void) operation;
3553 return 0;
3554#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3555 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3556 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3557}
3558
3559uint32_t mbedtls_psa_verify_hash_get_num_ops(
Paul Elliottf8e5b562023-02-19 18:43:45 +00003560 const mbedtls_psa_verify_hash_interruptible_operation_t *operation)
Paul Elliott588f8ed2022-12-02 18:10:26 +00003561{
3562 #if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3563 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3564 defined(MBEDTLS_ECP_RESTARTABLE)
3565
Paul Elliott93d9ca82023-02-15 18:14:21 +00003566 return operation->num_ops;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003567#else
3568 (void) operation;
3569 return 0;
3570#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3571 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3572 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3573}
3574
3575psa_status_t mbedtls_psa_sign_hash_start(
3576 mbedtls_psa_sign_hash_interruptible_operation_t *operation,
3577 const psa_key_attributes_t *attributes, const uint8_t *key_buffer,
3578 size_t key_buffer_size, psa_algorithm_t alg,
3579 const uint8_t *hash, size_t hash_length)
3580{
3581 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott0290a762023-02-09 14:30:24 +00003582 size_t required_hash_length;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003583
Paul Elliott068fe072023-01-16 13:59:15 +00003584 if (!PSA_KEY_TYPE_IS_ECC(attributes->core.type)) {
3585 return PSA_ERROR_NOT_SUPPORTED;
3586 }
3587
3588 if (!PSA_ALG_IS_ECDSA(alg)) {
Paul Elliott813f9cd2023-02-05 15:28:46 +00003589 return PSA_ERROR_NOT_SUPPORTED;
Paul Elliott068fe072023-01-16 13:59:15 +00003590 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003591
3592#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
Paul Elliott068fe072023-01-16 13:59:15 +00003593 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3594 defined(MBEDTLS_ECP_RESTARTABLE)
Paul Elliott588f8ed2022-12-02 18:10:26 +00003595
Paul Elliotta1c94092023-02-15 16:38:04 +00003596 mbedtls_ecdsa_restart_init(&operation->restart_ctx);
3597
Paul Elliott93d9ca82023-02-15 18:14:21 +00003598 /* Ensure num_ops is zero'ed in case of context re-use. */
3599 operation->num_ops = 0;
3600
Paul Elliott068fe072023-01-16 13:59:15 +00003601 status = mbedtls_psa_ecp_load_representation(attributes->core.type,
3602 attributes->core.bits,
3603 key_buffer,
3604 key_buffer_size,
3605 &operation->ctx);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003606
Paul Elliott068fe072023-01-16 13:59:15 +00003607 if (status != PSA_SUCCESS) {
3608 return status;
3609 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003610
Paul Elliott1bc59df2023-02-05 13:41:57 +00003611 operation->coordinate_bytes = PSA_BITS_TO_BYTES(
Paul Elliottc569fc22023-02-10 13:02:54 +00003612 operation->ctx->grp.nbits);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003613
Paul Elliott068fe072023-01-16 13:59:15 +00003614 psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH(alg);
3615 operation->md_alg = mbedtls_hash_info_md_from_psa(hash_alg);
3616 operation->alg = alg;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003617
Paul Elliott0290a762023-02-09 14:30:24 +00003618 /* We only need to store the same length of hash as the private key size
3619 * here, it would be truncated by the internal implementation anyway. */
3620 required_hash_length = (hash_length < operation->coordinate_bytes ?
3621 hash_length : operation->coordinate_bytes);
3622
Paul Elliottba70ad42023-02-15 18:23:53 +00003623 if (required_hash_length > sizeof(operation->hash)) {
3624 /* Shouldn't happen, but better safe than sorry. */
3625 return PSA_ERROR_CORRUPTION_DETECTED;
3626 }
3627
Paul Elliott0290a762023-02-09 14:30:24 +00003628 memcpy(operation->hash, hash, required_hash_length);
3629 operation->hash_length = required_hash_length;
Paul Elliott068fe072023-01-16 13:59:15 +00003630
3631 return PSA_SUCCESS;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003632
3633#else
Paul Elliott068fe072023-01-16 13:59:15 +00003634 (void) operation;
3635 (void) key_buffer;
3636 (void) key_buffer_size;
3637 (void) alg;
3638 (void) hash;
3639 (void) hash_length;
3640 (void) status;
Paul Elliott0290a762023-02-09 14:30:24 +00003641 (void) required_hash_length;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003642
Paul Elliott068fe072023-01-16 13:59:15 +00003643 return PSA_ERROR_NOT_SUPPORTED;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003644#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3645 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3646 * defined( MBEDTLS_ECP_RESTARTABLE ) */
Paul Elliott588f8ed2022-12-02 18:10:26 +00003647}
3648
3649psa_status_t mbedtls_psa_sign_hash_complete(
3650 mbedtls_psa_sign_hash_interruptible_operation_t *operation,
3651 uint8_t *signature, size_t signature_size,
3652 size_t *signature_length)
3653{
Paul Elliott588f8ed2022-12-02 18:10:26 +00003654#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3655 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3656 defined(MBEDTLS_ECP_RESTARTABLE)
3657
Paul Elliotta1c94092023-02-15 16:38:04 +00003658 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott1243f932023-02-07 11:21:10 +00003659 mbedtls_mpi r;
3660 mbedtls_mpi s;
3661
Paul Elliott46845252023-02-03 14:59:11 +00003662 mbedtls_mpi_init(&r);
3663 mbedtls_mpi_init(&s);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003664
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003665 /* Ensure max_ops is set to the current value (or default). */
3666 mbedtls_psa_interruptible_set_max_ops(psa_interruptible_get_max_ops());
3667
Paul Elliotta1c94092023-02-15 16:38:04 +00003668 if (signature_size < 2 * operation->coordinate_bytes) {
3669 status = PSA_ERROR_BUFFER_TOO_SMALL;
3670 goto exit;
3671 }
3672
Paul Elliott588f8ed2022-12-02 18:10:26 +00003673 if (PSA_ALG_ECDSA_IS_DETERMINISTIC(operation->alg)) {
Paul Elliott46845252023-02-03 14:59:11 +00003674
Paul Elliott588f8ed2022-12-02 18:10:26 +00003675#if defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
3676 status = mbedtls_to_psa_error(
3677 mbedtls_ecdsa_sign_det_restartable(&operation->ctx->grp,
Paul Elliott46845252023-02-03 14:59:11 +00003678 &r,
3679 &s,
Paul Elliott588f8ed2022-12-02 18:10:26 +00003680 &operation->ctx->d,
3681 operation->hash,
3682 operation->hash_length,
3683 operation->md_alg,
3684 mbedtls_psa_get_random,
3685 MBEDTLS_PSA_RANDOM_STATE,
3686 &operation->restart_ctx));
3687#else /* defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Paul Elliott724bd252023-02-08 12:35:08 +00003688 status = PSA_ERROR_NOT_SUPPORTED;
3689 goto exit;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003690#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
3691 } else {
Paul Elliott588f8ed2022-12-02 18:10:26 +00003692 status = mbedtls_to_psa_error(
3693 mbedtls_ecdsa_sign_restartable(&operation->ctx->grp,
Paul Elliott46845252023-02-03 14:59:11 +00003694 &r,
3695 &s,
Paul Elliott588f8ed2022-12-02 18:10:26 +00003696 &operation->ctx->d,
3697 operation->hash,
3698 operation->hash_length,
3699 mbedtls_psa_get_random,
3700 MBEDTLS_PSA_RANDOM_STATE,
3701 mbedtls_psa_get_random,
3702 MBEDTLS_PSA_RANDOM_STATE,
3703 &operation->restart_ctx));
3704 }
3705
Paul Elliottf8e5b562023-02-19 18:43:45 +00003706 /* Hide the fact that the restart context only holds a delta of number of
3707 * ops done during the last operation, not an absolute value. */
3708 operation->num_ops += operation->restart_ctx.ecp.ops_done;
3709
Paul Elliott724bd252023-02-08 12:35:08 +00003710 if (status == PSA_SUCCESS) {
Paul Elliott588f8ed2022-12-02 18:10:26 +00003711 status = mbedtls_to_psa_error(
Paul Elliott46845252023-02-03 14:59:11 +00003712 mbedtls_mpi_write_binary(&r,
Paul Elliott588f8ed2022-12-02 18:10:26 +00003713 signature,
Paul Elliott1bc59df2023-02-05 13:41:57 +00003714 operation->coordinate_bytes)
3715 );
Paul Elliott588f8ed2022-12-02 18:10:26 +00003716
3717 if (status != PSA_SUCCESS) {
Paul Elliott724bd252023-02-08 12:35:08 +00003718 goto exit;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003719 }
3720
3721 status = mbedtls_to_psa_error(
Paul Elliott46845252023-02-03 14:59:11 +00003722 mbedtls_mpi_write_binary(&s,
Paul Elliott588f8ed2022-12-02 18:10:26 +00003723 signature +
Paul Elliott1bc59df2023-02-05 13:41:57 +00003724 operation->coordinate_bytes,
3725 operation->coordinate_bytes)
3726 );
Paul Elliott588f8ed2022-12-02 18:10:26 +00003727
3728 if (status != PSA_SUCCESS) {
Paul Elliott724bd252023-02-08 12:35:08 +00003729 goto exit;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003730 }
3731
Paul Elliott1bc59df2023-02-05 13:41:57 +00003732 *signature_length = operation->coordinate_bytes * 2;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003733
Paul Elliott724bd252023-02-08 12:35:08 +00003734 status = PSA_SUCCESS;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003735 }
Paul Elliott724bd252023-02-08 12:35:08 +00003736
3737exit:
3738
3739 mbedtls_mpi_free(&r);
3740 mbedtls_mpi_free(&s);
3741 return status;
3742
Paul Elliott588f8ed2022-12-02 18:10:26 +00003743 #else
3744
3745 (void) operation;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003746 (void) signature;
3747 (void) signature_size;
3748 (void) signature_length;
3749
3750 return PSA_ERROR_NOT_SUPPORTED;
3751
3752#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3753 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3754 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3755}
3756
3757psa_status_t mbedtls_psa_sign_hash_abort(
3758 mbedtls_psa_sign_hash_interruptible_operation_t *operation)
3759{
3760
3761#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3762 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3763 defined(MBEDTLS_ECP_RESTARTABLE)
3764
3765 if (operation->ctx) {
3766 mbedtls_ecdsa_free(operation->ctx);
3767 mbedtls_free(operation->ctx);
Paul Elliottf9c91a72023-02-05 18:06:38 +00003768 operation->ctx = NULL;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003769 }
3770
3771 mbedtls_ecdsa_restart_free(&operation->restart_ctx);
3772
Paul Elliott93d9ca82023-02-15 18:14:21 +00003773 operation->num_ops = 0;
3774
Paul Elliott588f8ed2022-12-02 18:10:26 +00003775 return PSA_SUCCESS;
3776
3777#else
3778
3779 (void) operation;
3780
3781 return PSA_ERROR_NOT_SUPPORTED;
3782
3783#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3784 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3785 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3786}
3787
3788psa_status_t mbedtls_psa_verify_hash_start(
3789 mbedtls_psa_verify_hash_interruptible_operation_t *operation,
3790 const psa_key_attributes_t *attributes,
3791 const uint8_t *key_buffer, size_t key_buffer_size,
3792 psa_algorithm_t alg,
3793 const uint8_t *hash, size_t hash_length,
3794 const uint8_t *signature, size_t signature_length)
3795{
3796 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott1bc59df2023-02-05 13:41:57 +00003797 size_t coordinate_bytes = 0;
Paul Elliott0290a762023-02-09 14:30:24 +00003798 size_t required_hash_length = 0;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003799
Paul Elliott068fe072023-01-16 13:59:15 +00003800 if (!PSA_KEY_TYPE_IS_ECC(attributes->core.type)) {
3801 return PSA_ERROR_NOT_SUPPORTED;
3802 }
3803
3804 if (!PSA_ALG_IS_ECDSA(alg)) {
Paul Elliott813f9cd2023-02-05 15:28:46 +00003805 return PSA_ERROR_NOT_SUPPORTED;
Paul Elliott068fe072023-01-16 13:59:15 +00003806 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003807
3808#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
Paul Elliott068fe072023-01-16 13:59:15 +00003809 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3810 defined(MBEDTLS_ECP_RESTARTABLE)
Paul Elliott588f8ed2022-12-02 18:10:26 +00003811
Paul Elliotta1c94092023-02-15 16:38:04 +00003812 mbedtls_ecdsa_restart_init(&operation->restart_ctx);
3813 mbedtls_mpi_init(&operation->r);
3814 mbedtls_mpi_init(&operation->s);
3815
Paul Elliott93d9ca82023-02-15 18:14:21 +00003816 /* Ensure num_ops is zero'ed in case of context re-use. */
3817 operation->num_ops = 0;
3818
Paul Elliott068fe072023-01-16 13:59:15 +00003819 status = mbedtls_psa_ecp_load_representation(attributes->core.type,
3820 attributes->core.bits,
3821 key_buffer,
3822 key_buffer_size,
3823 &operation->ctx);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003824
Paul Elliott068fe072023-01-16 13:59:15 +00003825 if (status != PSA_SUCCESS) {
3826 return status;
3827 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003828
Paul Elliottc569fc22023-02-10 13:02:54 +00003829 coordinate_bytes = PSA_BITS_TO_BYTES(operation->ctx->grp.nbits);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003830
Paul Elliott1bc59df2023-02-05 13:41:57 +00003831 if (signature_length != 2 * coordinate_bytes) {
Paul Elliott068fe072023-01-16 13:59:15 +00003832 return PSA_ERROR_INVALID_SIGNATURE;
3833 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003834
Paul Elliott068fe072023-01-16 13:59:15 +00003835 status = mbedtls_to_psa_error(
3836 mbedtls_mpi_read_binary(&operation->r,
3837 signature,
Paul Elliott1bc59df2023-02-05 13:41:57 +00003838 coordinate_bytes));
Paul Elliott588f8ed2022-12-02 18:10:26 +00003839
Paul Elliott068fe072023-01-16 13:59:15 +00003840 if (status != PSA_SUCCESS) {
3841 return status;
3842 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003843
Paul Elliott068fe072023-01-16 13:59:15 +00003844 status = mbedtls_to_psa_error(
3845 mbedtls_mpi_read_binary(&operation->s,
3846 signature +
Paul Elliott1bc59df2023-02-05 13:41:57 +00003847 coordinate_bytes,
3848 coordinate_bytes));
Paul Elliott588f8ed2022-12-02 18:10:26 +00003849
Paul Elliott068fe072023-01-16 13:59:15 +00003850 if (status != PSA_SUCCESS) {
3851 return status;
3852 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003853
Paul Elliott2c9843f2023-02-15 17:32:42 +00003854 status = mbedtls_psa_ecp_load_public_part(operation->ctx);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003855
Paul Elliott2c9843f2023-02-15 17:32:42 +00003856 if (status != PSA_SUCCESS) {
3857 return status;
Paul Elliott068fe072023-01-16 13:59:15 +00003858 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003859
Paul Elliott0290a762023-02-09 14:30:24 +00003860 /* We only need to store the same length of hash as the private key size
3861 * here, it would be truncated by the internal implementation anyway. */
3862 required_hash_length = (hash_length < coordinate_bytes ? hash_length :
3863 coordinate_bytes);
3864
Paul Elliottba70ad42023-02-15 18:23:53 +00003865 if (required_hash_length > sizeof(operation->hash)) {
3866 /* Shouldn't happen, but better safe than sorry. */
3867 return PSA_ERROR_CORRUPTION_DETECTED;
3868 }
3869
Paul Elliott0290a762023-02-09 14:30:24 +00003870 memcpy(operation->hash, hash, required_hash_length);
3871 operation->hash_length = required_hash_length;
Paul Elliott068fe072023-01-16 13:59:15 +00003872
3873 return PSA_SUCCESS;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003874#else
Paul Elliott068fe072023-01-16 13:59:15 +00003875 (void) operation;
3876 (void) key_buffer;
3877 (void) key_buffer_size;
3878 (void) alg;
3879 (void) hash;
3880 (void) hash_length;
3881 (void) signature;
3882 (void) signature_length;
3883 (void) status;
Paul Elliott1243f932023-02-07 11:21:10 +00003884 (void) coordinate_bytes;
Paul Elliott0290a762023-02-09 14:30:24 +00003885 (void) required_hash_length;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003886
Paul Elliott068fe072023-01-16 13:59:15 +00003887 return PSA_ERROR_NOT_SUPPORTED;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003888#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3889 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3890 * defined( MBEDTLS_ECP_RESTARTABLE ) */
Paul Elliott588f8ed2022-12-02 18:10:26 +00003891}
3892
3893psa_status_t mbedtls_psa_verify_hash_complete(
3894 mbedtls_psa_verify_hash_interruptible_operation_t *operation)
3895{
3896
3897#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3898 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3899 defined(MBEDTLS_ECP_RESTARTABLE)
3900
Paul Elliottf8e5b562023-02-19 18:43:45 +00003901 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3902
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003903 /* Ensure max_ops is set to the current value (or default). */
3904 mbedtls_psa_interruptible_set_max_ops(psa_interruptible_get_max_ops());
3905
Paul Elliottf8e5b562023-02-19 18:43:45 +00003906 status = mbedtls_to_psa_error(
Paul Elliott588f8ed2022-12-02 18:10:26 +00003907 mbedtls_ecdsa_verify_restartable(&operation->ctx->grp,
3908 operation->hash,
3909 operation->hash_length,
3910 &operation->ctx->Q,
3911 &operation->r,
3912 &operation->s,
3913 &operation->restart_ctx));
3914
Paul Elliottf8e5b562023-02-19 18:43:45 +00003915 /* Hide the fact that the restart context only holds a delta of number of
3916 * ops done during the last operation, not an absolute value. */
3917 operation->num_ops += operation->restart_ctx.ecp.ops_done;
3918
3919 return status;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003920#else
3921 (void) operation;
3922
3923 return PSA_ERROR_NOT_SUPPORTED;
3924
3925#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3926 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3927 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3928}
3929
3930psa_status_t mbedtls_psa_verify_hash_abort(
3931 mbedtls_psa_verify_hash_interruptible_operation_t *operation)
3932{
3933
3934#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3935 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3936 defined(MBEDTLS_ECP_RESTARTABLE)
3937
3938 if (operation->ctx) {
3939 mbedtls_ecdsa_free(operation->ctx);
3940 mbedtls_free(operation->ctx);
Paul Elliottf9c91a72023-02-05 18:06:38 +00003941 operation->ctx = NULL;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003942 }
3943
3944 mbedtls_ecdsa_restart_free(&operation->restart_ctx);
3945
Paul Elliott93d9ca82023-02-15 18:14:21 +00003946 operation->num_ops = 0;
3947
Paul Elliott588f8ed2022-12-02 18:10:26 +00003948 mbedtls_mpi_free(&operation->r);
3949 mbedtls_mpi_free(&operation->s);
3950
3951 return PSA_SUCCESS;
3952
3953#else
3954 (void) operation;
3955
3956 return PSA_ERROR_NOT_SUPPORTED;
3957
3958#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3959 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3960 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3961}
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02003962
mohammad1603503973b2018-03-12 15:59:30 +02003963/****************************************************************/
3964/* Symmetric cryptography */
3965/****************************************************************/
3966
Gilles Peskine449bd832023-01-11 14:50:10 +01003967static psa_status_t psa_cipher_setup(psa_cipher_operation_t *operation,
3968 mbedtls_svc_key_id_t key,
3969 psa_algorithm_t alg,
3970 mbedtls_operation_t cipher_operation)
Ronald Cronab99ac22020-10-01 16:38:28 +02003971{
3972 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3973 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Dave Rodgman54648242021-06-24 11:49:45 +01003974 psa_key_slot_t *slot = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01003975 psa_key_usage_t usage = (cipher_operation == MBEDTLS_ENCRYPT ?
3976 PSA_KEY_USAGE_ENCRYPT :
3977 PSA_KEY_USAGE_DECRYPT);
Ronald Cronab99ac22020-10-01 16:38:28 +02003978
3979 /* A context must be freshly initialized before it can be set up. */
Gilles Peskine449bd832023-01-11 14:50:10 +01003980 if (operation->id != 0) {
Dave Rodgman54648242021-06-24 11:49:45 +01003981 status = PSA_ERROR_BAD_STATE;
3982 goto exit;
3983 }
Ronald Cronab99ac22020-10-01 16:38:28 +02003984
Gilles Peskine449bd832023-01-11 14:50:10 +01003985 if (!PSA_ALG_IS_CIPHER(alg)) {
Dave Rodgman54648242021-06-24 11:49:45 +01003986 status = PSA_ERROR_INVALID_ARGUMENT;
3987 goto exit;
3988 }
Ronald Cronab99ac22020-10-01 16:38:28 +02003989
Gilles Peskine449bd832023-01-11 14:50:10 +01003990 status = psa_get_and_lock_key_slot_with_policy(key, &slot, usage, alg);
3991 if (status != PSA_SUCCESS) {
Ronald Cronab99ac22020-10-01 16:38:28 +02003992 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01003993 }
Ronald Cronab99ac22020-10-01 16:38:28 +02003994
Ronald Cron49fafa92021-03-10 08:34:23 +01003995 /* Initialize the operation struct members, except for id. The id member
Ronald Cronab99ac22020-10-01 16:38:28 +02003996 * is used to indicate to psa_cipher_abort that there are resources to free,
Ronald Cron49fafa92021-03-10 08:34:23 +01003997 * so we only set it (in the driver wrapper) after resources have been
3998 * allocated/initialized. */
Ronald Cronab99ac22020-10-01 16:38:28 +02003999 operation->iv_set = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01004000 if (alg == PSA_ALG_ECB_NO_PADDING) {
Ronald Cronab99ac22020-10-01 16:38:28 +02004001 operation->iv_required = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01004002 } else {
Ronald Cronab99ac22020-10-01 16:38:28 +02004003 operation->iv_required = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004004 }
4005 operation->default_iv_length = PSA_CIPHER_IV_LENGTH(slot->attr.type, alg);
Ronald Cronab99ac22020-10-01 16:38:28 +02004006
Ronald Crona4af55f2020-12-14 14:36:06 +01004007 psa_key_attributes_t attributes = {
Gilles Peskine449bd832023-01-11 14:50:10 +01004008 .core = slot->attr
Ronald Crona4af55f2020-12-14 14:36:06 +01004009 };
4010
Ronald Cronab99ac22020-10-01 16:38:28 +02004011 /* Try doing the operation through a driver before using software fallback. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004012 if (cipher_operation == MBEDTLS_ENCRYPT) {
4013 status = psa_driver_wrapper_cipher_encrypt_setup(operation,
4014 &attributes,
4015 slot->key.data,
4016 slot->key.bytes,
4017 alg);
4018 } else {
4019 status = psa_driver_wrapper_cipher_decrypt_setup(operation,
4020 &attributes,
4021 slot->key.data,
4022 slot->key.bytes,
4023 alg);
4024 }
Ronald Cronab99ac22020-10-01 16:38:28 +02004025
Gilles Peskine9ab61b62019-02-25 17:43:14 +01004026exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004027 if (status != PSA_SUCCESS) {
4028 psa_cipher_abort(operation);
4029 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02004030
Gilles Peskine449bd832023-01-11 14:50:10 +01004031 unlock_status = psa_unlock_key_slot(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02004032
Gilles Peskine449bd832023-01-11 14:50:10 +01004033 return (status == PSA_SUCCESS) ? unlock_status : status;
mohammad1603503973b2018-03-12 15:59:30 +02004034}
4035
Gilles Peskine449bd832023-01-11 14:50:10 +01004036psa_status_t psa_cipher_encrypt_setup(psa_cipher_operation_t *operation,
4037 mbedtls_svc_key_id_t key,
4038 psa_algorithm_t alg)
mohammad16038481e742018-03-18 13:57:31 +02004039{
Gilles Peskine449bd832023-01-11 14:50:10 +01004040 return psa_cipher_setup(operation, key, alg, MBEDTLS_ENCRYPT);
mohammad16038481e742018-03-18 13:57:31 +02004041}
4042
Gilles Peskine449bd832023-01-11 14:50:10 +01004043psa_status_t psa_cipher_decrypt_setup(psa_cipher_operation_t *operation,
4044 mbedtls_svc_key_id_t key,
4045 psa_algorithm_t alg)
mohammad16038481e742018-03-18 13:57:31 +02004046{
Gilles Peskine449bd832023-01-11 14:50:10 +01004047 return psa_cipher_setup(operation, key, alg, MBEDTLS_DECRYPT);
mohammad16038481e742018-03-18 13:57:31 +02004048}
4049
Gilles Peskine449bd832023-01-11 14:50:10 +01004050psa_status_t psa_cipher_generate_iv(psa_cipher_operation_t *operation,
4051 uint8_t *iv,
4052 size_t iv_size,
4053 size_t *iv_length)
mohammad1603503973b2018-03-12 15:59:30 +02004054{
Ronald Cron6d051732020-10-01 14:10:20 +02004055 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron2fb90522021-07-05 12:31:44 +02004056 uint8_t local_iv[PSA_CIPHER_IV_MAX_SIZE];
4057 size_t default_iv_length;
Ronald Cron5618a392021-03-26 09:52:26 +01004058
Gilles Peskine449bd832023-01-11 14:50:10 +01004059 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004060 status = PSA_ERROR_BAD_STATE;
4061 goto exit;
Ronald Cronc45b4af2020-09-29 16:18:05 +02004062 }
4063
Gilles Peskine449bd832023-01-11 14:50:10 +01004064 if (operation->iv_set || !operation->iv_required) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004065 status = PSA_ERROR_BAD_STATE;
4066 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004067 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004068
Ronald Cron2fb90522021-07-05 12:31:44 +02004069 default_iv_length = operation->default_iv_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01004070 if (iv_size < default_iv_length) {
Ronald Cron5618a392021-03-26 09:52:26 +01004071 status = PSA_ERROR_BUFFER_TOO_SMALL;
4072 goto exit;
4073 }
Gilles Peskinee553c652018-06-04 16:22:46 +02004074
Gilles Peskine449bd832023-01-11 14:50:10 +01004075 if (default_iv_length > PSA_CIPHER_IV_MAX_SIZE) {
Ronald Cron2fb90522021-07-05 12:31:44 +02004076 status = PSA_ERROR_GENERIC_ERROR;
4077 goto exit;
4078 }
4079
Gilles Peskine449bd832023-01-11 14:50:10 +01004080 status = psa_generate_random(local_iv, default_iv_length);
4081 if (status != PSA_SUCCESS) {
Ronald Cron5618a392021-03-26 09:52:26 +01004082 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004083 }
Ronald Cron5618a392021-03-26 09:52:26 +01004084
Gilles Peskine449bd832023-01-11 14:50:10 +01004085 status = psa_driver_wrapper_cipher_set_iv(operation,
4086 local_iv, default_iv_length);
Ronald Cron5618a392021-03-26 09:52:26 +01004087
4088exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004089 if (status == PSA_SUCCESS) {
4090 memcpy(iv, local_iv, default_iv_length);
Ronald Cron2fb90522021-07-05 12:31:44 +02004091 *iv_length = default_iv_length;
Steven Cooreman7df02922020-09-09 15:28:49 +02004092 operation->iv_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004093 } else {
Ronald Cron2fb90522021-07-05 12:31:44 +02004094 *iv_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01004095 psa_cipher_abort(operation);
Ronald Cron2fb90522021-07-05 12:31:44 +02004096 }
Ronald Cron6d051732020-10-01 14:10:20 +02004097
Gilles Peskine449bd832023-01-11 14:50:10 +01004098 return status;
mohammad1603503973b2018-03-12 15:59:30 +02004099}
4100
Gilles Peskine449bd832023-01-11 14:50:10 +01004101psa_status_t psa_cipher_set_iv(psa_cipher_operation_t *operation,
4102 const uint8_t *iv,
4103 size_t iv_length)
mohammad1603503973b2018-03-12 15:59:30 +02004104{
Ronald Cron6d051732020-10-01 14:10:20 +02004105 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cronc45b4af2020-09-29 16:18:05 +02004106
Gilles Peskine449bd832023-01-11 14:50:10 +01004107 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004108 status = PSA_ERROR_BAD_STATE;
4109 goto exit;
4110 }
Ronald Cronc45b4af2020-09-29 16:18:05 +02004111
Gilles Peskine449bd832023-01-11 14:50:10 +01004112 if (operation->iv_set || !operation->iv_required) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004113 status = PSA_ERROR_BAD_STATE;
4114 goto exit;
4115 }
Ronald Crona0d68172021-03-26 10:15:08 +01004116
Gilles Peskine449bd832023-01-11 14:50:10 +01004117 if (iv_length > PSA_CIPHER_IV_MAX_SIZE) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004118 status = PSA_ERROR_INVALID_ARGUMENT;
4119 goto exit;
4120 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004121
Gilles Peskine449bd832023-01-11 14:50:10 +01004122 status = psa_driver_wrapper_cipher_set_iv(operation,
4123 iv,
4124 iv_length);
Steven Cooremand3feccd2020-09-01 15:56:14 +02004125
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004126exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004127 if (status == PSA_SUCCESS) {
itayzafrir534bd7c2018-08-02 13:56:32 +03004128 operation->iv_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004129 } else {
4130 psa_cipher_abort(operation);
4131 }
4132 return status;
mohammad1603503973b2018-03-12 15:59:30 +02004133}
4134
Gilles Peskine449bd832023-01-11 14:50:10 +01004135psa_status_t psa_cipher_update(psa_cipher_operation_t *operation,
4136 const uint8_t *input,
4137 size_t input_length,
4138 uint8_t *output,
4139 size_t output_size,
4140 size_t *output_length)
mohammad1603503973b2018-03-12 15:59:30 +02004141{
Steven Cooremanffecb7b2020-08-25 15:13:13 +02004142 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron6d051732020-10-01 14:10:20 +02004143
Gilles Peskine449bd832023-01-11 14:50:10 +01004144 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004145 status = PSA_ERROR_BAD_STATE;
4146 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004147 }
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004148
Gilles Peskine449bd832023-01-11 14:50:10 +01004149 if (operation->iv_required && !operation->iv_set) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004150 status = PSA_ERROR_BAD_STATE;
4151 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004152 }
Jaeden Ameroab439972019-02-15 14:12:05 +00004153
Gilles Peskine449bd832023-01-11 14:50:10 +01004154 status = psa_driver_wrapper_cipher_update(operation,
4155 input,
4156 input_length,
4157 output,
4158 output_size,
4159 output_length);
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004160
4161exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004162 if (status != PSA_SUCCESS) {
4163 psa_cipher_abort(operation);
4164 }
Ronald Cron6d051732020-10-01 14:10:20 +02004165
Gilles Peskine449bd832023-01-11 14:50:10 +01004166 return status;
mohammad1603503973b2018-03-12 15:59:30 +02004167}
4168
Gilles Peskine449bd832023-01-11 14:50:10 +01004169psa_status_t psa_cipher_finish(psa_cipher_operation_t *operation,
4170 uint8_t *output,
4171 size_t output_size,
4172 size_t *output_length)
mohammad1603503973b2018-03-12 15:59:30 +02004173{
David Saadab4ecc272019-02-14 13:48:10 +02004174 psa_status_t status = PSA_ERROR_GENERIC_ERROR;
Ronald Cron6d051732020-10-01 14:10:20 +02004175
Gilles Peskine449bd832023-01-11 14:50:10 +01004176 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004177 status = PSA_ERROR_BAD_STATE;
4178 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004179 }
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004180
Gilles Peskine449bd832023-01-11 14:50:10 +01004181 if (operation->iv_required && !operation->iv_set) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004182 status = PSA_ERROR_BAD_STATE;
4183 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004184 }
Moran Pekerbed71a22018-04-22 20:19:20 +03004185
Gilles Peskine449bd832023-01-11 14:50:10 +01004186 status = psa_driver_wrapper_cipher_finish(operation,
4187 output,
4188 output_size,
4189 output_length);
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004190
4191exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004192 if (status == PSA_SUCCESS) {
4193 return psa_cipher_abort(operation);
4194 } else {
Steven Cooremanef8575e2020-09-11 11:44:50 +02004195 *output_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01004196 (void) psa_cipher_abort(operation);
Janos Follath315b51c2018-07-09 16:04:51 +01004197
Gilles Peskine449bd832023-01-11 14:50:10 +01004198 return status;
Steven Cooremanef8575e2020-09-11 11:44:50 +02004199 }
mohammad1603503973b2018-03-12 15:59:30 +02004200}
4201
Gilles Peskine449bd832023-01-11 14:50:10 +01004202psa_status_t psa_cipher_abort(psa_cipher_operation_t *operation)
Gilles Peskinee553c652018-06-04 16:22:46 +02004203{
Gilles Peskine449bd832023-01-11 14:50:10 +01004204 if (operation->id == 0) {
Steven Cooremana07b9972020-09-10 14:54:14 +02004205 /* The object has (apparently) been initialized but it is not (yet)
Gilles Peskine81736312018-06-26 15:04:31 +02004206 * in use. It's ok to call abort on such an object, and there's
4207 * nothing to do. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004208 return PSA_SUCCESS;
Gilles Peskine81736312018-06-26 15:04:31 +02004209 }
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02004210
Gilles Peskine449bd832023-01-11 14:50:10 +01004211 psa_driver_wrapper_cipher_abort(operation);
Gilles Peskinee553c652018-06-04 16:22:46 +02004212
Ronald Cron49fafa92021-03-10 08:34:23 +01004213 operation->id = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03004214 operation->iv_set = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03004215 operation->iv_required = 0;
Moran Peker41deec42018-04-04 15:43:05 +03004216
Gilles Peskine449bd832023-01-11 14:50:10 +01004217 return PSA_SUCCESS;
mohammad1603503973b2018-03-12 15:59:30 +02004218}
4219
Gilles Peskine449bd832023-01-11 14:50:10 +01004220psa_status_t psa_cipher_encrypt(mbedtls_svc_key_id_t key,
4221 psa_algorithm_t alg,
4222 const uint8_t *input,
4223 size_t input_length,
4224 uint8_t *output,
4225 size_t output_size,
4226 size_t *output_length)
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004227{
4228 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004229 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron23919522021-07-08 19:00:07 +02004230 psa_key_slot_t *slot = NULL;
Ronald Cronc6e6f502021-07-09 18:44:58 +02004231 uint8_t local_iv[PSA_CIPHER_IV_MAX_SIZE];
4232 size_t default_iv_length = 0;
gabor-mezei-arm6f4e5bb2021-06-25 15:21:11 +02004233
Gilles Peskine449bd832023-01-11 14:50:10 +01004234 if (!PSA_ALG_IS_CIPHER(alg)) {
Ronald Cron23919522021-07-08 19:00:07 +02004235 status = PSA_ERROR_INVALID_ARGUMENT;
4236 goto exit;
4237 }
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004238
Gilles Peskine449bd832023-01-11 14:50:10 +01004239 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
4240 PSA_KEY_USAGE_ENCRYPT,
4241 alg);
4242 if (status != PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004243 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004244 }
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004245
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004246 psa_key_attributes_t attributes = {
Gilles Peskine449bd832023-01-11 14:50:10 +01004247 .core = slot->attr
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004248 };
4249
Gilles Peskine449bd832023-01-11 14:50:10 +01004250 default_iv_length = PSA_CIPHER_IV_LENGTH(slot->attr.type, alg);
4251 if (default_iv_length > PSA_CIPHER_IV_MAX_SIZE) {
Ronald Cronc6e6f502021-07-09 18:44:58 +02004252 status = PSA_ERROR_GENERIC_ERROR;
4253 goto exit;
4254 }
4255
Gilles Peskine449bd832023-01-11 14:50:10 +01004256 if (default_iv_length > 0) {
4257 if (output_size < default_iv_length) {
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004258 status = PSA_ERROR_BUFFER_TOO_SMALL;
4259 goto exit;
4260 }
4261
Gilles Peskine449bd832023-01-11 14:50:10 +01004262 status = psa_generate_random(local_iv, default_iv_length);
4263 if (status != PSA_SUCCESS) {
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004264 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004265 }
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004266 }
4267
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004268 status = psa_driver_wrapper_cipher_encrypt(
4269 &attributes, slot->key.data, slot->key.bytes,
Ronald Cronc6e6f502021-07-09 18:44:58 +02004270 alg, local_iv, default_iv_length, input, input_length,
Ronald Cronafbc7ed2023-01-24 16:02:04 +01004271 psa_crypto_buffer_offset(output, default_iv_length),
Gilles Peskine449bd832023-01-11 14:50:10 +01004272 output_size - default_iv_length, output_length);
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004273
4274exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004275 unlock_status = psa_unlock_key_slot(slot);
4276 if (status == PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004277 status = unlock_status;
Ronald Cronc6e6f502021-07-09 18:44:58 +02004278 }
Ronald Cron23919522021-07-08 19:00:07 +02004279
Gilles Peskine449bd832023-01-11 14:50:10 +01004280 if (status == PSA_SUCCESS) {
4281 if (default_iv_length > 0) {
4282 memcpy(output, local_iv, default_iv_length);
4283 }
4284 *output_length += default_iv_length;
4285 } else {
4286 *output_length = 0;
4287 }
4288
4289 return status;
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004290}
4291
Gilles Peskine449bd832023-01-11 14:50:10 +01004292psa_status_t psa_cipher_decrypt(mbedtls_svc_key_id_t key,
4293 psa_algorithm_t alg,
4294 const uint8_t *input,
4295 size_t input_length,
4296 uint8_t *output,
4297 size_t output_size,
4298 size_t *output_length)
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004299{
4300 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004301 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron23919522021-07-08 19:00:07 +02004302 psa_key_slot_t *slot = NULL;
gabor-mezei-arm6f4e5bb2021-06-25 15:21:11 +02004303
Gilles Peskine449bd832023-01-11 14:50:10 +01004304 if (!PSA_ALG_IS_CIPHER(alg)) {
Ronald Cron23919522021-07-08 19:00:07 +02004305 status = PSA_ERROR_INVALID_ARGUMENT;
4306 goto exit;
4307 }
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004308
Gilles Peskine449bd832023-01-11 14:50:10 +01004309 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
4310 PSA_KEY_USAGE_DECRYPT,
4311 alg);
4312 if (status != PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004313 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004314 }
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004315
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004316 psa_key_attributes_t attributes = {
Gilles Peskine449bd832023-01-11 14:50:10 +01004317 .core = slot->attr
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004318 };
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004319
Gilles Peskine449bd832023-01-11 14:50:10 +01004320 if (alg == PSA_ALG_CCM_STAR_NO_TAG &&
4321 input_length < PSA_BLOCK_CIPHER_BLOCK_LENGTH(slot->attr.type)) {
Mateusz Starzyk594215b2021-10-14 12:23:06 +02004322 status = PSA_ERROR_INVALID_ARGUMENT;
4323 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004324 } else if (input_length < PSA_CIPHER_IV_LENGTH(slot->attr.type, alg)) {
gabor-mezei-arm258ae072021-06-25 15:25:38 +02004325 status = PSA_ERROR_INVALID_ARGUMENT;
4326 goto exit;
4327 }
4328
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004329 status = psa_driver_wrapper_cipher_decrypt(
4330 &attributes, slot->key.data, slot->key.bytes,
4331 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01004332 output, output_size, output_length);
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004333
gabor-mezei-arm258ae072021-06-25 15:25:38 +02004334exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004335 unlock_status = psa_unlock_key_slot(slot);
4336 if (status == PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004337 status = unlock_status;
Gilles Peskine449bd832023-01-11 14:50:10 +01004338 }
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004339
Gilles Peskine449bd832023-01-11 14:50:10 +01004340 if (status != PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004341 *output_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01004342 }
Ronald Cron23919522021-07-08 19:00:07 +02004343
Gilles Peskine449bd832023-01-11 14:50:10 +01004344 return status;
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004345}
4346
4347
mohammad16035955c982018-04-26 00:53:03 +03004348/****************************************************************/
4349/* AEAD */
4350/****************************************************************/
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02004351
Paul Elliottbaff51c2021-09-28 17:44:45 +01004352/* Helper function to get the base algorithm from its variants. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004353static psa_algorithm_t psa_aead_get_base_algorithm(psa_algorithm_t alg)
Paul Elliottbaff51c2021-09-28 17:44:45 +01004354{
Gilles Peskine449bd832023-01-11 14:50:10 +01004355 return PSA_ALG_AEAD_WITH_DEFAULT_LENGTH_TAG(alg);
Paul Elliottbaff51c2021-09-28 17:44:45 +01004356}
4357
4358/* Helper function to perform common nonce length checks. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004359static psa_status_t psa_aead_check_nonce_length(psa_algorithm_t alg,
4360 size_t nonce_length)
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004361{
Gilles Peskine449bd832023-01-11 14:50:10 +01004362 psa_algorithm_t base_alg = psa_aead_get_base_algorithm(alg);
Paul Elliottbaff51c2021-09-28 17:44:45 +01004363
Gilles Peskine449bd832023-01-11 14:50:10 +01004364 switch (base_alg) {
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004365#if defined(PSA_WANT_ALG_GCM)
4366 case PSA_ALG_GCM:
4367 /* Not checking max nonce size here as GCM spec allows almost
Gilles Peskine449bd832023-01-11 14:50:10 +01004368 * arbitrarily large nonces. Please note that we do not generally
4369 * recommend the usage of nonces of greater length than
4370 * PSA_AEAD_NONCE_MAX_SIZE, as large nonces are hashed to a shorter
4371 * size, which can then lead to collisions if you encrypt a very
4372 * large number of messages.*/
4373 if (nonce_length != 0) {
4374 return PSA_SUCCESS;
4375 }
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004376 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004377#endif /* PSA_WANT_ALG_GCM */
4378#if defined(PSA_WANT_ALG_CCM)
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004379 case PSA_ALG_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01004380 if (nonce_length >= 7 && nonce_length <= 13) {
4381 return PSA_SUCCESS;
4382 }
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004383 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004384#endif /* PSA_WANT_ALG_CCM */
4385#if defined(PSA_WANT_ALG_CHACHA20_POLY1305)
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004386 case PSA_ALG_CHACHA20_POLY1305:
Gilles Peskine449bd832023-01-11 14:50:10 +01004387 if (nonce_length == 12) {
4388 return PSA_SUCCESS;
4389 } else if (nonce_length == 8) {
4390 return PSA_ERROR_NOT_SUPPORTED;
4391 }
Bence Szépkúti6d48e202021-11-15 20:04:15 +01004392 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004393#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004394 default:
Przemek Stekiel4c499272022-09-27 13:55:37 +02004395 (void) nonce_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01004396 return PSA_ERROR_NOT_SUPPORTED;
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004397 }
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004398
Gilles Peskine449bd832023-01-11 14:50:10 +01004399 return PSA_ERROR_INVALID_ARGUMENT;
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004400}
4401
Gilles Peskine449bd832023-01-11 14:50:10 +01004402static psa_status_t psa_aead_check_algorithm(psa_algorithm_t alg)
Bence Szépkútiaa3a6e42022-01-13 16:26:03 +01004403{
Gilles Peskine449bd832023-01-11 14:50:10 +01004404 if (!PSA_ALG_IS_AEAD(alg) || PSA_ALG_IS_WILDCARD(alg)) {
4405 return PSA_ERROR_INVALID_ARGUMENT;
4406 }
Bence Szépkúti08f34652021-12-08 21:07:13 +01004407
Gilles Peskine449bd832023-01-11 14:50:10 +01004408 return PSA_SUCCESS;
Bence Szépkúti08f34652021-12-08 21:07:13 +01004409}
4410
Gilles Peskine449bd832023-01-11 14:50:10 +01004411psa_status_t psa_aead_encrypt(mbedtls_svc_key_id_t key,
4412 psa_algorithm_t alg,
4413 const uint8_t *nonce,
4414 size_t nonce_length,
4415 const uint8_t *additional_data,
4416 size_t additional_data_length,
4417 const uint8_t *plaintext,
4418 size_t plaintext_length,
4419 uint8_t *ciphertext,
4420 size_t ciphertext_size,
4421 size_t *ciphertext_length)
mohammad16035955c982018-04-26 00:53:03 +03004422{
Ronald Cron215633c2021-03-16 17:15:37 +01004423 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4424 psa_key_slot_t *slot;
Gilles Peskine2d277862018-06-18 15:41:12 +02004425
mohammad1603f08a5502018-06-03 15:05:47 +03004426 *ciphertext_length = 0;
mohammad1603e58e6842018-05-09 04:58:32 -07004427
Gilles Peskine449bd832023-01-11 14:50:10 +01004428 status = psa_aead_check_algorithm(alg);
4429 if (status != PSA_SUCCESS) {
4430 return status;
4431 }
Steven Cooremanea7ab132021-03-17 16:28:00 +01004432
Ronald Cron9a986162021-03-26 12:40:07 +01004433 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01004434 key, &slot, PSA_KEY_USAGE_ENCRYPT, alg);
4435 if (status != PSA_SUCCESS) {
4436 return status;
4437 }
mohammad16035955c982018-04-26 00:53:03 +03004438
Ronald Cron215633c2021-03-16 17:15:37 +01004439 psa_key_attributes_t attributes = {
Gilles Peskine449bd832023-01-11 14:50:10 +01004440 .core = slot->attr
Ronald Cron215633c2021-03-16 17:15:37 +01004441 };
mohammad16035955c982018-04-26 00:53:03 +03004442
Gilles Peskine449bd832023-01-11 14:50:10 +01004443 status = psa_aead_check_nonce_length(alg, nonce_length);
4444 if (status != PSA_SUCCESS) {
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004445 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004446 }
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004447
Ronald Cronde822812021-03-17 16:08:20 +01004448 status = psa_driver_wrapper_aead_encrypt(
Ronald Cron215633c2021-03-16 17:15:37 +01004449 &attributes, slot->key.data, slot->key.bytes,
4450 alg,
4451 nonce, nonce_length,
4452 additional_data, additional_data_length,
4453 plaintext, plaintext_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01004454 ciphertext, ciphertext_size, ciphertext_length);
Gilles Peskine2d277862018-06-18 15:41:12 +02004455
Gilles Peskine449bd832023-01-11 14:50:10 +01004456 if (status != PSA_SUCCESS && ciphertext_size != 0) {
4457 memset(ciphertext, 0, ciphertext_size);
4458 }
Gilles Peskine2d277862018-06-18 15:41:12 +02004459
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004460exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004461 psa_unlock_key_slot(slot);
mohammad16035955c982018-04-26 00:53:03 +03004462
Gilles Peskine449bd832023-01-11 14:50:10 +01004463 return status;
Gilles Peskineee652a32018-06-01 19:23:52 +02004464}
4465
Gilles Peskine449bd832023-01-11 14:50:10 +01004466psa_status_t psa_aead_decrypt(mbedtls_svc_key_id_t key,
4467 psa_algorithm_t alg,
4468 const uint8_t *nonce,
4469 size_t nonce_length,
4470 const uint8_t *additional_data,
4471 size_t additional_data_length,
4472 const uint8_t *ciphertext,
4473 size_t ciphertext_length,
4474 uint8_t *plaintext,
4475 size_t plaintext_size,
4476 size_t *plaintext_length)
mohammad16035955c982018-04-26 00:53:03 +03004477{
Ronald Cron215633c2021-03-16 17:15:37 +01004478 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4479 psa_key_slot_t *slot;
Gilles Peskine2d277862018-06-18 15:41:12 +02004480
Gilles Peskineee652a32018-06-01 19:23:52 +02004481 *plaintext_length = 0;
mohammad16039e5a5152018-04-26 12:07:35 +03004482
Gilles Peskine449bd832023-01-11 14:50:10 +01004483 status = psa_aead_check_algorithm(alg);
4484 if (status != PSA_SUCCESS) {
4485 return status;
4486 }
Steven Cooremanea7ab132021-03-17 16:28:00 +01004487
Ronald Cron9a986162021-03-26 12:40:07 +01004488 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01004489 key, &slot, PSA_KEY_USAGE_DECRYPT, alg);
4490 if (status != PSA_SUCCESS) {
4491 return status;
4492 }
mohammad16035955c982018-04-26 00:53:03 +03004493
Ronald Cron215633c2021-03-16 17:15:37 +01004494 psa_key_attributes_t attributes = {
Gilles Peskine449bd832023-01-11 14:50:10 +01004495 .core = slot->attr
Ronald Cron215633c2021-03-16 17:15:37 +01004496 };
Gilles Peskinef7e7b012019-05-06 15:27:16 +02004497
Gilles Peskine449bd832023-01-11 14:50:10 +01004498 status = psa_aead_check_nonce_length(alg, nonce_length);
4499 if (status != PSA_SUCCESS) {
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004500 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004501 }
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004502
Ronald Cronde822812021-03-17 16:08:20 +01004503 status = psa_driver_wrapper_aead_decrypt(
Ronald Cron215633c2021-03-16 17:15:37 +01004504 &attributes, slot->key.data, slot->key.bytes,
4505 alg,
4506 nonce, nonce_length,
4507 additional_data, additional_data_length,
4508 ciphertext, ciphertext_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01004509 plaintext, plaintext_size, plaintext_length);
Gilles Peskinea40d7742018-06-01 16:28:30 +02004510
Gilles Peskine449bd832023-01-11 14:50:10 +01004511 if (status != PSA_SUCCESS && plaintext_size != 0) {
4512 memset(plaintext, 0, plaintext_size);
4513 }
mohammad160360a64d02018-06-03 17:20:42 +03004514
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004515exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004516 psa_unlock_key_slot(slot);
Ronald Cron215633c2021-03-16 17:15:37 +01004517
Gilles Peskine449bd832023-01-11 14:50:10 +01004518 return status;
mohammad16035955c982018-04-26 00:53:03 +03004519}
4520
Gilles Peskine449bd832023-01-11 14:50:10 +01004521static psa_status_t psa_validate_tag_length(psa_algorithm_t alg)
4522{
4523 const uint8_t tag_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg);
Andrzej Kurekf8816012021-12-19 17:00:12 +01004524
Gilles Peskine449bd832023-01-11 14:50:10 +01004525 switch (PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg, 0)) {
Przemek Stekiel86679c72022-10-06 17:06:56 +02004526#if defined(PSA_WANT_ALG_CCM)
Gilles Peskine449bd832023-01-11 14:50:10 +01004527 case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, 0):
Andrzej Kurekf8816012021-12-19 17:00:12 +01004528 /* CCM allows the following tag lengths: 4, 6, 8, 10, 12, 14, 16.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01004529 if (tag_len < 4 || tag_len > 16 || tag_len % 2) {
4530 return PSA_ERROR_INVALID_ARGUMENT;
4531 }
Andrzej Kurekf8816012021-12-19 17:00:12 +01004532 break;
Przemek Stekiel86679c72022-10-06 17:06:56 +02004533#endif /* PSA_WANT_ALG_CCM */
Andrzej Kurekf8816012021-12-19 17:00:12 +01004534
Przemek Stekiel86679c72022-10-06 17:06:56 +02004535#if defined(PSA_WANT_ALG_GCM)
Gilles Peskine449bd832023-01-11 14:50:10 +01004536 case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_GCM, 0):
Andrzej Kurekf8816012021-12-19 17:00:12 +01004537 /* GCM allows the following tag lengths: 4, 8, 12, 13, 14, 15, 16. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004538 if (tag_len != 4 && tag_len != 8 && (tag_len < 12 || tag_len > 16)) {
4539 return PSA_ERROR_INVALID_ARGUMENT;
4540 }
Andrzej Kurekf8816012021-12-19 17:00:12 +01004541 break;
Przemek Stekiel86679c72022-10-06 17:06:56 +02004542#endif /* PSA_WANT_ALG_GCM */
Andrzej Kurekf8816012021-12-19 17:00:12 +01004543
Przemek Stekiel86679c72022-10-06 17:06:56 +02004544#if defined(PSA_WANT_ALG_CHACHA20_POLY1305)
Gilles Peskine449bd832023-01-11 14:50:10 +01004545 case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CHACHA20_POLY1305, 0):
Andrzej Kurekf8816012021-12-19 17:00:12 +01004546 /* We only support the default tag length. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004547 if (tag_len != 16) {
4548 return PSA_ERROR_INVALID_ARGUMENT;
4549 }
Andrzej Kurekf8816012021-12-19 17:00:12 +01004550 break;
Przemek Stekiel86679c72022-10-06 17:06:56 +02004551#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */
Andrzej Kurekf8816012021-12-19 17:00:12 +01004552
4553 default:
4554 (void) tag_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01004555 return PSA_ERROR_NOT_SUPPORTED;
Andrzej Kurekf8816012021-12-19 17:00:12 +01004556 }
Gilles Peskine449bd832023-01-11 14:50:10 +01004557 return PSA_SUCCESS;
Andrzej Kurekf8816012021-12-19 17:00:12 +01004558}
4559
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004560/* Set the key for a multipart authenticated operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004561static psa_status_t psa_aead_setup(psa_aead_operation_t *operation,
4562 int is_encrypt,
4563 mbedtls_svc_key_id_t key,
4564 psa_algorithm_t alg)
Paul Elliottc2b71442021-06-24 18:17:52 +01004565{
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004566 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4567 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
4568 psa_key_slot_t *slot = NULL;
4569 psa_key_usage_t key_usage = 0;
4570
Gilles Peskine449bd832023-01-11 14:50:10 +01004571 status = psa_aead_check_algorithm(alg);
4572 if (status != PSA_SUCCESS) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004573 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004574 }
Paul Elliottc2b71442021-06-24 18:17:52 +01004575
Gilles Peskine449bd832023-01-11 14:50:10 +01004576 if (operation->id != 0) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004577 status = PSA_ERROR_BAD_STATE;
4578 goto exit;
Paul Elliottc2b71442021-06-24 18:17:52 +01004579 }
4580
Gilles Peskine449bd832023-01-11 14:50:10 +01004581 if (operation->nonce_set || operation->lengths_set ||
4582 operation->ad_started || operation->body_started) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004583 status = PSA_ERROR_BAD_STATE;
4584 goto exit;
Paul Elliottc2b71442021-06-24 18:17:52 +01004585 }
4586
Gilles Peskine449bd832023-01-11 14:50:10 +01004587 if (is_encrypt) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004588 key_usage = PSA_KEY_USAGE_ENCRYPT;
Gilles Peskine449bd832023-01-11 14:50:10 +01004589 } else {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004590 key_usage = PSA_KEY_USAGE_DECRYPT;
Gilles Peskine449bd832023-01-11 14:50:10 +01004591 }
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004592
Gilles Peskine449bd832023-01-11 14:50:10 +01004593 status = psa_get_and_lock_key_slot_with_policy(key, &slot, key_usage,
4594 alg);
4595 if (status != PSA_SUCCESS) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004596 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004597 }
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004598
4599 psa_key_attributes_t attributes = {
4600 .core = slot->attr
4601 };
4602
Gilles Peskine449bd832023-01-11 14:50:10 +01004603 if ((status = psa_validate_tag_length(alg)) != PSA_SUCCESS) {
Przemek Stekiel6ab50762022-10-08 17:54:30 +02004604 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004605 }
Przemek Stekiel6ab50762022-10-08 17:54:30 +02004606
Gilles Peskine449bd832023-01-11 14:50:10 +01004607 if (is_encrypt) {
4608 status = psa_driver_wrapper_aead_encrypt_setup(operation,
4609 &attributes,
4610 slot->key.data,
4611 slot->key.bytes,
4612 alg);
4613 } else {
4614 status = psa_driver_wrapper_aead_decrypt_setup(operation,
4615 &attributes,
4616 slot->key.data,
4617 slot->key.bytes,
4618 alg);
4619 }
4620 if (status != PSA_SUCCESS) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004621 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004622 }
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004623
Gilles Peskine449bd832023-01-11 14:50:10 +01004624 operation->key_type = psa_get_key_type(&attributes);
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004625
4626exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004627 unlock_status = psa_unlock_key_slot(slot);
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004628
Gilles Peskine449bd832023-01-11 14:50:10 +01004629 if (status == PSA_SUCCESS) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004630 status = unlock_status;
Gilles Peskine449bd832023-01-11 14:50:10 +01004631 operation->alg = psa_aead_get_base_algorithm(alg);
Paul Elliottd9343f22021-08-23 18:59:49 +01004632 operation->is_encrypt = is_encrypt;
Gilles Peskine449bd832023-01-11 14:50:10 +01004633 } else {
4634 psa_aead_abort(operation);
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004635 }
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004636
Gilles Peskine449bd832023-01-11 14:50:10 +01004637 return status;
Paul Elliottc2b71442021-06-24 18:17:52 +01004638}
4639
Paul Elliott302ff6b2021-04-20 18:10:30 +01004640/* Set the key for a multipart authenticated encryption operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004641psa_status_t psa_aead_encrypt_setup(psa_aead_operation_t *operation,
4642 mbedtls_svc_key_id_t key,
4643 psa_algorithm_t alg)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004644{
Gilles Peskine449bd832023-01-11 14:50:10 +01004645 return psa_aead_setup(operation, 1, key, alg);
Paul Elliott302ff6b2021-04-20 18:10:30 +01004646}
4647
4648/* Set the key for a multipart authenticated decryption operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004649psa_status_t psa_aead_decrypt_setup(psa_aead_operation_t *operation,
4650 mbedtls_svc_key_id_t key,
4651 psa_algorithm_t alg)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004652{
Gilles Peskine449bd832023-01-11 14:50:10 +01004653 return psa_aead_setup(operation, 0, key, alg);
Paul Elliott302ff6b2021-04-20 18:10:30 +01004654}
4655
4656/* Generate a random nonce / IV for multipart AEAD operation */
Gilles Peskine449bd832023-01-11 14:50:10 +01004657psa_status_t psa_aead_generate_nonce(psa_aead_operation_t *operation,
4658 uint8_t *nonce,
4659 size_t nonce_size,
4660 size_t *nonce_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004661{
4662 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Croncae59092021-11-26 18:53:58 +01004663 uint8_t local_nonce[PSA_AEAD_NONCE_MAX_SIZE];
Paul Elliottb91da712021-05-20 14:43:47 +01004664 size_t required_nonce_size;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004665
Paul Elliott8eb9daf2021-06-04 16:42:21 +01004666 *nonce_length = 0;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004667
Gilles Peskine449bd832023-01-11 14:50:10 +01004668 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004669 status = PSA_ERROR_BAD_STATE;
4670 goto exit;
4671 }
4672
Gilles Peskine449bd832023-01-11 14:50:10 +01004673 if (operation->nonce_set || !operation->is_encrypt) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004674 status = PSA_ERROR_BAD_STATE;
4675 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004676 }
4677
Paul Elliotte193ea82021-10-01 13:00:16 +01004678 /* For CCM, this size may not be correct according to the PSA
4679 * specification. The PSA Crypto 1.0.1 specification states:
4680 *
4681 * CCM encodes the plaintext length pLen in L octets, with L the smallest
4682 * integer >= 2 where pLen < 2^(8L). The nonce length is then 15 - L bytes.
4683 *
4684 * However this restriction that L has to be the smallest integer is not
4685 * applied in practice, and it is not implementable here since the
4686 * plaintext length may or may not be known at this time. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004687 required_nonce_size = PSA_AEAD_NONCE_LENGTH(operation->key_type,
4688 operation->alg);
4689 if (nonce_size < required_nonce_size) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004690 status = PSA_ERROR_BUFFER_TOO_SMALL;
4691 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004692 }
4693
Gilles Peskine449bd832023-01-11 14:50:10 +01004694 status = psa_generate_random(local_nonce, required_nonce_size);
4695 if (status != PSA_SUCCESS) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004696 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004697 }
Paul Elliott302ff6b2021-04-20 18:10:30 +01004698
Gilles Peskine449bd832023-01-11 14:50:10 +01004699 status = psa_aead_set_nonce(operation, local_nonce, required_nonce_size);
Paul Elliott302ff6b2021-04-20 18:10:30 +01004700
Paul Elliott39dc6b82021-05-11 19:16:09 +01004701exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004702 if (status == PSA_SUCCESS) {
4703 memcpy(nonce, local_nonce, required_nonce_size);
Paul Elliott39dc6b82021-05-11 19:16:09 +01004704 *nonce_length = required_nonce_size;
Gilles Peskine449bd832023-01-11 14:50:10 +01004705 } else {
4706 psa_aead_abort(operation);
Ronald Croncae59092021-11-26 18:53:58 +01004707 }
Paul Elliott39dc6b82021-05-11 19:16:09 +01004708
Gilles Peskine449bd832023-01-11 14:50:10 +01004709 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004710}
4711
4712/* Set the nonce for a multipart authenticated encryption or decryption
4713 operation.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01004714psa_status_t psa_aead_set_nonce(psa_aead_operation_t *operation,
4715 const uint8_t *nonce,
4716 size_t nonce_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004717{
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004718 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4719
Gilles Peskine449bd832023-01-11 14:50:10 +01004720 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004721 status = PSA_ERROR_BAD_STATE;
4722 goto exit;
4723 }
4724
Gilles Peskine449bd832023-01-11 14:50:10 +01004725 if (operation->nonce_set) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004726 status = PSA_ERROR_BAD_STATE;
4727 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004728 }
4729
Gilles Peskine449bd832023-01-11 14:50:10 +01004730 status = psa_aead_check_nonce_length(operation->alg, nonce_length);
4731 if (status != PSA_SUCCESS) {
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004732 status = PSA_ERROR_INVALID_ARGUMENT;
4733 goto exit;
Paul Elliott4ed1ed12021-09-27 18:09:28 +01004734 }
Paul Elliott1a98aca2021-05-20 18:24:07 +01004735
Gilles Peskine449bd832023-01-11 14:50:10 +01004736 status = psa_driver_wrapper_aead_set_nonce(operation, nonce,
4737 nonce_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004738
Paul Elliott39dc6b82021-05-11 19:16:09 +01004739exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004740 if (status == PSA_SUCCESS) {
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004741 operation->nonce_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004742 } else {
4743 psa_aead_abort(operation);
4744 }
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004745
Gilles Peskine449bd832023-01-11 14:50:10 +01004746 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004747}
4748
4749/* Declare the lengths of the message and additional data for multipart AEAD. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004750psa_status_t psa_aead_set_lengths(psa_aead_operation_t *operation,
4751 size_t ad_length,
4752 size_t plaintext_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004753{
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004754 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4755
Gilles Peskine449bd832023-01-11 14:50:10 +01004756 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004757 status = PSA_ERROR_BAD_STATE;
4758 goto exit;
4759 }
4760
Gilles Peskine449bd832023-01-11 14:50:10 +01004761 if (operation->lengths_set || operation->ad_started ||
4762 operation->body_started) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004763 status = PSA_ERROR_BAD_STATE;
4764 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004765 }
4766
Gilles Peskine449bd832023-01-11 14:50:10 +01004767 switch (operation->alg) {
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004768#if defined(PSA_WANT_ALG_GCM)
4769 case PSA_ALG_GCM:
4770 /* Lengths can only be too large for GCM if size_t is bigger than 32
Gilles Peskine449bd832023-01-11 14:50:10 +01004771 * bits. Without the guard this code will generate warnings on 32bit
4772 * builds. */
Paul Elliott325d3742021-09-27 17:56:28 +01004773#if SIZE_MAX > UINT32_MAX
Gilles Peskine449bd832023-01-11 14:50:10 +01004774 if (((uint64_t) ad_length) >> 61 != 0 ||
4775 ((uint64_t) plaintext_length) > 0xFFFFFFFE0ull) {
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004776 status = PSA_ERROR_INVALID_ARGUMENT;
4777 goto exit;
4778 }
Paul Elliott325d3742021-09-27 17:56:28 +01004779#endif
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004780 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004781#endif /* PSA_WANT_ALG_GCM */
4782#if defined(PSA_WANT_ALG_CCM)
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004783 case PSA_ALG_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01004784 if (ad_length > 0xFF00) {
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004785 status = PSA_ERROR_INVALID_ARGUMENT;
4786 goto exit;
4787 }
4788 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004789#endif /* PSA_WANT_ALG_CCM */
4790#if defined(PSA_WANT_ALG_CHACHA20_POLY1305)
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004791 case PSA_ALG_CHACHA20_POLY1305:
4792 /* No length restrictions for ChaChaPoly. */
4793 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004794#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004795 default:
4796 break;
4797 }
Paul Elliott325d3742021-09-27 17:56:28 +01004798
Gilles Peskine449bd832023-01-11 14:50:10 +01004799 status = psa_driver_wrapper_aead_set_lengths(operation, ad_length,
4800 plaintext_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004801
Paul Elliott39dc6b82021-05-11 19:16:09 +01004802exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004803 if (status == PSA_SUCCESS) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01004804 operation->ad_remaining = ad_length;
4805 operation->body_remaining = plaintext_length;
Paul Elliott39dc6b82021-05-11 19:16:09 +01004806 operation->lengths_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004807 } else {
4808 psa_aead_abort(operation);
Paul Elliottee4ffe02021-05-20 17:25:06 +01004809 }
Paul Elliott39dc6b82021-05-11 19:16:09 +01004810
Gilles Peskine449bd832023-01-11 14:50:10 +01004811 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004812}
Paul Elliott3d7d52c2021-09-01 10:33:14 +01004813
4814/* Pass additional data to an active multipart AEAD operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004815psa_status_t psa_aead_update_ad(psa_aead_operation_t *operation,
4816 const uint8_t *input,
4817 size_t input_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004818{
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004819 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4820
Gilles Peskine449bd832023-01-11 14:50:10 +01004821 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004822 status = PSA_ERROR_BAD_STATE;
4823 goto exit;
4824 }
4825
Gilles Peskine449bd832023-01-11 14:50:10 +01004826 if (!operation->nonce_set || operation->body_started) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004827 status = PSA_ERROR_BAD_STATE;
4828 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004829 }
4830
Gilles Peskine449bd832023-01-11 14:50:10 +01004831 if (operation->lengths_set) {
4832 if (operation->ad_remaining < input_length) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01004833 status = PSA_ERROR_INVALID_ARGUMENT;
4834 goto exit;
4835 }
4836
4837 operation->ad_remaining -= input_length;
4838 }
Paul Elliotte193ea82021-10-01 13:00:16 +01004839#if defined(PSA_WANT_ALG_CCM)
Gilles Peskine449bd832023-01-11 14:50:10 +01004840 else if (operation->alg == PSA_ALG_CCM) {
Paul Elliotte193ea82021-10-01 13:00:16 +01004841 status = PSA_ERROR_BAD_STATE;
4842 goto exit;
4843 }
4844#endif /* PSA_WANT_ALG_CCM */
Paul Elliottee4ffe02021-05-20 17:25:06 +01004845
Gilles Peskine449bd832023-01-11 14:50:10 +01004846 status = psa_driver_wrapper_aead_update_ad(operation, input,
4847 input_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004848
Paul Elliott39dc6b82021-05-11 19:16:09 +01004849exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004850 if (status == PSA_SUCCESS) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004851 operation->ad_started = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004852 } else {
4853 psa_aead_abort(operation);
4854 }
Paul Elliott39dc6b82021-05-11 19:16:09 +01004855
Gilles Peskine449bd832023-01-11 14:50:10 +01004856 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004857}
4858
4859/* Encrypt or decrypt a message fragment in an active multipart AEAD
4860 operation.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01004861psa_status_t psa_aead_update(psa_aead_operation_t *operation,
4862 const uint8_t *input,
4863 size_t input_length,
4864 uint8_t *output,
4865 size_t output_size,
4866 size_t *output_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004867{
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004868 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004869
4870 *output_length = 0;
4871
Gilles Peskine449bd832023-01-11 14:50:10 +01004872 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004873 status = PSA_ERROR_BAD_STATE;
4874 goto exit;
4875 }
4876
Gilles Peskine449bd832023-01-11 14:50:10 +01004877 if (!operation->nonce_set) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004878 status = PSA_ERROR_BAD_STATE;
4879 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004880 }
4881
Gilles Peskine449bd832023-01-11 14:50:10 +01004882 if (operation->lengths_set) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01004883 /* Additional data length was supplied, but not all the additional
4884 data was supplied.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01004885 if (operation->ad_remaining != 0) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01004886 status = PSA_ERROR_INVALID_ARGUMENT;
4887 goto exit;
4888 }
4889
4890 /* Too much data provided. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004891 if (operation->body_remaining < input_length) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01004892 status = PSA_ERROR_INVALID_ARGUMENT;
4893 goto exit;
4894 }
4895
4896 operation->body_remaining -= input_length;
4897 }
Paul Elliotte193ea82021-10-01 13:00:16 +01004898#if defined(PSA_WANT_ALG_CCM)
Gilles Peskine449bd832023-01-11 14:50:10 +01004899 else if (operation->alg == PSA_ALG_CCM) {
Paul Elliotte193ea82021-10-01 13:00:16 +01004900 status = PSA_ERROR_BAD_STATE;
4901 goto exit;
4902 }
4903#endif /* PSA_WANT_ALG_CCM */
Paul Elliottee4ffe02021-05-20 17:25:06 +01004904
Gilles Peskine449bd832023-01-11 14:50:10 +01004905 status = psa_driver_wrapper_aead_update(operation, input, input_length,
4906 output, output_size,
4907 output_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004908
Paul Elliott39dc6b82021-05-11 19:16:09 +01004909exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004910 if (status == PSA_SUCCESS) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004911 operation->body_started = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004912 } else {
4913 psa_aead_abort(operation);
4914 }
Paul Elliott39dc6b82021-05-11 19:16:09 +01004915
Gilles Peskine449bd832023-01-11 14:50:10 +01004916 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004917}
4918
Gilles Peskine449bd832023-01-11 14:50:10 +01004919static psa_status_t psa_aead_final_checks(const psa_aead_operation_t *operation)
Paul Elliottad53dcc2021-06-23 08:50:14 +01004920{
Gilles Peskine449bd832023-01-11 14:50:10 +01004921 if (operation->id == 0 || !operation->nonce_set) {
4922 return PSA_ERROR_BAD_STATE;
4923 }
Paul Elliottad53dcc2021-06-23 08:50:14 +01004924
Gilles Peskine449bd832023-01-11 14:50:10 +01004925 if (operation->lengths_set && (operation->ad_remaining != 0 ||
4926 operation->body_remaining != 0)) {
4927 return PSA_ERROR_INVALID_ARGUMENT;
4928 }
Paul Elliottad53dcc2021-06-23 08:50:14 +01004929
Gilles Peskine449bd832023-01-11 14:50:10 +01004930 return PSA_SUCCESS;
Paul Elliottad53dcc2021-06-23 08:50:14 +01004931}
4932
Paul Elliott302ff6b2021-04-20 18:10:30 +01004933/* Finish encrypting a message in a multipart AEAD operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004934psa_status_t psa_aead_finish(psa_aead_operation_t *operation,
4935 uint8_t *ciphertext,
4936 size_t ciphertext_size,
4937 size_t *ciphertext_length,
4938 uint8_t *tag,
4939 size_t tag_size,
4940 size_t *tag_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004941{
Paul Elliott39dc6b82021-05-11 19:16:09 +01004942 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4943
Paul Elliott302ff6b2021-04-20 18:10:30 +01004944 *ciphertext_length = 0;
Paul Elliottf88a5652021-06-22 17:53:45 +01004945 *tag_length = tag_size;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004946
Gilles Peskine449bd832023-01-11 14:50:10 +01004947 status = psa_aead_final_checks(operation);
4948 if (status != PSA_SUCCESS) {
Paul Elliottad53dcc2021-06-23 08:50:14 +01004949 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004950 }
Paul Elliottad53dcc2021-06-23 08:50:14 +01004951
Gilles Peskine449bd832023-01-11 14:50:10 +01004952 if (!operation->is_encrypt) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004953 status = PSA_ERROR_BAD_STATE;
4954 goto exit;
4955 }
4956
Gilles Peskine449bd832023-01-11 14:50:10 +01004957 status = psa_driver_wrapper_aead_finish(operation, ciphertext,
4958 ciphertext_size,
4959 ciphertext_length,
4960 tag, tag_size, tag_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004961
Paul Elliott39dc6b82021-05-11 19:16:09 +01004962exit:
Paul Elliottdc42ca82023-02-24 18:11:59 +00004963
4964
Paul Elliottf47b0952021-05-21 18:02:33 +01004965 /* In case the operation fails and the user fails to check for failure or
Paul Elliott4c916e82021-09-19 18:34:50 +01004966 * the zero tag size, make sure the tag is set to something implausible.
4967 * Even if the operation succeeds, make sure we clear the rest of the
4968 * buffer to prevent potential leakage of anything previously placed in
4969 * the same buffer.*/
Paul Elliottdc42ca82023-02-24 18:11:59 +00004970 psa_wipe_tag_output_buffer(tag, status, tag_size, *tag_length);
Paul Elliottf47b0952021-05-21 18:02:33 +01004971
Gilles Peskine449bd832023-01-11 14:50:10 +01004972 psa_aead_abort(operation);
Paul Elliott39dc6b82021-05-11 19:16:09 +01004973
Gilles Peskine449bd832023-01-11 14:50:10 +01004974 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004975}
4976
4977/* Finish authenticating and decrypting a message in a multipart AEAD
4978 operation.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01004979psa_status_t psa_aead_verify(psa_aead_operation_t *operation,
4980 uint8_t *plaintext,
4981 size_t plaintext_size,
4982 size_t *plaintext_length,
4983 const uint8_t *tag,
4984 size_t tag_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004985{
Paul Elliott39dc6b82021-05-11 19:16:09 +01004986 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4987
Paul Elliott302ff6b2021-04-20 18:10:30 +01004988 *plaintext_length = 0;
4989
Gilles Peskine449bd832023-01-11 14:50:10 +01004990 status = psa_aead_final_checks(operation);
4991 if (status != PSA_SUCCESS) {
Paul Elliottad53dcc2021-06-23 08:50:14 +01004992 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004993 }
Paul Elliottad53dcc2021-06-23 08:50:14 +01004994
Gilles Peskine449bd832023-01-11 14:50:10 +01004995 if (operation->is_encrypt) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004996 status = PSA_ERROR_BAD_STATE;
4997 goto exit;
4998 }
4999
Gilles Peskine449bd832023-01-11 14:50:10 +01005000 status = psa_driver_wrapper_aead_verify(operation, plaintext,
5001 plaintext_size,
5002 plaintext_length,
5003 tag, tag_length);
Paul Elliott39dc6b82021-05-11 19:16:09 +01005004
5005exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01005006 psa_aead_abort(operation);
Paul Elliott39dc6b82021-05-11 19:16:09 +01005007
Gilles Peskine449bd832023-01-11 14:50:10 +01005008 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005009}
5010
5011/* Abort an AEAD operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005012psa_status_t psa_aead_abort(psa_aead_operation_t *operation)
Paul Elliott302ff6b2021-04-20 18:10:30 +01005013{
5014 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
5015
Gilles Peskine449bd832023-01-11 14:50:10 +01005016 if (operation->id == 0) {
Paul Elliott302ff6b2021-04-20 18:10:30 +01005017 /* The object has (apparently) been initialized but it is not (yet)
5018 * in use. It's ok to call abort on such an object, and there's
5019 * nothing to do. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005020 return PSA_SUCCESS;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005021 }
5022
Gilles Peskine449bd832023-01-11 14:50:10 +01005023 status = psa_driver_wrapper_aead_abort(operation);
Paul Elliott302ff6b2021-04-20 18:10:30 +01005024
Gilles Peskine449bd832023-01-11 14:50:10 +01005025 memset(operation, 0, sizeof(*operation));
Paul Elliott302ff6b2021-04-20 18:10:30 +01005026
Gilles Peskine449bd832023-01-11 14:50:10 +01005027 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005028}
5029
Gilles Peskinee59236f2018-01-27 23:32:46 +01005030/****************************************************************/
Gilles Peskineeab56e42018-07-12 17:12:33 +02005031/* Generators */
5032/****************************************************************/
5033
Przemek Stekiel69c46792022-06-10 12:59:51 +02005034#if defined(BUILTIN_ALG_ANY_HKDF) || \
John Durkop07cc04a2020-11-16 22:08:34 -08005035 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005036 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) || \
5037 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
John Durkop07cc04a2020-11-16 22:08:34 -08005038#define AT_LEAST_ONE_BUILTIN_KDF
Steven Cooreman094a77e2021-05-06 17:58:36 +02005039#endif /* At least one builtin KDF */
5040
Przemek Stekiel69c46792022-06-10 12:59:51 +02005041#if defined(BUILTIN_ALG_ANY_HKDF) || \
Steven Cooreman094a77e2021-05-06 17:58:36 +02005042 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
5043 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
5044static psa_status_t psa_key_derivation_start_hmac(
5045 psa_mac_operation_t *operation,
5046 psa_algorithm_t hash_alg,
5047 const uint8_t *hmac_key,
Gilles Peskine449bd832023-01-11 14:50:10 +01005048 size_t hmac_key_length)
Steven Cooreman094a77e2021-05-06 17:58:36 +02005049{
5050 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
5051 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine449bd832023-01-11 14:50:10 +01005052 psa_set_key_type(&attributes, PSA_KEY_TYPE_HMAC);
5053 psa_set_key_bits(&attributes, PSA_BYTES_TO_BITS(hmac_key_length));
5054 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_HASH);
Steven Cooreman094a77e2021-05-06 17:58:36 +02005055
Steven Cooreman72f736a2021-05-07 14:14:37 +02005056 operation->is_sign = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01005057 operation->mac_size = PSA_HASH_LENGTH(hash_alg);
Steven Cooreman72f736a2021-05-07 14:14:37 +02005058
Gilles Peskine449bd832023-01-11 14:50:10 +01005059 status = psa_driver_wrapper_mac_sign_setup(operation,
5060 &attributes,
5061 hmac_key, hmac_key_length,
5062 PSA_ALG_HMAC(hash_alg));
Steven Cooreman094a77e2021-05-06 17:58:36 +02005063
Gilles Peskine449bd832023-01-11 14:50:10 +01005064 psa_reset_key_attributes(&attributes);
5065 return status;
Steven Cooreman094a77e2021-05-06 17:58:36 +02005066}
5067#endif /* KDF algorithms reliant on HMAC */
John Durkop07cc04a2020-11-16 22:08:34 -08005068
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005069#define HKDF_STATE_INIT 0 /* no input yet */
5070#define HKDF_STATE_STARTED 1 /* got salt */
5071#define HKDF_STATE_KEYED 2 /* got key */
5072#define HKDF_STATE_OUTPUT 3 /* output started */
5073
Gilles Peskinecbe66502019-05-16 16:59:18 +02005074static psa_algorithm_t psa_key_derivation_get_kdf_alg(
Gilles Peskine449bd832023-01-11 14:50:10 +01005075 const psa_key_derivation_operation_t *operation)
Gilles Peskine969c5d62019-01-16 15:53:06 +01005076{
Gilles Peskine449bd832023-01-11 14:50:10 +01005077 if (PSA_ALG_IS_KEY_AGREEMENT(operation->alg)) {
5078 return PSA_ALG_KEY_AGREEMENT_GET_KDF(operation->alg);
5079 } else {
5080 return operation->alg;
5081 }
Gilles Peskine969c5d62019-01-16 15:53:06 +01005082}
5083
Gilles Peskine449bd832023-01-11 14:50:10 +01005084psa_status_t psa_key_derivation_abort(psa_key_derivation_operation_t *operation)
Gilles Peskineeab56e42018-07-12 17:12:33 +02005085{
5086 psa_status_t status = PSA_SUCCESS;
Gilles Peskine449bd832023-01-11 14:50:10 +01005087 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation);
5088 if (kdf_alg == 0) {
Gilles Peskineeab56e42018-07-12 17:12:33 +02005089 /* The object has (apparently) been initialized but it is not
5090 * in use. It's ok to call abort on such an object, and there's
5091 * nothing to do. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005092 } else
Przemek Stekiel69c46792022-06-10 12:59:51 +02005093#if defined(BUILTIN_ALG_ANY_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01005094 if (PSA_ALG_IS_ANY_HKDF(kdf_alg)) {
5095 mbedtls_free(operation->ctx.hkdf.info);
5096 status = psa_mac_abort(&operation->ctx.hkdf.hmac);
5097 } else
Przemek Stekiel69c46792022-06-10 12:59:51 +02005098#endif /* BUILTIN_ALG_ANY_HKDF */
John Durkop07cc04a2020-11-16 22:08:34 -08005099#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
5100 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005101 if (PSA_ALG_IS_TLS12_PRF(kdf_alg) ||
5102 /* TLS-1.2 PSK-to-MS KDF uses the same core as TLS-1.2 PRF */
5103 PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
5104 if (operation->ctx.tls12_prf.secret != NULL) {
5105 mbedtls_platform_zeroize(operation->ctx.tls12_prf.secret,
5106 operation->ctx.tls12_prf.secret_length);
5107 mbedtls_free(operation->ctx.tls12_prf.secret);
Steven Cooremana6df6042021-04-29 19:32:25 +02005108 }
5109
Gilles Peskine449bd832023-01-11 14:50:10 +01005110 if (operation->ctx.tls12_prf.seed != NULL) {
5111 mbedtls_platform_zeroize(operation->ctx.tls12_prf.seed,
5112 operation->ctx.tls12_prf.seed_length);
5113 mbedtls_free(operation->ctx.tls12_prf.seed);
Janos Follath6a1d2622019-06-11 10:37:28 +01005114 }
5115
Gilles Peskine449bd832023-01-11 14:50:10 +01005116 if (operation->ctx.tls12_prf.label != NULL) {
5117 mbedtls_platform_zeroize(operation->ctx.tls12_prf.label,
5118 operation->ctx.tls12_prf.label_length);
5119 mbedtls_free(operation->ctx.tls12_prf.label);
Janos Follath6a1d2622019-06-11 10:37:28 +01005120 }
Przemek Stekiel6c764412022-11-22 14:05:12 +01005121#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005122 if (operation->ctx.tls12_prf.other_secret != NULL) {
5123 mbedtls_platform_zeroize(operation->ctx.tls12_prf.other_secret,
5124 operation->ctx.tls12_prf.other_secret_length);
5125 mbedtls_free(operation->ctx.tls12_prf.other_secret);
Przemek Stekiele3ee2212022-04-07 14:29:56 +02005126 }
Przemek Stekiel6c764412022-11-22 14:05:12 +01005127#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Steven Cooremana6df6042021-04-29 19:32:25 +02005128 status = PSA_SUCCESS;
Janos Follath6a1d2622019-06-11 10:37:28 +01005129
5130 /* We leave the fields Ai and output_block to be erased safely by the
5131 * mbedtls_platform_zeroize() in the end of this function. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005132 } else
John Durkop07cc04a2020-11-16 22:08:34 -08005133#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) ||
5134 * defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) */
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005135#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005136 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
5137 mbedtls_platform_zeroize(operation->ctx.tls12_ecjpake_to_pms.data,
5138 sizeof(operation->ctx.tls12_ecjpake_to_pms.data));
5139 } else
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005140#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) */
Gilles Peskineeab56e42018-07-12 17:12:33 +02005141 {
5142 status = PSA_ERROR_BAD_STATE;
5143 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005144 mbedtls_platform_zeroize(operation, sizeof(*operation));
5145 return status;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005146}
5147
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005148psa_status_t psa_key_derivation_get_capacity(const psa_key_derivation_operation_t *operation,
Gilles Peskine449bd832023-01-11 14:50:10 +01005149 size_t *capacity)
Gilles Peskineeab56e42018-07-12 17:12:33 +02005150{
Gilles Peskine449bd832023-01-11 14:50:10 +01005151 if (operation->alg == 0) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005152 /* This is a blank key derivation operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005153 return PSA_ERROR_BAD_STATE;
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005154 }
5155
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005156 *capacity = operation->capacity;
Gilles Peskine449bd832023-01-11 14:50:10 +01005157 return PSA_SUCCESS;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005158}
5159
Gilles Peskine449bd832023-01-11 14:50:10 +01005160psa_status_t psa_key_derivation_set_capacity(psa_key_derivation_operation_t *operation,
5161 size_t capacity)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005162{
Gilles Peskine449bd832023-01-11 14:50:10 +01005163 if (operation->alg == 0) {
5164 return PSA_ERROR_BAD_STATE;
5165 }
5166 if (capacity > operation->capacity) {
5167 return PSA_ERROR_INVALID_ARGUMENT;
5168 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005169 operation->capacity = capacity;
Gilles Peskine449bd832023-01-11 14:50:10 +01005170 return PSA_SUCCESS;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005171}
5172
Przemek Stekiel69c46792022-06-10 12:59:51 +02005173#if defined(BUILTIN_ALG_ANY_HKDF)
Przemek Stekiel03d948c2022-05-19 11:45:20 +02005174/* Read some bytes from an HKDF-based operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005175static psa_status_t psa_key_derivation_hkdf_read(psa_hkdf_key_derivation_t *hkdf,
5176 psa_algorithm_t kdf_alg,
5177 uint8_t *output,
5178 size_t output_length)
Gilles Peskinebef7f142018-07-12 17:22:21 +02005179{
Gilles Peskine449bd832023-01-11 14:50:10 +01005180 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(kdf_alg);
5181 uint8_t hash_length = PSA_HASH_LENGTH(hash_alg);
Steven Cooremand1ed1d92021-04-29 19:11:25 +02005182 size_t hmac_output_length;
Gilles Peskinebef7f142018-07-12 17:22:21 +02005183 psa_status_t status;
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02005184#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01005185 const uint8_t last_block = PSA_ALG_IS_HKDF_EXTRACT(kdf_alg) ? 0 : 0xff;
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02005186#else
5187 const uint8_t last_block = 0xff;
5188#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Gilles Peskinebef7f142018-07-12 17:22:21 +02005189
Gilles Peskine449bd832023-01-11 14:50:10 +01005190 if (hkdf->state < HKDF_STATE_KEYED ||
5191 (!hkdf->info_set
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02005192#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01005193 && !PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02005194#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Gilles Peskine449bd832023-01-11 14:50:10 +01005195 )) {
5196 return PSA_ERROR_BAD_STATE;
5197 }
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005198 hkdf->state = HKDF_STATE_OUTPUT;
5199
Gilles Peskine449bd832023-01-11 14:50:10 +01005200 while (output_length != 0) {
Gilles Peskinebef7f142018-07-12 17:22:21 +02005201 /* Copy what remains of the current block */
5202 uint8_t n = hash_length - hkdf->offset_in_block;
Gilles Peskine449bd832023-01-11 14:50:10 +01005203 if (n > output_length) {
Gilles Peskinebef7f142018-07-12 17:22:21 +02005204 n = (uint8_t) output_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01005205 }
5206 memcpy(output, hkdf->output_block + hkdf->offset_in_block, n);
Gilles Peskinebef7f142018-07-12 17:22:21 +02005207 output += n;
5208 output_length -= n;
5209 hkdf->offset_in_block += n;
Gilles Peskine449bd832023-01-11 14:50:10 +01005210 if (output_length == 0) {
Gilles Peskinebef7f142018-07-12 17:22:21 +02005211 break;
Gilles Peskine449bd832023-01-11 14:50:10 +01005212 }
Przemek Stekiel03d948c2022-05-19 11:45:20 +02005213 /* We can't be wanting more output after the last block, otherwise
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02005214 * the capacity check in psa_key_derivation_output_bytes() would have
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005215 * prevented this call. It could happen only if the operation
Gilles Peskined54931c2018-07-17 21:06:59 +02005216 * object was corrupted or if this function is called directly
5217 * inside the library. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005218 if (hkdf->block_number == last_block) {
5219 return PSA_ERROR_BAD_STATE;
5220 }
Gilles Peskinebef7f142018-07-12 17:22:21 +02005221
5222 /* We need a new block */
5223 ++hkdf->block_number;
5224 hkdf->offset_in_block = 0;
Steven Cooremand1ed1d92021-04-29 19:11:25 +02005225
Gilles Peskine449bd832023-01-11 14:50:10 +01005226 status = psa_key_derivation_start_hmac(&hkdf->hmac,
5227 hash_alg,
5228 hkdf->prk,
5229 hash_length);
5230 if (status != PSA_SUCCESS) {
5231 return status;
Gilles Peskinebef7f142018-07-12 17:22:21 +02005232 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005233
5234 if (hkdf->block_number != 1) {
5235 status = psa_mac_update(&hkdf->hmac,
5236 hkdf->output_block,
5237 hash_length);
5238 if (status != PSA_SUCCESS) {
5239 return status;
5240 }
5241 }
5242 status = psa_mac_update(&hkdf->hmac,
5243 hkdf->info,
5244 hkdf->info_length);
5245 if (status != PSA_SUCCESS) {
5246 return status;
5247 }
5248 status = psa_mac_update(&hkdf->hmac,
5249 &hkdf->block_number, 1);
5250 if (status != PSA_SUCCESS) {
5251 return status;
5252 }
5253 status = psa_mac_sign_finish(&hkdf->hmac,
5254 hkdf->output_block,
5255 sizeof(hkdf->output_block),
5256 &hmac_output_length);
5257 if (status != PSA_SUCCESS) {
5258 return status;
5259 }
Gilles Peskinebef7f142018-07-12 17:22:21 +02005260 }
5261
Gilles Peskine449bd832023-01-11 14:50:10 +01005262 return PSA_SUCCESS;
Gilles Peskinebef7f142018-07-12 17:22:21 +02005263}
Przemek Stekiel69c46792022-06-10 12:59:51 +02005264#endif /* BUILTIN_ALG_ANY_HKDF */
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005265
John Durkop07cc04a2020-11-16 22:08:34 -08005266#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
5267 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Janos Follath7742fee2019-06-17 12:58:10 +01005268static psa_status_t psa_key_derivation_tls12_prf_generate_next_block(
5269 psa_tls12_prf_key_derivation_t *tls12_prf,
Gilles Peskine449bd832023-01-11 14:50:10 +01005270 psa_algorithm_t alg)
Janos Follath7742fee2019-06-17 12:58:10 +01005271{
Gilles Peskine449bd832023-01-11 14:50:10 +01005272 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(alg);
5273 uint8_t hash_length = PSA_HASH_LENGTH(hash_alg);
Steven Cooremana6df6042021-04-29 19:32:25 +02005274 psa_mac_operation_t hmac = PSA_MAC_OPERATION_INIT;
5275 size_t hmac_output_length;
Janos Follathea29bfb2019-06-19 12:21:20 +01005276 psa_status_t status, cleanup_status;
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005277
Janos Follath7742fee2019-06-17 12:58:10 +01005278 /* We can't be wanting more output after block 0xff, otherwise
5279 * the capacity check in psa_key_derivation_output_bytes() would have
5280 * prevented this call. It could happen only if the operation
5281 * object was corrupted or if this function is called directly
5282 * inside the library. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005283 if (tls12_prf->block_number == 0xff) {
5284 return PSA_ERROR_CORRUPTION_DETECTED;
5285 }
Janos Follath7742fee2019-06-17 12:58:10 +01005286
5287 /* We need a new block */
5288 ++tls12_prf->block_number;
Janos Follath844eb0e2019-06-19 12:10:49 +01005289 tls12_prf->left_in_block = hash_length;
Janos Follath7742fee2019-06-17 12:58:10 +01005290
5291 /* Recall the definition of the TLS-1.2-PRF from RFC 5246:
5292 *
5293 * PRF(secret, label, seed) = P_<hash>(secret, label + seed)
5294 *
5295 * P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
5296 * HMAC_hash(secret, A(2) + seed) +
5297 * HMAC_hash(secret, A(3) + seed) + ...
5298 *
5299 * A(0) = seed
Janos Follathea29bfb2019-06-19 12:21:20 +01005300 * A(i) = HMAC_hash(secret, A(i-1))
Janos Follath7742fee2019-06-17 12:58:10 +01005301 *
Janos Follathea29bfb2019-06-19 12:21:20 +01005302 * The `psa_tls12_prf_key_derivation` structure saves the block
Janos Follath7742fee2019-06-17 12:58:10 +01005303 * `HMAC_hash(secret, A(i) + seed)` from which the output
Janos Follath76c39842019-06-26 12:50:36 +01005304 * is currently extracted as `output_block` and where i is
5305 * `block_number`.
Janos Follath7742fee2019-06-17 12:58:10 +01005306 */
5307
Gilles Peskine449bd832023-01-11 14:50:10 +01005308 status = psa_key_derivation_start_hmac(&hmac,
5309 hash_alg,
5310 tls12_prf->secret,
5311 tls12_prf->secret_length);
5312 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005313 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005314 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005315
5316 /* Calculate A(i) where i = tls12_prf->block_number. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005317 if (tls12_prf->block_number == 1) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005318 /* A(1) = HMAC_hash(secret, A(0)), where A(0) = seed. (The RFC overloads
5319 * the variable seed and in this instance means it in the context of the
5320 * P_hash function, where seed = label + seed.) */
Gilles Peskine449bd832023-01-11 14:50:10 +01005321 status = psa_mac_update(&hmac,
5322 tls12_prf->label,
5323 tls12_prf->label_length);
5324 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005325 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005326 }
5327 status = psa_mac_update(&hmac,
5328 tls12_prf->seed,
5329 tls12_prf->seed_length);
5330 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005331 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005332 }
5333 } else {
Janos Follathea29bfb2019-06-19 12:21:20 +01005334 /* A(i) = HMAC_hash(secret, A(i-1)) */
Gilles Peskine449bd832023-01-11 14:50:10 +01005335 status = psa_mac_update(&hmac, tls12_prf->Ai, hash_length);
5336 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005337 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005338 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005339 }
5340
Gilles Peskine449bd832023-01-11 14:50:10 +01005341 status = psa_mac_sign_finish(&hmac,
5342 tls12_prf->Ai, hash_length,
5343 &hmac_output_length);
5344 if (hmac_output_length != hash_length) {
Steven Cooremana6df6042021-04-29 19:32:25 +02005345 status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine449bd832023-01-11 14:50:10 +01005346 }
5347 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005348 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005349 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005350
5351 /* Calculate HMAC_hash(secret, A(i) + label + seed). */
Gilles Peskine449bd832023-01-11 14:50:10 +01005352 status = psa_key_derivation_start_hmac(&hmac,
5353 hash_alg,
5354 tls12_prf->secret,
5355 tls12_prf->secret_length);
5356 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005357 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005358 }
5359 status = psa_mac_update(&hmac, tls12_prf->Ai, hash_length);
5360 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005361 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005362 }
5363 status = psa_mac_update(&hmac, tls12_prf->label, tls12_prf->label_length);
5364 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005365 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005366 }
5367 status = psa_mac_update(&hmac, tls12_prf->seed, tls12_prf->seed_length);
5368 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005369 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005370 }
5371 status = psa_mac_sign_finish(&hmac,
5372 tls12_prf->output_block, hash_length,
5373 &hmac_output_length);
5374 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005375 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005376 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005377
Janos Follath7742fee2019-06-17 12:58:10 +01005378
5379cleanup:
Gilles Peskine449bd832023-01-11 14:50:10 +01005380 cleanup_status = psa_mac_abort(&hmac);
5381 if (status == PSA_SUCCESS && cleanup_status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005382 status = cleanup_status;
Gilles Peskine449bd832023-01-11 14:50:10 +01005383 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005384
Gilles Peskine449bd832023-01-11 14:50:10 +01005385 return status;
Janos Follath7742fee2019-06-17 12:58:10 +01005386}
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005387
Janos Follath844eb0e2019-06-19 12:10:49 +01005388static psa_status_t psa_key_derivation_tls12_prf_read(
5389 psa_tls12_prf_key_derivation_t *tls12_prf,
5390 psa_algorithm_t alg,
5391 uint8_t *output,
Gilles Peskine449bd832023-01-11 14:50:10 +01005392 size_t output_length)
Janos Follath844eb0e2019-06-19 12:10:49 +01005393{
Gilles Peskine449bd832023-01-11 14:50:10 +01005394 psa_algorithm_t hash_alg = PSA_ALG_TLS12_PRF_GET_HASH(alg);
5395 uint8_t hash_length = PSA_HASH_LENGTH(hash_alg);
Janos Follath844eb0e2019-06-19 12:10:49 +01005396 psa_status_t status;
5397 uint8_t offset, length;
5398
Gilles Peskine449bd832023-01-11 14:50:10 +01005399 switch (tls12_prf->state) {
Gilles Peskineb1edaec2021-06-11 22:41:46 +02005400 case PSA_TLS12_PRF_STATE_LABEL_SET:
5401 tls12_prf->state = PSA_TLS12_PRF_STATE_OUTPUT;
5402 break;
5403 case PSA_TLS12_PRF_STATE_OUTPUT:
5404 break;
5405 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01005406 return PSA_ERROR_BAD_STATE;
Gilles Peskineb1edaec2021-06-11 22:41:46 +02005407 }
5408
Gilles Peskine449bd832023-01-11 14:50:10 +01005409 while (output_length != 0) {
Janos Follath844eb0e2019-06-19 12:10:49 +01005410 /* Check if we have fully processed the current block. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005411 if (tls12_prf->left_in_block == 0) {
5412 status = psa_key_derivation_tls12_prf_generate_next_block(tls12_prf,
5413 alg);
5414 if (status != PSA_SUCCESS) {
5415 return status;
5416 }
Janos Follath844eb0e2019-06-19 12:10:49 +01005417
5418 continue;
5419 }
5420
Gilles Peskine449bd832023-01-11 14:50:10 +01005421 if (tls12_prf->left_in_block > output_length) {
Janos Follath844eb0e2019-06-19 12:10:49 +01005422 length = (uint8_t) output_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01005423 } else {
Janos Follath844eb0e2019-06-19 12:10:49 +01005424 length = tls12_prf->left_in_block;
Gilles Peskine449bd832023-01-11 14:50:10 +01005425 }
Janos Follath844eb0e2019-06-19 12:10:49 +01005426
5427 offset = hash_length - tls12_prf->left_in_block;
Gilles Peskine449bd832023-01-11 14:50:10 +01005428 memcpy(output, tls12_prf->output_block + offset, length);
Janos Follath844eb0e2019-06-19 12:10:49 +01005429 output += length;
5430 output_length -= length;
5431 tls12_prf->left_in_block -= length;
5432 }
5433
Gilles Peskine449bd832023-01-11 14:50:10 +01005434 return PSA_SUCCESS;
Janos Follath844eb0e2019-06-19 12:10:49 +01005435}
John Durkop07cc04a2020-11-16 22:08:34 -08005436#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF ||
5437 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Gilles Peskinebef7f142018-07-12 17:22:21 +02005438
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005439#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
5440static psa_status_t psa_key_derivation_tls12_ecjpake_to_pms_read(
5441 psa_tls12_ecjpake_to_pms_t *ecjpake,
5442 uint8_t *output,
Gilles Peskine449bd832023-01-11 14:50:10 +01005443 size_t output_length)
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005444{
5445 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Andrzej Kurek5603efd2022-09-26 10:49:16 -04005446 size_t output_size = 0;
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005447
Gilles Peskine449bd832023-01-11 14:50:10 +01005448 if (output_length != 32) {
5449 return PSA_ERROR_INVALID_ARGUMENT;
5450 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005451
Gilles Peskine449bd832023-01-11 14:50:10 +01005452 status = psa_hash_compute(PSA_ALG_SHA_256, ecjpake->data,
5453 PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE, output, output_length,
5454 &output_size);
5455 if (status != PSA_SUCCESS) {
5456 return status;
5457 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005458
Gilles Peskine449bd832023-01-11 14:50:10 +01005459 if (output_size != output_length) {
5460 return PSA_ERROR_GENERIC_ERROR;
5461 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005462
Gilles Peskine449bd832023-01-11 14:50:10 +01005463 return PSA_SUCCESS;
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005464}
5465#endif
5466
Janos Follath6c6c8fc2019-06-17 12:38:20 +01005467psa_status_t psa_key_derivation_output_bytes(
5468 psa_key_derivation_operation_t *operation,
5469 uint8_t *output,
Gilles Peskine449bd832023-01-11 14:50:10 +01005470 size_t output_length)
Gilles Peskineeab56e42018-07-12 17:12:33 +02005471{
5472 psa_status_t status;
Gilles Peskine449bd832023-01-11 14:50:10 +01005473 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation);
Gilles Peskineeab56e42018-07-12 17:12:33 +02005474
Gilles Peskine449bd832023-01-11 14:50:10 +01005475 if (operation->alg == 0) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005476 /* This is a blank operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005477 return PSA_ERROR_BAD_STATE;
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005478 }
5479
Gilles Peskine449bd832023-01-11 14:50:10 +01005480 if (output_length > operation->capacity) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005481 operation->capacity = 0;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005482 /* Go through the error path to wipe all confidential data now
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005483 * that the operation object is useless. */
David Saadab4ecc272019-02-14 13:48:10 +02005484 status = PSA_ERROR_INSUFFICIENT_DATA;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005485 goto exit;
5486 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005487 if (output_length == 0 && operation->capacity == 0) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005488 /* Edge case: this is a finished operation, and 0 bytes
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005489 * were requested. The right error in this case could
Gilles Peskineeab56e42018-07-12 17:12:33 +02005490 * be either INSUFFICIENT_CAPACITY or BAD_STATE. Return
5491 * INSUFFICIENT_CAPACITY, which is right for a finished
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005492 * operation, for consistency with the case when
Gilles Peskineeab56e42018-07-12 17:12:33 +02005493 * output_length > 0. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005494 return PSA_ERROR_INSUFFICIENT_DATA;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005495 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005496 operation->capacity -= output_length;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005497
Przemek Stekiel69c46792022-06-10 12:59:51 +02005498#if defined(BUILTIN_ALG_ANY_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01005499 if (PSA_ALG_IS_ANY_HKDF(kdf_alg)) {
5500 status = psa_key_derivation_hkdf_read(&operation->ctx.hkdf, kdf_alg,
5501 output, output_length);
5502 } else
Przemek Stekiel69c46792022-06-10 12:59:51 +02005503#endif /* BUILTIN_ALG_ANY_HKDF */
John Durkop07cc04a2020-11-16 22:08:34 -08005504#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
5505 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005506 if (PSA_ALG_IS_TLS12_PRF(kdf_alg) ||
5507 PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
5508 status = psa_key_derivation_tls12_prf_read(&operation->ctx.tls12_prf,
5509 kdf_alg, output,
5510 output_length);
5511 } else
John Durkop07cc04a2020-11-16 22:08:34 -08005512#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF ||
5513 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005514#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005515 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005516 status = psa_key_derivation_tls12_ecjpake_to_pms_read(
Gilles Peskine449bd832023-01-11 14:50:10 +01005517 &operation->ctx.tls12_ecjpake_to_pms, output, output_length);
5518 } else
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005519#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */
5520
Gilles Peskineeab56e42018-07-12 17:12:33 +02005521 {
Steven Cooreman74afe472021-02-10 17:19:22 +01005522 (void) kdf_alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01005523 return PSA_ERROR_BAD_STATE;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005524 }
5525
5526exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01005527 if (status != PSA_SUCCESS) {
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005528 /* Preserve the algorithm upon errors, but clear all sensitive state.
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005529 * This allows us to differentiate between exhausted operations and
5530 * blank operations, so we can return PSA_ERROR_BAD_STATE on blank
5531 * operations. */
5532 psa_algorithm_t alg = operation->alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01005533 psa_key_derivation_abort(operation);
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005534 operation->alg = alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01005535 memset(output, '!', output_length);
Gilles Peskineeab56e42018-07-12 17:12:33 +02005536 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005537 return status;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005538}
5539
David Brown7807bf72021-02-09 16:28:23 -07005540#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Gilles Peskine449bd832023-01-11 14:50:10 +01005541static void psa_des_set_key_parity(uint8_t *data, size_t data_size)
Gilles Peskine08542d82018-07-19 17:05:42 +02005542{
Gilles Peskine449bd832023-01-11 14:50:10 +01005543 if (data_size >= 8) {
5544 mbedtls_des_key_set_parity(data);
5545 }
5546 if (data_size >= 16) {
5547 mbedtls_des_key_set_parity(data + 8);
5548 }
5549 if (data_size >= 24) {
5550 mbedtls_des_key_set_parity(data + 16);
5551 }
Gilles Peskine08542d82018-07-19 17:05:42 +02005552}
David Brown7807bf72021-02-09 16:28:23 -07005553#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */
Gilles Peskine08542d82018-07-19 17:05:42 +02005554
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005555/*
Gilles Peskine449bd832023-01-11 14:50:10 +01005556 * ECC keys on a Weierstrass elliptic curve require the generation
5557 * of a private key which is an integer
5558 * in the range [1, N - 1], where N is the boundary of the private key domain:
5559 * N is the prime p for Diffie-Hellman, or the order of the
5560 * curve’s base point for ECC.
5561 *
5562 * Let m be the bit size of N, such that 2^m > N >= 2^(m-1).
5563 * This function generates the private key using the following process:
5564 *
5565 * 1. Draw a byte string of length ceiling(m/8) bytes.
5566 * 2. If m is not a multiple of 8, set the most significant
5567 * (8 * ceiling(m/8) - m) bits of the first byte in the string to zero.
5568 * 3. Convert the string to integer k by decoding it as a big-endian byte string.
5569 * 4. If k > N - 2, discard the result and return to step 1.
5570 * 5. Output k + 1 as the private key.
5571 *
5572 * This method allows compliance to NIST standards, specifically the methods titled
5573 * Key-Pair Generation by Testing Candidates in the following publications:
5574 * - NIST Special Publication 800-56A: Recommendation for Pair-Wise Key-Establishment
5575 * Schemes Using Discrete Logarithm Cryptography [SP800-56A] §5.6.1.1.4 for
5576 * Diffie-Hellman keys.
5577 *
5578 * - [SP800-56A] §5.6.1.2.2 or FIPS Publication 186-4: Digital Signature
5579 * Standard (DSS) [FIPS186-4] §B.4.2 for elliptic curve keys.
5580 *
5581 * Note: Function allocates memory for *data buffer, so given *data should be
5582 * always NULL.
5583 */
Joakim Anderssonbb576fe2023-03-01 11:23:02 +01005584#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) || \
5585 defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) || \
Przemek Stekiel7fc07512022-03-04 14:41:11 +01005586 defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
5587 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) || \
5588 defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01005589static psa_status_t psa_generate_derived_ecc_key_weierstrass_helper(
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005590 psa_key_slot_t *slot,
5591 size_t bits,
5592 psa_key_derivation_operation_t *operation,
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005593 uint8_t **data
5594 )
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005595{
Valerio Setti52789862023-04-07 12:13:11 +02005596#if defined(MBEDTLS_ECP_LIGHT)
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005597 unsigned key_out_of_range = 1;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005598 mbedtls_mpi k;
5599 mbedtls_mpi diff_N_2;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005600 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Przemek Stekiela81aed22022-03-01 15:13:30 +01005601 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005602
Gilles Peskine449bd832023-01-11 14:50:10 +01005603 mbedtls_mpi_init(&k);
5604 mbedtls_mpi_init(&diff_N_2);
Przemyslaw Stekiel1dfd1222021-11-18 13:35:00 +01005605
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005606 psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY(
Gilles Peskine449bd832023-01-11 14:50:10 +01005607 slot->attr.type);
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005608 mbedtls_ecp_group_id grp_id =
Gilles Peskine449bd832023-01-11 14:50:10 +01005609 mbedtls_ecc_group_of_psa(curve, bits, 0);
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005610
Gilles Peskine449bd832023-01-11 14:50:10 +01005611 if (grp_id == MBEDTLS_ECP_DP_NONE) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005612 ret = MBEDTLS_ERR_ASN1_INVALID_DATA;
Przemyslaw Stekiel871a3362021-12-02 08:46:39 +01005613 goto cleanup;
5614 }
5615
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005616 mbedtls_ecp_group ecp_group;
Gilles Peskine449bd832023-01-11 14:50:10 +01005617 mbedtls_ecp_group_init(&ecp_group);
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005618
Gilles Peskine449bd832023-01-11 14:50:10 +01005619 MBEDTLS_MPI_CHK(mbedtls_ecp_group_load(&ecp_group, grp_id));
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005620
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005621 /* N is the boundary of the private key domain (ecp_group.N). */
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005622 /* Let m be the bit size of N. */
5623 size_t m = ecp_group.nbits;
5624
Gilles Peskine449bd832023-01-11 14:50:10 +01005625 size_t m_bytes = PSA_BITS_TO_BYTES(m);
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005626
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005627 /* Calculate N - 2 - it will be needed later. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005628 MBEDTLS_MPI_CHK(mbedtls_mpi_sub_int(&diff_N_2, &ecp_group.N, 2));
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005629
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005630 /* Note: This function is always called with *data == NULL and it
5631 * allocates memory for the data buffer. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005632 *data = mbedtls_calloc(1, m_bytes);
5633 if (*data == NULL) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005634 ret = MBEDTLS_ERR_ASN1_ALLOC_FAILED;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005635 goto cleanup;
5636 }
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005637
Gilles Peskine449bd832023-01-11 14:50:10 +01005638 while (key_out_of_range) {
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005639 /* 1. Draw a byte string of length ceiling(m/8) bytes. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005640 if ((status = psa_key_derivation_output_bytes(operation, *data, m_bytes)) != 0) {
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005641 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005642 }
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005643
5644 /* 2. If m is not a multiple of 8 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005645 if (m % 8 != 0) {
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005646 /* Set the most significant
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005647 * (8 * ceiling(m/8) - m) bits of the first byte in
5648 * the string to zero.
5649 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005650 uint8_t clear_bit_mask = (1 << (m % 8)) - 1;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005651 (*data)[0] &= clear_bit_mask;
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005652 }
5653
5654 /* 3. Convert the string to integer k by decoding it as a
Gilles Peskine449bd832023-01-11 14:50:10 +01005655 * big-endian byte string.
5656 */
5657 MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(&k, *data, m_bytes));
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005658
5659 /* 4. If k > N - 2, discard the result and return to step 1.
Gilles Peskine449bd832023-01-11 14:50:10 +01005660 * Result of comparison is returned. When it indicates error
5661 * then this function is called again.
5662 */
5663 MBEDTLS_MPI_CHK(mbedtls_mpi_lt_mpi_ct(&diff_N_2, &k, &key_out_of_range));
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005664 }
5665
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005666 /* 5. Output k + 1 as the private key. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005667 MBEDTLS_MPI_CHK(mbedtls_mpi_add_int(&k, &k, 1));
5668 MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(&k, *data, m_bytes));
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005669cleanup:
Gilles Peskine449bd832023-01-11 14:50:10 +01005670 if (ret != 0) {
5671 status = mbedtls_to_psa_error(ret);
5672 }
5673 if (status != PSA_SUCCESS) {
5674 mbedtls_free(*data);
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005675 *data = NULL;
5676 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005677 mbedtls_mpi_free(&k);
5678 mbedtls_mpi_free(&diff_N_2);
5679 return status;
Valerio Setti52789862023-04-07 12:13:11 +02005680#else /* MBEDTLS_ECP_LIGHT */
Manuel Pégourié-Gonnard38316372023-03-17 12:18:32 +01005681 (void) slot;
5682 (void) bits;
5683 (void) operation;
5684 (void) data;
5685 return PSA_ERROR_NOT_SUPPORTED;
Valerio Setti52789862023-04-07 12:13:11 +02005686#endif /* MBEDTLS_ECP_LIGHT */
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005687}
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005688
5689/* ECC keys on a Montgomery elliptic curve draws a byte string whose length
5690 * is determined by the curve, and sets the mandatory bits accordingly. That is:
5691 *
5692 * - Curve25519 (PSA_ECC_FAMILY_MONTGOMERY, 255 bits):
5693 * draw a 32-byte string and process it as specified in
5694 * Elliptic Curves for Security [RFC7748] §5.
5695 *
5696 * - Curve448 (PSA_ECC_FAMILY_MONTGOMERY, 448 bits):
5697 * draw a 56-byte string and process it as specified in [RFC7748] §5.
5698 *
5699 * Note: Function allocates memory for *data buffer, so given *data should be
5700 * always NULL.
5701 */
5702
5703static psa_status_t psa_generate_derived_ecc_key_montgomery_helper(
5704 size_t bits,
5705 psa_key_derivation_operation_t *operation,
5706 uint8_t **data
5707 )
5708{
5709 size_t output_length;
Przemek Stekiela81aed22022-03-01 15:13:30 +01005710 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005711
Gilles Peskine449bd832023-01-11 14:50:10 +01005712 switch (bits) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005713 case 255:
5714 output_length = 32;
5715 break;
5716 case 448:
5717 output_length = 56;
5718 break;
5719 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01005720 return PSA_ERROR_INVALID_ARGUMENT;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005721 break;
5722 }
5723
Gilles Peskine449bd832023-01-11 14:50:10 +01005724 *data = mbedtls_calloc(1, output_length);
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005725
Gilles Peskine449bd832023-01-11 14:50:10 +01005726 if (*data == NULL) {
5727 return PSA_ERROR_INSUFFICIENT_MEMORY;
5728 }
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005729
Gilles Peskine449bd832023-01-11 14:50:10 +01005730 status = psa_key_derivation_output_bytes(operation, *data, output_length);
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005731
Gilles Peskine449bd832023-01-11 14:50:10 +01005732 if (status != PSA_SUCCESS) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005733 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01005734 }
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005735
Gilles Peskine449bd832023-01-11 14:50:10 +01005736 switch (bits) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005737 case 255:
5738 (*data)[0] &= 248;
5739 (*data)[31] &= 127;
5740 (*data)[31] |= 64;
5741 break;
5742 case 448:
5743 (*data)[0] &= 252;
5744 (*data)[55] |= 128;
5745 break;
5746 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01005747 return PSA_ERROR_CORRUPTION_DETECTED;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005748 break;
5749 }
5750
5751 return status;
5752}
Joakim Anderssonbb576fe2023-03-01 11:23:02 +01005753#endif /* defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) ||
5754 defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) ||
Przemek Stekiel7fc07512022-03-04 14:41:11 +01005755 defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
5756 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) ||
5757 defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH) */
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005758
Adrian L. Shaw5a5a79a2019-05-03 15:44:28 +01005759static psa_status_t psa_generate_derived_key_internal(
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005760 psa_key_slot_t *slot,
5761 size_t bits,
Gilles Peskine449bd832023-01-11 14:50:10 +01005762 psa_key_derivation_operation_t *operation)
Gilles Peskineeab56e42018-07-12 17:12:33 +02005763{
5764 uint8_t *data = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01005765 size_t bytes = PSA_BITS_TO_BYTES(bits);
Archanad8a83dc2021-06-14 10:04:16 +05305766 size_t storage_size = bytes;
Przemek Stekiela81aed22022-03-01 15:13:30 +01005767 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005768
Gilles Peskine449bd832023-01-11 14:50:10 +01005769 if (PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type)) {
5770 return PSA_ERROR_INVALID_ARGUMENT;
5771 }
Gilles Peskineeab56e42018-07-12 17:12:33 +02005772
Joakim Anderssonbb576fe2023-03-01 11:23:02 +01005773#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) || \
5774 defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) || \
Przemek Stekiel7fc07512022-03-04 14:41:11 +01005775 defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
5776 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) || \
5777 defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
Gilles Peskine449bd832023-01-11 14:50:10 +01005778 if (PSA_KEY_TYPE_IS_ECC(slot->attr.type)) {
5779 psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY(slot->attr.type);
5780 if (PSA_ECC_FAMILY_IS_WEIERSTRASS(curve)) {
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01005781 /* Weierstrass elliptic curve */
Gilles Peskine449bd832023-01-11 14:50:10 +01005782 status = psa_generate_derived_ecc_key_weierstrass_helper(slot, bits, operation, &data);
5783 if (status != PSA_SUCCESS) {
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005784 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005785 }
5786 } else {
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01005787 /* Montgomery elliptic curve */
Gilles Peskine449bd832023-01-11 14:50:10 +01005788 status = psa_generate_derived_ecc_key_montgomery_helper(bits, operation, &data);
5789 if (status != PSA_SUCCESS) {
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01005790 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005791 }
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01005792 }
Przemyslaw Stekiel1dfd1222021-11-18 13:35:00 +01005793 } else
Joakim Anderssonbb576fe2023-03-01 11:23:02 +01005794#endif /* defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) ||
5795 defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) ||
Przemek Stekiel7fc07512022-03-04 14:41:11 +01005796 defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
5797 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) ||
5798 defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH) */
Gilles Peskine449bd832023-01-11 14:50:10 +01005799 if (key_type_is_raw_bytes(slot->attr.type)) {
5800 if (bits % 8 != 0) {
5801 return PSA_ERROR_INVALID_ARGUMENT;
5802 }
5803 data = mbedtls_calloc(1, bytes);
5804 if (data == NULL) {
5805 return PSA_ERROR_INSUFFICIENT_MEMORY;
5806 }
Przemyslaw Stekiel1608e332021-11-09 10:46:40 +01005807
Gilles Peskine449bd832023-01-11 14:50:10 +01005808 status = psa_key_derivation_output_bytes(operation, data, bytes);
5809 if (status != PSA_SUCCESS) {
Przemyslaw Stekiel1608e332021-11-09 10:46:40 +01005810 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005811 }
David Brown12ca5032021-02-11 11:02:00 -07005812#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Gilles Peskine449bd832023-01-11 14:50:10 +01005813 if (slot->attr.type == PSA_KEY_TYPE_DES) {
5814 psa_des_set_key_parity(data, bytes);
5815 }
Przemek Stekielf110dc02022-03-01 14:48:05 +01005816#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES) */
Gilles Peskine449bd832023-01-11 14:50:10 +01005817 } else {
5818 return PSA_ERROR_NOT_SUPPORTED;
Przemyslaw Stekiel1608e332021-11-09 10:46:40 +01005819 }
Ronald Crondd04d422020-11-28 15:14:42 +01005820
Ronald Cronbf33c932020-11-28 18:06:53 +01005821 slot->attr.bits = (psa_key_bits_t) bits;
Ronald Cron2ebfdcc2020-11-28 15:54:54 +01005822 psa_key_attributes_t attributes = {
Gilles Peskine449bd832023-01-11 14:50:10 +01005823 .core = slot->attr
Ronald Cron2ebfdcc2020-11-28 15:54:54 +01005824 };
5825
Gilles Peskine449bd832023-01-11 14:50:10 +01005826 if (psa_key_lifetime_is_external(attributes.core.lifetime)) {
5827 status = psa_driver_wrapper_get_key_buffer_size(&attributes,
5828 &storage_size);
5829 if (status != PSA_SUCCESS) {
Archanad8a83dc2021-06-14 10:04:16 +05305830 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005831 }
Archanad8a83dc2021-06-14 10:04:16 +05305832 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005833 status = psa_allocate_buffer_to_slot(slot, storage_size);
5834 if (status != PSA_SUCCESS) {
Archanad8a83dc2021-06-14 10:04:16 +05305835 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005836 }
Archanad8a83dc2021-06-14 10:04:16 +05305837
Gilles Peskine449bd832023-01-11 14:50:10 +01005838 status = psa_driver_wrapper_import_key(&attributes,
5839 data, bytes,
5840 slot->key.data,
5841 slot->key.bytes,
5842 &slot->key.bytes, &bits);
5843 if (bits != slot->attr.bits) {
Ronald Cronbf33c932020-11-28 18:06:53 +01005844 status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine449bd832023-01-11 14:50:10 +01005845 }
Gilles Peskineeab56e42018-07-12 17:12:33 +02005846
5847exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01005848 mbedtls_free(data);
5849 return status;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005850}
5851
Gilles Peskine449bd832023-01-11 14:50:10 +01005852psa_status_t psa_key_derivation_output_key(const psa_key_attributes_t *attributes,
5853 psa_key_derivation_operation_t *operation,
5854 mbedtls_svc_key_id_t *key)
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005855{
5856 psa_status_t status;
5857 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02005858 psa_se_drv_table_entry_t *driver = NULL;
Gilles Peskine0f84d622019-09-12 19:03:13 +02005859
Ronald Cron81709fc2020-11-14 12:10:32 +01005860 *key = MBEDTLS_SVC_KEY_ID_INIT;
5861
Gilles Peskine0f84d622019-09-12 19:03:13 +02005862 /* Reject any attempt to create a zero-length key so that we don't
5863 * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005864 if (psa_get_key_bits(attributes) == 0) {
5865 return PSA_ERROR_INVALID_ARGUMENT;
5866 }
Gilles Peskine0f84d622019-09-12 19:03:13 +02005867
Gilles Peskine449bd832023-01-11 14:50:10 +01005868 if (operation->alg == PSA_ALG_NONE) {
5869 return PSA_ERROR_BAD_STATE;
5870 }
Dave Rodgmand69da6c2021-11-16 10:32:48 +00005871
Gilles Peskine449bd832023-01-11 14:50:10 +01005872 if (!operation->can_output_key) {
5873 return PSA_ERROR_NOT_PERMITTED;
5874 }
Gilles Peskine178c9aa2019-09-24 18:21:06 +02005875
Gilles Peskine449bd832023-01-11 14:50:10 +01005876 status = psa_start_key_creation(PSA_KEY_CREATION_DERIVE, attributes,
5877 &slot, &driver);
Gilles Peskinef4ee6622019-07-24 13:44:30 +02005878#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005879 if (driver != NULL) {
Gilles Peskinef4ee6622019-07-24 13:44:30 +02005880 /* Deriving a key in a secure element is not implemented yet. */
5881 status = PSA_ERROR_NOT_SUPPORTED;
5882 }
5883#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskine449bd832023-01-11 14:50:10 +01005884 if (status == PSA_SUCCESS) {
5885 status = psa_generate_derived_key_internal(slot,
5886 attributes->core.bits,
5887 operation);
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005888 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005889 if (status == PSA_SUCCESS) {
5890 status = psa_finish_key_creation(slot, driver, key);
5891 }
5892 if (status != PSA_SUCCESS) {
5893 psa_fail_key_creation(slot, driver);
5894 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02005895
Gilles Peskine449bd832023-01-11 14:50:10 +01005896 return status;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005897}
5898
Gilles Peskineeab56e42018-07-12 17:12:33 +02005899
5900
5901/****************************************************************/
Gilles Peskineea0fb492018-07-12 17:17:20 +02005902/* Key derivation */
5903/****************************************************************/
5904
Steven Cooreman932ffb72021-02-15 12:14:32 +01005905#if defined(AT_LEAST_ONE_BUILTIN_KDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01005906static int is_kdf_alg_supported(psa_algorithm_t kdf_alg)
Gilles Peskine9efde4f2021-04-29 21:10:00 +02005907{
5908#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01005909 if (PSA_ALG_IS_HKDF(kdf_alg)) {
5910 return 1;
5911 }
Gilles Peskine9efde4f2021-04-29 21:10:00 +02005912#endif
Przemek Stekielb57a44b2022-06-06 08:33:45 +02005913#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01005914 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
5915 return 1;
5916 }
Przemek Stekielb57a44b2022-06-06 08:33:45 +02005917#endif
5918#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Gilles Peskine449bd832023-01-11 14:50:10 +01005919 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) {
5920 return 1;
5921 }
Gilles Peskine9efde4f2021-04-29 21:10:00 +02005922#endif
5923#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF)
Gilles Peskine449bd832023-01-11 14:50:10 +01005924 if (PSA_ALG_IS_TLS12_PRF(kdf_alg)) {
5925 return 1;
5926 }
Gilles Peskine9efde4f2021-04-29 21:10:00 +02005927#endif
5928#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005929 if (PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
5930 return 1;
5931 }
Gilles Peskine9efde4f2021-04-29 21:10:00 +02005932#endif
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005933#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005934 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
5935 return 1;
5936 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005937#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01005938 return 0;
Gilles Peskine9efde4f2021-04-29 21:10:00 +02005939}
5940
Gilles Peskine449bd832023-01-11 14:50:10 +01005941static psa_status_t psa_hash_try_support(psa_algorithm_t alg)
Gilles Peskine0cc417d2021-04-29 21:18:14 +02005942{
5943 psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT;
Gilles Peskine449bd832023-01-11 14:50:10 +01005944 psa_status_t status = psa_hash_setup(&operation, alg);
5945 psa_hash_abort(&operation);
5946 return status;
Gilles Peskine0cc417d2021-04-29 21:18:14 +02005947}
5948
Gilles Peskine969c5d62019-01-16 15:53:06 +01005949static psa_status_t psa_key_derivation_setup_kdf(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005950 psa_key_derivation_operation_t *operation,
Gilles Peskine449bd832023-01-11 14:50:10 +01005951 psa_algorithm_t kdf_alg)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005952{
Janos Follath5fe19732019-06-20 15:09:30 +01005953 /* Make sure that operation->ctx is properly zero-initialised. (Macro
5954 * initialisers for this union leave some bytes unspecified.) */
Gilles Peskine449bd832023-01-11 14:50:10 +01005955 memset(&operation->ctx, 0, sizeof(operation->ctx));
Janos Follath5fe19732019-06-20 15:09:30 +01005956
Gilles Peskine969c5d62019-01-16 15:53:06 +01005957 /* Make sure that kdf_alg is a supported key derivation algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005958 if (!is_kdf_alg_supported(kdf_alg)) {
5959 return PSA_ERROR_NOT_SUPPORTED;
5960 }
John Durkop07cc04a2020-11-16 22:08:34 -08005961
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005962 /* All currently supported key derivation algorithms (apart from
Andrzej Kurek702776f2022-09-16 06:22:44 -04005963 * ecjpake to pms) are based on a hash algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005964 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(kdf_alg);
5965 size_t hash_size = PSA_HASH_LENGTH(hash_alg);
5966 if (kdf_alg != PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
5967 if (hash_size == 0) {
5968 return PSA_ERROR_NOT_SUPPORTED;
5969 }
Gilles Peskine0cc417d2021-04-29 21:18:14 +02005970
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005971 /* Make sure that hash_alg is a supported hash algorithm. Otherwise
5972 * we might fail later, which is somewhat unfriendly and potentially
5973 * risk-prone. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005974 psa_status_t status = psa_hash_try_support(hash_alg);
5975 if (status != PSA_SUCCESS) {
5976 return status;
5977 }
5978 } else {
5979 hash_size = PSA_HASH_LENGTH(PSA_ALG_SHA_256);
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005980 }
Gilles Peskine0cc417d2021-04-29 21:18:14 +02005981
Gilles Peskine449bd832023-01-11 14:50:10 +01005982 if ((PSA_ALG_IS_TLS12_PRF(kdf_alg) ||
5983 PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) &&
5984 !(hash_alg == PSA_ALG_SHA_256 || hash_alg == PSA_ALG_SHA_384)) {
5985 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005986 }
Andrzej Kurek77638292022-09-16 12:24:52 -04005987#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) || \
Andrzej Kurekb510cd22022-09-26 10:50:22 -04005988 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005989 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg) ||
5990 (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS)) {
Przemek Stekiel17520fe2022-05-10 13:53:33 +02005991 operation->capacity = hash_size;
Gilles Peskine449bd832023-01-11 14:50:10 +01005992 } else
Andrzej Kurekb510cd22022-09-26 10:50:22 -04005993#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT ||
5994 MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */
Gilles Peskine449bd832023-01-11 14:50:10 +01005995 operation->capacity = 255 * hash_size;
5996 return PSA_SUCCESS;
Gilles Peskine969c5d62019-01-16 15:53:06 +01005997}
Gilles Peskine0c3a0712021-04-29 21:34:33 +02005998
Gilles Peskine449bd832023-01-11 14:50:10 +01005999static psa_status_t psa_key_agreement_try_support(psa_algorithm_t alg)
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006000{
6001#if defined(PSA_WANT_ALG_ECDH)
Gilles Peskine449bd832023-01-11 14:50:10 +01006002 if (alg == PSA_ALG_ECDH) {
6003 return PSA_SUCCESS;
6004 }
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006005#endif
Przemek Stekielfb3dd542022-12-01 14:59:15 +01006006#if defined(PSA_WANT_ALG_FFDH)
6007 if (alg == PSA_ALG_FFDH) {
6008 return PSA_SUCCESS;
6009 }
6010#endif
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006011 (void) alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01006012 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006013}
Gilles Peskinebb3814c2022-12-16 01:12:12 +01006014
6015static int psa_key_derivation_allows_free_form_secret_input(
6016 psa_algorithm_t kdf_alg)
6017{
6018#if defined(PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS)
6019 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
6020 return 0;
6021 }
6022#endif
6023 (void) kdf_alg;
6024 return 1;
6025}
John Durkop07cc04a2020-11-16 22:08:34 -08006026#endif /* AT_LEAST_ONE_BUILTIN_KDF */
Gilles Peskine969c5d62019-01-16 15:53:06 +01006027
Gilles Peskine449bd832023-01-11 14:50:10 +01006028psa_status_t psa_key_derivation_setup(psa_key_derivation_operation_t *operation,
6029 psa_algorithm_t alg)
Gilles Peskine969c5d62019-01-16 15:53:06 +01006030{
6031 psa_status_t status;
6032
Gilles Peskine449bd832023-01-11 14:50:10 +01006033 if (operation->alg != 0) {
6034 return PSA_ERROR_BAD_STATE;
Gilles Peskine969c5d62019-01-16 15:53:06 +01006035 }
Gilles Peskine969c5d62019-01-16 15:53:06 +01006036
Gilles Peskine449bd832023-01-11 14:50:10 +01006037 if (PSA_ALG_IS_RAW_KEY_AGREEMENT(alg)) {
6038 return PSA_ERROR_INVALID_ARGUMENT;
6039 } else if (PSA_ALG_IS_KEY_AGREEMENT(alg)) {
6040#if defined(AT_LEAST_ONE_BUILTIN_KDF)
6041 psa_algorithm_t kdf_alg = PSA_ALG_KEY_AGREEMENT_GET_KDF(alg);
6042 psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE(alg);
6043 status = psa_key_agreement_try_support(ka_alg);
6044 if (status != PSA_SUCCESS) {
6045 return status;
6046 }
Gilles Peskinebb3814c2022-12-16 01:12:12 +01006047 if (!psa_key_derivation_allows_free_form_secret_input(kdf_alg)) {
6048 return PSA_ERROR_INVALID_ARGUMENT;
6049 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006050 status = psa_key_derivation_setup_kdf(operation, kdf_alg);
6051#else
6052 return PSA_ERROR_NOT_SUPPORTED;
6053#endif /* AT_LEAST_ONE_BUILTIN_KDF */
6054 } else if (PSA_ALG_IS_KEY_DERIVATION(alg)) {
6055#if defined(AT_LEAST_ONE_BUILTIN_KDF)
6056 status = psa_key_derivation_setup_kdf(operation, alg);
6057#else
6058 return PSA_ERROR_NOT_SUPPORTED;
6059#endif /* AT_LEAST_ONE_BUILTIN_KDF */
6060 } else {
6061 return PSA_ERROR_INVALID_ARGUMENT;
6062 }
6063
6064 if (status == PSA_SUCCESS) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006065 operation->alg = alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01006066 }
6067 return status;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006068}
6069
Przemek Stekiel69c46792022-06-10 12:59:51 +02006070#if defined(BUILTIN_ALG_ANY_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006071static psa_status_t psa_hkdf_input(psa_hkdf_key_derivation_t *hkdf,
6072 psa_algorithm_t kdf_alg,
6073 psa_key_derivation_step_t step,
6074 const uint8_t *data,
6075 size_t data_length)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006076{
Gilles Peskine449bd832023-01-11 14:50:10 +01006077 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(kdf_alg);
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006078 psa_status_t status;
Gilles Peskine449bd832023-01-11 14:50:10 +01006079 switch (step) {
Gilles Peskine03410b52019-05-16 16:05:19 +02006080 case PSA_KEY_DERIVATION_INPUT_SALT:
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006081#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Gilles Peskine449bd832023-01-11 14:50:10 +01006082 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) {
6083 return PSA_ERROR_INVALID_ARGUMENT;
6084 }
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006085#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND */
Gilles Peskine449bd832023-01-11 14:50:10 +01006086 if (hkdf->state != HKDF_STATE_INIT) {
6087 return PSA_ERROR_BAD_STATE;
6088 } else {
6089 status = psa_key_derivation_start_hmac(&hkdf->hmac,
6090 hash_alg,
6091 data, data_length);
6092 if (status != PSA_SUCCESS) {
6093 return status;
6094 }
Steven Cooremand1ed1d92021-04-29 19:11:25 +02006095 hkdf->state = HKDF_STATE_STARTED;
Gilles Peskine449bd832023-01-11 14:50:10 +01006096 return PSA_SUCCESS;
Steven Cooremand1ed1d92021-04-29 19:11:25 +02006097 }
Gilles Peskine03410b52019-05-16 16:05:19 +02006098 case PSA_KEY_DERIVATION_INPUT_SECRET:
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006099#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Gilles Peskine449bd832023-01-11 14:50:10 +01006100 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) {
Przemek Stekiel2fb0dcd2022-05-19 10:34:37 +02006101 /* We shouldn't be in different state as HKDF_EXPAND only allows
6102 * two inputs: SECRET (this case) and INFO which does not modify
6103 * the state. It could happen only if the hkdf
6104 * object was corrupted. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006105 if (hkdf->state != HKDF_STATE_INIT) {
6106 return PSA_ERROR_BAD_STATE;
6107 }
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006108
Przemek Stekiel2fb0dcd2022-05-19 10:34:37 +02006109 /* Allow only input that fits expected prk size */
Gilles Peskine449bd832023-01-11 14:50:10 +01006110 if (data_length != PSA_HASH_LENGTH(hash_alg)) {
6111 return PSA_ERROR_INVALID_ARGUMENT;
6112 }
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006113
Gilles Peskine449bd832023-01-11 14:50:10 +01006114 memcpy(hkdf->prk, data, data_length);
6115 } else
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006116#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND */
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006117 {
Przemek Stekiel0586f4c2022-06-03 16:00:25 +02006118 /* HKDF: If no salt was provided, use an empty salt.
6119 * HKDF-EXTRACT: salt is mandatory. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006120 if (hkdf->state == HKDF_STATE_INIT) {
Przemek Stekiel0586f4c2022-06-03 16:00:25 +02006121#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01006122 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
6123 return PSA_ERROR_BAD_STATE;
6124 }
Przemek Stekiel0586f4c2022-06-03 16:00:25 +02006125#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Gilles Peskine449bd832023-01-11 14:50:10 +01006126 status = psa_key_derivation_start_hmac(&hkdf->hmac,
6127 hash_alg,
6128 NULL, 0);
6129 if (status != PSA_SUCCESS) {
6130 return status;
6131 }
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006132 hkdf->state = HKDF_STATE_STARTED;
6133 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006134 if (hkdf->state != HKDF_STATE_STARTED) {
6135 return PSA_ERROR_BAD_STATE;
6136 }
6137 status = psa_mac_update(&hkdf->hmac,
6138 data, data_length);
6139 if (status != PSA_SUCCESS) {
6140 return status;
6141 }
6142 status = psa_mac_sign_finish(&hkdf->hmac,
6143 hkdf->prk,
6144 sizeof(hkdf->prk),
6145 &data_length);
6146 if (status != PSA_SUCCESS) {
6147 return status;
6148 }
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006149 }
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006150
Gilles Peskine2b522db2019-04-12 15:11:49 +02006151 hkdf->state = HKDF_STATE_KEYED;
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006152 hkdf->block_number = 0;
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006153#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01006154 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006155 /* The only block of output is the PRK. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006156 memcpy(hkdf->output_block, hkdf->prk, PSA_HASH_LENGTH(hash_alg));
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006157 hkdf->offset_in_block = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01006158 } else
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006159#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006160 {
6161 /* Block 0 is empty, and the next block will be
6162 * generated by psa_key_derivation_hkdf_read(). */
Gilles Peskine449bd832023-01-11 14:50:10 +01006163 hkdf->offset_in_block = PSA_HASH_LENGTH(hash_alg);
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006164 }
6165
Gilles Peskine449bd832023-01-11 14:50:10 +01006166 return PSA_SUCCESS;
Gilles Peskine03410b52019-05-16 16:05:19 +02006167 case PSA_KEY_DERIVATION_INPUT_INFO:
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006168#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01006169 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
6170 return PSA_ERROR_INVALID_ARGUMENT;
6171 }
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006172#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Przemek Stekielcde3f782022-06-03 16:12:27 +02006173#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Gilles Peskine449bd832023-01-11 14:50:10 +01006174 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg) &&
6175 hkdf->state == HKDF_STATE_INIT) {
6176 return PSA_ERROR_BAD_STATE;
6177 }
Przemek Stekielcde3f782022-06-03 16:12:27 +02006178#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Gilles Peskine449bd832023-01-11 14:50:10 +01006179 if (hkdf->state == HKDF_STATE_OUTPUT) {
6180 return PSA_ERROR_BAD_STATE;
6181 }
6182 if (hkdf->info_set) {
6183 return PSA_ERROR_BAD_STATE;
6184 }
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006185 hkdf->info_length = data_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01006186 if (data_length != 0) {
6187 hkdf->info = mbedtls_calloc(1, data_length);
6188 if (hkdf->info == NULL) {
6189 return PSA_ERROR_INSUFFICIENT_MEMORY;
6190 }
6191 memcpy(hkdf->info, data, data_length);
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006192 }
6193 hkdf->info_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01006194 return PSA_SUCCESS;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006195 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01006196 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006197 }
6198}
Przemek Stekiel69c46792022-06-10 12:59:51 +02006199#endif /* BUILTIN_ALG_ANY_HKDF */
Janos Follathb03233e2019-06-11 15:30:30 +01006200
John Durkop07cc04a2020-11-16 22:08:34 -08006201#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
6202 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006203static psa_status_t psa_tls12_prf_set_seed(psa_tls12_prf_key_derivation_t *prf,
6204 const uint8_t *data,
6205 size_t data_length)
Janos Follathf08e2652019-06-13 09:05:41 +01006206{
Gilles Peskine449bd832023-01-11 14:50:10 +01006207 if (prf->state != PSA_TLS12_PRF_STATE_INIT) {
6208 return PSA_ERROR_BAD_STATE;
6209 }
Janos Follathf08e2652019-06-13 09:05:41 +01006210
Gilles Peskine449bd832023-01-11 14:50:10 +01006211 if (data_length != 0) {
6212 prf->seed = mbedtls_calloc(1, data_length);
6213 if (prf->seed == NULL) {
6214 return PSA_ERROR_INSUFFICIENT_MEMORY;
6215 }
Janos Follathf08e2652019-06-13 09:05:41 +01006216
Gilles Peskine449bd832023-01-11 14:50:10 +01006217 memcpy(prf->seed, data, data_length);
Janos Follathd6dce9f2019-07-04 09:11:38 +01006218 prf->seed_length = data_length;
6219 }
Janos Follathf08e2652019-06-13 09:05:41 +01006220
Gilles Peskine43f958b2020-12-13 14:55:14 +01006221 prf->state = PSA_TLS12_PRF_STATE_SEED_SET;
Janos Follathf08e2652019-06-13 09:05:41 +01006222
Gilles Peskine449bd832023-01-11 14:50:10 +01006223 return PSA_SUCCESS;
Janos Follathf08e2652019-06-13 09:05:41 +01006224}
6225
Gilles Peskine449bd832023-01-11 14:50:10 +01006226static psa_status_t psa_tls12_prf_set_key(psa_tls12_prf_key_derivation_t *prf,
6227 const uint8_t *data,
6228 size_t data_length)
Janos Follath81550542019-06-13 14:26:34 +01006229{
Gilles Peskine449bd832023-01-11 14:50:10 +01006230 if (prf->state != PSA_TLS12_PRF_STATE_SEED_SET &&
6231 prf->state != PSA_TLS12_PRF_STATE_OTHER_KEY_SET) {
6232 return PSA_ERROR_BAD_STATE;
6233 }
Janos Follath81550542019-06-13 14:26:34 +01006234
Gilles Peskine449bd832023-01-11 14:50:10 +01006235 if (data_length != 0) {
6236 prf->secret = mbedtls_calloc(1, data_length);
6237 if (prf->secret == NULL) {
6238 return PSA_ERROR_INSUFFICIENT_MEMORY;
6239 }
Steven Cooremana6df6042021-04-29 19:32:25 +02006240
Gilles Peskine449bd832023-01-11 14:50:10 +01006241 memcpy(prf->secret, data, data_length);
Steven Cooremana6df6042021-04-29 19:32:25 +02006242 prf->secret_length = data_length;
6243 }
Janos Follath81550542019-06-13 14:26:34 +01006244
Gilles Peskine43f958b2020-12-13 14:55:14 +01006245 prf->state = PSA_TLS12_PRF_STATE_KEY_SET;
Janos Follath81550542019-06-13 14:26:34 +01006246
Gilles Peskine449bd832023-01-11 14:50:10 +01006247 return PSA_SUCCESS;
Janos Follath81550542019-06-13 14:26:34 +01006248}
6249
Gilles Peskine449bd832023-01-11 14:50:10 +01006250static psa_status_t psa_tls12_prf_set_label(psa_tls12_prf_key_derivation_t *prf,
6251 const uint8_t *data,
6252 size_t data_length)
Janos Follath63028dd2019-06-13 09:15:47 +01006253{
Gilles Peskine449bd832023-01-11 14:50:10 +01006254 if (prf->state != PSA_TLS12_PRF_STATE_KEY_SET) {
6255 return PSA_ERROR_BAD_STATE;
6256 }
Janos Follath63028dd2019-06-13 09:15:47 +01006257
Gilles Peskine449bd832023-01-11 14:50:10 +01006258 if (data_length != 0) {
6259 prf->label = mbedtls_calloc(1, data_length);
6260 if (prf->label == NULL) {
6261 return PSA_ERROR_INSUFFICIENT_MEMORY;
6262 }
Janos Follath63028dd2019-06-13 09:15:47 +01006263
Gilles Peskine449bd832023-01-11 14:50:10 +01006264 memcpy(prf->label, data, data_length);
Janos Follathd6dce9f2019-07-04 09:11:38 +01006265 prf->label_length = data_length;
6266 }
Janos Follath63028dd2019-06-13 09:15:47 +01006267
Gilles Peskine43f958b2020-12-13 14:55:14 +01006268 prf->state = PSA_TLS12_PRF_STATE_LABEL_SET;
Janos Follath63028dd2019-06-13 09:15:47 +01006269
Gilles Peskine449bd832023-01-11 14:50:10 +01006270 return PSA_SUCCESS;
Janos Follath63028dd2019-06-13 09:15:47 +01006271}
6272
Gilles Peskine449bd832023-01-11 14:50:10 +01006273static psa_status_t psa_tls12_prf_input(psa_tls12_prf_key_derivation_t *prf,
6274 psa_key_derivation_step_t step,
6275 const uint8_t *data,
6276 size_t data_length)
Janos Follathb03233e2019-06-11 15:30:30 +01006277{
Gilles Peskine449bd832023-01-11 14:50:10 +01006278 switch (step) {
Janos Follathf08e2652019-06-13 09:05:41 +01006279 case PSA_KEY_DERIVATION_INPUT_SEED:
Gilles Peskine449bd832023-01-11 14:50:10 +01006280 return psa_tls12_prf_set_seed(prf, data, data_length);
Janos Follath81550542019-06-13 14:26:34 +01006281 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01006282 return psa_tls12_prf_set_key(prf, data, data_length);
Janos Follath63028dd2019-06-13 09:15:47 +01006283 case PSA_KEY_DERIVATION_INPUT_LABEL:
Gilles Peskine449bd832023-01-11 14:50:10 +01006284 return psa_tls12_prf_set_label(prf, data, data_length);
Janos Follathb03233e2019-06-11 15:30:30 +01006285 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01006286 return PSA_ERROR_INVALID_ARGUMENT;
Janos Follathb03233e2019-06-11 15:30:30 +01006287 }
6288}
John Durkop07cc04a2020-11-16 22:08:34 -08006289#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) ||
6290 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
6291
6292#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
6293static psa_status_t psa_tls12_prf_psk_to_ms_set_key(
6294 psa_tls12_prf_key_derivation_t *prf,
John Durkop07cc04a2020-11-16 22:08:34 -08006295 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01006296 size_t data_length)
John Durkop07cc04a2020-11-16 22:08:34 -08006297{
6298 psa_status_t status;
Gilles Peskine449bd832023-01-11 14:50:10 +01006299 const size_t pms_len = (prf->state == PSA_TLS12_PRF_STATE_OTHER_KEY_SET ?
6300 4 + data_length + prf->other_secret_length :
6301 4 + 2 * data_length);
John Durkop07cc04a2020-11-16 22:08:34 -08006302
Gilles Peskine449bd832023-01-11 14:50:10 +01006303 if (data_length > PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE) {
6304 return PSA_ERROR_INVALID_ARGUMENT;
6305 }
John Durkop07cc04a2020-11-16 22:08:34 -08006306
Gilles Peskine449bd832023-01-11 14:50:10 +01006307 uint8_t *pms = mbedtls_calloc(1, pms_len);
6308 if (pms == NULL) {
6309 return PSA_ERROR_INSUFFICIENT_MEMORY;
6310 }
Przemek Stekielc8fa5a12022-04-07 14:17:13 +02006311 uint8_t *cur = pms;
6312
6313 /* pure-PSK:
6314 * Quoting RFC 4279, Section 2:
John Durkop07cc04a2020-11-16 22:08:34 -08006315 *
6316 * The premaster secret is formed as follows: if the PSK is N octets
6317 * long, concatenate a uint16 with the value N, N zero octets, a second
6318 * uint16 with the value N, and the PSK itself.
Przemek Stekielc8fa5a12022-04-07 14:17:13 +02006319 *
6320 * mixed-PSK:
6321 * In a DHE-PSK, RSA-PSK, ECDHE-PSK the premaster secret is formed as
6322 * follows: concatenate a uint16 with the length of the other secret,
6323 * the other secret itself, uint16 with the length of PSK, and the
6324 * PSK itself.
6325 * For details please check:
6326 * - RFC 4279, Section 4 for the definition of RSA-PSK,
6327 * - RFC 4279, Section 3 for the definition of DHE-PSK,
6328 * - RFC 5489 for the definition of ECDHE-PSK.
John Durkop07cc04a2020-11-16 22:08:34 -08006329 */
6330
Gilles Peskine449bd832023-01-11 14:50:10 +01006331 if (prf->state == PSA_TLS12_PRF_STATE_OTHER_KEY_SET) {
6332 *cur++ = MBEDTLS_BYTE_1(prf->other_secret_length);
6333 *cur++ = MBEDTLS_BYTE_0(prf->other_secret_length);
6334 if (prf->other_secret_length != 0) {
6335 memcpy(cur, prf->other_secret, prf->other_secret_length);
6336 mbedtls_platform_zeroize(prf->other_secret, prf->other_secret_length);
Przemek Stekiel2503f7e2022-04-12 12:08:01 +02006337 cur += prf->other_secret_length;
6338 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006339 } else {
6340 *cur++ = MBEDTLS_BYTE_1(data_length);
6341 *cur++ = MBEDTLS_BYTE_0(data_length);
6342 memset(cur, 0, data_length);
Przemek Stekielc8fa5a12022-04-07 14:17:13 +02006343 cur += data_length;
6344 }
6345
Gilles Peskine449bd832023-01-11 14:50:10 +01006346 *cur++ = MBEDTLS_BYTE_1(data_length);
6347 *cur++ = MBEDTLS_BYTE_0(data_length);
6348 memcpy(cur, data, data_length);
John Durkop07cc04a2020-11-16 22:08:34 -08006349 cur += data_length;
6350
Gilles Peskine449bd832023-01-11 14:50:10 +01006351 status = psa_tls12_prf_set_key(prf, pms, cur - pms);
John Durkop07cc04a2020-11-16 22:08:34 -08006352
Gilles Peskine449bd832023-01-11 14:50:10 +01006353 mbedtls_platform_zeroize(pms, pms_len);
6354 mbedtls_free(pms);
6355 return status;
John Durkop07cc04a2020-11-16 22:08:34 -08006356}
Janos Follath6660f0e2019-06-17 08:44:03 +01006357
Przemek Stekiele47201b2022-04-19 13:53:28 +02006358static psa_status_t psa_tls12_prf_psk_to_ms_set_other_key(
6359 psa_tls12_prf_key_derivation_t *prf,
6360 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01006361 size_t data_length)
Przemek Stekiele47201b2022-04-19 13:53:28 +02006362{
Gilles Peskine449bd832023-01-11 14:50:10 +01006363 if (prf->state != PSA_TLS12_PRF_STATE_SEED_SET) {
6364 return PSA_ERROR_BAD_STATE;
Przemek Stekiele47201b2022-04-19 13:53:28 +02006365 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006366
6367 if (data_length != 0) {
6368 prf->other_secret = mbedtls_calloc(1, data_length);
6369 if (prf->other_secret == NULL) {
6370 return PSA_ERROR_INSUFFICIENT_MEMORY;
6371 }
6372
6373 memcpy(prf->other_secret, data, data_length);
6374 prf->other_secret_length = data_length;
6375 } else {
Przemek Stekiele47201b2022-04-19 13:53:28 +02006376 prf->other_secret_length = 0;
6377 }
6378
6379 prf->state = PSA_TLS12_PRF_STATE_OTHER_KEY_SET;
6380
Gilles Peskine449bd832023-01-11 14:50:10 +01006381 return PSA_SUCCESS;
Przemek Stekiele47201b2022-04-19 13:53:28 +02006382}
6383
Janos Follath6660f0e2019-06-17 08:44:03 +01006384static psa_status_t psa_tls12_prf_psk_to_ms_input(
6385 psa_tls12_prf_key_derivation_t *prf,
Janos Follath6660f0e2019-06-17 08:44:03 +01006386 psa_key_derivation_step_t step,
6387 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01006388 size_t data_length)
Janos Follath6660f0e2019-06-17 08:44:03 +01006389{
Gilles Peskine449bd832023-01-11 14:50:10 +01006390 switch (step) {
Przemek Stekiele47201b2022-04-19 13:53:28 +02006391 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01006392 return psa_tls12_prf_psk_to_ms_set_key(prf,
6393 data, data_length);
Przemek Stekiele47201b2022-04-19 13:53:28 +02006394 break;
6395 case PSA_KEY_DERIVATION_INPUT_OTHER_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01006396 return psa_tls12_prf_psk_to_ms_set_other_key(prf,
6397 data,
6398 data_length);
Przemek Stekiele47201b2022-04-19 13:53:28 +02006399 break;
6400 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01006401 return psa_tls12_prf_input(prf, step, data, data_length);
Przemek Stekiele47201b2022-04-19 13:53:28 +02006402 break;
Janos Follath6660f0e2019-06-17 08:44:03 +01006403
Przemek Stekiele47201b2022-04-19 13:53:28 +02006404 }
Janos Follath6660f0e2019-06-17 08:44:03 +01006405}
John Durkop07cc04a2020-11-16 22:08:34 -08006406#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006407
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006408#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
6409static psa_status_t psa_tls12_ecjpake_to_pms_input(
6410 psa_tls12_ecjpake_to_pms_t *ecjpake,
Andrzej Kurek702776f2022-09-16 06:22:44 -04006411 psa_key_derivation_step_t step,
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006412 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01006413 size_t data_length)
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006414{
Gilles Peskine449bd832023-01-11 14:50:10 +01006415 if (data_length != PSA_TLS12_ECJPAKE_TO_PMS_INPUT_SIZE ||
6416 step != PSA_KEY_DERIVATION_INPUT_SECRET) {
6417 return PSA_ERROR_INVALID_ARGUMENT;
Andrzej Kurek5603efd2022-09-26 10:49:16 -04006418 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006419
6420 /* Check if the passed point is in an uncompressed form */
Gilles Peskine449bd832023-01-11 14:50:10 +01006421 if (data[0] != 0x04) {
6422 return PSA_ERROR_INVALID_ARGUMENT;
6423 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006424
6425 /* Only K.X has to be extracted - bytes 1 to 32 inclusive. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006426 memcpy(ecjpake->data, data + 1, PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE);
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006427
Gilles Peskine449bd832023-01-11 14:50:10 +01006428 return PSA_SUCCESS;
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006429}
6430#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */
Gilles Peskineb8965192019-09-24 16:21:10 +02006431/** Check whether the given key type is acceptable for the given
6432 * input step of a key derivation.
6433 *
6434 * Secret inputs must have the type #PSA_KEY_TYPE_DERIVE.
6435 * Non-secret inputs must have the type #PSA_KEY_TYPE_RAW_DATA.
6436 * Both secret and non-secret inputs can alternatively have the type
6437 * #PSA_KEY_TYPE_NONE, which is never the type of a key object, meaning
6438 * that the input was passed as a buffer rather than via a key object.
6439 */
Gilles Peskine224b0d62019-09-23 18:13:17 +02006440static int psa_key_derivation_check_input_type(
6441 psa_key_derivation_step_t step,
Gilles Peskine449bd832023-01-11 14:50:10 +01006442 psa_key_type_t key_type)
Gilles Peskine224b0d62019-09-23 18:13:17 +02006443{
Gilles Peskine449bd832023-01-11 14:50:10 +01006444 switch (step) {
Gilles Peskine224b0d62019-09-23 18:13:17 +02006445 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01006446 if (key_type == PSA_KEY_TYPE_DERIVE) {
6447 return PSA_SUCCESS;
6448 }
6449 if (key_type == PSA_KEY_TYPE_NONE) {
6450 return PSA_SUCCESS;
6451 }
Gilles Peskine224b0d62019-09-23 18:13:17 +02006452 break;
Przemek Stekiela7695a22022-04-07 15:39:01 +02006453 case PSA_KEY_DERIVATION_INPUT_OTHER_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01006454 if (key_type == PSA_KEY_TYPE_DERIVE) {
6455 return PSA_SUCCESS;
6456 }
6457 if (key_type == PSA_KEY_TYPE_NONE) {
6458 return PSA_SUCCESS;
6459 }
Przemek Stekiela7695a22022-04-07 15:39:01 +02006460 break;
Gilles Peskine224b0d62019-09-23 18:13:17 +02006461 case PSA_KEY_DERIVATION_INPUT_LABEL:
6462 case PSA_KEY_DERIVATION_INPUT_SALT:
6463 case PSA_KEY_DERIVATION_INPUT_INFO:
6464 case PSA_KEY_DERIVATION_INPUT_SEED:
Gilles Peskine449bd832023-01-11 14:50:10 +01006465 if (key_type == PSA_KEY_TYPE_RAW_DATA) {
6466 return PSA_SUCCESS;
6467 }
6468 if (key_type == PSA_KEY_TYPE_NONE) {
6469 return PSA_SUCCESS;
6470 }
Gilles Peskine224b0d62019-09-23 18:13:17 +02006471 break;
6472 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006473 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine224b0d62019-09-23 18:13:17 +02006474}
6475
Janos Follathb80a94e2019-06-12 15:54:46 +01006476static psa_status_t psa_key_derivation_input_internal(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006477 psa_key_derivation_operation_t *operation,
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01006478 psa_key_derivation_step_t step,
Gilles Peskine224b0d62019-09-23 18:13:17 +02006479 psa_key_type_t key_type,
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01006480 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01006481 size_t data_length)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006482{
Gilles Peskine46d7faf2019-09-23 19:22:55 +02006483 psa_status_t status;
Gilles Peskine449bd832023-01-11 14:50:10 +01006484 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation);
Gilles Peskine46d7faf2019-09-23 19:22:55 +02006485
Gilles Peskine449bd832023-01-11 14:50:10 +01006486 status = psa_key_derivation_check_input_type(step, key_type);
6487 if (status != PSA_SUCCESS) {
Gilles Peskine224b0d62019-09-23 18:13:17 +02006488 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006489 }
Gilles Peskine224b0d62019-09-23 18:13:17 +02006490
Przemek Stekiel69c46792022-06-10 12:59:51 +02006491#if defined(BUILTIN_ALG_ANY_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006492 if (PSA_ALG_IS_ANY_HKDF(kdf_alg)) {
6493 status = psa_hkdf_input(&operation->ctx.hkdf, kdf_alg,
6494 step, data, data_length);
6495 } else
Przemek Stekiel69c46792022-06-10 12:59:51 +02006496#endif /* BUILTIN_ALG_ANY_HKDF */
John Durkop07cc04a2020-11-16 22:08:34 -08006497#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006498 if (PSA_ALG_IS_TLS12_PRF(kdf_alg)) {
6499 status = psa_tls12_prf_input(&operation->ctx.tls12_prf,
6500 step, data, data_length);
6501 } else
John Durkop07cc04a2020-11-16 22:08:34 -08006502#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF */
6503#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006504 if (PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
6505 status = psa_tls12_prf_psk_to_ms_input(&operation->ctx.tls12_prf,
6506 step, data, data_length);
6507 } else
John Durkop07cc04a2020-11-16 22:08:34 -08006508#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006509#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006510 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006511 status = psa_tls12_ecjpake_to_pms_input(
Gilles Peskine449bd832023-01-11 14:50:10 +01006512 &operation->ctx.tls12_ecjpake_to_pms, step, data, data_length);
6513 } else
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006514#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006515 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006516 /* This can't happen unless the operation object was not initialized */
Steven Cooreman74afe472021-02-10 17:19:22 +01006517 (void) data;
6518 (void) data_length;
6519 (void) kdf_alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01006520 return PSA_ERROR_BAD_STATE;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006521 }
6522
Gilles Peskine224b0d62019-09-23 18:13:17 +02006523exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01006524 if (status != PSA_SUCCESS) {
6525 psa_key_derivation_abort(operation);
6526 }
6527 return status;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006528}
6529
Janos Follath51f4a0f2019-06-14 11:35:55 +01006530psa_status_t psa_key_derivation_input_bytes(
6531 psa_key_derivation_operation_t *operation,
6532 psa_key_derivation_step_t step,
6533 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01006534 size_t data_length)
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01006535{
Gilles Peskine449bd832023-01-11 14:50:10 +01006536 return psa_key_derivation_input_internal(operation, step,
6537 PSA_KEY_TYPE_NONE,
6538 data, data_length);
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01006539}
6540
Janos Follath51f4a0f2019-06-14 11:35:55 +01006541psa_status_t psa_key_derivation_input_key(
6542 psa_key_derivation_operation_t *operation,
6543 psa_key_derivation_step_t step,
Gilles Peskine449bd832023-01-11 14:50:10 +01006544 mbedtls_svc_key_id_t key)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006545{
Ronald Cronf95a2b12020-10-22 15:24:49 +02006546 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01006547 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006548 psa_key_slot_t *slot;
Gilles Peskine178c9aa2019-09-24 18:21:06 +02006549
Ronald Cron5c522922020-11-14 16:35:34 +01006550 status = psa_get_and_lock_transparent_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01006551 key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg);
6552 if (status != PSA_SUCCESS) {
6553 psa_key_derivation_abort(operation);
6554 return status;
Gilles Peskine593773d2019-09-23 18:17:40 +02006555 }
Gilles Peskine178c9aa2019-09-24 18:21:06 +02006556
6557 /* Passing a key object as a SECRET input unlocks the permission
6558 * to output to a key object. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006559 if (step == PSA_KEY_DERIVATION_INPUT_SECRET) {
Gilles Peskine178c9aa2019-09-24 18:21:06 +02006560 operation->can_output_key = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01006561 }
Gilles Peskine178c9aa2019-09-24 18:21:06 +02006562
Gilles Peskine449bd832023-01-11 14:50:10 +01006563 status = psa_key_derivation_input_internal(operation,
6564 step, slot->attr.type,
6565 slot->key.data,
6566 slot->key.bytes);
Ronald Cronf95a2b12020-10-22 15:24:49 +02006567
Gilles Peskine449bd832023-01-11 14:50:10 +01006568 unlock_status = psa_unlock_key_slot(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02006569
Gilles Peskine449bd832023-01-11 14:50:10 +01006570 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006571}
Gilles Peskineea0fb492018-07-12 17:17:20 +02006572
6573
6574
6575/****************************************************************/
Gilles Peskine01d718c2018-09-18 12:01:02 +02006576/* Key agreement */
6577/****************************************************************/
6578
Gilles Peskine449bd832023-01-11 14:50:10 +01006579psa_status_t psa_key_agreement_raw_builtin(const psa_key_attributes_t *attributes,
6580 const uint8_t *key_buffer,
6581 size_t key_buffer_size,
6582 psa_algorithm_t alg,
6583 const uint8_t *peer_key,
6584 size_t peer_key_length,
6585 uint8_t *shared_secret,
6586 size_t shared_secret_size,
6587 size_t *shared_secret_length)
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02006588{
Gilles Peskine449bd832023-01-11 14:50:10 +01006589 switch (alg) {
John Durkop6ba40d12020-11-10 08:50:04 -08006590#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
Gilles Peskine0216fe12019-04-11 21:23:21 +02006591 case PSA_ALG_ECDH:
Gilles Peskine449bd832023-01-11 14:50:10 +01006592 return mbedtls_psa_key_agreement_ecdh(attributes, key_buffer,
6593 key_buffer_size, alg,
6594 peer_key, peer_key_length,
6595 shared_secret,
6596 shared_secret_size,
6597 shared_secret_length);
Gilles Peskine01d718c2018-09-18 12:01:02 +02006598#endif /* MBEDTLS_PSA_BUILTIN_ALG_ECDH */
Przemek Stekielfb3dd542022-12-01 14:59:15 +01006599
6600#if defined(MBEDTLS_PSA_BUILTIN_ALG_FFDH)
6601 case PSA_ALG_FFDH:
Przemek Stekiel359f4622022-12-05 14:11:55 +01006602 return mbedtls_psa_key_agreement_ffdh(attributes,
6603 peer_key,
6604 peer_key_length,
6605 key_buffer,
6606 key_buffer_size,
6607 shared_secret,
6608 shared_secret_size,
6609 shared_secret_length);
Przemek Stekielfb3dd542022-12-01 14:59:15 +01006610#endif /* MBEDTLS_PSA_BUILTIN_ALG_FFDH */
6611
Gilles Peskine01d718c2018-09-18 12:01:02 +02006612 default:
Aditya Deshpande17845b82022-10-13 17:21:01 +01006613 (void) attributes;
6614 (void) key_buffer;
6615 (void) key_buffer_size;
Gilles Peskine93f85002018-11-16 16:43:31 +01006616 (void) peer_key;
6617 (void) peer_key_length;
Gilles Peskine0216fe12019-04-11 21:23:21 +02006618 (void) shared_secret;
6619 (void) shared_secret_size;
6620 (void) shared_secret_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01006621 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine01d718c2018-09-18 12:01:02 +02006622 }
Gilles Peskine0216fe12019-04-11 21:23:21 +02006623}
Gilles Peskine01d718c2018-09-18 12:01:02 +02006624
Aditya Deshpande17845b82022-10-13 17:21:01 +01006625/** Internal function for raw key agreement
6626 * Calls the driver wrapper which will hand off key agreement task
Aditya Deshpande40c05cc2022-10-14 16:41:40 +01006627 * to the driver's implementation if a driver is present.
6628 * Fallback specified in the driver wrapper is built-in raw key agreement
Aditya Deshpande17845b82022-10-13 17:21:01 +01006629 * (psa_key_agreement_raw_builtin).
6630 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006631static psa_status_t psa_key_agreement_raw_internal(psa_algorithm_t alg,
6632 psa_key_slot_t *private_key,
6633 const uint8_t *peer_key,
6634 size_t peer_key_length,
6635 uint8_t *shared_secret,
6636 size_t shared_secret_size,
6637 size_t *shared_secret_length)
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006638{
Gilles Peskine449bd832023-01-11 14:50:10 +01006639 if (!PSA_ALG_IS_RAW_KEY_AGREEMENT(alg)) {
6640 return PSA_ERROR_NOT_SUPPORTED;
6641 }
Aditya Deshpande17845b82022-10-13 17:21:01 +01006642
6643 psa_key_attributes_t attributes = {
Gilles Peskine449bd832023-01-11 14:50:10 +01006644 .core = private_key->attr
Aditya Deshpande17845b82022-10-13 17:21:01 +01006645 };
6646
Gilles Peskine449bd832023-01-11 14:50:10 +01006647 return psa_driver_wrapper_key_agreement(&attributes,
6648 private_key->key.data,
6649 private_key->key.bytes, alg,
6650 peer_key, peer_key_length,
6651 shared_secret,
6652 shared_secret_size,
6653 shared_secret_length);
Gilles Peskine0216fe12019-04-11 21:23:21 +02006654}
6655
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02006656/* Note that if this function fails, you must call psa_key_derivation_abort()
Gilles Peskine01d718c2018-09-18 12:01:02 +02006657 * to potentially free embedded data structures and wipe confidential data.
6658 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006659static psa_status_t psa_key_agreement_internal(psa_key_derivation_operation_t *operation,
6660 psa_key_derivation_step_t step,
6661 psa_key_slot_t *private_key,
6662 const uint8_t *peer_key,
6663 size_t peer_key_length)
Gilles Peskine01d718c2018-09-18 12:01:02 +02006664{
6665 psa_status_t status;
Aditya Deshpande2f7fd762022-11-22 11:10:34 +00006666 uint8_t shared_secret[PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE];
Gilles Peskine01d718c2018-09-18 12:01:02 +02006667 size_t shared_secret_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01006668 psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE(operation->alg);
Gilles Peskine01d718c2018-09-18 12:01:02 +02006669
6670 /* Step 1: run the secret agreement algorithm to generate the shared
6671 * secret. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006672 status = psa_key_agreement_raw_internal(ka_alg,
6673 private_key,
6674 peer_key, peer_key_length,
6675 shared_secret,
6676 sizeof(shared_secret),
6677 &shared_secret_length);
6678 if (status != PSA_SUCCESS) {
Gilles Peskine12313cd2018-06-20 00:20:32 +02006679 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006680 }
Gilles Peskine12313cd2018-06-20 00:20:32 +02006681
Gilles Peskineb0b255c2018-07-06 17:01:38 +02006682 /* Step 2: set up the key derivation to generate key material from
Gilles Peskine224b0d62019-09-23 18:13:17 +02006683 * the shared secret. A shared secret is permitted wherever a key
6684 * of type DERIVE is permitted. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006685 status = psa_key_derivation_input_internal(operation, step,
6686 PSA_KEY_TYPE_DERIVE,
6687 shared_secret,
6688 shared_secret_length);
Gilles Peskine12313cd2018-06-20 00:20:32 +02006689exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01006690 mbedtls_platform_zeroize(shared_secret, shared_secret_length);
6691 return status;
Gilles Peskine12313cd2018-06-20 00:20:32 +02006692}
6693
Gilles Peskine449bd832023-01-11 14:50:10 +01006694psa_status_t psa_key_derivation_key_agreement(psa_key_derivation_operation_t *operation,
6695 psa_key_derivation_step_t step,
6696 mbedtls_svc_key_id_t private_key,
6697 const uint8_t *peer_key,
6698 size_t peer_key_length)
Gilles Peskine12313cd2018-06-20 00:20:32 +02006699{
Ronald Cronf95a2b12020-10-22 15:24:49 +02006700 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01006701 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01006702 psa_key_slot_t *slot;
Ronald Cronf95a2b12020-10-22 15:24:49 +02006703
Gilles Peskine449bd832023-01-11 14:50:10 +01006704 if (!PSA_ALG_IS_KEY_AGREEMENT(operation->alg)) {
6705 return PSA_ERROR_INVALID_ARGUMENT;
6706 }
Ronald Cron5c522922020-11-14 16:35:34 +01006707 status = psa_get_and_lock_transparent_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01006708 private_key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg);
6709 if (status != PSA_SUCCESS) {
6710 return status;
6711 }
6712 status = psa_key_agreement_internal(operation, step,
6713 slot,
6714 peer_key, peer_key_length);
6715 if (status != PSA_SUCCESS) {
6716 psa_key_derivation_abort(operation);
6717 } else {
Steven Cooremanfa5e6312020-10-15 17:07:12 +02006718 /* If a private key has been added as SECRET, we allow the derived
6719 * key material to be used as a key in PSA Crypto. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006720 if (step == PSA_KEY_DERIVATION_INPUT_SECRET) {
Steven Cooremanfa5e6312020-10-15 17:07:12 +02006721 operation->can_output_key = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01006722 }
Steven Cooremanfa5e6312020-10-15 17:07:12 +02006723 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02006724
Gilles Peskine449bd832023-01-11 14:50:10 +01006725 unlock_status = psa_unlock_key_slot(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02006726
Gilles Peskine449bd832023-01-11 14:50:10 +01006727 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskineaf3baab2018-06-27 22:55:52 +02006728}
6729
Gilles Peskine449bd832023-01-11 14:50:10 +01006730psa_status_t psa_raw_key_agreement(psa_algorithm_t alg,
6731 mbedtls_svc_key_id_t private_key,
6732 const uint8_t *peer_key,
6733 size_t peer_key_length,
6734 uint8_t *output,
6735 size_t output_size,
6736 size_t *output_length)
Gilles Peskine0216fe12019-04-11 21:23:21 +02006737{
Ronald Cronf95a2b12020-10-22 15:24:49 +02006738 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01006739 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cronf95a2b12020-10-22 15:24:49 +02006740 psa_key_slot_t *slot = NULL;
Gilles Peskine0216fe12019-04-11 21:23:21 +02006741
Gilles Peskine449bd832023-01-11 14:50:10 +01006742 if (!PSA_ALG_IS_KEY_AGREEMENT(alg)) {
Gilles Peskine0216fe12019-04-11 21:23:21 +02006743 status = PSA_ERROR_INVALID_ARGUMENT;
6744 goto exit;
6745 }
Ronald Cron5c522922020-11-14 16:35:34 +01006746 status = psa_get_and_lock_transparent_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01006747 private_key, &slot, PSA_KEY_USAGE_DERIVE, alg);
6748 if (status != PSA_SUCCESS) {
Gilles Peskine0216fe12019-04-11 21:23:21 +02006749 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006750 }
Gilles Peskine0216fe12019-04-11 21:23:21 +02006751
Gilles Peskine3e561302022-04-14 00:17:15 +02006752 /* PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() is in general an upper bound
6753 * for the output size. The PSA specification only guarantees that this
6754 * function works if output_size >= PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE(...),
6755 * but it might be nice to allow smaller buffers if the output fits.
6756 * At the time of writing this comment, with only ECDH implemented,
6757 * PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() is exact so the point is moot.
6758 * If FFDH is implemented, PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() can easily
6759 * be exact for it as well. */
6760 size_t expected_length =
Gilles Peskine449bd832023-01-11 14:50:10 +01006761 PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE(slot->attr.type, slot->attr.bits);
6762 if (output_size < expected_length) {
Gilles Peskine3e561302022-04-14 00:17:15 +02006763 status = PSA_ERROR_BUFFER_TOO_SMALL;
6764 goto exit;
6765 }
6766
Gilles Peskine449bd832023-01-11 14:50:10 +01006767 status = psa_key_agreement_raw_internal(alg, slot,
6768 peer_key, peer_key_length,
6769 output, output_size,
6770 output_length);
Gilles Peskine0216fe12019-04-11 21:23:21 +02006771
6772exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01006773 if (status != PSA_SUCCESS) {
Gilles Peskine0216fe12019-04-11 21:23:21 +02006774 /* If an error happens and is not handled properly, the output
6775 * may be used as a key to protect sensitive data. Arrange for such
6776 * a key to be random, which is likely to result in decryption or
6777 * verification errors. This is better than filling the buffer with
6778 * some constant data such as zeros, which would result in the data
6779 * being protected with a reproducible, easily knowable key.
6780 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006781 psa_generate_random(output, output_size);
Gilles Peskine0216fe12019-04-11 21:23:21 +02006782 *output_length = output_size;
6783 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02006784
Gilles Peskine449bd832023-01-11 14:50:10 +01006785 unlock_status = psa_unlock_key_slot(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02006786
Gilles Peskine449bd832023-01-11 14:50:10 +01006787 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine0216fe12019-04-11 21:23:21 +02006788}
Gilles Peskine86a440b2018-11-12 18:39:40 +01006789
6790
Gilles Peskine30524eb2020-11-13 17:02:26 +01006791
Gilles Peskine86a440b2018-11-12 18:39:40 +01006792/****************************************************************/
6793/* Random generation */
Gilles Peskine53d991e2018-07-12 01:14:59 +02006794/****************************************************************/
Gilles Peskine12313cd2018-06-20 00:20:32 +02006795
Gilles Peskine30524eb2020-11-13 17:02:26 +01006796/** Initialize the PSA random generator.
6797 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006798static void mbedtls_psa_random_init(mbedtls_psa_random_context_t *rng)
Gilles Peskine30524eb2020-11-13 17:02:26 +01006799{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01006800#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
Gilles Peskine449bd832023-01-11 14:50:10 +01006801 memset(rng, 0, sizeof(*rng));
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01006802#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
6803
Gilles Peskine30524eb2020-11-13 17:02:26 +01006804 /* Set default configuration if
6805 * mbedtls_psa_crypto_configure_entropy_sources() hasn't been called. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006806 if (rng->entropy_init == NULL) {
Gilles Peskine30524eb2020-11-13 17:02:26 +01006807 rng->entropy_init = mbedtls_entropy_init;
Gilles Peskine449bd832023-01-11 14:50:10 +01006808 }
6809 if (rng->entropy_free == NULL) {
Gilles Peskine30524eb2020-11-13 17:02:26 +01006810 rng->entropy_free = mbedtls_entropy_free;
Gilles Peskine449bd832023-01-11 14:50:10 +01006811 }
Gilles Peskine30524eb2020-11-13 17:02:26 +01006812
Gilles Peskine449bd832023-01-11 14:50:10 +01006813 rng->entropy_init(&rng->entropy);
Gilles Peskine30524eb2020-11-13 17:02:26 +01006814#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \
6815 defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES)
6816 /* The PSA entropy injection feature depends on using NV seed as an entropy
6817 * source. Add NV seed as an entropy source for PSA entropy injection. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006818 mbedtls_entropy_add_source(&rng->entropy,
6819 mbedtls_nv_seed_poll, NULL,
6820 MBEDTLS_ENTROPY_BLOCK_SIZE,
6821 MBEDTLS_ENTROPY_SOURCE_STRONG);
Gilles Peskine30524eb2020-11-13 17:02:26 +01006822#endif
6823
Gilles Peskine449bd832023-01-11 14:50:10 +01006824 mbedtls_psa_drbg_init(MBEDTLS_PSA_RANDOM_STATE);
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01006825#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01006826}
6827
6828/** Deinitialize the PSA random generator.
6829 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006830static void mbedtls_psa_random_free(mbedtls_psa_random_context_t *rng)
Gilles Peskine30524eb2020-11-13 17:02:26 +01006831{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01006832#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
Gilles Peskine449bd832023-01-11 14:50:10 +01006833 memset(rng, 0, sizeof(*rng));
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01006834#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine449bd832023-01-11 14:50:10 +01006835 mbedtls_psa_drbg_free(MBEDTLS_PSA_RANDOM_STATE);
6836 rng->entropy_free(&rng->entropy);
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01006837#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01006838}
6839
6840/** Seed the PSA random generator.
6841 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006842static psa_status_t mbedtls_psa_random_seed(mbedtls_psa_random_context_t *rng)
Gilles Peskine30524eb2020-11-13 17:02:26 +01006843{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01006844#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
6845 /* Do nothing: the external RNG seeds itself. */
6846 (void) rng;
Gilles Peskine449bd832023-01-11 14:50:10 +01006847 return PSA_SUCCESS;
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01006848#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01006849 const unsigned char drbg_seed[] = "PSA";
Gilles Peskine449bd832023-01-11 14:50:10 +01006850 int ret = mbedtls_psa_drbg_seed(&rng->entropy,
6851 drbg_seed, sizeof(drbg_seed) - 1);
6852 return mbedtls_to_psa_error(ret);
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01006853#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01006854}
6855
Gilles Peskine449bd832023-01-11 14:50:10 +01006856psa_status_t psa_generate_random(uint8_t *output,
6857 size_t output_size)
Gilles Peskinee59236f2018-01-27 23:32:46 +01006858{
Gilles Peskinee59236f2018-01-27 23:32:46 +01006859 GUARD_MODULE_INITIALIZED;
6860
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01006861#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
6862
6863 size_t output_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01006864 psa_status_t status = mbedtls_psa_external_get_random(&global_data.rng,
6865 output, output_size,
6866 &output_length);
6867 if (status != PSA_SUCCESS) {
6868 return status;
6869 }
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01006870 /* Breaking up a request into smaller chunks is currently not supported
Tom Cosgrove1797b052022-12-04 17:19:59 +00006871 * for the external RNG interface. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006872 if (output_length != output_size) {
6873 return PSA_ERROR_INSUFFICIENT_ENTROPY;
6874 }
6875 return PSA_SUCCESS;
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01006876
6877#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
6878
Gilles Peskine449bd832023-01-11 14:50:10 +01006879 while (output_size > 0) {
Gilles Peskine71ddab92021-01-04 21:01:07 +01006880 size_t request_size =
Gilles Peskine449bd832023-01-11 14:50:10 +01006881 (output_size > MBEDTLS_PSA_RANDOM_MAX_REQUEST ?
6882 MBEDTLS_PSA_RANDOM_MAX_REQUEST :
6883 output_size);
6884 int ret = mbedtls_psa_get_random(MBEDTLS_PSA_RANDOM_STATE,
6885 output, request_size);
6886 if (ret != 0) {
6887 return mbedtls_to_psa_error(ret);
6888 }
Gilles Peskine71ddab92021-01-04 21:01:07 +01006889 output_size -= request_size;
6890 output += request_size;
Gilles Peskinef181eca2019-08-07 13:49:00 +02006891 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006892 return PSA_SUCCESS;
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01006893#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskinee59236f2018-01-27 23:32:46 +01006894}
6895
Gilles Peskine8814fc42020-12-14 15:33:44 +01006896/* Wrapper function allowing the classic API to use the PSA RNG.
Gilles Peskine9c3e0602021-01-05 16:03:55 +01006897 *
6898 * `mbedtls_psa_get_random(MBEDTLS_PSA_RANDOM_STATE, ...)` calls
6899 * `psa_generate_random(...)`. The state parameter is ignored since the
6900 * PSA API doesn't support passing an explicit state.
6901 *
6902 * In the non-external case, psa_generate_random() calls an
6903 * `mbedtls_xxx_drbg_random` function which has exactly the same signature
6904 * and semantics as mbedtls_psa_get_random(). As an optimization,
6905 * instead of doing this back-and-forth between the PSA API and the
6906 * classic API, psa_crypto_random_impl.h defines `mbedtls_psa_get_random`
6907 * as a constant function pointer to `mbedtls_xxx_drbg_random`.
Gilles Peskine8814fc42020-12-14 15:33:44 +01006908 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006909#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
6910int mbedtls_psa_get_random(void *p_rng,
6911 unsigned char *output,
6912 size_t output_size)
Gilles Peskine8814fc42020-12-14 15:33:44 +01006913{
Gilles Peskine9c3e0602021-01-05 16:03:55 +01006914 /* This function takes a pointer to the RNG state because that's what
6915 * classic mbedtls functions using an RNG expect. The PSA RNG manages
6916 * its own state internally and doesn't let the caller access that state.
6917 * So we just ignore the state parameter, and in practice we'll pass
6918 * NULL. */
Gilles Peskine8814fc42020-12-14 15:33:44 +01006919 (void) p_rng;
Gilles Peskine449bd832023-01-11 14:50:10 +01006920 psa_status_t status = psa_generate_random(output, output_size);
6921 if (status == PSA_SUCCESS) {
6922 return 0;
6923 } else {
6924 return MBEDTLS_ERR_ENTROPY_SOURCE_FAILED;
6925 }
Gilles Peskine8814fc42020-12-14 15:33:44 +01006926}
6927#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
6928
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01006929#if defined(MBEDTLS_PSA_INJECT_ENTROPY)
Chris Jonesea0a8652021-03-09 19:11:19 +00006930#include "entropy_poll.h"
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01006931
Gilles Peskine449bd832023-01-11 14:50:10 +01006932psa_status_t mbedtls_psa_inject_entropy(const uint8_t *seed,
6933 size_t seed_size)
Netanel Gonen2bcd3122018-11-19 11:53:02 +02006934{
Gilles Peskine449bd832023-01-11 14:50:10 +01006935 if (global_data.initialized) {
6936 return PSA_ERROR_NOT_PERMITTED;
6937 }
Netanel Gonen21f37cb2018-11-19 11:53:55 +02006938
Gilles Peskine449bd832023-01-11 14:50:10 +01006939 if (((seed_size < MBEDTLS_ENTROPY_MIN_PLATFORM) ||
6940 (seed_size < MBEDTLS_ENTROPY_BLOCK_SIZE)) ||
6941 (seed_size > MBEDTLS_ENTROPY_MAX_SEED_SIZE)) {
6942 return PSA_ERROR_INVALID_ARGUMENT;
6943 }
Netanel Gonen21f37cb2018-11-19 11:53:55 +02006944
Gilles Peskine449bd832023-01-11 14:50:10 +01006945 return mbedtls_psa_storage_inject_entropy(seed, seed_size);
Netanel Gonen2bcd3122018-11-19 11:53:02 +02006946}
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01006947#endif /* MBEDTLS_PSA_INJECT_ENTROPY */
Netanel Gonen2bcd3122018-11-19 11:53:02 +02006948
Ronald Cron3772afe2021-02-08 16:10:05 +01006949/** Validate the key type and size for key generation
Ronald Cron01b2aba2020-10-05 09:42:02 +02006950 *
Ronald Cron3772afe2021-02-08 16:10:05 +01006951 * \param type The key type
6952 * \param bits The number of bits of the key
Ronald Cron01b2aba2020-10-05 09:42:02 +02006953 *
6954 * \retval #PSA_SUCCESS
Ronald Cron3772afe2021-02-08 16:10:05 +01006955 * The key type and size are valid.
Ronald Cron01b2aba2020-10-05 09:42:02 +02006956 * \retval #PSA_ERROR_INVALID_ARGUMENT
6957 * The size in bits of the key is not valid.
6958 * \retval #PSA_ERROR_NOT_SUPPORTED
6959 * The type and/or the size in bits of the key or the combination of
6960 * the two is not supported.
6961 */
Ronald Cron3772afe2021-02-08 16:10:05 +01006962static psa_status_t psa_validate_key_type_and_size_for_key_generation(
Gilles Peskine449bd832023-01-11 14:50:10 +01006963 psa_key_type_t type, size_t bits)
Gilles Peskinee59236f2018-01-27 23:32:46 +01006964{
Ronald Cronf3bb7612020-10-02 20:11:59 +02006965 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinee59236f2018-01-27 23:32:46 +01006966
Gilles Peskine449bd832023-01-11 14:50:10 +01006967 if (key_type_is_raw_bytes(type)) {
6968 status = psa_validate_unstructured_key_bit_size(type, bits);
6969 if (status != PSA_SUCCESS) {
6970 return status;
6971 }
6972 } else
Ronald Cron5c4d3862020-12-07 11:07:24 +01006973#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR)
Gilles Peskine449bd832023-01-11 14:50:10 +01006974 if (PSA_KEY_TYPE_IS_RSA(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
6975 if (bits > PSA_VENDOR_RSA_MAX_KEY_BITS) {
6976 return PSA_ERROR_NOT_SUPPORTED;
6977 }
Steven Cooreman81be2fa2020-07-24 22:04:59 +02006978
Ronald Cron01b2aba2020-10-05 09:42:02 +02006979 /* Accept only byte-aligned keys, for the same reasons as
6980 * in psa_import_rsa_key(). */
Gilles Peskine449bd832023-01-11 14:50:10 +01006981 if (bits % 8 != 0) {
6982 return PSA_ERROR_NOT_SUPPORTED;
6983 }
6984 } else
Ronald Cron5c4d3862020-12-07 11:07:24 +01006985#endif /* defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR) */
Ronald Cron01b2aba2020-10-05 09:42:02 +02006986
Ronald Cron5c4d3862020-12-07 11:07:24 +01006987#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR)
Gilles Peskine449bd832023-01-11 14:50:10 +01006988 if (PSA_KEY_TYPE_IS_ECC(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
Ronald Crond81ab562021-02-16 09:01:16 +01006989 /* To avoid empty block, return successfully here. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006990 return PSA_SUCCESS;
6991 } else
Ronald Cron5c4d3862020-12-07 11:07:24 +01006992#endif /* defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) */
Przemek Stekielfedd1342022-12-01 15:00:02 +01006993
Przemek Stekiel6d85afa2023-04-28 11:42:17 +02006994#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR)
Przemek Stekielfedd1342022-12-01 15:00:02 +01006995 if (PSA_KEY_TYPE_IS_DH(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
Przemek Stekield1cf1ba2023-04-27 12:04:21 +02006996 if (psa_is_dh_key_size_valid(bits) == 0) {
Przemek Stekielfedd1342022-12-01 15:00:02 +01006997 return PSA_ERROR_NOT_SUPPORTED;
6998 }
6999 } else
Przemek Stekiel6d85afa2023-04-28 11:42:17 +02007000#endif /* defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR) */
Ronald Cron01b2aba2020-10-05 09:42:02 +02007001 {
Gilles Peskine449bd832023-01-11 14:50:10 +01007002 return PSA_ERROR_NOT_SUPPORTED;
Ronald Cron01b2aba2020-10-05 09:42:02 +02007003 }
7004
Gilles Peskine449bd832023-01-11 14:50:10 +01007005 return PSA_SUCCESS;
Ronald Cron01b2aba2020-10-05 09:42:02 +02007006}
7007
Ronald Cron55ed0592020-10-05 10:30:40 +02007008psa_status_t psa_generate_key_internal(
Ronald Cron2a38a6b2020-10-02 20:02:04 +02007009 const psa_key_attributes_t *attributes,
Gilles Peskine449bd832023-01-11 14:50:10 +01007010 uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length)
Ronald Cron01b2aba2020-10-05 09:42:02 +02007011{
7012 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron2a38a6b2020-10-02 20:02:04 +02007013 psa_key_type_t type = attributes->core.type;
Ronald Cron01b2aba2020-10-05 09:42:02 +02007014
Gilles Peskine449bd832023-01-11 14:50:10 +01007015 if ((attributes->domain_parameters == NULL) &&
7016 (attributes->domain_parameters_size != 0)) {
7017 return PSA_ERROR_INVALID_ARGUMENT;
7018 }
Ronald Cron01b2aba2020-10-05 09:42:02 +02007019
Gilles Peskine449bd832023-01-11 14:50:10 +01007020 if (key_type_is_raw_bytes(type)) {
7021 status = psa_generate_random(key_buffer, key_buffer_size);
7022 if (status != PSA_SUCCESS) {
7023 return status;
7024 }
Steven Cooreman81be2fa2020-07-24 22:04:59 +02007025
David Brown12ca5032021-02-11 11:02:00 -07007026#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Gilles Peskine449bd832023-01-11 14:50:10 +01007027 if (type == PSA_KEY_TYPE_DES) {
7028 psa_des_set_key_parity(key_buffer, key_buffer_size);
7029 }
David Brown8107e312021-02-12 08:08:46 -07007030#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */
Gilles Peskine449bd832023-01-11 14:50:10 +01007031 } else
Gilles Peskinee59236f2018-01-27 23:32:46 +01007032
Jaeden Amero424fa932021-05-14 08:34:32 +01007033#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) && \
7034 defined(MBEDTLS_GENPRIME)
Gilles Peskine449bd832023-01-11 14:50:10 +01007035 if (type == PSA_KEY_TYPE_RSA_KEY_PAIR) {
7036 return mbedtls_psa_rsa_generate_key(attributes,
7037 key_buffer,
7038 key_buffer_size,
7039 key_buffer_length);
7040 } else
Jaeden Amero424fa932021-05-14 08:34:32 +01007041#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR)
7042 * defined(MBEDTLS_GENPRIME) */
Gilles Peskinee59236f2018-01-27 23:32:46 +01007043
John Durkop9814fa22020-11-04 12:28:15 -08007044#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR)
Gilles Peskine449bd832023-01-11 14:50:10 +01007045 if (PSA_KEY_TYPE_IS_ECC(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
7046 return mbedtls_psa_ecp_generate_key(attributes,
7047 key_buffer,
7048 key_buffer_size,
7049 key_buffer_length);
7050 } else
John Durkop9814fa22020-11-04 12:28:15 -08007051#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) */
Przemek Stekielfedd1342022-12-01 15:00:02 +01007052
Przemek Stekiel6d85afa2023-04-28 11:42:17 +02007053#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR)
Przemek Stekielfedd1342022-12-01 15:00:02 +01007054 if (PSA_KEY_TYPE_IS_DH(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
7055 return mbedtls_psa_ffdh_generate_key(attributes,
7056 key_buffer,
7057 key_buffer_size,
7058 key_buffer_length);
7059 } else
Przemek Stekiel6d85afa2023-04-28 11:42:17 +02007060#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR) */
Steven Cooreman29149862020-08-05 15:43:42 +02007061 {
Gilles Peskine449bd832023-01-11 14:50:10 +01007062 (void) key_buffer_length;
7063 return PSA_ERROR_NOT_SUPPORTED;
Steven Cooreman29149862020-08-05 15:43:42 +02007064 }
Gilles Peskinee59236f2018-01-27 23:32:46 +01007065
Gilles Peskine449bd832023-01-11 14:50:10 +01007066 return PSA_SUCCESS;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02007067}
Darryl Green0c6575a2018-11-07 16:05:30 +00007068
Gilles Peskine449bd832023-01-11 14:50:10 +01007069psa_status_t psa_generate_key(const psa_key_attributes_t *attributes,
7070 mbedtls_svc_key_id_t *key)
Gilles Peskineff5f0e72019-04-18 12:53:30 +02007071{
7072 psa_status_t status;
7073 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02007074 psa_se_drv_table_entry_t *driver = NULL;
Ronald Cron2b56bc82020-10-05 10:02:26 +02007075 size_t key_buffer_size;
Gilles Peskine11792082019-08-06 18:36:36 +02007076
Ronald Cron81709fc2020-11-14 12:10:32 +01007077 *key = MBEDTLS_SVC_KEY_ID_INIT;
7078
Gilles Peskine0f84d622019-09-12 19:03:13 +02007079 /* Reject any attempt to create a zero-length key so that we don't
7080 * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007081 if (psa_get_key_bits(attributes) == 0) {
7082 return PSA_ERROR_INVALID_ARGUMENT;
7083 }
Gilles Peskine0f84d622019-09-12 19:03:13 +02007084
Przemyslaw Stekielc0fe8202021-10-07 11:08:56 +02007085 /* Reject any attempt to create a public key. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007086 if (PSA_KEY_TYPE_IS_PUBLIC_KEY(attributes->core.type)) {
7087 return PSA_ERROR_INVALID_ARGUMENT;
7088 }
Przemyslaw Stekielc0fe8202021-10-07 11:08:56 +02007089
Gilles Peskine449bd832023-01-11 14:50:10 +01007090 status = psa_start_key_creation(PSA_KEY_CREATION_GENERATE, attributes,
7091 &slot, &driver);
7092 if (status != PSA_SUCCESS) {
Gilles Peskine11792082019-08-06 18:36:36 +02007093 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007094 }
Gilles Peskine11792082019-08-06 18:36:36 +02007095
Ronald Cron977c2472020-10-13 08:32:21 +02007096 /* In the case of a transparent key or an opaque key stored in local
Archana449608b2021-09-08 15:36:05 +05307097 * storage ( thus not in the case of generating a key in a secure element
7098 * with storage ( MBEDTLS_PSA_CRYPTO_SE_C ) ),we have to allocate a
7099 * buffer to hold the generated key material. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007100 if (slot->key.data == NULL) {
7101 if (PSA_KEY_LIFETIME_GET_LOCATION(attributes->core.lifetime) ==
7102 PSA_KEY_LOCATION_LOCAL_STORAGE) {
Ronald Cron3772afe2021-02-08 16:10:05 +01007103 status = psa_validate_key_type_and_size_for_key_generation(
Gilles Peskine449bd832023-01-11 14:50:10 +01007104 attributes->core.type, attributes->core.bits);
7105 if (status != PSA_SUCCESS) {
Ronald Cron3772afe2021-02-08 16:10:05 +01007106 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007107 }
Ronald Cron3772afe2021-02-08 16:10:05 +01007108
7109 key_buffer_size = PSA_EXPORT_KEY_OUTPUT_SIZE(
Gilles Peskine449bd832023-01-11 14:50:10 +01007110 attributes->core.type,
7111 attributes->core.bits);
7112 } else {
Ronald Cron977c2472020-10-13 08:32:21 +02007113 status = psa_driver_wrapper_get_key_buffer_size(
Gilles Peskine449bd832023-01-11 14:50:10 +01007114 attributes, &key_buffer_size);
7115 if (status != PSA_SUCCESS) {
Ronald Cron3772afe2021-02-08 16:10:05 +01007116 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007117 }
Ronald Cron977c2472020-10-13 08:32:21 +02007118 }
Ronald Cron977c2472020-10-13 08:32:21 +02007119
Gilles Peskine449bd832023-01-11 14:50:10 +01007120 status = psa_allocate_buffer_to_slot(slot, key_buffer_size);
7121 if (status != PSA_SUCCESS) {
Ronald Cron977c2472020-10-13 08:32:21 +02007122 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007123 }
Ronald Cron977c2472020-10-13 08:32:21 +02007124 }
7125
Gilles Peskine449bd832023-01-11 14:50:10 +01007126 status = psa_driver_wrapper_generate_key(attributes,
7127 slot->key.data, slot->key.bytes, &slot->key.bytes);
Gilles Peskine11792082019-08-06 18:36:36 +02007128
Gilles Peskine449bd832023-01-11 14:50:10 +01007129 if (status != PSA_SUCCESS) {
7130 psa_remove_key_data_from_memory(slot);
7131 }
Ronald Cron2b56bc82020-10-05 10:02:26 +02007132
Gilles Peskine11792082019-08-06 18:36:36 +02007133exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01007134 if (status == PSA_SUCCESS) {
7135 status = psa_finish_key_creation(slot, driver, key);
7136 }
7137 if (status != PSA_SUCCESS) {
7138 psa_fail_key_creation(slot, driver);
7139 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02007140
Gilles Peskine449bd832023-01-11 14:50:10 +01007141 return status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01007142}
7143
Gilles Peskinee59236f2018-01-27 23:32:46 +01007144/****************************************************************/
7145/* Module setup */
7146/****************************************************************/
7147
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007148#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
Gilles Peskine5e769522018-11-20 21:59:56 +01007149psa_status_t mbedtls_psa_crypto_configure_entropy_sources(
Gilles Peskine449bd832023-01-11 14:50:10 +01007150 void (* entropy_init)(mbedtls_entropy_context *ctx),
7151 void (* entropy_free)(mbedtls_entropy_context *ctx))
Gilles Peskine5e769522018-11-20 21:59:56 +01007152{
Gilles Peskine449bd832023-01-11 14:50:10 +01007153 if (global_data.rng_state != RNG_NOT_INITIALIZED) {
7154 return PSA_ERROR_BAD_STATE;
7155 }
Gilles Peskine30524eb2020-11-13 17:02:26 +01007156 global_data.rng.entropy_init = entropy_init;
7157 global_data.rng.entropy_free = entropy_free;
Gilles Peskine449bd832023-01-11 14:50:10 +01007158 return PSA_SUCCESS;
Gilles Peskine5e769522018-11-20 21:59:56 +01007159}
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007160#endif /* !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) */
Gilles Peskine5e769522018-11-20 21:59:56 +01007161
Gilles Peskine449bd832023-01-11 14:50:10 +01007162void mbedtls_psa_crypto_free(void)
Gilles Peskinee59236f2018-01-27 23:32:46 +01007163{
Gilles Peskine449bd832023-01-11 14:50:10 +01007164 psa_wipe_all_key_slots();
7165 if (global_data.rng_state != RNG_NOT_INITIALIZED) {
7166 mbedtls_psa_random_free(&global_data.rng);
Gilles Peskinec6b69072018-11-20 21:42:52 +01007167 }
7168 /* Wipe all remaining data, including configuration.
7169 * In particular, this sets all state indicator to the value
7170 * indicating "uninitialized". */
Gilles Peskine449bd832023-01-11 14:50:10 +01007171 mbedtls_platform_zeroize(&global_data, sizeof(global_data));
Ronald Cron9ba76912021-04-10 16:57:30 +02007172
7173 /* Terminate drivers */
Gilles Peskine449bd832023-01-11 14:50:10 +01007174 psa_driver_wrapper_free();
Gilles Peskinee59236f2018-01-27 23:32:46 +01007175}
7176
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02007177#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
7178/** Recover a transaction that was interrupted by a power failure.
7179 *
7180 * This function is called during initialization, before psa_crypto_init()
7181 * returns. If this function returns a failure status, the initialization
7182 * fails.
7183 */
7184static psa_status_t psa_crypto_recover_transaction(
Gilles Peskine449bd832023-01-11 14:50:10 +01007185 const psa_crypto_transaction_t *transaction)
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02007186{
Gilles Peskine449bd832023-01-11 14:50:10 +01007187 switch (transaction->unknown.type) {
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02007188 case PSA_CRYPTO_TRANSACTION_CREATE_KEY:
7189 case PSA_CRYPTO_TRANSACTION_DESTROY_KEY:
Gilles Peskine449bd832023-01-11 14:50:10 +01007190 /* TODO - fall through to the failure case until this
7191 * is implemented.
7192 * https://github.com/ARMmbed/mbed-crypto/issues/218
7193 */
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02007194 default:
7195 /* We found an unsupported transaction in the storage.
7196 * We don't know what state the storage is in. Give up. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007197 return PSA_ERROR_DATA_INVALID;
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02007198 }
7199}
7200#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
7201
Gilles Peskine449bd832023-01-11 14:50:10 +01007202psa_status_t psa_crypto_init(void)
Gilles Peskinee59236f2018-01-27 23:32:46 +01007203{
Gilles Peskine66fb1262018-12-10 16:29:04 +01007204 psa_status_t status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01007205
Gilles Peskinec6b69072018-11-20 21:42:52 +01007206 /* Double initialization is explicitly allowed. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007207 if (global_data.initialized != 0) {
7208 return PSA_SUCCESS;
7209 }
Gilles Peskinee59236f2018-01-27 23:32:46 +01007210
Manuel Pégourié-Gonnard7abdf7e2023-03-09 11:17:43 +01007211 /* Init drivers */
7212 status = psa_driver_wrapper_init();
7213 if (status != PSA_SUCCESS) {
7214 goto exit;
7215 }
7216 global_data.drivers_initialized = 1;
7217
Gilles Peskine30524eb2020-11-13 17:02:26 +01007218 /* Initialize and seed the random generator. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007219 mbedtls_psa_random_init(&global_data.rng);
Gilles Peskinec6b69072018-11-20 21:42:52 +01007220 global_data.rng_state = RNG_INITIALIZED;
Gilles Peskine449bd832023-01-11 14:50:10 +01007221 status = mbedtls_psa_random_seed(&global_data.rng);
7222 if (status != PSA_SUCCESS) {
Gilles Peskinee59236f2018-01-27 23:32:46 +01007223 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007224 }
Gilles Peskinec6b69072018-11-20 21:42:52 +01007225 global_data.rng_state = RNG_SEEDED;
Gilles Peskinee59236f2018-01-27 23:32:46 +01007226
Gilles Peskine449bd832023-01-11 14:50:10 +01007227 status = psa_initialize_key_slots();
7228 if (status != PSA_SUCCESS) {
Gilles Peskine66fb1262018-12-10 16:29:04 +01007229 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007230 }
Gilles Peskinec6b69072018-11-20 21:42:52 +01007231
Gilles Peskine4b734222019-07-24 15:56:31 +02007232#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
Gilles Peskine449bd832023-01-11 14:50:10 +01007233 status = psa_crypto_load_transaction();
7234 if (status == PSA_SUCCESS) {
7235 status = psa_crypto_recover_transaction(&psa_crypto_transaction);
7236 if (status != PSA_SUCCESS) {
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02007237 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007238 }
7239 status = psa_crypto_stop_transaction();
7240 } else if (status == PSA_ERROR_DOES_NOT_EXIST) {
Gilles Peskinefc762652019-07-22 19:30:34 +02007241 /* There's no transaction to complete. It's all good. */
7242 status = PSA_SUCCESS;
7243 }
Gilles Peskine4b734222019-07-24 15:56:31 +02007244#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
Gilles Peskinefc762652019-07-22 19:30:34 +02007245
Gilles Peskinec6b69072018-11-20 21:42:52 +01007246 /* All done. */
Gilles Peskinee59236f2018-01-27 23:32:46 +01007247 global_data.initialized = 1;
7248
7249exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01007250 if (status != PSA_SUCCESS) {
7251 mbedtls_psa_crypto_free();
7252 }
7253 return status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01007254}
7255
Przemek Stekielca8d2b22023-01-17 16:21:33 +01007256psa_status_t psa_crypto_driver_pake_get_password_len(
7257 const psa_crypto_driver_pake_inputs_t *inputs,
7258 size_t *password_len)
7259{
7260 if (inputs->password_len == 0) {
7261 return PSA_ERROR_BAD_STATE;
7262 }
7263
7264 *password_len = inputs->password_len;
7265
7266 return PSA_SUCCESS;
7267}
7268
7269psa_status_t psa_crypto_driver_pake_get_password(
7270 const psa_crypto_driver_pake_inputs_t *inputs,
7271 uint8_t *buffer, size_t buffer_size, size_t *buffer_length)
7272{
7273 if (inputs->password_len == 0) {
7274 return PSA_ERROR_BAD_STATE;
7275 }
7276
7277 if (buffer_size < inputs->password_len) {
7278 return PSA_ERROR_BUFFER_TOO_SMALL;
7279 }
7280
7281 memcpy(buffer, inputs->password, inputs->password_len);
7282 *buffer_length = inputs->password_len;
7283
7284 return PSA_SUCCESS;
7285}
7286
7287psa_status_t psa_crypto_driver_pake_get_role(
7288 const psa_crypto_driver_pake_inputs_t *inputs,
7289 psa_pake_role_t *role)
7290{
7291 if (inputs->role == PSA_PAKE_ROLE_NONE) {
7292 return PSA_ERROR_BAD_STATE;
7293 }
7294
7295 *role = inputs->role;
7296
7297 return PSA_SUCCESS;
7298}
7299
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007300psa_status_t psa_crypto_driver_pake_get_user_len(
7301 const psa_crypto_driver_pake_inputs_t *inputs,
7302 size_t *user_len)
7303{
7304 if (inputs->user_len == 0) {
7305 return PSA_ERROR_BAD_STATE;
7306 }
7307
7308 *user_len = inputs->user_len;
7309
7310 return PSA_SUCCESS;
7311}
7312
7313psa_status_t psa_crypto_driver_pake_get_user(
7314 const psa_crypto_driver_pake_inputs_t *inputs,
Przemek Stekielc0e62502023-03-14 11:49:36 +01007315 uint8_t *user_id, size_t user_id_size, size_t *user_id_len)
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007316{
7317 if (inputs->user_len == 0) {
7318 return PSA_ERROR_BAD_STATE;
7319 }
7320
Przemek Stekielc0e62502023-03-14 11:49:36 +01007321 if (user_id_size < inputs->user_len) {
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007322 return PSA_ERROR_BUFFER_TOO_SMALL;
7323 }
7324
Przemek Stekielc0e62502023-03-14 11:49:36 +01007325 memcpy(user_id, inputs->user, inputs->user_len);
7326 *user_id_len = inputs->user_len;
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007327
7328 return PSA_SUCCESS;
7329}
7330
7331psa_status_t psa_crypto_driver_pake_get_peer_len(
7332 const psa_crypto_driver_pake_inputs_t *inputs,
7333 size_t *peer_len)
7334{
7335 if (inputs->peer_len == 0) {
7336 return PSA_ERROR_BAD_STATE;
7337 }
7338
7339 *peer_len = inputs->peer_len;
7340
7341 return PSA_SUCCESS;
7342}
7343
7344psa_status_t psa_crypto_driver_pake_get_peer(
7345 const psa_crypto_driver_pake_inputs_t *inputs,
Przemek Stekielc0e62502023-03-14 11:49:36 +01007346 uint8_t *peer_id, size_t peer_id_size, size_t *peer_id_length)
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007347{
7348 if (inputs->peer_len == 0) {
7349 return PSA_ERROR_BAD_STATE;
7350 }
7351
Przemek Stekielc0e62502023-03-14 11:49:36 +01007352 if (peer_id_size < inputs->peer_len) {
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007353 return PSA_ERROR_BUFFER_TOO_SMALL;
7354 }
7355
Przemek Stekielc0e62502023-03-14 11:49:36 +01007356 memcpy(peer_id, inputs->peer, inputs->peer_len);
7357 *peer_id_length = inputs->peer_len;
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007358
7359 return PSA_SUCCESS;
7360}
7361
Przemek Stekielca8d2b22023-01-17 16:21:33 +01007362psa_status_t psa_crypto_driver_pake_get_cipher_suite(
7363 const psa_crypto_driver_pake_inputs_t *inputs,
7364 psa_pake_cipher_suite_t *cipher_suite)
7365{
7366 if (inputs->cipher_suite.algorithm == PSA_ALG_NONE) {
7367 return PSA_ERROR_BAD_STATE;
7368 }
7369
7370 *cipher_suite = inputs->cipher_suite;
7371
7372 return PSA_SUCCESS;
7373}
7374
Neil Armstronga7d08c32022-06-01 18:21:20 +02007375psa_status_t psa_pake_setup(
7376 psa_pake_operation_t *operation,
7377 const psa_pake_cipher_suite_t *cipher_suite)
7378{
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007379 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007380
Przemek Stekiel1c3cfb42023-01-26 10:35:02 +01007381 if (operation->stage != PSA_PAKE_OPERATION_STAGE_SETUP) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007382 status = PSA_ERROR_BAD_STATE;
7383 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007384 }
7385
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01007386 if (PSA_ALG_IS_PAKE(cipher_suite->algorithm) == 0 ||
Przemek Stekiel51eac532022-12-07 11:04:51 +01007387 PSA_ALG_IS_HASH(cipher_suite->hash) == 0) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007388 status = PSA_ERROR_INVALID_ARGUMENT;
7389 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007390 }
7391
Przemek Stekiel51eac532022-12-07 11:04:51 +01007392 memset(&operation->data.inputs, 0, sizeof(operation->data.inputs));
7393
Przemek Stekiele12ed362022-12-21 12:54:46 +01007394 operation->alg = cipher_suite->algorithm;
Przemek Stekiel656b2592023-03-22 13:15:33 +01007395 operation->primitive = PSA_PAKE_PRIMITIVE(cipher_suite->type,
7396 cipher_suite->family, cipher_suite->bits);
Przemek Stekiel51eac532022-12-07 11:04:51 +01007397 operation->data.inputs.cipher_suite = *cipher_suite;
7398
Przemek Stekiel4aa99402023-02-27 13:00:57 +01007399#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01007400 if (operation->alg == PSA_ALG_JPAKE) {
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01007401 psa_jpake_computation_stage_t *computation_stage =
Przemek Stekieldde6a912023-01-26 08:46:37 +01007402 &operation->computation_stage.jpake;
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01007403
Przemek Stekiele12ed362022-12-21 12:54:46 +01007404 computation_stage->state = PSA_PAKE_STATE_SETUP;
7405 computation_stage->sequence = PSA_PAKE_SEQ_INVALID;
7406 computation_stage->input_step = PSA_PAKE_STEP_X1_X2;
7407 computation_stage->output_step = PSA_PAKE_STEP_X1_X2;
Przemek Stekiel80a88492023-02-20 13:32:22 +01007408 } else
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007409#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiel80a88492023-02-20 13:32:22 +01007410 {
7411 status = PSA_ERROR_NOT_SUPPORTED;
7412 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01007413 }
7414
Przemek Stekiel1c3cfb42023-01-26 10:35:02 +01007415 operation->stage = PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS;
7416
Przemek Stekiel51eac532022-12-07 11:04:51 +01007417 return PSA_SUCCESS;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007418exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007419 psa_pake_abort(operation);
7420 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02007421}
7422
7423psa_status_t psa_pake_set_password_key(
7424 psa_pake_operation_t *operation,
7425 mbedtls_svc_key_id_t password)
7426{
Neil Armstrong5ae60962022-09-15 11:29:46 +02007427 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel6c764412022-11-22 14:05:12 +01007428 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
7429 psa_key_slot_t *slot = NULL;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007430
Przemek Stekiel51eac532022-12-07 11:04:51 +01007431 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007432 status = PSA_ERROR_BAD_STATE;
7433 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007434 }
7435
Przemek Stekiel6c764412022-11-22 14:05:12 +01007436 status = psa_get_and_lock_key_slot_with_policy(password, &slot,
7437 PSA_KEY_USAGE_DERIVE,
Przemek Stekield5d28a22023-01-26 10:46:05 +01007438 operation->alg);
Neil Armstrong5ae60962022-09-15 11:29:46 +02007439 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007440 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007441 }
7442
Przemek Stekiel6c764412022-11-22 14:05:12 +01007443 psa_key_attributes_t attributes = {
7444 .core = slot->attr
7445 };
Neil Armstrong5ae60962022-09-15 11:29:46 +02007446
Przemek Stekiel51eac532022-12-07 11:04:51 +01007447 psa_key_type_t type = psa_get_key_type(&attributes);
Neil Armstrong5ae60962022-09-15 11:29:46 +02007448
Przemek Stekiel51eac532022-12-07 11:04:51 +01007449 if (type != PSA_KEY_TYPE_PASSWORD &&
7450 type != PSA_KEY_TYPE_PASSWORD_HASH) {
7451 status = PSA_ERROR_INVALID_ARGUMENT;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007452 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007453 }
7454
Przemek Stekiel51eac532022-12-07 11:04:51 +01007455 operation->data.inputs.password = mbedtls_calloc(1, slot->key.bytes);
7456 if (operation->data.inputs.password == NULL) {
Przemek Stekiele12ed362022-12-21 12:54:46 +01007457 status = PSA_ERROR_INSUFFICIENT_MEMORY;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007458 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007459 }
7460
7461 memcpy(operation->data.inputs.password, slot->key.data, slot->key.bytes);
7462 operation->data.inputs.password_len = slot->key.bytes;
Przemek Stekiel9dd24402023-01-26 15:06:09 +01007463 operation->data.inputs.attributes = attributes;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007464exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007465 if (status != PSA_SUCCESS) {
7466 psa_pake_abort(operation);
7467 }
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007468 unlock_status = psa_unlock_key_slot(slot);
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007469 return (status == PSA_SUCCESS) ? unlock_status : status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02007470}
7471
7472psa_status_t psa_pake_set_user(
7473 psa_pake_operation_t *operation,
7474 const uint8_t *user_id,
7475 size_t user_id_len)
7476{
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007477 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007478
7479 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007480 status = PSA_ERROR_BAD_STATE;
7481 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007482 }
7483
Przemek Stekiel51eac532022-12-07 11:04:51 +01007484 if (user_id_len == 0) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007485 status = PSA_ERROR_INVALID_ARGUMENT;
7486 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007487 }
7488
Przemek Stekielf309d6b2023-03-10 09:54:45 +01007489 if (operation->data.inputs.user_len != 0) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007490 status = PSA_ERROR_BAD_STATE;
7491 goto exit;
7492 }
7493
Przemek Stekield7f6ad72023-03-06 13:39:52 +01007494 /* Allow only "client" or "server" values (temporary restriction). */
Przemek Stekielfde11282023-03-13 16:06:09 +01007495 if ((user_id_len != sizeof(jpake_server_id) ||
7496 memcmp(user_id, jpake_server_id, user_id_len) != 0) &&
7497 (user_id_len != sizeof(jpake_client_id) ||
7498 memcmp(user_id, jpake_client_id, user_id_len) != 0)) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007499 status = PSA_ERROR_NOT_SUPPORTED;
7500 goto exit;
7501 }
7502
Przemek Stekielf309d6b2023-03-10 09:54:45 +01007503 operation->data.inputs.user = mbedtls_calloc(1, user_id_len);
7504 if (operation->data.inputs.user == NULL) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007505 status = PSA_ERROR_INSUFFICIENT_MEMORY;
7506 goto exit;
7507 }
7508
Przemek Stekielf309d6b2023-03-10 09:54:45 +01007509 memcpy(operation->data.inputs.user, user_id, user_id_len);
7510 operation->data.inputs.user_len = user_id_len;
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007511
7512 return PSA_SUCCESS;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007513exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007514 psa_pake_abort(operation);
7515 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02007516}
7517
7518psa_status_t psa_pake_set_peer(
7519 psa_pake_operation_t *operation,
7520 const uint8_t *peer_id,
7521 size_t peer_id_len)
7522{
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007523 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007524
7525 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007526 status = PSA_ERROR_BAD_STATE;
7527 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007528 }
7529
Przemek Stekiel51eac532022-12-07 11:04:51 +01007530 if (peer_id_len == 0) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007531 status = PSA_ERROR_INVALID_ARGUMENT;
7532 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007533 }
7534
Przemek Stekielf309d6b2023-03-10 09:54:45 +01007535 if (operation->data.inputs.peer_len != 0) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007536 status = PSA_ERROR_BAD_STATE;
7537 goto exit;
7538 }
7539
Przemek Stekield7f6ad72023-03-06 13:39:52 +01007540 /* Allow only "client" or "server" values (temporary restriction). */
Przemek Stekielfde11282023-03-13 16:06:09 +01007541 if ((peer_id_len != sizeof(jpake_server_id) ||
7542 memcmp(peer_id, jpake_server_id, peer_id_len) != 0) &&
7543 (peer_id_len != sizeof(jpake_client_id) ||
7544 memcmp(peer_id, jpake_client_id, peer_id_len) != 0)) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007545 status = PSA_ERROR_NOT_SUPPORTED;
7546 goto exit;
7547 }
7548
Przemek Stekielf309d6b2023-03-10 09:54:45 +01007549 operation->data.inputs.peer = mbedtls_calloc(1, peer_id_len);
7550 if (operation->data.inputs.peer == NULL) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007551 status = PSA_ERROR_INSUFFICIENT_MEMORY;
7552 goto exit;
7553 }
7554
Przemek Stekielf309d6b2023-03-10 09:54:45 +01007555 memcpy(operation->data.inputs.peer, peer_id, peer_id_len);
7556 operation->data.inputs.peer_len = peer_id_len;
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007557
7558 return PSA_SUCCESS;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007559exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007560 psa_pake_abort(operation);
7561 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02007562}
7563
7564psa_status_t psa_pake_set_role(
7565 psa_pake_operation_t *operation,
7566 psa_pake_role_t role)
7567{
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007568 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007569
Przemek Stekiel51eac532022-12-07 11:04:51 +01007570 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007571 status = PSA_ERROR_BAD_STATE;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007572 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007573 }
7574
Przemek Stekiel09104b82023-03-06 14:11:51 +01007575 switch (operation->alg) {
7576#if defined(PSA_WANT_ALG_JPAKE)
7577 case PSA_ALG_JPAKE:
7578 if (role == PSA_PAKE_ROLE_NONE) {
7579 return PSA_SUCCESS;
7580 }
7581 status = PSA_ERROR_INVALID_ARGUMENT;
7582 break;
7583#endif
7584 default:
7585 (void) role;
7586 status = PSA_ERROR_NOT_SUPPORTED;
7587 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007588 }
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007589exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007590 psa_pake_abort(operation);
7591 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02007592}
7593
Przemek Stekielb09c4872023-01-17 12:05:38 +01007594/* Auxiliary function to convert core computation stage(step, sequence, state) to single driver step. */
Przemek Stekiel4aa99402023-02-27 13:00:57 +01007595#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiel251e86a2023-02-17 14:30:50 +01007596static psa_crypto_driver_pake_step_t convert_jpake_computation_stage_to_driver_step(
Przemek Stekieldde6a912023-01-26 08:46:37 +01007597 psa_jpake_computation_stage_t *stage)
Przemek Stekielb09c4872023-01-17 12:05:38 +01007598{
Przemek Stekieldde6a912023-01-26 08:46:37 +01007599 switch (stage->state) {
Przemek Stekielb09c4872023-01-17 12:05:38 +01007600 case PSA_PAKE_OUTPUT_X1_X2:
7601 case PSA_PAKE_INPUT_X1_X2:
Przemek Stekieldde6a912023-01-26 08:46:37 +01007602 switch (stage->sequence) {
Przemek Stekielb09c4872023-01-17 12:05:38 +01007603 case PSA_PAKE_X1_STEP_KEY_SHARE:
7604 return PSA_JPAKE_X1_STEP_KEY_SHARE;
Przemek Stekielb09c4872023-01-17 12:05:38 +01007605 case PSA_PAKE_X1_STEP_ZK_PUBLIC:
7606 return PSA_JPAKE_X1_STEP_ZK_PUBLIC;
Przemek Stekielb09c4872023-01-17 12:05:38 +01007607 case PSA_PAKE_X1_STEP_ZK_PROOF:
7608 return PSA_JPAKE_X1_STEP_ZK_PROOF;
Przemek Stekielb09c4872023-01-17 12:05:38 +01007609 case PSA_PAKE_X2_STEP_KEY_SHARE:
7610 return PSA_JPAKE_X2_STEP_KEY_SHARE;
Przemek Stekielb09c4872023-01-17 12:05:38 +01007611 case PSA_PAKE_X2_STEP_ZK_PUBLIC:
7612 return PSA_JPAKE_X2_STEP_ZK_PUBLIC;
Przemek Stekielb09c4872023-01-17 12:05:38 +01007613 case PSA_PAKE_X2_STEP_ZK_PROOF:
7614 return PSA_JPAKE_X2_STEP_ZK_PROOF;
Przemek Stekielb09c4872023-01-17 12:05:38 +01007615 default:
7616 return PSA_JPAKE_STEP_INVALID;
7617 }
7618 break;
7619 case PSA_PAKE_OUTPUT_X2S:
Przemek Stekieldde6a912023-01-26 08:46:37 +01007620 switch (stage->sequence) {
Przemek Stekielb09c4872023-01-17 12:05:38 +01007621 case PSA_PAKE_X1_STEP_KEY_SHARE:
7622 return PSA_JPAKE_X2S_STEP_KEY_SHARE;
Przemek Stekielb09c4872023-01-17 12:05:38 +01007623 case PSA_PAKE_X1_STEP_ZK_PUBLIC:
7624 return PSA_JPAKE_X2S_STEP_ZK_PUBLIC;
Przemek Stekielb09c4872023-01-17 12:05:38 +01007625 case PSA_PAKE_X1_STEP_ZK_PROOF:
7626 return PSA_JPAKE_X2S_STEP_ZK_PROOF;
Przemek Stekiel57580f22023-03-01 12:21:26 +01007627 default:
Przemek Stekielb09c4872023-01-17 12:05:38 +01007628 return PSA_JPAKE_STEP_INVALID;
7629 }
7630 break;
7631 case PSA_PAKE_INPUT_X4S:
Przemek Stekieldde6a912023-01-26 08:46:37 +01007632 switch (stage->sequence) {
Przemek Stekielb09c4872023-01-17 12:05:38 +01007633 case PSA_PAKE_X1_STEP_KEY_SHARE:
7634 return PSA_JPAKE_X4S_STEP_KEY_SHARE;
Przemek Stekielb09c4872023-01-17 12:05:38 +01007635 case PSA_PAKE_X1_STEP_ZK_PUBLIC:
7636 return PSA_JPAKE_X4S_STEP_ZK_PUBLIC;
Przemek Stekielb09c4872023-01-17 12:05:38 +01007637 case PSA_PAKE_X1_STEP_ZK_PROOF:
7638 return PSA_JPAKE_X4S_STEP_ZK_PROOF;
Przemek Stekiel57580f22023-03-01 12:21:26 +01007639 default:
Przemek Stekielb09c4872023-01-17 12:05:38 +01007640 return PSA_JPAKE_STEP_INVALID;
7641 }
7642 break;
7643 default:
7644 return PSA_JPAKE_STEP_INVALID;
7645 }
7646 return PSA_JPAKE_STEP_INVALID;
7647}
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007648#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekielb09c4872023-01-17 12:05:38 +01007649
Przemek Stekiel2797d372022-12-22 11:19:22 +01007650static psa_status_t psa_pake_complete_inputs(
7651 psa_pake_operation_t *operation)
7652{
Przemek Stekiel2797d372022-12-22 11:19:22 +01007653 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel18620a32023-01-17 16:34:52 +01007654 /* Create copy of the inputs on stack as inputs share memory
7655 with the driver context which will be setup by the driver. */
7656 psa_crypto_driver_pake_inputs_t inputs = operation->data.inputs;
Przemek Stekiel2797d372022-12-22 11:19:22 +01007657
Przemek Stekielfde11282023-03-13 16:06:09 +01007658 if (inputs.password_len == 0) {
Przemek Stekiel2797d372022-12-22 11:19:22 +01007659 return PSA_ERROR_BAD_STATE;
7660 }
7661
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007662 if (operation->alg == PSA_ALG_JPAKE) {
Przemek Stekielfde11282023-03-13 16:06:09 +01007663 if (inputs.user_len == 0 || inputs.peer_len == 0) {
7664 return PSA_ERROR_BAD_STATE;
7665 }
7666 if (memcmp(inputs.user, jpake_client_id, inputs.user_len) == 0 &&
7667 memcmp(inputs.peer, jpake_server_id, inputs.peer_len) == 0) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007668 inputs.role = PSA_PAKE_ROLE_CLIENT;
7669 } else
Przemek Stekielfde11282023-03-13 16:06:09 +01007670 if (memcmp(inputs.user, jpake_server_id, inputs.user_len) == 0 &&
7671 memcmp(inputs.peer, jpake_client_id, inputs.peer_len) == 0) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007672 inputs.role = PSA_PAKE_ROLE_SERVER;
7673 }
7674
7675 if (inputs.role != PSA_PAKE_ROLE_CLIENT &&
7676 inputs.role != PSA_PAKE_ROLE_SERVER) {
7677 return PSA_ERROR_NOT_SUPPORTED;
7678 }
Przemek Stekieldff21d32023-02-14 20:09:10 +01007679 }
7680
Przemek Stekiel18620a32023-01-17 16:34:52 +01007681 /* Clear driver context */
7682 mbedtls_platform_zeroize(&operation->data, sizeof(operation->data));
7683
7684 status = psa_driver_wrapper_pake_setup(operation, &inputs);
Przemek Stekiel2797d372022-12-22 11:19:22 +01007685
7686 /* Driver is responsible for creating its own copy of the password. */
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01007687 mbedtls_platform_zeroize(inputs.password, inputs.password_len);
7688 mbedtls_free(inputs.password);
Przemek Stekiel2797d372022-12-22 11:19:22 +01007689
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007690 /* User and peer are translated to role. */
7691 mbedtls_free(inputs.user);
7692 mbedtls_free(inputs.peer);
7693
Przemek Stekiel2797d372022-12-22 11:19:22 +01007694 if (status == PSA_SUCCESS) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01007695#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiel2797d372022-12-22 11:19:22 +01007696 if (operation->alg == PSA_ALG_JPAKE) {
Przemek Stekield93de322023-02-24 08:39:04 +01007697 operation->stage = PSA_PAKE_OPERATION_STAGE_COMPUTATION;
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01007698 psa_jpake_computation_stage_t *computation_stage =
7699 &operation->computation_stage.jpake;
Przemek Stekiel2797d372022-12-22 11:19:22 +01007700 computation_stage->state = PSA_PAKE_STATE_READY;
7701 computation_stage->sequence = PSA_PAKE_SEQ_INVALID;
7702 computation_stage->input_step = PSA_PAKE_STEP_X1_X2;
7703 computation_stage->output_step = PSA_PAKE_STEP_X1_X2;
Przemek Stekiel80a88492023-02-20 13:32:22 +01007704 } else
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007705#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiel80a88492023-02-20 13:32:22 +01007706 {
7707 status = PSA_ERROR_NOT_SUPPORTED;
Przemek Stekiel2797d372022-12-22 11:19:22 +01007708 }
Przemek Stekiel2797d372022-12-22 11:19:22 +01007709 }
Przemek Stekiel2797d372022-12-22 11:19:22 +01007710 return status;
7711}
7712
Przemek Stekiel4aa99402023-02-27 13:00:57 +01007713#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01007714static psa_status_t psa_jpake_output_prologue(
7715 psa_pake_operation_t *operation,
7716 psa_pake_step_t step)
7717{
Przemek Stekiele12ed362022-12-21 12:54:46 +01007718 if (step != PSA_PAKE_STEP_KEY_SHARE &&
7719 step != PSA_PAKE_STEP_ZK_PUBLIC &&
7720 step != PSA_PAKE_STEP_ZK_PROOF) {
7721 return PSA_ERROR_INVALID_ARGUMENT;
7722 }
7723
Przemek Stekiel5eff1032023-02-21 19:10:36 +01007724 psa_jpake_computation_stage_t *computation_stage =
7725 &operation->computation_stage.jpake;
Przemek Stekiele12ed362022-12-21 12:54:46 +01007726
Przemek Stekiel5eff1032023-02-21 19:10:36 +01007727 if (computation_stage->state == PSA_PAKE_STATE_INVALID) {
7728 return PSA_ERROR_BAD_STATE;
7729 }
7730
7731 if (computation_stage->state != PSA_PAKE_STATE_READY &&
7732 computation_stage->state != PSA_PAKE_OUTPUT_X1_X2 &&
7733 computation_stage->state != PSA_PAKE_OUTPUT_X2S) {
7734 return PSA_ERROR_BAD_STATE;
7735 }
7736
7737 if (computation_stage->state == PSA_PAKE_STATE_READY) {
7738 if (step != PSA_PAKE_STEP_KEY_SHARE) {
Przemek Stekiele12ed362022-12-21 12:54:46 +01007739 return PSA_ERROR_BAD_STATE;
7740 }
7741
Przemek Stekiel5eff1032023-02-21 19:10:36 +01007742 switch (computation_stage->output_step) {
7743 case PSA_PAKE_STEP_X1_X2:
7744 computation_stage->state = PSA_PAKE_OUTPUT_X1_X2;
Przemek Stekiel80a88492023-02-20 13:32:22 +01007745 break;
Przemek Stekiel5eff1032023-02-21 19:10:36 +01007746 case PSA_PAKE_STEP_X2S:
7747 computation_stage->state = PSA_PAKE_OUTPUT_X2S;
Przemek Stekiel80a88492023-02-20 13:32:22 +01007748 break;
Przemek Stekiel80a88492023-02-20 13:32:22 +01007749 default:
Przemek Stekiele12ed362022-12-21 12:54:46 +01007750 return PSA_ERROR_BAD_STATE;
Przemek Stekiel80a88492023-02-20 13:32:22 +01007751 }
Przemek Stekiel5eff1032023-02-21 19:10:36 +01007752
7753 computation_stage->sequence = PSA_PAKE_X1_STEP_KEY_SHARE;
7754 }
7755
7756 /* Check if step matches current sequence */
7757 switch (computation_stage->sequence) {
7758 case PSA_PAKE_X1_STEP_KEY_SHARE:
7759 case PSA_PAKE_X2_STEP_KEY_SHARE:
7760 if (step != PSA_PAKE_STEP_KEY_SHARE) {
7761 return PSA_ERROR_BAD_STATE;
7762 }
7763 break;
7764
7765 case PSA_PAKE_X1_STEP_ZK_PUBLIC:
7766 case PSA_PAKE_X2_STEP_ZK_PUBLIC:
7767 if (step != PSA_PAKE_STEP_ZK_PUBLIC) {
7768 return PSA_ERROR_BAD_STATE;
7769 }
7770 break;
7771
7772 case PSA_PAKE_X1_STEP_ZK_PROOF:
7773 case PSA_PAKE_X2_STEP_ZK_PROOF:
7774 if (step != PSA_PAKE_STEP_ZK_PROOF) {
7775 return PSA_ERROR_BAD_STATE;
7776 }
7777 break;
7778
7779 default:
7780 return PSA_ERROR_BAD_STATE;
Przemek Stekiele12ed362022-12-21 12:54:46 +01007781 }
7782
7783 return PSA_SUCCESS;
7784}
7785
7786static psa_status_t psa_jpake_output_epilogue(
7787 psa_pake_operation_t *operation)
7788{
Przemek Stekiel5eff1032023-02-21 19:10:36 +01007789 psa_jpake_computation_stage_t *computation_stage =
7790 &operation->computation_stage.jpake;
Przemek Stekiele12ed362022-12-21 12:54:46 +01007791
Przemek Stekiel5eff1032023-02-21 19:10:36 +01007792 if ((computation_stage->state == PSA_PAKE_OUTPUT_X1_X2 &&
Przemek Stekiel083745e2023-02-23 17:28:23 +01007793 computation_stage->sequence == PSA_PAKE_X2_STEP_ZK_PROOF) ||
Przemek Stekiel5eff1032023-02-21 19:10:36 +01007794 (computation_stage->state == PSA_PAKE_OUTPUT_X2S &&
Przemek Stekiel083745e2023-02-23 17:28:23 +01007795 computation_stage->sequence == PSA_PAKE_X1_STEP_ZK_PROOF)) {
Przemek Stekiel5eff1032023-02-21 19:10:36 +01007796 computation_stage->state = PSA_PAKE_STATE_READY;
7797 computation_stage->output_step++;
7798 computation_stage->sequence = PSA_PAKE_SEQ_INVALID;
7799 } else {
7800 computation_stage->sequence++;
Przemek Stekiele12ed362022-12-21 12:54:46 +01007801 }
7802
7803 return PSA_SUCCESS;
7804}
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007805#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01007806
Neil Armstronga7d08c32022-06-01 18:21:20 +02007807psa_status_t psa_pake_output(
7808 psa_pake_operation_t *operation,
7809 psa_pake_step_t step,
7810 uint8_t *output,
7811 size_t output_size,
7812 size_t *output_length)
7813{
Przemek Stekiel51eac532022-12-07 11:04:51 +01007814 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel691e91a2023-03-07 16:26:37 +01007815 psa_crypto_driver_pake_step_t driver_step = PSA_JPAKE_STEP_INVALID;
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01007816 *output_length = 0;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007817
7818 if (operation->stage == PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel2797d372022-12-22 11:19:22 +01007819 status = psa_pake_complete_inputs(operation);
7820 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007821 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007822 }
7823 }
7824
7825 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COMPUTATION) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007826 status = PSA_ERROR_BAD_STATE;
7827 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007828 }
7829
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01007830 if (output_size == 0) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007831 status = PSA_ERROR_INVALID_ARGUMENT;
7832 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007833 }
7834
Przemek Stekiele12ed362022-12-21 12:54:46 +01007835 switch (operation->alg) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01007836#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01007837 case PSA_ALG_JPAKE:
7838 status = psa_jpake_output_prologue(operation, step);
7839 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007840 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01007841 }
Przemek Stekiel691e91a2023-03-07 16:26:37 +01007842 driver_step = convert_jpake_computation_stage_to_driver_step(
7843 &operation->computation_stage.jpake);
Przemek Stekiele12ed362022-12-21 12:54:46 +01007844 break;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007845#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01007846 default:
Przemek Stekiel80a88492023-02-20 13:32:22 +01007847 (void) step;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007848 status = PSA_ERROR_NOT_SUPPORTED;
7849 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01007850 }
7851
Przemek Stekiel691e91a2023-03-07 16:26:37 +01007852 status = psa_driver_wrapper_pake_output(operation, driver_step,
7853 output, output_size, output_length);
Przemek Stekiele12ed362022-12-21 12:54:46 +01007854
7855 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007856 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01007857 }
7858
7859 switch (operation->alg) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01007860#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01007861 case PSA_ALG_JPAKE:
7862 status = psa_jpake_output_epilogue(operation);
7863 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007864 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01007865 }
7866 break;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007867#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01007868 default:
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007869 status = PSA_ERROR_NOT_SUPPORTED;
7870 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01007871 }
7872
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007873 return PSA_SUCCESS;
7874exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007875 psa_pake_abort(operation);
7876 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02007877}
7878
Przemek Stekiel4aa99402023-02-27 13:00:57 +01007879#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01007880static psa_status_t psa_jpake_input_prologue(
7881 psa_pake_operation_t *operation,
Przemek Stekiel691e91a2023-03-07 16:26:37 +01007882 psa_pake_step_t step)
Przemek Stekiele12ed362022-12-21 12:54:46 +01007883{
Przemek Stekiele12ed362022-12-21 12:54:46 +01007884 if (step != PSA_PAKE_STEP_KEY_SHARE &&
7885 step != PSA_PAKE_STEP_ZK_PUBLIC &&
7886 step != PSA_PAKE_STEP_ZK_PROOF) {
7887 return PSA_ERROR_INVALID_ARGUMENT;
7888 }
7889
Przemek Stekiel5eff1032023-02-21 19:10:36 +01007890 psa_jpake_computation_stage_t *computation_stage =
7891 &operation->computation_stage.jpake;
Przemek Stekiele12ed362022-12-21 12:54:46 +01007892
Przemek Stekiel5eff1032023-02-21 19:10:36 +01007893 if (computation_stage->state == PSA_PAKE_STATE_INVALID) {
7894 return PSA_ERROR_BAD_STATE;
7895 }
7896
Przemek Stekiel5eff1032023-02-21 19:10:36 +01007897 if (computation_stage->state != PSA_PAKE_STATE_READY &&
7898 computation_stage->state != PSA_PAKE_INPUT_X1_X2 &&
7899 computation_stage->state != PSA_PAKE_INPUT_X4S) {
7900 return PSA_ERROR_BAD_STATE;
7901 }
7902
7903 if (computation_stage->state == PSA_PAKE_STATE_READY) {
7904 if (step != PSA_PAKE_STEP_KEY_SHARE) {
Przemek Stekiele12ed362022-12-21 12:54:46 +01007905 return PSA_ERROR_BAD_STATE;
7906 }
7907
Przemek Stekiel5eff1032023-02-21 19:10:36 +01007908 switch (computation_stage->input_step) {
7909 case PSA_PAKE_STEP_X1_X2:
7910 computation_stage->state = PSA_PAKE_INPUT_X1_X2;
Przemek Stekiel80a88492023-02-20 13:32:22 +01007911 break;
Przemek Stekiel5eff1032023-02-21 19:10:36 +01007912 case PSA_PAKE_STEP_X2S:
7913 computation_stage->state = PSA_PAKE_INPUT_X4S;
Przemek Stekiel80a88492023-02-20 13:32:22 +01007914 break;
Przemek Stekiel80a88492023-02-20 13:32:22 +01007915 default:
Przemek Stekiele12ed362022-12-21 12:54:46 +01007916 return PSA_ERROR_BAD_STATE;
Przemek Stekiel80a88492023-02-20 13:32:22 +01007917 }
Przemek Stekiel5eff1032023-02-21 19:10:36 +01007918
7919 computation_stage->sequence = PSA_PAKE_X1_STEP_KEY_SHARE;
7920 }
7921
7922 /* Check if step matches current sequence */
7923 switch (computation_stage->sequence) {
7924 case PSA_PAKE_X1_STEP_KEY_SHARE:
7925 case PSA_PAKE_X2_STEP_KEY_SHARE:
7926 if (step != PSA_PAKE_STEP_KEY_SHARE) {
7927 return PSA_ERROR_BAD_STATE;
7928 }
7929 break;
7930
7931 case PSA_PAKE_X1_STEP_ZK_PUBLIC:
7932 case PSA_PAKE_X2_STEP_ZK_PUBLIC:
7933 if (step != PSA_PAKE_STEP_ZK_PUBLIC) {
7934 return PSA_ERROR_BAD_STATE;
7935 }
7936 break;
7937
7938 case PSA_PAKE_X1_STEP_ZK_PROOF:
7939 case PSA_PAKE_X2_STEP_ZK_PROOF:
7940 if (step != PSA_PAKE_STEP_ZK_PROOF) {
7941 return PSA_ERROR_BAD_STATE;
7942 }
7943 break;
7944
7945 default:
7946 return PSA_ERROR_BAD_STATE;
Przemek Stekiele12ed362022-12-21 12:54:46 +01007947 }
7948
7949 return PSA_SUCCESS;
7950}
7951
Przemek Stekiele12ed362022-12-21 12:54:46 +01007952static psa_status_t psa_jpake_input_epilogue(
7953 psa_pake_operation_t *operation)
7954{
Przemek Stekiel5eff1032023-02-21 19:10:36 +01007955 psa_jpake_computation_stage_t *computation_stage =
7956 &operation->computation_stage.jpake;
Przemek Stekiele12ed362022-12-21 12:54:46 +01007957
Przemek Stekiel5eff1032023-02-21 19:10:36 +01007958 if ((computation_stage->state == PSA_PAKE_INPUT_X1_X2 &&
Przemek Stekiel083745e2023-02-23 17:28:23 +01007959 computation_stage->sequence == PSA_PAKE_X2_STEP_ZK_PROOF) ||
Przemek Stekiel5eff1032023-02-21 19:10:36 +01007960 (computation_stage->state == PSA_PAKE_INPUT_X4S &&
Przemek Stekiel083745e2023-02-23 17:28:23 +01007961 computation_stage->sequence == PSA_PAKE_X1_STEP_ZK_PROOF)) {
Przemek Stekiel5eff1032023-02-21 19:10:36 +01007962 computation_stage->state = PSA_PAKE_STATE_READY;
7963 computation_stage->input_step++;
7964 computation_stage->sequence = PSA_PAKE_SEQ_INVALID;
7965 } else {
7966 computation_stage->sequence++;
Przemek Stekiele12ed362022-12-21 12:54:46 +01007967 }
7968
7969 return PSA_SUCCESS;
7970}
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007971#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01007972
Neil Armstronga7d08c32022-06-01 18:21:20 +02007973psa_status_t psa_pake_input(
7974 psa_pake_operation_t *operation,
7975 psa_pake_step_t step,
7976 const uint8_t *input,
7977 size_t input_length)
7978{
Przemek Stekiel51eac532022-12-07 11:04:51 +01007979 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel691e91a2023-03-07 16:26:37 +01007980 psa_crypto_driver_pake_step_t driver_step = PSA_JPAKE_STEP_INVALID;
Przemek Stekiel256c75d2023-03-23 14:09:34 +01007981 const size_t max_input_length = (size_t) PSA_PAKE_INPUT_SIZE(operation->alg,
7982 operation->primitive,
7983 step);
Przemek Stekiel51eac532022-12-07 11:04:51 +01007984
7985 if (operation->stage == PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel2797d372022-12-22 11:19:22 +01007986 status = psa_pake_complete_inputs(operation);
7987 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007988 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007989 }
7990 }
7991
7992 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COMPUTATION) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007993 status = PSA_ERROR_BAD_STATE;
7994 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007995 }
7996
Przemek Stekiel256c75d2023-03-23 14:09:34 +01007997 if (input_length == 0 || input_length > max_input_length) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007998 status = PSA_ERROR_INVALID_ARGUMENT;
7999 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008000 }
8001
Przemek Stekiele12ed362022-12-21 12:54:46 +01008002 switch (operation->alg) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008003#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008004 case PSA_ALG_JPAKE:
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008005 status = psa_jpake_input_prologue(operation, step);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008006 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008007 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008008 }
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008009 driver_step = convert_jpake_computation_stage_to_driver_step(
8010 &operation->computation_stage.jpake);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008011 break;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008012#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008013 default:
Przemek Stekiel80a88492023-02-20 13:32:22 +01008014 (void) step;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008015 status = PSA_ERROR_NOT_SUPPORTED;
8016 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008017 }
8018
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008019 status = psa_driver_wrapper_pake_input(operation, driver_step,
8020 input, input_length);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008021
8022 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008023 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008024 }
8025
8026 switch (operation->alg) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008027#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008028 case PSA_ALG_JPAKE:
8029 status = psa_jpake_input_epilogue(operation);
8030 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008031 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008032 }
8033 break;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008034#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008035 default:
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008036 status = PSA_ERROR_NOT_SUPPORTED;
8037 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008038 }
8039
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008040 return PSA_SUCCESS;
8041exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008042 psa_pake_abort(operation);
8043 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008044}
8045
8046psa_status_t psa_pake_get_implicit_key(
8047 psa_pake_operation_t *operation,
8048 psa_key_derivation_operation_t *output)
8049{
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01008050 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008051 psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel251e86a2023-02-17 14:30:50 +01008052 uint8_t shared_key[MBEDTLS_PSA_JPAKE_BUFFER_SIZE];
Przemek Stekiel0c781802022-11-29 14:53:13 +01008053 size_t shared_key_len = 0;
8054
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01008055 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COMPUTATION) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008056 status = PSA_ERROR_BAD_STATE;
8057 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008058 }
8059
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008060#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008061 if (operation->alg == PSA_ALG_JPAKE) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008062 psa_jpake_computation_stage_t *computation_stage =
Przemek Stekiel083745e2023-02-23 17:28:23 +01008063 &operation->computation_stage.jpake;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008064 if (computation_stage->input_step != PSA_PAKE_STEP_DERIVE ||
8065 computation_stage->output_step != PSA_PAKE_STEP_DERIVE) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008066 status = PSA_ERROR_BAD_STATE;
8067 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008068 }
Przemek Stekiel80a88492023-02-20 13:32:22 +01008069 } else
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008070#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiel80a88492023-02-20 13:32:22 +01008071 {
8072 status = PSA_ERROR_NOT_SUPPORTED;
8073 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008074 }
8075
Przemek Stekiel0c781802022-11-29 14:53:13 +01008076 status = psa_driver_wrapper_pake_get_implicit_key(operation,
8077 shared_key,
Przemek Stekiel6b648622023-02-19 22:55:33 +01008078 sizeof(shared_key),
Przemek Stekiel0c781802022-11-29 14:53:13 +01008079 &shared_key_len);
8080
8081 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008082 goto exit;
Przemek Stekiel0c781802022-11-29 14:53:13 +01008083 }
8084
8085 status = psa_key_derivation_input_bytes(output,
8086 PSA_KEY_DERIVATION_INPUT_SECRET,
8087 shared_key,
8088 shared_key_len);
8089
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008090 mbedtls_platform_zeroize(shared_key, sizeof(shared_key));
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008091exit:
8092 abort_status = psa_pake_abort(operation);
8093 return status == PSA_SUCCESS ? abort_status : status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008094}
8095
8096psa_status_t psa_pake_abort(
8097 psa_pake_operation_t *operation)
8098{
Przemek Stekield69dca92023-01-31 19:59:20 +01008099 psa_status_t status = PSA_SUCCESS;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008100
Przemek Stekield69dca92023-01-31 19:59:20 +01008101 if (operation->stage == PSA_PAKE_OPERATION_STAGE_COMPUTATION) {
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01008102 status = psa_driver_wrapper_pake_abort(operation);
Neil Armstrong5ae60962022-09-15 11:29:46 +02008103 }
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01008104
Przemek Stekiel26c909d2023-02-28 12:34:03 +01008105 if (operation->stage == PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
8106 if (operation->data.inputs.password != NULL) {
8107 mbedtls_platform_zeroize(operation->data.inputs.password,
Przemek Stekielaa183422023-03-06 14:21:44 +01008108 operation->data.inputs.password_len);
Przemek Stekiel26c909d2023-02-28 12:34:03 +01008109 mbedtls_free(operation->data.inputs.password);
8110 }
8111 if (operation->data.inputs.user != NULL) {
8112 mbedtls_free(operation->data.inputs.user);
8113 }
8114 if (operation->data.inputs.peer != NULL) {
8115 mbedtls_free(operation->data.inputs.peer);
8116 }
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01008117 }
Przemek Stekield69dca92023-01-31 19:59:20 +01008118 memset(operation, 0, sizeof(psa_pake_operation_t));
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01008119
Przemek Stekield69dca92023-01-31 19:59:20 +01008120 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008121}
Neil Armstronga7d08c32022-06-01 18:21:20 +02008122
Gilles Peskinee59236f2018-01-27 23:32:46 +01008123#endif /* MBEDTLS_PSA_CRYPTO_C */