Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 1 | /* |
| 2 | * PSA RSA layer on top of Mbed TLS crypto |
| 3 | */ |
| 4 | /* |
| 5 | * Copyright The Mbed TLS Contributors |
| 6 | * SPDX-License-Identifier: Apache-2.0 |
| 7 | * |
| 8 | * Licensed under the Apache License, Version 2.0 (the "License"); you may |
| 9 | * not use this file except in compliance with the License. |
| 10 | * You may obtain a copy of the License at |
| 11 | * |
| 12 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 13 | * |
| 14 | * Unless required by applicable law or agreed to in writing, software |
| 15 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
| 16 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 17 | * See the License for the specific language governing permissions and |
| 18 | * limitations under the License. |
| 19 | */ |
| 20 | |
| 21 | #include "common.h" |
| 22 | |
| 23 | #if defined(MBEDTLS_PSA_CRYPTO_C) |
| 24 | |
| 25 | #include <psa/crypto.h> |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 26 | #include "psa/crypto_values.h" |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 27 | #include "psa_crypto_core.h" |
Ronald Cron | 9e18fc1 | 2020-11-05 17:36:40 +0100 | [diff] [blame] | 28 | #include "psa_crypto_random_impl.h" |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 29 | #include "psa_crypto_rsa.h" |
Steven Cooreman | 5f88e77 | 2021-03-15 11:07:12 +0100 | [diff] [blame] | 30 | #include "psa_crypto_hash.h" |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 31 | |
| 32 | #include <stdlib.h> |
| 33 | #include <string.h> |
| 34 | #include "mbedtls/platform.h" |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 35 | |
| 36 | #include <mbedtls/rsa.h> |
| 37 | #include <mbedtls/error.h> |
| 38 | #include <mbedtls/pk.h> |
Dave Rodgman | 3b5e6f0 | 2021-04-06 17:58:16 +0100 | [diff] [blame] | 39 | #include "pk_wrap.h" |
Manuel Pégourié-Gonnard | 4772884 | 2022-07-18 13:00:40 +0200 | [diff] [blame] | 40 | #include "hash_info.h" |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 41 | |
| 42 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \ |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 43 | defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) || \ |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 44 | defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \ |
| 45 | defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) || \ |
| 46 | defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \ |
| 47 | defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 48 | |
| 49 | /* Mbed TLS doesn't support non-byte-aligned key sizes (i.e. key sizes |
| 50 | * that are not a multiple of 8) well. For example, there is only |
| 51 | * mbedtls_rsa_get_len(), which returns a number of bytes, and no |
| 52 | * way to return the exact bit size of a key. |
| 53 | * To keep things simple, reject non-byte-aligned key sizes. */ |
| 54 | static psa_status_t psa_check_rsa_key_byte_aligned( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 55 | const mbedtls_rsa_context *rsa) |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 56 | { |
| 57 | mbedtls_mpi n; |
| 58 | psa_status_t status; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 59 | mbedtls_mpi_init(&n); |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 60 | status = mbedtls_to_psa_error( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 61 | mbedtls_rsa_export(rsa, &n, NULL, NULL, NULL, NULL)); |
| 62 | if (status == PSA_SUCCESS) { |
| 63 | if (mbedtls_mpi_bitlen(&n) % 8 != 0) { |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 64 | status = PSA_ERROR_NOT_SUPPORTED; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 65 | } |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 66 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 67 | mbedtls_mpi_free(&n); |
| 68 | return status; |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 69 | } |
| 70 | |
| 71 | psa_status_t mbedtls_psa_rsa_load_representation( |
| 72 | psa_key_type_t type, const uint8_t *data, size_t data_length, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 73 | mbedtls_rsa_context **p_rsa) |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 74 | { |
| 75 | psa_status_t status; |
| 76 | mbedtls_pk_context ctx; |
| 77 | size_t bits; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 78 | mbedtls_pk_init(&ctx); |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 79 | |
| 80 | /* Parse the data. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 81 | if (PSA_KEY_TYPE_IS_KEY_PAIR(type)) { |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 82 | status = mbedtls_to_psa_error( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 83 | mbedtls_pk_parse_key(&ctx, data, data_length, NULL, 0, |
| 84 | mbedtls_psa_get_random, MBEDTLS_PSA_RANDOM_STATE)); |
| 85 | } else { |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 86 | status = mbedtls_to_psa_error( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 87 | mbedtls_pk_parse_public_key(&ctx, data, data_length)); |
| 88 | } |
| 89 | if (status != PSA_SUCCESS) { |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 90 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 91 | } |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 92 | |
| 93 | /* We have something that the pkparse module recognizes. If it is a |
| 94 | * valid RSA key, store it. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 95 | if (mbedtls_pk_get_type(&ctx) != MBEDTLS_PK_RSA) { |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 96 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 97 | goto exit; |
| 98 | } |
| 99 | |
| 100 | /* The size of an RSA key doesn't have to be a multiple of 8. Mbed TLS |
| 101 | * supports non-byte-aligned key sizes, but not well. For example, |
| 102 | * mbedtls_rsa_get_len() returns the key size in bytes, not in bits. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 103 | bits = PSA_BYTES_TO_BITS(mbedtls_rsa_get_len(mbedtls_pk_rsa(ctx))); |
| 104 | if (bits > PSA_VENDOR_RSA_MAX_KEY_BITS) { |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 105 | status = PSA_ERROR_NOT_SUPPORTED; |
| 106 | goto exit; |
| 107 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 108 | status = psa_check_rsa_key_byte_aligned(mbedtls_pk_rsa(ctx)); |
| 109 | if (status != PSA_SUCCESS) { |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 110 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 111 | } |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 112 | |
| 113 | /* Copy out the pointer to the RSA context, and reset the PK context |
| 114 | * such that pk_free doesn't free the RSA context we just grabbed. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 115 | *p_rsa = mbedtls_pk_rsa(ctx); |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 116 | ctx.pk_info = NULL; |
| 117 | |
| 118 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 119 | mbedtls_pk_free(&ctx); |
| 120 | return status; |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 121 | } |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 122 | #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 123 | * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) || |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 124 | * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || |
| 125 | * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) || |
| 126 | * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || |
| 127 | * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */ |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 128 | |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 129 | #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \ |
| 130 | defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) |
Ronald Cron | abf2aef | 2020-11-27 18:13:44 +0100 | [diff] [blame] | 131 | |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 132 | psa_status_t mbedtls_psa_rsa_import_key( |
Ronald Cron | abf2aef | 2020-11-27 18:13:44 +0100 | [diff] [blame] | 133 | const psa_key_attributes_t *attributes, |
| 134 | const uint8_t *data, size_t data_length, |
| 135 | uint8_t *key_buffer, size_t key_buffer_size, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 136 | size_t *key_buffer_length, size_t *bits) |
Ronald Cron | abf2aef | 2020-11-27 18:13:44 +0100 | [diff] [blame] | 137 | { |
| 138 | psa_status_t status; |
| 139 | mbedtls_rsa_context *rsa = NULL; |
| 140 | |
| 141 | /* Parse input */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 142 | status = mbedtls_psa_rsa_load_representation(attributes->core.type, |
| 143 | data, |
| 144 | data_length, |
| 145 | &rsa); |
| 146 | if (status != PSA_SUCCESS) { |
Ronald Cron | abf2aef | 2020-11-27 18:13:44 +0100 | [diff] [blame] | 147 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 148 | } |
Ronald Cron | abf2aef | 2020-11-27 18:13:44 +0100 | [diff] [blame] | 149 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 150 | *bits = (psa_key_bits_t) PSA_BYTES_TO_BITS(mbedtls_rsa_get_len(rsa)); |
Ronald Cron | abf2aef | 2020-11-27 18:13:44 +0100 | [diff] [blame] | 151 | |
| 152 | /* Re-export the data to PSA export format, such that we can store export |
| 153 | * representation in the key slot. Export representation in case of RSA is |
| 154 | * the smallest representation that's allowed as input, so a straight-up |
| 155 | * allocation of the same size as the input buffer will be large enough. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 156 | status = mbedtls_psa_rsa_export_key(attributes->core.type, |
| 157 | rsa, |
| 158 | key_buffer, |
| 159 | key_buffer_size, |
| 160 | key_buffer_length); |
Ronald Cron | abf2aef | 2020-11-27 18:13:44 +0100 | [diff] [blame] | 161 | exit: |
| 162 | /* Always free the RSA object */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 163 | mbedtls_rsa_free(rsa); |
| 164 | mbedtls_free(rsa); |
Ronald Cron | abf2aef | 2020-11-27 18:13:44 +0100 | [diff] [blame] | 165 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 166 | return status; |
Ronald Cron | abf2aef | 2020-11-27 18:13:44 +0100 | [diff] [blame] | 167 | } |
| 168 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 169 | psa_status_t mbedtls_psa_rsa_export_key(psa_key_type_t type, |
| 170 | mbedtls_rsa_context *rsa, |
| 171 | uint8_t *data, |
| 172 | size_t data_size, |
| 173 | size_t *data_length) |
Ronald Cron | e5ca3d8 | 2020-11-26 16:36:16 +0100 | [diff] [blame] | 174 | { |
| 175 | #if defined(MBEDTLS_PK_WRITE_C) |
| 176 | int ret; |
| 177 | mbedtls_pk_context pk; |
| 178 | uint8_t *pos = data + data_size; |
| 179 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 180 | mbedtls_pk_init(&pk); |
Ronald Cron | e5ca3d8 | 2020-11-26 16:36:16 +0100 | [diff] [blame] | 181 | pk.pk_info = &mbedtls_rsa_info; |
| 182 | pk.pk_ctx = rsa; |
| 183 | |
| 184 | /* PSA Crypto API defines the format of an RSA key as a DER-encoded |
| 185 | * representation of the non-encrypted PKCS#1 RSAPrivateKey for a |
| 186 | * private key and of the RFC3279 RSAPublicKey for a public key. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 187 | if (PSA_KEY_TYPE_IS_KEY_PAIR(type)) { |
| 188 | ret = mbedtls_pk_write_key_der(&pk, data, data_size); |
| 189 | } else { |
| 190 | ret = mbedtls_pk_write_pubkey(&pos, data, &pk); |
| 191 | } |
Ronald Cron | e5ca3d8 | 2020-11-26 16:36:16 +0100 | [diff] [blame] | 192 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 193 | if (ret < 0) { |
Ronald Cron | e5ca3d8 | 2020-11-26 16:36:16 +0100 | [diff] [blame] | 194 | /* Clean up in case pk_write failed halfway through. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 195 | memset(data, 0, data_size); |
| 196 | return mbedtls_to_psa_error(ret); |
Ronald Cron | e5ca3d8 | 2020-11-26 16:36:16 +0100 | [diff] [blame] | 197 | } |
| 198 | |
| 199 | /* The mbedtls_pk_xxx functions write to the end of the buffer. |
| 200 | * Move the data to the beginning and erase remaining data |
| 201 | * at the original location. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 202 | if (2 * (size_t) ret <= data_size) { |
| 203 | memcpy(data, data + data_size - ret, ret); |
| 204 | memset(data + data_size - ret, 0, ret); |
| 205 | } else if ((size_t) ret < data_size) { |
| 206 | memmove(data, data + data_size - ret, ret); |
| 207 | memset(data + ret, 0, data_size - ret); |
Ronald Cron | e5ca3d8 | 2020-11-26 16:36:16 +0100 | [diff] [blame] | 208 | } |
| 209 | |
| 210 | *data_length = ret; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 211 | return PSA_SUCCESS; |
Ronald Cron | e5ca3d8 | 2020-11-26 16:36:16 +0100 | [diff] [blame] | 212 | #else |
| 213 | (void) type; |
| 214 | (void) rsa; |
| 215 | (void) data; |
| 216 | (void) data_size; |
| 217 | (void) data_length; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 218 | return PSA_ERROR_NOT_SUPPORTED; |
Ronald Cron | e5ca3d8 | 2020-11-26 16:36:16 +0100 | [diff] [blame] | 219 | #endif /* MBEDTLS_PK_WRITE_C */ |
| 220 | } |
| 221 | |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 222 | psa_status_t mbedtls_psa_rsa_export_public_key( |
Ronald Cron | e5ca3d8 | 2020-11-26 16:36:16 +0100 | [diff] [blame] | 223 | const psa_key_attributes_t *attributes, |
| 224 | const uint8_t *key_buffer, size_t key_buffer_size, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 225 | uint8_t *data, size_t data_size, size_t *data_length) |
Ronald Cron | e5ca3d8 | 2020-11-26 16:36:16 +0100 | [diff] [blame] | 226 | { |
| 227 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 228 | mbedtls_rsa_context *rsa = NULL; |
| 229 | |
| 230 | status = mbedtls_psa_rsa_load_representation( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 231 | attributes->core.type, key_buffer, key_buffer_size, &rsa); |
| 232 | if (status != PSA_SUCCESS) { |
| 233 | return status; |
| 234 | } |
Ronald Cron | e5ca3d8 | 2020-11-26 16:36:16 +0100 | [diff] [blame] | 235 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 236 | status = mbedtls_psa_rsa_export_key(PSA_KEY_TYPE_RSA_PUBLIC_KEY, |
| 237 | rsa, |
| 238 | data, |
| 239 | data_size, |
| 240 | data_length); |
Ronald Cron | e5ca3d8 | 2020-11-26 16:36:16 +0100 | [diff] [blame] | 241 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 242 | mbedtls_rsa_free(rsa); |
| 243 | mbedtls_free(rsa); |
Ronald Cron | e5ca3d8 | 2020-11-26 16:36:16 +0100 | [diff] [blame] | 244 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 245 | return status; |
Ronald Cron | e5ca3d8 | 2020-11-26 16:36:16 +0100 | [diff] [blame] | 246 | } |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 247 | #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || |
| 248 | * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */ |
Ronald Cron | f1057d3 | 2020-11-26 19:19:10 +0100 | [diff] [blame] | 249 | |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 250 | #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) && \ |
Jaeden Amero | 424fa93 | 2021-05-14 08:34:32 +0100 | [diff] [blame] | 251 | defined(MBEDTLS_GENPRIME) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 252 | static psa_status_t psa_rsa_read_exponent(const uint8_t *domain_parameters, |
| 253 | size_t domain_parameters_size, |
| 254 | int *exponent) |
Ronald Cron | 9e18fc1 | 2020-11-05 17:36:40 +0100 | [diff] [blame] | 255 | { |
| 256 | size_t i; |
| 257 | uint32_t acc = 0; |
| 258 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 259 | if (domain_parameters_size == 0) { |
Ronald Cron | 9e18fc1 | 2020-11-05 17:36:40 +0100 | [diff] [blame] | 260 | *exponent = 65537; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 261 | return PSA_SUCCESS; |
Ronald Cron | 9e18fc1 | 2020-11-05 17:36:40 +0100 | [diff] [blame] | 262 | } |
| 263 | |
| 264 | /* Mbed TLS encodes the public exponent as an int. For simplicity, only |
| 265 | * support values that fit in a 32-bit integer, which is larger than |
| 266 | * int on just about every platform anyway. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 267 | if (domain_parameters_size > sizeof(acc)) { |
| 268 | return PSA_ERROR_NOT_SUPPORTED; |
| 269 | } |
| 270 | for (i = 0; i < domain_parameters_size; i++) { |
| 271 | acc = (acc << 8) | domain_parameters[i]; |
| 272 | } |
| 273 | if (acc > INT_MAX) { |
| 274 | return PSA_ERROR_NOT_SUPPORTED; |
| 275 | } |
Ronald Cron | 9e18fc1 | 2020-11-05 17:36:40 +0100 | [diff] [blame] | 276 | *exponent = acc; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 277 | return PSA_SUCCESS; |
Ronald Cron | 9e18fc1 | 2020-11-05 17:36:40 +0100 | [diff] [blame] | 278 | } |
| 279 | |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 280 | psa_status_t mbedtls_psa_rsa_generate_key( |
Ronald Cron | 9e18fc1 | 2020-11-05 17:36:40 +0100 | [diff] [blame] | 281 | const psa_key_attributes_t *attributes, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 282 | uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length) |
Ronald Cron | 9e18fc1 | 2020-11-05 17:36:40 +0100 | [diff] [blame] | 283 | { |
| 284 | psa_status_t status; |
| 285 | mbedtls_rsa_context rsa; |
| 286 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
| 287 | int exponent; |
| 288 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 289 | status = psa_rsa_read_exponent(attributes->domain_parameters, |
| 290 | attributes->domain_parameters_size, |
| 291 | &exponent); |
| 292 | if (status != PSA_SUCCESS) { |
| 293 | return status; |
| 294 | } |
Ronald Cron | 9e18fc1 | 2020-11-05 17:36:40 +0100 | [diff] [blame] | 295 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 296 | mbedtls_rsa_init(&rsa); |
| 297 | ret = mbedtls_rsa_gen_key(&rsa, |
| 298 | mbedtls_psa_get_random, |
| 299 | MBEDTLS_PSA_RANDOM_STATE, |
| 300 | (unsigned int) attributes->core.bits, |
| 301 | exponent); |
| 302 | if (ret != 0) { |
| 303 | return mbedtls_to_psa_error(ret); |
| 304 | } |
Ronald Cron | 9e18fc1 | 2020-11-05 17:36:40 +0100 | [diff] [blame] | 305 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 306 | status = mbedtls_psa_rsa_export_key(attributes->core.type, |
| 307 | &rsa, key_buffer, key_buffer_size, |
| 308 | key_buffer_length); |
| 309 | mbedtls_rsa_free(&rsa); |
Ronald Cron | 9e18fc1 | 2020-11-05 17:36:40 +0100 | [diff] [blame] | 310 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 311 | return status; |
Ronald Cron | 9e18fc1 | 2020-11-05 17:36:40 +0100 | [diff] [blame] | 312 | } |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 313 | #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) |
Jaeden Amero | 424fa93 | 2021-05-14 08:34:32 +0100 | [diff] [blame] | 314 | * defined(MBEDTLS_GENPRIME) */ |
Ronald Cron | 9e18fc1 | 2020-11-05 17:36:40 +0100 | [diff] [blame] | 315 | |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 316 | /****************************************************************/ |
| 317 | /* Sign/verify hashes */ |
| 318 | /****************************************************************/ |
| 319 | |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 320 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \ |
| 321 | defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 322 | |
| 323 | /* Decode the hash algorithm from alg and store the mbedtls encoding in |
| 324 | * md_alg. Verify that the hash length is acceptable. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 325 | static psa_status_t psa_rsa_decode_md_type(psa_algorithm_t alg, |
| 326 | size_t hash_length, |
| 327 | mbedtls_md_type_t *md_alg) |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 328 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 329 | psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH(alg); |
| 330 | *md_alg = mbedtls_hash_info_md_from_psa(hash_alg); |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 331 | |
| 332 | /* The Mbed TLS RSA module uses an unsigned int for hash length |
| 333 | * parameters. Validate that it fits so that we don't risk an |
| 334 | * overflow later. */ |
| 335 | #if SIZE_MAX > UINT_MAX |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 336 | if (hash_length > UINT_MAX) { |
| 337 | return PSA_ERROR_INVALID_ARGUMENT; |
| 338 | } |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 339 | #endif |
| 340 | |
Janos Follath | 0af093b | 2021-06-07 14:34:10 +0100 | [diff] [blame] | 341 | /* For signatures using a hash, the hash length must be correct. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 342 | if (alg != PSA_ALG_RSA_PKCS1V15_SIGN_RAW) { |
| 343 | if (*md_alg == MBEDTLS_MD_NONE) { |
| 344 | return PSA_ERROR_NOT_SUPPORTED; |
| 345 | } |
| 346 | if (mbedtls_hash_info_get_size(*md_alg) != hash_length) { |
| 347 | return PSA_ERROR_INVALID_ARGUMENT; |
| 348 | } |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 349 | } |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 350 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 351 | return PSA_SUCCESS; |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 352 | } |
| 353 | |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 354 | psa_status_t mbedtls_psa_rsa_sign_hash( |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 355 | const psa_key_attributes_t *attributes, |
| 356 | const uint8_t *key_buffer, size_t key_buffer_size, |
| 357 | psa_algorithm_t alg, const uint8_t *hash, size_t hash_length, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 358 | uint8_t *signature, size_t signature_size, size_t *signature_length) |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 359 | { |
| 360 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 361 | mbedtls_rsa_context *rsa = NULL; |
| 362 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
| 363 | mbedtls_md_type_t md_alg; |
| 364 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 365 | status = mbedtls_psa_rsa_load_representation(attributes->core.type, |
| 366 | key_buffer, |
| 367 | key_buffer_size, |
| 368 | &rsa); |
| 369 | if (status != PSA_SUCCESS) { |
| 370 | return status; |
| 371 | } |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 372 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 373 | status = psa_rsa_decode_md_type(alg, hash_length, &md_alg); |
| 374 | if (status != PSA_SUCCESS) { |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 375 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 376 | } |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 377 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 378 | if (signature_size < mbedtls_rsa_get_len(rsa)) { |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 379 | status = PSA_ERROR_BUFFER_TOO_SMALL; |
| 380 | goto exit; |
| 381 | } |
| 382 | |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 383 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 384 | if (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg)) { |
| 385 | ret = mbedtls_rsa_set_padding(rsa, MBEDTLS_RSA_PKCS_V15, |
| 386 | MBEDTLS_MD_NONE); |
| 387 | if (ret == 0) { |
| 388 | ret = mbedtls_rsa_pkcs1_sign(rsa, |
| 389 | mbedtls_psa_get_random, |
| 390 | MBEDTLS_PSA_RANDOM_STATE, |
| 391 | md_alg, |
| 392 | (unsigned int) hash_length, |
| 393 | hash, |
| 394 | signature); |
Ronald Cron | ea7631b | 2021-06-03 18:51:59 +0200 | [diff] [blame] | 395 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 396 | } else |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 397 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN */ |
| 398 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 399 | if (PSA_ALG_IS_RSA_PSS(alg)) { |
| 400 | ret = mbedtls_rsa_set_padding(rsa, MBEDTLS_RSA_PKCS_V21, md_alg); |
Ronald Cron | ea7631b | 2021-06-03 18:51:59 +0200 | [diff] [blame] | 401 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 402 | if (ret == 0) { |
| 403 | ret = mbedtls_rsa_rsassa_pss_sign(rsa, |
| 404 | mbedtls_psa_get_random, |
| 405 | MBEDTLS_PSA_RANDOM_STATE, |
| 406 | MBEDTLS_MD_NONE, |
| 407 | (unsigned int) hash_length, |
| 408 | hash, |
| 409 | signature); |
Ronald Cron | ea7631b | 2021-06-03 18:51:59 +0200 | [diff] [blame] | 410 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 411 | } else |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 412 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS */ |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 413 | { |
| 414 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 415 | goto exit; |
| 416 | } |
| 417 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 418 | if (ret == 0) { |
| 419 | *signature_length = mbedtls_rsa_get_len(rsa); |
| 420 | } |
| 421 | status = mbedtls_to_psa_error(ret); |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 422 | |
| 423 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 424 | mbedtls_rsa_free(rsa); |
| 425 | mbedtls_free(rsa); |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 426 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 427 | return status; |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 428 | } |
| 429 | |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 430 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 431 | static int rsa_pss_expected_salt_len(psa_algorithm_t alg, |
| 432 | const mbedtls_rsa_context *rsa, |
| 433 | size_t hash_length) |
Gilles Peskine | b9b817e | 2021-10-04 22:15:05 +0200 | [diff] [blame] | 434 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 435 | if (PSA_ALG_IS_RSA_PSS_ANY_SALT(alg)) { |
| 436 | return MBEDTLS_RSA_SALT_LEN_ANY; |
| 437 | } |
Gilles Peskine | b9b817e | 2021-10-04 22:15:05 +0200 | [diff] [blame] | 438 | /* Otherwise: standard salt length, i.e. largest possible salt length |
| 439 | * up to the hash length. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 440 | int klen = (int) mbedtls_rsa_get_len(rsa); // known to fit |
Gilles Peskine | b9b817e | 2021-10-04 22:15:05 +0200 | [diff] [blame] | 441 | int hlen = (int) hash_length; // known to fit |
| 442 | int room = klen - 2 - hlen; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 443 | if (room < 0) { |
| 444 | return 0; // there is no valid signature in this case anyway |
| 445 | } else if (room > hlen) { |
| 446 | return hlen; |
| 447 | } else { |
| 448 | return room; |
| 449 | } |
Gilles Peskine | b9b817e | 2021-10-04 22:15:05 +0200 | [diff] [blame] | 450 | } |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 451 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS */ |
Gilles Peskine | b9b817e | 2021-10-04 22:15:05 +0200 | [diff] [blame] | 452 | |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 453 | psa_status_t mbedtls_psa_rsa_verify_hash( |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 454 | const psa_key_attributes_t *attributes, |
| 455 | const uint8_t *key_buffer, size_t key_buffer_size, |
| 456 | psa_algorithm_t alg, const uint8_t *hash, size_t hash_length, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 457 | const uint8_t *signature, size_t signature_length) |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 458 | { |
| 459 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 460 | mbedtls_rsa_context *rsa = NULL; |
| 461 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
| 462 | mbedtls_md_type_t md_alg; |
| 463 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 464 | status = mbedtls_psa_rsa_load_representation(attributes->core.type, |
| 465 | key_buffer, |
| 466 | key_buffer_size, |
| 467 | &rsa); |
| 468 | if (status != PSA_SUCCESS) { |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 469 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 470 | } |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 471 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 472 | status = psa_rsa_decode_md_type(alg, hash_length, &md_alg); |
| 473 | if (status != PSA_SUCCESS) { |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 474 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 475 | } |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 476 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 477 | if (signature_length != mbedtls_rsa_get_len(rsa)) { |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 478 | status = PSA_ERROR_INVALID_SIGNATURE; |
| 479 | goto exit; |
| 480 | } |
| 481 | |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 482 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 483 | if (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg)) { |
| 484 | ret = mbedtls_rsa_set_padding(rsa, MBEDTLS_RSA_PKCS_V15, |
| 485 | MBEDTLS_MD_NONE); |
| 486 | if (ret == 0) { |
| 487 | ret = mbedtls_rsa_pkcs1_verify(rsa, |
| 488 | md_alg, |
| 489 | (unsigned int) hash_length, |
| 490 | hash, |
| 491 | signature); |
Ronald Cron | ea7631b | 2021-06-03 18:51:59 +0200 | [diff] [blame] | 492 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 493 | } else |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 494 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN */ |
| 495 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 496 | if (PSA_ALG_IS_RSA_PSS(alg)) { |
| 497 | ret = mbedtls_rsa_set_padding(rsa, MBEDTLS_RSA_PKCS_V21, md_alg); |
| 498 | if (ret == 0) { |
| 499 | int slen = rsa_pss_expected_salt_len(alg, rsa, hash_length); |
| 500 | ret = mbedtls_rsa_rsassa_pss_verify_ext(rsa, |
| 501 | md_alg, |
| 502 | (unsigned) hash_length, |
| 503 | hash, |
| 504 | md_alg, |
| 505 | slen, |
| 506 | signature); |
Ronald Cron | ea7631b | 2021-06-03 18:51:59 +0200 | [diff] [blame] | 507 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 508 | } else |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 509 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS */ |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 510 | { |
| 511 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 512 | goto exit; |
| 513 | } |
| 514 | |
| 515 | /* Mbed TLS distinguishes "invalid padding" from "valid padding but |
| 516 | * the rest of the signature is invalid". This has little use in |
| 517 | * practice and PSA doesn't report this distinction. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 518 | status = (ret == MBEDTLS_ERR_RSA_INVALID_PADDING) ? |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 519 | PSA_ERROR_INVALID_SIGNATURE : |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 520 | mbedtls_to_psa_error(ret); |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 521 | |
| 522 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 523 | mbedtls_rsa_free(rsa); |
| 524 | mbedtls_free(rsa); |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 525 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 526 | return status; |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 527 | } |
| 528 | |
Ronald Cron | d2fb854 | 2020-12-09 15:18:01 +0100 | [diff] [blame] | 529 | #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || |
| 530 | * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */ |
| 531 | |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 532 | /****************************************************************/ |
| 533 | /* Asymmetric cryptography */ |
| 534 | /****************************************************************/ |
| 535 | |
| 536 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 537 | static int psa_rsa_oaep_set_padding_mode(psa_algorithm_t alg, |
| 538 | mbedtls_rsa_context *rsa) |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 539 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 540 | psa_algorithm_t hash_alg = PSA_ALG_RSA_OAEP_GET_HASH(alg); |
| 541 | mbedtls_md_type_t md_alg = mbedtls_hash_info_md_from_psa(hash_alg); |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 542 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 543 | return mbedtls_rsa_set_padding(rsa, MBEDTLS_RSA_PKCS_V21, md_alg); |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 544 | } |
| 545 | #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */ |
| 546 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 547 | psa_status_t mbedtls_psa_asymmetric_encrypt(const psa_key_attributes_t *attributes, |
| 548 | const uint8_t *key_buffer, |
| 549 | size_t key_buffer_size, |
| 550 | psa_algorithm_t alg, |
| 551 | const uint8_t *input, |
| 552 | size_t input_length, |
| 553 | const uint8_t *salt, |
| 554 | size_t salt_length, |
| 555 | uint8_t *output, |
| 556 | size_t output_size, |
| 557 | size_t *output_length) |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 558 | { |
| 559 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 560 | (void) key_buffer; |
| 561 | (void) key_buffer_size; |
| 562 | (void) input; |
| 563 | (void) input_length; |
| 564 | (void) salt; |
| 565 | (void) salt_length; |
| 566 | (void) output; |
| 567 | (void) output_size; |
| 568 | (void) output_length; |
| 569 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 570 | if (PSA_KEY_TYPE_IS_RSA(attributes->core.type)) { |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 571 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 572 | defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 573 | mbedtls_rsa_context *rsa = NULL; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 574 | status = mbedtls_psa_rsa_load_representation(attributes->core.type, |
| 575 | key_buffer, |
| 576 | key_buffer_size, |
| 577 | &rsa); |
| 578 | if (status != PSA_SUCCESS) { |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 579 | goto rsa_exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 580 | } |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 581 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 582 | if (output_size < mbedtls_rsa_get_len(rsa)) { |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 583 | status = PSA_ERROR_BUFFER_TOO_SMALL; |
| 584 | goto rsa_exit; |
| 585 | } |
| 586 | #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || |
| 587 | * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 588 | if (alg == PSA_ALG_RSA_PKCS1V15_CRYPT) { |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 589 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) |
| 590 | status = mbedtls_to_psa_error( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 591 | mbedtls_rsa_pkcs1_encrypt(rsa, |
| 592 | mbedtls_psa_get_random, |
| 593 | MBEDTLS_PSA_RANDOM_STATE, |
| 594 | input_length, |
| 595 | input, |
| 596 | output)); |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 597 | #else |
| 598 | status = PSA_ERROR_NOT_SUPPORTED; |
| 599 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 600 | } else |
| 601 | if (PSA_ALG_IS_RSA_OAEP(alg)) { |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 602 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) |
| 603 | status = mbedtls_to_psa_error( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 604 | psa_rsa_oaep_set_padding_mode(alg, rsa)); |
| 605 | if (status != PSA_SUCCESS) { |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 606 | goto rsa_exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 607 | } |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 608 | |
| 609 | status = mbedtls_to_psa_error( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 610 | mbedtls_rsa_rsaes_oaep_encrypt(rsa, |
| 611 | mbedtls_psa_get_random, |
| 612 | MBEDTLS_PSA_RANDOM_STATE, |
| 613 | salt, salt_length, |
| 614 | input_length, |
| 615 | input, |
| 616 | output)); |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 617 | #else |
| 618 | status = PSA_ERROR_NOT_SUPPORTED; |
| 619 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 620 | } else { |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 621 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 622 | } |
| 623 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 624 | defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 625 | rsa_exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 626 | if (status == PSA_SUCCESS) { |
| 627 | *output_length = mbedtls_rsa_get_len(rsa); |
| 628 | } |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 629 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 630 | mbedtls_rsa_free(rsa); |
| 631 | mbedtls_free(rsa); |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 632 | #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || |
| 633 | * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 634 | } else { |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 635 | status = PSA_ERROR_NOT_SUPPORTED; |
| 636 | } |
| 637 | |
| 638 | return status; |
| 639 | } |
| 640 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 641 | psa_status_t mbedtls_psa_asymmetric_decrypt(const psa_key_attributes_t *attributes, |
| 642 | const uint8_t *key_buffer, |
| 643 | size_t key_buffer_size, |
| 644 | psa_algorithm_t alg, |
| 645 | const uint8_t *input, |
| 646 | size_t input_length, |
| 647 | const uint8_t *salt, |
| 648 | size_t salt_length, |
| 649 | uint8_t *output, |
| 650 | size_t output_size, |
| 651 | size_t *output_length) |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 652 | { |
| 653 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 654 | (void) key_buffer; |
| 655 | (void) key_buffer_size; |
| 656 | (void) input; |
| 657 | (void) input_length; |
| 658 | (void) salt; |
| 659 | (void) salt_length; |
| 660 | (void) output; |
| 661 | (void) output_size; |
| 662 | (void) output_length; |
| 663 | |
| 664 | *output_length = 0; |
| 665 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 666 | if (attributes->core.type == PSA_KEY_TYPE_RSA_KEY_PAIR) { |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 667 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 668 | defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 669 | mbedtls_rsa_context *rsa = NULL; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 670 | status = mbedtls_psa_rsa_load_representation(attributes->core.type, |
| 671 | key_buffer, |
| 672 | key_buffer_size, |
| 673 | &rsa); |
| 674 | if (status != PSA_SUCCESS) { |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 675 | goto rsa_exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 676 | } |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 677 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 678 | if (input_length != mbedtls_rsa_get_len(rsa)) { |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 679 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 680 | goto rsa_exit; |
| 681 | } |
| 682 | #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || |
| 683 | * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */ |
| 684 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 685 | if (alg == PSA_ALG_RSA_PKCS1V15_CRYPT) { |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 686 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) |
| 687 | status = mbedtls_to_psa_error( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 688 | mbedtls_rsa_pkcs1_decrypt(rsa, |
| 689 | mbedtls_psa_get_random, |
| 690 | MBEDTLS_PSA_RANDOM_STATE, |
| 691 | output_length, |
| 692 | input, |
| 693 | output, |
| 694 | output_size)); |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 695 | #else |
| 696 | status = PSA_ERROR_NOT_SUPPORTED; |
| 697 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 698 | } else |
| 699 | if (PSA_ALG_IS_RSA_OAEP(alg)) { |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 700 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) |
| 701 | status = mbedtls_to_psa_error( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 702 | psa_rsa_oaep_set_padding_mode(alg, rsa)); |
| 703 | if (status != PSA_SUCCESS) { |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 704 | goto rsa_exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 705 | } |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 706 | |
| 707 | status = mbedtls_to_psa_error( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 708 | mbedtls_rsa_rsaes_oaep_decrypt(rsa, |
| 709 | mbedtls_psa_get_random, |
| 710 | MBEDTLS_PSA_RANDOM_STATE, |
| 711 | salt, salt_length, |
| 712 | output_length, |
| 713 | input, |
| 714 | output, |
| 715 | output_size)); |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 716 | #else |
| 717 | status = PSA_ERROR_NOT_SUPPORTED; |
| 718 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 719 | } else { |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 720 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 721 | } |
| 722 | |
| 723 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 724 | defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 725 | rsa_exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 726 | mbedtls_rsa_free(rsa); |
| 727 | mbedtls_free(rsa); |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 728 | #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || |
| 729 | * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame^] | 730 | } else { |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 731 | status = PSA_ERROR_NOT_SUPPORTED; |
| 732 | } |
| 733 | |
| 734 | return status; |
| 735 | } |
| 736 | |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 737 | #endif /* MBEDTLS_PSA_CRYPTO_C */ |