blob: 1f64500258e49f35487da291461939acc212dc85 [file] [log] [blame]
Gilles Peskinee59236f2018-01-27 23:32:46 +01001/*
2 * PSA crypto layer on top of Mbed TLS crypto
3 */
Bence Szépkúti86974652020-06-15 11:59:37 +02004/*
Bence Szépkúti1e148272020-08-07 13:07:28 +02005 * Copyright The Mbed TLS Contributors
Dave Rodgman16799db2023-11-02 19:47:20 +00006 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
Gilles Peskinee59236f2018-01-27 23:32:46 +01007 */
8
Gilles Peskinedb09ef62020-06-03 01:43:33 +02009#include "common.h"
Ronald Cronafbc7ed2023-01-24 16:02:04 +010010#include "psa_crypto_core_common.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010011
12#if defined(MBEDTLS_PSA_CRYPTO_C)
mohammad160327010052018-07-03 13:16:15 +030013
John Durkop07cc04a2020-11-16 22:08:34 -080014#if defined(MBEDTLS_PSA_CRYPTO_CONFIG)
15#include "check_crypto_config.h"
16#endif
17
Gilles Peskinee59236f2018-01-27 23:32:46 +010018#include "psa/crypto.h"
Przemyslaw Stekiel705fb0f2021-11-24 08:47:29 +010019#include "psa/crypto_values.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010020
Ronald Crond6d28882020-12-14 14:56:02 +010021#include "psa_crypto_cipher.h"
Gilles Peskine039b90c2018-12-07 18:24:41 +010022#include "psa_crypto_core.h"
Gilles Peskine5e769522018-11-20 21:59:56 +010023#include "psa_crypto_invasive.h"
Xiaokang Qiane9c39c42023-08-09 08:50:19 +000024#include "psa_crypto_driver_wrappers.h"
Xiaokang Qianfe9666b2023-09-11 10:36:20 +000025#include "psa_crypto_driver_wrappers_no_static.h"
Ronald Cron00b7bfc2020-11-25 15:25:26 +010026#include "psa_crypto_ecp.h"
Przemek Stekiel359f4622022-12-05 14:11:55 +010027#include "psa_crypto_ffdh.h"
Steven Cooreman5f88e772021-03-15 11:07:12 +010028#include "psa_crypto_hash.h"
Steven Cooreman82c66b62021-03-19 17:39:17 +010029#include "psa_crypto_mac.h"
Ronald Cron00b7bfc2020-11-25 15:25:26 +010030#include "psa_crypto_rsa.h"
Ronald Cron7023db52020-11-20 18:17:42 +010031#include "psa_crypto_ecp.h"
Gilles Peskinea8ade162019-06-26 11:24:49 +020032#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined0890212019-06-24 14:34:43 +020033#include "psa_crypto_se.h"
Gilles Peskinea8ade162019-06-26 11:24:49 +020034#endif
Gilles Peskine961849f2018-11-30 18:54:54 +010035#include "psa_crypto_slot_management.h"
Darryl Greend49a4992018-06-18 17:27:26 +010036/* Include internal declarations that are useful for implementing persistently
37 * stored keys. */
38#include "psa_crypto_storage.h"
39
Gilles Peskineb2b64d32020-12-14 16:43:58 +010040#include "psa_crypto_random_impl.h"
Gilles Peskine90edc992020-11-13 15:39:19 +010041
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010042#include <stdlib.h>
43#include <string.h>
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010044#include "mbedtls/platform.h"
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010045
Gilles Peskine1c49f1a2020-11-13 18:46:25 +010046#include "mbedtls/aes.h"
Gilles Peskine9a944802018-06-21 09:35:35 +020047#include "mbedtls/asn1.h"
Jaeden Amero25384a22019-01-10 10:23:21 +000048#include "mbedtls/asn1write.h"
Gilles Peskinea81d85b2018-06-26 16:10:23 +020049#include "mbedtls/bignum.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010050#include "mbedtls/camellia.h"
Gilles Peskine26869f22019-05-06 15:25:00 +020051#include "mbedtls/chacha20.h"
52#include "mbedtls/chachapoly.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010053#include "mbedtls/cipher.h"
54#include "mbedtls/ccm.h"
55#include "mbedtls/cmac.h"
Dave Rodgman78701152023-08-29 14:20:18 +010056#include "mbedtls/constant_time.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010057#include "mbedtls/des.h"
Gilles Peskineb7ecdf02018-09-18 12:11:27 +020058#include "mbedtls/ecdh.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010059#include "mbedtls/ecp.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010060#include "mbedtls/entropy.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010061#include "mbedtls/error.h"
62#include "mbedtls/gcm.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010063#include "mbedtls/md5.h"
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010064#include "mbedtls/pk.h"
Chris Jonesdaacb592021-03-09 17:03:29 +000065#include "pk_wrap.h"
Gilles Peskine3f108122018-12-07 18:14:53 +010066#include "mbedtls/platform_util.h"
Janos Follath24eed8d2019-11-22 13:21:35 +000067#include "mbedtls/error.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010068#include "mbedtls/ripemd160.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010069#include "mbedtls/rsa.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010070#include "mbedtls/sha1.h"
71#include "mbedtls/sha256.h"
72#include "mbedtls/sha512.h"
Manuel Pégourié-Gonnard02b10d82023-03-28 12:33:20 +020073#include "md_psa.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010074
Przemek Stekiel75fe3fb2022-06-09 14:44:55 +020075#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF) || \
76 defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) || \
77 defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Przemek Stekiel69c46792022-06-10 12:59:51 +020078#define BUILTIN_ALG_ANY_HKDF 1
Przemek Stekiel75fe3fb2022-06-09 14:44:55 +020079#endif
80
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010081/****************************************************************/
82/* Global data, support functions and library management */
83/****************************************************************/
84
Gilles Peskine449bd832023-01-11 14:50:10 +010085static int key_type_is_raw_bytes(psa_key_type_t type)
Gilles Peskine48c0ea12018-06-21 14:15:31 +020086{
Gilles Peskine449bd832023-01-11 14:50:10 +010087 return PSA_KEY_TYPE_IS_UNSTRUCTURED(type);
Gilles Peskine48c0ea12018-06-21 14:15:31 +020088}
89
Gilles Peskine5a3c50e2018-12-04 12:27:09 +010090/* Values for psa_global_data_t::rng_state */
91#define RNG_NOT_INITIALIZED 0
92#define RNG_INITIALIZED 1
93#define RNG_SEEDED 2
Gilles Peskinec6b69072018-11-20 21:42:52 +010094
Gilles Peskine449bd832023-01-11 14:50:10 +010095typedef struct {
Dave Rodgman864f5942023-08-16 18:04:44 +010096 uint8_t initialized;
97 uint8_t rng_state;
98 uint8_t drivers_initialized;
Gilles Peskine2d8a1822021-11-08 22:20:03 +010099 mbedtls_psa_random_context_t rng;
Gilles Peskinee59236f2018-01-27 23:32:46 +0100100} psa_global_data_t;
101
102static psa_global_data_t global_data;
103
Gilles Peskine5894e8e2020-12-14 14:54:06 +0100104#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
105mbedtls_psa_drbg_context_t *const mbedtls_psa_random_state =
106 &global_data.rng.drbg;
107#endif
108
itayzafrir0adf0fc2018-09-06 16:24:41 +0300109#define GUARD_MODULE_INITIALIZED \
Gilles Peskine449bd832023-01-11 14:50:10 +0100110 if (global_data.initialized == 0) \
111 return PSA_ERROR_BAD_STATE;
itayzafrir0adf0fc2018-09-06 16:24:41 +0300112
Manuel Pégourié-Gonnard7abdf7e2023-03-09 11:17:43 +0100113int psa_can_do_hash(psa_algorithm_t hash_alg)
114{
115 (void) hash_alg;
116 return global_data.drivers_initialized;
117}
Valerio Settia55f0422023-07-10 15:34:41 +0200118#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT) || \
Przemek Stekiel53410502023-04-28 13:18:43 +0200119 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) || \
Valerio Settia55f0422023-07-10 15:34:41 +0200120 defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE)
Przemek Stekiel134cc2e2023-05-05 10:13:37 +0200121static int psa_is_dh_key_size_valid(size_t bits)
122{
Przemek Stekield1cf1ba2023-04-27 12:04:21 +0200123 if (bits != 2048 && bits != 3072 && bits != 4096 &&
124 bits != 6144 && bits != 8192) {
125 return 0;
126 }
127
128 return 1;
129}
Valerio Settia55f0422023-07-10 15:34:41 +0200130#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT ||
Przemek Stekiel53410502023-04-28 13:18:43 +0200131 MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY ||
Valerio Settia55f0422023-07-10 15:34:41 +0200132 PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE */
Manuel Pégourié-Gonnard7abdf7e2023-03-09 11:17:43 +0100133
Gilles Peskine449bd832023-01-11 14:50:10 +0100134psa_status_t mbedtls_to_psa_error(int ret)
Gilles Peskinee59236f2018-01-27 23:32:46 +0100135{
Gilles Peskinedbf68962021-01-06 20:04:23 +0100136 /* Mbed TLS error codes can combine a high-level error code and a
137 * low-level error code. The low-level error usually reflects the
138 * root cause better, so dispatch on that preferably. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100139 int low_level_ret = -(-ret & 0x007f);
140 switch (low_level_ret != 0 ? low_level_ret : ret) {
Gilles Peskinee59236f2018-01-27 23:32:46 +0100141 case 0:
Gilles Peskine449bd832023-01-11 14:50:10 +0100142 return PSA_SUCCESS;
Gilles Peskinea5905292018-02-07 20:59:33 +0100143
Dave Rodgman4f47f3d2023-08-31 12:10:00 +0100144#if defined(MBEDTLS_AES_C)
Gilles Peskinea5905292018-02-07 20:59:33 +0100145 case MBEDTLS_ERR_AES_INVALID_KEY_LENGTH:
146 case MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100147 return PSA_ERROR_NOT_SUPPORTED;
Dave Rodgman09a9e582023-08-31 11:05:22 +0100148 case MBEDTLS_ERR_AES_BAD_INPUT_DATA:
149 return PSA_ERROR_INVALID_ARGUMENT;
Dave Rodgman509b5672023-08-16 19:26:23 +0100150#endif
151
152#if defined(MBEDTLS_ASN1_PARSE_C) || defined(MBEDTLS_ASN1_WRITE_C)
Gilles Peskine9a944802018-06-21 09:35:35 +0200153 case MBEDTLS_ERR_ASN1_OUT_OF_DATA:
154 case MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:
155 case MBEDTLS_ERR_ASN1_INVALID_LENGTH:
156 case MBEDTLS_ERR_ASN1_LENGTH_MISMATCH:
157 case MBEDTLS_ERR_ASN1_INVALID_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100158 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine9a944802018-06-21 09:35:35 +0200159 case MBEDTLS_ERR_ASN1_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100160 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskine9a944802018-06-21 09:35:35 +0200161 case MBEDTLS_ERR_ASN1_BUF_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100162 return PSA_ERROR_BUFFER_TOO_SMALL;
Dave Rodgman509b5672023-08-16 19:26:23 +0100163#endif
Gilles Peskine9a944802018-06-21 09:35:35 +0200164
Dave Rodgman4f47f3d2023-08-31 12:10:00 +0100165#if defined(MBEDTLS_CAMELLIA_C)
Jaeden Amero892cd6d2019-02-11 12:21:12 +0000166 case MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA:
Gilles Peskinea5905292018-02-07 20:59:33 +0100167 case MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100168 return PSA_ERROR_NOT_SUPPORTED;
Dave Rodgman509b5672023-08-16 19:26:23 +0100169#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100170
Dave Rodgman4f47f3d2023-08-31 12:10:00 +0100171#if defined(MBEDTLS_CCM_C)
Gilles Peskinea5905292018-02-07 20:59:33 +0100172 case MBEDTLS_ERR_CCM_BAD_INPUT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100173 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100174 case MBEDTLS_ERR_CCM_AUTH_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100175 return PSA_ERROR_INVALID_SIGNATURE;
Dave Rodgman509b5672023-08-16 19:26:23 +0100176#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100177
Dave Rodgman4f47f3d2023-08-31 12:10:00 +0100178#if defined(MBEDTLS_CHACHA20_C)
Gilles Peskine26869f22019-05-06 15:25:00 +0200179 case MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100180 return PSA_ERROR_INVALID_ARGUMENT;
Dave Rodgman509b5672023-08-16 19:26:23 +0100181#endif
Gilles Peskine26869f22019-05-06 15:25:00 +0200182
Dave Rodgman4f47f3d2023-08-31 12:10:00 +0100183#if defined(MBEDTLS_CHACHAPOLY_C)
Gilles Peskine26869f22019-05-06 15:25:00 +0200184 case MBEDTLS_ERR_CHACHAPOLY_BAD_STATE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100185 return PSA_ERROR_BAD_STATE;
Gilles Peskine26869f22019-05-06 15:25:00 +0200186 case MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100187 return PSA_ERROR_INVALID_SIGNATURE;
Dave Rodgman509b5672023-08-16 19:26:23 +0100188#endif
Gilles Peskine26869f22019-05-06 15:25:00 +0200189
Dave Rodgman509b5672023-08-16 19:26:23 +0100190#if defined(MBEDTLS_CIPHER_C)
Gilles Peskinea5905292018-02-07 20:59:33 +0100191 case MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100192 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100193 case MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100194 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100195 case MBEDTLS_ERR_CIPHER_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100196 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskinea5905292018-02-07 20:59:33 +0100197 case MBEDTLS_ERR_CIPHER_INVALID_PADDING:
Gilles Peskine449bd832023-01-11 14:50:10 +0100198 return PSA_ERROR_INVALID_PADDING;
Gilles Peskinea5905292018-02-07 20:59:33 +0100199 case MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100200 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100201 case MBEDTLS_ERR_CIPHER_AUTH_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100202 return PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskinea5905292018-02-07 20:59:33 +0100203 case MBEDTLS_ERR_CIPHER_INVALID_CONTEXT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100204 return PSA_ERROR_CORRUPTION_DETECTED;
Dave Rodgman509b5672023-08-16 19:26:23 +0100205#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100206
Gilles Peskine449bd832023-01-11 14:50:10 +0100207#if !(defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) || \
208 defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE))
Gilles Peskinebee96c82020-11-23 21:00:09 +0100209 /* Only check CTR_DRBG error codes if underlying mbedtls_xxx
210 * functions are passed a CTR_DRBG instance. */
Gilles Peskinea5905292018-02-07 20:59:33 +0100211 case MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100212 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskinea5905292018-02-07 20:59:33 +0100213 case MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG:
214 case MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG:
Gilles Peskine449bd832023-01-11 14:50:10 +0100215 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100216 case MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100217 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskine82e57d12020-11-13 21:31:17 +0100218#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100219
Dave Rodgman4f47f3d2023-08-31 12:10:00 +0100220#if defined(MBEDTLS_DES_C)
Gilles Peskinea5905292018-02-07 20:59:33 +0100221 case MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100222 return PSA_ERROR_NOT_SUPPORTED;
Dave Rodgman509b5672023-08-16 19:26:23 +0100223#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100224
Gilles Peskinee59236f2018-01-27 23:32:46 +0100225 case MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED:
226 case MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE:
227 case MBEDTLS_ERR_ENTROPY_SOURCE_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100228 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskinea5905292018-02-07 20:59:33 +0100229
Dave Rodgman4f47f3d2023-08-31 12:10:00 +0100230#if defined(MBEDTLS_GCM_C)
Gilles Peskinea5905292018-02-07 20:59:33 +0100231 case MBEDTLS_ERR_GCM_AUTH_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100232 return PSA_ERROR_INVALID_SIGNATURE;
Mateusz Starzykf28261f2021-09-30 16:39:07 +0200233 case MBEDTLS_ERR_GCM_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100234 return PSA_ERROR_BUFFER_TOO_SMALL;
Gilles Peskinea5905292018-02-07 20:59:33 +0100235 case MBEDTLS_ERR_GCM_BAD_INPUT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100236 return PSA_ERROR_INVALID_ARGUMENT;
Dave Rodgman509b5672023-08-16 19:26:23 +0100237#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100238
Gilles Peskine82e57d12020-11-13 21:31:17 +0100239#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) && \
Gilles Peskine449bd832023-01-11 14:50:10 +0100240 defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE)
Gilles Peskinebee96c82020-11-23 21:00:09 +0100241 /* Only check HMAC_DRBG error codes if underlying mbedtls_xxx
242 * functions are passed a HMAC_DRBG instance. */
Gilles Peskine82e57d12020-11-13 21:31:17 +0100243 case MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100244 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskine82e57d12020-11-13 21:31:17 +0100245 case MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG:
246 case MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG:
Gilles Peskine449bd832023-01-11 14:50:10 +0100247 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine82e57d12020-11-13 21:31:17 +0100248 case MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100249 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskine82e57d12020-11-13 21:31:17 +0100250#endif
251
Dave Rodgmandea266f2023-08-31 11:52:43 +0100252#if defined(MBEDTLS_MD_LIGHT)
Gilles Peskinea5905292018-02-07 20:59:33 +0100253 case MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100254 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100255 case MBEDTLS_ERR_MD_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100256 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100257 case MBEDTLS_ERR_MD_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100258 return PSA_ERROR_INSUFFICIENT_MEMORY;
Dave Rodgman509b5672023-08-16 19:26:23 +0100259#if defined(MBEDTLS_FS_IO)
Gilles Peskinea5905292018-02-07 20:59:33 +0100260 case MBEDTLS_ERR_MD_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100261 return PSA_ERROR_STORAGE_FAILURE;
Dave Rodgman509b5672023-08-16 19:26:23 +0100262#endif
263#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100264
Dave Rodgman509b5672023-08-16 19:26:23 +0100265#if defined(MBEDTLS_BIGNUM_C)
266#if defined(MBEDTLS_FS_IO)
Gilles Peskinef76aa772018-10-29 19:24:33 +0100267 case MBEDTLS_ERR_MPI_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100268 return PSA_ERROR_STORAGE_FAILURE;
Dave Rodgman509b5672023-08-16 19:26:23 +0100269#endif
Gilles Peskinef76aa772018-10-29 19:24:33 +0100270 case MBEDTLS_ERR_MPI_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100271 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100272 case MBEDTLS_ERR_MPI_INVALID_CHARACTER:
Gilles Peskine449bd832023-01-11 14:50:10 +0100273 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100274 case MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100275 return PSA_ERROR_BUFFER_TOO_SMALL;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100276 case MBEDTLS_ERR_MPI_NEGATIVE_VALUE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100277 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100278 case MBEDTLS_ERR_MPI_DIVISION_BY_ZERO:
Gilles Peskine449bd832023-01-11 14:50:10 +0100279 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100280 case MBEDTLS_ERR_MPI_NOT_ACCEPTABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100281 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100282 case MBEDTLS_ERR_MPI_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100283 return PSA_ERROR_INSUFFICIENT_MEMORY;
Dave Rodgman509b5672023-08-16 19:26:23 +0100284#endif
Gilles Peskinef76aa772018-10-29 19:24:33 +0100285
Dave Rodgman509b5672023-08-16 19:26:23 +0100286#if defined(MBEDTLS_PK_C)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100287 case MBEDTLS_ERR_PK_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100288 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100289 case MBEDTLS_ERR_PK_TYPE_MISMATCH:
290 case MBEDTLS_ERR_PK_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100291 return PSA_ERROR_INVALID_ARGUMENT;
Dave Rodgman509b5672023-08-16 19:26:23 +0100292#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) || defined(MBEDTLS_FS_IO) || \
293 defined(MBEDTLS_PSA_ITS_FILE_C)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100294 case MBEDTLS_ERR_PK_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100295 return PSA_ERROR_STORAGE_FAILURE;
Dave Rodgman509b5672023-08-16 19:26:23 +0100296#endif
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100297 case MBEDTLS_ERR_PK_KEY_INVALID_VERSION:
298 case MBEDTLS_ERR_PK_KEY_INVALID_FORMAT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100299 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100300 case MBEDTLS_ERR_PK_UNKNOWN_PK_ALG:
Gilles Peskine449bd832023-01-11 14:50:10 +0100301 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100302 case MBEDTLS_ERR_PK_PASSWORD_REQUIRED:
303 case MBEDTLS_ERR_PK_PASSWORD_MISMATCH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100304 return PSA_ERROR_NOT_PERMITTED;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100305 case MBEDTLS_ERR_PK_INVALID_PUBKEY:
Gilles Peskine449bd832023-01-11 14:50:10 +0100306 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100307 case MBEDTLS_ERR_PK_INVALID_ALG:
308 case MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE:
309 case MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100310 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100311 case MBEDTLS_ERR_PK_SIG_LEN_MISMATCH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100312 return PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskinef9f1bdf2021-06-23 20:32:27 +0200313 case MBEDTLS_ERR_PK_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100314 return PSA_ERROR_BUFFER_TOO_SMALL;
Dave Rodgman509b5672023-08-16 19:26:23 +0100315#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100316
Gilles Peskineff2d2002019-05-06 15:26:23 +0200317 case MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100318 return PSA_ERROR_HARDWARE_FAILURE;
Gilles Peskineff2d2002019-05-06 15:26:23 +0200319 case MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100320 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskineff2d2002019-05-06 15:26:23 +0200321
Dave Rodgman509b5672023-08-16 19:26:23 +0100322#if defined(MBEDTLS_RSA_C)
Gilles Peskinea5905292018-02-07 20:59:33 +0100323 case MBEDTLS_ERR_RSA_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100324 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100325 case MBEDTLS_ERR_RSA_INVALID_PADDING:
Gilles Peskine449bd832023-01-11 14:50:10 +0100326 return PSA_ERROR_INVALID_PADDING;
Gilles Peskinea5905292018-02-07 20:59:33 +0100327 case MBEDTLS_ERR_RSA_KEY_GEN_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100328 return PSA_ERROR_HARDWARE_FAILURE;
Gilles Peskinea5905292018-02-07 20:59:33 +0100329 case MBEDTLS_ERR_RSA_KEY_CHECK_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100330 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100331 case MBEDTLS_ERR_RSA_PUBLIC_FAILED:
332 case MBEDTLS_ERR_RSA_PRIVATE_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100333 return PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100334 case MBEDTLS_ERR_RSA_VERIFY_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100335 return PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskinea5905292018-02-07 20:59:33 +0100336 case MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100337 return PSA_ERROR_BUFFER_TOO_SMALL;
Gilles Peskinea5905292018-02-07 20:59:33 +0100338 case MBEDTLS_ERR_RSA_RNG_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100339 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Dave Rodgman509b5672023-08-16 19:26:23 +0100340#endif
Manuel Pégourié-Gonnard93c08472021-04-15 12:23:55 +0200341
Dave Rodgman1dab4452023-09-01 09:59:51 +0100342#if defined(MBEDTLS_ECP_LIGHT)
itayzafrir5c753392018-05-08 11:18:38 +0300343 case MBEDTLS_ERR_ECP_BAD_INPUT_DATA:
itayzafrir7b30f8b2018-05-09 16:07:36 +0300344 case MBEDTLS_ERR_ECP_INVALID_KEY:
Gilles Peskine449bd832023-01-11 14:50:10 +0100345 return PSA_ERROR_INVALID_ARGUMENT;
itayzafrir7b30f8b2018-05-09 16:07:36 +0300346 case MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100347 return PSA_ERROR_BUFFER_TOO_SMALL;
itayzafrir7b30f8b2018-05-09 16:07:36 +0300348 case MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100349 return PSA_ERROR_NOT_SUPPORTED;
itayzafrir7b30f8b2018-05-09 16:07:36 +0300350 case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH:
351 case MBEDTLS_ERR_ECP_VERIFY_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100352 return PSA_ERROR_INVALID_SIGNATURE;
itayzafrir7b30f8b2018-05-09 16:07:36 +0300353 case MBEDTLS_ERR_ECP_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100354 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskine40d81602020-11-25 00:09:47 +0100355 case MBEDTLS_ERR_ECP_RANDOM_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100356 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskine40d81602020-11-25 00:09:47 +0100357
Dave Rodgman509b5672023-08-16 19:26:23 +0100358#if defined(MBEDTLS_ECP_RESTARTABLE)
Paul Elliott588f8ed2022-12-02 18:10:26 +0000359 case MBEDTLS_ERR_ECP_IN_PROGRESS:
360 return PSA_OPERATION_INCOMPLETE;
Dave Rodgman509b5672023-08-16 19:26:23 +0100361#endif
362#endif
Paul Elliott588f8ed2022-12-02 18:10:26 +0000363
Janos Follatha13b9052019-11-22 12:48:59 +0000364 case MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100365 return PSA_ERROR_CORRUPTION_DETECTED;
itayzafrir5c753392018-05-08 11:18:38 +0300366
Gilles Peskinee59236f2018-01-27 23:32:46 +0100367 default:
Gilles Peskine449bd832023-01-11 14:50:10 +0100368 return PSA_ERROR_GENERIC_ERROR;
Gilles Peskinee59236f2018-01-27 23:32:46 +0100369 }
370}
371
Paul Elliottdc42ca82023-02-24 18:11:59 +0000372/**
373 * \brief For output buffers which contain "tags"
374 * (outputs that may be checked for validity like
375 * hashes, MACs and signatures), fill the unused
376 * part of the output buffer (the whole buffer on
377 * error, the trailing part on success) with
378 * something that isn't a valid tag (barring an
379 * attack on the tag and deliberately-crafted
380 * input), in case the caller doesn't check the
381 * return status properly.
382 *
383 * \param output_buffer Pointer to buffer to wipe. May not be NULL
384 * unless \p output_buffer_size is zero.
385 * \param status Status of function called to generate
386 * output_buffer originally
387 * \param output_buffer_size Size of output buffer. If zero, \p output_buffer
388 * could be NULL.
389 * \param output_buffer_length Length of data written to output_buffer, must be
390 * less than \p output_buffer_size
391 */
392static void psa_wipe_tag_output_buffer(uint8_t *output_buffer, psa_status_t status,
Paul Elliott7118d172023-02-26 16:57:05 +0000393 size_t output_buffer_size, size_t output_buffer_length)
394{
Paul Elliottdc42ca82023-02-24 18:11:59 +0000395 size_t offset = 0;
396
397 if (output_buffer_size == 0) {
398 /* If output_buffer_size is 0 then we have nothing to do. We must not
399 call memset because output_buffer may be NULL in this case */
400 return;
401 }
402
403 if (status == PSA_SUCCESS) {
404 offset = output_buffer_length;
405 }
406
407 memset(output_buffer + offset, '!', output_buffer_size - offset);
408}
409
Gilles Peskineb0b255c2018-07-06 17:01:38 +0200410
Gilles Peskine449bd832023-01-11 14:50:10 +0100411psa_status_t psa_validate_unstructured_key_bit_size(psa_key_type_t type,
412 size_t bits)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200413{
414 /* Check that the bit size is acceptable for the key type */
Gilles Peskine449bd832023-01-11 14:50:10 +0100415 switch (type) {
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200416 case PSA_KEY_TYPE_RAW_DATA:
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200417 case PSA_KEY_TYPE_HMAC:
Gilles Peskineea0fb492018-07-12 17:17:20 +0200418 case PSA_KEY_TYPE_DERIVE:
Neil Armstrong4b5710f2022-05-25 11:30:27 +0200419 case PSA_KEY_TYPE_PASSWORD:
420 case PSA_KEY_TYPE_PASSWORD_HASH:
Gilles Peskineea0fb492018-07-12 17:17:20 +0200421 break;
Ronald Cron1f0db802021-03-12 09:59:30 +0100422#if defined(PSA_WANT_KEY_TYPE_AES)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200423 case PSA_KEY_TYPE_AES:
Gilles Peskine449bd832023-01-11 14:50:10 +0100424 if (bits != 128 && bits != 192 && bits != 256) {
425 return PSA_ERROR_INVALID_ARGUMENT;
426 }
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200427 break;
428#endif
Gilles Peskine6c12a1e2021-09-21 11:59:39 +0200429#if defined(PSA_WANT_KEY_TYPE_ARIA)
430 case PSA_KEY_TYPE_ARIA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100431 if (bits != 128 && bits != 192 && bits != 256) {
432 return PSA_ERROR_INVALID_ARGUMENT;
433 }
Gilles Peskine6c12a1e2021-09-21 11:59:39 +0200434 break;
435#endif
Ronald Cron1f0db802021-03-12 09:59:30 +0100436#if defined(PSA_WANT_KEY_TYPE_CAMELLIA)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200437 case PSA_KEY_TYPE_CAMELLIA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100438 if (bits != 128 && bits != 192 && bits != 256) {
439 return PSA_ERROR_INVALID_ARGUMENT;
440 }
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200441 break;
442#endif
Ronald Cron1f0db802021-03-12 09:59:30 +0100443#if defined(PSA_WANT_KEY_TYPE_DES)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200444 case PSA_KEY_TYPE_DES:
Gilles Peskine449bd832023-01-11 14:50:10 +0100445 if (bits != 64 && bits != 128 && bits != 192) {
446 return PSA_ERROR_INVALID_ARGUMENT;
447 }
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200448 break;
449#endif
Ronald Cron1f0db802021-03-12 09:59:30 +0100450#if defined(PSA_WANT_KEY_TYPE_CHACHA20)
Gilles Peskine26869f22019-05-06 15:25:00 +0200451 case PSA_KEY_TYPE_CHACHA20:
Gilles Peskine449bd832023-01-11 14:50:10 +0100452 if (bits != 256) {
453 return PSA_ERROR_INVALID_ARGUMENT;
454 }
Gilles Peskine26869f22019-05-06 15:25:00 +0200455 break;
456#endif
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200457 default:
Gilles Peskine449bd832023-01-11 14:50:10 +0100458 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200459 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100460 if (bits % 8 != 0) {
461 return PSA_ERROR_INVALID_ARGUMENT;
462 }
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200463
Gilles Peskine449bd832023-01-11 14:50:10 +0100464 return PSA_SUCCESS;
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200465}
466
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100467/** Check whether a given key type is valid for use with a given MAC algorithm
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100468 *
Steven Cooremancd640932021-03-08 12:00:27 +0100469 * Upon successful return of this function, the behavior of #PSA_MAC_LENGTH
470 * when called with the validated \p algorithm and \p key_type is well-defined.
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100471 *
472 * \param[in] algorithm The specific MAC algorithm (can be wildcard).
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100473 * \param[in] key_type The key type of the key to be used with the
474 * \p algorithm.
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100475 *
476 * \retval #PSA_SUCCESS
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100477 * The \p key_type is valid for use with the \p algorithm
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100478 * \retval #PSA_ERROR_INVALID_ARGUMENT
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100479 * The \p key_type is not valid for use with the \p algorithm
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100480 */
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100481MBEDTLS_STATIC_TESTABLE psa_status_t psa_mac_key_can_do(
Steven Cooreman58c94d32021-03-02 21:31:17 +0100482 psa_algorithm_t algorithm,
Gilles Peskine449bd832023-01-11 14:50:10 +0100483 psa_key_type_t key_type)
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100484{
Gilles Peskine449bd832023-01-11 14:50:10 +0100485 if (PSA_ALG_IS_HMAC(algorithm)) {
486 if (key_type == PSA_KEY_TYPE_HMAC) {
487 return PSA_SUCCESS;
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100488 }
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100489 }
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100490
Gilles Peskine449bd832023-01-11 14:50:10 +0100491 if (PSA_ALG_IS_BLOCK_CIPHER_MAC(algorithm)) {
492 /* Check that we're calling PSA_BLOCK_CIPHER_BLOCK_LENGTH with a cipher
493 * key. */
494 if ((key_type & PSA_KEY_TYPE_CATEGORY_MASK) ==
495 PSA_KEY_TYPE_CATEGORY_SYMMETRIC) {
496 /* PSA_BLOCK_CIPHER_BLOCK_LENGTH returns 1 for stream ciphers and
497 * the block length (larger than 1) for block ciphers. */
498 if (PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type) > 1) {
499 return PSA_SUCCESS;
500 }
501 }
502 }
503
504 return PSA_ERROR_INVALID_ARGUMENT;
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100505}
506
Gilles Peskine449bd832023-01-11 14:50:10 +0100507psa_status_t psa_allocate_buffer_to_slot(psa_key_slot_t *slot,
508 size_t buffer_length)
Steven Cooreman75b74362020-07-28 14:30:13 +0200509{
Gilles Peskine449bd832023-01-11 14:50:10 +0100510 if (slot->key.data != NULL) {
511 return PSA_ERROR_ALREADY_EXISTS;
512 }
Steven Cooreman75b74362020-07-28 14:30:13 +0200513
Gilles Peskine449bd832023-01-11 14:50:10 +0100514 slot->key.data = mbedtls_calloc(1, buffer_length);
515 if (slot->key.data == NULL) {
516 return PSA_ERROR_INSUFFICIENT_MEMORY;
517 }
Steven Cooreman75b74362020-07-28 14:30:13 +0200518
Ronald Cronea0f8a62020-11-25 17:52:23 +0100519 slot->key.bytes = buffer_length;
Gilles Peskine449bd832023-01-11 14:50:10 +0100520 return PSA_SUCCESS;
Steven Cooreman75b74362020-07-28 14:30:13 +0200521}
522
Gilles Peskine449bd832023-01-11 14:50:10 +0100523psa_status_t psa_copy_key_material_into_slot(psa_key_slot_t *slot,
524 const uint8_t *data,
525 size_t data_length)
Steven Cooremanf7cebd42020-10-13 20:27:40 +0200526{
Gilles Peskine449bd832023-01-11 14:50:10 +0100527 psa_status_t status = psa_allocate_buffer_to_slot(slot,
528 data_length);
529 if (status != PSA_SUCCESS) {
530 return status;
531 }
Steven Cooremanf7cebd42020-10-13 20:27:40 +0200532
Gilles Peskine449bd832023-01-11 14:50:10 +0100533 memcpy(slot->key.data, data, data_length);
534 return PSA_SUCCESS;
Steven Cooremanf7cebd42020-10-13 20:27:40 +0200535}
536
Ronald Crona0fe59f2020-11-29 11:14:53 +0100537psa_status_t psa_import_key_into_slot(
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100538 const psa_key_attributes_t *attributes,
539 const uint8_t *data, size_t data_length,
540 uint8_t *key_buffer, size_t key_buffer_size,
Gilles Peskine449bd832023-01-11 14:50:10 +0100541 size_t *key_buffer_length, size_t *bits)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100542{
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100543 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
544 psa_key_type_t type = attributes->core.type;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100545
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200546 /* zero-length keys are never supported. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100547 if (data_length == 0) {
548 return PSA_ERROR_NOT_SUPPORTED;
549 }
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200550
Gilles Peskine449bd832023-01-11 14:50:10 +0100551 if (key_type_is_raw_bytes(type)) {
552 *bits = PSA_BYTES_TO_BITS(data_length);
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200553
Gilles Peskine449bd832023-01-11 14:50:10 +0100554 status = psa_validate_unstructured_key_bit_size(attributes->core.type,
555 *bits);
556 if (status != PSA_SUCCESS) {
557 return status;
558 }
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200559
Ronald Crondd04d422020-11-28 15:14:42 +0100560 /* Copy the key material. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100561 memcpy(key_buffer, data, data_length);
Ronald Crondd04d422020-11-28 15:14:42 +0100562 *key_buffer_length = data_length;
Gilles Peskine449bd832023-01-11 14:50:10 +0100563 (void) key_buffer_size;
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200564
Gilles Peskine449bd832023-01-11 14:50:10 +0100565 return PSA_SUCCESS;
566 } else if (PSA_KEY_TYPE_IS_ASYMMETRIC(type)) {
Valerio Settia55f0422023-07-10 15:34:41 +0200567#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT) || \
Przemek Stekiel6d85afa2023-04-28 11:42:17 +0200568 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY)
Przemek Stekiel472b3f32022-12-01 14:38:49 +0100569 if (PSA_KEY_TYPE_IS_DH(type)) {
Przemek Stekield1cf1ba2023-04-27 12:04:21 +0200570 if (psa_is_dh_key_size_valid(PSA_BYTES_TO_BITS(data_length)) == 0) {
Przemek Stekiel472b3f32022-12-01 14:38:49 +0100571 return PSA_ERROR_INVALID_ARGUMENT;
572 }
Przemek Stekiel33c91eb2023-05-30 15:16:35 +0200573 return mbedtls_psa_ffdh_import_key(attributes,
574 data, data_length,
575 key_buffer, key_buffer_size,
576 key_buffer_length,
577 bits);
Przemek Stekiel472b3f32022-12-01 14:38:49 +0100578 }
Valerio Settia55f0422023-07-10 15:34:41 +0200579#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT) ||
Przemek Stekiel6d85afa2023-04-28 11:42:17 +0200580 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) */
Valerio Setti27c501a2023-06-27 16:58:52 +0200581#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT) || \
Gilles Peskine449bd832023-01-11 14:50:10 +0100582 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
583 if (PSA_KEY_TYPE_IS_ECC(type)) {
584 return mbedtls_psa_ecp_import_key(attributes,
585 data, data_length,
586 key_buffer, key_buffer_size,
587 key_buffer_length,
588 bits);
Steven Cooreman40120f62020-10-29 11:42:22 +0100589 }
Valerio Setti27c501a2023-06-27 16:58:52 +0200590#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT) ||
John Durkop9814fa22020-11-04 12:28:15 -0800591 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
Valerio Settife478902023-07-25 12:27:19 +0200592#if (defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT) && \
593 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT)) || \
Gilles Peskine449bd832023-01-11 14:50:10 +0100594 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
595 if (PSA_KEY_TYPE_IS_RSA(type)) {
596 return mbedtls_psa_rsa_import_key(attributes,
597 data, data_length,
598 key_buffer, key_buffer_size,
599 key_buffer_length,
600 bits);
Steven Cooreman3ea0ce42020-10-23 11:37:05 +0200601 }
Valerio Settife478902023-07-25 12:27:19 +0200602#endif /* (defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT) &&
603 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT)) ||
John Durkop9814fa22020-11-04 12:28:15 -0800604 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100605 }
Steven Cooreman40120f62020-10-29 11:42:22 +0100606
Gilles Peskine449bd832023-01-11 14:50:10 +0100607 return PSA_ERROR_NOT_SUPPORTED;
Darryl Green06fd18d2018-07-16 11:21:11 +0100608}
609
Gilles Peskinef603c712019-01-19 13:40:11 +0100610/** Calculate the intersection of two algorithm usage policies.
611 *
612 * Return 0 (which allows no operation) on incompatibility.
613 */
614static psa_algorithm_t psa_key_policy_algorithm_intersection(
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100615 psa_key_type_t key_type,
Gilles Peskinef603c712019-01-19 13:40:11 +0100616 psa_algorithm_t alg1,
Gilles Peskine449bd832023-01-11 14:50:10 +0100617 psa_algorithm_t alg2)
Gilles Peskinef603c712019-01-19 13:40:11 +0100618{
Gilles Peskine549ea862019-05-22 11:45:59 +0200619 /* Common case: both sides actually specify the same policy. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100620 if (alg1 == alg2) {
621 return alg1;
622 }
Steven Cooreman03488022021-02-18 12:07:20 +0100623 /* If the policies are from the same hash-and-sign family, check
624 * if one is a wildcard. If so the other has the specific algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100625 if (PSA_ALG_IS_SIGN_HASH(alg1) &&
626 PSA_ALG_IS_SIGN_HASH(alg2) &&
627 (alg1 & ~PSA_ALG_HASH_MASK) == (alg2 & ~PSA_ALG_HASH_MASK)) {
628 if (PSA_ALG_SIGN_GET_HASH(alg1) == PSA_ALG_ANY_HASH) {
629 return alg2;
630 }
631 if (PSA_ALG_SIGN_GET_HASH(alg2) == PSA_ALG_ANY_HASH) {
632 return alg1;
633 }
Steven Cooreman03488022021-02-18 12:07:20 +0100634 }
635 /* If the policies are from the same AEAD family, check whether
Steven Cooreman7de9e2d2021-02-22 17:05:56 +0100636 * one of them is a minimum-tag-length wildcard. Calculate the most
Steven Cooreman03488022021-02-18 12:07:20 +0100637 * restrictive tag length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100638 if (PSA_ALG_IS_AEAD(alg1) && PSA_ALG_IS_AEAD(alg2) &&
639 (PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg1, 0) ==
640 PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg2, 0))) {
641 size_t alg1_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg1);
642 size_t alg2_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg2);
Steven Cooremancd640932021-03-08 12:00:27 +0100643 size_t restricted_len = alg1_len > alg2_len ? alg1_len : alg2_len;
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100644
Steven Cooreman7de9e2d2021-02-22 17:05:56 +0100645 /* If both are wildcards, return most restrictive wildcard */
Gilles Peskine449bd832023-01-11 14:50:10 +0100646 if (((alg1 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
647 ((alg2 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0)) {
648 return PSA_ALG_AEAD_WITH_AT_LEAST_THIS_LENGTH_TAG(
649 alg1, restricted_len);
Steven Cooreman03488022021-02-18 12:07:20 +0100650 }
651 /* If only one is a wildcard, return specific algorithm if compatible. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100652 if (((alg1 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
653 (alg1_len <= alg2_len)) {
654 return alg2;
Steven Cooreman03488022021-02-18 12:07:20 +0100655 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100656 if (((alg2 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
657 (alg2_len <= alg1_len)) {
658 return alg1;
Steven Cooreman03488022021-02-18 12:07:20 +0100659 }
660 }
661 /* If the policies are from the same MAC family, check whether one
662 * of them is a minimum-MAC-length policy. Calculate the most
663 * restrictive tag length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100664 if (PSA_ALG_IS_MAC(alg1) && PSA_ALG_IS_MAC(alg2) &&
665 (PSA_ALG_FULL_LENGTH_MAC(alg1) ==
666 PSA_ALG_FULL_LENGTH_MAC(alg2))) {
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100667 /* Validate the combination of key type and algorithm. Since the base
668 * algorithm of alg1 and alg2 are the same, we only need this once. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100669 if (PSA_SUCCESS != psa_mac_key_can_do(alg1, key_type)) {
670 return 0;
671 }
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100672
Steven Cooreman31a876d2021-03-03 20:47:40 +0100673 /* Get the (exact or at-least) output lengths for both sides of the
674 * requested intersection. None of the currently supported algorithms
675 * have an output length dependent on the actual key size, so setting it
676 * to a bogus value of 0 is currently OK.
677 *
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100678 * Note that for at-least-this-length wildcard algorithms, the output
679 * length is set to the shortest allowed length, which allows us to
680 * calculate the most restrictive tag length for the intersection. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100681 size_t alg1_len = PSA_MAC_LENGTH(key_type, 0, alg1);
682 size_t alg2_len = PSA_MAC_LENGTH(key_type, 0, alg2);
Steven Cooremancd640932021-03-08 12:00:27 +0100683 size_t restricted_len = alg1_len > alg2_len ? alg1_len : alg2_len;
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100684
Steven Cooremana1d83222021-02-25 10:20:29 +0100685 /* If both are wildcards, return most restrictive wildcard */
Gilles Peskine449bd832023-01-11 14:50:10 +0100686 if (((alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
687 ((alg2 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0)) {
688 return PSA_ALG_AT_LEAST_THIS_LENGTH_MAC(alg1, restricted_len);
Steven Cooreman03488022021-02-18 12:07:20 +0100689 }
Steven Cooreman31a876d2021-03-03 20:47:40 +0100690
691 /* If only one is an at-least-this-length policy, the intersection would
692 * be the other (fixed-length) policy as long as said fixed length is
693 * equal to or larger than the shortest allowed length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100694 if ((alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) {
695 return (alg1_len <= alg2_len) ? alg2 : 0;
Steven Cooreman03488022021-02-18 12:07:20 +0100696 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100697 if ((alg2 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) {
698 return (alg2_len <= alg1_len) ? alg1 : 0;
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100699 }
Steven Cooreman31a876d2021-03-03 20:47:40 +0100700
Steven Cooremancd640932021-03-08 12:00:27 +0100701 /* If none of them are wildcards, check whether they define the same tag
702 * length. This is still possible here when one is default-length and
703 * the other specific-length. Ensure to always return the
704 * specific-length version for the intersection. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100705 if (alg1_len == alg2_len) {
706 return PSA_ALG_TRUNCATED_MAC(alg1, alg1_len);
707 }
Gilles Peskinef603c712019-01-19 13:40:11 +0100708 }
709 /* If the policies are incompatible, allow nothing. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100710 return 0;
Gilles Peskinef603c712019-01-19 13:40:11 +0100711}
712
Gilles Peskine449bd832023-01-11 14:50:10 +0100713static int psa_key_algorithm_permits(psa_key_type_t key_type,
714 psa_algorithm_t policy_alg,
715 psa_algorithm_t requested_alg)
Gilles Peskined6f371b2019-05-10 19:33:38 +0200716{
Gilles Peskine549ea862019-05-22 11:45:59 +0200717 /* Common case: the policy only allows requested_alg. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100718 if (requested_alg == policy_alg) {
719 return 1;
720 }
Steven Cooreman03488022021-02-18 12:07:20 +0100721 /* If policy_alg is a hash-and-sign with a wildcard for the hash,
722 * and requested_alg is the same hash-and-sign family with any hash,
723 * then requested_alg is compliant with policy_alg. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100724 if (PSA_ALG_IS_SIGN_HASH(requested_alg) &&
725 PSA_ALG_SIGN_GET_HASH(policy_alg) == PSA_ALG_ANY_HASH) {
726 return (policy_alg & ~PSA_ALG_HASH_MASK) ==
727 (requested_alg & ~PSA_ALG_HASH_MASK);
Steven Cooreman03488022021-02-18 12:07:20 +0100728 }
729 /* If policy_alg is a wildcard AEAD algorithm of the same base as
730 * the requested algorithm, check the requested tag length to be
731 * equal-length or longer than the wildcard-specified length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100732 if (PSA_ALG_IS_AEAD(policy_alg) &&
733 PSA_ALG_IS_AEAD(requested_alg) &&
734 (PSA_ALG_AEAD_WITH_SHORTENED_TAG(policy_alg, 0) ==
735 PSA_ALG_AEAD_WITH_SHORTENED_TAG(requested_alg, 0)) &&
736 ((policy_alg & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0)) {
737 return PSA_ALG_AEAD_GET_TAG_LENGTH(policy_alg) <=
738 PSA_ALG_AEAD_GET_TAG_LENGTH(requested_alg);
Steven Cooreman03488022021-02-18 12:07:20 +0100739 }
Steven Cooremancd640932021-03-08 12:00:27 +0100740 /* If policy_alg is a MAC algorithm of the same base as the requested
741 * algorithm, check whether their MAC lengths are compatible. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100742 if (PSA_ALG_IS_MAC(policy_alg) &&
743 PSA_ALG_IS_MAC(requested_alg) &&
744 (PSA_ALG_FULL_LENGTH_MAC(policy_alg) ==
745 PSA_ALG_FULL_LENGTH_MAC(requested_alg))) {
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100746 /* Validate the combination of key type and algorithm. Since the policy
747 * and requested algorithms are the same, we only need this once. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100748 if (PSA_SUCCESS != psa_mac_key_can_do(policy_alg, key_type)) {
749 return 0;
750 }
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100751
Steven Cooreman31a876d2021-03-03 20:47:40 +0100752 /* Get both the requested output length for the algorithm which is to be
753 * verified, and the default output length for the base algorithm.
754 * Note that none of the currently supported algorithms have an output
755 * length dependent on actual key size, so setting it to a bogus value
756 * of 0 is currently OK. */
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100757 size_t requested_output_length = PSA_MAC_LENGTH(
Gilles Peskine449bd832023-01-11 14:50:10 +0100758 key_type, 0, requested_alg);
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100759 size_t default_output_length = PSA_MAC_LENGTH(
Gilles Peskine449bd832023-01-11 14:50:10 +0100760 key_type, 0,
761 PSA_ALG_FULL_LENGTH_MAC(requested_alg));
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100762
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100763 /* If the policy is default-length, only allow an algorithm with
764 * a declared exact-length matching the default. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100765 if (PSA_MAC_TRUNCATED_LENGTH(policy_alg) == 0) {
766 return requested_output_length == default_output_length;
767 }
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100768
769 /* If the requested algorithm is default-length, allow it if the policy
Steven Cooremancd640932021-03-08 12:00:27 +0100770 * length exactly matches the default length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100771 if (PSA_MAC_TRUNCATED_LENGTH(requested_alg) == 0 &&
772 PSA_MAC_TRUNCATED_LENGTH(policy_alg) == default_output_length) {
773 return 1;
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100774 }
775
Steven Cooremancd640932021-03-08 12:00:27 +0100776 /* If policy_alg is an at-least-this-length wildcard MAC algorithm,
777 * check for the requested MAC length to be equal to or longer than the
778 * minimum allowed length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100779 if ((policy_alg & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) {
780 return PSA_MAC_TRUNCATED_LENGTH(policy_alg) <=
781 requested_output_length;
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100782 }
Gilles Peskined6f371b2019-05-10 19:33:38 +0200783 }
Steven Cooremance48e852020-10-05 16:02:45 +0200784 /* If policy_alg is a generic key agreement operation, then using it for
Steven Cooremanfa5e6312020-10-15 17:07:12 +0200785 * a key derivation with that key agreement should also be allowed. This
786 * behaviour is expected to be defined in a future specification version. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100787 if (PSA_ALG_IS_RAW_KEY_AGREEMENT(policy_alg) &&
788 PSA_ALG_IS_KEY_AGREEMENT(requested_alg)) {
789 return PSA_ALG_KEY_AGREEMENT_GET_BASE(requested_alg) ==
790 policy_alg;
Steven Cooremance48e852020-10-05 16:02:45 +0200791 }
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100792 /* If it isn't explicitly permitted, it's forbidden. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100793 return 0;
Gilles Peskined6f371b2019-05-10 19:33:38 +0200794}
795
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100796/** Test whether a policy permits an algorithm.
797 *
798 * The caller must test usage flags separately.
Steven Cooreman7e39f052021-02-23 14:18:32 +0100799 *
Steven Cooreman5a172672021-03-02 21:27:42 +0100800 * \note This function requires providing the key type for which the policy is
801 * being validated, since some algorithm policy definitions (e.g. MAC)
802 * have different properties depending on what kind of cipher it is
803 * combined with.
804 *
Steven Cooreman7e39f052021-02-23 14:18:32 +0100805 * \retval PSA_SUCCESS When \p alg is a specific algorithm
806 * allowed by the \p policy.
807 * \retval PSA_ERROR_INVALID_ARGUMENT When \p alg is not a specific algorithm
808 * \retval PSA_ERROR_NOT_PERMITTED When \p alg is a specific algorithm, but
809 * the \p policy does not allow it.
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100810 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100811static psa_status_t psa_key_policy_permits(const psa_key_policy_t *policy,
812 psa_key_type_t key_type,
813 psa_algorithm_t alg)
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100814{
Steven Cooremand788fab2021-02-25 11:29:17 +0100815 /* '0' is not a valid algorithm */
Gilles Peskine449bd832023-01-11 14:50:10 +0100816 if (alg == 0) {
817 return PSA_ERROR_INVALID_ARGUMENT;
818 }
Steven Cooremand788fab2021-02-25 11:29:17 +0100819
Steven Cooreman7e39f052021-02-23 14:18:32 +0100820 /* A requested algorithm cannot be a wildcard. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100821 if (PSA_ALG_IS_WILDCARD(alg)) {
822 return PSA_ERROR_INVALID_ARGUMENT;
823 }
Steven Cooreman7e39f052021-02-23 14:18:32 +0100824
Gilles Peskine449bd832023-01-11 14:50:10 +0100825 if (psa_key_algorithm_permits(key_type, policy->alg, alg) ||
826 psa_key_algorithm_permits(key_type, policy->alg2, alg)) {
827 return PSA_SUCCESS;
828 } else {
829 return PSA_ERROR_NOT_PERMITTED;
830 }
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100831}
832
Gilles Peskinef603c712019-01-19 13:40:11 +0100833/** Restrict a key policy based on a constraint.
834 *
Steven Cooreman5a172672021-03-02 21:27:42 +0100835 * \note This function requires providing the key type for which the policy is
836 * being restricted, since some algorithm policy definitions (e.g. MAC)
837 * have different properties depending on what kind of cipher it is
838 * combined with.
839 *
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100840 * \param[in] key_type The key type for which to restrict the policy
Gilles Peskinef603c712019-01-19 13:40:11 +0100841 * \param[in,out] policy The policy to restrict.
842 * \param[in] constraint The policy constraint to apply.
843 *
844 * \retval #PSA_SUCCESS
845 * \c *policy contains the intersection of the original value of
846 * \c *policy and \c *constraint.
847 * \retval #PSA_ERROR_INVALID_ARGUMENT
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100848 * \c key_type, \c *policy and \c *constraint are incompatible.
Gilles Peskinef603c712019-01-19 13:40:11 +0100849 * \c *policy is unchanged.
850 */
851static psa_status_t psa_restrict_key_policy(
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100852 psa_key_type_t key_type,
Gilles Peskinef603c712019-01-19 13:40:11 +0100853 psa_key_policy_t *policy,
Gilles Peskine449bd832023-01-11 14:50:10 +0100854 const psa_key_policy_t *constraint)
Gilles Peskinef603c712019-01-19 13:40:11 +0100855{
856 psa_algorithm_t intersection_alg =
Gilles Peskine449bd832023-01-11 14:50:10 +0100857 psa_key_policy_algorithm_intersection(key_type, policy->alg,
858 constraint->alg);
Gilles Peskined6f371b2019-05-10 19:33:38 +0200859 psa_algorithm_t intersection_alg2 =
Gilles Peskine449bd832023-01-11 14:50:10 +0100860 psa_key_policy_algorithm_intersection(key_type, policy->alg2,
861 constraint->alg2);
862 if (intersection_alg == 0 && policy->alg != 0 && constraint->alg != 0) {
863 return PSA_ERROR_INVALID_ARGUMENT;
864 }
865 if (intersection_alg2 == 0 && policy->alg2 != 0 && constraint->alg2 != 0) {
866 return PSA_ERROR_INVALID_ARGUMENT;
867 }
Gilles Peskinef603c712019-01-19 13:40:11 +0100868 policy->usage &= constraint->usage;
869 policy->alg = intersection_alg;
Gilles Peskined6f371b2019-05-10 19:33:38 +0200870 policy->alg2 = intersection_alg2;
Gilles Peskine449bd832023-01-11 14:50:10 +0100871 return PSA_SUCCESS;
Gilles Peskinef603c712019-01-19 13:40:11 +0100872}
873
Przemek Stekiel061f6942022-11-30 10:51:35 +0100874/** Get the description of a key given its identifier and policy constraints
875 * and lock it.
876 *
877 * The key must have allow all the usage flags set in \p usage. If \p alg is
878 * nonzero, the key must allow operations with this algorithm. If \p alg is
879 * zero, the algorithm is not checked.
880 *
881 * In case of a persistent key, the function loads the description of the key
882 * into a key slot if not already done.
883 *
Ryan Everett098c6652024-01-03 13:03:36 +0000884 * On success, the returned key slot has been registered for reading.
885 * It is the responsibility of the caller to call psa_unregister_read(slot)
886 * when they have finished reading the contents of the slot.
Przemek Stekiel061f6942022-11-30 10:51:35 +0100887 */
888static psa_status_t psa_get_and_lock_key_slot_with_policy(
Ronald Cron5c522922020-11-14 16:35:34 +0100889 mbedtls_svc_key_id_t key,
890 psa_key_slot_t **p_slot,
891 psa_key_usage_t usage,
Gilles Peskine449bd832023-01-11 14:50:10 +0100892 psa_algorithm_t alg)
Darryl Green06fd18d2018-07-16 11:21:11 +0100893{
Ronald Cronf95a2b12020-10-22 15:24:49 +0200894 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel9a5b8122022-12-22 13:34:47 +0100895 psa_key_slot_t *slot = NULL;
Darryl Green06fd18d2018-07-16 11:21:11 +0100896
Gilles Peskine449bd832023-01-11 14:50:10 +0100897 status = psa_get_and_lock_key_slot(key, p_slot);
898 if (status != PSA_SUCCESS) {
899 return status;
900 }
Ronald Cronf95a2b12020-10-22 15:24:49 +0200901 slot = *p_slot;
Darryl Green06fd18d2018-07-16 11:21:11 +0100902
903 /* Enforce that usage policy for the key slot contains all the flags
904 * required by the usage parameter. There is one exception: public
905 * keys can always be exported, so we treat public key objects as
906 * if they had the export flag. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100907 if (PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type)) {
Darryl Green06fd18d2018-07-16 11:21:11 +0100908 usage &= ~PSA_KEY_USAGE_EXPORT;
Gilles Peskine449bd832023-01-11 14:50:10 +0100909 }
Ronald Cronf95a2b12020-10-22 15:24:49 +0200910
Gilles Peskine449bd832023-01-11 14:50:10 +0100911 if ((slot->attr.policy.usage & usage) != usage) {
Steven Cooreman328f11c2021-03-02 11:44:51 +0100912 status = PSA_ERROR_NOT_PERMITTED;
Ronald Cronf95a2b12020-10-22 15:24:49 +0200913 goto error;
Steven Cooreman328f11c2021-03-02 11:44:51 +0100914 }
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100915
Shaun Case8b0ecbc2021-12-20 21:14:10 -0800916 /* Enforce that the usage policy permits the requested algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100917 if (alg != 0) {
918 status = psa_key_policy_permits(&slot->attr.policy,
919 slot->attr.type,
920 alg);
921 if (status != PSA_SUCCESS) {
Steven Cooreman7e39f052021-02-23 14:18:32 +0100922 goto error;
Gilles Peskine449bd832023-01-11 14:50:10 +0100923 }
Steven Cooreman7e39f052021-02-23 14:18:32 +0100924 }
Darryl Green06fd18d2018-07-16 11:21:11 +0100925
Gilles Peskine449bd832023-01-11 14:50:10 +0100926 return PSA_SUCCESS;
Ronald Cronf95a2b12020-10-22 15:24:49 +0200927
928error:
929 *p_slot = NULL;
Ryan Everett098c6652024-01-03 13:03:36 +0000930 psa_unregister_read(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +0200931
Gilles Peskine449bd832023-01-11 14:50:10 +0100932 return status;
Darryl Green06fd18d2018-07-16 11:21:11 +0100933}
Darryl Green940d72c2018-07-13 13:18:51 +0100934
Ronald Cron5c522922020-11-14 16:35:34 +0100935/** Get a key slot containing a transparent key and lock it.
Gilles Peskine28f8f302019-07-24 13:30:31 +0200936 *
937 * A transparent key is a key for which the key material is directly
Ronald Cronddae0f52021-08-24 15:39:44 +0200938 * available, as opposed to a key in a secure element and/or to be used
939 * by a secure element.
Gilles Peskine28f8f302019-07-24 13:30:31 +0200940 *
Ronald Cronddae0f52021-08-24 15:39:44 +0200941 * This is a temporary function that may be used instead of
942 * psa_get_and_lock_key_slot_with_policy() when there is no opaque key support
943 * for a cryptographic operation.
Ronald Cronf95a2b12020-10-22 15:24:49 +0200944 *
Ryan Everett098c6652024-01-03 13:03:36 +0000945 * On success, the returned key slot has been registered for reading.
946 * It is the responsibility of the caller to call psa_unregister_read(slot)
947 * when they have finished reading the contents of the slot.
Gilles Peskine28f8f302019-07-24 13:30:31 +0200948 */
Ronald Cron5c522922020-11-14 16:35:34 +0100949static psa_status_t psa_get_and_lock_transparent_key_slot_with_policy(
950 mbedtls_svc_key_id_t key,
951 psa_key_slot_t **p_slot,
952 psa_key_usage_t usage,
Gilles Peskine449bd832023-01-11 14:50:10 +0100953 psa_algorithm_t alg)
Gilles Peskine28f8f302019-07-24 13:30:31 +0200954{
Gilles Peskine449bd832023-01-11 14:50:10 +0100955 psa_status_t status = psa_get_and_lock_key_slot_with_policy(key, p_slot,
956 usage, alg);
957 if (status != PSA_SUCCESS) {
958 return status;
Gilles Peskine28f8f302019-07-24 13:30:31 +0200959 }
Ronald Cronf95a2b12020-10-22 15:24:49 +0200960
Gilles Peskine449bd832023-01-11 14:50:10 +0100961 if (psa_key_lifetime_is_external((*p_slot)->attr.lifetime)) {
Ryan Everett098c6652024-01-03 13:03:36 +0000962 psa_unregister_read(*p_slot);
Gilles Peskine449bd832023-01-11 14:50:10 +0100963 *p_slot = NULL;
964 return PSA_ERROR_NOT_SUPPORTED;
965 }
966
967 return PSA_SUCCESS;
Gilles Peskine28f8f302019-07-24 13:30:31 +0200968}
Gilles Peskine28f8f302019-07-24 13:30:31 +0200969
Gilles Peskine449bd832023-01-11 14:50:10 +0100970psa_status_t psa_remove_key_data_from_memory(psa_key_slot_t *slot)
Darryl Green40225ba2018-11-15 14:48:15 +0000971{
Gilles Peskine449bd832023-01-11 14:50:10 +0100972 if (slot->key.data != NULL) {
Tom Cosgrove52f7e182023-08-01 09:08:48 +0100973 mbedtls_zeroize_and_free(slot->key.data, slot->key.bytes);
Gilles Peskine449bd832023-01-11 14:50:10 +0100974 }
Ronald Cronea0f8a62020-11-25 17:52:23 +0100975
Ronald Cronea0f8a62020-11-25 17:52:23 +0100976 slot->key.data = NULL;
977 slot->key.bytes = 0;
Darryl Green40225ba2018-11-15 14:48:15 +0000978
Gilles Peskine449bd832023-01-11 14:50:10 +0100979 return PSA_SUCCESS;
Darryl Green40225ba2018-11-15 14:48:15 +0000980}
981
Gilles Peskinef77ed1f2018-12-03 11:58:46 +0100982/** Completely wipe a slot in memory, including its policy.
983 * Persistent storage is not affected. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100984psa_status_t psa_wipe_key_slot(psa_key_slot_t *slot)
Gilles Peskinef77ed1f2018-12-03 11:58:46 +0100985{
Gilles Peskine449bd832023-01-11 14:50:10 +0100986 psa_status_t status = psa_remove_key_data_from_memory(slot);
Ronald Cronddd3d052020-10-30 14:07:07 +0100987
Gilles Peskine449bd832023-01-11 14:50:10 +0100988 /*
989 * As the return error code may not be handled in case of multiple errors,
Ryan Everettaa33c512023-12-21 17:32:07 +0000990 * do our best to report an unexpected amount of registered readers.
991 * Assert with MBEDTLS_TEST_HOOK_TEST_ASSERT that registered_readers is
992 * equal to one:
Gilles Peskine449bd832023-01-11 14:50:10 +0100993 * if the MBEDTLS_TEST_HOOKS configuration option is enabled and the
994 * function is called as part of the execution of a test suite, the
995 * execution of the test suite is stopped in error if the assertion fails.
996 */
Ryan Everett4755e6b2024-01-12 16:35:59 +0000997 if (((slot->state == PSA_SLOT_FULL) ||
998 (slot->state == PSA_SLOT_PENDING_DELETION)) &&
999 (slot->registered_readers != 1)) {
Ryan Everettaa33c512023-12-21 17:32:07 +00001000 MBEDTLS_TEST_HOOK_TEST_ASSERT(slot->registered_readers == 1);
Ronald Cronddd3d052020-10-30 14:07:07 +01001001 status = PSA_ERROR_CORRUPTION_DETECTED;
1002 }
1003
Gilles Peskine3f7cd622019-08-13 15:01:08 +02001004 /* Multipart operations may still be using the key. This is safe
1005 * because all multipart operation objects are independent from
1006 * the key slot: if they need to access the key after the setup
1007 * phase, they have a copy of the key. Note that this means that
1008 * key material can linger until all operations are completed. */
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001009 /* At this point, key material and other type-specific content has
1010 * been wiped. Clear remaining metadata. We can call memset and not
Ryan Everettaa33c512023-12-21 17:32:07 +00001011 * zeroize because the metadata is not particularly sensitive.
1012 * This memset also sets the slot's state to PSA_SLOT_EMPTY. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001013 memset(slot, 0, sizeof(*slot));
1014 return status;
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001015}
1016
Gilles Peskine449bd832023-01-11 14:50:10 +01001017psa_status_t psa_destroy_key(mbedtls_svc_key_id_t key)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001018{
Gilles Peskine2f060a82018-12-04 17:12:32 +01001019 psa_key_slot_t *slot;
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001020 psa_status_t status; /* status of the last operation */
1021 psa_status_t overall_status = PSA_SUCCESS;
Gilles Peskine354f7672019-07-12 23:46:38 +02001022#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1023 psa_se_drv_table_entry_t *driver;
1024#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001025
Gilles Peskine449bd832023-01-11 14:50:10 +01001026 if (mbedtls_svc_key_id_is_null(key)) {
1027 return PSA_SUCCESS;
1028 }
Gilles Peskine1841cf42019-10-08 15:48:25 +02001029
Ronald Cronf2911112020-10-29 17:51:10 +01001030 /*
Ronald Cron19daca92020-11-10 18:08:03 +01001031 * Get the description of the key in a key slot. In case of a persistent
Ronald Cronf2911112020-10-29 17:51:10 +01001032 * key, this will load the key description from persistent memory if not
1033 * done yet. We cannot avoid this loading as without it we don't know if
1034 * the key is operated by an SE or not and this information is needed by
1035 * the current implementation.
1036 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001037 status = psa_get_and_lock_key_slot(key, &slot);
1038 if (status != PSA_SUCCESS) {
1039 return status;
1040 }
Gilles Peskine354f7672019-07-12 23:46:38 +02001041
Ronald Cronf2911112020-10-29 17:51:10 +01001042 /*
1043 * If the key slot containing the key description is under access by the
1044 * library (apart from the present access), the key cannot be destroyed
1045 * yet. For the time being, just return in error. Eventually (to be
1046 * implemented), the key should be destroyed when all accesses have
1047 * stopped.
1048 */
Ryan Everettc70ce572024-01-03 16:04:33 +00001049 if (slot->registered_readers > 1) {
1050 psa_unregister_read(slot);
Gilles Peskine449bd832023-01-11 14:50:10 +01001051 return PSA_ERROR_GENERIC_ERROR;
Ronald Cronf2911112020-10-29 17:51:10 +01001052 }
1053
Ryan Everettc70ce572024-01-03 16:04:33 +00001054 slot->state = PSA_SLOT_PENDING_DELETION;
1055
Gilles Peskine449bd832023-01-11 14:50:10 +01001056 if (PSA_KEY_LIFETIME_IS_READ_ONLY(slot->attr.lifetime)) {
Gilles Peskine6687cd02021-04-21 22:32:05 +02001057 /* Refuse the destruction of a read-only key (which may or may not work
1058 * if we attempt it, depending on whether the key is merely read-only
1059 * by policy or actually physically read-only).
Gilles Peskinef9a046e2021-06-07 23:27:54 +02001060 * Just do the best we can, which is to wipe the copy in memory
1061 * (done in this function's cleanup code). */
1062 overall_status = PSA_ERROR_NOT_PERMITTED;
1063 goto exit;
Gilles Peskine6687cd02021-04-21 22:32:05 +02001064 }
1065
Gilles Peskine354f7672019-07-12 23:46:38 +02001066#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001067 driver = psa_get_se_driver_entry(slot->attr.lifetime);
1068 if (driver != NULL) {
Gilles Peskine60450a42019-07-25 11:32:45 +02001069 /* For a key in a secure element, we need to do three things:
1070 * remove the key file in internal storage, destroy the
1071 * key inside the secure element, and update the driver's
1072 * persistent data. Start a transaction that will encompass these
1073 * three actions. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001074 psa_crypto_prepare_transaction(PSA_CRYPTO_TRANSACTION_DESTROY_KEY);
Gilles Peskine8e338702019-07-30 20:06:31 +02001075 psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
Gilles Peskine449bd832023-01-11 14:50:10 +01001076 psa_crypto_transaction.key.slot = psa_key_slot_get_slot_number(slot);
Gilles Peskine8e338702019-07-30 20:06:31 +02001077 psa_crypto_transaction.key.id = slot->attr.id;
Gilles Peskine449bd832023-01-11 14:50:10 +01001078 status = psa_crypto_save_transaction();
1079 if (status != PSA_SUCCESS) {
1080 (void) psa_crypto_stop_transaction();
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001081 /* We should still try to destroy the key in the secure
1082 * element and the key metadata in storage. This is especially
1083 * important if the error is that the storage is full.
1084 * But how to do it exactly without risking an inconsistent
1085 * state after a reset?
1086 * https://github.com/ARMmbed/mbed-crypto/issues/215
1087 */
1088 overall_status = status;
1089 goto exit;
Gilles Peskinefc762652019-07-22 19:30:34 +02001090 }
1091
Gilles Peskine449bd832023-01-11 14:50:10 +01001092 status = psa_destroy_se_key(driver,
1093 psa_key_slot_get_slot_number(slot));
1094 if (overall_status == PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001095 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001096 }
Gilles Peskinefc762652019-07-22 19:30:34 +02001097 }
Gilles Peskine354f7672019-07-12 23:46:38 +02001098#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1099
Darryl Greend49a4992018-06-18 17:27:26 +01001100#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001101 if (!PSA_KEY_LIFETIME_IS_VOLATILE(slot->attr.lifetime)) {
1102 status = psa_destroy_persistent_key(slot->attr.id);
1103 if (overall_status == PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001104 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001105 }
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001106
Gilles Peskine9ce31c42019-08-13 15:14:20 +02001107 /* TODO: other slots may have a copy of the same key. We should
1108 * invalidate them.
1109 * https://github.com/ARMmbed/mbed-crypto/issues/214
1110 */
Darryl Greend49a4992018-06-18 17:27:26 +01001111 }
1112#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
Gilles Peskine354f7672019-07-12 23:46:38 +02001113
Gilles Peskinefc762652019-07-22 19:30:34 +02001114#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001115 if (driver != NULL) {
1116 status = psa_save_se_persistent_data(driver);
1117 if (overall_status == PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001118 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001119 }
1120 status = psa_crypto_stop_transaction();
1121 if (overall_status == PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001122 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001123 }
Gilles Peskinefc762652019-07-22 19:30:34 +02001124 }
1125#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1126
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001127exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001128 status = psa_wipe_key_slot(slot);
Ryan Everettc70ce572024-01-03 16:04:33 +00001129 /* Prioritize an error from wiping over a storage error */
Gilles Peskine449bd832023-01-11 14:50:10 +01001130 if (status != PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001131 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001132 }
1133 return overall_status;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001134}
1135
Valerio Settib2bcedb2023-07-10 11:24:00 +02001136#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT) || \
John Durkop0e005192020-10-31 22:06:54 -07001137 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Gilles Peskineb699f072019-04-26 16:06:02 +02001138static psa_status_t psa_get_rsa_public_exponent(
1139 const mbedtls_rsa_context *rsa,
Gilles Peskine449bd832023-01-11 14:50:10 +01001140 psa_key_attributes_t *attributes)
Gilles Peskineb699f072019-04-26 16:06:02 +02001141{
1142 mbedtls_mpi mpi;
Janos Follath24eed8d2019-11-22 13:21:35 +00001143 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskineb699f072019-04-26 16:06:02 +02001144 uint8_t *buffer = NULL;
1145 size_t buflen;
Gilles Peskine449bd832023-01-11 14:50:10 +01001146 mbedtls_mpi_init(&mpi);
Gilles Peskineb699f072019-04-26 16:06:02 +02001147
Gilles Peskine449bd832023-01-11 14:50:10 +01001148 ret = mbedtls_rsa_export(rsa, NULL, NULL, NULL, NULL, &mpi);
1149 if (ret != 0) {
Gilles Peskineb699f072019-04-26 16:06:02 +02001150 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001151 }
1152 if (mbedtls_mpi_cmp_int(&mpi, 65537) == 0) {
Gilles Peskine772c8b12019-04-26 17:37:21 +02001153 /* It's the default value, which is reported as an empty string,
1154 * so there's nothing to do. */
1155 goto exit;
1156 }
Gilles Peskineb699f072019-04-26 16:06:02 +02001157
Gilles Peskine449bd832023-01-11 14:50:10 +01001158 buflen = mbedtls_mpi_size(&mpi);
1159 buffer = mbedtls_calloc(1, buflen);
1160 if (buffer == NULL) {
Gilles Peskineb699f072019-04-26 16:06:02 +02001161 ret = MBEDTLS_ERR_MPI_ALLOC_FAILED;
1162 goto exit;
1163 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001164 ret = mbedtls_mpi_write_binary(&mpi, buffer, buflen);
1165 if (ret != 0) {
Gilles Peskineb699f072019-04-26 16:06:02 +02001166 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001167 }
Gilles Peskineb699f072019-04-26 16:06:02 +02001168 attributes->domain_parameters = buffer;
1169 attributes->domain_parameters_size = buflen;
1170
1171exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001172 mbedtls_mpi_free(&mpi);
1173 if (ret != 0) {
1174 mbedtls_free(buffer);
1175 }
1176 return mbedtls_to_psa_error(ret);
Gilles Peskineb699f072019-04-26 16:06:02 +02001177}
Valerio Settib2bcedb2023-07-10 11:24:00 +02001178#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT) ||
John Durkop9814fa22020-11-04 12:28:15 -08001179 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Gilles Peskineb699f072019-04-26 16:06:02 +02001180
Gilles Peskinebfd322f2019-07-23 11:58:03 +02001181/** Retrieve all the publicly-accessible attributes of a key.
1182 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001183psa_status_t psa_get_key_attributes(mbedtls_svc_key_id_t key,
1184 psa_key_attributes_t *attributes)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001185{
Ronald Cronf95a2b12020-10-22 15:24:49 +02001186 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01001187 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01001188 psa_key_slot_t *slot;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001189
Gilles Peskine449bd832023-01-11 14:50:10 +01001190 psa_reset_key_attributes(attributes);
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001191
Gilles Peskine449bd832023-01-11 14:50:10 +01001192 status = psa_get_and_lock_key_slot_with_policy(key, &slot, 0, 0);
1193 if (status != PSA_SUCCESS) {
1194 return status;
1195 }
Gilles Peskineb870b182018-07-06 16:02:09 +02001196
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001197 attributes->core = slot->attr;
Gilles Peskine449bd832023-01-11 14:50:10 +01001198 attributes->core.flags &= (MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY |
1199 MBEDTLS_PSA_KA_MASK_DUAL_USE);
Gilles Peskinec8000c02019-08-02 20:15:51 +02001200
1201#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001202 if (psa_get_se_driver_entry(slot->attr.lifetime) != NULL) {
1203 psa_set_key_slot_number(attributes,
1204 psa_key_slot_get_slot_number(slot));
1205 }
Gilles Peskinec8000c02019-08-02 20:15:51 +02001206#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskineb699f072019-04-26 16:06:02 +02001207
Gilles Peskine449bd832023-01-11 14:50:10 +01001208 switch (slot->attr.type) {
Valerio Settib2bcedb2023-07-10 11:24:00 +02001209#if (defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT) && \
1210 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT)) || \
John Durkop0e005192020-10-31 22:06:54 -07001211 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Gilles Peskinec93b80c2019-05-16 19:39:54 +02001212 case PSA_KEY_TYPE_RSA_KEY_PAIR:
Gilles Peskineb699f072019-04-26 16:06:02 +02001213 case PSA_KEY_TYPE_RSA_PUBLIC_KEY:
Pengyu Lvf75893b2023-12-08 17:21:39 +08001214 /* TODO: This is a temporary situation where domain parameters are deprecated,
1215 * but we need it for namely generating an RSA key with a non-default exponent.
1216 * This would be improved after https://github.com/Mbed-TLS/mbedtls/issues/6494.
Gilles Peskinec9d7f942019-08-13 16:17:16 +02001217 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001218 if (!psa_key_lifetime_is_external(slot->attr.lifetime)) {
Steven Cooremana2371e52020-07-28 14:30:39 +02001219 mbedtls_rsa_context *rsa = NULL;
Steven Cooremana01795d2020-07-24 22:48:15 +02001220
Ronald Cron90857082020-11-25 14:58:33 +01001221 status = mbedtls_psa_rsa_load_representation(
Gilles Peskine449bd832023-01-11 14:50:10 +01001222 slot->attr.type,
1223 slot->key.data,
1224 slot->key.bytes,
1225 &rsa);
1226 if (status != PSA_SUCCESS) {
Steven Cooremana01795d2020-07-24 22:48:15 +02001227 break;
Gilles Peskine449bd832023-01-11 14:50:10 +01001228 }
Steven Cooremana01795d2020-07-24 22:48:15 +02001229
Gilles Peskine449bd832023-01-11 14:50:10 +01001230 status = psa_get_rsa_public_exponent(rsa,
1231 attributes);
1232 mbedtls_rsa_free(rsa);
1233 mbedtls_free(rsa);
Steven Cooremana01795d2020-07-24 22:48:15 +02001234 }
Gilles Peskineb699f072019-04-26 16:06:02 +02001235 break;
Pengyu Lve9efbc22023-12-08 16:59:08 +08001236#else
1237 case PSA_KEY_TYPE_RSA_KEY_PAIR:
1238 case PSA_KEY_TYPE_RSA_PUBLIC_KEY:
1239 attributes->domain_parameters = NULL;
1240 attributes->domain_parameters_size = SIZE_MAX;
1241 break;
Valerio Settib2bcedb2023-07-10 11:24:00 +02001242#endif /* (defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT) && \
1243 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT)) ||
John Durkop9814fa22020-11-04 12:28:15 -08001244 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Gilles Peskineb699f072019-04-26 16:06:02 +02001245 default:
1246 /* Nothing else to do. */
1247 break;
1248 }
1249
Gilles Peskine449bd832023-01-11 14:50:10 +01001250 if (status != PSA_SUCCESS) {
1251 psa_reset_key_attributes(attributes);
1252 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02001253
Ryan Everett1b70a072024-01-04 10:32:49 +00001254 unlock_status = psa_unregister_read(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02001255
Gilles Peskine449bd832023-01-11 14:50:10 +01001256 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001257}
1258
Gilles Peskinec8000c02019-08-02 20:15:51 +02001259#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1260psa_status_t psa_get_key_slot_number(
1261 const psa_key_attributes_t *attributes,
Gilles Peskine449bd832023-01-11 14:50:10 +01001262 psa_key_slot_number_t *slot_number)
Gilles Peskinec8000c02019-08-02 20:15:51 +02001263{
Gilles Peskine449bd832023-01-11 14:50:10 +01001264 if (attributes->core.flags & MBEDTLS_PSA_KA_FLAG_HAS_SLOT_NUMBER) {
Gilles Peskinec8000c02019-08-02 20:15:51 +02001265 *slot_number = attributes->slot_number;
Gilles Peskine449bd832023-01-11 14:50:10 +01001266 return PSA_SUCCESS;
1267 } else {
1268 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinec8000c02019-08-02 20:15:51 +02001269 }
Gilles Peskinec8000c02019-08-02 20:15:51 +02001270}
1271#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1272
Gilles Peskine449bd832023-01-11 14:50:10 +01001273static psa_status_t psa_export_key_buffer_internal(const uint8_t *key_buffer,
1274 size_t key_buffer_size,
1275 uint8_t *data,
1276 size_t data_size,
1277 size_t *data_length)
Steven Cooremana01795d2020-07-24 22:48:15 +02001278{
Gilles Peskine449bd832023-01-11 14:50:10 +01001279 if (key_buffer_size > data_size) {
1280 return PSA_ERROR_BUFFER_TOO_SMALL;
1281 }
1282 memcpy(data, key_buffer, key_buffer_size);
1283 memset(data + key_buffer_size, 0,
1284 data_size - key_buffer_size);
Ronald Crond18b5f82020-11-25 16:46:05 +01001285 *data_length = key_buffer_size;
Gilles Peskine449bd832023-01-11 14:50:10 +01001286 return PSA_SUCCESS;
Steven Cooremana01795d2020-07-24 22:48:15 +02001287}
1288
Ronald Cron7285cda2020-11-26 14:46:37 +01001289psa_status_t psa_export_key_internal(
Ronald Crond18b5f82020-11-25 16:46:05 +01001290 const psa_key_attributes_t *attributes,
1291 const uint8_t *key_buffer, size_t key_buffer_size,
Gilles Peskine449bd832023-01-11 14:50:10 +01001292 uint8_t *data, size_t data_size, size_t *data_length)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001293{
Ronald Crond18b5f82020-11-25 16:46:05 +01001294 psa_key_type_t type = attributes->core.type;
1295
Gilles Peskine449bd832023-01-11 14:50:10 +01001296 if (key_type_is_raw_bytes(type) ||
1297 PSA_KEY_TYPE_IS_RSA(type) ||
Przemek Stekiel472b3f32022-12-01 14:38:49 +01001298 PSA_KEY_TYPE_IS_ECC(type) ||
1299 PSA_KEY_TYPE_IS_DH(type)) {
Gilles Peskine449bd832023-01-11 14:50:10 +01001300 return psa_export_key_buffer_internal(
1301 key_buffer, key_buffer_size,
1302 data, data_size, data_length);
1303 } else {
Ronald Cron9486f9d2020-11-26 13:36:23 +01001304 /* This shouldn't happen in the reference implementation, but
1305 it is valid for a special-purpose implementation to omit
1306 support for exporting certain key types. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001307 return PSA_ERROR_NOT_SUPPORTED;
Ronald Cron9486f9d2020-11-26 13:36:23 +01001308 }
1309}
1310
Gilles Peskine449bd832023-01-11 14:50:10 +01001311psa_status_t psa_export_key(mbedtls_svc_key_id_t key,
1312 uint8_t *data,
1313 size_t data_size,
1314 size_t *data_length)
Ronald Cron9486f9d2020-11-26 13:36:23 +01001315{
1316 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
1317 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
1318 psa_key_slot_t *slot;
1319
Ronald Crone907e552021-01-18 13:22:38 +01001320 /* Reject a zero-length output buffer now, since this can never be a
1321 * valid key representation. This way we know that data must be a valid
1322 * pointer and we can do things like memset(data, ..., data_size). */
Gilles Peskine449bd832023-01-11 14:50:10 +01001323 if (data_size == 0) {
1324 return PSA_ERROR_BUFFER_TOO_SMALL;
1325 }
Ronald Crone907e552021-01-18 13:22:38 +01001326
Ronald Cron9486f9d2020-11-26 13:36:23 +01001327 /* Set the key to empty now, so that even when there are errors, we always
1328 * set data_length to a value between 0 and data_size. On error, setting
1329 * the key to empty is a good choice because an empty key representation is
1330 * unlikely to be accepted anywhere. */
Jaeden Amerof24c7f82018-06-27 17:20:43 +01001331 *data_length = 0;
1332
Ronald Cron9486f9d2020-11-26 13:36:23 +01001333 /* Export requires the EXPORT flag. There is an exception for public keys,
1334 * which don't require any flag, but
1335 * psa_get_and_lock_key_slot_with_policy() takes care of this.
1336 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001337 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
1338 PSA_KEY_USAGE_EXPORT, 0);
1339 if (status != PSA_SUCCESS) {
1340 return status;
1341 }
mohammad160306e79202018-03-28 13:17:44 +03001342
Ronald Crond18b5f82020-11-25 16:46:05 +01001343 psa_key_attributes_t attributes = {
1344 .core = slot->attr
1345 };
Gilles Peskine449bd832023-01-11 14:50:10 +01001346 status = psa_driver_wrapper_export_key(&attributes,
1347 slot->key.data, slot->key.bytes,
1348 data, data_size, data_length);
Ronald Cron9486f9d2020-11-26 13:36:23 +01001349
Ryan Everett1b70a072024-01-04 10:32:49 +00001350 unlock_status = psa_unregister_read(slot);
Ronald Cron9486f9d2020-11-26 13:36:23 +01001351
Gilles Peskine449bd832023-01-11 14:50:10 +01001352 return (status == PSA_SUCCESS) ? unlock_status : status;
Ronald Cron9486f9d2020-11-26 13:36:23 +01001353}
1354
Ronald Cron7285cda2020-11-26 14:46:37 +01001355psa_status_t psa_export_public_key_internal(
Ronald Crond18b5f82020-11-25 16:46:05 +01001356 const psa_key_attributes_t *attributes,
1357 const uint8_t *key_buffer,
1358 size_t key_buffer_size,
1359 uint8_t *data,
1360 size_t data_size,
Gilles Peskine449bd832023-01-11 14:50:10 +01001361 size_t *data_length)
Ronald Cron9486f9d2020-11-26 13:36:23 +01001362{
Ronald Crond18b5f82020-11-25 16:46:05 +01001363 psa_key_type_t type = attributes->core.type;
Ronald Crond18b5f82020-11-25 16:46:05 +01001364
Przemek Stekiel6fd72b62023-04-27 10:20:56 +02001365 if (PSA_KEY_TYPE_IS_PUBLIC_KEY(type) &&
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001366 (PSA_KEY_TYPE_IS_RSA(type) || PSA_KEY_TYPE_IS_ECC(type) ||
1367 PSA_KEY_TYPE_IS_DH(type))) {
Przemek Stekiel6fd72b62023-04-27 10:20:56 +02001368 /* Exporting public -> public */
1369 return psa_export_key_buffer_internal(
1370 key_buffer, key_buffer_size,
1371 data, data_size, data_length);
1372 } else if (PSA_KEY_TYPE_IS_RSA(type)) {
Valerio Settib2bcedb2023-07-10 11:24:00 +02001373#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT) || \
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001374 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
1375 return mbedtls_psa_rsa_export_public_key(attributes,
1376 key_buffer,
1377 key_buffer_size,
1378 data,
1379 data_size,
1380 data_length);
Darryl Green9e2d7a02018-07-24 16:33:30 +01001381#else
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001382 /* We don't know how to convert a private RSA key to public. */
1383 return PSA_ERROR_NOT_SUPPORTED;
Valerio Settib2bcedb2023-07-10 11:24:00 +02001384#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT) ||
John Durkop9814fa22020-11-04 12:28:15 -08001385 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Przemek Stekiel6fd72b62023-04-27 10:20:56 +02001386 } else if (PSA_KEY_TYPE_IS_ECC(type)) {
Valerio Setti27c501a2023-06-27 16:58:52 +02001387#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT) || \
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001388 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
1389 return mbedtls_psa_ecp_export_public_key(attributes,
1390 key_buffer,
1391 key_buffer_size,
1392 data,
1393 data_size,
1394 data_length);
Steven Cooreman560c28a2020-07-24 23:20:24 +02001395#else
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001396 /* We don't know how to convert a private ECC key to public */
1397 return PSA_ERROR_NOT_SUPPORTED;
Valerio Setti27c501a2023-06-27 16:58:52 +02001398#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT) ||
John Durkop9814fa22020-11-04 12:28:15 -08001399 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
Przemek Stekiel6fd72b62023-04-27 10:20:56 +02001400 } else if (PSA_KEY_TYPE_IS_DH(type)) {
Valerio Settia55f0422023-07-10 15:34:41 +02001401#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT) || \
Przemek Stekiel6d85afa2023-04-28 11:42:17 +02001402 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY)
Przemek Stekiel152bb462023-06-01 11:52:39 +02001403 return mbedtls_psa_ffdh_export_public_key(attributes,
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001404 key_buffer,
1405 key_buffer_size,
1406 data, data_size,
1407 data_length);
Przemek Stekiel472b3f32022-12-01 14:38:49 +01001408#else
Przemek Stekiel472b3f32022-12-01 14:38:49 +01001409 return PSA_ERROR_NOT_SUPPORTED;
Valerio Settia55f0422023-07-10 15:34:41 +02001410#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT) ||
Przemek Stekiel6d85afa2023-04-28 11:42:17 +02001411 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) */
Gilles Peskine449bd832023-01-11 14:50:10 +01001412 } else {
Przemek Stekiel0b11ee02023-05-16 13:26:06 +02001413 (void) key_buffer;
1414 (void) key_buffer_size;
1415 (void) data;
1416 (void) data_size;
1417 (void) data_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01001418 return PSA_ERROR_NOT_SUPPORTED;
Steven Cooreman560c28a2020-07-24 23:20:24 +02001419 }
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001420}
Ronald Crond18b5f82020-11-25 16:46:05 +01001421
Gilles Peskine449bd832023-01-11 14:50:10 +01001422psa_status_t psa_export_public_key(mbedtls_svc_key_id_t key,
1423 uint8_t *data,
1424 size_t data_size,
1425 size_t *data_length)
Moran Pekerdd4ea382018-04-03 15:30:03 +03001426{
Ronald Cronf95a2b12020-10-22 15:24:49 +02001427 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01001428 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01001429 psa_key_slot_t *slot;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01001430 psa_key_attributes_t attributes;
Darryl Greendd8fb772018-11-07 16:00:44 +00001431
Ronald Crone907e552021-01-18 13:22:38 +01001432 /* Reject a zero-length output buffer now, since this can never be a
1433 * valid key representation. This way we know that data must be a valid
1434 * pointer and we can do things like memset(data, ..., data_size). */
Gilles Peskine449bd832023-01-11 14:50:10 +01001435 if (data_size == 0) {
1436 return PSA_ERROR_BUFFER_TOO_SMALL;
1437 }
Ronald Crone907e552021-01-18 13:22:38 +01001438
Darryl Greendd8fb772018-11-07 16:00:44 +00001439 /* Set the key to empty now, so that even when there are errors, we always
1440 * set data_length to a value between 0 and data_size. On error, setting
1441 * the key to empty is a good choice because an empty key representation is
1442 * unlikely to be accepted anywhere. */
1443 *data_length = 0;
1444
1445 /* Exporting a public key doesn't require a usage flag. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001446 status = psa_get_and_lock_key_slot_with_policy(key, &slot, 0, 0);
1447 if (status != PSA_SUCCESS) {
1448 return status;
1449 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02001450
Gilles Peskine449bd832023-01-11 14:50:10 +01001451 if (!PSA_KEY_TYPE_IS_ASYMMETRIC(slot->attr.type)) {
1452 status = PSA_ERROR_INVALID_ARGUMENT;
1453 goto exit;
Ronald Cron9486f9d2020-11-26 13:36:23 +01001454 }
1455
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01001456 attributes = (psa_key_attributes_t) {
Ronald Crond18b5f82020-11-25 16:46:05 +01001457 .core = slot->attr
1458 };
Ronald Cron67227982020-11-26 15:16:05 +01001459 status = psa_driver_wrapper_export_public_key(
Ronald Crond18b5f82020-11-25 16:46:05 +01001460 &attributes, slot->key.data, slot->key.bytes,
Gilles Peskine449bd832023-01-11 14:50:10 +01001461 data, data_size, data_length);
Ronald Cron9486f9d2020-11-26 13:36:23 +01001462
1463exit:
Ryan Everett1b70a072024-01-04 10:32:49 +00001464 unlock_status = psa_unregister_read(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02001465
Gilles Peskine449bd832023-01-11 14:50:10 +01001466 return (status == PSA_SUCCESS) ? unlock_status : status;
Moran Pekerdd4ea382018-04-03 15:30:03 +03001467}
1468
Tom Cosgrove6ef9bb32023-03-08 14:19:51 +00001469MBEDTLS_STATIC_ASSERT(
1470 (MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE) == 0,
1471 "One or more key attribute flag is listed as both external-only and dual-use")
1472MBEDTLS_STATIC_ASSERT(
1473 (PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE) == 0,
1474 "One or more key attribute flag is listed as both internal-only and dual-use")
1475MBEDTLS_STATIC_ASSERT(
1476 (PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY) == 0,
1477 "One or more key attribute flag is listed as both internal-only and external-only")
Gilles Peskine91e8c332019-08-02 19:19:39 +02001478
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001479/** Validate that a key policy is internally well-formed.
1480 *
1481 * This function only rejects invalid policies. It does not validate the
1482 * consistency of the policy with respect to other attributes of the key
1483 * such as the key type.
1484 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001485static psa_status_t psa_validate_key_policy(const psa_key_policy_t *policy)
Gilles Peskine4747d192019-04-17 15:05:45 +02001486{
Gilles Peskine449bd832023-01-11 14:50:10 +01001487 if ((policy->usage & ~(PSA_KEY_USAGE_EXPORT |
1488 PSA_KEY_USAGE_COPY |
1489 PSA_KEY_USAGE_ENCRYPT |
1490 PSA_KEY_USAGE_DECRYPT |
1491 PSA_KEY_USAGE_SIGN_MESSAGE |
1492 PSA_KEY_USAGE_VERIFY_MESSAGE |
1493 PSA_KEY_USAGE_SIGN_HASH |
1494 PSA_KEY_USAGE_VERIFY_HASH |
1495 PSA_KEY_USAGE_VERIFY_DERIVATION |
1496 PSA_KEY_USAGE_DERIVE)) != 0) {
1497 return PSA_ERROR_INVALID_ARGUMENT;
1498 }
Gilles Peskine4747d192019-04-17 15:05:45 +02001499
Gilles Peskine449bd832023-01-11 14:50:10 +01001500 return PSA_SUCCESS;
Gilles Peskine4747d192019-04-17 15:05:45 +02001501}
1502
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001503/** Validate the internal consistency of key attributes.
1504 *
1505 * This function only rejects invalid attribute values. If does not
1506 * validate the consistency of the attributes with any key data that may
1507 * be involved in the creation of the key.
1508 *
1509 * Call this function early in the key creation process.
1510 *
1511 * \param[in] attributes Key attributes for the new key.
1512 * \param[out] p_drv On any return, the driver for the key, if any.
1513 * NULL for a transparent key.
1514 *
1515 */
1516static psa_status_t psa_validate_key_attributes(
1517 const psa_key_attributes_t *attributes,
Gilles Peskine449bd832023-01-11 14:50:10 +01001518 psa_se_drv_table_entry_t **p_drv)
Darryl Green0c6575a2018-11-07 16:05:30 +00001519{
Steven Cooreman81fe7c32020-06-08 18:37:19 +02001520 psa_status_t status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine449bd832023-01-11 14:50:10 +01001521 psa_key_lifetime_t lifetime = psa_get_key_lifetime(attributes);
1522 mbedtls_svc_key_id_t key = psa_get_key_id(attributes);
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001523
Gilles Peskine449bd832023-01-11 14:50:10 +01001524 status = psa_validate_key_location(lifetime, p_drv);
1525 if (status != PSA_SUCCESS) {
1526 return status;
Ronald Crond2ed4812020-07-17 16:11:30 +02001527 }
1528
Gilles Peskine449bd832023-01-11 14:50:10 +01001529 status = psa_validate_key_persistence(lifetime);
1530 if (status != PSA_SUCCESS) {
1531 return status;
1532 }
1533
1534 if (PSA_KEY_LIFETIME_IS_VOLATILE(lifetime)) {
1535 if (MBEDTLS_SVC_KEY_ID_GET_KEY_ID(key) != 0) {
1536 return PSA_ERROR_INVALID_ARGUMENT;
1537 }
1538 } else {
1539 if (!psa_is_valid_key_id(psa_get_key_id(attributes), 0)) {
1540 return PSA_ERROR_INVALID_ARGUMENT;
1541 }
1542 }
1543
1544 status = psa_validate_key_policy(&attributes->core.policy);
1545 if (status != PSA_SUCCESS) {
1546 return status;
1547 }
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001548
1549 /* Refuse to create overly large keys.
1550 * Note that this doesn't trigger on import if the attributes don't
1551 * explicitly specify a size (so psa_get_key_bits returns 0), so
1552 * psa_import_key() needs its own checks. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001553 if (psa_get_key_bits(attributes) > PSA_MAX_KEY_BITS) {
1554 return PSA_ERROR_NOT_SUPPORTED;
1555 }
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001556
Gilles Peskine91e8c332019-08-02 19:19:39 +02001557 /* Reject invalid flags. These should not be reachable through the API. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001558 if (attributes->core.flags & ~(MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY |
1559 MBEDTLS_PSA_KA_MASK_DUAL_USE)) {
1560 return PSA_ERROR_INVALID_ARGUMENT;
1561 }
Gilles Peskine91e8c332019-08-02 19:19:39 +02001562
Gilles Peskine449bd832023-01-11 14:50:10 +01001563 return PSA_SUCCESS;
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001564}
1565
Gilles Peskine4747d192019-04-17 15:05:45 +02001566/** Prepare a key slot to receive key material.
1567 *
1568 * This function allocates a key slot and sets its metadata.
1569 *
1570 * If this function fails, call psa_fail_key_creation().
1571 *
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001572 * This function is intended to be used as follows:
1573 * -# Call psa_start_key_creation() to allocate a key slot, prepare
Ronald Croncf56a0a2020-08-04 09:51:30 +02001574 * it with the specified attributes, and in case of a volatile key assign it
1575 * a volatile key identifier.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001576 * -# Populate the slot with the key material.
1577 * -# Call psa_finish_key_creation() to finalize the creation of the slot.
1578 * In case of failure at any step, stop the sequence and call
1579 * psa_fail_key_creation().
1580 *
Ryan Everettb69118e2024-01-02 15:54:32 +00001581 * On success, the key slot's state is PSA_SLOT_FILLING.
1582 * It is the responsibility of the caller to change the slot's state to
1583 * PSA_SLOT_EMPTY/FULL once key creation has finished.
Ronald Cronf95a2b12020-10-22 15:24:49 +02001584 *
Gilles Peskinedf179142019-07-15 22:02:14 +02001585 * \param method An identification of the calling function.
Gilles Peskine011e4282019-06-26 18:34:38 +02001586 * \param[in] attributes Key attributes for the new key.
Gilles Peskine011e4282019-06-26 18:34:38 +02001587 * \param[out] p_slot On success, a pointer to the prepared slot.
1588 * \param[out] p_drv On any return, the driver for the key, if any.
1589 * NULL for a transparent key.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001590 *
1591 * \retval #PSA_SUCCESS
1592 * The key slot is ready to receive key material.
1593 * \return If this function fails, the key slot is an invalid state.
1594 * You must call psa_fail_key_creation() to wipe and free the slot.
Gilles Peskine4747d192019-04-17 15:05:45 +02001595 */
1596static psa_status_t psa_start_key_creation(
Gilles Peskinedf179142019-07-15 22:02:14 +02001597 psa_key_creation_method_t method,
Gilles Peskine4747d192019-04-17 15:05:45 +02001598 const psa_key_attributes_t *attributes,
Gilles Peskine011e4282019-06-26 18:34:38 +02001599 psa_key_slot_t **p_slot,
Gilles Peskine449bd832023-01-11 14:50:10 +01001600 psa_se_drv_table_entry_t **p_drv)
Gilles Peskine4747d192019-04-17 15:05:45 +02001601{
1602 psa_status_t status;
Ronald Cron2a993152020-07-17 14:13:26 +02001603 psa_key_id_t volatile_key_id;
Gilles Peskine4747d192019-04-17 15:05:45 +02001604 psa_key_slot_t *slot;
1605
Gilles Peskinedf179142019-07-15 22:02:14 +02001606 (void) method;
Gilles Peskine011e4282019-06-26 18:34:38 +02001607 *p_drv = NULL;
1608
Gilles Peskine449bd832023-01-11 14:50:10 +01001609 status = psa_validate_key_attributes(attributes, p_drv);
1610 if (status != PSA_SUCCESS) {
1611 return status;
1612 }
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001613
Ryan Everettb69118e2024-01-02 15:54:32 +00001614 status = psa_reserve_free_key_slot(&volatile_key_id, p_slot);
Gilles Peskine449bd832023-01-11 14:50:10 +01001615 if (status != PSA_SUCCESS) {
1616 return status;
1617 }
Gilles Peskine4747d192019-04-17 15:05:45 +02001618 slot = *p_slot;
1619
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001620 /* We're storing the declared bit-size of the key. It's up to each
1621 * creation mechanism to verify that this information is correct.
1622 * It's automatically correct for mechanisms that use the bit-size as
Gilles Peskineb46bef22019-07-30 21:32:04 +02001623 * an input (generate, device) but not for those where the bit-size
Ronald Cronc4d1b512020-07-31 11:26:37 +02001624 * is optional (import, copy). In case of a volatile key, assign it the
1625 * volatile key identifier associated to the slot returned to contain its
1626 * definition. */
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001627
1628 slot->attr = attributes->core;
Gilles Peskine449bd832023-01-11 14:50:10 +01001629 if (PSA_KEY_LIFETIME_IS_VOLATILE(slot->attr.lifetime)) {
Ronald Cronc4d1b512020-07-31 11:26:37 +02001630#if !defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER)
1631 slot->attr.id = volatile_key_id;
1632#else
1633 slot->attr.id.key_id = volatile_key_id;
1634#endif
1635 }
Gilles Peskinec744d992019-07-30 17:26:54 +02001636
Gilles Peskine91e8c332019-08-02 19:19:39 +02001637 /* Erase external-only flags from the internal copy. To access
Gilles Peskine013f5472019-08-07 15:42:14 +02001638 * external-only flags, query `attributes`. Thanks to the check
1639 * in psa_validate_key_attributes(), this leaves the dual-use
Ryan Everettb69118e2024-01-02 15:54:32 +00001640 * flags and any internal flag that psa_reserve_free_key_slot()
Gilles Peskine013f5472019-08-07 15:42:14 +02001641 * may have set. */
1642 slot->attr.flags &= ~MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY;
Gilles Peskine91e8c332019-08-02 19:19:39 +02001643
Gilles Peskinecbaff462019-07-12 23:46:04 +02001644#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined7729582019-08-05 15:55:54 +02001645 /* For a key in a secure element, we need to do three things
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001646 * when creating or registering a persistent key:
Gilles Peskine60450a42019-07-25 11:32:45 +02001647 * create the key file in internal storage, create the
1648 * key inside the secure element, and update the driver's
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001649 * persistent data. This is done by starting a transaction that will
1650 * encompass these three actions.
1651 * For registering a volatile key, we just need to find an appropriate
1652 * slot number inside the SE. Since the key is designated volatile, creating
1653 * a transaction is not required. */
Gilles Peskine60450a42019-07-25 11:32:45 +02001654 /* The first thing to do is to find a slot number for the new key.
1655 * We save the slot number in persistent storage as part of the
1656 * transaction data. It will be needed to recover if the power
1657 * fails during the key creation process, to clean up on the secure
1658 * element side after restarting. Obtaining a slot number from the
1659 * secure element driver updates its persistent state, but we do not yet
1660 * save the driver's persistent state, so that if the power fails,
Gilles Peskinefc762652019-07-22 19:30:34 +02001661 * we can roll back to a state where the key doesn't exist. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001662 if (*p_drv != NULL) {
Ronald Cronea0f8a62020-11-25 17:52:23 +01001663 psa_key_slot_number_t slot_number;
Gilles Peskine449bd832023-01-11 14:50:10 +01001664 status = psa_find_se_slot_for_key(attributes, method, *p_drv,
1665 &slot_number);
1666 if (status != PSA_SUCCESS) {
1667 return status;
1668 }
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001669
Gilles Peskine449bd832023-01-11 14:50:10 +01001670 if (!PSA_KEY_LIFETIME_IS_VOLATILE(attributes->core.lifetime)) {
1671 psa_crypto_prepare_transaction(PSA_CRYPTO_TRANSACTION_CREATE_KEY);
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001672 psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
Ronald Cronea0f8a62020-11-25 17:52:23 +01001673 psa_crypto_transaction.key.slot = slot_number;
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001674 psa_crypto_transaction.key.id = slot->attr.id;
Gilles Peskine449bd832023-01-11 14:50:10 +01001675 status = psa_crypto_save_transaction();
1676 if (status != PSA_SUCCESS) {
1677 (void) psa_crypto_stop_transaction();
1678 return status;
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001679 }
Gilles Peskine66be51c2019-07-25 18:02:52 +02001680 }
Ronald Cronea0f8a62020-11-25 17:52:23 +01001681
1682 status = psa_copy_key_material_into_slot(
Gilles Peskine449bd832023-01-11 14:50:10 +01001683 slot, (uint8_t *) (&slot_number), sizeof(slot_number));
Darryl Green0c6575a2018-11-07 16:05:30 +00001684 }
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001685
Gilles Peskine449bd832023-01-11 14:50:10 +01001686 if (*p_drv == NULL && method == PSA_KEY_CREATION_REGISTER) {
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001687 /* Key registration only makes sense with a secure element. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001688 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001689 }
Gilles Peskinecbaff462019-07-12 23:46:04 +02001690#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1691
Gilles Peskine449bd832023-01-11 14:50:10 +01001692 return PSA_SUCCESS;
Darryl Green0c6575a2018-11-07 16:05:30 +00001693}
Gilles Peskine4747d192019-04-17 15:05:45 +02001694
1695/** Finalize the creation of a key once its key material has been set.
1696 *
1697 * This entails writing the key to persistent storage.
1698 *
1699 * If this function fails, call psa_fail_key_creation().
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001700 * See the documentation of psa_start_key_creation() for the intended use
1701 * of this function.
Gilles Peskine4747d192019-04-17 15:05:45 +02001702 *
Ryan Everettb69118e2024-01-02 15:54:32 +00001703 * If the finalization succeeds, the function sets the key slot's state to
1704 * PSA_SLOT_FULL, and the key slot can no longer be accessed as part of the
1705 * key creation process.
Ronald Cron50972942020-11-14 11:28:25 +01001706 *
Gilles Peskine011e4282019-06-26 18:34:38 +02001707 * \param[in,out] slot Pointer to the slot with key material.
1708 * \param[in] driver The secure element driver for the key,
1709 * or NULL for a transparent key.
Ronald Cron81709fc2020-11-14 12:10:32 +01001710 * \param[out] key On success, identifier of the key. Note that the
1711 * key identifier is also stored in the key slot.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001712 *
1713 * \retval #PSA_SUCCESS
Ronald Croncf56a0a2020-08-04 09:51:30 +02001714 * The key was successfully created.
Gilles Peskineed733552023-02-14 19:21:09 +01001715 * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription
1716 * \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription
1717 * \retval #PSA_ERROR_ALREADY_EXISTS \emptydescription
1718 * \retval #PSA_ERROR_DATA_INVALID \emptydescription
1719 * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription
1720 * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription
Ryan Everettb69118e2024-01-02 15:54:32 +00001721 * \retval #PSA_ERROR_BAD_STATE \emptydescription
gabor-mezei-arm452b0a32020-11-09 17:42:55 +01001722 *
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001723 * \return If this function fails, the key slot is an invalid state.
1724 * You must call psa_fail_key_creation() to wipe and free the slot.
Gilles Peskine4747d192019-04-17 15:05:45 +02001725 */
Gilles Peskine011e4282019-06-26 18:34:38 +02001726static psa_status_t psa_finish_key_creation(
1727 psa_key_slot_t *slot,
Ronald Cron81709fc2020-11-14 12:10:32 +01001728 psa_se_drv_table_entry_t *driver,
1729 mbedtls_svc_key_id_t *key)
Gilles Peskine4747d192019-04-17 15:05:45 +02001730{
1731 psa_status_t status = PSA_SUCCESS;
Gilles Peskine30afafd2019-04-25 13:47:40 +02001732 (void) slot;
Gilles Peskine011e4282019-06-26 18:34:38 +02001733 (void) driver;
Gilles Peskine4747d192019-04-17 15:05:45 +02001734
1735#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001736 if (!PSA_KEY_LIFETIME_IS_VOLATILE(slot->attr.lifetime)) {
Gilles Peskine1df83d42019-07-23 16:13:14 +02001737#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001738 if (driver != NULL) {
Gilles Peskineb46bef22019-07-30 21:32:04 +02001739 psa_se_key_data_storage_t data;
Ronald Cronea0f8a62020-11-25 17:52:23 +01001740 psa_key_slot_number_t slot_number =
Gilles Peskine449bd832023-01-11 14:50:10 +01001741 psa_key_slot_get_slot_number(slot);
Ronald Cronea0f8a62020-11-25 17:52:23 +01001742
Tom Cosgrove6ef9bb32023-03-08 14:19:51 +00001743 MBEDTLS_STATIC_ASSERT(sizeof(slot_number) ==
1744 sizeof(data.slot_number),
1745 "Slot number size does not match psa_se_key_data_storage_t");
1746
Gilles Peskine449bd832023-01-11 14:50:10 +01001747 memcpy(&data.slot_number, &slot_number, sizeof(slot_number));
1748 status = psa_save_persistent_key(&slot->attr,
1749 (uint8_t *) &data,
1750 sizeof(data));
1751 } else
Gilles Peskine1df83d42019-07-23 16:13:14 +02001752#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1753 {
Steven Cooreman40120f62020-10-29 11:42:22 +01001754 /* Key material is saved in export representation in the slot, so
1755 * just pass the slot buffer for storage. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001756 status = psa_save_persistent_key(&slot->attr,
1757 slot->key.data,
1758 slot->key.bytes);
Gilles Peskine1df83d42019-07-23 16:13:14 +02001759 }
Gilles Peskine4747d192019-04-17 15:05:45 +02001760 }
Darryl Green0c6575a2018-11-07 16:05:30 +00001761#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
1762
Gilles Peskinecbaff462019-07-12 23:46:04 +02001763#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined7729582019-08-05 15:55:54 +02001764 /* Finish the transaction for a key creation. This does not
1765 * happen when registering an existing key. Detect this case
1766 * by checking whether a transaction is in progress (actual
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001767 * creation of a persistent key in a secure element requires a transaction,
1768 * but registration or volatile key creation doesn't use one). */
Gilles Peskine449bd832023-01-11 14:50:10 +01001769 if (driver != NULL &&
1770 psa_crypto_transaction.unknown.type == PSA_CRYPTO_TRANSACTION_CREATE_KEY) {
1771 status = psa_save_se_persistent_data(driver);
1772 if (status != PSA_SUCCESS) {
1773 psa_destroy_persistent_key(slot->attr.id);
1774 return status;
Gilles Peskinecbaff462019-07-12 23:46:04 +02001775 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001776 status = psa_crypto_stop_transaction();
Gilles Peskinecbaff462019-07-12 23:46:04 +02001777 }
1778#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1779
Gilles Peskine449bd832023-01-11 14:50:10 +01001780 if (status == PSA_SUCCESS) {
Ronald Cron81709fc2020-11-14 12:10:32 +01001781 *key = slot->attr.id;
Ryan Everettb69118e2024-01-02 15:54:32 +00001782 status = psa_key_slot_state_transition(slot, PSA_SLOT_FILLING,
1783 PSA_SLOT_FULL);
Gilles Peskine449bd832023-01-11 14:50:10 +01001784 if (status != PSA_SUCCESS) {
Ronald Cron81709fc2020-11-14 12:10:32 +01001785 *key = MBEDTLS_SVC_KEY_ID_INIT;
Gilles Peskine449bd832023-01-11 14:50:10 +01001786 }
Ronald Cron81709fc2020-11-14 12:10:32 +01001787 }
Ronald Cron50972942020-11-14 11:28:25 +01001788
Gilles Peskine449bd832023-01-11 14:50:10 +01001789 return status;
Gilles Peskine4747d192019-04-17 15:05:45 +02001790}
1791
1792/** Abort the creation of a key.
1793 *
1794 * You may call this function after calling psa_start_key_creation(),
1795 * or after psa_finish_key_creation() fails. In other circumstances, this
1796 * function may not clean up persistent storage.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001797 * See the documentation of psa_start_key_creation() for the intended use
Ryan Everettb69118e2024-01-02 15:54:32 +00001798 * of this function. Sets the slot's state to PSA_SLOT_EMPTY.
Gilles Peskine4747d192019-04-17 15:05:45 +02001799 *
Gilles Peskine011e4282019-06-26 18:34:38 +02001800 * \param[in,out] slot Pointer to the slot with key material.
1801 * \param[in] driver The secure element driver for the key,
1802 * or NULL for a transparent key.
Gilles Peskine4747d192019-04-17 15:05:45 +02001803 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001804static void psa_fail_key_creation(psa_key_slot_t *slot,
1805 psa_se_drv_table_entry_t *driver)
Gilles Peskine4747d192019-04-17 15:05:45 +02001806{
Gilles Peskine011e4282019-06-26 18:34:38 +02001807 (void) driver;
1808
Gilles Peskine449bd832023-01-11 14:50:10 +01001809 if (slot == NULL) {
Gilles Peskine4747d192019-04-17 15:05:45 +02001810 return;
Gilles Peskine449bd832023-01-11 14:50:10 +01001811 }
Gilles Peskine011e4282019-06-26 18:34:38 +02001812
1813#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Janos Follath1d57a202019-08-13 12:15:34 +01001814 /* TODO: If the key has already been created in the secure
Gilles Peskine011e4282019-06-26 18:34:38 +02001815 * element, and the failure happened later (when saving metadata
1816 * to internal storage), we need to destroy the key in the secure
Gilles Peskinec9d7f942019-08-13 16:17:16 +02001817 * element.
1818 * https://github.com/ARMmbed/mbed-crypto/issues/217
1819 */
Gilles Peskinefc762652019-07-22 19:30:34 +02001820
Gilles Peskined7729582019-08-05 15:55:54 +02001821 /* Abort the ongoing transaction if any (there may not be one if
1822 * the creation process failed before starting one, or if the
1823 * key creation is a registration of a key in a secure element).
1824 * Earlier functions must already have done what it takes to undo any
1825 * partial creation. All that's left is to update the transaction data
1826 * itself. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001827 (void) psa_crypto_stop_transaction();
Gilles Peskine011e4282019-06-26 18:34:38 +02001828#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskine449bd832023-01-11 14:50:10 +01001829 psa_wipe_key_slot(slot);
Gilles Peskine4747d192019-04-17 15:05:45 +02001830}
1831
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001832/** Validate optional attributes during key creation.
1833 *
1834 * Some key attributes are optional during key creation. If they are
1835 * specified in the attributes structure, check that they are consistent
1836 * with the data in the slot.
1837 *
1838 * This function should be called near the end of key creation, after
1839 * the slot in memory is fully populated but before saving persistent data.
1840 */
1841static psa_status_t psa_validate_optional_attributes(
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001842 const psa_key_slot_t *slot,
Gilles Peskine449bd832023-01-11 14:50:10 +01001843 const psa_key_attributes_t *attributes)
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001844{
Gilles Peskine449bd832023-01-11 14:50:10 +01001845 if (attributes->core.type != 0) {
1846 if (attributes->core.type != slot->attr.type) {
1847 return PSA_ERROR_INVALID_ARGUMENT;
1848 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001849 }
1850
Gilles Peskine449bd832023-01-11 14:50:10 +01001851 if (attributes->domain_parameters_size != 0) {
Valerio Settib2bcedb2023-07-10 11:24:00 +02001852#if (defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT) && \
1853 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT)) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01001854 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
1855 if (PSA_KEY_TYPE_IS_RSA(slot->attr.type)) {
Steven Cooremana2371e52020-07-28 14:30:39 +02001856 mbedtls_rsa_context *rsa = NULL;
Steven Cooreman75b74362020-07-28 14:30:13 +02001857 mbedtls_mpi actual, required;
Steven Cooreman6d839f02020-07-30 11:36:45 +02001858 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Steven Cooremana01795d2020-07-24 22:48:15 +02001859
Ronald Cron90857082020-11-25 14:58:33 +01001860 psa_status_t status = mbedtls_psa_rsa_load_representation(
Gilles Peskine449bd832023-01-11 14:50:10 +01001861 slot->attr.type,
1862 slot->key.data,
1863 slot->key.bytes,
1864 &rsa);
1865 if (status != PSA_SUCCESS) {
1866 return status;
1867 }
Steven Cooreman75b74362020-07-28 14:30:13 +02001868
Gilles Peskine449bd832023-01-11 14:50:10 +01001869 mbedtls_mpi_init(&actual);
1870 mbedtls_mpi_init(&required);
1871 ret = mbedtls_rsa_export(rsa,
1872 NULL, NULL, NULL, NULL, &actual);
1873 mbedtls_rsa_free(rsa);
1874 mbedtls_free(rsa);
1875 if (ret != 0) {
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001876 goto rsa_exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001877 }
1878 ret = mbedtls_mpi_read_binary(&required,
1879 attributes->domain_parameters,
1880 attributes->domain_parameters_size);
1881 if (ret != 0) {
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001882 goto rsa_exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001883 }
1884 if (mbedtls_mpi_cmp_mpi(&actual, &required) != 0) {
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001885 ret = MBEDTLS_ERR_RSA_BAD_INPUT_DATA;
Gilles Peskine449bd832023-01-11 14:50:10 +01001886 }
1887rsa_exit:
1888 mbedtls_mpi_free(&actual);
1889 mbedtls_mpi_free(&required);
1890 if (ret != 0) {
1891 return mbedtls_to_psa_error(ret);
1892 }
1893 } else
Valerio Settib2bcedb2023-07-10 11:24:00 +02001894#endif /* (defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT) &&
1895 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT)) ||
John Durkop9814fa22020-11-04 12:28:15 -08001896 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001897 {
Gilles Peskine449bd832023-01-11 14:50:10 +01001898 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001899 }
1900 }
1901
Gilles Peskine449bd832023-01-11 14:50:10 +01001902 if (attributes->core.bits != 0) {
1903 if (attributes->core.bits != slot->attr.bits) {
1904 return PSA_ERROR_INVALID_ARGUMENT;
1905 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001906 }
1907
Gilles Peskine449bd832023-01-11 14:50:10 +01001908 return PSA_SUCCESS;
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001909}
1910
Gilles Peskine449bd832023-01-11 14:50:10 +01001911psa_status_t psa_import_key(const psa_key_attributes_t *attributes,
1912 const uint8_t *data,
1913 size_t data_length,
1914 mbedtls_svc_key_id_t *key)
Gilles Peskine4747d192019-04-17 15:05:45 +02001915{
1916 psa_status_t status;
1917 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02001918 psa_se_drv_table_entry_t *driver = NULL;
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01001919 size_t bits;
Archanad8a83dc2021-06-14 10:04:16 +05301920 size_t storage_size = data_length;
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001921
Ronald Cron81709fc2020-11-14 12:10:32 +01001922 *key = MBEDTLS_SVC_KEY_ID_INIT;
1923
Gilles Peskine0f84d622019-09-12 19:03:13 +02001924 /* Reject zero-length symmetric keys (including raw data key objects).
1925 * This also rejects any key which might be encoded as an empty string,
1926 * which is never valid. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001927 if (data_length == 0) {
1928 return PSA_ERROR_INVALID_ARGUMENT;
1929 }
Gilles Peskine0f84d622019-09-12 19:03:13 +02001930
Archana449608b2021-09-08 15:36:05 +05301931 /* Ensure that the bytes-to-bits conversion cannot overflow. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001932 if (data_length > SIZE_MAX / 8) {
1933 return PSA_ERROR_NOT_SUPPORTED;
1934 }
Archana6ed4bda2021-08-04 10:47:15 +05301935
Gilles Peskine449bd832023-01-11 14:50:10 +01001936 status = psa_start_key_creation(PSA_KEY_CREATION_IMPORT, attributes,
1937 &slot, &driver);
1938 if (status != PSA_SUCCESS) {
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001939 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001940 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001941
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01001942 /* In the case of a transparent key or an opaque key stored in local
Archana449608b2021-09-08 15:36:05 +05301943 * storage ( thus not in the case of importing a key in a secure element
1944 * with storage ( MBEDTLS_PSA_CRYPTO_SE_C ) ),we have to allocate a
1945 * buffer to hold the imported key material. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001946 if (slot->key.data == NULL) {
1947 if (psa_key_lifetime_is_external(attributes->core.lifetime)) {
Archana449608b2021-09-08 15:36:05 +05301948 status = psa_driver_wrapper_get_key_buffer_size_from_key_data(
Gilles Peskine449bd832023-01-11 14:50:10 +01001949 attributes, data, data_length, &storage_size);
1950 if (status != PSA_SUCCESS) {
Archanad8a83dc2021-06-14 10:04:16 +05301951 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001952 }
Archanad8a83dc2021-06-14 10:04:16 +05301953 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001954 status = psa_allocate_buffer_to_slot(slot, storage_size);
1955 if (status != PSA_SUCCESS) {
Gilles Peskineb46bef22019-07-30 21:32:04 +02001956 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001957 }
Gilles Peskine5d309672019-07-12 23:47:28 +02001958 }
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01001959
1960 bits = slot->attr.bits;
Gilles Peskine449bd832023-01-11 14:50:10 +01001961 status = psa_driver_wrapper_import_key(attributes,
1962 data, data_length,
1963 slot->key.data,
1964 slot->key.bytes,
1965 &slot->key.bytes, &bits);
1966 if (status != PSA_SUCCESS) {
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01001967 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001968 }
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01001969
Gilles Peskine449bd832023-01-11 14:50:10 +01001970 if (slot->attr.bits == 0) {
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01001971 slot->attr.bits = (psa_key_bits_t) bits;
Gilles Peskine449bd832023-01-11 14:50:10 +01001972 } else if (bits != slot->attr.bits) {
Steven Cooremanac3434f2021-01-15 17:36:02 +01001973 status = PSA_ERROR_INVALID_ARGUMENT;
1974 goto exit;
Gilles Peskine5d309672019-07-12 23:47:28 +02001975 }
Ronald Cron2ebfdcc2020-11-28 15:54:54 +01001976
Archana6ed4bda2021-08-04 10:47:15 +05301977 /* Enforce a size limit, and in particular ensure that the bit
1978 * size fits in its representation type.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01001979 if (bits > PSA_MAX_KEY_BITS) {
Archana6ed4bda2021-08-04 10:47:15 +05301980 status = PSA_ERROR_NOT_SUPPORTED;
1981 goto exit;
1982 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001983 status = psa_validate_optional_attributes(slot, attributes);
1984 if (status != PSA_SUCCESS) {
Gilles Peskine18017402019-07-24 20:25:59 +02001985 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001986 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001987
Gilles Peskine449bd832023-01-11 14:50:10 +01001988 status = psa_finish_key_creation(slot, driver, key);
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001989exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001990 if (status != PSA_SUCCESS) {
1991 psa_fail_key_creation(slot, driver);
1992 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02001993
Gilles Peskine449bd832023-01-11 14:50:10 +01001994 return status;
Gilles Peskine4747d192019-04-17 15:05:45 +02001995}
1996
Gilles Peskined7729582019-08-05 15:55:54 +02001997#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1998psa_status_t mbedtls_psa_register_se_key(
Gilles Peskine449bd832023-01-11 14:50:10 +01001999 const psa_key_attributes_t *attributes)
Gilles Peskined7729582019-08-05 15:55:54 +02002000{
2001 psa_status_t status;
2002 psa_key_slot_t *slot = NULL;
2003 psa_se_drv_table_entry_t *driver = NULL;
Ronald Croncf56a0a2020-08-04 09:51:30 +02002004 mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT;
Gilles Peskined7729582019-08-05 15:55:54 +02002005
2006 /* Leaving attributes unspecified is not currently supported.
2007 * It could make sense to query the key type and size from the
2008 * secure element, but not all secure elements support this
2009 * and the driver HAL doesn't currently support it. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002010 if (psa_get_key_type(attributes) == PSA_KEY_TYPE_NONE) {
2011 return PSA_ERROR_NOT_SUPPORTED;
2012 }
2013 if (psa_get_key_bits(attributes) == 0) {
2014 return PSA_ERROR_NOT_SUPPORTED;
2015 }
Gilles Peskined7729582019-08-05 15:55:54 +02002016
Gilles Peskine449bd832023-01-11 14:50:10 +01002017 status = psa_start_key_creation(PSA_KEY_CREATION_REGISTER, attributes,
2018 &slot, &driver);
2019 if (status != PSA_SUCCESS) {
Gilles Peskined7729582019-08-05 15:55:54 +02002020 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002021 }
Gilles Peskined7729582019-08-05 15:55:54 +02002022
Gilles Peskine449bd832023-01-11 14:50:10 +01002023 status = psa_finish_key_creation(slot, driver, &key);
Gilles Peskined7729582019-08-05 15:55:54 +02002024
2025exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002026 if (status != PSA_SUCCESS) {
2027 psa_fail_key_creation(slot, driver);
2028 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02002029
Gilles Peskined7729582019-08-05 15:55:54 +02002030 /* Registration doesn't keep the key in RAM. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002031 psa_close_key(key);
2032 return status;
Gilles Peskined7729582019-08-05 15:55:54 +02002033}
2034#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
2035
Gilles Peskine449bd832023-01-11 14:50:10 +01002036psa_status_t psa_copy_key(mbedtls_svc_key_id_t source_key,
2037 const psa_key_attributes_t *specified_attributes,
2038 mbedtls_svc_key_id_t *target_key)
Gilles Peskinef603c712019-01-19 13:40:11 +01002039{
Ronald Cronf95a2b12020-10-22 15:24:49 +02002040 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01002041 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinef603c712019-01-19 13:40:11 +01002042 psa_key_slot_t *source_slot = NULL;
2043 psa_key_slot_t *target_slot = NULL;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002044 psa_key_attributes_t actual_attributes = *specified_attributes;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02002045 psa_se_drv_table_entry_t *driver = NULL;
Archana8a180362021-07-05 02:18:48 +05302046 size_t storage_size = 0;
Gilles Peskinef603c712019-01-19 13:40:11 +01002047
Ronald Cron81709fc2020-11-14 12:10:32 +01002048 *target_key = MBEDTLS_SVC_KEY_ID_INIT;
2049
Archana8a180362021-07-05 02:18:48 +05302050 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002051 source_key, &source_slot, PSA_KEY_USAGE_COPY, 0);
2052 if (status != PSA_SUCCESS) {
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002053 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002054 }
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002055
Gilles Peskine449bd832023-01-11 14:50:10 +01002056 status = psa_validate_optional_attributes(source_slot,
2057 specified_attributes);
2058 if (status != PSA_SUCCESS) {
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002059 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002060 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002061
Archana9d17bf42021-09-10 06:22:44 +05302062 /* The target key type and number of bits have been validated by
2063 * psa_validate_optional_attributes() to be either equal to zero or
2064 * equal to the ones of the source key. So it is safe to inherit
2065 * them from the source key now."
Archana374fe5b2021-09-08 15:50:28 +05302066 * */
Archana9d17bf42021-09-10 06:22:44 +05302067 actual_attributes.core.bits = source_slot->attr.bits;
2068 actual_attributes.core.type = source_slot->attr.type;
Archana374fe5b2021-09-08 15:50:28 +05302069
2070
Gilles Peskine449bd832023-01-11 14:50:10 +01002071 status = psa_restrict_key_policy(source_slot->attr.type,
2072 &actual_attributes.core.policy,
2073 &source_slot->attr.policy);
2074 if (status != PSA_SUCCESS) {
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002075 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002076 }
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002077
Gilles Peskine449bd832023-01-11 14:50:10 +01002078 status = psa_start_key_creation(PSA_KEY_CREATION_COPY, &actual_attributes,
2079 &target_slot, &driver);
2080 if (status != PSA_SUCCESS) {
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002081 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002082 }
2083 if (PSA_KEY_LIFETIME_GET_LOCATION(target_slot->attr.lifetime) !=
2084 PSA_KEY_LIFETIME_GET_LOCATION(source_slot->attr.lifetime)) {
Archana8a180362021-07-05 02:18:48 +05302085 /*
Archana9d17bf42021-09-10 06:22:44 +05302086 * If the source and target keys are stored in different locations,
Archana8a180362021-07-05 02:18:48 +05302087 * the source key would need to be exported as plaintext and re-imported
2088 * in the other location. This has security implications which have not
Archana449608b2021-09-08 15:36:05 +05302089 * been fully mapped. For now, this can be achieved through
Archana8a180362021-07-05 02:18:48 +05302090 * appropriate API invocations from the application, if needed.
2091 * */
Gilles Peskinef4ee6622019-07-24 13:44:30 +02002092 status = PSA_ERROR_NOT_SUPPORTED;
2093 goto exit;
Gilles Peskinef603c712019-01-19 13:40:11 +01002094 }
Archana8a180362021-07-05 02:18:48 +05302095 /*
2096 * When the source and target keys are within the same location,
Archana449608b2021-09-08 15:36:05 +05302097 * - For transparent keys it is a blind copy without any driver invocation,
Archana8a180362021-07-05 02:18:48 +05302098 * - For opaque keys this translates to an invocation of the drivers'
2099 * copy_key entry point through the dispatch layer.
2100 * */
Gilles Peskine449bd832023-01-11 14:50:10 +01002101 if (psa_key_lifetime_is_external(actual_attributes.core.lifetime)) {
2102 status = psa_driver_wrapper_get_key_buffer_size(&actual_attributes,
2103 &storage_size);
2104 if (status != PSA_SUCCESS) {
Archana8a180362021-07-05 02:18:48 +05302105 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002106 }
Archana374fe5b2021-09-08 15:50:28 +05302107
Gilles Peskine449bd832023-01-11 14:50:10 +01002108 status = psa_allocate_buffer_to_slot(target_slot, storage_size);
2109 if (status != PSA_SUCCESS) {
Archana8a180362021-07-05 02:18:48 +05302110 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002111 }
Archana374fe5b2021-09-08 15:50:28 +05302112
Gilles Peskine449bd832023-01-11 14:50:10 +01002113 status = psa_driver_wrapper_copy_key(&actual_attributes,
2114 source_slot->key.data,
2115 source_slot->key.bytes,
2116 target_slot->key.data,
2117 target_slot->key.bytes,
2118 &target_slot->key.bytes);
2119 if (status != PSA_SUCCESS) {
Archana8a180362021-07-05 02:18:48 +05302120 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002121 }
2122 } else {
2123 status = psa_copy_key_material_into_slot(target_slot,
Archana9d17bf42021-09-10 06:22:44 +05302124 source_slot->key.data,
Gilles Peskine449bd832023-01-11 14:50:10 +01002125 source_slot->key.bytes);
2126 if (status != PSA_SUCCESS) {
Archana8a180362021-07-05 02:18:48 +05302127 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002128 }
Archana8a180362021-07-05 02:18:48 +05302129 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002130 status = psa_finish_key_creation(target_slot, driver, target_key);
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002131exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002132 if (status != PSA_SUCCESS) {
2133 psa_fail_key_creation(target_slot, driver);
2134 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02002135
Ryan Everett1b70a072024-01-04 10:32:49 +00002136 unlock_status = psa_unregister_read(source_slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02002137
Gilles Peskine449bd832023-01-11 14:50:10 +01002138 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskinef603c712019-01-19 13:40:11 +01002139}
2140
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02002141
2142
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01002143/****************************************************************/
Gilles Peskine20035e32018-02-03 22:44:14 +01002144/* Message digests */
2145/****************************************************************/
2146
Gilles Peskine449bd832023-01-11 14:50:10 +01002147psa_status_t psa_hash_abort(psa_hash_operation_t *operation)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002148{
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002149 /* Aborting a non-active operation is allowed */
Gilles Peskine449bd832023-01-11 14:50:10 +01002150 if (operation->id == 0) {
2151 return PSA_SUCCESS;
2152 }
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002153
Gilles Peskine449bd832023-01-11 14:50:10 +01002154 psa_status_t status = psa_driver_wrapper_hash_abort(operation);
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002155 operation->id = 0;
2156
Gilles Peskine449bd832023-01-11 14:50:10 +01002157 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002158}
2159
Gilles Peskine449bd832023-01-11 14:50:10 +01002160psa_status_t psa_hash_setup(psa_hash_operation_t *operation,
2161 psa_algorithm_t alg)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002162{
Dave Rodgman685b6a72021-06-24 11:49:14 +01002163 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002164
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002165 /* A context must be freshly initialized before it can be set up. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002166 if (operation->id != 0) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002167 status = PSA_ERROR_BAD_STATE;
2168 goto exit;
2169 }
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002170
Gilles Peskine449bd832023-01-11 14:50:10 +01002171 if (!PSA_ALG_IS_HASH(alg)) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002172 status = PSA_ERROR_INVALID_ARGUMENT;
2173 goto exit;
2174 }
Jaeden Amero36ee5d02019-02-19 09:25:10 +00002175
Steven Cooremanb6bf4bb2021-03-15 19:00:14 +01002176 /* Ensure all of the context is zeroized, since PSA_HASH_OPERATION_INIT only
2177 * directly zeroes the int-sized dummy member of the context union. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002178 memset(&operation->ctx, 0, sizeof(operation->ctx));
Steven Cooreman893232f2021-03-15 12:23:37 +01002179
Gilles Peskine449bd832023-01-11 14:50:10 +01002180 status = psa_driver_wrapper_hash_setup(operation, alg);
Dave Rodgman685b6a72021-06-24 11:49:14 +01002181
2182exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002183 if (status != PSA_SUCCESS) {
2184 psa_hash_abort(operation);
2185 }
Dave Rodgman685b6a72021-06-24 11:49:14 +01002186
2187 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002188}
2189
Gilles Peskine449bd832023-01-11 14:50:10 +01002190psa_status_t psa_hash_update(psa_hash_operation_t *operation,
2191 const uint8_t *input,
2192 size_t input_length)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002193{
Dave Rodgman685b6a72021-06-24 11:49:14 +01002194 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2195
Gilles Peskine449bd832023-01-11 14:50:10 +01002196 if (operation->id == 0) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002197 status = PSA_ERROR_BAD_STATE;
2198 goto exit;
2199 }
Gilles Peskine94e44542018-07-12 16:58:43 +02002200
Steven Cooremanc8288352021-03-04 14:02:19 +01002201 /* Don't require hash implementations to behave correctly on a
2202 * zero-length input, which may have an invalid pointer. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002203 if (input_length == 0) {
2204 return PSA_SUCCESS;
2205 }
Steven Cooremanc8288352021-03-04 14:02:19 +01002206
Gilles Peskine449bd832023-01-11 14:50:10 +01002207 status = psa_driver_wrapper_hash_update(operation, input, input_length);
Dave Rodgman685b6a72021-06-24 11:49:14 +01002208
2209exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002210 if (status != PSA_SUCCESS) {
2211 psa_hash_abort(operation);
2212 }
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002213
Gilles Peskine449bd832023-01-11 14:50:10 +01002214 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002215}
2216
Gilles Peskine449bd832023-01-11 14:50:10 +01002217psa_status_t psa_hash_finish(psa_hash_operation_t *operation,
2218 uint8_t *hash,
2219 size_t hash_size,
2220 size_t *hash_length)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002221{
Steven Cooremanfbe09282021-03-08 18:41:12 +01002222 *hash_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01002223 if (operation->id == 0) {
2224 return PSA_ERROR_BAD_STATE;
2225 }
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002226
Steven Cooreman1e582352021-02-18 17:24:37 +01002227 psa_status_t status = psa_driver_wrapper_hash_finish(
Gilles Peskine449bd832023-01-11 14:50:10 +01002228 operation, hash, hash_size, hash_length);
2229 psa_hash_abort(operation);
2230 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002231}
2232
Gilles Peskine449bd832023-01-11 14:50:10 +01002233psa_status_t psa_hash_verify(psa_hash_operation_t *operation,
2234 const uint8_t *hash,
2235 size_t hash_length)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002236{
Ronald Cron69a63422021-10-18 09:47:58 +02002237 uint8_t actual_hash[PSA_HASH_MAX_SIZE];
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002238 size_t actual_hash_length;
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002239 psa_status_t status = psa_hash_finish(
Gilles Peskine449bd832023-01-11 14:50:10 +01002240 operation,
2241 actual_hash, sizeof(actual_hash),
2242 &actual_hash_length);
Dave Rodgman685b6a72021-06-24 11:49:14 +01002243
Gilles Peskine449bd832023-01-11 14:50:10 +01002244 if (status != PSA_SUCCESS) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002245 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002246 }
Dave Rodgman685b6a72021-06-24 11:49:14 +01002247
Gilles Peskine449bd832023-01-11 14:50:10 +01002248 if (actual_hash_length != hash_length) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002249 status = PSA_ERROR_INVALID_SIGNATURE;
2250 goto exit;
2251 }
2252
Dave Rodgman78701152023-08-29 14:20:18 +01002253 if (mbedtls_ct_memcmp(hash, actual_hash, actual_hash_length) != 0) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002254 status = PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskine449bd832023-01-11 14:50:10 +01002255 }
Dave Rodgman685b6a72021-06-24 11:49:14 +01002256
2257exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002258 mbedtls_platform_zeroize(actual_hash, sizeof(actual_hash));
2259 if (status != PSA_SUCCESS) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002260 psa_hash_abort(operation);
Gilles Peskine449bd832023-01-11 14:50:10 +01002261 }
Dave Rodgman685b6a72021-06-24 11:49:14 +01002262
Gilles Peskine449bd832023-01-11 14:50:10 +01002263 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002264}
2265
Gilles Peskine449bd832023-01-11 14:50:10 +01002266psa_status_t psa_hash_compute(psa_algorithm_t alg,
2267 const uint8_t *input, size_t input_length,
2268 uint8_t *hash, size_t hash_size,
2269 size_t *hash_length)
Gilles Peskine0a749c82019-11-28 19:33:58 +01002270{
Steven Cooremanfbe09282021-03-08 18:41:12 +01002271 *hash_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01002272 if (!PSA_ALG_IS_HASH(alg)) {
2273 return PSA_ERROR_INVALID_ARGUMENT;
2274 }
Steven Cooremanf66d5fd2021-03-08 18:40:40 +01002275
Gilles Peskine449bd832023-01-11 14:50:10 +01002276 return psa_driver_wrapper_hash_compute(alg, input, input_length,
2277 hash, hash_size, hash_length);
Gilles Peskine0a749c82019-11-28 19:33:58 +01002278}
2279
Gilles Peskine449bd832023-01-11 14:50:10 +01002280psa_status_t psa_hash_compare(psa_algorithm_t alg,
2281 const uint8_t *input, size_t input_length,
2282 const uint8_t *hash, size_t hash_length)
Gilles Peskine0a749c82019-11-28 19:33:58 +01002283{
Ronald Cron69a63422021-10-18 09:47:58 +02002284 uint8_t actual_hash[PSA_HASH_MAX_SIZE];
Steven Cooreman84d670d2021-02-18 16:22:53 +01002285 size_t actual_hash_length;
Steven Cooremanf66d5fd2021-03-08 18:40:40 +01002286
Gilles Peskine449bd832023-01-11 14:50:10 +01002287 if (!PSA_ALG_IS_HASH(alg)) {
2288 return PSA_ERROR_INVALID_ARGUMENT;
2289 }
Steven Cooremanf66d5fd2021-03-08 18:40:40 +01002290
Steven Cooreman1e582352021-02-18 17:24:37 +01002291 psa_status_t status = psa_driver_wrapper_hash_compute(
Gilles Peskine449bd832023-01-11 14:50:10 +01002292 alg, input, input_length,
2293 actual_hash, sizeof(actual_hash),
2294 &actual_hash_length);
2295 if (status != PSA_SUCCESS) {
Gilles Peskine60aebec2021-12-13 12:33:18 +01002296 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002297 }
2298 if (actual_hash_length != hash_length) {
Gilles Peskine60aebec2021-12-13 12:33:18 +01002299 status = PSA_ERROR_INVALID_SIGNATURE;
2300 goto exit;
2301 }
Dave Rodgman78701152023-08-29 14:20:18 +01002302 if (mbedtls_ct_memcmp(hash, actual_hash, actual_hash_length) != 0) {
Gilles Peskine60aebec2021-12-13 12:33:18 +01002303 status = PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskine449bd832023-01-11 14:50:10 +01002304 }
Gilles Peskine60aebec2021-12-13 12:33:18 +01002305
2306exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002307 mbedtls_platform_zeroize(actual_hash, sizeof(actual_hash));
2308 return status;
Gilles Peskine0a749c82019-11-28 19:33:58 +01002309}
2310
Gilles Peskine449bd832023-01-11 14:50:10 +01002311psa_status_t psa_hash_clone(const psa_hash_operation_t *source_operation,
2312 psa_hash_operation_t *target_operation)
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002313{
Gilles Peskine449bd832023-01-11 14:50:10 +01002314 if (source_operation->id == 0 ||
2315 target_operation->id != 0) {
2316 return PSA_ERROR_BAD_STATE;
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002317 }
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002318
Gilles Peskine449bd832023-01-11 14:50:10 +01002319 psa_status_t status = psa_driver_wrapper_hash_clone(source_operation,
2320 target_operation);
2321 if (status != PSA_SUCCESS) {
2322 psa_hash_abort(target_operation);
2323 }
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002324
Gilles Peskine449bd832023-01-11 14:50:10 +01002325 return status;
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002326}
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002327
2328
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002329/****************************************************************/
Gilles Peskine8c9def32018-02-08 10:02:12 +01002330/* MAC */
2331/****************************************************************/
2332
Gilles Peskine449bd832023-01-11 14:50:10 +01002333psa_status_t psa_mac_abort(psa_mac_operation_t *operation)
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002334{
Steven Cooremane6804192021-03-19 18:28:56 +01002335 /* Aborting a non-active operation is allowed */
Gilles Peskine449bd832023-01-11 14:50:10 +01002336 if (operation->id == 0) {
2337 return PSA_SUCCESS;
2338 }
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002339
Gilles Peskine449bd832023-01-11 14:50:10 +01002340 psa_status_t status = psa_driver_wrapper_mac_abort(operation);
Steven Cooreman72f736a2021-05-07 14:14:37 +02002341 operation->mac_size = 0;
2342 operation->is_sign = 0;
Steven Cooremane6804192021-03-19 18:28:56 +01002343 operation->id = 0;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002344
Gilles Peskine449bd832023-01-11 14:50:10 +01002345 return status;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002346}
2347
Ronald Cron2dff3b22021-06-17 16:33:22 +02002348static psa_status_t psa_mac_finalize_alg_and_key_validation(
2349 psa_algorithm_t alg,
Ronald Cron79bdd822021-06-17 16:46:44 +02002350 const psa_key_attributes_t *attributes,
Gilles Peskine449bd832023-01-11 14:50:10 +01002351 uint8_t *mac_size)
Gilles Peskine8c9def32018-02-08 10:02:12 +01002352{
Ronald Cronf95a2b12020-10-22 15:24:49 +02002353 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine449bd832023-01-11 14:50:10 +01002354 psa_key_type_t key_type = psa_get_key_type(attributes);
2355 size_t key_bits = psa_get_key_bits(attributes);
Steven Cooreman77e2cc52021-03-19 17:05:52 +01002356
Gilles Peskine449bd832023-01-11 14:50:10 +01002357 if (!PSA_ALG_IS_MAC(alg)) {
2358 return PSA_ERROR_INVALID_ARGUMENT;
2359 }
Steven Cooremane6804192021-03-19 18:28:56 +01002360
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +01002361 /* Validate the combination of key type and algorithm */
Gilles Peskine449bd832023-01-11 14:50:10 +01002362 status = psa_mac_key_can_do(alg, key_type);
2363 if (status != PSA_SUCCESS) {
2364 return status;
2365 }
Steven Cooreman15472f82021-03-02 16:16:22 +01002366
Steven Cooremand1a68f12021-05-10 11:13:41 +02002367 /* Get the output length for the algorithm and key combination */
Gilles Peskine449bd832023-01-11 14:50:10 +01002368 *mac_size = PSA_MAC_LENGTH(key_type, key_bits, alg);
Steven Cooreman15472f82021-03-02 16:16:22 +01002369
Gilles Peskine449bd832023-01-11 14:50:10 +01002370 if (*mac_size < 4) {
Steven Cooreman15472f82021-03-02 16:16:22 +01002371 /* A very short MAC is too short for security since it can be
2372 * brute-forced. Ancient protocols with 32-bit MACs do exist,
2373 * so we make this our minimum, even though 32 bits is still
2374 * too small for security. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002375 return PSA_ERROR_NOT_SUPPORTED;
Steven Cooreman15472f82021-03-02 16:16:22 +01002376 }
Gilles Peskineab1d7ab2018-07-06 16:07:47 +02002377
Gilles Peskine449bd832023-01-11 14:50:10 +01002378 if (*mac_size > PSA_MAC_LENGTH(key_type, key_bits,
2379 PSA_ALG_FULL_LENGTH_MAC(alg))) {
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +01002380 /* It's impossible to "truncate" to a larger length than the full length
2381 * of the algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002382 return PSA_ERROR_INVALID_ARGUMENT;
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +01002383 }
2384
Gilles Peskine449bd832023-01-11 14:50:10 +01002385 if (*mac_size > PSA_MAC_MAX_SIZE) {
Gilles Peskinea9b6c802022-03-16 13:54:49 +01002386 /* PSA_MAC_LENGTH returns the correct length even for a MAC algorithm
2387 * that is disabled in the compile-time configuration. The result can
2388 * therefore be larger than PSA_MAC_MAX_SIZE, which does take the
2389 * configuration into account. In this case, force a return of
2390 * PSA_ERROR_NOT_SUPPORTED here. Otherwise psa_mac_verify(), or
2391 * psa_mac_compute(mac_size=PSA_MAC_MAX_SIZE), would return
2392 * PSA_ERROR_BUFFER_TOO_SMALL for an unsupported algorithm whose MAC size
2393 * is larger than PSA_MAC_MAX_SIZE, which is misleading and which breaks
2394 * systematically generated tests. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002395 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea9b6c802022-03-16 13:54:49 +01002396 }
2397
Gilles Peskine449bd832023-01-11 14:50:10 +01002398 return PSA_SUCCESS;
Ronald Cron2dff3b22021-06-17 16:33:22 +02002399}
2400
Gilles Peskine449bd832023-01-11 14:50:10 +01002401static psa_status_t psa_mac_setup(psa_mac_operation_t *operation,
2402 mbedtls_svc_key_id_t key,
2403 psa_algorithm_t alg,
2404 int is_sign)
Gilles Peskinee59236f2018-01-27 23:32:46 +01002405{
2406 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2407 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Dave Rodgman54648242021-06-24 11:49:45 +01002408 psa_key_slot_t *slot = NULL;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01002409 psa_key_attributes_t attributes;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002410
2411 /* A context must be freshly initialized before it can be set up. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002412 if (operation->id != 0) {
Dave Rodgman54648242021-06-24 11:49:45 +01002413 status = PSA_ERROR_BAD_STATE;
2414 goto exit;
2415 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002416
2417 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002418 key,
2419 &slot,
2420 is_sign ? PSA_KEY_USAGE_SIGN_MESSAGE : PSA_KEY_USAGE_VERIFY_MESSAGE,
2421 alg);
2422 if (status != PSA_SUCCESS) {
Dave Rodgman54648242021-06-24 11:49:45 +01002423 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002424 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002425
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01002426 attributes = (psa_key_attributes_t) {
Gilles Peskine8c9def32018-02-08 10:02:12 +01002427 .core = slot->attr
2428 };
2429
Gilles Peskine449bd832023-01-11 14:50:10 +01002430 status = psa_mac_finalize_alg_and_key_validation(alg, &attributes,
2431 &operation->mac_size);
2432 if (status != PSA_SUCCESS) {
Gilles Peskine8c9def32018-02-08 10:02:12 +01002433 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002434 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002435
2436 operation->is_sign = is_sign;
Steven Cooremane6804192021-03-19 18:28:56 +01002437 /* Dispatch the MAC setup call with validated input */
Gilles Peskine449bd832023-01-11 14:50:10 +01002438 if (is_sign) {
2439 status = psa_driver_wrapper_mac_sign_setup(operation,
2440 &attributes,
2441 slot->key.data,
2442 slot->key.bytes,
2443 alg);
2444 } else {
2445 status = psa_driver_wrapper_mac_verify_setup(operation,
2446 &attributes,
2447 slot->key.data,
2448 slot->key.bytes,
2449 alg);
Gilles Peskine8c9def32018-02-08 10:02:12 +01002450 }
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002451
Gilles Peskinefbfac682018-07-08 20:51:54 +02002452exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002453 if (status != PSA_SUCCESS) {
2454 psa_mac_abort(operation);
2455 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02002456
Ryan Everett1b70a072024-01-04 10:32:49 +00002457 unlock_status = psa_unregister_read(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02002458
Gilles Peskine449bd832023-01-11 14:50:10 +01002459 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002460}
2461
Gilles Peskine449bd832023-01-11 14:50:10 +01002462psa_status_t psa_mac_sign_setup(psa_mac_operation_t *operation,
2463 mbedtls_svc_key_id_t key,
2464 psa_algorithm_t alg)
Gilles Peskine89167cb2018-07-08 20:12:23 +02002465{
Gilles Peskine449bd832023-01-11 14:50:10 +01002466 return psa_mac_setup(operation, key, alg, 1);
Gilles Peskine89167cb2018-07-08 20:12:23 +02002467}
2468
Gilles Peskine449bd832023-01-11 14:50:10 +01002469psa_status_t psa_mac_verify_setup(psa_mac_operation_t *operation,
2470 mbedtls_svc_key_id_t key,
2471 psa_algorithm_t alg)
Gilles Peskine89167cb2018-07-08 20:12:23 +02002472{
Gilles Peskine449bd832023-01-11 14:50:10 +01002473 return psa_mac_setup(operation, key, alg, 0);
Gilles Peskine89167cb2018-07-08 20:12:23 +02002474}
2475
Gilles Peskine449bd832023-01-11 14:50:10 +01002476psa_status_t psa_mac_update(psa_mac_operation_t *operation,
2477 const uint8_t *input,
2478 size_t input_length)
Gilles Peskine8c9def32018-02-08 10:02:12 +01002479{
Gilles Peskine449bd832023-01-11 14:50:10 +01002480 if (operation->id == 0) {
2481 return PSA_ERROR_BAD_STATE;
2482 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002483
Steven Cooreman6e7f2912021-03-19 18:38:46 +01002484 /* Don't require hash implementations to behave correctly on a
2485 * zero-length input, which may have an invalid pointer. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002486 if (input_length == 0) {
2487 return PSA_SUCCESS;
2488 }
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03002489
Gilles Peskine449bd832023-01-11 14:50:10 +01002490 psa_status_t status = psa_driver_wrapper_mac_update(operation,
2491 input, input_length);
2492 if (status != PSA_SUCCESS) {
2493 psa_mac_abort(operation);
2494 }
Steven Cooreman6e7f2912021-03-19 18:38:46 +01002495
Gilles Peskine449bd832023-01-11 14:50:10 +01002496 return status;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002497}
2498
Gilles Peskine449bd832023-01-11 14:50:10 +01002499psa_status_t psa_mac_sign_finish(psa_mac_operation_t *operation,
2500 uint8_t *mac,
2501 size_t mac_size,
2502 size_t *mac_length)
mohammad16036df908f2018-04-02 08:34:15 -07002503{
Steven Cooremana5b860a2021-03-19 19:04:39 +01002504 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2505 psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED;
Steven Cooreman77e2cc52021-03-19 17:05:52 +01002506
Gilles Peskine449bd832023-01-11 14:50:10 +01002507 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002508 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002509 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002510 }
Jaeden Amero252ef282019-02-15 14:05:35 +00002511
Gilles Peskine449bd832023-01-11 14:50:10 +01002512 if (!operation->is_sign) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002513 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002514 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002515 }
Steven Cooreman72f736a2021-05-07 14:14:37 +02002516
Steven Cooreman8af5c5c2021-05-11 11:09:13 +02002517 /* Sanity check. This will guarantee that mac_size != 0 (and so mac != NULL)
2518 * once all the error checks are done. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002519 if (operation->mac_size == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002520 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002521 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002522 }
Steven Cooreman8af5c5c2021-05-11 11:09:13 +02002523
Gilles Peskine449bd832023-01-11 14:50:10 +01002524 if (mac_size < operation->mac_size) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002525 status = PSA_ERROR_BUFFER_TOO_SMALL;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002526 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002527 }
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002528
Gilles Peskine449bd832023-01-11 14:50:10 +01002529 status = psa_driver_wrapper_mac_sign_finish(operation,
2530 mac, operation->mac_size,
2531 mac_length);
Steven Cooreman72f736a2021-05-07 14:14:37 +02002532
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002533exit:
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002534 /* In case of success, set the potential excess room in the output buffer
2535 * to an invalid value, to avoid potentially leaking a longer MAC.
2536 * In case of error, set the output length and content to a safe default,
2537 * such that in case the caller misses an error check, the output would be
2538 * an unachievable MAC.
2539 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002540 if (status != PSA_SUCCESS) {
Steven Cooreman72f736a2021-05-07 14:14:37 +02002541 *mac_length = mac_size;
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002542 operation->mac_size = 0;
Steven Cooreman72f736a2021-05-07 14:14:37 +02002543 }
mohammad16036df908f2018-04-02 08:34:15 -07002544
Paul Elliottdc42ca82023-02-24 18:11:59 +00002545 psa_wipe_tag_output_buffer(mac, status, mac_size, *mac_length);
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002546
Gilles Peskine449bd832023-01-11 14:50:10 +01002547 abort_status = psa_mac_abort(operation);
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002548
Gilles Peskine449bd832023-01-11 14:50:10 +01002549 return status == PSA_SUCCESS ? abort_status : status;
mohammad16036df908f2018-04-02 08:34:15 -07002550}
2551
Gilles Peskine449bd832023-01-11 14:50:10 +01002552psa_status_t psa_mac_verify_finish(psa_mac_operation_t *operation,
2553 const uint8_t *mac,
2554 size_t mac_length)
Gilles Peskine8c9def32018-02-08 10:02:12 +01002555{
Steven Cooremana5b860a2021-03-19 19:04:39 +01002556 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2557 psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED;
Steven Cooreman77e2cc52021-03-19 17:05:52 +01002558
Gilles Peskine449bd832023-01-11 14:50:10 +01002559 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002560 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002561 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002562 }
Jaeden Amero252ef282019-02-15 14:05:35 +00002563
Gilles Peskine449bd832023-01-11 14:50:10 +01002564 if (operation->is_sign) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002565 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002566 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002567 }
Steven Cooreman72f736a2021-05-07 14:14:37 +02002568
Gilles Peskine449bd832023-01-11 14:50:10 +01002569 if (operation->mac_size != mac_length) {
Steven Cooreman72f736a2021-05-07 14:14:37 +02002570 status = PSA_ERROR_INVALID_SIGNATURE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002571 goto exit;
Steven Cooreman72f736a2021-05-07 14:14:37 +02002572 }
2573
Gilles Peskine449bd832023-01-11 14:50:10 +01002574 status = psa_driver_wrapper_mac_verify_finish(operation,
2575 mac, mac_length);
Steven Cooreman72f736a2021-05-07 14:14:37 +02002576
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002577exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002578 abort_status = psa_mac_abort(operation);
mohammad16036df908f2018-04-02 08:34:15 -07002579
Gilles Peskine449bd832023-01-11 14:50:10 +01002580 return status == PSA_SUCCESS ? abort_status : status;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002581}
2582
Gilles Peskine449bd832023-01-11 14:50:10 +01002583static psa_status_t psa_mac_compute_internal(mbedtls_svc_key_id_t key,
2584 psa_algorithm_t alg,
2585 const uint8_t *input,
2586 size_t input_length,
2587 uint8_t *mac,
2588 size_t mac_size,
2589 size_t *mac_length,
2590 int is_sign)
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002591{
2592 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron51131b52021-06-17 17:17:20 +02002593 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
2594 psa_key_slot_t *slot;
2595 uint8_t operation_mac_size = 0;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01002596 psa_key_attributes_t attributes;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002597
Ronald Cron51131b52021-06-17 17:17:20 +02002598 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002599 key,
2600 &slot,
2601 is_sign ? PSA_KEY_USAGE_SIGN_MESSAGE : PSA_KEY_USAGE_VERIFY_MESSAGE,
2602 alg);
2603 if (status != PSA_SUCCESS) {
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002604 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002605 }
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002606
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01002607 attributes = (psa_key_attributes_t) {
Ronald Cron51131b52021-06-17 17:17:20 +02002608 .core = slot->attr
2609 };
2610
Gilles Peskine449bd832023-01-11 14:50:10 +01002611 status = psa_mac_finalize_alg_and_key_validation(alg, &attributes,
2612 &operation_mac_size);
2613 if (status != PSA_SUCCESS) {
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002614 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002615 }
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002616
Gilles Peskine449bd832023-01-11 14:50:10 +01002617 if (mac_size < operation_mac_size) {
Ronald Cron51131b52021-06-17 17:17:20 +02002618 status = PSA_ERROR_BUFFER_TOO_SMALL;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002619 goto exit;
Ronald Cron51131b52021-06-17 17:17:20 +02002620 }
2621
2622 status = psa_driver_wrapper_mac_compute(
Gilles Peskine449bd832023-01-11 14:50:10 +01002623 &attributes,
2624 slot->key.data, slot->key.bytes,
2625 alg,
2626 input, input_length,
2627 mac, operation_mac_size, mac_length);
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002628
2629exit:
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002630 /* In case of success, set the potential excess room in the output buffer
2631 * to an invalid value, to avoid potentially leaking a longer MAC.
2632 * In case of error, set the output length and content to a safe default,
2633 * such that in case the caller misses an error check, the output would be
2634 * an unachievable MAC.
2635 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002636 if (status != PSA_SUCCESS) {
Ronald Cron51131b52021-06-17 17:17:20 +02002637 *mac_length = mac_size;
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002638 operation_mac_size = 0;
Ronald Cron51131b52021-06-17 17:17:20 +02002639 }
Paul Elliottdc42ca82023-02-24 18:11:59 +00002640
2641 psa_wipe_tag_output_buffer(mac, status, mac_size, *mac_length);
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002642
Ryan Everett1b70a072024-01-04 10:32:49 +00002643 unlock_status = psa_unregister_read(slot);
Ronald Cron51131b52021-06-17 17:17:20 +02002644
Gilles Peskine449bd832023-01-11 14:50:10 +01002645 return (status == PSA_SUCCESS) ? unlock_status : status;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002646}
2647
Gilles Peskine449bd832023-01-11 14:50:10 +01002648psa_status_t psa_mac_compute(mbedtls_svc_key_id_t key,
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002649 psa_algorithm_t alg,
2650 const uint8_t *input,
2651 size_t input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002652 uint8_t *mac,
2653 size_t mac_size,
2654 size_t *mac_length)
2655{
2656 return psa_mac_compute_internal(key, alg,
2657 input, input_length,
2658 mac, mac_size, mac_length, 1);
2659}
2660
2661psa_status_t psa_mac_verify(mbedtls_svc_key_id_t key,
2662 psa_algorithm_t alg,
2663 const uint8_t *input,
2664 size_t input_length,
2665 const uint8_t *mac,
2666 size_t mac_length)
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002667{
2668 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Crona587cbc2021-06-18 14:51:29 +02002669 uint8_t actual_mac[PSA_MAC_MAX_SIZE];
2670 size_t actual_mac_length;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002671
Gilles Peskine449bd832023-01-11 14:50:10 +01002672 status = psa_mac_compute_internal(key, alg,
2673 input, input_length,
2674 actual_mac, sizeof(actual_mac),
2675 &actual_mac_length, 0);
2676 if (status != PSA_SUCCESS) {
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002677 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002678 }
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002679
Gilles Peskine449bd832023-01-11 14:50:10 +01002680 if (mac_length != actual_mac_length) {
Ronald Crona587cbc2021-06-18 14:51:29 +02002681 status = PSA_ERROR_INVALID_SIGNATURE;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002682 goto exit;
Ronald Crona587cbc2021-06-18 14:51:29 +02002683 }
Dave Rodgman78701152023-08-29 14:20:18 +01002684 if (mbedtls_ct_memcmp(mac, actual_mac, actual_mac_length) != 0) {
Ronald Crona587cbc2021-06-18 14:51:29 +02002685 status = PSA_ERROR_INVALID_SIGNATURE;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002686 goto exit;
Ronald Crona587cbc2021-06-18 14:51:29 +02002687 }
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002688
2689exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002690 mbedtls_platform_zeroize(actual_mac, sizeof(actual_mac));
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002691
Gilles Peskine449bd832023-01-11 14:50:10 +01002692 return status;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002693}
Gilles Peskinee59236f2018-01-27 23:32:46 +01002694
Gilles Peskinee59236f2018-01-27 23:32:46 +01002695/****************************************************************/
2696/* Asymmetric cryptography */
2697/****************************************************************/
2698
Gilles Peskine449bd832023-01-11 14:50:10 +01002699static psa_status_t psa_sign_verify_check_alg(int input_is_message,
2700 psa_algorithm_t alg)
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002701{
Gilles Peskine449bd832023-01-11 14:50:10 +01002702 if (input_is_message) {
2703 if (!PSA_ALG_IS_SIGN_MESSAGE(alg)) {
2704 return PSA_ERROR_INVALID_ARGUMENT;
2705 }
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002706
Gilles Peskine449bd832023-01-11 14:50:10 +01002707 if (PSA_ALG_IS_SIGN_HASH(alg)) {
2708 if (!PSA_ALG_IS_HASH(PSA_ALG_SIGN_GET_HASH(alg))) {
2709 return PSA_ERROR_INVALID_ARGUMENT;
2710 }
2711 }
2712 } else {
2713 if (!PSA_ALG_IS_SIGN_HASH(alg)) {
2714 return PSA_ERROR_INVALID_ARGUMENT;
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002715 }
2716 }
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002717
Gilles Peskine449bd832023-01-11 14:50:10 +01002718 return PSA_SUCCESS;
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002719}
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002720
Gilles Peskine449bd832023-01-11 14:50:10 +01002721static psa_status_t psa_sign_internal(mbedtls_svc_key_id_t key,
2722 int input_is_message,
2723 psa_algorithm_t alg,
2724 const uint8_t *input,
2725 size_t input_length,
2726 uint8_t *signature,
2727 size_t signature_size,
2728 size_t *signature_length)
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002729{
2730 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2731 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
2732 psa_key_slot_t *slot;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01002733 psa_key_attributes_t attributes;
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002734
2735 *signature_length = 0;
2736
Gilles Peskine449bd832023-01-11 14:50:10 +01002737 status = psa_sign_verify_check_alg(input_is_message, alg);
2738 if (status != PSA_SUCCESS) {
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002739 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01002740 }
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002741
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002742 /* Immediately reject a zero-length signature buffer. This guarantees
gabor-mezei-arm12b4f342021-05-05 13:54:55 +02002743 * that signature must be a valid pointer. (On the other hand, the input
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002744 * buffer can in principle be empty since it doesn't actually have
2745 * to be a hash.) */
Gilles Peskine449bd832023-01-11 14:50:10 +01002746 if (signature_size == 0) {
2747 return PSA_ERROR_BUFFER_TOO_SMALL;
2748 }
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002749
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002750 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002751 key, &slot,
2752 input_is_message ? PSA_KEY_USAGE_SIGN_MESSAGE :
2753 PSA_KEY_USAGE_SIGN_HASH,
2754 alg);
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002755
Gilles Peskine449bd832023-01-11 14:50:10 +01002756 if (status != PSA_SUCCESS) {
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002757 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002758 }
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002759
Gilles Peskine449bd832023-01-11 14:50:10 +01002760 if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) {
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002761 status = PSA_ERROR_INVALID_ARGUMENT;
2762 goto exit;
2763 }
2764
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01002765 attributes = (psa_key_attributes_t) {
Gilles Peskine449bd832023-01-11 14:50:10 +01002766 .core = slot->attr
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002767 };
2768
Gilles Peskine449bd832023-01-11 14:50:10 +01002769 if (input_is_message) {
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002770 status = psa_driver_wrapper_sign_message(
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002771 &attributes, slot->key.data, slot->key.bytes,
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002772 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002773 signature, signature_size, signature_length);
2774 } else {
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002775
2776 status = psa_driver_wrapper_sign_hash(
2777 &attributes, slot->key.data, slot->key.bytes,
2778 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002779 signature, signature_size, signature_length);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002780 }
2781
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002782
2783exit:
Paul Elliott59200a22023-02-21 15:07:40 +00002784 psa_wipe_tag_output_buffer(signature, status, signature_size,
2785 *signature_length);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002786
Ryan Everett1b70a072024-01-04 10:32:49 +00002787 unlock_status = psa_unregister_read(slot);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002788
Gilles Peskine449bd832023-01-11 14:50:10 +01002789 return (status == PSA_SUCCESS) ? unlock_status : status;
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002790}
2791
Gilles Peskine449bd832023-01-11 14:50:10 +01002792static psa_status_t psa_verify_internal(mbedtls_svc_key_id_t key,
2793 int input_is_message,
2794 psa_algorithm_t alg,
2795 const uint8_t *input,
2796 size_t input_length,
2797 const uint8_t *signature,
2798 size_t signature_length)
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002799{
2800 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2801 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
2802 psa_key_slot_t *slot;
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002803
Gilles Peskine449bd832023-01-11 14:50:10 +01002804 status = psa_sign_verify_check_alg(input_is_message, alg);
2805 if (status != PSA_SUCCESS) {
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002806 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01002807 }
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002808
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002809 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002810 key, &slot,
2811 input_is_message ? PSA_KEY_USAGE_VERIFY_MESSAGE :
2812 PSA_KEY_USAGE_VERIFY_HASH,
2813 alg);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002814
Gilles Peskine449bd832023-01-11 14:50:10 +01002815 if (status != PSA_SUCCESS) {
2816 return status;
2817 }
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002818
2819 psa_key_attributes_t attributes = {
Gilles Peskine449bd832023-01-11 14:50:10 +01002820 .core = slot->attr
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002821 };
2822
Gilles Peskine449bd832023-01-11 14:50:10 +01002823 if (input_is_message) {
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002824 status = psa_driver_wrapper_verify_message(
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002825 &attributes, slot->key.data, slot->key.bytes,
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002826 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002827 signature, signature_length);
2828 } else {
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002829 status = psa_driver_wrapper_verify_hash(
2830 &attributes, slot->key.data, slot->key.bytes,
2831 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002832 signature, signature_length);
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002833 }
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002834
Ryan Everett1b70a072024-01-04 10:32:49 +00002835 unlock_status = psa_unregister_read(slot);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002836
Gilles Peskine449bd832023-01-11 14:50:10 +01002837 return (status == PSA_SUCCESS) ? unlock_status : status;
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002838
2839}
2840
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02002841psa_status_t psa_sign_message_builtin(
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002842 const psa_key_attributes_t *attributes,
2843 const uint8_t *key_buffer,
2844 size_t key_buffer_size,
2845 psa_algorithm_t alg,
2846 const uint8_t *input,
2847 size_t input_length,
2848 uint8_t *signature,
2849 size_t signature_size,
Gilles Peskine449bd832023-01-11 14:50:10 +01002850 size_t *signature_length)
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002851{
2852 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002853
Gilles Peskine449bd832023-01-11 14:50:10 +01002854 if (PSA_ALG_IS_SIGN_HASH(alg)) {
gabor-mezei-armf9820f92021-05-03 16:26:20 +02002855 size_t hash_length;
2856 uint8_t hash[PSA_HASH_MAX_SIZE];
2857
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002858 status = psa_driver_wrapper_hash_compute(
Gilles Peskine449bd832023-01-11 14:50:10 +01002859 PSA_ALG_SIGN_GET_HASH(alg),
2860 input, input_length,
2861 hash, sizeof(hash), &hash_length);
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002862
Gilles Peskine449bd832023-01-11 14:50:10 +01002863 if (status != PSA_SUCCESS) {
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002864 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01002865 }
gabor-mezei-armf9820f92021-05-03 16:26:20 +02002866
2867 return psa_driver_wrapper_sign_hash(
Gilles Peskine449bd832023-01-11 14:50:10 +01002868 attributes, key_buffer, key_buffer_size,
2869 alg, hash, hash_length,
2870 signature, signature_size, signature_length);
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002871 }
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002872
Gilles Peskine449bd832023-01-11 14:50:10 +01002873 return PSA_ERROR_NOT_SUPPORTED;
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002874}
2875
Gilles Peskine449bd832023-01-11 14:50:10 +01002876psa_status_t psa_sign_message(mbedtls_svc_key_id_t key,
2877 psa_algorithm_t alg,
2878 const uint8_t *input,
2879 size_t input_length,
2880 uint8_t *signature,
2881 size_t signature_size,
2882 size_t *signature_length)
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002883{
2884 return psa_sign_internal(
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002885 key, 1, alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002886 signature, signature_size, signature_length);
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002887}
2888
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02002889psa_status_t psa_verify_message_builtin(
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002890 const psa_key_attributes_t *attributes,
2891 const uint8_t *key_buffer,
2892 size_t key_buffer_size,
2893 psa_algorithm_t alg,
2894 const uint8_t *input,
2895 size_t input_length,
2896 const uint8_t *signature,
Gilles Peskine449bd832023-01-11 14:50:10 +01002897 size_t signature_length)
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002898{
2899 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002900
Gilles Peskine449bd832023-01-11 14:50:10 +01002901 if (PSA_ALG_IS_SIGN_HASH(alg)) {
gabor-mezei-armf9820f92021-05-03 16:26:20 +02002902 size_t hash_length;
2903 uint8_t hash[PSA_HASH_MAX_SIZE];
2904
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002905 status = psa_driver_wrapper_hash_compute(
Gilles Peskine449bd832023-01-11 14:50:10 +01002906 PSA_ALG_SIGN_GET_HASH(alg),
2907 input, input_length,
2908 hash, sizeof(hash), &hash_length);
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002909
Gilles Peskine449bd832023-01-11 14:50:10 +01002910 if (status != PSA_SUCCESS) {
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002911 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01002912 }
gabor-mezei-armf9820f92021-05-03 16:26:20 +02002913
2914 return psa_driver_wrapper_verify_hash(
Gilles Peskine449bd832023-01-11 14:50:10 +01002915 attributes, key_buffer, key_buffer_size,
2916 alg, hash, hash_length,
2917 signature, signature_length);
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002918 }
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002919
Gilles Peskine449bd832023-01-11 14:50:10 +01002920 return PSA_ERROR_NOT_SUPPORTED;
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002921}
2922
Gilles Peskine449bd832023-01-11 14:50:10 +01002923psa_status_t psa_verify_message(mbedtls_svc_key_id_t key,
2924 psa_algorithm_t alg,
2925 const uint8_t *input,
2926 size_t input_length,
2927 const uint8_t *signature,
2928 size_t signature_length)
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002929{
2930 return psa_verify_internal(
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002931 key, 1, alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002932 signature, signature_length);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002933}
2934
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02002935psa_status_t psa_sign_hash_builtin(
Ronald Cron18659932020-12-08 16:32:23 +01002936 const psa_key_attributes_t *attributes,
2937 const uint8_t *key_buffer, size_t key_buffer_size,
2938 psa_algorithm_t alg, const uint8_t *hash, size_t hash_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002939 uint8_t *signature, size_t signature_size, size_t *signature_length)
Gilles Peskinee59236f2018-01-27 23:32:46 +01002940{
Gilles Peskine449bd832023-01-11 14:50:10 +01002941 if (attributes->core.type == PSA_KEY_TYPE_RSA_KEY_PAIR) {
2942 if (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) ||
2943 PSA_ALG_IS_RSA_PSS(alg)) {
Ronald Cron4501c982021-03-19 20:09:32 +01002944#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01002945 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
2946 return mbedtls_psa_rsa_sign_hash(
2947 attributes,
2948 key_buffer, key_buffer_size,
2949 alg, hash, hash_length,
2950 signature, signature_size, signature_length);
Ronald Cron4501c982021-03-19 20:09:32 +01002951#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
2952 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
Gilles Peskine449bd832023-01-11 14:50:10 +01002953 } else {
2954 return PSA_ERROR_INVALID_ARGUMENT;
Steven Cooremanacda8342020-07-24 23:09:52 +02002955 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002956 } else if (PSA_KEY_TYPE_IS_ECC(attributes->core.type)) {
2957 if (PSA_ALG_IS_ECDSA(alg)) {
Ronald Cron4501c982021-03-19 20:09:32 +01002958#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01002959 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
2960 return mbedtls_psa_ecdsa_sign_hash(
2961 attributes,
2962 key_buffer, key_buffer_size,
2963 alg, hash, hash_length,
2964 signature, signature_size, signature_length);
Gilles Peskinee59236f2018-01-27 23:32:46 +01002965#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
2966 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Gilles Peskine449bd832023-01-11 14:50:10 +01002967 } else {
2968 return PSA_ERROR_INVALID_ARGUMENT;
Ronald Cron4501c982021-03-19 20:09:32 +01002969 }
Ronald Cron8a494f32021-02-17 09:49:51 +01002970 }
Ronald Cron4501c982021-03-19 20:09:32 +01002971
Gilles Peskine449bd832023-01-11 14:50:10 +01002972 (void) key_buffer;
2973 (void) key_buffer_size;
2974 (void) hash;
2975 (void) hash_length;
2976 (void) signature;
2977 (void) signature_size;
2978 (void) signature_length;
Ronald Cron4501c982021-03-19 20:09:32 +01002979
Gilles Peskine449bd832023-01-11 14:50:10 +01002980 return PSA_ERROR_NOT_SUPPORTED;
Ronald Cron18659932020-12-08 16:32:23 +01002981}
Gilles Peskinee59236f2018-01-27 23:32:46 +01002982
Gilles Peskine449bd832023-01-11 14:50:10 +01002983psa_status_t psa_sign_hash(mbedtls_svc_key_id_t key,
2984 psa_algorithm_t alg,
2985 const uint8_t *hash,
2986 size_t hash_length,
2987 uint8_t *signature,
2988 size_t signature_size,
2989 size_t *signature_length)
Gilles Peskinee59236f2018-01-27 23:32:46 +01002990{
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002991 return psa_sign_internal(
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002992 key, 0, alg, hash, hash_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002993 signature, signature_size, signature_length);
itayzafrir5c753392018-05-08 11:18:38 +03002994}
2995
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02002996psa_status_t psa_verify_hash_builtin(
Ronald Cron18659932020-12-08 16:32:23 +01002997 const psa_key_attributes_t *attributes,
2998 const uint8_t *key_buffer, size_t key_buffer_size,
2999 psa_algorithm_t alg, const uint8_t *hash, size_t hash_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003000 const uint8_t *signature, size_t signature_length)
itayzafrir5c753392018-05-08 11:18:38 +03003001{
Gilles Peskine449bd832023-01-11 14:50:10 +01003002 if (PSA_KEY_TYPE_IS_RSA(attributes->core.type)) {
3003 if (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) ||
3004 PSA_ALG_IS_RSA_PSS(alg)) {
Ronald Cron4501c982021-03-19 20:09:32 +01003005#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01003006 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
3007 return mbedtls_psa_rsa_verify_hash(
3008 attributes,
3009 key_buffer, key_buffer_size,
3010 alg, hash, hash_length,
3011 signature, signature_length);
Ronald Cron4501c982021-03-19 20:09:32 +01003012#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
3013 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
Gilles Peskine449bd832023-01-11 14:50:10 +01003014 } else {
3015 return PSA_ERROR_INVALID_ARGUMENT;
Steven Cooremanacda8342020-07-24 23:09:52 +02003016 }
Gilles Peskine449bd832023-01-11 14:50:10 +01003017 } else if (PSA_KEY_TYPE_IS_ECC(attributes->core.type)) {
3018 if (PSA_ALG_IS_ECDSA(alg)) {
Ronald Cron4501c982021-03-19 20:09:32 +01003019#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01003020 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
3021 return mbedtls_psa_ecdsa_verify_hash(
3022 attributes,
3023 key_buffer, key_buffer_size,
3024 alg, hash, hash_length,
3025 signature, signature_length);
Ronald Cron4501c982021-03-19 20:09:32 +01003026#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3027 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Gilles Peskine449bd832023-01-11 14:50:10 +01003028 } else {
3029 return PSA_ERROR_INVALID_ARGUMENT;
Ronald Cron4501c982021-03-19 20:09:32 +01003030 }
Ronald Cron8a494f32021-02-17 09:49:51 +01003031 }
Ronald Cron4501c982021-03-19 20:09:32 +01003032
Gilles Peskine449bd832023-01-11 14:50:10 +01003033 (void) key_buffer;
3034 (void) key_buffer_size;
3035 (void) hash;
3036 (void) hash_length;
3037 (void) signature;
3038 (void) signature_length;
Ronald Cron4501c982021-03-19 20:09:32 +01003039
Gilles Peskine449bd832023-01-11 14:50:10 +01003040 return PSA_ERROR_NOT_SUPPORTED;
Ronald Cron18659932020-12-08 16:32:23 +01003041}
3042
Gilles Peskine449bd832023-01-11 14:50:10 +01003043psa_status_t psa_verify_hash(mbedtls_svc_key_id_t key,
3044 psa_algorithm_t alg,
3045 const uint8_t *hash,
3046 size_t hash_length,
3047 const uint8_t *signature,
3048 size_t signature_length)
itayzafrir5c753392018-05-08 11:18:38 +03003049{
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003050 return psa_verify_internal(
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02003051 key, 0, alg, hash, hash_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003052 signature, signature_length);
Gilles Peskinee59236f2018-01-27 23:32:46 +01003053}
3054
Gilles Peskine449bd832023-01-11 14:50:10 +01003055psa_status_t psa_asymmetric_encrypt(mbedtls_svc_key_id_t key,
3056 psa_algorithm_t alg,
3057 const uint8_t *input,
3058 size_t input_length,
3059 const uint8_t *salt,
3060 size_t salt_length,
3061 uint8_t *output,
3062 size_t output_size,
3063 size_t *output_length)
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003064{
Ronald Cronf95a2b12020-10-22 15:24:49 +02003065 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01003066 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01003067 psa_key_slot_t *slot;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01003068 psa_key_attributes_t attributes;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003069
Darryl Green5cc689a2018-07-24 15:34:10 +01003070 (void) input;
3071 (void) input_length;
3072 (void) salt;
3073 (void) output;
3074 (void) output_size;
3075
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03003076 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003077
Gilles Peskine449bd832023-01-11 14:50:10 +01003078 if (!PSA_ALG_IS_RSA_OAEP(alg) && salt_length != 0) {
3079 return PSA_ERROR_INVALID_ARGUMENT;
3080 }
Gilles Peskineb3fc05d2018-06-30 19:04:35 +02003081
Ronald Cron5c522922020-11-14 16:35:34 +01003082 status = psa_get_and_lock_transparent_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01003083 key, &slot, PSA_KEY_USAGE_ENCRYPT, alg);
3084 if (status != PSA_SUCCESS) {
3085 return status;
3086 }
3087 if (!(PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type) ||
3088 PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type))) {
Ronald Cronf95a2b12020-10-22 15:24:49 +02003089 status = PSA_ERROR_INVALID_ARGUMENT;
3090 goto exit;
3091 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003092
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01003093 attributes = (psa_key_attributes_t) {
Gilles Peskine449bd832023-01-11 14:50:10 +01003094 .core = slot->attr
Przemyslaw Stekiel19e61422021-12-09 11:09:11 +01003095 };
Steven Cooremana2371e52020-07-28 14:30:39 +02003096
Przemyslaw Stekiel19e61422021-12-09 11:09:11 +01003097 status = psa_driver_wrapper_asymmetric_encrypt(
3098 &attributes, slot->key.data, slot->key.bytes,
3099 alg, input, input_length, salt, salt_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003100 output, output_size, output_length);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003101exit:
Ryan Everett1b70a072024-01-04 10:32:49 +00003102 unlock_status = psa_unregister_read(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003103
Gilles Peskine449bd832023-01-11 14:50:10 +01003104 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine5b051bc2018-05-31 13:25:48 +02003105}
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003106
Gilles Peskine449bd832023-01-11 14:50:10 +01003107psa_status_t psa_asymmetric_decrypt(mbedtls_svc_key_id_t key,
3108 psa_algorithm_t alg,
3109 const uint8_t *input,
3110 size_t input_length,
3111 const uint8_t *salt,
3112 size_t salt_length,
3113 uint8_t *output,
3114 size_t output_size,
3115 size_t *output_length)
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003116{
Ronald Cronf95a2b12020-10-22 15:24:49 +02003117 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01003118 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01003119 psa_key_slot_t *slot;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01003120 psa_key_attributes_t attributes;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003121
Darryl Green5cc689a2018-07-24 15:34:10 +01003122 (void) input;
3123 (void) input_length;
3124 (void) salt;
3125 (void) output;
3126 (void) output_size;
3127
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03003128 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003129
Gilles Peskine449bd832023-01-11 14:50:10 +01003130 if (!PSA_ALG_IS_RSA_OAEP(alg) && salt_length != 0) {
3131 return PSA_ERROR_INVALID_ARGUMENT;
3132 }
Gilles Peskineb3fc05d2018-06-30 19:04:35 +02003133
Ronald Cron5c522922020-11-14 16:35:34 +01003134 status = psa_get_and_lock_transparent_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01003135 key, &slot, PSA_KEY_USAGE_DECRYPT, alg);
3136 if (status != PSA_SUCCESS) {
3137 return status;
3138 }
3139 if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) {
Ronald Cronf95a2b12020-10-22 15:24:49 +02003140 status = PSA_ERROR_INVALID_ARGUMENT;
3141 goto exit;
3142 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003143
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01003144 attributes = (psa_key_attributes_t) {
Gilles Peskine449bd832023-01-11 14:50:10 +01003145 .core = slot->attr
Przemyslaw Stekiel8d45c002021-12-13 08:58:19 +01003146 };
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003147
Przemyslaw Stekiel8d45c002021-12-13 08:58:19 +01003148 status = psa_driver_wrapper_asymmetric_decrypt(
3149 &attributes, slot->key.data, slot->key.bytes,
3150 alg, input, input_length, salt, salt_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003151 output, output_size, output_length);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003152
3153exit:
Ryan Everett1b70a072024-01-04 10:32:49 +00003154 unlock_status = psa_unregister_read(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003155
Gilles Peskine449bd832023-01-11 14:50:10 +01003156 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine5b051bc2018-05-31 13:25:48 +02003157}
Gilles Peskinee59236f2018-01-27 23:32:46 +01003158
Paul Elliott9fe12f62022-11-30 19:16:02 +00003159/****************************************************************/
3160/* Asymmetric interruptible cryptography */
3161/****************************************************************/
3162
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003163static uint32_t psa_interruptible_max_ops = PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED;
3164
Paul Elliott9fe12f62022-11-30 19:16:02 +00003165void psa_interruptible_set_max_ops(uint32_t max_ops)
3166{
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003167 psa_interruptible_max_ops = max_ops;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003168}
3169
3170uint32_t psa_interruptible_get_max_ops(void)
3171{
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003172 return psa_interruptible_max_ops;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003173}
3174
Paul Elliott9fe12f62022-11-30 19:16:02 +00003175uint32_t psa_sign_hash_get_num_ops(
3176 const psa_sign_hash_interruptible_operation_t *operation)
3177{
Paul Elliott296ede92022-12-15 17:00:30 +00003178 return operation->num_ops;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003179}
3180
3181uint32_t psa_verify_hash_get_num_ops(
3182 const psa_verify_hash_interruptible_operation_t *operation)
3183{
Paul Elliott296ede92022-12-15 17:00:30 +00003184 return operation->num_ops;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003185}
3186
Paul Elliott59ad9452022-12-18 15:09:02 +00003187static psa_status_t psa_sign_hash_abort_internal(
3188 psa_sign_hash_interruptible_operation_t *operation)
3189{
3190 if (operation->id == 0) {
3191 /* The object has (apparently) been initialized but it is not (yet)
3192 * in use. It's ok to call abort on such an object, and there's
3193 * nothing to do. */
3194 return PSA_SUCCESS;
3195 }
3196
3197 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3198
3199 status = psa_driver_wrapper_sign_hash_abort(operation);
3200
3201 operation->id = 0;
3202
Paul Elliotte6145dc2023-02-07 12:51:21 +00003203 /* Do not clear either the error_occurred or num_ops elements here as they
3204 * only want to be cleared by the application calling abort, not by abort
3205 * being called at completion of an operation. */
3206
Paul Elliott59ad9452022-12-18 15:09:02 +00003207 return status;
3208}
3209
Paul Elliott9fe12f62022-11-30 19:16:02 +00003210psa_status_t psa_sign_hash_start(
3211 psa_sign_hash_interruptible_operation_t *operation,
3212 mbedtls_svc_key_id_t key, psa_algorithm_t alg,
3213 const uint8_t *hash, size_t hash_length)
3214{
3215 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3216 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
3217 psa_key_slot_t *slot;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01003218 psa_key_attributes_t attributes;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003219
Paul Elliottc9774412023-02-06 15:14:07 +00003220 /* Check that start has not been previously called, or operation has not
3221 * previously errored. */
3222 if (operation->id != 0 || operation->error_occurred) {
Paul Elliott9fe12f62022-11-30 19:16:02 +00003223 return PSA_ERROR_BAD_STATE;
3224 }
3225
Paul Elliott9fe12f62022-11-30 19:16:02 +00003226 status = psa_sign_verify_check_alg(0, alg);
3227 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003228 operation->error_occurred = 1;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003229 return status;
3230 }
3231
3232 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
3233 PSA_KEY_USAGE_SIGN_HASH,
3234 alg);
3235
3236 if (status != PSA_SUCCESS) {
3237 goto exit;
3238 }
3239
3240 if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) {
3241 status = PSA_ERROR_INVALID_ARGUMENT;
3242 goto exit;
3243 }
3244
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01003245 attributes = (psa_key_attributes_t) {
Paul Elliott9fe12f62022-11-30 19:16:02 +00003246 .core = slot->attr
3247 };
3248
Paul Elliott296ede92022-12-15 17:00:30 +00003249 /* Ensure ops count gets reset, in case of operation re-use. */
3250 operation->num_ops = 0;
3251
Paul Elliott9fe12f62022-11-30 19:16:02 +00003252 status = psa_driver_wrapper_sign_hash_start(operation, &attributes,
3253 slot->key.data,
3254 slot->key.bytes, alg,
3255 hash, hash_length);
3256exit:
3257
3258 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003259 operation->error_occurred = 1;
Paul Elliott59ad9452022-12-18 15:09:02 +00003260 psa_sign_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003261 }
3262
Ryan Everett1b70a072024-01-04 10:32:49 +00003263 unlock_status = psa_unregister_read(slot);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003264
Paul Elliottc9774412023-02-06 15:14:07 +00003265 if (unlock_status != PSA_SUCCESS) {
3266 operation->error_occurred = 1;
3267 }
Paul Elliott9fe12f62022-11-30 19:16:02 +00003268
Paul Elliottc9774412023-02-06 15:14:07 +00003269 return (status == PSA_SUCCESS) ? unlock_status : status;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003270}
3271
3272
3273psa_status_t psa_sign_hash_complete(
3274 psa_sign_hash_interruptible_operation_t *operation,
3275 uint8_t *signature, size_t signature_size,
3276 size_t *signature_length)
3277{
3278 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3279
3280 *signature_length = 0;
3281
Paul Elliottc9774412023-02-06 15:14:07 +00003282 /* Check that start has been called first, and that operation has not
3283 * previously errored. */
3284 if (operation->id == 0 || operation->error_occurred) {
Paul Elliott9fe12f62022-11-30 19:16:02 +00003285 status = PSA_ERROR_BAD_STATE;
3286 goto exit;
3287 }
3288
Paul Elliott096abc42023-02-03 18:33:23 +00003289 /* Immediately reject a zero-length signature buffer. This guarantees that
3290 * signature must be a valid pointer. */
Paul Elliott9fe12f62022-11-30 19:16:02 +00003291 if (signature_size == 0) {
3292 status = PSA_ERROR_BUFFER_TOO_SMALL;
3293 goto exit;
3294 }
3295
3296 status = psa_driver_wrapper_sign_hash_complete(operation, signature,
3297 signature_size,
3298 signature_length);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003299
Paul Elliott296ede92022-12-15 17:00:30 +00003300 /* Update ops count with work done. */
Paul Elliottde1114c2023-02-07 12:43:11 +00003301 operation->num_ops = psa_driver_wrapper_sign_hash_get_num_ops(operation);
Paul Elliott296ede92022-12-15 17:00:30 +00003302
Paul Elliottebe225c2023-02-10 14:32:53 +00003303exit:
3304
Paul Elliott59200a22023-02-21 15:07:40 +00003305 psa_wipe_tag_output_buffer(signature, status, signature_size,
3306 *signature_length);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003307
Paul Elliott53bb3122023-02-10 14:22:22 +00003308 if (status != PSA_OPERATION_INCOMPLETE) {
Paul Elliottc9774412023-02-06 15:14:07 +00003309 if (status != PSA_SUCCESS) {
3310 operation->error_occurred = 1;
3311 }
3312
Paul Elliott59ad9452022-12-18 15:09:02 +00003313 psa_sign_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003314 }
3315
3316 return status;
3317}
3318
3319psa_status_t psa_sign_hash_abort(
3320 psa_sign_hash_interruptible_operation_t *operation)
3321{
Paul Elliott59ad9452022-12-18 15:09:02 +00003322 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3323
3324 status = psa_sign_hash_abort_internal(operation);
3325
3326 /* We clear the number of ops done here, so that it is not cleared when
3327 * the operation fails or succeeds, only on manual abort. */
3328 operation->num_ops = 0;
3329
Paul Elliottc9774412023-02-06 15:14:07 +00003330 /* Likewise, failure state. */
3331 operation->error_occurred = 0;
3332
Paul Elliott59ad9452022-12-18 15:09:02 +00003333 return status;
3334}
3335
3336static psa_status_t psa_verify_hash_abort_internal(
3337 psa_verify_hash_interruptible_operation_t *operation)
3338{
Paul Elliott9fe12f62022-11-30 19:16:02 +00003339 if (operation->id == 0) {
3340 /* The object has (apparently) been initialized but it is not (yet)
3341 * in use. It's ok to call abort on such an object, and there's
3342 * nothing to do. */
3343 return PSA_SUCCESS;
3344 }
3345
Paul Elliott59ad9452022-12-18 15:09:02 +00003346 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3347
3348 status = psa_driver_wrapper_verify_hash_abort(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003349
3350 operation->id = 0;
3351
Paul Elliotte6145dc2023-02-07 12:51:21 +00003352 /* Do not clear either the error_occurred or num_ops elements here as they
3353 * only want to be cleared by the application calling abort, not by abort
3354 * being called at completion of an operation. */
3355
Paul Elliott59ad9452022-12-18 15:09:02 +00003356 return status;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003357}
3358
3359psa_status_t psa_verify_hash_start(
3360 psa_verify_hash_interruptible_operation_t *operation,
3361 mbedtls_svc_key_id_t key, psa_algorithm_t alg,
3362 const uint8_t *hash, size_t hash_length,
3363 const uint8_t *signature, size_t signature_length)
3364{
3365 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3366 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
3367 psa_key_slot_t *slot;
3368
Paul Elliottc9774412023-02-06 15:14:07 +00003369 /* Check that start has not been previously called, or operation has not
3370 * previously errored. */
3371 if (operation->id != 0 || operation->error_occurred) {
Paul Elliott9fe12f62022-11-30 19:16:02 +00003372 return PSA_ERROR_BAD_STATE;
3373 }
3374
3375 status = psa_sign_verify_check_alg(0, alg);
3376 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003377 operation->error_occurred = 1;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003378 return status;
3379 }
3380
3381 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
3382 PSA_KEY_USAGE_VERIFY_HASH,
3383 alg);
3384
3385 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003386 operation->error_occurred = 1;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003387 return status;
3388 }
3389
3390 psa_key_attributes_t attributes = {
3391 .core = slot->attr
3392 };
3393
Paul Elliott296ede92022-12-15 17:00:30 +00003394 /* Ensure ops count gets reset, in case of operation re-use. */
3395 operation->num_ops = 0;
3396
Paul Elliott9fe12f62022-11-30 19:16:02 +00003397 status = psa_driver_wrapper_verify_hash_start(operation, &attributes,
3398 slot->key.data,
3399 slot->key.bytes,
3400 alg, hash, hash_length,
3401 signature, signature_length);
3402
3403 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003404 operation->error_occurred = 1;
Paul Elliott59ad9452022-12-18 15:09:02 +00003405 psa_verify_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003406 }
3407
Ryan Everett1b70a072024-01-04 10:32:49 +00003408 unlock_status = psa_unregister_read(slot);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003409
Paul Elliottc9774412023-02-06 15:14:07 +00003410 if (unlock_status != PSA_SUCCESS) {
3411 operation->error_occurred = 1;
3412 }
Paul Elliott9fe12f62022-11-30 19:16:02 +00003413
Paul Elliottc9774412023-02-06 15:14:07 +00003414 return (status == PSA_SUCCESS) ? unlock_status : status;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003415}
3416
3417psa_status_t psa_verify_hash_complete(
3418 psa_verify_hash_interruptible_operation_t *operation)
3419{
3420 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3421
Paul Elliottc9774412023-02-06 15:14:07 +00003422 /* Check that start has been called first, and that operation has not
3423 * previously errored. */
3424 if (operation->id == 0 || operation->error_occurred) {
Paul Elliott9fe12f62022-11-30 19:16:02 +00003425 status = PSA_ERROR_BAD_STATE;
3426 goto exit;
3427 }
3428
3429 status = psa_driver_wrapper_verify_hash_complete(operation);
3430
Paul Elliott296ede92022-12-15 17:00:30 +00003431 /* Update ops count with work done. */
Paul Elliottde1114c2023-02-07 12:43:11 +00003432 operation->num_ops = psa_driver_wrapper_verify_hash_get_num_ops(
Paul Elliott296ede92022-12-15 17:00:30 +00003433 operation);
3434
Paul Elliottebe225c2023-02-10 14:32:53 +00003435exit:
3436
Paul Elliott9fe12f62022-11-30 19:16:02 +00003437 if (status != PSA_OPERATION_INCOMPLETE) {
Paul Elliottc9774412023-02-06 15:14:07 +00003438 if (status != PSA_SUCCESS) {
3439 operation->error_occurred = 1;
3440 }
3441
Paul Elliott59ad9452022-12-18 15:09:02 +00003442 psa_verify_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003443 }
3444
3445 return status;
3446}
3447
3448psa_status_t psa_verify_hash_abort(
3449 psa_verify_hash_interruptible_operation_t *operation)
3450{
Paul Elliott59ad9452022-12-18 15:09:02 +00003451 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003452
Paul Elliott59ad9452022-12-18 15:09:02 +00003453 status = psa_verify_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003454
Paul Elliott59ad9452022-12-18 15:09:02 +00003455 /* We clear the number of ops done here, so that it is not cleared when
3456 * the operation fails or succeeds, only on manual abort. */
3457 operation->num_ops = 0;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003458
Paul Elliottc9774412023-02-06 15:14:07 +00003459 /* Likewise, failure state. */
3460 operation->error_occurred = 0;
3461
Paul Elliott59ad9452022-12-18 15:09:02 +00003462 return status;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003463}
3464
Paul Elliott588f8ed2022-12-02 18:10:26 +00003465/****************************************************************/
3466/* Asymmetric interruptible cryptography internal */
3467/* implementations */
3468/****************************************************************/
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02003469
Paul Elliott588f8ed2022-12-02 18:10:26 +00003470void mbedtls_psa_interruptible_set_max_ops(uint32_t max_ops)
3471{
Paul Elliott7cc4e812023-01-10 17:14:11 +00003472
Paul Elliott588f8ed2022-12-02 18:10:26 +00003473#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3474 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3475 defined(MBEDTLS_ECP_RESTARTABLE)
3476
3477 /* Internal implementation uses zero to indicate infinite number max ops,
3478 * therefore avoid this value, and set to minimum possible. */
3479 if (max_ops == 0) {
3480 max_ops = 1;
3481 }
3482
Paul Elliott588f8ed2022-12-02 18:10:26 +00003483 mbedtls_ecp_set_max_ops(max_ops);
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003484#else
3485 (void) max_ops;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003486#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3487 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3488 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3489}
3490
Paul Elliott588f8ed2022-12-02 18:10:26 +00003491uint32_t mbedtls_psa_sign_hash_get_num_ops(
Paul Elliottf8e5b562023-02-19 18:43:45 +00003492 const mbedtls_psa_sign_hash_interruptible_operation_t *operation)
Paul Elliott588f8ed2022-12-02 18:10:26 +00003493{
3494#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3495 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3496 defined(MBEDTLS_ECP_RESTARTABLE)
3497
Paul Elliott93d9ca82023-02-15 18:14:21 +00003498 return operation->num_ops;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003499#else
3500 (void) operation;
3501 return 0;
3502#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3503 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3504 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3505}
3506
3507uint32_t mbedtls_psa_verify_hash_get_num_ops(
Paul Elliottf8e5b562023-02-19 18:43:45 +00003508 const mbedtls_psa_verify_hash_interruptible_operation_t *operation)
Paul Elliott588f8ed2022-12-02 18:10:26 +00003509{
3510 #if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3511 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3512 defined(MBEDTLS_ECP_RESTARTABLE)
3513
Paul Elliott93d9ca82023-02-15 18:14:21 +00003514 return operation->num_ops;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003515#else
3516 (void) operation;
3517 return 0;
3518#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3519 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3520 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3521}
3522
3523psa_status_t mbedtls_psa_sign_hash_start(
3524 mbedtls_psa_sign_hash_interruptible_operation_t *operation,
3525 const psa_key_attributes_t *attributes, const uint8_t *key_buffer,
3526 size_t key_buffer_size, psa_algorithm_t alg,
3527 const uint8_t *hash, size_t hash_length)
3528{
3529 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott0290a762023-02-09 14:30:24 +00003530 size_t required_hash_length;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003531
Paul Elliott068fe072023-01-16 13:59:15 +00003532 if (!PSA_KEY_TYPE_IS_ECC(attributes->core.type)) {
3533 return PSA_ERROR_NOT_SUPPORTED;
3534 }
3535
3536 if (!PSA_ALG_IS_ECDSA(alg)) {
Paul Elliott813f9cd2023-02-05 15:28:46 +00003537 return PSA_ERROR_NOT_SUPPORTED;
Paul Elliott068fe072023-01-16 13:59:15 +00003538 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003539
3540#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
Paul Elliott068fe072023-01-16 13:59:15 +00003541 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3542 defined(MBEDTLS_ECP_RESTARTABLE)
Paul Elliott588f8ed2022-12-02 18:10:26 +00003543
Paul Elliotta1c94092023-02-15 16:38:04 +00003544 mbedtls_ecdsa_restart_init(&operation->restart_ctx);
3545
Paul Elliott93d9ca82023-02-15 18:14:21 +00003546 /* Ensure num_ops is zero'ed in case of context re-use. */
3547 operation->num_ops = 0;
3548
Paul Elliott068fe072023-01-16 13:59:15 +00003549 status = mbedtls_psa_ecp_load_representation(attributes->core.type,
3550 attributes->core.bits,
3551 key_buffer,
3552 key_buffer_size,
3553 &operation->ctx);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003554
Paul Elliott068fe072023-01-16 13:59:15 +00003555 if (status != PSA_SUCCESS) {
3556 return status;
3557 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003558
Paul Elliott1bc59df2023-02-05 13:41:57 +00003559 operation->coordinate_bytes = PSA_BITS_TO_BYTES(
Paul Elliottc569fc22023-02-10 13:02:54 +00003560 operation->ctx->grp.nbits);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003561
Paul Elliott068fe072023-01-16 13:59:15 +00003562 psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH(alg);
Manuel Pégourié-Gonnard2d6d9932023-03-28 11:38:08 +02003563 operation->md_alg = mbedtls_md_type_from_psa_alg(hash_alg);
Paul Elliott068fe072023-01-16 13:59:15 +00003564 operation->alg = alg;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003565
Paul Elliott0290a762023-02-09 14:30:24 +00003566 /* We only need to store the same length of hash as the private key size
3567 * here, it would be truncated by the internal implementation anyway. */
3568 required_hash_length = (hash_length < operation->coordinate_bytes ?
3569 hash_length : operation->coordinate_bytes);
3570
Paul Elliottba70ad42023-02-15 18:23:53 +00003571 if (required_hash_length > sizeof(operation->hash)) {
3572 /* Shouldn't happen, but better safe than sorry. */
3573 return PSA_ERROR_CORRUPTION_DETECTED;
3574 }
3575
Paul Elliott0290a762023-02-09 14:30:24 +00003576 memcpy(operation->hash, hash, required_hash_length);
3577 operation->hash_length = required_hash_length;
Paul Elliott068fe072023-01-16 13:59:15 +00003578
3579 return PSA_SUCCESS;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003580
3581#else
Paul Elliott068fe072023-01-16 13:59:15 +00003582 (void) operation;
3583 (void) key_buffer;
3584 (void) key_buffer_size;
3585 (void) alg;
3586 (void) hash;
3587 (void) hash_length;
3588 (void) status;
Paul Elliott0290a762023-02-09 14:30:24 +00003589 (void) required_hash_length;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003590
Paul Elliott068fe072023-01-16 13:59:15 +00003591 return PSA_ERROR_NOT_SUPPORTED;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003592#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3593 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3594 * defined( MBEDTLS_ECP_RESTARTABLE ) */
Paul Elliott588f8ed2022-12-02 18:10:26 +00003595}
3596
3597psa_status_t mbedtls_psa_sign_hash_complete(
3598 mbedtls_psa_sign_hash_interruptible_operation_t *operation,
3599 uint8_t *signature, size_t signature_size,
3600 size_t *signature_length)
3601{
Paul Elliott588f8ed2022-12-02 18:10:26 +00003602#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3603 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3604 defined(MBEDTLS_ECP_RESTARTABLE)
3605
Paul Elliotta1c94092023-02-15 16:38:04 +00003606 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott1243f932023-02-07 11:21:10 +00003607 mbedtls_mpi r;
3608 mbedtls_mpi s;
3609
Paul Elliott46845252023-02-03 14:59:11 +00003610 mbedtls_mpi_init(&r);
3611 mbedtls_mpi_init(&s);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003612
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003613 /* Ensure max_ops is set to the current value (or default). */
3614 mbedtls_psa_interruptible_set_max_ops(psa_interruptible_get_max_ops());
3615
Paul Elliotta1c94092023-02-15 16:38:04 +00003616 if (signature_size < 2 * operation->coordinate_bytes) {
3617 status = PSA_ERROR_BUFFER_TOO_SMALL;
3618 goto exit;
3619 }
3620
Paul Elliott588f8ed2022-12-02 18:10:26 +00003621 if (PSA_ALG_ECDSA_IS_DETERMINISTIC(operation->alg)) {
Paul Elliott46845252023-02-03 14:59:11 +00003622
Paul Elliott588f8ed2022-12-02 18:10:26 +00003623#if defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
3624 status = mbedtls_to_psa_error(
3625 mbedtls_ecdsa_sign_det_restartable(&operation->ctx->grp,
Paul Elliott46845252023-02-03 14:59:11 +00003626 &r,
3627 &s,
Paul Elliott588f8ed2022-12-02 18:10:26 +00003628 &operation->ctx->d,
3629 operation->hash,
3630 operation->hash_length,
3631 operation->md_alg,
3632 mbedtls_psa_get_random,
3633 MBEDTLS_PSA_RANDOM_STATE,
3634 &operation->restart_ctx));
3635#else /* defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Paul Elliott724bd252023-02-08 12:35:08 +00003636 status = PSA_ERROR_NOT_SUPPORTED;
3637 goto exit;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003638#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
3639 } else {
Paul Elliott588f8ed2022-12-02 18:10:26 +00003640 status = mbedtls_to_psa_error(
3641 mbedtls_ecdsa_sign_restartable(&operation->ctx->grp,
Paul Elliott46845252023-02-03 14:59:11 +00003642 &r,
3643 &s,
Paul Elliott588f8ed2022-12-02 18:10:26 +00003644 &operation->ctx->d,
3645 operation->hash,
3646 operation->hash_length,
3647 mbedtls_psa_get_random,
3648 MBEDTLS_PSA_RANDOM_STATE,
3649 mbedtls_psa_get_random,
3650 MBEDTLS_PSA_RANDOM_STATE,
3651 &operation->restart_ctx));
3652 }
3653
Paul Elliottf8e5b562023-02-19 18:43:45 +00003654 /* Hide the fact that the restart context only holds a delta of number of
3655 * ops done during the last operation, not an absolute value. */
3656 operation->num_ops += operation->restart_ctx.ecp.ops_done;
3657
Paul Elliott724bd252023-02-08 12:35:08 +00003658 if (status == PSA_SUCCESS) {
Paul Elliott588f8ed2022-12-02 18:10:26 +00003659 status = mbedtls_to_psa_error(
Paul Elliott46845252023-02-03 14:59:11 +00003660 mbedtls_mpi_write_binary(&r,
Paul Elliott588f8ed2022-12-02 18:10:26 +00003661 signature,
Paul Elliott1bc59df2023-02-05 13:41:57 +00003662 operation->coordinate_bytes)
3663 );
Paul Elliott588f8ed2022-12-02 18:10:26 +00003664
3665 if (status != PSA_SUCCESS) {
Paul Elliott724bd252023-02-08 12:35:08 +00003666 goto exit;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003667 }
3668
3669 status = mbedtls_to_psa_error(
Paul Elliott46845252023-02-03 14:59:11 +00003670 mbedtls_mpi_write_binary(&s,
Paul Elliott588f8ed2022-12-02 18:10:26 +00003671 signature +
Paul Elliott1bc59df2023-02-05 13:41:57 +00003672 operation->coordinate_bytes,
3673 operation->coordinate_bytes)
3674 );
Paul Elliott588f8ed2022-12-02 18:10:26 +00003675
3676 if (status != PSA_SUCCESS) {
Paul Elliott724bd252023-02-08 12:35:08 +00003677 goto exit;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003678 }
3679
Paul Elliott1bc59df2023-02-05 13:41:57 +00003680 *signature_length = operation->coordinate_bytes * 2;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003681
Paul Elliott724bd252023-02-08 12:35:08 +00003682 status = PSA_SUCCESS;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003683 }
Paul Elliott724bd252023-02-08 12:35:08 +00003684
3685exit:
3686
3687 mbedtls_mpi_free(&r);
3688 mbedtls_mpi_free(&s);
3689 return status;
3690
Paul Elliott588f8ed2022-12-02 18:10:26 +00003691 #else
3692
3693 (void) operation;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003694 (void) signature;
3695 (void) signature_size;
3696 (void) signature_length;
3697
3698 return PSA_ERROR_NOT_SUPPORTED;
3699
3700#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3701 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3702 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3703}
3704
3705psa_status_t mbedtls_psa_sign_hash_abort(
3706 mbedtls_psa_sign_hash_interruptible_operation_t *operation)
3707{
3708
3709#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3710 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3711 defined(MBEDTLS_ECP_RESTARTABLE)
3712
3713 if (operation->ctx) {
3714 mbedtls_ecdsa_free(operation->ctx);
3715 mbedtls_free(operation->ctx);
Paul Elliottf9c91a72023-02-05 18:06:38 +00003716 operation->ctx = NULL;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003717 }
3718
3719 mbedtls_ecdsa_restart_free(&operation->restart_ctx);
3720
Paul Elliott93d9ca82023-02-15 18:14:21 +00003721 operation->num_ops = 0;
3722
Paul Elliott588f8ed2022-12-02 18:10:26 +00003723 return PSA_SUCCESS;
3724
3725#else
3726
3727 (void) operation;
3728
3729 return PSA_ERROR_NOT_SUPPORTED;
3730
3731#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3732 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3733 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3734}
3735
3736psa_status_t mbedtls_psa_verify_hash_start(
3737 mbedtls_psa_verify_hash_interruptible_operation_t *operation,
3738 const psa_key_attributes_t *attributes,
3739 const uint8_t *key_buffer, size_t key_buffer_size,
3740 psa_algorithm_t alg,
3741 const uint8_t *hash, size_t hash_length,
3742 const uint8_t *signature, size_t signature_length)
3743{
3744 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott1bc59df2023-02-05 13:41:57 +00003745 size_t coordinate_bytes = 0;
Paul Elliott0290a762023-02-09 14:30:24 +00003746 size_t required_hash_length = 0;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003747
Paul Elliott068fe072023-01-16 13:59:15 +00003748 if (!PSA_KEY_TYPE_IS_ECC(attributes->core.type)) {
3749 return PSA_ERROR_NOT_SUPPORTED;
3750 }
3751
3752 if (!PSA_ALG_IS_ECDSA(alg)) {
Paul Elliott813f9cd2023-02-05 15:28:46 +00003753 return PSA_ERROR_NOT_SUPPORTED;
Paul Elliott068fe072023-01-16 13:59:15 +00003754 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003755
3756#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
Paul Elliott068fe072023-01-16 13:59:15 +00003757 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3758 defined(MBEDTLS_ECP_RESTARTABLE)
Paul Elliott588f8ed2022-12-02 18:10:26 +00003759
Paul Elliotta1c94092023-02-15 16:38:04 +00003760 mbedtls_ecdsa_restart_init(&operation->restart_ctx);
3761 mbedtls_mpi_init(&operation->r);
3762 mbedtls_mpi_init(&operation->s);
3763
Paul Elliott93d9ca82023-02-15 18:14:21 +00003764 /* Ensure num_ops is zero'ed in case of context re-use. */
3765 operation->num_ops = 0;
3766
Paul Elliott068fe072023-01-16 13:59:15 +00003767 status = mbedtls_psa_ecp_load_representation(attributes->core.type,
3768 attributes->core.bits,
3769 key_buffer,
3770 key_buffer_size,
3771 &operation->ctx);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003772
Paul Elliott068fe072023-01-16 13:59:15 +00003773 if (status != PSA_SUCCESS) {
3774 return status;
3775 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003776
Paul Elliottc569fc22023-02-10 13:02:54 +00003777 coordinate_bytes = PSA_BITS_TO_BYTES(operation->ctx->grp.nbits);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003778
Paul Elliott1bc59df2023-02-05 13:41:57 +00003779 if (signature_length != 2 * coordinate_bytes) {
Paul Elliott068fe072023-01-16 13:59:15 +00003780 return PSA_ERROR_INVALID_SIGNATURE;
3781 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003782
Paul Elliott068fe072023-01-16 13:59:15 +00003783 status = mbedtls_to_psa_error(
3784 mbedtls_mpi_read_binary(&operation->r,
3785 signature,
Paul Elliott1bc59df2023-02-05 13:41:57 +00003786 coordinate_bytes));
Paul Elliott588f8ed2022-12-02 18:10:26 +00003787
Paul Elliott068fe072023-01-16 13:59:15 +00003788 if (status != PSA_SUCCESS) {
3789 return status;
3790 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003791
Paul Elliott068fe072023-01-16 13:59:15 +00003792 status = mbedtls_to_psa_error(
3793 mbedtls_mpi_read_binary(&operation->s,
3794 signature +
Paul Elliott1bc59df2023-02-05 13:41:57 +00003795 coordinate_bytes,
3796 coordinate_bytes));
Paul Elliott588f8ed2022-12-02 18:10:26 +00003797
Paul Elliott068fe072023-01-16 13:59:15 +00003798 if (status != PSA_SUCCESS) {
3799 return status;
3800 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003801
Paul Elliott2c9843f2023-02-15 17:32:42 +00003802 status = mbedtls_psa_ecp_load_public_part(operation->ctx);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003803
Paul Elliott2c9843f2023-02-15 17:32:42 +00003804 if (status != PSA_SUCCESS) {
3805 return status;
Paul Elliott068fe072023-01-16 13:59:15 +00003806 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003807
Paul Elliott0290a762023-02-09 14:30:24 +00003808 /* We only need to store the same length of hash as the private key size
3809 * here, it would be truncated by the internal implementation anyway. */
3810 required_hash_length = (hash_length < coordinate_bytes ? hash_length :
3811 coordinate_bytes);
3812
Paul Elliottba70ad42023-02-15 18:23:53 +00003813 if (required_hash_length > sizeof(operation->hash)) {
3814 /* Shouldn't happen, but better safe than sorry. */
3815 return PSA_ERROR_CORRUPTION_DETECTED;
3816 }
3817
Paul Elliott0290a762023-02-09 14:30:24 +00003818 memcpy(operation->hash, hash, required_hash_length);
3819 operation->hash_length = required_hash_length;
Paul Elliott068fe072023-01-16 13:59:15 +00003820
3821 return PSA_SUCCESS;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003822#else
Paul Elliott068fe072023-01-16 13:59:15 +00003823 (void) operation;
3824 (void) key_buffer;
3825 (void) key_buffer_size;
3826 (void) alg;
3827 (void) hash;
3828 (void) hash_length;
3829 (void) signature;
3830 (void) signature_length;
3831 (void) status;
Paul Elliott1243f932023-02-07 11:21:10 +00003832 (void) coordinate_bytes;
Paul Elliott0290a762023-02-09 14:30:24 +00003833 (void) required_hash_length;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003834
Paul Elliott068fe072023-01-16 13:59:15 +00003835 return PSA_ERROR_NOT_SUPPORTED;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003836#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3837 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3838 * defined( MBEDTLS_ECP_RESTARTABLE ) */
Paul Elliott588f8ed2022-12-02 18:10:26 +00003839}
3840
3841psa_status_t mbedtls_psa_verify_hash_complete(
3842 mbedtls_psa_verify_hash_interruptible_operation_t *operation)
3843{
3844
3845#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3846 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3847 defined(MBEDTLS_ECP_RESTARTABLE)
3848
Paul Elliottf8e5b562023-02-19 18:43:45 +00003849 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3850
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003851 /* Ensure max_ops is set to the current value (or default). */
3852 mbedtls_psa_interruptible_set_max_ops(psa_interruptible_get_max_ops());
3853
Paul Elliottf8e5b562023-02-19 18:43:45 +00003854 status = mbedtls_to_psa_error(
Paul Elliott588f8ed2022-12-02 18:10:26 +00003855 mbedtls_ecdsa_verify_restartable(&operation->ctx->grp,
3856 operation->hash,
3857 operation->hash_length,
3858 &operation->ctx->Q,
3859 &operation->r,
3860 &operation->s,
3861 &operation->restart_ctx));
3862
Paul Elliottf8e5b562023-02-19 18:43:45 +00003863 /* Hide the fact that the restart context only holds a delta of number of
3864 * ops done during the last operation, not an absolute value. */
3865 operation->num_ops += operation->restart_ctx.ecp.ops_done;
3866
3867 return status;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003868#else
3869 (void) operation;
3870
3871 return PSA_ERROR_NOT_SUPPORTED;
3872
3873#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3874 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3875 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3876}
3877
3878psa_status_t mbedtls_psa_verify_hash_abort(
3879 mbedtls_psa_verify_hash_interruptible_operation_t *operation)
3880{
3881
3882#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3883 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3884 defined(MBEDTLS_ECP_RESTARTABLE)
3885
3886 if (operation->ctx) {
3887 mbedtls_ecdsa_free(operation->ctx);
3888 mbedtls_free(operation->ctx);
Paul Elliottf9c91a72023-02-05 18:06:38 +00003889 operation->ctx = NULL;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003890 }
3891
3892 mbedtls_ecdsa_restart_free(&operation->restart_ctx);
3893
Paul Elliott93d9ca82023-02-15 18:14:21 +00003894 operation->num_ops = 0;
3895
Paul Elliott588f8ed2022-12-02 18:10:26 +00003896 mbedtls_mpi_free(&operation->r);
3897 mbedtls_mpi_free(&operation->s);
3898
3899 return PSA_SUCCESS;
3900
3901#else
3902 (void) operation;
3903
3904 return PSA_ERROR_NOT_SUPPORTED;
3905
3906#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3907 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3908 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3909}
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02003910
mohammad1603503973b2018-03-12 15:59:30 +02003911/****************************************************************/
3912/* Symmetric cryptography */
3913/****************************************************************/
3914
Gilles Peskine449bd832023-01-11 14:50:10 +01003915static psa_status_t psa_cipher_setup(psa_cipher_operation_t *operation,
3916 mbedtls_svc_key_id_t key,
3917 psa_algorithm_t alg,
3918 mbedtls_operation_t cipher_operation)
Ronald Cronab99ac22020-10-01 16:38:28 +02003919{
3920 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3921 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Dave Rodgman54648242021-06-24 11:49:45 +01003922 psa_key_slot_t *slot = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01003923 psa_key_usage_t usage = (cipher_operation == MBEDTLS_ENCRYPT ?
3924 PSA_KEY_USAGE_ENCRYPT :
3925 PSA_KEY_USAGE_DECRYPT);
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01003926 psa_key_attributes_t attributes;
Ronald Cronab99ac22020-10-01 16:38:28 +02003927
3928 /* A context must be freshly initialized before it can be set up. */
Gilles Peskine449bd832023-01-11 14:50:10 +01003929 if (operation->id != 0) {
Dave Rodgman54648242021-06-24 11:49:45 +01003930 status = PSA_ERROR_BAD_STATE;
3931 goto exit;
3932 }
Ronald Cronab99ac22020-10-01 16:38:28 +02003933
Gilles Peskine449bd832023-01-11 14:50:10 +01003934 if (!PSA_ALG_IS_CIPHER(alg)) {
Dave Rodgman54648242021-06-24 11:49:45 +01003935 status = PSA_ERROR_INVALID_ARGUMENT;
3936 goto exit;
3937 }
Ronald Cronab99ac22020-10-01 16:38:28 +02003938
Gilles Peskine449bd832023-01-11 14:50:10 +01003939 status = psa_get_and_lock_key_slot_with_policy(key, &slot, usage, alg);
3940 if (status != PSA_SUCCESS) {
Ronald Cronab99ac22020-10-01 16:38:28 +02003941 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01003942 }
Ronald Cronab99ac22020-10-01 16:38:28 +02003943
Ronald Cron49fafa92021-03-10 08:34:23 +01003944 /* Initialize the operation struct members, except for id. The id member
Ronald Cronab99ac22020-10-01 16:38:28 +02003945 * is used to indicate to psa_cipher_abort that there are resources to free,
Ronald Cron49fafa92021-03-10 08:34:23 +01003946 * so we only set it (in the driver wrapper) after resources have been
3947 * allocated/initialized. */
Ronald Cronab99ac22020-10-01 16:38:28 +02003948 operation->iv_set = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01003949 if (alg == PSA_ALG_ECB_NO_PADDING) {
Ronald Cronab99ac22020-10-01 16:38:28 +02003950 operation->iv_required = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01003951 } else {
Ronald Cronab99ac22020-10-01 16:38:28 +02003952 operation->iv_required = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01003953 }
3954 operation->default_iv_length = PSA_CIPHER_IV_LENGTH(slot->attr.type, alg);
Ronald Cronab99ac22020-10-01 16:38:28 +02003955
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01003956 attributes = (psa_key_attributes_t) {
Gilles Peskine449bd832023-01-11 14:50:10 +01003957 .core = slot->attr
Ronald Crona4af55f2020-12-14 14:36:06 +01003958 };
3959
Ronald Cronab99ac22020-10-01 16:38:28 +02003960 /* Try doing the operation through a driver before using software fallback. */
Gilles Peskine449bd832023-01-11 14:50:10 +01003961 if (cipher_operation == MBEDTLS_ENCRYPT) {
3962 status = psa_driver_wrapper_cipher_encrypt_setup(operation,
3963 &attributes,
3964 slot->key.data,
3965 slot->key.bytes,
3966 alg);
3967 } else {
3968 status = psa_driver_wrapper_cipher_decrypt_setup(operation,
3969 &attributes,
3970 slot->key.data,
3971 slot->key.bytes,
3972 alg);
3973 }
Ronald Cronab99ac22020-10-01 16:38:28 +02003974
Gilles Peskine9ab61b62019-02-25 17:43:14 +01003975exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01003976 if (status != PSA_SUCCESS) {
3977 psa_cipher_abort(operation);
3978 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02003979
Ryan Everett1b70a072024-01-04 10:32:49 +00003980 unlock_status = psa_unregister_read(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003981
Gilles Peskine449bd832023-01-11 14:50:10 +01003982 return (status == PSA_SUCCESS) ? unlock_status : status;
mohammad1603503973b2018-03-12 15:59:30 +02003983}
3984
Gilles Peskine449bd832023-01-11 14:50:10 +01003985psa_status_t psa_cipher_encrypt_setup(psa_cipher_operation_t *operation,
3986 mbedtls_svc_key_id_t key,
3987 psa_algorithm_t alg)
mohammad16038481e742018-03-18 13:57:31 +02003988{
Gilles Peskine449bd832023-01-11 14:50:10 +01003989 return psa_cipher_setup(operation, key, alg, MBEDTLS_ENCRYPT);
mohammad16038481e742018-03-18 13:57:31 +02003990}
3991
Gilles Peskine449bd832023-01-11 14:50:10 +01003992psa_status_t psa_cipher_decrypt_setup(psa_cipher_operation_t *operation,
3993 mbedtls_svc_key_id_t key,
3994 psa_algorithm_t alg)
mohammad16038481e742018-03-18 13:57:31 +02003995{
Gilles Peskine449bd832023-01-11 14:50:10 +01003996 return psa_cipher_setup(operation, key, alg, MBEDTLS_DECRYPT);
mohammad16038481e742018-03-18 13:57:31 +02003997}
3998
Gilles Peskine449bd832023-01-11 14:50:10 +01003999psa_status_t psa_cipher_generate_iv(psa_cipher_operation_t *operation,
4000 uint8_t *iv,
4001 size_t iv_size,
4002 size_t *iv_length)
mohammad1603503973b2018-03-12 15:59:30 +02004003{
Ronald Cron6d051732020-10-01 14:10:20 +02004004 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron2fb90522021-07-05 12:31:44 +02004005 uint8_t local_iv[PSA_CIPHER_IV_MAX_SIZE];
Sergeybef1f632023-03-06 15:25:06 -07004006 size_t default_iv_length = 0;
Ronald Cron5618a392021-03-26 09:52:26 +01004007
Gilles Peskine449bd832023-01-11 14:50:10 +01004008 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004009 status = PSA_ERROR_BAD_STATE;
4010 goto exit;
Ronald Cronc45b4af2020-09-29 16:18:05 +02004011 }
4012
Gilles Peskine449bd832023-01-11 14:50:10 +01004013 if (operation->iv_set || !operation->iv_required) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004014 status = PSA_ERROR_BAD_STATE;
4015 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004016 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004017
Ronald Cron2fb90522021-07-05 12:31:44 +02004018 default_iv_length = operation->default_iv_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01004019 if (iv_size < default_iv_length) {
Ronald Cron5618a392021-03-26 09:52:26 +01004020 status = PSA_ERROR_BUFFER_TOO_SMALL;
4021 goto exit;
4022 }
Gilles Peskinee553c652018-06-04 16:22:46 +02004023
Gilles Peskine449bd832023-01-11 14:50:10 +01004024 if (default_iv_length > PSA_CIPHER_IV_MAX_SIZE) {
Ronald Cron2fb90522021-07-05 12:31:44 +02004025 status = PSA_ERROR_GENERIC_ERROR;
4026 goto exit;
4027 }
4028
Gilles Peskine449bd832023-01-11 14:50:10 +01004029 status = psa_generate_random(local_iv, default_iv_length);
4030 if (status != PSA_SUCCESS) {
Ronald Cron5618a392021-03-26 09:52:26 +01004031 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004032 }
Ronald Cron5618a392021-03-26 09:52:26 +01004033
Gilles Peskine449bd832023-01-11 14:50:10 +01004034 status = psa_driver_wrapper_cipher_set_iv(operation,
4035 local_iv, default_iv_length);
Ronald Cron5618a392021-03-26 09:52:26 +01004036
4037exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004038 if (status == PSA_SUCCESS) {
4039 memcpy(iv, local_iv, default_iv_length);
Ronald Cron2fb90522021-07-05 12:31:44 +02004040 *iv_length = default_iv_length;
Steven Cooreman7df02922020-09-09 15:28:49 +02004041 operation->iv_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004042 } else {
Ronald Cron2fb90522021-07-05 12:31:44 +02004043 *iv_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01004044 psa_cipher_abort(operation);
Ronald Cron2fb90522021-07-05 12:31:44 +02004045 }
Ronald Cron6d051732020-10-01 14:10:20 +02004046
Gilles Peskine449bd832023-01-11 14:50:10 +01004047 return status;
mohammad1603503973b2018-03-12 15:59:30 +02004048}
4049
Gilles Peskine449bd832023-01-11 14:50:10 +01004050psa_status_t psa_cipher_set_iv(psa_cipher_operation_t *operation,
4051 const uint8_t *iv,
4052 size_t iv_length)
mohammad1603503973b2018-03-12 15:59:30 +02004053{
Ronald Cron6d051732020-10-01 14:10:20 +02004054 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cronc45b4af2020-09-29 16:18:05 +02004055
Gilles Peskine449bd832023-01-11 14:50:10 +01004056 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004057 status = PSA_ERROR_BAD_STATE;
4058 goto exit;
4059 }
Ronald Cronc45b4af2020-09-29 16:18:05 +02004060
Gilles Peskine449bd832023-01-11 14:50:10 +01004061 if (operation->iv_set || !operation->iv_required) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004062 status = PSA_ERROR_BAD_STATE;
4063 goto exit;
4064 }
Ronald Crona0d68172021-03-26 10:15:08 +01004065
Gilles Peskine449bd832023-01-11 14:50:10 +01004066 if (iv_length > PSA_CIPHER_IV_MAX_SIZE) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004067 status = PSA_ERROR_INVALID_ARGUMENT;
4068 goto exit;
4069 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004070
Gilles Peskine449bd832023-01-11 14:50:10 +01004071 status = psa_driver_wrapper_cipher_set_iv(operation,
4072 iv,
4073 iv_length);
Steven Cooremand3feccd2020-09-01 15:56:14 +02004074
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004075exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004076 if (status == PSA_SUCCESS) {
itayzafrir534bd7c2018-08-02 13:56:32 +03004077 operation->iv_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004078 } else {
4079 psa_cipher_abort(operation);
4080 }
4081 return status;
mohammad1603503973b2018-03-12 15:59:30 +02004082}
4083
Gilles Peskine449bd832023-01-11 14:50:10 +01004084psa_status_t psa_cipher_update(psa_cipher_operation_t *operation,
4085 const uint8_t *input,
4086 size_t input_length,
4087 uint8_t *output,
4088 size_t output_size,
4089 size_t *output_length)
mohammad1603503973b2018-03-12 15:59:30 +02004090{
Steven Cooremanffecb7b2020-08-25 15:13:13 +02004091 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron6d051732020-10-01 14:10:20 +02004092
Gilles Peskine449bd832023-01-11 14:50:10 +01004093 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004094 status = PSA_ERROR_BAD_STATE;
4095 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004096 }
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004097
Gilles Peskine449bd832023-01-11 14:50:10 +01004098 if (operation->iv_required && !operation->iv_set) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004099 status = PSA_ERROR_BAD_STATE;
4100 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004101 }
Jaeden Ameroab439972019-02-15 14:12:05 +00004102
Gilles Peskine449bd832023-01-11 14:50:10 +01004103 status = psa_driver_wrapper_cipher_update(operation,
4104 input,
4105 input_length,
4106 output,
4107 output_size,
4108 output_length);
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004109
4110exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004111 if (status != PSA_SUCCESS) {
4112 psa_cipher_abort(operation);
4113 }
Ronald Cron6d051732020-10-01 14:10:20 +02004114
Gilles Peskine449bd832023-01-11 14:50:10 +01004115 return status;
mohammad1603503973b2018-03-12 15:59:30 +02004116}
4117
Gilles Peskine449bd832023-01-11 14:50:10 +01004118psa_status_t psa_cipher_finish(psa_cipher_operation_t *operation,
4119 uint8_t *output,
4120 size_t output_size,
4121 size_t *output_length)
mohammad1603503973b2018-03-12 15:59:30 +02004122{
David Saadab4ecc272019-02-14 13:48:10 +02004123 psa_status_t status = PSA_ERROR_GENERIC_ERROR;
Ronald Cron6d051732020-10-01 14:10:20 +02004124
Gilles Peskine449bd832023-01-11 14:50:10 +01004125 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004126 status = PSA_ERROR_BAD_STATE;
4127 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004128 }
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004129
Gilles Peskine449bd832023-01-11 14:50:10 +01004130 if (operation->iv_required && !operation->iv_set) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004131 status = PSA_ERROR_BAD_STATE;
4132 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004133 }
Moran Pekerbed71a22018-04-22 20:19:20 +03004134
Gilles Peskine449bd832023-01-11 14:50:10 +01004135 status = psa_driver_wrapper_cipher_finish(operation,
4136 output,
4137 output_size,
4138 output_length);
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004139
4140exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004141 if (status == PSA_SUCCESS) {
4142 return psa_cipher_abort(operation);
4143 } else {
Steven Cooremanef8575e2020-09-11 11:44:50 +02004144 *output_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01004145 (void) psa_cipher_abort(operation);
Janos Follath315b51c2018-07-09 16:04:51 +01004146
Gilles Peskine449bd832023-01-11 14:50:10 +01004147 return status;
Steven Cooremanef8575e2020-09-11 11:44:50 +02004148 }
mohammad1603503973b2018-03-12 15:59:30 +02004149}
4150
Gilles Peskine449bd832023-01-11 14:50:10 +01004151psa_status_t psa_cipher_abort(psa_cipher_operation_t *operation)
Gilles Peskinee553c652018-06-04 16:22:46 +02004152{
Gilles Peskine449bd832023-01-11 14:50:10 +01004153 if (operation->id == 0) {
Steven Cooremana07b9972020-09-10 14:54:14 +02004154 /* The object has (apparently) been initialized but it is not (yet)
Gilles Peskine81736312018-06-26 15:04:31 +02004155 * in use. It's ok to call abort on such an object, and there's
4156 * nothing to do. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004157 return PSA_SUCCESS;
Gilles Peskine81736312018-06-26 15:04:31 +02004158 }
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02004159
Gilles Peskine449bd832023-01-11 14:50:10 +01004160 psa_driver_wrapper_cipher_abort(operation);
Gilles Peskinee553c652018-06-04 16:22:46 +02004161
Ronald Cron49fafa92021-03-10 08:34:23 +01004162 operation->id = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03004163 operation->iv_set = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03004164 operation->iv_required = 0;
Moran Peker41deec42018-04-04 15:43:05 +03004165
Gilles Peskine449bd832023-01-11 14:50:10 +01004166 return PSA_SUCCESS;
mohammad1603503973b2018-03-12 15:59:30 +02004167}
4168
Gilles Peskine449bd832023-01-11 14:50:10 +01004169psa_status_t psa_cipher_encrypt(mbedtls_svc_key_id_t key,
4170 psa_algorithm_t alg,
4171 const uint8_t *input,
4172 size_t input_length,
4173 uint8_t *output,
4174 size_t output_size,
4175 size_t *output_length)
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004176{
4177 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004178 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron23919522021-07-08 19:00:07 +02004179 psa_key_slot_t *slot = NULL;
Ronald Cronc6e6f502021-07-09 18:44:58 +02004180 uint8_t local_iv[PSA_CIPHER_IV_MAX_SIZE];
4181 size_t default_iv_length = 0;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01004182 psa_key_attributes_t attributes;
gabor-mezei-arm6f4e5bb2021-06-25 15:21:11 +02004183
Gilles Peskine449bd832023-01-11 14:50:10 +01004184 if (!PSA_ALG_IS_CIPHER(alg)) {
Ronald Cron23919522021-07-08 19:00:07 +02004185 status = PSA_ERROR_INVALID_ARGUMENT;
4186 goto exit;
4187 }
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004188
Gilles Peskine449bd832023-01-11 14:50:10 +01004189 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
4190 PSA_KEY_USAGE_ENCRYPT,
4191 alg);
4192 if (status != PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004193 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004194 }
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004195
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01004196 attributes = (psa_key_attributes_t) {
Gilles Peskine449bd832023-01-11 14:50:10 +01004197 .core = slot->attr
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004198 };
4199
Gilles Peskine449bd832023-01-11 14:50:10 +01004200 default_iv_length = PSA_CIPHER_IV_LENGTH(slot->attr.type, alg);
4201 if (default_iv_length > PSA_CIPHER_IV_MAX_SIZE) {
Ronald Cronc6e6f502021-07-09 18:44:58 +02004202 status = PSA_ERROR_GENERIC_ERROR;
4203 goto exit;
4204 }
4205
Gilles Peskine449bd832023-01-11 14:50:10 +01004206 if (default_iv_length > 0) {
4207 if (output_size < default_iv_length) {
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004208 status = PSA_ERROR_BUFFER_TOO_SMALL;
4209 goto exit;
4210 }
4211
Gilles Peskine449bd832023-01-11 14:50:10 +01004212 status = psa_generate_random(local_iv, default_iv_length);
4213 if (status != PSA_SUCCESS) {
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004214 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004215 }
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004216 }
4217
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004218 status = psa_driver_wrapper_cipher_encrypt(
4219 &attributes, slot->key.data, slot->key.bytes,
Ronald Cronc6e6f502021-07-09 18:44:58 +02004220 alg, local_iv, default_iv_length, input, input_length,
Ronald Cronafbc7ed2023-01-24 16:02:04 +01004221 psa_crypto_buffer_offset(output, default_iv_length),
Gilles Peskine449bd832023-01-11 14:50:10 +01004222 output_size - default_iv_length, output_length);
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004223
4224exit:
Ryan Everett1b70a072024-01-04 10:32:49 +00004225 unlock_status = psa_unregister_read(slot);
Gilles Peskine449bd832023-01-11 14:50:10 +01004226 if (status == PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004227 status = unlock_status;
Ronald Cronc6e6f502021-07-09 18:44:58 +02004228 }
Ronald Cron23919522021-07-08 19:00:07 +02004229
Gilles Peskine449bd832023-01-11 14:50:10 +01004230 if (status == PSA_SUCCESS) {
4231 if (default_iv_length > 0) {
4232 memcpy(output, local_iv, default_iv_length);
4233 }
4234 *output_length += default_iv_length;
4235 } else {
4236 *output_length = 0;
4237 }
4238
4239 return status;
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004240}
4241
Gilles Peskine449bd832023-01-11 14:50:10 +01004242psa_status_t psa_cipher_decrypt(mbedtls_svc_key_id_t key,
4243 psa_algorithm_t alg,
4244 const uint8_t *input,
4245 size_t input_length,
4246 uint8_t *output,
4247 size_t output_size,
4248 size_t *output_length)
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004249{
4250 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004251 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron23919522021-07-08 19:00:07 +02004252 psa_key_slot_t *slot = NULL;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01004253 psa_key_attributes_t attributes;
gabor-mezei-arm6f4e5bb2021-06-25 15:21:11 +02004254
Gilles Peskine449bd832023-01-11 14:50:10 +01004255 if (!PSA_ALG_IS_CIPHER(alg)) {
Ronald Cron23919522021-07-08 19:00:07 +02004256 status = PSA_ERROR_INVALID_ARGUMENT;
4257 goto exit;
4258 }
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004259
Gilles Peskine449bd832023-01-11 14:50:10 +01004260 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
4261 PSA_KEY_USAGE_DECRYPT,
4262 alg);
4263 if (status != PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004264 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004265 }
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004266
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01004267 attributes = (psa_key_attributes_t) {
Gilles Peskine449bd832023-01-11 14:50:10 +01004268 .core = slot->attr
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004269 };
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004270
Gilles Peskine449bd832023-01-11 14:50:10 +01004271 if (alg == PSA_ALG_CCM_STAR_NO_TAG &&
4272 input_length < PSA_BLOCK_CIPHER_BLOCK_LENGTH(slot->attr.type)) {
Mateusz Starzyk594215b2021-10-14 12:23:06 +02004273 status = PSA_ERROR_INVALID_ARGUMENT;
4274 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004275 } else if (input_length < PSA_CIPHER_IV_LENGTH(slot->attr.type, alg)) {
gabor-mezei-arm258ae072021-06-25 15:25:38 +02004276 status = PSA_ERROR_INVALID_ARGUMENT;
4277 goto exit;
4278 }
4279
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004280 status = psa_driver_wrapper_cipher_decrypt(
4281 &attributes, slot->key.data, slot->key.bytes,
4282 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01004283 output, output_size, output_length);
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004284
gabor-mezei-arm258ae072021-06-25 15:25:38 +02004285exit:
Ryan Everett1b70a072024-01-04 10:32:49 +00004286 unlock_status = psa_unregister_read(slot);
Gilles Peskine449bd832023-01-11 14:50:10 +01004287 if (status == PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004288 status = unlock_status;
Gilles Peskine449bd832023-01-11 14:50:10 +01004289 }
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004290
Gilles Peskine449bd832023-01-11 14:50:10 +01004291 if (status != PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004292 *output_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01004293 }
Ronald Cron23919522021-07-08 19:00:07 +02004294
Gilles Peskine449bd832023-01-11 14:50:10 +01004295 return status;
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004296}
4297
4298
mohammad16035955c982018-04-26 00:53:03 +03004299/****************************************************************/
4300/* AEAD */
4301/****************************************************************/
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02004302
Paul Elliottbaff51c2021-09-28 17:44:45 +01004303/* Helper function to get the base algorithm from its variants. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004304static psa_algorithm_t psa_aead_get_base_algorithm(psa_algorithm_t alg)
Paul Elliottbaff51c2021-09-28 17:44:45 +01004305{
Gilles Peskine449bd832023-01-11 14:50:10 +01004306 return PSA_ALG_AEAD_WITH_DEFAULT_LENGTH_TAG(alg);
Paul Elliottbaff51c2021-09-28 17:44:45 +01004307}
4308
4309/* Helper function to perform common nonce length checks. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004310static psa_status_t psa_aead_check_nonce_length(psa_algorithm_t alg,
4311 size_t nonce_length)
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004312{
Gilles Peskine449bd832023-01-11 14:50:10 +01004313 psa_algorithm_t base_alg = psa_aead_get_base_algorithm(alg);
Paul Elliottbaff51c2021-09-28 17:44:45 +01004314
Gilles Peskine449bd832023-01-11 14:50:10 +01004315 switch (base_alg) {
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004316#if defined(PSA_WANT_ALG_GCM)
4317 case PSA_ALG_GCM:
4318 /* Not checking max nonce size here as GCM spec allows almost
Gilles Peskine449bd832023-01-11 14:50:10 +01004319 * arbitrarily large nonces. Please note that we do not generally
4320 * recommend the usage of nonces of greater length than
4321 * PSA_AEAD_NONCE_MAX_SIZE, as large nonces are hashed to a shorter
4322 * size, which can then lead to collisions if you encrypt a very
4323 * large number of messages.*/
4324 if (nonce_length != 0) {
4325 return PSA_SUCCESS;
4326 }
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004327 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004328#endif /* PSA_WANT_ALG_GCM */
4329#if defined(PSA_WANT_ALG_CCM)
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004330 case PSA_ALG_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01004331 if (nonce_length >= 7 && nonce_length <= 13) {
4332 return PSA_SUCCESS;
4333 }
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004334 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004335#endif /* PSA_WANT_ALG_CCM */
4336#if defined(PSA_WANT_ALG_CHACHA20_POLY1305)
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004337 case PSA_ALG_CHACHA20_POLY1305:
Gilles Peskine449bd832023-01-11 14:50:10 +01004338 if (nonce_length == 12) {
4339 return PSA_SUCCESS;
4340 } else if (nonce_length == 8) {
4341 return PSA_ERROR_NOT_SUPPORTED;
4342 }
Bence Szépkúti6d48e202021-11-15 20:04:15 +01004343 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004344#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004345 default:
Przemek Stekiel4c499272022-09-27 13:55:37 +02004346 (void) nonce_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01004347 return PSA_ERROR_NOT_SUPPORTED;
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004348 }
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004349
Gilles Peskine449bd832023-01-11 14:50:10 +01004350 return PSA_ERROR_INVALID_ARGUMENT;
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004351}
4352
Gilles Peskine449bd832023-01-11 14:50:10 +01004353static psa_status_t psa_aead_check_algorithm(psa_algorithm_t alg)
Bence Szépkútiaa3a6e42022-01-13 16:26:03 +01004354{
Gilles Peskine449bd832023-01-11 14:50:10 +01004355 if (!PSA_ALG_IS_AEAD(alg) || PSA_ALG_IS_WILDCARD(alg)) {
4356 return PSA_ERROR_INVALID_ARGUMENT;
4357 }
Bence Szépkúti08f34652021-12-08 21:07:13 +01004358
Gilles Peskine449bd832023-01-11 14:50:10 +01004359 return PSA_SUCCESS;
Bence Szépkúti08f34652021-12-08 21:07:13 +01004360}
4361
Gilles Peskine449bd832023-01-11 14:50:10 +01004362psa_status_t psa_aead_encrypt(mbedtls_svc_key_id_t key,
4363 psa_algorithm_t alg,
4364 const uint8_t *nonce,
4365 size_t nonce_length,
4366 const uint8_t *additional_data,
4367 size_t additional_data_length,
4368 const uint8_t *plaintext,
4369 size_t plaintext_length,
4370 uint8_t *ciphertext,
4371 size_t ciphertext_size,
4372 size_t *ciphertext_length)
mohammad16035955c982018-04-26 00:53:03 +03004373{
Ronald Cron215633c2021-03-16 17:15:37 +01004374 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4375 psa_key_slot_t *slot;
Gilles Peskine2d277862018-06-18 15:41:12 +02004376
mohammad1603f08a5502018-06-03 15:05:47 +03004377 *ciphertext_length = 0;
mohammad1603e58e6842018-05-09 04:58:32 -07004378
Gilles Peskine449bd832023-01-11 14:50:10 +01004379 status = psa_aead_check_algorithm(alg);
4380 if (status != PSA_SUCCESS) {
4381 return status;
4382 }
Steven Cooremanea7ab132021-03-17 16:28:00 +01004383
Ronald Cron9a986162021-03-26 12:40:07 +01004384 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01004385 key, &slot, PSA_KEY_USAGE_ENCRYPT, alg);
4386 if (status != PSA_SUCCESS) {
4387 return status;
4388 }
mohammad16035955c982018-04-26 00:53:03 +03004389
Ronald Cron215633c2021-03-16 17:15:37 +01004390 psa_key_attributes_t attributes = {
Gilles Peskine449bd832023-01-11 14:50:10 +01004391 .core = slot->attr
Ronald Cron215633c2021-03-16 17:15:37 +01004392 };
mohammad16035955c982018-04-26 00:53:03 +03004393
Gilles Peskine449bd832023-01-11 14:50:10 +01004394 status = psa_aead_check_nonce_length(alg, nonce_length);
4395 if (status != PSA_SUCCESS) {
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004396 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004397 }
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004398
Ronald Cronde822812021-03-17 16:08:20 +01004399 status = psa_driver_wrapper_aead_encrypt(
Ronald Cron215633c2021-03-16 17:15:37 +01004400 &attributes, slot->key.data, slot->key.bytes,
4401 alg,
4402 nonce, nonce_length,
4403 additional_data, additional_data_length,
4404 plaintext, plaintext_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01004405 ciphertext, ciphertext_size, ciphertext_length);
Gilles Peskine2d277862018-06-18 15:41:12 +02004406
Gilles Peskine449bd832023-01-11 14:50:10 +01004407 if (status != PSA_SUCCESS && ciphertext_size != 0) {
4408 memset(ciphertext, 0, ciphertext_size);
4409 }
Gilles Peskine2d277862018-06-18 15:41:12 +02004410
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004411exit:
Ryan Everett1b70a072024-01-04 10:32:49 +00004412 psa_unregister_read(slot);
mohammad16035955c982018-04-26 00:53:03 +03004413
Gilles Peskine449bd832023-01-11 14:50:10 +01004414 return status;
Gilles Peskineee652a32018-06-01 19:23:52 +02004415}
4416
Gilles Peskine449bd832023-01-11 14:50:10 +01004417psa_status_t psa_aead_decrypt(mbedtls_svc_key_id_t key,
4418 psa_algorithm_t alg,
4419 const uint8_t *nonce,
4420 size_t nonce_length,
4421 const uint8_t *additional_data,
4422 size_t additional_data_length,
4423 const uint8_t *ciphertext,
4424 size_t ciphertext_length,
4425 uint8_t *plaintext,
4426 size_t plaintext_size,
4427 size_t *plaintext_length)
mohammad16035955c982018-04-26 00:53:03 +03004428{
Ronald Cron215633c2021-03-16 17:15:37 +01004429 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4430 psa_key_slot_t *slot;
Gilles Peskine2d277862018-06-18 15:41:12 +02004431
Gilles Peskineee652a32018-06-01 19:23:52 +02004432 *plaintext_length = 0;
mohammad16039e5a5152018-04-26 12:07:35 +03004433
Gilles Peskine449bd832023-01-11 14:50:10 +01004434 status = psa_aead_check_algorithm(alg);
4435 if (status != PSA_SUCCESS) {
4436 return status;
4437 }
Steven Cooremanea7ab132021-03-17 16:28:00 +01004438
Ronald Cron9a986162021-03-26 12:40:07 +01004439 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01004440 key, &slot, PSA_KEY_USAGE_DECRYPT, alg);
4441 if (status != PSA_SUCCESS) {
4442 return status;
4443 }
mohammad16035955c982018-04-26 00:53:03 +03004444
Ronald Cron215633c2021-03-16 17:15:37 +01004445 psa_key_attributes_t attributes = {
Gilles Peskine449bd832023-01-11 14:50:10 +01004446 .core = slot->attr
Ronald Cron215633c2021-03-16 17:15:37 +01004447 };
Gilles Peskinef7e7b012019-05-06 15:27:16 +02004448
Gilles Peskine449bd832023-01-11 14:50:10 +01004449 status = psa_aead_check_nonce_length(alg, nonce_length);
4450 if (status != PSA_SUCCESS) {
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004451 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004452 }
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004453
Ronald Cronde822812021-03-17 16:08:20 +01004454 status = psa_driver_wrapper_aead_decrypt(
Ronald Cron215633c2021-03-16 17:15:37 +01004455 &attributes, slot->key.data, slot->key.bytes,
4456 alg,
4457 nonce, nonce_length,
4458 additional_data, additional_data_length,
4459 ciphertext, ciphertext_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01004460 plaintext, plaintext_size, plaintext_length);
Gilles Peskinea40d7742018-06-01 16:28:30 +02004461
Gilles Peskine449bd832023-01-11 14:50:10 +01004462 if (status != PSA_SUCCESS && plaintext_size != 0) {
4463 memset(plaintext, 0, plaintext_size);
4464 }
mohammad160360a64d02018-06-03 17:20:42 +03004465
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004466exit:
Ryan Everett1b70a072024-01-04 10:32:49 +00004467 psa_unregister_read(slot);
Ronald Cron215633c2021-03-16 17:15:37 +01004468
Gilles Peskine449bd832023-01-11 14:50:10 +01004469 return status;
mohammad16035955c982018-04-26 00:53:03 +03004470}
4471
Gilles Peskine449bd832023-01-11 14:50:10 +01004472static psa_status_t psa_validate_tag_length(psa_algorithm_t alg)
4473{
4474 const uint8_t tag_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg);
Andrzej Kurekf8816012021-12-19 17:00:12 +01004475
Gilles Peskine449bd832023-01-11 14:50:10 +01004476 switch (PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg, 0)) {
Przemek Stekiel86679c72022-10-06 17:06:56 +02004477#if defined(PSA_WANT_ALG_CCM)
Gilles Peskine449bd832023-01-11 14:50:10 +01004478 case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, 0):
Andrzej Kurekf8816012021-12-19 17:00:12 +01004479 /* CCM allows the following tag lengths: 4, 6, 8, 10, 12, 14, 16.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01004480 if (tag_len < 4 || tag_len > 16 || tag_len % 2) {
4481 return PSA_ERROR_INVALID_ARGUMENT;
4482 }
Andrzej Kurekf8816012021-12-19 17:00:12 +01004483 break;
Przemek Stekiel86679c72022-10-06 17:06:56 +02004484#endif /* PSA_WANT_ALG_CCM */
Andrzej Kurekf8816012021-12-19 17:00:12 +01004485
Przemek Stekiel86679c72022-10-06 17:06:56 +02004486#if defined(PSA_WANT_ALG_GCM)
Gilles Peskine449bd832023-01-11 14:50:10 +01004487 case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_GCM, 0):
Andrzej Kurekf8816012021-12-19 17:00:12 +01004488 /* GCM allows the following tag lengths: 4, 8, 12, 13, 14, 15, 16. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004489 if (tag_len != 4 && tag_len != 8 && (tag_len < 12 || tag_len > 16)) {
4490 return PSA_ERROR_INVALID_ARGUMENT;
4491 }
Andrzej Kurekf8816012021-12-19 17:00:12 +01004492 break;
Przemek Stekiel86679c72022-10-06 17:06:56 +02004493#endif /* PSA_WANT_ALG_GCM */
Andrzej Kurekf8816012021-12-19 17:00:12 +01004494
Przemek Stekiel86679c72022-10-06 17:06:56 +02004495#if defined(PSA_WANT_ALG_CHACHA20_POLY1305)
Gilles Peskine449bd832023-01-11 14:50:10 +01004496 case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CHACHA20_POLY1305, 0):
Andrzej Kurekf8816012021-12-19 17:00:12 +01004497 /* We only support the default tag length. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004498 if (tag_len != 16) {
4499 return PSA_ERROR_INVALID_ARGUMENT;
4500 }
Andrzej Kurekf8816012021-12-19 17:00:12 +01004501 break;
Przemek Stekiel86679c72022-10-06 17:06:56 +02004502#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */
Andrzej Kurekf8816012021-12-19 17:00:12 +01004503
4504 default:
4505 (void) tag_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01004506 return PSA_ERROR_NOT_SUPPORTED;
Andrzej Kurekf8816012021-12-19 17:00:12 +01004507 }
Gilles Peskine449bd832023-01-11 14:50:10 +01004508 return PSA_SUCCESS;
Andrzej Kurekf8816012021-12-19 17:00:12 +01004509}
4510
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004511/* Set the key for a multipart authenticated operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004512static psa_status_t psa_aead_setup(psa_aead_operation_t *operation,
4513 int is_encrypt,
4514 mbedtls_svc_key_id_t key,
4515 psa_algorithm_t alg)
Paul Elliottc2b71442021-06-24 18:17:52 +01004516{
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004517 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4518 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
4519 psa_key_slot_t *slot = NULL;
4520 psa_key_usage_t key_usage = 0;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01004521 psa_key_attributes_t attributes;
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004522
Gilles Peskine449bd832023-01-11 14:50:10 +01004523 status = psa_aead_check_algorithm(alg);
4524 if (status != PSA_SUCCESS) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004525 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004526 }
Paul Elliottc2b71442021-06-24 18:17:52 +01004527
Gilles Peskine449bd832023-01-11 14:50:10 +01004528 if (operation->id != 0) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004529 status = PSA_ERROR_BAD_STATE;
4530 goto exit;
Paul Elliottc2b71442021-06-24 18:17:52 +01004531 }
4532
Gilles Peskine449bd832023-01-11 14:50:10 +01004533 if (operation->nonce_set || operation->lengths_set ||
4534 operation->ad_started || operation->body_started) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004535 status = PSA_ERROR_BAD_STATE;
4536 goto exit;
Paul Elliottc2b71442021-06-24 18:17:52 +01004537 }
4538
Gilles Peskine449bd832023-01-11 14:50:10 +01004539 if (is_encrypt) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004540 key_usage = PSA_KEY_USAGE_ENCRYPT;
Gilles Peskine449bd832023-01-11 14:50:10 +01004541 } else {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004542 key_usage = PSA_KEY_USAGE_DECRYPT;
Gilles Peskine449bd832023-01-11 14:50:10 +01004543 }
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004544
Gilles Peskine449bd832023-01-11 14:50:10 +01004545 status = psa_get_and_lock_key_slot_with_policy(key, &slot, key_usage,
4546 alg);
4547 if (status != PSA_SUCCESS) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004548 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004549 }
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004550
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01004551 attributes = (psa_key_attributes_t) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004552 .core = slot->attr
4553 };
4554
Gilles Peskine449bd832023-01-11 14:50:10 +01004555 if ((status = psa_validate_tag_length(alg)) != PSA_SUCCESS) {
Przemek Stekiel6ab50762022-10-08 17:54:30 +02004556 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004557 }
Przemek Stekiel6ab50762022-10-08 17:54:30 +02004558
Gilles Peskine449bd832023-01-11 14:50:10 +01004559 if (is_encrypt) {
4560 status = psa_driver_wrapper_aead_encrypt_setup(operation,
4561 &attributes,
4562 slot->key.data,
4563 slot->key.bytes,
4564 alg);
4565 } else {
4566 status = psa_driver_wrapper_aead_decrypt_setup(operation,
4567 &attributes,
4568 slot->key.data,
4569 slot->key.bytes,
4570 alg);
4571 }
4572 if (status != PSA_SUCCESS) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004573 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004574 }
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004575
Gilles Peskine449bd832023-01-11 14:50:10 +01004576 operation->key_type = psa_get_key_type(&attributes);
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004577
4578exit:
Ryan Everett1b70a072024-01-04 10:32:49 +00004579 unlock_status = psa_unregister_read(slot);
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004580
Gilles Peskine449bd832023-01-11 14:50:10 +01004581 if (status == PSA_SUCCESS) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004582 status = unlock_status;
Gilles Peskine449bd832023-01-11 14:50:10 +01004583 operation->alg = psa_aead_get_base_algorithm(alg);
Paul Elliottd9343f22021-08-23 18:59:49 +01004584 operation->is_encrypt = is_encrypt;
Gilles Peskine449bd832023-01-11 14:50:10 +01004585 } else {
4586 psa_aead_abort(operation);
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004587 }
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004588
Gilles Peskine449bd832023-01-11 14:50:10 +01004589 return status;
Paul Elliottc2b71442021-06-24 18:17:52 +01004590}
4591
Paul Elliott302ff6b2021-04-20 18:10:30 +01004592/* Set the key for a multipart authenticated encryption operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004593psa_status_t psa_aead_encrypt_setup(psa_aead_operation_t *operation,
4594 mbedtls_svc_key_id_t key,
4595 psa_algorithm_t alg)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004596{
Gilles Peskine449bd832023-01-11 14:50:10 +01004597 return psa_aead_setup(operation, 1, key, alg);
Paul Elliott302ff6b2021-04-20 18:10:30 +01004598}
4599
4600/* Set the key for a multipart authenticated decryption operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004601psa_status_t psa_aead_decrypt_setup(psa_aead_operation_t *operation,
4602 mbedtls_svc_key_id_t key,
4603 psa_algorithm_t alg)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004604{
Gilles Peskine449bd832023-01-11 14:50:10 +01004605 return psa_aead_setup(operation, 0, key, alg);
Paul Elliott302ff6b2021-04-20 18:10:30 +01004606}
4607
4608/* Generate a random nonce / IV for multipart AEAD operation */
Gilles Peskine449bd832023-01-11 14:50:10 +01004609psa_status_t psa_aead_generate_nonce(psa_aead_operation_t *operation,
4610 uint8_t *nonce,
4611 size_t nonce_size,
4612 size_t *nonce_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004613{
4614 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Croncae59092021-11-26 18:53:58 +01004615 uint8_t local_nonce[PSA_AEAD_NONCE_MAX_SIZE];
Sergeybef1f632023-03-06 15:25:06 -07004616 size_t required_nonce_size = 0;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004617
Paul Elliott8eb9daf2021-06-04 16:42:21 +01004618 *nonce_length = 0;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004619
Gilles Peskine449bd832023-01-11 14:50:10 +01004620 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004621 status = PSA_ERROR_BAD_STATE;
4622 goto exit;
4623 }
4624
Gilles Peskine449bd832023-01-11 14:50:10 +01004625 if (operation->nonce_set || !operation->is_encrypt) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004626 status = PSA_ERROR_BAD_STATE;
4627 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004628 }
4629
Paul Elliotte193ea82021-10-01 13:00:16 +01004630 /* For CCM, this size may not be correct according to the PSA
4631 * specification. The PSA Crypto 1.0.1 specification states:
4632 *
4633 * CCM encodes the plaintext length pLen in L octets, with L the smallest
4634 * integer >= 2 where pLen < 2^(8L). The nonce length is then 15 - L bytes.
4635 *
4636 * However this restriction that L has to be the smallest integer is not
4637 * applied in practice, and it is not implementable here since the
4638 * plaintext length may or may not be known at this time. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004639 required_nonce_size = PSA_AEAD_NONCE_LENGTH(operation->key_type,
4640 operation->alg);
4641 if (nonce_size < required_nonce_size) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004642 status = PSA_ERROR_BUFFER_TOO_SMALL;
4643 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004644 }
4645
Gilles Peskine449bd832023-01-11 14:50:10 +01004646 status = psa_generate_random(local_nonce, required_nonce_size);
4647 if (status != PSA_SUCCESS) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004648 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004649 }
Paul Elliott302ff6b2021-04-20 18:10:30 +01004650
Gilles Peskine449bd832023-01-11 14:50:10 +01004651 status = psa_aead_set_nonce(operation, local_nonce, required_nonce_size);
Paul Elliott302ff6b2021-04-20 18:10:30 +01004652
Paul Elliott39dc6b82021-05-11 19:16:09 +01004653exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004654 if (status == PSA_SUCCESS) {
4655 memcpy(nonce, local_nonce, required_nonce_size);
Paul Elliott39dc6b82021-05-11 19:16:09 +01004656 *nonce_length = required_nonce_size;
Gilles Peskine449bd832023-01-11 14:50:10 +01004657 } else {
4658 psa_aead_abort(operation);
Ronald Croncae59092021-11-26 18:53:58 +01004659 }
Paul Elliott39dc6b82021-05-11 19:16:09 +01004660
Gilles Peskine449bd832023-01-11 14:50:10 +01004661 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004662}
4663
4664/* Set the nonce for a multipart authenticated encryption or decryption
4665 operation.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01004666psa_status_t psa_aead_set_nonce(psa_aead_operation_t *operation,
4667 const uint8_t *nonce,
4668 size_t nonce_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004669{
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004670 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4671
Gilles Peskine449bd832023-01-11 14:50:10 +01004672 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004673 status = PSA_ERROR_BAD_STATE;
4674 goto exit;
4675 }
4676
Gilles Peskine449bd832023-01-11 14:50:10 +01004677 if (operation->nonce_set) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004678 status = PSA_ERROR_BAD_STATE;
4679 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004680 }
4681
Gilles Peskine449bd832023-01-11 14:50:10 +01004682 status = psa_aead_check_nonce_length(operation->alg, nonce_length);
4683 if (status != PSA_SUCCESS) {
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004684 status = PSA_ERROR_INVALID_ARGUMENT;
4685 goto exit;
Paul Elliott4ed1ed12021-09-27 18:09:28 +01004686 }
Paul Elliott1a98aca2021-05-20 18:24:07 +01004687
Gilles Peskine449bd832023-01-11 14:50:10 +01004688 status = psa_driver_wrapper_aead_set_nonce(operation, nonce,
4689 nonce_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004690
Paul Elliott39dc6b82021-05-11 19:16:09 +01004691exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004692 if (status == PSA_SUCCESS) {
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004693 operation->nonce_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004694 } else {
4695 psa_aead_abort(operation);
4696 }
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004697
Gilles Peskine449bd832023-01-11 14:50:10 +01004698 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004699}
4700
4701/* Declare the lengths of the message and additional data for multipart AEAD. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004702psa_status_t psa_aead_set_lengths(psa_aead_operation_t *operation,
4703 size_t ad_length,
4704 size_t plaintext_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004705{
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004706 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4707
Gilles Peskine449bd832023-01-11 14:50:10 +01004708 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004709 status = PSA_ERROR_BAD_STATE;
4710 goto exit;
4711 }
4712
Gilles Peskine449bd832023-01-11 14:50:10 +01004713 if (operation->lengths_set || operation->ad_started ||
4714 operation->body_started) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004715 status = PSA_ERROR_BAD_STATE;
4716 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004717 }
4718
Gilles Peskine449bd832023-01-11 14:50:10 +01004719 switch (operation->alg) {
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004720#if defined(PSA_WANT_ALG_GCM)
4721 case PSA_ALG_GCM:
4722 /* Lengths can only be too large for GCM if size_t is bigger than 32
Gilles Peskine449bd832023-01-11 14:50:10 +01004723 * bits. Without the guard this code will generate warnings on 32bit
4724 * builds. */
Paul Elliott325d3742021-09-27 17:56:28 +01004725#if SIZE_MAX > UINT32_MAX
Gilles Peskine449bd832023-01-11 14:50:10 +01004726 if (((uint64_t) ad_length) >> 61 != 0 ||
4727 ((uint64_t) plaintext_length) > 0xFFFFFFFE0ull) {
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004728 status = PSA_ERROR_INVALID_ARGUMENT;
4729 goto exit;
4730 }
Paul Elliott325d3742021-09-27 17:56:28 +01004731#endif
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004732 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004733#endif /* PSA_WANT_ALG_GCM */
4734#if defined(PSA_WANT_ALG_CCM)
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004735 case PSA_ALG_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01004736 if (ad_length > 0xFF00) {
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004737 status = PSA_ERROR_INVALID_ARGUMENT;
4738 goto exit;
4739 }
4740 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004741#endif /* PSA_WANT_ALG_CCM */
4742#if defined(PSA_WANT_ALG_CHACHA20_POLY1305)
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004743 case PSA_ALG_CHACHA20_POLY1305:
4744 /* No length restrictions for ChaChaPoly. */
4745 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004746#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004747 default:
4748 break;
4749 }
Paul Elliott325d3742021-09-27 17:56:28 +01004750
Gilles Peskine449bd832023-01-11 14:50:10 +01004751 status = psa_driver_wrapper_aead_set_lengths(operation, ad_length,
4752 plaintext_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004753
Paul Elliott39dc6b82021-05-11 19:16:09 +01004754exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004755 if (status == PSA_SUCCESS) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01004756 operation->ad_remaining = ad_length;
4757 operation->body_remaining = plaintext_length;
Paul Elliott39dc6b82021-05-11 19:16:09 +01004758 operation->lengths_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004759 } else {
4760 psa_aead_abort(operation);
Paul Elliottee4ffe02021-05-20 17:25:06 +01004761 }
Paul Elliott39dc6b82021-05-11 19:16:09 +01004762
Gilles Peskine449bd832023-01-11 14:50:10 +01004763 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004764}
Paul Elliott3d7d52c2021-09-01 10:33:14 +01004765
4766/* Pass additional data to an active multipart AEAD operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004767psa_status_t psa_aead_update_ad(psa_aead_operation_t *operation,
4768 const uint8_t *input,
4769 size_t input_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004770{
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004771 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4772
Gilles Peskine449bd832023-01-11 14:50:10 +01004773 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004774 status = PSA_ERROR_BAD_STATE;
4775 goto exit;
4776 }
4777
Gilles Peskine449bd832023-01-11 14:50:10 +01004778 if (!operation->nonce_set || operation->body_started) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004779 status = PSA_ERROR_BAD_STATE;
4780 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004781 }
4782
Gilles Peskine449bd832023-01-11 14:50:10 +01004783 if (operation->lengths_set) {
4784 if (operation->ad_remaining < input_length) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01004785 status = PSA_ERROR_INVALID_ARGUMENT;
4786 goto exit;
4787 }
4788
4789 operation->ad_remaining -= input_length;
4790 }
Paul Elliotte193ea82021-10-01 13:00:16 +01004791#if defined(PSA_WANT_ALG_CCM)
Gilles Peskine449bd832023-01-11 14:50:10 +01004792 else if (operation->alg == PSA_ALG_CCM) {
Paul Elliotte193ea82021-10-01 13:00:16 +01004793 status = PSA_ERROR_BAD_STATE;
4794 goto exit;
4795 }
4796#endif /* PSA_WANT_ALG_CCM */
Paul Elliottee4ffe02021-05-20 17:25:06 +01004797
Gilles Peskine449bd832023-01-11 14:50:10 +01004798 status = psa_driver_wrapper_aead_update_ad(operation, input,
4799 input_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004800
Paul Elliott39dc6b82021-05-11 19:16:09 +01004801exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004802 if (status == PSA_SUCCESS) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004803 operation->ad_started = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004804 } else {
4805 psa_aead_abort(operation);
4806 }
Paul Elliott39dc6b82021-05-11 19:16:09 +01004807
Gilles Peskine449bd832023-01-11 14:50:10 +01004808 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004809}
4810
4811/* Encrypt or decrypt a message fragment in an active multipart AEAD
4812 operation.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01004813psa_status_t psa_aead_update(psa_aead_operation_t *operation,
4814 const uint8_t *input,
4815 size_t input_length,
4816 uint8_t *output,
4817 size_t output_size,
4818 size_t *output_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004819{
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004820 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004821
4822 *output_length = 0;
4823
Gilles Peskine449bd832023-01-11 14:50:10 +01004824 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004825 status = PSA_ERROR_BAD_STATE;
4826 goto exit;
4827 }
4828
Gilles Peskine449bd832023-01-11 14:50:10 +01004829 if (!operation->nonce_set) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004830 status = PSA_ERROR_BAD_STATE;
4831 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004832 }
4833
Gilles Peskine449bd832023-01-11 14:50:10 +01004834 if (operation->lengths_set) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01004835 /* Additional data length was supplied, but not all the additional
4836 data was supplied.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01004837 if (operation->ad_remaining != 0) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01004838 status = PSA_ERROR_INVALID_ARGUMENT;
4839 goto exit;
4840 }
4841
4842 /* Too much data provided. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004843 if (operation->body_remaining < input_length) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01004844 status = PSA_ERROR_INVALID_ARGUMENT;
4845 goto exit;
4846 }
4847
4848 operation->body_remaining -= input_length;
4849 }
Paul Elliotte193ea82021-10-01 13:00:16 +01004850#if defined(PSA_WANT_ALG_CCM)
Gilles Peskine449bd832023-01-11 14:50:10 +01004851 else if (operation->alg == PSA_ALG_CCM) {
Paul Elliotte193ea82021-10-01 13:00:16 +01004852 status = PSA_ERROR_BAD_STATE;
4853 goto exit;
4854 }
4855#endif /* PSA_WANT_ALG_CCM */
Paul Elliottee4ffe02021-05-20 17:25:06 +01004856
Gilles Peskine449bd832023-01-11 14:50:10 +01004857 status = psa_driver_wrapper_aead_update(operation, input, input_length,
4858 output, output_size,
4859 output_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004860
Paul Elliott39dc6b82021-05-11 19:16:09 +01004861exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004862 if (status == PSA_SUCCESS) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004863 operation->body_started = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004864 } else {
4865 psa_aead_abort(operation);
4866 }
Paul Elliott39dc6b82021-05-11 19:16:09 +01004867
Gilles Peskine449bd832023-01-11 14:50:10 +01004868 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004869}
4870
Gilles Peskine449bd832023-01-11 14:50:10 +01004871static psa_status_t psa_aead_final_checks(const psa_aead_operation_t *operation)
Paul Elliottad53dcc2021-06-23 08:50:14 +01004872{
Gilles Peskine449bd832023-01-11 14:50:10 +01004873 if (operation->id == 0 || !operation->nonce_set) {
4874 return PSA_ERROR_BAD_STATE;
4875 }
Paul Elliottad53dcc2021-06-23 08:50:14 +01004876
Gilles Peskine449bd832023-01-11 14:50:10 +01004877 if (operation->lengths_set && (operation->ad_remaining != 0 ||
4878 operation->body_remaining != 0)) {
4879 return PSA_ERROR_INVALID_ARGUMENT;
4880 }
Paul Elliottad53dcc2021-06-23 08:50:14 +01004881
Gilles Peskine449bd832023-01-11 14:50:10 +01004882 return PSA_SUCCESS;
Paul Elliottad53dcc2021-06-23 08:50:14 +01004883}
4884
Paul Elliott302ff6b2021-04-20 18:10:30 +01004885/* Finish encrypting a message in a multipart AEAD operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004886psa_status_t psa_aead_finish(psa_aead_operation_t *operation,
4887 uint8_t *ciphertext,
4888 size_t ciphertext_size,
4889 size_t *ciphertext_length,
4890 uint8_t *tag,
4891 size_t tag_size,
4892 size_t *tag_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004893{
Paul Elliott39dc6b82021-05-11 19:16:09 +01004894 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4895
Paul Elliott302ff6b2021-04-20 18:10:30 +01004896 *ciphertext_length = 0;
Paul Elliottf88a5652021-06-22 17:53:45 +01004897 *tag_length = tag_size;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004898
Gilles Peskine449bd832023-01-11 14:50:10 +01004899 status = psa_aead_final_checks(operation);
4900 if (status != PSA_SUCCESS) {
Paul Elliottad53dcc2021-06-23 08:50:14 +01004901 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004902 }
Paul Elliottad53dcc2021-06-23 08:50:14 +01004903
Gilles Peskine449bd832023-01-11 14:50:10 +01004904 if (!operation->is_encrypt) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004905 status = PSA_ERROR_BAD_STATE;
4906 goto exit;
4907 }
4908
Gilles Peskine449bd832023-01-11 14:50:10 +01004909 status = psa_driver_wrapper_aead_finish(operation, ciphertext,
4910 ciphertext_size,
4911 ciphertext_length,
4912 tag, tag_size, tag_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004913
Paul Elliott39dc6b82021-05-11 19:16:09 +01004914exit:
Paul Elliottdc42ca82023-02-24 18:11:59 +00004915
4916
Paul Elliottf47b0952021-05-21 18:02:33 +01004917 /* In case the operation fails and the user fails to check for failure or
Paul Elliott4c916e82021-09-19 18:34:50 +01004918 * the zero tag size, make sure the tag is set to something implausible.
4919 * Even if the operation succeeds, make sure we clear the rest of the
4920 * buffer to prevent potential leakage of anything previously placed in
4921 * the same buffer.*/
Paul Elliottdc42ca82023-02-24 18:11:59 +00004922 psa_wipe_tag_output_buffer(tag, status, tag_size, *tag_length);
Paul Elliottf47b0952021-05-21 18:02:33 +01004923
Gilles Peskine449bd832023-01-11 14:50:10 +01004924 psa_aead_abort(operation);
Paul Elliott39dc6b82021-05-11 19:16:09 +01004925
Gilles Peskine449bd832023-01-11 14:50:10 +01004926 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004927}
4928
4929/* Finish authenticating and decrypting a message in a multipart AEAD
4930 operation.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01004931psa_status_t psa_aead_verify(psa_aead_operation_t *operation,
4932 uint8_t *plaintext,
4933 size_t plaintext_size,
4934 size_t *plaintext_length,
4935 const uint8_t *tag,
4936 size_t tag_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004937{
Paul Elliott39dc6b82021-05-11 19:16:09 +01004938 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4939
Paul Elliott302ff6b2021-04-20 18:10:30 +01004940 *plaintext_length = 0;
4941
Gilles Peskine449bd832023-01-11 14:50:10 +01004942 status = psa_aead_final_checks(operation);
4943 if (status != PSA_SUCCESS) {
Paul Elliottad53dcc2021-06-23 08:50:14 +01004944 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004945 }
Paul Elliottad53dcc2021-06-23 08:50:14 +01004946
Gilles Peskine449bd832023-01-11 14:50:10 +01004947 if (operation->is_encrypt) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004948 status = PSA_ERROR_BAD_STATE;
4949 goto exit;
4950 }
4951
Gilles Peskine449bd832023-01-11 14:50:10 +01004952 status = psa_driver_wrapper_aead_verify(operation, plaintext,
4953 plaintext_size,
4954 plaintext_length,
4955 tag, tag_length);
Paul Elliott39dc6b82021-05-11 19:16:09 +01004956
4957exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004958 psa_aead_abort(operation);
Paul Elliott39dc6b82021-05-11 19:16:09 +01004959
Gilles Peskine449bd832023-01-11 14:50:10 +01004960 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004961}
4962
4963/* Abort an AEAD operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004964psa_status_t psa_aead_abort(psa_aead_operation_t *operation)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004965{
4966 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4967
Gilles Peskine449bd832023-01-11 14:50:10 +01004968 if (operation->id == 0) {
Paul Elliott302ff6b2021-04-20 18:10:30 +01004969 /* The object has (apparently) been initialized but it is not (yet)
4970 * in use. It's ok to call abort on such an object, and there's
4971 * nothing to do. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004972 return PSA_SUCCESS;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004973 }
4974
Gilles Peskine449bd832023-01-11 14:50:10 +01004975 status = psa_driver_wrapper_aead_abort(operation);
Paul Elliott302ff6b2021-04-20 18:10:30 +01004976
Gilles Peskine449bd832023-01-11 14:50:10 +01004977 memset(operation, 0, sizeof(*operation));
Paul Elliott302ff6b2021-04-20 18:10:30 +01004978
Gilles Peskine449bd832023-01-11 14:50:10 +01004979 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004980}
4981
Gilles Peskinee59236f2018-01-27 23:32:46 +01004982/****************************************************************/
Gilles Peskineeab56e42018-07-12 17:12:33 +02004983/* Generators */
4984/****************************************************************/
4985
Przemek Stekiel69c46792022-06-10 12:59:51 +02004986#if defined(BUILTIN_ALG_ANY_HKDF) || \
John Durkop07cc04a2020-11-16 22:08:34 -08004987 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
Andrzej Kurek08d34b82022-07-29 10:00:16 -04004988 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) || \
Kusumit Ghoderaoaf0b5342023-05-03 11:58:46 +05304989 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) || \
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05304990 defined(PSA_HAVE_SOFT_PBKDF2)
John Durkop07cc04a2020-11-16 22:08:34 -08004991#define AT_LEAST_ONE_BUILTIN_KDF
Steven Cooreman094a77e2021-05-06 17:58:36 +02004992#endif /* At least one builtin KDF */
4993
Przemek Stekiel69c46792022-06-10 12:59:51 +02004994#if defined(BUILTIN_ALG_ANY_HKDF) || \
Steven Cooreman094a77e2021-05-06 17:58:36 +02004995 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
4996 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
4997static psa_status_t psa_key_derivation_start_hmac(
4998 psa_mac_operation_t *operation,
4999 psa_algorithm_t hash_alg,
5000 const uint8_t *hmac_key,
Gilles Peskine449bd832023-01-11 14:50:10 +01005001 size_t hmac_key_length)
Steven Cooreman094a77e2021-05-06 17:58:36 +02005002{
5003 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
5004 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine449bd832023-01-11 14:50:10 +01005005 psa_set_key_type(&attributes, PSA_KEY_TYPE_HMAC);
5006 psa_set_key_bits(&attributes, PSA_BYTES_TO_BITS(hmac_key_length));
5007 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_HASH);
Steven Cooreman094a77e2021-05-06 17:58:36 +02005008
Steven Cooreman72f736a2021-05-07 14:14:37 +02005009 operation->is_sign = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01005010 operation->mac_size = PSA_HASH_LENGTH(hash_alg);
Steven Cooreman72f736a2021-05-07 14:14:37 +02005011
Gilles Peskine449bd832023-01-11 14:50:10 +01005012 status = psa_driver_wrapper_mac_sign_setup(operation,
5013 &attributes,
5014 hmac_key, hmac_key_length,
5015 PSA_ALG_HMAC(hash_alg));
Steven Cooreman094a77e2021-05-06 17:58:36 +02005016
Gilles Peskine449bd832023-01-11 14:50:10 +01005017 psa_reset_key_attributes(&attributes);
5018 return status;
Steven Cooreman094a77e2021-05-06 17:58:36 +02005019}
5020#endif /* KDF algorithms reliant on HMAC */
John Durkop07cc04a2020-11-16 22:08:34 -08005021
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005022#define HKDF_STATE_INIT 0 /* no input yet */
5023#define HKDF_STATE_STARTED 1 /* got salt */
5024#define HKDF_STATE_KEYED 2 /* got key */
5025#define HKDF_STATE_OUTPUT 3 /* output started */
5026
Gilles Peskinecbe66502019-05-16 16:59:18 +02005027static psa_algorithm_t psa_key_derivation_get_kdf_alg(
Gilles Peskine449bd832023-01-11 14:50:10 +01005028 const psa_key_derivation_operation_t *operation)
Gilles Peskine969c5d62019-01-16 15:53:06 +01005029{
Gilles Peskine449bd832023-01-11 14:50:10 +01005030 if (PSA_ALG_IS_KEY_AGREEMENT(operation->alg)) {
5031 return PSA_ALG_KEY_AGREEMENT_GET_KDF(operation->alg);
5032 } else {
5033 return operation->alg;
5034 }
Gilles Peskine969c5d62019-01-16 15:53:06 +01005035}
5036
Gilles Peskine449bd832023-01-11 14:50:10 +01005037psa_status_t psa_key_derivation_abort(psa_key_derivation_operation_t *operation)
Gilles Peskineeab56e42018-07-12 17:12:33 +02005038{
5039 psa_status_t status = PSA_SUCCESS;
Gilles Peskine449bd832023-01-11 14:50:10 +01005040 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation);
5041 if (kdf_alg == 0) {
Gilles Peskineeab56e42018-07-12 17:12:33 +02005042 /* The object has (apparently) been initialized but it is not
5043 * in use. It's ok to call abort on such an object, and there's
5044 * nothing to do. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005045 } else
Przemek Stekiel69c46792022-06-10 12:59:51 +02005046#if defined(BUILTIN_ALG_ANY_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01005047 if (PSA_ALG_IS_ANY_HKDF(kdf_alg)) {
5048 mbedtls_free(operation->ctx.hkdf.info);
5049 status = psa_mac_abort(&operation->ctx.hkdf.hmac);
5050 } else
Przemek Stekiel69c46792022-06-10 12:59:51 +02005051#endif /* BUILTIN_ALG_ANY_HKDF */
John Durkop07cc04a2020-11-16 22:08:34 -08005052#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
5053 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005054 if (PSA_ALG_IS_TLS12_PRF(kdf_alg) ||
5055 /* TLS-1.2 PSK-to-MS KDF uses the same core as TLS-1.2 PRF */
5056 PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
5057 if (operation->ctx.tls12_prf.secret != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01005058 mbedtls_zeroize_and_free(operation->ctx.tls12_prf.secret,
Gilles Peskine449bd832023-01-11 14:50:10 +01005059 operation->ctx.tls12_prf.secret_length);
Steven Cooremana6df6042021-04-29 19:32:25 +02005060 }
5061
Gilles Peskine449bd832023-01-11 14:50:10 +01005062 if (operation->ctx.tls12_prf.seed != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01005063 mbedtls_zeroize_and_free(operation->ctx.tls12_prf.seed,
Gilles Peskine449bd832023-01-11 14:50:10 +01005064 operation->ctx.tls12_prf.seed_length);
Janos Follath6a1d2622019-06-11 10:37:28 +01005065 }
5066
Gilles Peskine449bd832023-01-11 14:50:10 +01005067 if (operation->ctx.tls12_prf.label != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01005068 mbedtls_zeroize_and_free(operation->ctx.tls12_prf.label,
Gilles Peskine449bd832023-01-11 14:50:10 +01005069 operation->ctx.tls12_prf.label_length);
Janos Follath6a1d2622019-06-11 10:37:28 +01005070 }
Przemek Stekiel6c764412022-11-22 14:05:12 +01005071#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005072 if (operation->ctx.tls12_prf.other_secret != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01005073 mbedtls_zeroize_and_free(operation->ctx.tls12_prf.other_secret,
Gilles Peskine449bd832023-01-11 14:50:10 +01005074 operation->ctx.tls12_prf.other_secret_length);
Przemek Stekiele3ee2212022-04-07 14:29:56 +02005075 }
Przemek Stekiel6c764412022-11-22 14:05:12 +01005076#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Steven Cooremana6df6042021-04-29 19:32:25 +02005077 status = PSA_SUCCESS;
Janos Follath6a1d2622019-06-11 10:37:28 +01005078
5079 /* We leave the fields Ai and output_block to be erased safely by the
5080 * mbedtls_platform_zeroize() in the end of this function. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005081 } else
John Durkop07cc04a2020-11-16 22:08:34 -08005082#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) ||
5083 * defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) */
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005084#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005085 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
5086 mbedtls_platform_zeroize(operation->ctx.tls12_ecjpake_to_pms.data,
5087 sizeof(operation->ctx.tls12_ecjpake_to_pms.data));
5088 } else
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005089#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) */
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05305090#if defined(PSA_HAVE_SOFT_PBKDF2)
Kusumit Ghoderao9ab03c32023-07-27 21:14:05 +05305091 if (PSA_ALG_IS_PBKDF2(kdf_alg)) {
Kusumit Ghoderaof5fedf12023-05-03 12:29:48 +05305092 if (operation->ctx.pbkdf2.salt != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01005093 mbedtls_zeroize_and_free(operation->ctx.pbkdf2.salt,
Kusumit Ghoderaof5fedf12023-05-03 12:29:48 +05305094 operation->ctx.pbkdf2.salt_length);
Kusumit Ghoderaof5fedf12023-05-03 12:29:48 +05305095 }
Kusumit Ghoderaof5fedf12023-05-03 12:29:48 +05305096
5097 status = PSA_SUCCESS;
5098 } else
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05305099#endif /* defined(PSA_HAVE_SOFT_PBKDF2) */
Gilles Peskineeab56e42018-07-12 17:12:33 +02005100 {
5101 status = PSA_ERROR_BAD_STATE;
5102 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005103 mbedtls_platform_zeroize(operation, sizeof(*operation));
5104 return status;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005105}
5106
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005107psa_status_t psa_key_derivation_get_capacity(const psa_key_derivation_operation_t *operation,
Gilles Peskine449bd832023-01-11 14:50:10 +01005108 size_t *capacity)
Gilles Peskineeab56e42018-07-12 17:12:33 +02005109{
Gilles Peskine449bd832023-01-11 14:50:10 +01005110 if (operation->alg == 0) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005111 /* This is a blank key derivation operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005112 return PSA_ERROR_BAD_STATE;
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005113 }
5114
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005115 *capacity = operation->capacity;
Gilles Peskine449bd832023-01-11 14:50:10 +01005116 return PSA_SUCCESS;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005117}
5118
Gilles Peskine449bd832023-01-11 14:50:10 +01005119psa_status_t psa_key_derivation_set_capacity(psa_key_derivation_operation_t *operation,
5120 size_t capacity)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005121{
Gilles Peskine449bd832023-01-11 14:50:10 +01005122 if (operation->alg == 0) {
5123 return PSA_ERROR_BAD_STATE;
5124 }
5125 if (capacity > operation->capacity) {
5126 return PSA_ERROR_INVALID_ARGUMENT;
5127 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005128 operation->capacity = capacity;
Gilles Peskine449bd832023-01-11 14:50:10 +01005129 return PSA_SUCCESS;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005130}
5131
Przemek Stekiel69c46792022-06-10 12:59:51 +02005132#if defined(BUILTIN_ALG_ANY_HKDF)
Przemek Stekiel03d948c2022-05-19 11:45:20 +02005133/* Read some bytes from an HKDF-based operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005134static psa_status_t psa_key_derivation_hkdf_read(psa_hkdf_key_derivation_t *hkdf,
5135 psa_algorithm_t kdf_alg,
5136 uint8_t *output,
5137 size_t output_length)
Gilles Peskinebef7f142018-07-12 17:22:21 +02005138{
Gilles Peskine449bd832023-01-11 14:50:10 +01005139 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(kdf_alg);
5140 uint8_t hash_length = PSA_HASH_LENGTH(hash_alg);
Steven Cooremand1ed1d92021-04-29 19:11:25 +02005141 size_t hmac_output_length;
Gilles Peskinebef7f142018-07-12 17:22:21 +02005142 psa_status_t status;
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02005143#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01005144 const uint8_t last_block = PSA_ALG_IS_HKDF_EXTRACT(kdf_alg) ? 0 : 0xff;
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02005145#else
5146 const uint8_t last_block = 0xff;
5147#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Gilles Peskinebef7f142018-07-12 17:22:21 +02005148
Gilles Peskine449bd832023-01-11 14:50:10 +01005149 if (hkdf->state < HKDF_STATE_KEYED ||
5150 (!hkdf->info_set
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02005151#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01005152 && !PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02005153#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Gilles Peskine449bd832023-01-11 14:50:10 +01005154 )) {
5155 return PSA_ERROR_BAD_STATE;
5156 }
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005157 hkdf->state = HKDF_STATE_OUTPUT;
5158
Gilles Peskine449bd832023-01-11 14:50:10 +01005159 while (output_length != 0) {
Gilles Peskinebef7f142018-07-12 17:22:21 +02005160 /* Copy what remains of the current block */
5161 uint8_t n = hash_length - hkdf->offset_in_block;
Gilles Peskine449bd832023-01-11 14:50:10 +01005162 if (n > output_length) {
Gilles Peskinebef7f142018-07-12 17:22:21 +02005163 n = (uint8_t) output_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01005164 }
5165 memcpy(output, hkdf->output_block + hkdf->offset_in_block, n);
Gilles Peskinebef7f142018-07-12 17:22:21 +02005166 output += n;
5167 output_length -= n;
5168 hkdf->offset_in_block += n;
Gilles Peskine449bd832023-01-11 14:50:10 +01005169 if (output_length == 0) {
Gilles Peskinebef7f142018-07-12 17:22:21 +02005170 break;
Gilles Peskine449bd832023-01-11 14:50:10 +01005171 }
Przemek Stekiel03d948c2022-05-19 11:45:20 +02005172 /* We can't be wanting more output after the last block, otherwise
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02005173 * the capacity check in psa_key_derivation_output_bytes() would have
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005174 * prevented this call. It could happen only if the operation
Gilles Peskined54931c2018-07-17 21:06:59 +02005175 * object was corrupted or if this function is called directly
5176 * inside the library. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005177 if (hkdf->block_number == last_block) {
5178 return PSA_ERROR_BAD_STATE;
5179 }
Gilles Peskinebef7f142018-07-12 17:22:21 +02005180
5181 /* We need a new block */
5182 ++hkdf->block_number;
5183 hkdf->offset_in_block = 0;
Steven Cooremand1ed1d92021-04-29 19:11:25 +02005184
Gilles Peskine449bd832023-01-11 14:50:10 +01005185 status = psa_key_derivation_start_hmac(&hkdf->hmac,
5186 hash_alg,
5187 hkdf->prk,
5188 hash_length);
5189 if (status != PSA_SUCCESS) {
5190 return status;
Gilles Peskinebef7f142018-07-12 17:22:21 +02005191 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005192
5193 if (hkdf->block_number != 1) {
5194 status = psa_mac_update(&hkdf->hmac,
5195 hkdf->output_block,
5196 hash_length);
5197 if (status != PSA_SUCCESS) {
5198 return status;
5199 }
5200 }
5201 status = psa_mac_update(&hkdf->hmac,
5202 hkdf->info,
5203 hkdf->info_length);
5204 if (status != PSA_SUCCESS) {
5205 return status;
5206 }
5207 status = psa_mac_update(&hkdf->hmac,
5208 &hkdf->block_number, 1);
5209 if (status != PSA_SUCCESS) {
5210 return status;
5211 }
5212 status = psa_mac_sign_finish(&hkdf->hmac,
5213 hkdf->output_block,
5214 sizeof(hkdf->output_block),
5215 &hmac_output_length);
5216 if (status != PSA_SUCCESS) {
5217 return status;
5218 }
Gilles Peskinebef7f142018-07-12 17:22:21 +02005219 }
5220
Gilles Peskine449bd832023-01-11 14:50:10 +01005221 return PSA_SUCCESS;
Gilles Peskinebef7f142018-07-12 17:22:21 +02005222}
Przemek Stekiel69c46792022-06-10 12:59:51 +02005223#endif /* BUILTIN_ALG_ANY_HKDF */
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005224
John Durkop07cc04a2020-11-16 22:08:34 -08005225#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
5226 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Janos Follath7742fee2019-06-17 12:58:10 +01005227static psa_status_t psa_key_derivation_tls12_prf_generate_next_block(
5228 psa_tls12_prf_key_derivation_t *tls12_prf,
Gilles Peskine449bd832023-01-11 14:50:10 +01005229 psa_algorithm_t alg)
Janos Follath7742fee2019-06-17 12:58:10 +01005230{
Gilles Peskine449bd832023-01-11 14:50:10 +01005231 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(alg);
5232 uint8_t hash_length = PSA_HASH_LENGTH(hash_alg);
Steven Cooremana6df6042021-04-29 19:32:25 +02005233 psa_mac_operation_t hmac = PSA_MAC_OPERATION_INIT;
5234 size_t hmac_output_length;
Janos Follathea29bfb2019-06-19 12:21:20 +01005235 psa_status_t status, cleanup_status;
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005236
Janos Follath7742fee2019-06-17 12:58:10 +01005237 /* We can't be wanting more output after block 0xff, otherwise
5238 * the capacity check in psa_key_derivation_output_bytes() would have
5239 * prevented this call. It could happen only if the operation
5240 * object was corrupted or if this function is called directly
5241 * inside the library. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005242 if (tls12_prf->block_number == 0xff) {
5243 return PSA_ERROR_CORRUPTION_DETECTED;
5244 }
Janos Follath7742fee2019-06-17 12:58:10 +01005245
5246 /* We need a new block */
5247 ++tls12_prf->block_number;
Janos Follath844eb0e2019-06-19 12:10:49 +01005248 tls12_prf->left_in_block = hash_length;
Janos Follath7742fee2019-06-17 12:58:10 +01005249
5250 /* Recall the definition of the TLS-1.2-PRF from RFC 5246:
5251 *
5252 * PRF(secret, label, seed) = P_<hash>(secret, label + seed)
5253 *
5254 * P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
5255 * HMAC_hash(secret, A(2) + seed) +
5256 * HMAC_hash(secret, A(3) + seed) + ...
5257 *
5258 * A(0) = seed
Janos Follathea29bfb2019-06-19 12:21:20 +01005259 * A(i) = HMAC_hash(secret, A(i-1))
Janos Follath7742fee2019-06-17 12:58:10 +01005260 *
Janos Follathea29bfb2019-06-19 12:21:20 +01005261 * The `psa_tls12_prf_key_derivation` structure saves the block
Janos Follath7742fee2019-06-17 12:58:10 +01005262 * `HMAC_hash(secret, A(i) + seed)` from which the output
Janos Follath76c39842019-06-26 12:50:36 +01005263 * is currently extracted as `output_block` and where i is
5264 * `block_number`.
Janos Follath7742fee2019-06-17 12:58:10 +01005265 */
5266
Gilles Peskine449bd832023-01-11 14:50:10 +01005267 status = psa_key_derivation_start_hmac(&hmac,
5268 hash_alg,
5269 tls12_prf->secret,
5270 tls12_prf->secret_length);
5271 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005272 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005273 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005274
5275 /* Calculate A(i) where i = tls12_prf->block_number. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005276 if (tls12_prf->block_number == 1) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005277 /* A(1) = HMAC_hash(secret, A(0)), where A(0) = seed. (The RFC overloads
5278 * the variable seed and in this instance means it in the context of the
5279 * P_hash function, where seed = label + seed.) */
Gilles Peskine449bd832023-01-11 14:50:10 +01005280 status = psa_mac_update(&hmac,
5281 tls12_prf->label,
5282 tls12_prf->label_length);
5283 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005284 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005285 }
5286 status = psa_mac_update(&hmac,
5287 tls12_prf->seed,
5288 tls12_prf->seed_length);
5289 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005290 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005291 }
5292 } else {
Janos Follathea29bfb2019-06-19 12:21:20 +01005293 /* A(i) = HMAC_hash(secret, A(i-1)) */
Gilles Peskine449bd832023-01-11 14:50:10 +01005294 status = psa_mac_update(&hmac, tls12_prf->Ai, hash_length);
5295 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005296 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005297 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005298 }
5299
Gilles Peskine449bd832023-01-11 14:50:10 +01005300 status = psa_mac_sign_finish(&hmac,
5301 tls12_prf->Ai, hash_length,
5302 &hmac_output_length);
5303 if (hmac_output_length != hash_length) {
Steven Cooremana6df6042021-04-29 19:32:25 +02005304 status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine449bd832023-01-11 14:50:10 +01005305 }
5306 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005307 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005308 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005309
5310 /* Calculate HMAC_hash(secret, A(i) + label + seed). */
Gilles Peskine449bd832023-01-11 14:50:10 +01005311 status = psa_key_derivation_start_hmac(&hmac,
5312 hash_alg,
5313 tls12_prf->secret,
5314 tls12_prf->secret_length);
5315 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005316 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005317 }
5318 status = psa_mac_update(&hmac, tls12_prf->Ai, hash_length);
5319 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005320 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005321 }
5322 status = psa_mac_update(&hmac, tls12_prf->label, tls12_prf->label_length);
5323 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005324 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005325 }
5326 status = psa_mac_update(&hmac, tls12_prf->seed, tls12_prf->seed_length);
5327 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005328 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005329 }
5330 status = psa_mac_sign_finish(&hmac,
5331 tls12_prf->output_block, hash_length,
5332 &hmac_output_length);
5333 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005334 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005335 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005336
Janos Follath7742fee2019-06-17 12:58:10 +01005337
5338cleanup:
Gilles Peskine449bd832023-01-11 14:50:10 +01005339 cleanup_status = psa_mac_abort(&hmac);
5340 if (status == PSA_SUCCESS && cleanup_status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005341 status = cleanup_status;
Gilles Peskine449bd832023-01-11 14:50:10 +01005342 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005343
Gilles Peskine449bd832023-01-11 14:50:10 +01005344 return status;
Janos Follath7742fee2019-06-17 12:58:10 +01005345}
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005346
Janos Follath844eb0e2019-06-19 12:10:49 +01005347static psa_status_t psa_key_derivation_tls12_prf_read(
5348 psa_tls12_prf_key_derivation_t *tls12_prf,
5349 psa_algorithm_t alg,
5350 uint8_t *output,
Gilles Peskine449bd832023-01-11 14:50:10 +01005351 size_t output_length)
Janos Follath844eb0e2019-06-19 12:10:49 +01005352{
Gilles Peskine449bd832023-01-11 14:50:10 +01005353 psa_algorithm_t hash_alg = PSA_ALG_TLS12_PRF_GET_HASH(alg);
5354 uint8_t hash_length = PSA_HASH_LENGTH(hash_alg);
Janos Follath844eb0e2019-06-19 12:10:49 +01005355 psa_status_t status;
5356 uint8_t offset, length;
5357
Gilles Peskine449bd832023-01-11 14:50:10 +01005358 switch (tls12_prf->state) {
Gilles Peskineb1edaec2021-06-11 22:41:46 +02005359 case PSA_TLS12_PRF_STATE_LABEL_SET:
5360 tls12_prf->state = PSA_TLS12_PRF_STATE_OUTPUT;
5361 break;
5362 case PSA_TLS12_PRF_STATE_OUTPUT:
5363 break;
5364 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01005365 return PSA_ERROR_BAD_STATE;
Gilles Peskineb1edaec2021-06-11 22:41:46 +02005366 }
5367
Gilles Peskine449bd832023-01-11 14:50:10 +01005368 while (output_length != 0) {
Janos Follath844eb0e2019-06-19 12:10:49 +01005369 /* Check if we have fully processed the current block. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005370 if (tls12_prf->left_in_block == 0) {
5371 status = psa_key_derivation_tls12_prf_generate_next_block(tls12_prf,
5372 alg);
5373 if (status != PSA_SUCCESS) {
5374 return status;
5375 }
Janos Follath844eb0e2019-06-19 12:10:49 +01005376
5377 continue;
5378 }
5379
Gilles Peskine449bd832023-01-11 14:50:10 +01005380 if (tls12_prf->left_in_block > output_length) {
Janos Follath844eb0e2019-06-19 12:10:49 +01005381 length = (uint8_t) output_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01005382 } else {
Janos Follath844eb0e2019-06-19 12:10:49 +01005383 length = tls12_prf->left_in_block;
Gilles Peskine449bd832023-01-11 14:50:10 +01005384 }
Janos Follath844eb0e2019-06-19 12:10:49 +01005385
5386 offset = hash_length - tls12_prf->left_in_block;
Gilles Peskine449bd832023-01-11 14:50:10 +01005387 memcpy(output, tls12_prf->output_block + offset, length);
Janos Follath844eb0e2019-06-19 12:10:49 +01005388 output += length;
5389 output_length -= length;
5390 tls12_prf->left_in_block -= length;
5391 }
5392
Gilles Peskine449bd832023-01-11 14:50:10 +01005393 return PSA_SUCCESS;
Janos Follath844eb0e2019-06-19 12:10:49 +01005394}
John Durkop07cc04a2020-11-16 22:08:34 -08005395#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF ||
5396 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Gilles Peskinebef7f142018-07-12 17:22:21 +02005397
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005398#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
5399static psa_status_t psa_key_derivation_tls12_ecjpake_to_pms_read(
5400 psa_tls12_ecjpake_to_pms_t *ecjpake,
5401 uint8_t *output,
Gilles Peskine449bd832023-01-11 14:50:10 +01005402 size_t output_length)
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005403{
5404 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Andrzej Kurek5603efd2022-09-26 10:49:16 -04005405 size_t output_size = 0;
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005406
Gilles Peskine449bd832023-01-11 14:50:10 +01005407 if (output_length != 32) {
5408 return PSA_ERROR_INVALID_ARGUMENT;
5409 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005410
Gilles Peskine449bd832023-01-11 14:50:10 +01005411 status = psa_hash_compute(PSA_ALG_SHA_256, ecjpake->data,
5412 PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE, output, output_length,
5413 &output_size);
5414 if (status != PSA_SUCCESS) {
5415 return status;
5416 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005417
Gilles Peskine449bd832023-01-11 14:50:10 +01005418 if (output_size != output_length) {
5419 return PSA_ERROR_GENERIC_ERROR;
5420 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005421
Gilles Peskine449bd832023-01-11 14:50:10 +01005422 return PSA_SUCCESS;
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005423}
5424#endif
5425
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05305426#if defined(PSA_HAVE_SOFT_PBKDF2)
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305427static psa_status_t psa_key_derivation_pbkdf2_generate_block(
5428 psa_pbkdf2_key_derivation_t *pbkdf2,
5429 psa_algorithm_t prf_alg,
5430 uint8_t prf_output_length,
5431 psa_key_attributes_t *attributes)
5432{
5433 psa_status_t status;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305434 psa_mac_operation_t mac_operation = PSA_MAC_OPERATION_INIT;
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305435 size_t mac_output_length;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305436 uint8_t U_i[PSA_MAC_MAX_SIZE];
Kusumit Ghoderao257ea002023-06-14 15:55:11 +05305437 uint8_t *U_accumulator = pbkdf2->output_block;
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305438 uint64_t i;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305439 uint8_t block_counter[4];
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305440
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305441 mac_operation.is_sign = 1;
5442 mac_operation.mac_size = prf_output_length;
5443 MBEDTLS_PUT_UINT32_BE(pbkdf2->block_number, block_counter, 0);
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305444
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305445 status = psa_driver_wrapper_mac_sign_setup(&mac_operation,
5446 attributes,
5447 pbkdf2->password,
5448 pbkdf2->password_length,
5449 prf_alg);
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305450 if (status != PSA_SUCCESS) {
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305451 goto cleanup;
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305452 }
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305453 status = psa_mac_update(&mac_operation, pbkdf2->salt, pbkdf2->salt_length);
5454 if (status != PSA_SUCCESS) {
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305455 goto cleanup;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305456 }
Kusumit Ghoderao257ea002023-06-14 15:55:11 +05305457 status = psa_mac_update(&mac_operation, block_counter, sizeof(block_counter));
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305458 if (status != PSA_SUCCESS) {
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305459 goto cleanup;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305460 }
5461 status = psa_mac_sign_finish(&mac_operation, U_i, sizeof(U_i),
5462 &mac_output_length);
5463 if (status != PSA_SUCCESS) {
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305464 goto cleanup;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305465 }
5466
5467 if (mac_output_length != prf_output_length) {
Kusumit Ghoderao257ea002023-06-14 15:55:11 +05305468 status = PSA_ERROR_CORRUPTION_DETECTED;
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305469 goto cleanup;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305470 }
5471
Kusumit Ghoderao257ea002023-06-14 15:55:11 +05305472 memcpy(U_accumulator, U_i, prf_output_length);
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305473
5474 for (i = 1; i < pbkdf2->input_cost; i++) {
Kusumit Ghoderao4536bb62023-06-22 15:42:59 +05305475 /* We are passing prf_output_length as mac_size because the driver
5476 * function directly sets mac_output_length as mac_size upon success.
Kusumit Ghoderao5f3345a2023-07-27 21:21:38 +05305477 * See https://github.com/Mbed-TLS/mbedtls/issues/7801 */
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305478 status = psa_driver_wrapper_mac_compute(attributes,
5479 pbkdf2->password,
5480 pbkdf2->password_length,
5481 prf_alg, U_i, prf_output_length,
Kusumit Ghoderao4536bb62023-06-22 15:42:59 +05305482 U_i, prf_output_length,
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305483 &mac_output_length);
5484 if (status != PSA_SUCCESS) {
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305485 goto cleanup;
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305486 }
5487
Kusumit Ghoderao109ee3d2023-06-08 16:36:45 +05305488 mbedtls_xor(U_accumulator, U_accumulator, U_i, prf_output_length);
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305489 }
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305490
5491cleanup:
5492 /* Zeroise buffers to clear sensitive data from memory. */
5493 mbedtls_platform_zeroize(U_i, PSA_MAC_MAX_SIZE);
5494 return status;
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305495}
Kusumit Ghoderaof6a0d572023-06-05 14:55:56 +05305496
5497static psa_status_t psa_key_derivation_pbkdf2_read(
5498 psa_pbkdf2_key_derivation_t *pbkdf2,
5499 psa_algorithm_t kdf_alg,
5500 uint8_t *output,
5501 size_t output_length)
5502{
5503 psa_status_t status;
5504 psa_algorithm_t prf_alg;
5505 uint8_t prf_output_length;
5506 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
5507 psa_set_key_bits(&attributes, PSA_BYTES_TO_BITS(pbkdf2->password_length));
5508 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_MESSAGE);
5509
5510 if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) {
5511 prf_alg = PSA_ALG_HMAC(PSA_ALG_PBKDF2_HMAC_GET_HASH(kdf_alg));
5512 prf_output_length = PSA_HASH_LENGTH(prf_alg);
5513 psa_set_key_type(&attributes, PSA_KEY_TYPE_HMAC);
Kusumit Ghoderaoa2520a52023-06-22 15:42:19 +05305514 } else if (kdf_alg == PSA_ALG_PBKDF2_AES_CMAC_PRF_128) {
5515 prf_alg = PSA_ALG_CMAC;
Kusumit Ghoderaoa12e2d52023-07-27 21:18:30 +05305516 prf_output_length = PSA_MAC_LENGTH(PSA_KEY_TYPE_AES, 128U, PSA_ALG_CMAC);
Kusumit Ghoderaoa2520a52023-06-22 15:42:19 +05305517 psa_set_key_type(&attributes, PSA_KEY_TYPE_AES);
Kusumit Ghoderaod9ec1af2023-06-08 20:19:51 +05305518 } else {
5519 return PSA_ERROR_INVALID_ARGUMENT;
Kusumit Ghoderaof6a0d572023-06-05 14:55:56 +05305520 }
5521
5522 switch (pbkdf2->state) {
5523 case PSA_PBKDF2_STATE_PASSWORD_SET:
5524 /* Initially we need a new block so bytes_used is equal to block size*/
5525 pbkdf2->bytes_used = prf_output_length;
5526 pbkdf2->state = PSA_PBKDF2_STATE_OUTPUT;
5527 break;
5528 case PSA_PBKDF2_STATE_OUTPUT:
5529 break;
5530 default:
5531 return PSA_ERROR_BAD_STATE;
5532 }
5533
5534 while (output_length != 0) {
5535 uint8_t n = prf_output_length - pbkdf2->bytes_used;
5536 if (n > output_length) {
5537 n = (uint8_t) output_length;
5538 }
5539 memcpy(output, pbkdf2->output_block + pbkdf2->bytes_used, n);
5540 output += n;
5541 output_length -= n;
5542 pbkdf2->bytes_used += n;
5543
5544 if (output_length == 0) {
5545 break;
5546 }
5547
5548 /* We need a new block */
5549 pbkdf2->bytes_used = 0;
5550 pbkdf2->block_number++;
5551
5552 status = psa_key_derivation_pbkdf2_generate_block(pbkdf2, prf_alg,
5553 prf_output_length,
5554 &attributes);
5555 if (status != PSA_SUCCESS) {
5556 return status;
5557 }
5558 }
5559
5560 return PSA_SUCCESS;
5561}
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05305562#endif /* PSA_HAVE_SOFT_PBKDF2 */
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305563
Janos Follath6c6c8fc2019-06-17 12:38:20 +01005564psa_status_t psa_key_derivation_output_bytes(
5565 psa_key_derivation_operation_t *operation,
5566 uint8_t *output,
Gilles Peskine449bd832023-01-11 14:50:10 +01005567 size_t output_length)
Gilles Peskineeab56e42018-07-12 17:12:33 +02005568{
5569 psa_status_t status;
Gilles Peskine449bd832023-01-11 14:50:10 +01005570 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation);
Gilles Peskineeab56e42018-07-12 17:12:33 +02005571
Gilles Peskine449bd832023-01-11 14:50:10 +01005572 if (operation->alg == 0) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005573 /* This is a blank operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005574 return PSA_ERROR_BAD_STATE;
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005575 }
5576
Gilles Peskine449bd832023-01-11 14:50:10 +01005577 if (output_length > operation->capacity) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005578 operation->capacity = 0;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005579 /* Go through the error path to wipe all confidential data now
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005580 * that the operation object is useless. */
David Saadab4ecc272019-02-14 13:48:10 +02005581 status = PSA_ERROR_INSUFFICIENT_DATA;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005582 goto exit;
5583 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005584 if (output_length == 0 && operation->capacity == 0) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005585 /* Edge case: this is a finished operation, and 0 bytes
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005586 * were requested. The right error in this case could
Gilles Peskineeab56e42018-07-12 17:12:33 +02005587 * be either INSUFFICIENT_CAPACITY or BAD_STATE. Return
5588 * INSUFFICIENT_CAPACITY, which is right for a finished
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005589 * operation, for consistency with the case when
Gilles Peskineeab56e42018-07-12 17:12:33 +02005590 * output_length > 0. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005591 return PSA_ERROR_INSUFFICIENT_DATA;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005592 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005593 operation->capacity -= output_length;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005594
Przemek Stekiel69c46792022-06-10 12:59:51 +02005595#if defined(BUILTIN_ALG_ANY_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01005596 if (PSA_ALG_IS_ANY_HKDF(kdf_alg)) {
5597 status = psa_key_derivation_hkdf_read(&operation->ctx.hkdf, kdf_alg,
5598 output, output_length);
5599 } else
Przemek Stekiel69c46792022-06-10 12:59:51 +02005600#endif /* BUILTIN_ALG_ANY_HKDF */
John Durkop07cc04a2020-11-16 22:08:34 -08005601#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
5602 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005603 if (PSA_ALG_IS_TLS12_PRF(kdf_alg) ||
5604 PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
5605 status = psa_key_derivation_tls12_prf_read(&operation->ctx.tls12_prf,
5606 kdf_alg, output,
5607 output_length);
5608 } else
John Durkop07cc04a2020-11-16 22:08:34 -08005609#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF ||
5610 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005611#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005612 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005613 status = psa_key_derivation_tls12_ecjpake_to_pms_read(
Gilles Peskine449bd832023-01-11 14:50:10 +01005614 &operation->ctx.tls12_ecjpake_to_pms, output, output_length);
5615 } else
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005616#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05305617#if defined(PSA_HAVE_SOFT_PBKDF2)
Kusumit Ghoderao9ab03c32023-07-27 21:14:05 +05305618 if (PSA_ALG_IS_PBKDF2(kdf_alg)) {
Kusumit Ghoderaof6a0d572023-06-05 14:55:56 +05305619 status = psa_key_derivation_pbkdf2_read(&operation->ctx.pbkdf2, kdf_alg,
5620 output, output_length);
Kusumit Ghoderao056f0c52023-05-03 15:58:34 +05305621 } else
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05305622#endif /* PSA_HAVE_SOFT_PBKDF2 */
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005623
Gilles Peskineeab56e42018-07-12 17:12:33 +02005624 {
Steven Cooreman74afe472021-02-10 17:19:22 +01005625 (void) kdf_alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01005626 return PSA_ERROR_BAD_STATE;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005627 }
5628
5629exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01005630 if (status != PSA_SUCCESS) {
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005631 /* Preserve the algorithm upon errors, but clear all sensitive state.
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005632 * This allows us to differentiate between exhausted operations and
5633 * blank operations, so we can return PSA_ERROR_BAD_STATE on blank
5634 * operations. */
5635 psa_algorithm_t alg = operation->alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01005636 psa_key_derivation_abort(operation);
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005637 operation->alg = alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01005638 memset(output, '!', output_length);
Gilles Peskineeab56e42018-07-12 17:12:33 +02005639 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005640 return status;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005641}
5642
David Brown7807bf72021-02-09 16:28:23 -07005643#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Gilles Peskine449bd832023-01-11 14:50:10 +01005644static void psa_des_set_key_parity(uint8_t *data, size_t data_size)
Gilles Peskine08542d82018-07-19 17:05:42 +02005645{
Gilles Peskine449bd832023-01-11 14:50:10 +01005646 if (data_size >= 8) {
5647 mbedtls_des_key_set_parity(data);
5648 }
5649 if (data_size >= 16) {
5650 mbedtls_des_key_set_parity(data + 8);
5651 }
5652 if (data_size >= 24) {
5653 mbedtls_des_key_set_parity(data + 16);
5654 }
Gilles Peskine08542d82018-07-19 17:05:42 +02005655}
David Brown7807bf72021-02-09 16:28:23 -07005656#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */
Gilles Peskine08542d82018-07-19 17:05:42 +02005657
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005658/*
Gilles Peskine449bd832023-01-11 14:50:10 +01005659 * ECC keys on a Weierstrass elliptic curve require the generation
5660 * of a private key which is an integer
5661 * in the range [1, N - 1], where N is the boundary of the private key domain:
5662 * N is the prime p for Diffie-Hellman, or the order of the
5663 * curve’s base point for ECC.
5664 *
5665 * Let m be the bit size of N, such that 2^m > N >= 2^(m-1).
5666 * This function generates the private key using the following process:
5667 *
5668 * 1. Draw a byte string of length ceiling(m/8) bytes.
5669 * 2. If m is not a multiple of 8, set the most significant
5670 * (8 * ceiling(m/8) - m) bits of the first byte in the string to zero.
5671 * 3. Convert the string to integer k by decoding it as a big-endian byte string.
5672 * 4. If k > N - 2, discard the result and return to step 1.
5673 * 5. Output k + 1 as the private key.
5674 *
5675 * This method allows compliance to NIST standards, specifically the methods titled
5676 * Key-Pair Generation by Testing Candidates in the following publications:
5677 * - NIST Special Publication 800-56A: Recommendation for Pair-Wise Key-Establishment
5678 * Schemes Using Discrete Logarithm Cryptography [SP800-56A] §5.6.1.1.4 for
5679 * Diffie-Hellman keys.
5680 *
5681 * - [SP800-56A] §5.6.1.2.2 or FIPS Publication 186-4: Digital Signature
5682 * Standard (DSS) [FIPS186-4] §B.4.2 for elliptic curve keys.
5683 *
5684 * Note: Function allocates memory for *data buffer, so given *data should be
5685 * always NULL.
5686 */
Valerio Setti86587ab2023-06-27 13:09:30 +02005687#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE)
5688#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE)
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01005689static psa_status_t psa_generate_derived_ecc_key_weierstrass_helper(
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005690 psa_key_slot_t *slot,
5691 size_t bits,
5692 psa_key_derivation_operation_t *operation,
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005693 uint8_t **data
5694 )
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005695{
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005696 unsigned key_out_of_range = 1;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005697 mbedtls_mpi k;
5698 mbedtls_mpi diff_N_2;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005699 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Przemek Stekiela81aed22022-03-01 15:13:30 +01005700 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01005701 size_t m;
5702 size_t m_bytes;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005703
Gilles Peskine449bd832023-01-11 14:50:10 +01005704 mbedtls_mpi_init(&k);
5705 mbedtls_mpi_init(&diff_N_2);
Przemyslaw Stekiel1dfd1222021-11-18 13:35:00 +01005706
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005707 psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY(
Gilles Peskine449bd832023-01-11 14:50:10 +01005708 slot->attr.type);
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005709 mbedtls_ecp_group_id grp_id =
Gilles Peskine449bd832023-01-11 14:50:10 +01005710 mbedtls_ecc_group_of_psa(curve, bits, 0);
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005711
Gilles Peskine449bd832023-01-11 14:50:10 +01005712 if (grp_id == MBEDTLS_ECP_DP_NONE) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005713 ret = MBEDTLS_ERR_ASN1_INVALID_DATA;
Przemyslaw Stekiel871a3362021-12-02 08:46:39 +01005714 goto cleanup;
5715 }
5716
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005717 mbedtls_ecp_group ecp_group;
Gilles Peskine449bd832023-01-11 14:50:10 +01005718 mbedtls_ecp_group_init(&ecp_group);
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005719
Gilles Peskine449bd832023-01-11 14:50:10 +01005720 MBEDTLS_MPI_CHK(mbedtls_ecp_group_load(&ecp_group, grp_id));
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005721
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005722 /* N is the boundary of the private key domain (ecp_group.N). */
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005723 /* Let m be the bit size of N. */
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01005724 m = ecp_group.nbits;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005725
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01005726 m_bytes = PSA_BITS_TO_BYTES(m);
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005727
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005728 /* Calculate N - 2 - it will be needed later. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005729 MBEDTLS_MPI_CHK(mbedtls_mpi_sub_int(&diff_N_2, &ecp_group.N, 2));
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005730
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005731 /* Note: This function is always called with *data == NULL and it
5732 * allocates memory for the data buffer. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005733 *data = mbedtls_calloc(1, m_bytes);
5734 if (*data == NULL) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005735 ret = MBEDTLS_ERR_ASN1_ALLOC_FAILED;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005736 goto cleanup;
5737 }
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005738
Gilles Peskine449bd832023-01-11 14:50:10 +01005739 while (key_out_of_range) {
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005740 /* 1. Draw a byte string of length ceiling(m/8) bytes. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005741 if ((status = psa_key_derivation_output_bytes(operation, *data, m_bytes)) != 0) {
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005742 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005743 }
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005744
5745 /* 2. If m is not a multiple of 8 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005746 if (m % 8 != 0) {
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005747 /* Set the most significant
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005748 * (8 * ceiling(m/8) - m) bits of the first byte in
5749 * the string to zero.
5750 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005751 uint8_t clear_bit_mask = (1 << (m % 8)) - 1;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005752 (*data)[0] &= clear_bit_mask;
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005753 }
5754
5755 /* 3. Convert the string to integer k by decoding it as a
Gilles Peskine449bd832023-01-11 14:50:10 +01005756 * big-endian byte string.
5757 */
5758 MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(&k, *data, m_bytes));
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005759
5760 /* 4. If k > N - 2, discard the result and return to step 1.
Gilles Peskine449bd832023-01-11 14:50:10 +01005761 * Result of comparison is returned. When it indicates error
5762 * then this function is called again.
5763 */
5764 MBEDTLS_MPI_CHK(mbedtls_mpi_lt_mpi_ct(&diff_N_2, &k, &key_out_of_range));
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005765 }
5766
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005767 /* 5. Output k + 1 as the private key. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005768 MBEDTLS_MPI_CHK(mbedtls_mpi_add_int(&k, &k, 1));
5769 MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(&k, *data, m_bytes));
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005770cleanup:
Gilles Peskine449bd832023-01-11 14:50:10 +01005771 if (ret != 0) {
5772 status = mbedtls_to_psa_error(ret);
5773 }
5774 if (status != PSA_SUCCESS) {
5775 mbedtls_free(*data);
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005776 *data = NULL;
5777 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005778 mbedtls_mpi_free(&k);
5779 mbedtls_mpi_free(&diff_N_2);
5780 return status;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005781}
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005782
5783/* ECC keys on a Montgomery elliptic curve draws a byte string whose length
5784 * is determined by the curve, and sets the mandatory bits accordingly. That is:
5785 *
5786 * - Curve25519 (PSA_ECC_FAMILY_MONTGOMERY, 255 bits):
5787 * draw a 32-byte string and process it as specified in
5788 * Elliptic Curves for Security [RFC7748] §5.
5789 *
5790 * - Curve448 (PSA_ECC_FAMILY_MONTGOMERY, 448 bits):
5791 * draw a 56-byte string and process it as specified in [RFC7748] §5.
5792 *
5793 * Note: Function allocates memory for *data buffer, so given *data should be
5794 * always NULL.
5795 */
5796
5797static psa_status_t psa_generate_derived_ecc_key_montgomery_helper(
5798 size_t bits,
5799 psa_key_derivation_operation_t *operation,
5800 uint8_t **data
5801 )
5802{
5803 size_t output_length;
Przemek Stekiela81aed22022-03-01 15:13:30 +01005804 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005805
Gilles Peskine449bd832023-01-11 14:50:10 +01005806 switch (bits) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005807 case 255:
5808 output_length = 32;
5809 break;
5810 case 448:
5811 output_length = 56;
5812 break;
5813 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01005814 return PSA_ERROR_INVALID_ARGUMENT;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005815 break;
5816 }
5817
Gilles Peskine449bd832023-01-11 14:50:10 +01005818 *data = mbedtls_calloc(1, output_length);
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005819
Gilles Peskine449bd832023-01-11 14:50:10 +01005820 if (*data == NULL) {
5821 return PSA_ERROR_INSUFFICIENT_MEMORY;
5822 }
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005823
Gilles Peskine449bd832023-01-11 14:50:10 +01005824 status = psa_key_derivation_output_bytes(operation, *data, output_length);
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005825
Gilles Peskine449bd832023-01-11 14:50:10 +01005826 if (status != PSA_SUCCESS) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005827 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01005828 }
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005829
Gilles Peskine449bd832023-01-11 14:50:10 +01005830 switch (bits) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005831 case 255:
5832 (*data)[0] &= 248;
5833 (*data)[31] &= 127;
5834 (*data)[31] |= 64;
5835 break;
5836 case 448:
5837 (*data)[0] &= 252;
5838 (*data)[55] |= 128;
5839 break;
5840 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01005841 return PSA_ERROR_CORRUPTION_DETECTED;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005842 break;
5843 }
5844
5845 return status;
5846}
Valerio Setti86587ab2023-06-27 13:09:30 +02005847#else /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE */
5848static psa_status_t psa_generate_derived_ecc_key_weierstrass_helper(
5849 psa_key_slot_t *slot, size_t bits,
5850 psa_key_derivation_operation_t *operation, uint8_t **data)
5851{
5852 (void) slot;
5853 (void) bits;
5854 (void) operation;
5855 (void) data;
5856 return PSA_ERROR_NOT_SUPPORTED;
5857}
5858
5859static psa_status_t psa_generate_derived_ecc_key_montgomery_helper(
5860 size_t bits, psa_key_derivation_operation_t *operation, uint8_t **data)
5861{
5862 (void) bits;
5863 (void) operation;
5864 (void) data;
5865 return PSA_ERROR_NOT_SUPPORTED;
5866}
5867#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE */
5868#endif /* PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE */
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005869
Adrian L. Shaw5a5a79a2019-05-03 15:44:28 +01005870static psa_status_t psa_generate_derived_key_internal(
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005871 psa_key_slot_t *slot,
5872 size_t bits,
Gilles Peskine449bd832023-01-11 14:50:10 +01005873 psa_key_derivation_operation_t *operation)
Gilles Peskineeab56e42018-07-12 17:12:33 +02005874{
5875 uint8_t *data = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01005876 size_t bytes = PSA_BITS_TO_BYTES(bits);
Archanad8a83dc2021-06-14 10:04:16 +05305877 size_t storage_size = bytes;
Przemek Stekiela81aed22022-03-01 15:13:30 +01005878 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01005879 psa_key_attributes_t attributes;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005880
Gilles Peskine449bd832023-01-11 14:50:10 +01005881 if (PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type)) {
5882 return PSA_ERROR_INVALID_ARGUMENT;
5883 }
Gilles Peskineeab56e42018-07-12 17:12:33 +02005884
Valerio Setti8ffdb5d2023-06-20 13:14:08 +02005885#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE) || \
Valerio Settidd24f292023-06-26 12:21:17 +02005886 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE)
Gilles Peskine449bd832023-01-11 14:50:10 +01005887 if (PSA_KEY_TYPE_IS_ECC(slot->attr.type)) {
5888 psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY(slot->attr.type);
5889 if (PSA_ECC_FAMILY_IS_WEIERSTRASS(curve)) {
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01005890 /* Weierstrass elliptic curve */
Gilles Peskine449bd832023-01-11 14:50:10 +01005891 status = psa_generate_derived_ecc_key_weierstrass_helper(slot, bits, operation, &data);
5892 if (status != PSA_SUCCESS) {
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005893 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005894 }
5895 } else {
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01005896 /* Montgomery elliptic curve */
Gilles Peskine449bd832023-01-11 14:50:10 +01005897 status = psa_generate_derived_ecc_key_montgomery_helper(bits, operation, &data);
5898 if (status != PSA_SUCCESS) {
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01005899 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005900 }
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01005901 }
Przemyslaw Stekiel1dfd1222021-11-18 13:35:00 +01005902 } else
Valerio Setti8ffdb5d2023-06-20 13:14:08 +02005903#endif /* defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE) ||
Valerio Settidd24f292023-06-26 12:21:17 +02005904 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE) */
Gilles Peskine449bd832023-01-11 14:50:10 +01005905 if (key_type_is_raw_bytes(slot->attr.type)) {
5906 if (bits % 8 != 0) {
5907 return PSA_ERROR_INVALID_ARGUMENT;
5908 }
5909 data = mbedtls_calloc(1, bytes);
5910 if (data == NULL) {
5911 return PSA_ERROR_INSUFFICIENT_MEMORY;
5912 }
Przemyslaw Stekiel1608e332021-11-09 10:46:40 +01005913
Gilles Peskine449bd832023-01-11 14:50:10 +01005914 status = psa_key_derivation_output_bytes(operation, data, bytes);
5915 if (status != PSA_SUCCESS) {
Przemyslaw Stekiel1608e332021-11-09 10:46:40 +01005916 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005917 }
David Brown12ca5032021-02-11 11:02:00 -07005918#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Gilles Peskine449bd832023-01-11 14:50:10 +01005919 if (slot->attr.type == PSA_KEY_TYPE_DES) {
5920 psa_des_set_key_parity(data, bytes);
5921 }
Przemek Stekielf110dc02022-03-01 14:48:05 +01005922#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES) */
Gilles Peskine449bd832023-01-11 14:50:10 +01005923 } else {
5924 return PSA_ERROR_NOT_SUPPORTED;
Przemyslaw Stekiel1608e332021-11-09 10:46:40 +01005925 }
Ronald Crondd04d422020-11-28 15:14:42 +01005926
Ronald Cronbf33c932020-11-28 18:06:53 +01005927 slot->attr.bits = (psa_key_bits_t) bits;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01005928 attributes = (psa_key_attributes_t) {
Gilles Peskine449bd832023-01-11 14:50:10 +01005929 .core = slot->attr
Ronald Cron2ebfdcc2020-11-28 15:54:54 +01005930 };
5931
Gilles Peskine449bd832023-01-11 14:50:10 +01005932 if (psa_key_lifetime_is_external(attributes.core.lifetime)) {
5933 status = psa_driver_wrapper_get_key_buffer_size(&attributes,
5934 &storage_size);
5935 if (status != PSA_SUCCESS) {
Archanad8a83dc2021-06-14 10:04:16 +05305936 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005937 }
Archanad8a83dc2021-06-14 10:04:16 +05305938 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005939 status = psa_allocate_buffer_to_slot(slot, storage_size);
5940 if (status != PSA_SUCCESS) {
Archanad8a83dc2021-06-14 10:04:16 +05305941 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005942 }
Archanad8a83dc2021-06-14 10:04:16 +05305943
Gilles Peskine449bd832023-01-11 14:50:10 +01005944 status = psa_driver_wrapper_import_key(&attributes,
5945 data, bytes,
5946 slot->key.data,
5947 slot->key.bytes,
5948 &slot->key.bytes, &bits);
5949 if (bits != slot->attr.bits) {
Ronald Cronbf33c932020-11-28 18:06:53 +01005950 status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine449bd832023-01-11 14:50:10 +01005951 }
Gilles Peskineeab56e42018-07-12 17:12:33 +02005952
5953exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01005954 mbedtls_free(data);
5955 return status;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005956}
5957
Gilles Peskine449bd832023-01-11 14:50:10 +01005958psa_status_t psa_key_derivation_output_key(const psa_key_attributes_t *attributes,
5959 psa_key_derivation_operation_t *operation,
5960 mbedtls_svc_key_id_t *key)
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005961{
5962 psa_status_t status;
5963 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02005964 psa_se_drv_table_entry_t *driver = NULL;
Gilles Peskine0f84d622019-09-12 19:03:13 +02005965
Ronald Cron81709fc2020-11-14 12:10:32 +01005966 *key = MBEDTLS_SVC_KEY_ID_INIT;
5967
Gilles Peskine0f84d622019-09-12 19:03:13 +02005968 /* Reject any attempt to create a zero-length key so that we don't
5969 * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005970 if (psa_get_key_bits(attributes) == 0) {
5971 return PSA_ERROR_INVALID_ARGUMENT;
5972 }
Gilles Peskine0f84d622019-09-12 19:03:13 +02005973
Gilles Peskine449bd832023-01-11 14:50:10 +01005974 if (operation->alg == PSA_ALG_NONE) {
5975 return PSA_ERROR_BAD_STATE;
5976 }
Dave Rodgmand69da6c2021-11-16 10:32:48 +00005977
Gilles Peskine449bd832023-01-11 14:50:10 +01005978 if (!operation->can_output_key) {
5979 return PSA_ERROR_NOT_PERMITTED;
5980 }
Gilles Peskine178c9aa2019-09-24 18:21:06 +02005981
Gilles Peskine449bd832023-01-11 14:50:10 +01005982 status = psa_start_key_creation(PSA_KEY_CREATION_DERIVE, attributes,
5983 &slot, &driver);
Gilles Peskinef4ee6622019-07-24 13:44:30 +02005984#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005985 if (driver != NULL) {
Gilles Peskinef4ee6622019-07-24 13:44:30 +02005986 /* Deriving a key in a secure element is not implemented yet. */
5987 status = PSA_ERROR_NOT_SUPPORTED;
5988 }
5989#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskine449bd832023-01-11 14:50:10 +01005990 if (status == PSA_SUCCESS) {
5991 status = psa_generate_derived_key_internal(slot,
5992 attributes->core.bits,
5993 operation);
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005994 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005995 if (status == PSA_SUCCESS) {
5996 status = psa_finish_key_creation(slot, driver, key);
5997 }
5998 if (status != PSA_SUCCESS) {
5999 psa_fail_key_creation(slot, driver);
6000 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02006001
Gilles Peskine449bd832023-01-11 14:50:10 +01006002 return status;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006003}
6004
Gilles Peskineeab56e42018-07-12 17:12:33 +02006005
6006
6007/****************************************************************/
Gilles Peskineea0fb492018-07-12 17:17:20 +02006008/* Key derivation */
6009/****************************************************************/
6010
Steven Cooreman932ffb72021-02-15 12:14:32 +01006011#if defined(AT_LEAST_ONE_BUILTIN_KDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006012static int is_kdf_alg_supported(psa_algorithm_t kdf_alg)
Gilles Peskine9efde4f2021-04-29 21:10:00 +02006013{
6014#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006015 if (PSA_ALG_IS_HKDF(kdf_alg)) {
6016 return 1;
6017 }
Gilles Peskine9efde4f2021-04-29 21:10:00 +02006018#endif
Przemek Stekielb57a44b2022-06-06 08:33:45 +02006019#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01006020 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
6021 return 1;
6022 }
Przemek Stekielb57a44b2022-06-06 08:33:45 +02006023#endif
6024#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Gilles Peskine449bd832023-01-11 14:50:10 +01006025 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) {
6026 return 1;
6027 }
Gilles Peskine9efde4f2021-04-29 21:10:00 +02006028#endif
6029#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006030 if (PSA_ALG_IS_TLS12_PRF(kdf_alg)) {
6031 return 1;
6032 }
Gilles Peskine9efde4f2021-04-29 21:10:00 +02006033#endif
6034#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006035 if (PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
6036 return 1;
6037 }
Gilles Peskine9efde4f2021-04-29 21:10:00 +02006038#endif
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006039#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006040 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
6041 return 1;
6042 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006043#endif
Kusumit Ghoderaod132cac2023-05-03 12:00:27 +05306044#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC)
6045 if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) {
6046 return 1;
6047 }
6048#endif
Kusumit Ghoderao2cd64962023-06-22 15:38:57 +05306049#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_AES_CMAC_PRF_128)
6050 if (kdf_alg == PSA_ALG_PBKDF2_AES_CMAC_PRF_128) {
6051 return 1;
6052 }
6053#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01006054 return 0;
Gilles Peskine9efde4f2021-04-29 21:10:00 +02006055}
6056
Gilles Peskine449bd832023-01-11 14:50:10 +01006057static psa_status_t psa_hash_try_support(psa_algorithm_t alg)
Gilles Peskine0cc417d2021-04-29 21:18:14 +02006058{
6059 psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT;
Gilles Peskine449bd832023-01-11 14:50:10 +01006060 psa_status_t status = psa_hash_setup(&operation, alg);
6061 psa_hash_abort(&operation);
6062 return status;
Gilles Peskine0cc417d2021-04-29 21:18:14 +02006063}
6064
Gilles Peskine969c5d62019-01-16 15:53:06 +01006065static psa_status_t psa_key_derivation_setup_kdf(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006066 psa_key_derivation_operation_t *operation,
Gilles Peskine449bd832023-01-11 14:50:10 +01006067 psa_algorithm_t kdf_alg)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006068{
Janos Follath5fe19732019-06-20 15:09:30 +01006069 /* Make sure that operation->ctx is properly zero-initialised. (Macro
6070 * initialisers for this union leave some bytes unspecified.) */
Gilles Peskine449bd832023-01-11 14:50:10 +01006071 memset(&operation->ctx, 0, sizeof(operation->ctx));
Janos Follath5fe19732019-06-20 15:09:30 +01006072
Gilles Peskine969c5d62019-01-16 15:53:06 +01006073 /* Make sure that kdf_alg is a supported key derivation algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006074 if (!is_kdf_alg_supported(kdf_alg)) {
6075 return PSA_ERROR_NOT_SUPPORTED;
6076 }
John Durkop07cc04a2020-11-16 22:08:34 -08006077
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006078 /* All currently supported key derivation algorithms (apart from
Kusumit Ghoderao2cd64962023-06-22 15:38:57 +05306079 * ecjpake to pms and pbkdf2_aes_cmac_128) are based on a hash algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006080 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(kdf_alg);
6081 size_t hash_size = PSA_HASH_LENGTH(hash_alg);
Kusumit Ghoderao2cd64962023-06-22 15:38:57 +05306082 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
6083 hash_size = PSA_HASH_LENGTH(PSA_ALG_SHA_256);
6084 } else if (kdf_alg == PSA_ALG_PBKDF2_AES_CMAC_PRF_128) {
Kusumit Ghoderaoa12e2d52023-07-27 21:18:30 +05306085 hash_size = PSA_MAC_LENGTH(PSA_KEY_TYPE_AES, 128U, PSA_ALG_CMAC);
Kusumit Ghoderao2cd64962023-06-22 15:38:57 +05306086 } else {
Gilles Peskine449bd832023-01-11 14:50:10 +01006087 if (hash_size == 0) {
6088 return PSA_ERROR_NOT_SUPPORTED;
6089 }
Gilles Peskine0cc417d2021-04-29 21:18:14 +02006090
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006091 /* Make sure that hash_alg is a supported hash algorithm. Otherwise
6092 * we might fail later, which is somewhat unfriendly and potentially
6093 * risk-prone. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006094 psa_status_t status = psa_hash_try_support(hash_alg);
6095 if (status != PSA_SUCCESS) {
6096 return status;
6097 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006098 }
Gilles Peskine0cc417d2021-04-29 21:18:14 +02006099
Gilles Peskine449bd832023-01-11 14:50:10 +01006100 if ((PSA_ALG_IS_TLS12_PRF(kdf_alg) ||
6101 PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) &&
6102 !(hash_alg == PSA_ALG_SHA_256 || hash_alg == PSA_ALG_SHA_384)) {
6103 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006104 }
Andrzej Kurek77638292022-09-16 12:24:52 -04006105#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) || \
Andrzej Kurekb510cd22022-09-26 10:50:22 -04006106 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006107 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg) ||
6108 (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS)) {
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006109 operation->capacity = hash_size;
Gilles Peskine449bd832023-01-11 14:50:10 +01006110 } else
Andrzej Kurekb510cd22022-09-26 10:50:22 -04006111#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT ||
6112 MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */
Gilles Peskine449bd832023-01-11 14:50:10 +01006113 operation->capacity = 255 * hash_size;
6114 return PSA_SUCCESS;
Gilles Peskine969c5d62019-01-16 15:53:06 +01006115}
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006116
Gilles Peskine449bd832023-01-11 14:50:10 +01006117static psa_status_t psa_key_agreement_try_support(psa_algorithm_t alg)
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006118{
6119#if defined(PSA_WANT_ALG_ECDH)
Gilles Peskine449bd832023-01-11 14:50:10 +01006120 if (alg == PSA_ALG_ECDH) {
6121 return PSA_SUCCESS;
6122 }
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006123#endif
Przemek Stekielfb3dd542022-12-01 14:59:15 +01006124#if defined(PSA_WANT_ALG_FFDH)
6125 if (alg == PSA_ALG_FFDH) {
6126 return PSA_SUCCESS;
6127 }
6128#endif
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006129 (void) alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01006130 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006131}
Gilles Peskinebb3814c2022-12-16 01:12:12 +01006132
6133static int psa_key_derivation_allows_free_form_secret_input(
6134 psa_algorithm_t kdf_alg)
6135{
6136#if defined(PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS)
6137 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
6138 return 0;
6139 }
6140#endif
6141 (void) kdf_alg;
6142 return 1;
6143}
John Durkop07cc04a2020-11-16 22:08:34 -08006144#endif /* AT_LEAST_ONE_BUILTIN_KDF */
Gilles Peskine969c5d62019-01-16 15:53:06 +01006145
Gilles Peskine449bd832023-01-11 14:50:10 +01006146psa_status_t psa_key_derivation_setup(psa_key_derivation_operation_t *operation,
6147 psa_algorithm_t alg)
Gilles Peskine969c5d62019-01-16 15:53:06 +01006148{
6149 psa_status_t status;
6150
Gilles Peskine449bd832023-01-11 14:50:10 +01006151 if (operation->alg != 0) {
6152 return PSA_ERROR_BAD_STATE;
Gilles Peskine969c5d62019-01-16 15:53:06 +01006153 }
Gilles Peskine969c5d62019-01-16 15:53:06 +01006154
Gilles Peskine449bd832023-01-11 14:50:10 +01006155 if (PSA_ALG_IS_RAW_KEY_AGREEMENT(alg)) {
6156 return PSA_ERROR_INVALID_ARGUMENT;
6157 } else if (PSA_ALG_IS_KEY_AGREEMENT(alg)) {
6158#if defined(AT_LEAST_ONE_BUILTIN_KDF)
6159 psa_algorithm_t kdf_alg = PSA_ALG_KEY_AGREEMENT_GET_KDF(alg);
6160 psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE(alg);
6161 status = psa_key_agreement_try_support(ka_alg);
6162 if (status != PSA_SUCCESS) {
6163 return status;
6164 }
Gilles Peskinebb3814c2022-12-16 01:12:12 +01006165 if (!psa_key_derivation_allows_free_form_secret_input(kdf_alg)) {
6166 return PSA_ERROR_INVALID_ARGUMENT;
6167 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006168 status = psa_key_derivation_setup_kdf(operation, kdf_alg);
6169#else
6170 return PSA_ERROR_NOT_SUPPORTED;
6171#endif /* AT_LEAST_ONE_BUILTIN_KDF */
6172 } else if (PSA_ALG_IS_KEY_DERIVATION(alg)) {
6173#if defined(AT_LEAST_ONE_BUILTIN_KDF)
6174 status = psa_key_derivation_setup_kdf(operation, alg);
6175#else
6176 return PSA_ERROR_NOT_SUPPORTED;
6177#endif /* AT_LEAST_ONE_BUILTIN_KDF */
6178 } else {
6179 return PSA_ERROR_INVALID_ARGUMENT;
6180 }
6181
6182 if (status == PSA_SUCCESS) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006183 operation->alg = alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01006184 }
6185 return status;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006186}
6187
Przemek Stekiel69c46792022-06-10 12:59:51 +02006188#if defined(BUILTIN_ALG_ANY_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006189static psa_status_t psa_hkdf_input(psa_hkdf_key_derivation_t *hkdf,
6190 psa_algorithm_t kdf_alg,
6191 psa_key_derivation_step_t step,
6192 const uint8_t *data,
6193 size_t data_length)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006194{
Gilles Peskine449bd832023-01-11 14:50:10 +01006195 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(kdf_alg);
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006196 psa_status_t status;
Gilles Peskine449bd832023-01-11 14:50:10 +01006197 switch (step) {
Gilles Peskine03410b52019-05-16 16:05:19 +02006198 case PSA_KEY_DERIVATION_INPUT_SALT:
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006199#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Gilles Peskine449bd832023-01-11 14:50:10 +01006200 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) {
6201 return PSA_ERROR_INVALID_ARGUMENT;
6202 }
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006203#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND */
Gilles Peskine449bd832023-01-11 14:50:10 +01006204 if (hkdf->state != HKDF_STATE_INIT) {
6205 return PSA_ERROR_BAD_STATE;
6206 } else {
6207 status = psa_key_derivation_start_hmac(&hkdf->hmac,
6208 hash_alg,
6209 data, data_length);
6210 if (status != PSA_SUCCESS) {
6211 return status;
6212 }
Steven Cooremand1ed1d92021-04-29 19:11:25 +02006213 hkdf->state = HKDF_STATE_STARTED;
Gilles Peskine449bd832023-01-11 14:50:10 +01006214 return PSA_SUCCESS;
Steven Cooremand1ed1d92021-04-29 19:11:25 +02006215 }
Gilles Peskine03410b52019-05-16 16:05:19 +02006216 case PSA_KEY_DERIVATION_INPUT_SECRET:
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006217#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Gilles Peskine449bd832023-01-11 14:50:10 +01006218 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) {
Przemek Stekiel2fb0dcd2022-05-19 10:34:37 +02006219 /* We shouldn't be in different state as HKDF_EXPAND only allows
6220 * two inputs: SECRET (this case) and INFO which does not modify
6221 * the state. It could happen only if the hkdf
6222 * object was corrupted. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006223 if (hkdf->state != HKDF_STATE_INIT) {
6224 return PSA_ERROR_BAD_STATE;
6225 }
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006226
Przemek Stekiel2fb0dcd2022-05-19 10:34:37 +02006227 /* Allow only input that fits expected prk size */
Gilles Peskine449bd832023-01-11 14:50:10 +01006228 if (data_length != PSA_HASH_LENGTH(hash_alg)) {
6229 return PSA_ERROR_INVALID_ARGUMENT;
6230 }
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006231
Gilles Peskine449bd832023-01-11 14:50:10 +01006232 memcpy(hkdf->prk, data, data_length);
6233 } else
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006234#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND */
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006235 {
Przemek Stekiel0586f4c2022-06-03 16:00:25 +02006236 /* HKDF: If no salt was provided, use an empty salt.
6237 * HKDF-EXTRACT: salt is mandatory. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006238 if (hkdf->state == HKDF_STATE_INIT) {
Przemek Stekiel0586f4c2022-06-03 16:00:25 +02006239#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01006240 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
6241 return PSA_ERROR_BAD_STATE;
6242 }
Przemek Stekiel0586f4c2022-06-03 16:00:25 +02006243#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Gilles Peskine449bd832023-01-11 14:50:10 +01006244 status = psa_key_derivation_start_hmac(&hkdf->hmac,
6245 hash_alg,
6246 NULL, 0);
6247 if (status != PSA_SUCCESS) {
6248 return status;
6249 }
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006250 hkdf->state = HKDF_STATE_STARTED;
6251 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006252 if (hkdf->state != HKDF_STATE_STARTED) {
6253 return PSA_ERROR_BAD_STATE;
6254 }
6255 status = psa_mac_update(&hkdf->hmac,
6256 data, data_length);
6257 if (status != PSA_SUCCESS) {
6258 return status;
6259 }
6260 status = psa_mac_sign_finish(&hkdf->hmac,
6261 hkdf->prk,
6262 sizeof(hkdf->prk),
6263 &data_length);
6264 if (status != PSA_SUCCESS) {
6265 return status;
6266 }
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006267 }
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006268
Gilles Peskine2b522db2019-04-12 15:11:49 +02006269 hkdf->state = HKDF_STATE_KEYED;
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006270 hkdf->block_number = 0;
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006271#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01006272 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006273 /* The only block of output is the PRK. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006274 memcpy(hkdf->output_block, hkdf->prk, PSA_HASH_LENGTH(hash_alg));
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006275 hkdf->offset_in_block = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01006276 } else
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006277#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006278 {
6279 /* Block 0 is empty, and the next block will be
6280 * generated by psa_key_derivation_hkdf_read(). */
Gilles Peskine449bd832023-01-11 14:50:10 +01006281 hkdf->offset_in_block = PSA_HASH_LENGTH(hash_alg);
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006282 }
6283
Gilles Peskine449bd832023-01-11 14:50:10 +01006284 return PSA_SUCCESS;
Gilles Peskine03410b52019-05-16 16:05:19 +02006285 case PSA_KEY_DERIVATION_INPUT_INFO:
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006286#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01006287 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
6288 return PSA_ERROR_INVALID_ARGUMENT;
6289 }
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006290#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Przemek Stekielcde3f782022-06-03 16:12:27 +02006291#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Gilles Peskine449bd832023-01-11 14:50:10 +01006292 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg) &&
6293 hkdf->state == HKDF_STATE_INIT) {
6294 return PSA_ERROR_BAD_STATE;
6295 }
Przemek Stekielcde3f782022-06-03 16:12:27 +02006296#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Gilles Peskine449bd832023-01-11 14:50:10 +01006297 if (hkdf->state == HKDF_STATE_OUTPUT) {
6298 return PSA_ERROR_BAD_STATE;
6299 }
6300 if (hkdf->info_set) {
6301 return PSA_ERROR_BAD_STATE;
6302 }
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006303 hkdf->info_length = data_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01006304 if (data_length != 0) {
6305 hkdf->info = mbedtls_calloc(1, data_length);
6306 if (hkdf->info == NULL) {
6307 return PSA_ERROR_INSUFFICIENT_MEMORY;
6308 }
6309 memcpy(hkdf->info, data, data_length);
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006310 }
6311 hkdf->info_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01006312 return PSA_SUCCESS;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006313 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01006314 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006315 }
6316}
Przemek Stekiel69c46792022-06-10 12:59:51 +02006317#endif /* BUILTIN_ALG_ANY_HKDF */
Janos Follathb03233e2019-06-11 15:30:30 +01006318
John Durkop07cc04a2020-11-16 22:08:34 -08006319#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
6320 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006321static psa_status_t psa_tls12_prf_set_seed(psa_tls12_prf_key_derivation_t *prf,
6322 const uint8_t *data,
6323 size_t data_length)
Janos Follathf08e2652019-06-13 09:05:41 +01006324{
Gilles Peskine449bd832023-01-11 14:50:10 +01006325 if (prf->state != PSA_TLS12_PRF_STATE_INIT) {
6326 return PSA_ERROR_BAD_STATE;
6327 }
Janos Follathf08e2652019-06-13 09:05:41 +01006328
Gilles Peskine449bd832023-01-11 14:50:10 +01006329 if (data_length != 0) {
6330 prf->seed = mbedtls_calloc(1, data_length);
6331 if (prf->seed == NULL) {
6332 return PSA_ERROR_INSUFFICIENT_MEMORY;
6333 }
Janos Follathf08e2652019-06-13 09:05:41 +01006334
Gilles Peskine449bd832023-01-11 14:50:10 +01006335 memcpy(prf->seed, data, data_length);
Janos Follathd6dce9f2019-07-04 09:11:38 +01006336 prf->seed_length = data_length;
6337 }
Janos Follathf08e2652019-06-13 09:05:41 +01006338
Gilles Peskine43f958b2020-12-13 14:55:14 +01006339 prf->state = PSA_TLS12_PRF_STATE_SEED_SET;
Janos Follathf08e2652019-06-13 09:05:41 +01006340
Gilles Peskine449bd832023-01-11 14:50:10 +01006341 return PSA_SUCCESS;
Janos Follathf08e2652019-06-13 09:05:41 +01006342}
6343
Gilles Peskine449bd832023-01-11 14:50:10 +01006344static psa_status_t psa_tls12_prf_set_key(psa_tls12_prf_key_derivation_t *prf,
6345 const uint8_t *data,
6346 size_t data_length)
Janos Follath81550542019-06-13 14:26:34 +01006347{
Gilles Peskine449bd832023-01-11 14:50:10 +01006348 if (prf->state != PSA_TLS12_PRF_STATE_SEED_SET &&
6349 prf->state != PSA_TLS12_PRF_STATE_OTHER_KEY_SET) {
6350 return PSA_ERROR_BAD_STATE;
6351 }
Janos Follath81550542019-06-13 14:26:34 +01006352
Gilles Peskine449bd832023-01-11 14:50:10 +01006353 if (data_length != 0) {
6354 prf->secret = mbedtls_calloc(1, data_length);
6355 if (prf->secret == NULL) {
6356 return PSA_ERROR_INSUFFICIENT_MEMORY;
6357 }
Steven Cooremana6df6042021-04-29 19:32:25 +02006358
Gilles Peskine449bd832023-01-11 14:50:10 +01006359 memcpy(prf->secret, data, data_length);
Steven Cooremana6df6042021-04-29 19:32:25 +02006360 prf->secret_length = data_length;
6361 }
Janos Follath81550542019-06-13 14:26:34 +01006362
Gilles Peskine43f958b2020-12-13 14:55:14 +01006363 prf->state = PSA_TLS12_PRF_STATE_KEY_SET;
Janos Follath81550542019-06-13 14:26:34 +01006364
Gilles Peskine449bd832023-01-11 14:50:10 +01006365 return PSA_SUCCESS;
Janos Follath81550542019-06-13 14:26:34 +01006366}
6367
Gilles Peskine449bd832023-01-11 14:50:10 +01006368static psa_status_t psa_tls12_prf_set_label(psa_tls12_prf_key_derivation_t *prf,
6369 const uint8_t *data,
6370 size_t data_length)
Janos Follath63028dd2019-06-13 09:15:47 +01006371{
Gilles Peskine449bd832023-01-11 14:50:10 +01006372 if (prf->state != PSA_TLS12_PRF_STATE_KEY_SET) {
6373 return PSA_ERROR_BAD_STATE;
6374 }
Janos Follath63028dd2019-06-13 09:15:47 +01006375
Gilles Peskine449bd832023-01-11 14:50:10 +01006376 if (data_length != 0) {
6377 prf->label = mbedtls_calloc(1, data_length);
6378 if (prf->label == NULL) {
6379 return PSA_ERROR_INSUFFICIENT_MEMORY;
6380 }
Janos Follath63028dd2019-06-13 09:15:47 +01006381
Gilles Peskine449bd832023-01-11 14:50:10 +01006382 memcpy(prf->label, data, data_length);
Janos Follathd6dce9f2019-07-04 09:11:38 +01006383 prf->label_length = data_length;
6384 }
Janos Follath63028dd2019-06-13 09:15:47 +01006385
Gilles Peskine43f958b2020-12-13 14:55:14 +01006386 prf->state = PSA_TLS12_PRF_STATE_LABEL_SET;
Janos Follath63028dd2019-06-13 09:15:47 +01006387
Gilles Peskine449bd832023-01-11 14:50:10 +01006388 return PSA_SUCCESS;
Janos Follath63028dd2019-06-13 09:15:47 +01006389}
6390
Gilles Peskine449bd832023-01-11 14:50:10 +01006391static psa_status_t psa_tls12_prf_input(psa_tls12_prf_key_derivation_t *prf,
6392 psa_key_derivation_step_t step,
6393 const uint8_t *data,
6394 size_t data_length)
Janos Follathb03233e2019-06-11 15:30:30 +01006395{
Gilles Peskine449bd832023-01-11 14:50:10 +01006396 switch (step) {
Janos Follathf08e2652019-06-13 09:05:41 +01006397 case PSA_KEY_DERIVATION_INPUT_SEED:
Gilles Peskine449bd832023-01-11 14:50:10 +01006398 return psa_tls12_prf_set_seed(prf, data, data_length);
Janos Follath81550542019-06-13 14:26:34 +01006399 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01006400 return psa_tls12_prf_set_key(prf, data, data_length);
Janos Follath63028dd2019-06-13 09:15:47 +01006401 case PSA_KEY_DERIVATION_INPUT_LABEL:
Gilles Peskine449bd832023-01-11 14:50:10 +01006402 return psa_tls12_prf_set_label(prf, data, data_length);
Janos Follathb03233e2019-06-11 15:30:30 +01006403 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01006404 return PSA_ERROR_INVALID_ARGUMENT;
Janos Follathb03233e2019-06-11 15:30:30 +01006405 }
6406}
John Durkop07cc04a2020-11-16 22:08:34 -08006407#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) ||
6408 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
6409
6410#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
6411static psa_status_t psa_tls12_prf_psk_to_ms_set_key(
6412 psa_tls12_prf_key_derivation_t *prf,
John Durkop07cc04a2020-11-16 22:08:34 -08006413 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01006414 size_t data_length)
John Durkop07cc04a2020-11-16 22:08:34 -08006415{
6416 psa_status_t status;
Gilles Peskine449bd832023-01-11 14:50:10 +01006417 const size_t pms_len = (prf->state == PSA_TLS12_PRF_STATE_OTHER_KEY_SET ?
6418 4 + data_length + prf->other_secret_length :
6419 4 + 2 * data_length);
John Durkop07cc04a2020-11-16 22:08:34 -08006420
Gilles Peskine449bd832023-01-11 14:50:10 +01006421 if (data_length > PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE) {
6422 return PSA_ERROR_INVALID_ARGUMENT;
6423 }
John Durkop07cc04a2020-11-16 22:08:34 -08006424
Gilles Peskine449bd832023-01-11 14:50:10 +01006425 uint8_t *pms = mbedtls_calloc(1, pms_len);
6426 if (pms == NULL) {
6427 return PSA_ERROR_INSUFFICIENT_MEMORY;
6428 }
Przemek Stekielc8fa5a12022-04-07 14:17:13 +02006429 uint8_t *cur = pms;
6430
6431 /* pure-PSK:
6432 * Quoting RFC 4279, Section 2:
John Durkop07cc04a2020-11-16 22:08:34 -08006433 *
6434 * The premaster secret is formed as follows: if the PSK is N octets
6435 * long, concatenate a uint16 with the value N, N zero octets, a second
6436 * uint16 with the value N, and the PSK itself.
Przemek Stekielc8fa5a12022-04-07 14:17:13 +02006437 *
6438 * mixed-PSK:
6439 * In a DHE-PSK, RSA-PSK, ECDHE-PSK the premaster secret is formed as
6440 * follows: concatenate a uint16 with the length of the other secret,
6441 * the other secret itself, uint16 with the length of PSK, and the
6442 * PSK itself.
6443 * For details please check:
6444 * - RFC 4279, Section 4 for the definition of RSA-PSK,
6445 * - RFC 4279, Section 3 for the definition of DHE-PSK,
6446 * - RFC 5489 for the definition of ECDHE-PSK.
John Durkop07cc04a2020-11-16 22:08:34 -08006447 */
6448
Gilles Peskine449bd832023-01-11 14:50:10 +01006449 if (prf->state == PSA_TLS12_PRF_STATE_OTHER_KEY_SET) {
6450 *cur++ = MBEDTLS_BYTE_1(prf->other_secret_length);
6451 *cur++ = MBEDTLS_BYTE_0(prf->other_secret_length);
6452 if (prf->other_secret_length != 0) {
6453 memcpy(cur, prf->other_secret, prf->other_secret_length);
6454 mbedtls_platform_zeroize(prf->other_secret, prf->other_secret_length);
Przemek Stekiel2503f7e2022-04-12 12:08:01 +02006455 cur += prf->other_secret_length;
6456 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006457 } else {
6458 *cur++ = MBEDTLS_BYTE_1(data_length);
6459 *cur++ = MBEDTLS_BYTE_0(data_length);
6460 memset(cur, 0, data_length);
Przemek Stekielc8fa5a12022-04-07 14:17:13 +02006461 cur += data_length;
6462 }
6463
Gilles Peskine449bd832023-01-11 14:50:10 +01006464 *cur++ = MBEDTLS_BYTE_1(data_length);
6465 *cur++ = MBEDTLS_BYTE_0(data_length);
6466 memcpy(cur, data, data_length);
John Durkop07cc04a2020-11-16 22:08:34 -08006467 cur += data_length;
6468
Dave Rodgmane4a6f5a2023-11-04 12:20:09 +00006469 status = psa_tls12_prf_set_key(prf, pms, (size_t) (cur - pms));
John Durkop07cc04a2020-11-16 22:08:34 -08006470
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01006471 mbedtls_zeroize_and_free(pms, pms_len);
Gilles Peskine449bd832023-01-11 14:50:10 +01006472 return status;
John Durkop07cc04a2020-11-16 22:08:34 -08006473}
Janos Follath6660f0e2019-06-17 08:44:03 +01006474
Przemek Stekiele47201b2022-04-19 13:53:28 +02006475static psa_status_t psa_tls12_prf_psk_to_ms_set_other_key(
6476 psa_tls12_prf_key_derivation_t *prf,
6477 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01006478 size_t data_length)
Przemek Stekiele47201b2022-04-19 13:53:28 +02006479{
Gilles Peskine449bd832023-01-11 14:50:10 +01006480 if (prf->state != PSA_TLS12_PRF_STATE_SEED_SET) {
6481 return PSA_ERROR_BAD_STATE;
Przemek Stekiele47201b2022-04-19 13:53:28 +02006482 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006483
6484 if (data_length != 0) {
6485 prf->other_secret = mbedtls_calloc(1, data_length);
6486 if (prf->other_secret == NULL) {
6487 return PSA_ERROR_INSUFFICIENT_MEMORY;
6488 }
6489
6490 memcpy(prf->other_secret, data, data_length);
6491 prf->other_secret_length = data_length;
6492 } else {
Przemek Stekiele47201b2022-04-19 13:53:28 +02006493 prf->other_secret_length = 0;
6494 }
6495
6496 prf->state = PSA_TLS12_PRF_STATE_OTHER_KEY_SET;
6497
Gilles Peskine449bd832023-01-11 14:50:10 +01006498 return PSA_SUCCESS;
Przemek Stekiele47201b2022-04-19 13:53:28 +02006499}
6500
Janos Follath6660f0e2019-06-17 08:44:03 +01006501static psa_status_t psa_tls12_prf_psk_to_ms_input(
6502 psa_tls12_prf_key_derivation_t *prf,
Janos Follath6660f0e2019-06-17 08:44:03 +01006503 psa_key_derivation_step_t step,
6504 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01006505 size_t data_length)
Janos Follath6660f0e2019-06-17 08:44:03 +01006506{
Gilles Peskine449bd832023-01-11 14:50:10 +01006507 switch (step) {
Przemek Stekiele47201b2022-04-19 13:53:28 +02006508 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01006509 return psa_tls12_prf_psk_to_ms_set_key(prf,
6510 data, data_length);
Przemek Stekiele47201b2022-04-19 13:53:28 +02006511 break;
6512 case PSA_KEY_DERIVATION_INPUT_OTHER_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01006513 return psa_tls12_prf_psk_to_ms_set_other_key(prf,
6514 data,
6515 data_length);
Przemek Stekiele47201b2022-04-19 13:53:28 +02006516 break;
6517 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01006518 return psa_tls12_prf_input(prf, step, data, data_length);
Przemek Stekiele47201b2022-04-19 13:53:28 +02006519 break;
Janos Follath6660f0e2019-06-17 08:44:03 +01006520
Przemek Stekiele47201b2022-04-19 13:53:28 +02006521 }
Janos Follath6660f0e2019-06-17 08:44:03 +01006522}
John Durkop07cc04a2020-11-16 22:08:34 -08006523#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006524
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006525#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
6526static psa_status_t psa_tls12_ecjpake_to_pms_input(
6527 psa_tls12_ecjpake_to_pms_t *ecjpake,
Andrzej Kurek702776f2022-09-16 06:22:44 -04006528 psa_key_derivation_step_t step,
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006529 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01006530 size_t data_length)
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006531{
Gilles Peskine449bd832023-01-11 14:50:10 +01006532 if (data_length != PSA_TLS12_ECJPAKE_TO_PMS_INPUT_SIZE ||
6533 step != PSA_KEY_DERIVATION_INPUT_SECRET) {
6534 return PSA_ERROR_INVALID_ARGUMENT;
Andrzej Kurek5603efd2022-09-26 10:49:16 -04006535 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006536
6537 /* Check if the passed point is in an uncompressed form */
Gilles Peskine449bd832023-01-11 14:50:10 +01006538 if (data[0] != 0x04) {
6539 return PSA_ERROR_INVALID_ARGUMENT;
6540 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006541
6542 /* Only K.X has to be extracted - bytes 1 to 32 inclusive. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006543 memcpy(ecjpake->data, data + 1, PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE);
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006544
Gilles Peskine449bd832023-01-11 14:50:10 +01006545 return PSA_SUCCESS;
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006546}
6547#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05306548
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05306549#if defined(PSA_HAVE_SOFT_PBKDF2)
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05306550static psa_status_t psa_pbkdf2_set_input_cost(
6551 psa_pbkdf2_key_derivation_t *pbkdf2,
6552 psa_key_derivation_step_t step,
6553 uint64_t data)
6554{
6555 if (step != PSA_KEY_DERIVATION_INPUT_COST) {
6556 return PSA_ERROR_INVALID_ARGUMENT;
6557 }
6558
6559 if (pbkdf2->state != PSA_PBKDF2_STATE_INIT) {
6560 return PSA_ERROR_BAD_STATE;
6561 }
Kusumit Ghoderao3fc4ca72023-05-08 15:57:41 +05306562
Kusumit Ghoderaoe66a8ad2023-05-24 12:30:43 +05306563 if (data > PSA_VENDOR_PBKDF2_MAX_ITERATIONS) {
Kusumit Ghoderao3fc4ca72023-05-08 15:57:41 +05306564 return PSA_ERROR_NOT_SUPPORTED;
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05306565 }
Kusumit Ghoderao3fc4ca72023-05-08 15:57:41 +05306566
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05306567 if (data == 0) {
6568 return PSA_ERROR_INVALID_ARGUMENT;
6569 }
Kusumit Ghoderaoe66a8ad2023-05-24 12:30:43 +05306570
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05306571 pbkdf2->input_cost = data;
6572 pbkdf2->state = PSA_PBKDF2_STATE_INPUT_COST_SET;
6573
6574 return PSA_SUCCESS;
6575}
Kusumit Ghoderao547a6c62023-05-03 12:18:19 +05306576
6577static psa_status_t psa_pbkdf2_set_salt(psa_pbkdf2_key_derivation_t *pbkdf2,
6578 const uint8_t *data,
6579 size_t data_length)
6580{
Gilles Peskineead17662023-08-20 22:02:51 +02006581 if (pbkdf2->state == PSA_PBKDF2_STATE_INPUT_COST_SET) {
6582 pbkdf2->state = PSA_PBKDF2_STATE_SALT_SET;
6583 } else if (pbkdf2->state == PSA_PBKDF2_STATE_SALT_SET) {
6584 /* Appending to existing salt. No state change. */
6585 } else {
Kusumit Ghoderao547a6c62023-05-03 12:18:19 +05306586 return PSA_ERROR_BAD_STATE;
6587 }
6588
Gilles Peskineca57d782023-07-20 19:08:06 +02006589 if (data_length == 0) {
Gilles Peskineead17662023-08-20 22:02:51 +02006590 /* Appending an empty string, nothing to do. */
6591 } else {
Kusumit Ghoderaod7a3f802023-05-24 22:19:47 +05306592 uint8_t *next_salt;
Kusumit Ghoderaob538bb72023-05-24 12:32:14 +05306593
Kusumit Ghoderaod7a3f802023-05-24 22:19:47 +05306594 next_salt = mbedtls_calloc(1, data_length + pbkdf2->salt_length);
6595 if (next_salt == NULL) {
Kusumit Ghoderaod0422f32023-05-08 15:56:19 +05306596 return PSA_ERROR_INSUFFICIENT_MEMORY;
6597 }
6598
Gilles Peskineead17662023-08-20 22:02:51 +02006599 if (pbkdf2->salt_length != 0) {
6600 memcpy(next_salt, pbkdf2->salt, pbkdf2->salt_length);
6601 }
Kusumit Ghoderaod7a3f802023-05-24 22:19:47 +05306602 memcpy(next_salt + pbkdf2->salt_length, data, data_length);
Kusumit Ghoderaod0422f32023-05-08 15:56:19 +05306603 pbkdf2->salt_length += data_length;
Kusumit Ghoderaod7a3f802023-05-24 22:19:47 +05306604 mbedtls_free(pbkdf2->salt);
6605 pbkdf2->salt = next_salt;
Kusumit Ghoderao547a6c62023-05-03 12:18:19 +05306606 }
Kusumit Ghoderao547a6c62023-05-03 12:18:19 +05306607 return PSA_SUCCESS;
6608}
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05306609
Kusumit Ghoderao0bca4c52023-07-27 21:20:14 +05306610#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC)
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306611static psa_status_t psa_pbkdf2_hmac_set_password(psa_algorithm_t hash_alg,
Kusumit Ghoderaoaac9a582023-05-24 14:19:17 +05306612 const uint8_t *input,
6613 size_t input_len,
6614 uint8_t *output,
Kusumit Ghoderao91f99f52023-05-24 22:21:48 +05306615 size_t *output_len)
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306616{
6617 psa_status_t status = PSA_SUCCESS;
6618 if (input_len > PSA_HASH_BLOCK_LENGTH(hash_alg)) {
6619 status = psa_hash_compute(hash_alg, input, input_len, output,
Kusumit Ghoderao91f99f52023-05-24 22:21:48 +05306620 PSA_HMAC_MAX_HASH_BLOCK_SIZE, output_len);
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306621 } else {
6622 memcpy(output, input, input_len);
Kusumit Ghoderao91f99f52023-05-24 22:21:48 +05306623 *output_len = PSA_HASH_BLOCK_LENGTH(hash_alg);
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306624 }
6625 return status;
6626}
Kusumit Ghoderao0bca4c52023-07-27 21:20:14 +05306627#endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC */
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306628
Kusumit Ghoderao0bca4c52023-07-27 21:20:14 +05306629#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_AES_CMAC_PRF_128)
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05306630static psa_status_t psa_pbkdf2_cmac_set_password(const uint8_t *input,
6631 size_t input_len,
6632 uint8_t *output,
6633 size_t *output_len)
6634{
6635 psa_status_t status = PSA_SUCCESS;
Kusumit Ghoderaoa12e2d52023-07-27 21:18:30 +05306636 if (input_len != PSA_MAC_LENGTH(PSA_KEY_TYPE_AES, 128U, PSA_ALG_CMAC)) {
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05306637 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Kusumit Ghoderao3fde8fe2023-06-27 10:41:43 +05306638 uint8_t zeros[16] = { 0 };
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05306639 psa_set_key_type(&attributes, PSA_KEY_TYPE_AES);
6640 psa_set_key_bits(&attributes, PSA_BYTES_TO_BITS(sizeof(zeros)));
6641 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_MESSAGE);
Kusumit Ghoderaoa12e2d52023-07-27 21:18:30 +05306642 /* Passing PSA_MAC_LENGTH(PSA_KEY_TYPE_AES, 128U, PSA_ALG_CMAC) as
Kusumit Ghoderao5f3345a2023-07-27 21:21:38 +05306643 * mac_size as the driver function sets mac_output_length = mac_size
6644 * on success. See https://github.com/Mbed-TLS/mbedtls/issues/7801 */
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05306645 status = psa_driver_wrapper_mac_compute(&attributes,
6646 zeros, sizeof(zeros),
6647 PSA_ALG_CMAC, input, input_len,
6648 output,
Kusumit Ghoderaoa12e2d52023-07-27 21:18:30 +05306649 PSA_MAC_LENGTH(PSA_KEY_TYPE_AES,
6650 128U,
6651 PSA_ALG_CMAC),
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05306652 output_len);
6653 } else {
6654 memcpy(output, input, input_len);
Kusumit Ghoderaoa12e2d52023-07-27 21:18:30 +05306655 *output_len = PSA_MAC_LENGTH(PSA_KEY_TYPE_AES, 128U, PSA_ALG_CMAC);
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05306656 }
6657 return status;
6658}
Kusumit Ghoderao0bca4c52023-07-27 21:20:14 +05306659#endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_AES_CMAC_PRF_128 */
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05306660
6661static psa_status_t psa_pbkdf2_set_password(psa_pbkdf2_key_derivation_t *pbkdf2,
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306662 psa_algorithm_t kdf_alg,
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05306663 const uint8_t *data,
6664 size_t data_length)
6665{
Kusumit Ghoderaoaac9a582023-05-24 14:19:17 +05306666 psa_status_t status = PSA_SUCCESS;
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05306667 if (pbkdf2->state != PSA_PBKDF2_STATE_SALT_SET) {
6668 return PSA_ERROR_BAD_STATE;
6669 }
6670
Kusumit Ghoderaof3e696d2023-07-28 13:30:50 +05306671#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC)
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05306672 if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) {
6673 psa_algorithm_t hash_alg = PSA_ALG_PBKDF2_HMAC_GET_HASH(kdf_alg);
6674 status = psa_pbkdf2_hmac_set_password(hash_alg, data, data_length,
6675 pbkdf2->password,
6676 &pbkdf2->password_length);
Kusumit Ghoderaof3e696d2023-07-28 13:30:50 +05306677 } else
6678#endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC */
6679#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_AES_CMAC_PRF_128)
6680 if (kdf_alg == PSA_ALG_PBKDF2_AES_CMAC_PRF_128) {
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05306681 status = psa_pbkdf2_cmac_set_password(data, data_length,
6682 pbkdf2->password,
6683 &pbkdf2->password_length);
Kusumit Ghoderaof3e696d2023-07-28 13:30:50 +05306684 } else
6685#endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_AES_CMAC_PRF_128 */
6686 {
6687 return PSA_ERROR_INVALID_ARGUMENT;
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05306688 }
6689
6690 pbkdf2->state = PSA_PBKDF2_STATE_PASSWORD_SET;
6691
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306692 return status;
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05306693}
Kusumit Ghoderao24b38952023-05-03 12:25:26 +05306694
6695static psa_status_t psa_pbkdf2_input(psa_pbkdf2_key_derivation_t *pbkdf2,
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306696 psa_algorithm_t kdf_alg,
Kusumit Ghoderao24b38952023-05-03 12:25:26 +05306697 psa_key_derivation_step_t step,
6698 const uint8_t *data,
6699 size_t data_length)
6700{
6701 switch (step) {
6702 case PSA_KEY_DERIVATION_INPUT_SALT:
6703 return psa_pbkdf2_set_salt(pbkdf2, data, data_length);
6704 case PSA_KEY_DERIVATION_INPUT_PASSWORD:
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306705 return psa_pbkdf2_set_password(pbkdf2, kdf_alg, data, data_length);
Kusumit Ghoderao24b38952023-05-03 12:25:26 +05306706 default:
6707 return PSA_ERROR_INVALID_ARGUMENT;
6708 }
6709}
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05306710#endif /* PSA_HAVE_SOFT_PBKDF2 */
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05306711
Gilles Peskineb8965192019-09-24 16:21:10 +02006712/** Check whether the given key type is acceptable for the given
6713 * input step of a key derivation.
6714 *
6715 * Secret inputs must have the type #PSA_KEY_TYPE_DERIVE.
6716 * Non-secret inputs must have the type #PSA_KEY_TYPE_RAW_DATA.
6717 * Both secret and non-secret inputs can alternatively have the type
6718 * #PSA_KEY_TYPE_NONE, which is never the type of a key object, meaning
6719 * that the input was passed as a buffer rather than via a key object.
6720 */
Gilles Peskine224b0d62019-09-23 18:13:17 +02006721static int psa_key_derivation_check_input_type(
6722 psa_key_derivation_step_t step,
Gilles Peskine449bd832023-01-11 14:50:10 +01006723 psa_key_type_t key_type)
Gilles Peskine224b0d62019-09-23 18:13:17 +02006724{
Gilles Peskine449bd832023-01-11 14:50:10 +01006725 switch (step) {
Gilles Peskine224b0d62019-09-23 18:13:17 +02006726 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01006727 if (key_type == PSA_KEY_TYPE_DERIVE) {
6728 return PSA_SUCCESS;
6729 }
6730 if (key_type == PSA_KEY_TYPE_NONE) {
6731 return PSA_SUCCESS;
6732 }
Gilles Peskine224b0d62019-09-23 18:13:17 +02006733 break;
Przemek Stekiela7695a22022-04-07 15:39:01 +02006734 case PSA_KEY_DERIVATION_INPUT_OTHER_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01006735 if (key_type == PSA_KEY_TYPE_DERIVE) {
6736 return PSA_SUCCESS;
6737 }
6738 if (key_type == PSA_KEY_TYPE_NONE) {
6739 return PSA_SUCCESS;
6740 }
Przemek Stekiela7695a22022-04-07 15:39:01 +02006741 break;
Gilles Peskine224b0d62019-09-23 18:13:17 +02006742 case PSA_KEY_DERIVATION_INPUT_LABEL:
6743 case PSA_KEY_DERIVATION_INPUT_SALT:
6744 case PSA_KEY_DERIVATION_INPUT_INFO:
6745 case PSA_KEY_DERIVATION_INPUT_SEED:
Gilles Peskine449bd832023-01-11 14:50:10 +01006746 if (key_type == PSA_KEY_TYPE_RAW_DATA) {
6747 return PSA_SUCCESS;
6748 }
6749 if (key_type == PSA_KEY_TYPE_NONE) {
6750 return PSA_SUCCESS;
6751 }
Gilles Peskine224b0d62019-09-23 18:13:17 +02006752 break;
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05306753 case PSA_KEY_DERIVATION_INPUT_PASSWORD:
6754 if (key_type == PSA_KEY_TYPE_PASSWORD) {
6755 return PSA_SUCCESS;
6756 }
6757 if (key_type == PSA_KEY_TYPE_DERIVE) {
6758 return PSA_SUCCESS;
6759 }
6760 if (key_type == PSA_KEY_TYPE_NONE) {
6761 return PSA_SUCCESS;
6762 }
6763 break;
Gilles Peskine224b0d62019-09-23 18:13:17 +02006764 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006765 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine224b0d62019-09-23 18:13:17 +02006766}
6767
Janos Follathb80a94e2019-06-12 15:54:46 +01006768static psa_status_t psa_key_derivation_input_internal(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006769 psa_key_derivation_operation_t *operation,
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01006770 psa_key_derivation_step_t step,
Gilles Peskine224b0d62019-09-23 18:13:17 +02006771 psa_key_type_t key_type,
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01006772 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01006773 size_t data_length)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006774{
Gilles Peskine46d7faf2019-09-23 19:22:55 +02006775 psa_status_t status;
Gilles Peskine449bd832023-01-11 14:50:10 +01006776 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation);
Gilles Peskine46d7faf2019-09-23 19:22:55 +02006777
Gilles Peskine449bd832023-01-11 14:50:10 +01006778 status = psa_key_derivation_check_input_type(step, key_type);
6779 if (status != PSA_SUCCESS) {
Gilles Peskine224b0d62019-09-23 18:13:17 +02006780 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006781 }
Gilles Peskine224b0d62019-09-23 18:13:17 +02006782
Przemek Stekiel69c46792022-06-10 12:59:51 +02006783#if defined(BUILTIN_ALG_ANY_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006784 if (PSA_ALG_IS_ANY_HKDF(kdf_alg)) {
6785 status = psa_hkdf_input(&operation->ctx.hkdf, kdf_alg,
6786 step, data, data_length);
6787 } else
Przemek Stekiel69c46792022-06-10 12:59:51 +02006788#endif /* BUILTIN_ALG_ANY_HKDF */
John Durkop07cc04a2020-11-16 22:08:34 -08006789#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006790 if (PSA_ALG_IS_TLS12_PRF(kdf_alg)) {
6791 status = psa_tls12_prf_input(&operation->ctx.tls12_prf,
6792 step, data, data_length);
6793 } else
John Durkop07cc04a2020-11-16 22:08:34 -08006794#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF */
6795#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006796 if (PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
6797 status = psa_tls12_prf_psk_to_ms_input(&operation->ctx.tls12_prf,
6798 step, data, data_length);
6799 } else
John Durkop07cc04a2020-11-16 22:08:34 -08006800#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006801#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006802 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006803 status = psa_tls12_ecjpake_to_pms_input(
Gilles Peskine449bd832023-01-11 14:50:10 +01006804 &operation->ctx.tls12_ecjpake_to_pms, step, data, data_length);
6805 } else
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006806#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05306807#if defined(PSA_HAVE_SOFT_PBKDF2)
Kusumit Ghoderao9ab03c32023-07-27 21:14:05 +05306808 if (PSA_ALG_IS_PBKDF2(kdf_alg)) {
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306809 status = psa_pbkdf2_input(&operation->ctx.pbkdf2, kdf_alg,
6810 step, data, data_length);
Kusumit Ghoderao24b38952023-05-03 12:25:26 +05306811 } else
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05306812#endif /* PSA_HAVE_SOFT_PBKDF2 */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006813 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006814 /* This can't happen unless the operation object was not initialized */
Steven Cooreman74afe472021-02-10 17:19:22 +01006815 (void) data;
6816 (void) data_length;
6817 (void) kdf_alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01006818 return PSA_ERROR_BAD_STATE;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006819 }
6820
Gilles Peskine224b0d62019-09-23 18:13:17 +02006821exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01006822 if (status != PSA_SUCCESS) {
6823 psa_key_derivation_abort(operation);
6824 }
6825 return status;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006826}
6827
Kusumit Ghoderao50e0e112023-04-06 17:47:25 +05306828static psa_status_t psa_key_derivation_input_integer_internal(
6829 psa_key_derivation_operation_t *operation,
6830 psa_key_derivation_step_t step,
6831 uint64_t value)
6832{
6833 psa_status_t status;
6834 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation);
6835
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05306836#if defined(PSA_HAVE_SOFT_PBKDF2)
Kusumit Ghoderao9ab03c32023-07-27 21:14:05 +05306837 if (PSA_ALG_IS_PBKDF2(kdf_alg)) {
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05306838 status = psa_pbkdf2_set_input_cost(
6839 &operation->ctx.pbkdf2, step, value);
6840 } else
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05306841#endif /* PSA_HAVE_SOFT_PBKDF2 */
Kusumit Ghoderao50e0e112023-04-06 17:47:25 +05306842 {
Kusumit Ghoderao3a18dee2023-04-07 16:16:27 +05306843 (void) step;
Kusumit Ghoderao50e0e112023-04-06 17:47:25 +05306844 (void) value;
6845 (void) kdf_alg;
Kusumit Ghoderaoa14ae5a2023-04-19 14:16:26 +05306846 status = PSA_ERROR_INVALID_ARGUMENT;
Kusumit Ghoderao50e0e112023-04-06 17:47:25 +05306847 }
6848
6849 if (status != PSA_SUCCESS) {
6850 psa_key_derivation_abort(operation);
6851 }
6852 return status;
6853}
6854
Janos Follath51f4a0f2019-06-14 11:35:55 +01006855psa_status_t psa_key_derivation_input_bytes(
6856 psa_key_derivation_operation_t *operation,
6857 psa_key_derivation_step_t step,
6858 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01006859 size_t data_length)
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01006860{
Gilles Peskine449bd832023-01-11 14:50:10 +01006861 return psa_key_derivation_input_internal(operation, step,
6862 PSA_KEY_TYPE_NONE,
6863 data, data_length);
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01006864}
6865
Kusumit Ghoderao50e0e112023-04-06 17:47:25 +05306866psa_status_t psa_key_derivation_input_integer(
6867 psa_key_derivation_operation_t *operation,
6868 psa_key_derivation_step_t step,
6869 uint64_t value)
6870{
6871 return psa_key_derivation_input_integer_internal(operation, step, value);
6872}
6873
Janos Follath51f4a0f2019-06-14 11:35:55 +01006874psa_status_t psa_key_derivation_input_key(
6875 psa_key_derivation_operation_t *operation,
6876 psa_key_derivation_step_t step,
Gilles Peskine449bd832023-01-11 14:50:10 +01006877 mbedtls_svc_key_id_t key)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006878{
Ronald Cronf95a2b12020-10-22 15:24:49 +02006879 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01006880 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006881 psa_key_slot_t *slot;
Gilles Peskine178c9aa2019-09-24 18:21:06 +02006882
Ronald Cron5c522922020-11-14 16:35:34 +01006883 status = psa_get_and_lock_transparent_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01006884 key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg);
6885 if (status != PSA_SUCCESS) {
6886 psa_key_derivation_abort(operation);
6887 return status;
Gilles Peskine593773d2019-09-23 18:17:40 +02006888 }
Gilles Peskine178c9aa2019-09-24 18:21:06 +02006889
Kusumit Ghoderao3128c5d2023-05-03 12:27:57 +05306890 /* Passing a key object as a SECRET or PASSWORD input unlocks the
6891 * permission to output to a key object. */
6892 if (step == PSA_KEY_DERIVATION_INPUT_SECRET ||
6893 step == PSA_KEY_DERIVATION_INPUT_PASSWORD) {
Gilles Peskine178c9aa2019-09-24 18:21:06 +02006894 operation->can_output_key = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01006895 }
Gilles Peskine178c9aa2019-09-24 18:21:06 +02006896
Gilles Peskine449bd832023-01-11 14:50:10 +01006897 status = psa_key_derivation_input_internal(operation,
6898 step, slot->attr.type,
6899 slot->key.data,
6900 slot->key.bytes);
Ronald Cronf95a2b12020-10-22 15:24:49 +02006901
Ryan Everett1b70a072024-01-04 10:32:49 +00006902 unlock_status = psa_unregister_read(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02006903
Gilles Peskine449bd832023-01-11 14:50:10 +01006904 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006905}
Gilles Peskineea0fb492018-07-12 17:17:20 +02006906
6907
6908
6909/****************************************************************/
Gilles Peskine01d718c2018-09-18 12:01:02 +02006910/* Key agreement */
6911/****************************************************************/
6912
Gilles Peskine449bd832023-01-11 14:50:10 +01006913psa_status_t psa_key_agreement_raw_builtin(const psa_key_attributes_t *attributes,
6914 const uint8_t *key_buffer,
6915 size_t key_buffer_size,
6916 psa_algorithm_t alg,
6917 const uint8_t *peer_key,
6918 size_t peer_key_length,
6919 uint8_t *shared_secret,
6920 size_t shared_secret_size,
6921 size_t *shared_secret_length)
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02006922{
Gilles Peskine449bd832023-01-11 14:50:10 +01006923 switch (alg) {
John Durkop6ba40d12020-11-10 08:50:04 -08006924#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
Gilles Peskine0216fe12019-04-11 21:23:21 +02006925 case PSA_ALG_ECDH:
Gilles Peskine449bd832023-01-11 14:50:10 +01006926 return mbedtls_psa_key_agreement_ecdh(attributes, key_buffer,
6927 key_buffer_size, alg,
6928 peer_key, peer_key_length,
6929 shared_secret,
6930 shared_secret_size,
6931 shared_secret_length);
Gilles Peskine01d718c2018-09-18 12:01:02 +02006932#endif /* MBEDTLS_PSA_BUILTIN_ALG_ECDH */
Przemek Stekielfb3dd542022-12-01 14:59:15 +01006933
6934#if defined(MBEDTLS_PSA_BUILTIN_ALG_FFDH)
6935 case PSA_ALG_FFDH:
Przemek Stekiel152bb462023-06-01 11:52:39 +02006936 return mbedtls_psa_ffdh_key_agreement(attributes,
Przemek Stekiel359f4622022-12-05 14:11:55 +01006937 peer_key,
6938 peer_key_length,
6939 key_buffer,
6940 key_buffer_size,
6941 shared_secret,
6942 shared_secret_size,
6943 shared_secret_length);
Przemek Stekielfb3dd542022-12-01 14:59:15 +01006944#endif /* MBEDTLS_PSA_BUILTIN_ALG_FFDH */
6945
Gilles Peskine01d718c2018-09-18 12:01:02 +02006946 default:
Aditya Deshpande17845b82022-10-13 17:21:01 +01006947 (void) attributes;
6948 (void) key_buffer;
6949 (void) key_buffer_size;
Gilles Peskine93f85002018-11-16 16:43:31 +01006950 (void) peer_key;
6951 (void) peer_key_length;
Gilles Peskine0216fe12019-04-11 21:23:21 +02006952 (void) shared_secret;
6953 (void) shared_secret_size;
6954 (void) shared_secret_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01006955 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine01d718c2018-09-18 12:01:02 +02006956 }
Gilles Peskine0216fe12019-04-11 21:23:21 +02006957}
Gilles Peskine01d718c2018-09-18 12:01:02 +02006958
Aditya Deshpande17845b82022-10-13 17:21:01 +01006959/** Internal function for raw key agreement
6960 * Calls the driver wrapper which will hand off key agreement task
Aditya Deshpande40c05cc2022-10-14 16:41:40 +01006961 * to the driver's implementation if a driver is present.
6962 * Fallback specified in the driver wrapper is built-in raw key agreement
Aditya Deshpande17845b82022-10-13 17:21:01 +01006963 * (psa_key_agreement_raw_builtin).
6964 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006965static psa_status_t psa_key_agreement_raw_internal(psa_algorithm_t alg,
6966 psa_key_slot_t *private_key,
6967 const uint8_t *peer_key,
6968 size_t peer_key_length,
6969 uint8_t *shared_secret,
6970 size_t shared_secret_size,
6971 size_t *shared_secret_length)
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006972{
Gilles Peskine449bd832023-01-11 14:50:10 +01006973 if (!PSA_ALG_IS_RAW_KEY_AGREEMENT(alg)) {
6974 return PSA_ERROR_NOT_SUPPORTED;
6975 }
Aditya Deshpande17845b82022-10-13 17:21:01 +01006976
6977 psa_key_attributes_t attributes = {
Gilles Peskine449bd832023-01-11 14:50:10 +01006978 .core = private_key->attr
Aditya Deshpande17845b82022-10-13 17:21:01 +01006979 };
6980
Gilles Peskine449bd832023-01-11 14:50:10 +01006981 return psa_driver_wrapper_key_agreement(&attributes,
6982 private_key->key.data,
6983 private_key->key.bytes, alg,
6984 peer_key, peer_key_length,
6985 shared_secret,
6986 shared_secret_size,
6987 shared_secret_length);
Gilles Peskine0216fe12019-04-11 21:23:21 +02006988}
6989
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02006990/* Note that if this function fails, you must call psa_key_derivation_abort()
Gilles Peskine01d718c2018-09-18 12:01:02 +02006991 * to potentially free embedded data structures and wipe confidential data.
6992 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006993static psa_status_t psa_key_agreement_internal(psa_key_derivation_operation_t *operation,
6994 psa_key_derivation_step_t step,
6995 psa_key_slot_t *private_key,
6996 const uint8_t *peer_key,
6997 size_t peer_key_length)
Gilles Peskine01d718c2018-09-18 12:01:02 +02006998{
6999 psa_status_t status;
Aditya Deshpande2f7fd762022-11-22 11:10:34 +00007000 uint8_t shared_secret[PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE];
Gilles Peskine01d718c2018-09-18 12:01:02 +02007001 size_t shared_secret_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01007002 psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE(operation->alg);
Gilles Peskine01d718c2018-09-18 12:01:02 +02007003
7004 /* Step 1: run the secret agreement algorithm to generate the shared
7005 * secret. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007006 status = psa_key_agreement_raw_internal(ka_alg,
7007 private_key,
7008 peer_key, peer_key_length,
7009 shared_secret,
7010 sizeof(shared_secret),
7011 &shared_secret_length);
7012 if (status != PSA_SUCCESS) {
Gilles Peskine12313cd2018-06-20 00:20:32 +02007013 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007014 }
Gilles Peskine12313cd2018-06-20 00:20:32 +02007015
Gilles Peskineb0b255c2018-07-06 17:01:38 +02007016 /* Step 2: set up the key derivation to generate key material from
Gilles Peskine224b0d62019-09-23 18:13:17 +02007017 * the shared secret. A shared secret is permitted wherever a key
7018 * of type DERIVE is permitted. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007019 status = psa_key_derivation_input_internal(operation, step,
7020 PSA_KEY_TYPE_DERIVE,
7021 shared_secret,
7022 shared_secret_length);
Gilles Peskine12313cd2018-06-20 00:20:32 +02007023exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01007024 mbedtls_platform_zeroize(shared_secret, shared_secret_length);
7025 return status;
Gilles Peskine12313cd2018-06-20 00:20:32 +02007026}
7027
Gilles Peskine449bd832023-01-11 14:50:10 +01007028psa_status_t psa_key_derivation_key_agreement(psa_key_derivation_operation_t *operation,
7029 psa_key_derivation_step_t step,
7030 mbedtls_svc_key_id_t private_key,
7031 const uint8_t *peer_key,
7032 size_t peer_key_length)
Gilles Peskine12313cd2018-06-20 00:20:32 +02007033{
Ronald Cronf95a2b12020-10-22 15:24:49 +02007034 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01007035 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01007036 psa_key_slot_t *slot;
Ronald Cronf95a2b12020-10-22 15:24:49 +02007037
Gilles Peskine449bd832023-01-11 14:50:10 +01007038 if (!PSA_ALG_IS_KEY_AGREEMENT(operation->alg)) {
7039 return PSA_ERROR_INVALID_ARGUMENT;
7040 }
Ronald Cron5c522922020-11-14 16:35:34 +01007041 status = psa_get_and_lock_transparent_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01007042 private_key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg);
7043 if (status != PSA_SUCCESS) {
7044 return status;
7045 }
7046 status = psa_key_agreement_internal(operation, step,
7047 slot,
7048 peer_key, peer_key_length);
7049 if (status != PSA_SUCCESS) {
7050 psa_key_derivation_abort(operation);
7051 } else {
Steven Cooremanfa5e6312020-10-15 17:07:12 +02007052 /* If a private key has been added as SECRET, we allow the derived
7053 * key material to be used as a key in PSA Crypto. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007054 if (step == PSA_KEY_DERIVATION_INPUT_SECRET) {
Steven Cooremanfa5e6312020-10-15 17:07:12 +02007055 operation->can_output_key = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01007056 }
Steven Cooremanfa5e6312020-10-15 17:07:12 +02007057 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02007058
Ryan Everett1b70a072024-01-04 10:32:49 +00007059 unlock_status = psa_unregister_read(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02007060
Gilles Peskine449bd832023-01-11 14:50:10 +01007061 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskineaf3baab2018-06-27 22:55:52 +02007062}
7063
Gilles Peskine449bd832023-01-11 14:50:10 +01007064psa_status_t psa_raw_key_agreement(psa_algorithm_t alg,
7065 mbedtls_svc_key_id_t private_key,
7066 const uint8_t *peer_key,
7067 size_t peer_key_length,
7068 uint8_t *output,
7069 size_t output_size,
7070 size_t *output_length)
Gilles Peskine0216fe12019-04-11 21:23:21 +02007071{
Ronald Cronf95a2b12020-10-22 15:24:49 +02007072 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01007073 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cronf95a2b12020-10-22 15:24:49 +02007074 psa_key_slot_t *slot = NULL;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01007075 size_t expected_length;
Gilles Peskine0216fe12019-04-11 21:23:21 +02007076
Gilles Peskine449bd832023-01-11 14:50:10 +01007077 if (!PSA_ALG_IS_KEY_AGREEMENT(alg)) {
Gilles Peskine0216fe12019-04-11 21:23:21 +02007078 status = PSA_ERROR_INVALID_ARGUMENT;
7079 goto exit;
7080 }
Ronald Cron5c522922020-11-14 16:35:34 +01007081 status = psa_get_and_lock_transparent_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01007082 private_key, &slot, PSA_KEY_USAGE_DERIVE, alg);
7083 if (status != PSA_SUCCESS) {
Gilles Peskine0216fe12019-04-11 21:23:21 +02007084 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007085 }
Gilles Peskine0216fe12019-04-11 21:23:21 +02007086
Gilles Peskine3e561302022-04-14 00:17:15 +02007087 /* PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() is in general an upper bound
7088 * for the output size. The PSA specification only guarantees that this
7089 * function works if output_size >= PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE(...),
7090 * but it might be nice to allow smaller buffers if the output fits.
7091 * At the time of writing this comment, with only ECDH implemented,
7092 * PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() is exact so the point is moot.
7093 * If FFDH is implemented, PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() can easily
7094 * be exact for it as well. */
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01007095 expected_length =
Gilles Peskine449bd832023-01-11 14:50:10 +01007096 PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE(slot->attr.type, slot->attr.bits);
7097 if (output_size < expected_length) {
Gilles Peskine3e561302022-04-14 00:17:15 +02007098 status = PSA_ERROR_BUFFER_TOO_SMALL;
7099 goto exit;
7100 }
7101
Gilles Peskine449bd832023-01-11 14:50:10 +01007102 status = psa_key_agreement_raw_internal(alg, slot,
7103 peer_key, peer_key_length,
7104 output, output_size,
7105 output_length);
Gilles Peskine0216fe12019-04-11 21:23:21 +02007106
7107exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01007108 if (status != PSA_SUCCESS) {
Gilles Peskine0216fe12019-04-11 21:23:21 +02007109 /* If an error happens and is not handled properly, the output
7110 * may be used as a key to protect sensitive data. Arrange for such
7111 * a key to be random, which is likely to result in decryption or
7112 * verification errors. This is better than filling the buffer with
7113 * some constant data such as zeros, which would result in the data
7114 * being protected with a reproducible, easily knowable key.
7115 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007116 psa_generate_random(output, output_size);
Gilles Peskine0216fe12019-04-11 21:23:21 +02007117 *output_length = output_size;
7118 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02007119
Ryan Everett1b70a072024-01-04 10:32:49 +00007120 unlock_status = psa_unregister_read(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02007121
Gilles Peskine449bd832023-01-11 14:50:10 +01007122 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine0216fe12019-04-11 21:23:21 +02007123}
Gilles Peskine86a440b2018-11-12 18:39:40 +01007124
7125
Gilles Peskine30524eb2020-11-13 17:02:26 +01007126
Gilles Peskine86a440b2018-11-12 18:39:40 +01007127/****************************************************************/
7128/* Random generation */
Gilles Peskine53d991e2018-07-12 01:14:59 +02007129/****************************************************************/
Gilles Peskine12313cd2018-06-20 00:20:32 +02007130
Gilles Peskine672a7712023-04-28 21:00:28 +02007131#if defined(MBEDTLS_PSA_INJECT_ENTROPY)
7132#include "entropy_poll.h"
7133#endif
7134
Gilles Peskine30524eb2020-11-13 17:02:26 +01007135/** Initialize the PSA random generator.
7136 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007137static void mbedtls_psa_random_init(mbedtls_psa_random_context_t *rng)
Gilles Peskine30524eb2020-11-13 17:02:26 +01007138{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007139#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
Gilles Peskine449bd832023-01-11 14:50:10 +01007140 memset(rng, 0, sizeof(*rng));
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007141#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
7142
Gilles Peskine30524eb2020-11-13 17:02:26 +01007143 /* Set default configuration if
7144 * mbedtls_psa_crypto_configure_entropy_sources() hasn't been called. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007145 if (rng->entropy_init == NULL) {
Gilles Peskine30524eb2020-11-13 17:02:26 +01007146 rng->entropy_init = mbedtls_entropy_init;
Gilles Peskine449bd832023-01-11 14:50:10 +01007147 }
7148 if (rng->entropy_free == NULL) {
Gilles Peskine30524eb2020-11-13 17:02:26 +01007149 rng->entropy_free = mbedtls_entropy_free;
Gilles Peskine449bd832023-01-11 14:50:10 +01007150 }
Gilles Peskine30524eb2020-11-13 17:02:26 +01007151
Gilles Peskine449bd832023-01-11 14:50:10 +01007152 rng->entropy_init(&rng->entropy);
Gilles Peskine30524eb2020-11-13 17:02:26 +01007153#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \
7154 defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES)
7155 /* The PSA entropy injection feature depends on using NV seed as an entropy
7156 * source. Add NV seed as an entropy source for PSA entropy injection. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007157 mbedtls_entropy_add_source(&rng->entropy,
7158 mbedtls_nv_seed_poll, NULL,
7159 MBEDTLS_ENTROPY_BLOCK_SIZE,
7160 MBEDTLS_ENTROPY_SOURCE_STRONG);
Gilles Peskine30524eb2020-11-13 17:02:26 +01007161#endif
7162
Gilles Peskine449bd832023-01-11 14:50:10 +01007163 mbedtls_psa_drbg_init(MBEDTLS_PSA_RANDOM_STATE);
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007164#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01007165}
7166
7167/** Deinitialize the PSA random generator.
7168 */
Valerio Setti83e0de82023-11-24 12:13:05 +01007169static void mbedtls_psa_random_free(mbedtls_psa_random_context_t *rng)
Gilles Peskine30524eb2020-11-13 17:02:26 +01007170{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007171#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
Valerio Setti83e0de82023-11-24 12:13:05 +01007172 memset(rng, 0, sizeof(*rng));
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007173#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Valerio Setti83e0de82023-11-24 12:13:05 +01007174 mbedtls_psa_drbg_free(MBEDTLS_PSA_RANDOM_STATE);
7175 rng->entropy_free(&rng->entropy);
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007176#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01007177}
7178
7179/** Seed the PSA random generator.
7180 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007181static psa_status_t mbedtls_psa_random_seed(mbedtls_psa_random_context_t *rng)
Gilles Peskine30524eb2020-11-13 17:02:26 +01007182{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007183#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
7184 /* Do nothing: the external RNG seeds itself. */
7185 (void) rng;
Gilles Peskine449bd832023-01-11 14:50:10 +01007186 return PSA_SUCCESS;
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007187#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01007188 const unsigned char drbg_seed[] = "PSA";
Gilles Peskine449bd832023-01-11 14:50:10 +01007189 int ret = mbedtls_psa_drbg_seed(&rng->entropy,
7190 drbg_seed, sizeof(drbg_seed) - 1);
7191 return mbedtls_to_psa_error(ret);
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007192#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01007193}
7194
Gilles Peskine449bd832023-01-11 14:50:10 +01007195psa_status_t psa_generate_random(uint8_t *output,
7196 size_t output_size)
Gilles Peskinee59236f2018-01-27 23:32:46 +01007197{
Gilles Peskinee59236f2018-01-27 23:32:46 +01007198 GUARD_MODULE_INITIALIZED;
7199
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007200#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
7201
7202 size_t output_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01007203 psa_status_t status = mbedtls_psa_external_get_random(&global_data.rng,
7204 output, output_size,
7205 &output_length);
7206 if (status != PSA_SUCCESS) {
7207 return status;
7208 }
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007209 /* Breaking up a request into smaller chunks is currently not supported
Tom Cosgrove1797b052022-12-04 17:19:59 +00007210 * for the external RNG interface. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007211 if (output_length != output_size) {
7212 return PSA_ERROR_INSUFFICIENT_ENTROPY;
7213 }
7214 return PSA_SUCCESS;
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007215
7216#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
7217
Gilles Peskine449bd832023-01-11 14:50:10 +01007218 while (output_size > 0) {
Gilles Peskine71ddab92021-01-04 21:01:07 +01007219 size_t request_size =
Gilles Peskine449bd832023-01-11 14:50:10 +01007220 (output_size > MBEDTLS_PSA_RANDOM_MAX_REQUEST ?
7221 MBEDTLS_PSA_RANDOM_MAX_REQUEST :
7222 output_size);
7223 int ret = mbedtls_psa_get_random(MBEDTLS_PSA_RANDOM_STATE,
7224 output, request_size);
7225 if (ret != 0) {
7226 return mbedtls_to_psa_error(ret);
7227 }
Gilles Peskine71ddab92021-01-04 21:01:07 +01007228 output_size -= request_size;
7229 output += request_size;
Gilles Peskinef181eca2019-08-07 13:49:00 +02007230 }
Gilles Peskine449bd832023-01-11 14:50:10 +01007231 return PSA_SUCCESS;
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007232#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskinee59236f2018-01-27 23:32:46 +01007233}
7234
Gilles Peskine8814fc42020-12-14 15:33:44 +01007235/* Wrapper function allowing the classic API to use the PSA RNG.
Gilles Peskine9c3e0602021-01-05 16:03:55 +01007236 *
7237 * `mbedtls_psa_get_random(MBEDTLS_PSA_RANDOM_STATE, ...)` calls
7238 * `psa_generate_random(...)`. The state parameter is ignored since the
7239 * PSA API doesn't support passing an explicit state.
7240 *
7241 * In the non-external case, psa_generate_random() calls an
7242 * `mbedtls_xxx_drbg_random` function which has exactly the same signature
7243 * and semantics as mbedtls_psa_get_random(). As an optimization,
7244 * instead of doing this back-and-forth between the PSA API and the
7245 * classic API, psa_crypto_random_impl.h defines `mbedtls_psa_get_random`
7246 * as a constant function pointer to `mbedtls_xxx_drbg_random`.
Gilles Peskine8814fc42020-12-14 15:33:44 +01007247 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007248#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
7249int mbedtls_psa_get_random(void *p_rng,
7250 unsigned char *output,
7251 size_t output_size)
Gilles Peskine8814fc42020-12-14 15:33:44 +01007252{
Gilles Peskine9c3e0602021-01-05 16:03:55 +01007253 /* This function takes a pointer to the RNG state because that's what
7254 * classic mbedtls functions using an RNG expect. The PSA RNG manages
7255 * its own state internally and doesn't let the caller access that state.
7256 * So we just ignore the state parameter, and in practice we'll pass
7257 * NULL. */
Gilles Peskine8814fc42020-12-14 15:33:44 +01007258 (void) p_rng;
Gilles Peskine449bd832023-01-11 14:50:10 +01007259 psa_status_t status = psa_generate_random(output, output_size);
7260 if (status == PSA_SUCCESS) {
7261 return 0;
7262 } else {
7263 return MBEDTLS_ERR_ENTROPY_SOURCE_FAILED;
7264 }
Gilles Peskine8814fc42020-12-14 15:33:44 +01007265}
7266#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
7267
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01007268#if defined(MBEDTLS_PSA_INJECT_ENTROPY)
Gilles Peskine449bd832023-01-11 14:50:10 +01007269psa_status_t mbedtls_psa_inject_entropy(const uint8_t *seed,
7270 size_t seed_size)
Netanel Gonen2bcd3122018-11-19 11:53:02 +02007271{
Gilles Peskine449bd832023-01-11 14:50:10 +01007272 if (global_data.initialized) {
7273 return PSA_ERROR_NOT_PERMITTED;
7274 }
Netanel Gonen21f37cb2018-11-19 11:53:55 +02007275
Gilles Peskine449bd832023-01-11 14:50:10 +01007276 if (((seed_size < MBEDTLS_ENTROPY_MIN_PLATFORM) ||
7277 (seed_size < MBEDTLS_ENTROPY_BLOCK_SIZE)) ||
7278 (seed_size > MBEDTLS_ENTROPY_MAX_SEED_SIZE)) {
7279 return PSA_ERROR_INVALID_ARGUMENT;
7280 }
Netanel Gonen21f37cb2018-11-19 11:53:55 +02007281
Gilles Peskine449bd832023-01-11 14:50:10 +01007282 return mbedtls_psa_storage_inject_entropy(seed, seed_size);
Netanel Gonen2bcd3122018-11-19 11:53:02 +02007283}
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01007284#endif /* MBEDTLS_PSA_INJECT_ENTROPY */
Netanel Gonen2bcd3122018-11-19 11:53:02 +02007285
Ronald Cron3772afe2021-02-08 16:10:05 +01007286/** Validate the key type and size for key generation
Ronald Cron01b2aba2020-10-05 09:42:02 +02007287 *
Ronald Cron3772afe2021-02-08 16:10:05 +01007288 * \param type The key type
7289 * \param bits The number of bits of the key
Ronald Cron01b2aba2020-10-05 09:42:02 +02007290 *
7291 * \retval #PSA_SUCCESS
Ronald Cron3772afe2021-02-08 16:10:05 +01007292 * The key type and size are valid.
Ronald Cron01b2aba2020-10-05 09:42:02 +02007293 * \retval #PSA_ERROR_INVALID_ARGUMENT
7294 * The size in bits of the key is not valid.
7295 * \retval #PSA_ERROR_NOT_SUPPORTED
7296 * The type and/or the size in bits of the key or the combination of
7297 * the two is not supported.
7298 */
Ronald Cron3772afe2021-02-08 16:10:05 +01007299static psa_status_t psa_validate_key_type_and_size_for_key_generation(
Gilles Peskine449bd832023-01-11 14:50:10 +01007300 psa_key_type_t type, size_t bits)
Gilles Peskinee59236f2018-01-27 23:32:46 +01007301{
Ronald Cronf3bb7612020-10-02 20:11:59 +02007302 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinee59236f2018-01-27 23:32:46 +01007303
Gilles Peskine449bd832023-01-11 14:50:10 +01007304 if (key_type_is_raw_bytes(type)) {
7305 status = psa_validate_unstructured_key_bit_size(type, bits);
7306 if (status != PSA_SUCCESS) {
7307 return status;
7308 }
7309 } else
Valerio Settif6d4dfb2023-07-10 10:55:12 +02007310#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01007311 if (PSA_KEY_TYPE_IS_RSA(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
7312 if (bits > PSA_VENDOR_RSA_MAX_KEY_BITS) {
7313 return PSA_ERROR_NOT_SUPPORTED;
7314 }
Waleed Elmelegyd7bdbbe2023-07-20 16:26:58 +00007315 if (bits < PSA_VENDOR_RSA_GENERATE_MIN_KEY_BITS) {
Waleed Elmelegyab570712023-07-05 16:40:58 +00007316 return PSA_ERROR_NOT_SUPPORTED;
7317 }
Steven Cooreman81be2fa2020-07-24 22:04:59 +02007318
Ronald Cron01b2aba2020-10-05 09:42:02 +02007319 /* Accept only byte-aligned keys, for the same reasons as
7320 * in psa_import_rsa_key(). */
Gilles Peskine449bd832023-01-11 14:50:10 +01007321 if (bits % 8 != 0) {
7322 return PSA_ERROR_NOT_SUPPORTED;
7323 }
7324 } else
Valerio Settif6d4dfb2023-07-10 10:55:12 +02007325#endif /* defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE) */
Ronald Cron01b2aba2020-10-05 09:42:02 +02007326
Valerio Setti6a9d0ee2023-06-21 10:07:21 +02007327#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01007328 if (PSA_KEY_TYPE_IS_ECC(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
Ronald Crond81ab562021-02-16 09:01:16 +01007329 /* To avoid empty block, return successfully here. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007330 return PSA_SUCCESS;
7331 } else
Valerio Setti6a9d0ee2023-06-21 10:07:21 +02007332#endif /* defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE) */
Przemek Stekielfedd1342022-12-01 15:00:02 +01007333
Valerio Settia55f0422023-07-10 15:34:41 +02007334#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE)
Przemek Stekielfedd1342022-12-01 15:00:02 +01007335 if (PSA_KEY_TYPE_IS_DH(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
Przemek Stekield1cf1ba2023-04-27 12:04:21 +02007336 if (psa_is_dh_key_size_valid(bits) == 0) {
Przemek Stekielfedd1342022-12-01 15:00:02 +01007337 return PSA_ERROR_NOT_SUPPORTED;
7338 }
7339 } else
Valerio Settia55f0422023-07-10 15:34:41 +02007340#endif /* defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE) */
Ronald Cron01b2aba2020-10-05 09:42:02 +02007341 {
Gilles Peskine449bd832023-01-11 14:50:10 +01007342 return PSA_ERROR_NOT_SUPPORTED;
Ronald Cron01b2aba2020-10-05 09:42:02 +02007343 }
7344
Gilles Peskine449bd832023-01-11 14:50:10 +01007345 return PSA_SUCCESS;
Ronald Cron01b2aba2020-10-05 09:42:02 +02007346}
7347
Ronald Cron55ed0592020-10-05 10:30:40 +02007348psa_status_t psa_generate_key_internal(
Ronald Cron2a38a6b2020-10-02 20:02:04 +02007349 const psa_key_attributes_t *attributes,
Gilles Peskine449bd832023-01-11 14:50:10 +01007350 uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length)
Ronald Cron01b2aba2020-10-05 09:42:02 +02007351{
7352 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron2a38a6b2020-10-02 20:02:04 +02007353 psa_key_type_t type = attributes->core.type;
Ronald Cron01b2aba2020-10-05 09:42:02 +02007354
Gilles Peskine449bd832023-01-11 14:50:10 +01007355 if ((attributes->domain_parameters == NULL) &&
7356 (attributes->domain_parameters_size != 0)) {
7357 return PSA_ERROR_INVALID_ARGUMENT;
7358 }
Ronald Cron01b2aba2020-10-05 09:42:02 +02007359
Gilles Peskine449bd832023-01-11 14:50:10 +01007360 if (key_type_is_raw_bytes(type)) {
7361 status = psa_generate_random(key_buffer, key_buffer_size);
7362 if (status != PSA_SUCCESS) {
7363 return status;
7364 }
Steven Cooreman81be2fa2020-07-24 22:04:59 +02007365
David Brown12ca5032021-02-11 11:02:00 -07007366#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Gilles Peskine449bd832023-01-11 14:50:10 +01007367 if (type == PSA_KEY_TYPE_DES) {
7368 psa_des_set_key_parity(key_buffer, key_buffer_size);
7369 }
David Brown8107e312021-02-12 08:08:46 -07007370#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */
Gilles Peskine449bd832023-01-11 14:50:10 +01007371 } else
Gilles Peskinee59236f2018-01-27 23:32:46 +01007372
Valerio Setti76df8c12023-07-11 14:11:28 +02007373#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_GENERATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01007374 if (type == PSA_KEY_TYPE_RSA_KEY_PAIR) {
7375 return mbedtls_psa_rsa_generate_key(attributes,
7376 key_buffer,
7377 key_buffer_size,
7378 key_buffer_length);
7379 } else
Valerio Setti76df8c12023-07-11 14:11:28 +02007380#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_GENERATE) */
Gilles Peskinee59236f2018-01-27 23:32:46 +01007381
Valerio Settibfeaf5b2023-06-20 13:27:46 +02007382#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01007383 if (PSA_KEY_TYPE_IS_ECC(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
7384 return mbedtls_psa_ecp_generate_key(attributes,
7385 key_buffer,
7386 key_buffer_size,
7387 key_buffer_length);
7388 } else
Valerio Settibfeaf5b2023-06-20 13:27:46 +02007389#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE) */
Przemek Stekielfedd1342022-12-01 15:00:02 +01007390
Valerio Settia55f0422023-07-10 15:34:41 +02007391#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE)
Przemek Stekielfedd1342022-12-01 15:00:02 +01007392 if (PSA_KEY_TYPE_IS_DH(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
7393 return mbedtls_psa_ffdh_generate_key(attributes,
7394 key_buffer,
7395 key_buffer_size,
7396 key_buffer_length);
7397 } else
Valerio Settia55f0422023-07-10 15:34:41 +02007398#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE) */
Steven Cooreman29149862020-08-05 15:43:42 +02007399 {
Gilles Peskine449bd832023-01-11 14:50:10 +01007400 (void) key_buffer_length;
7401 return PSA_ERROR_NOT_SUPPORTED;
Steven Cooreman29149862020-08-05 15:43:42 +02007402 }
Gilles Peskinee59236f2018-01-27 23:32:46 +01007403
Gilles Peskine449bd832023-01-11 14:50:10 +01007404 return PSA_SUCCESS;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02007405}
Darryl Green0c6575a2018-11-07 16:05:30 +00007406
Gilles Peskine449bd832023-01-11 14:50:10 +01007407psa_status_t psa_generate_key(const psa_key_attributes_t *attributes,
7408 mbedtls_svc_key_id_t *key)
Gilles Peskineff5f0e72019-04-18 12:53:30 +02007409{
7410 psa_status_t status;
7411 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02007412 psa_se_drv_table_entry_t *driver = NULL;
Ronald Cron2b56bc82020-10-05 10:02:26 +02007413 size_t key_buffer_size;
Gilles Peskine11792082019-08-06 18:36:36 +02007414
Ronald Cron81709fc2020-11-14 12:10:32 +01007415 *key = MBEDTLS_SVC_KEY_ID_INIT;
7416
Gilles Peskine0f84d622019-09-12 19:03:13 +02007417 /* Reject any attempt to create a zero-length key so that we don't
7418 * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007419 if (psa_get_key_bits(attributes) == 0) {
7420 return PSA_ERROR_INVALID_ARGUMENT;
7421 }
Gilles Peskine0f84d622019-09-12 19:03:13 +02007422
Przemyslaw Stekielc0fe8202021-10-07 11:08:56 +02007423 /* Reject any attempt to create a public key. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007424 if (PSA_KEY_TYPE_IS_PUBLIC_KEY(attributes->core.type)) {
7425 return PSA_ERROR_INVALID_ARGUMENT;
7426 }
Przemyslaw Stekielc0fe8202021-10-07 11:08:56 +02007427
Gilles Peskine449bd832023-01-11 14:50:10 +01007428 status = psa_start_key_creation(PSA_KEY_CREATION_GENERATE, attributes,
7429 &slot, &driver);
7430 if (status != PSA_SUCCESS) {
Gilles Peskine11792082019-08-06 18:36:36 +02007431 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007432 }
Gilles Peskine11792082019-08-06 18:36:36 +02007433
Ronald Cron977c2472020-10-13 08:32:21 +02007434 /* In the case of a transparent key or an opaque key stored in local
Archana449608b2021-09-08 15:36:05 +05307435 * storage ( thus not in the case of generating a key in a secure element
7436 * with storage ( MBEDTLS_PSA_CRYPTO_SE_C ) ),we have to allocate a
7437 * buffer to hold the generated key material. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007438 if (slot->key.data == NULL) {
7439 if (PSA_KEY_LIFETIME_GET_LOCATION(attributes->core.lifetime) ==
7440 PSA_KEY_LOCATION_LOCAL_STORAGE) {
Ronald Cron3772afe2021-02-08 16:10:05 +01007441 status = psa_validate_key_type_and_size_for_key_generation(
Gilles Peskine449bd832023-01-11 14:50:10 +01007442 attributes->core.type, attributes->core.bits);
7443 if (status != PSA_SUCCESS) {
Ronald Cron3772afe2021-02-08 16:10:05 +01007444 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007445 }
Ronald Cron3772afe2021-02-08 16:10:05 +01007446
7447 key_buffer_size = PSA_EXPORT_KEY_OUTPUT_SIZE(
Gilles Peskine449bd832023-01-11 14:50:10 +01007448 attributes->core.type,
7449 attributes->core.bits);
7450 } else {
Ronald Cron977c2472020-10-13 08:32:21 +02007451 status = psa_driver_wrapper_get_key_buffer_size(
Gilles Peskine449bd832023-01-11 14:50:10 +01007452 attributes, &key_buffer_size);
7453 if (status != PSA_SUCCESS) {
Ronald Cron3772afe2021-02-08 16:10:05 +01007454 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007455 }
Ronald Cron977c2472020-10-13 08:32:21 +02007456 }
Ronald Cron977c2472020-10-13 08:32:21 +02007457
Gilles Peskine449bd832023-01-11 14:50:10 +01007458 status = psa_allocate_buffer_to_slot(slot, key_buffer_size);
7459 if (status != PSA_SUCCESS) {
Ronald Cron977c2472020-10-13 08:32:21 +02007460 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007461 }
Ronald Cron977c2472020-10-13 08:32:21 +02007462 }
7463
Gilles Peskine449bd832023-01-11 14:50:10 +01007464 status = psa_driver_wrapper_generate_key(attributes,
7465 slot->key.data, slot->key.bytes, &slot->key.bytes);
Gilles Peskine11792082019-08-06 18:36:36 +02007466
Gilles Peskine449bd832023-01-11 14:50:10 +01007467 if (status != PSA_SUCCESS) {
7468 psa_remove_key_data_from_memory(slot);
7469 }
Ronald Cron2b56bc82020-10-05 10:02:26 +02007470
Gilles Peskine11792082019-08-06 18:36:36 +02007471exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01007472 if (status == PSA_SUCCESS) {
7473 status = psa_finish_key_creation(slot, driver, key);
7474 }
7475 if (status != PSA_SUCCESS) {
7476 psa_fail_key_creation(slot, driver);
7477 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02007478
Gilles Peskine449bd832023-01-11 14:50:10 +01007479 return status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01007480}
7481
Gilles Peskinee59236f2018-01-27 23:32:46 +01007482/****************************************************************/
7483/* Module setup */
7484/****************************************************************/
7485
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007486#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
Gilles Peskine5e769522018-11-20 21:59:56 +01007487psa_status_t mbedtls_psa_crypto_configure_entropy_sources(
Gilles Peskine449bd832023-01-11 14:50:10 +01007488 void (* entropy_init)(mbedtls_entropy_context *ctx),
7489 void (* entropy_free)(mbedtls_entropy_context *ctx))
Gilles Peskine5e769522018-11-20 21:59:56 +01007490{
Gilles Peskine449bd832023-01-11 14:50:10 +01007491 if (global_data.rng_state != RNG_NOT_INITIALIZED) {
7492 return PSA_ERROR_BAD_STATE;
7493 }
Gilles Peskine30524eb2020-11-13 17:02:26 +01007494 global_data.rng.entropy_init = entropy_init;
7495 global_data.rng.entropy_free = entropy_free;
Gilles Peskine449bd832023-01-11 14:50:10 +01007496 return PSA_SUCCESS;
Gilles Peskine5e769522018-11-20 21:59:56 +01007497}
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007498#endif /* !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) */
Gilles Peskine5e769522018-11-20 21:59:56 +01007499
Gilles Peskine449bd832023-01-11 14:50:10 +01007500void mbedtls_psa_crypto_free(void)
Gilles Peskinee59236f2018-01-27 23:32:46 +01007501{
Gilles Peskine449bd832023-01-11 14:50:10 +01007502 psa_wipe_all_key_slots();
Valerio Setti83e0de82023-11-24 12:13:05 +01007503 if (global_data.rng_state != RNG_NOT_INITIALIZED) {
7504 mbedtls_psa_random_free(&global_data.rng);
7505 }
Gilles Peskinec6b69072018-11-20 21:42:52 +01007506 /* Wipe all remaining data, including configuration.
7507 * In particular, this sets all state indicator to the value
7508 * indicating "uninitialized". */
Gilles Peskine449bd832023-01-11 14:50:10 +01007509 mbedtls_platform_zeroize(&global_data, sizeof(global_data));
Ronald Cron9ba76912021-04-10 16:57:30 +02007510
7511 /* Terminate drivers */
Gilles Peskine449bd832023-01-11 14:50:10 +01007512 psa_driver_wrapper_free();
Gilles Peskinee59236f2018-01-27 23:32:46 +01007513}
7514
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02007515#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
7516/** Recover a transaction that was interrupted by a power failure.
7517 *
7518 * This function is called during initialization, before psa_crypto_init()
7519 * returns. If this function returns a failure status, the initialization
7520 * fails.
7521 */
7522static psa_status_t psa_crypto_recover_transaction(
Gilles Peskine449bd832023-01-11 14:50:10 +01007523 const psa_crypto_transaction_t *transaction)
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02007524{
Gilles Peskine449bd832023-01-11 14:50:10 +01007525 switch (transaction->unknown.type) {
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02007526 case PSA_CRYPTO_TRANSACTION_CREATE_KEY:
7527 case PSA_CRYPTO_TRANSACTION_DESTROY_KEY:
Gilles Peskine449bd832023-01-11 14:50:10 +01007528 /* TODO - fall through to the failure case until this
7529 * is implemented.
7530 * https://github.com/ARMmbed/mbed-crypto/issues/218
7531 */
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02007532 default:
7533 /* We found an unsupported transaction in the storage.
7534 * We don't know what state the storage is in. Give up. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007535 return PSA_ERROR_DATA_INVALID;
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02007536 }
7537}
7538#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
7539
Gilles Peskine449bd832023-01-11 14:50:10 +01007540psa_status_t psa_crypto_init(void)
Gilles Peskinee59236f2018-01-27 23:32:46 +01007541{
Gilles Peskine66fb1262018-12-10 16:29:04 +01007542 psa_status_t status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01007543
Gilles Peskinec6b69072018-11-20 21:42:52 +01007544 /* Double initialization is explicitly allowed. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007545 if (global_data.initialized != 0) {
7546 return PSA_SUCCESS;
7547 }
Gilles Peskinee59236f2018-01-27 23:32:46 +01007548
Manuel Pégourié-Gonnard7abdf7e2023-03-09 11:17:43 +01007549 /* Init drivers */
7550 status = psa_driver_wrapper_init();
7551 if (status != PSA_SUCCESS) {
7552 goto exit;
7553 }
7554 global_data.drivers_initialized = 1;
7555
Valerio Setti402cfba2023-11-13 10:24:32 +01007556 status = psa_initialize_key_slots();
7557 if (status != PSA_SUCCESS) {
7558 goto exit;
7559 }
7560
Gilles Peskine30524eb2020-11-13 17:02:26 +01007561 /* Initialize and seed the random generator. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007562 mbedtls_psa_random_init(&global_data.rng);
Gilles Peskinec6b69072018-11-20 21:42:52 +01007563 global_data.rng_state = RNG_INITIALIZED;
Gilles Peskine449bd832023-01-11 14:50:10 +01007564 status = mbedtls_psa_random_seed(&global_data.rng);
7565 if (status != PSA_SUCCESS) {
Gilles Peskinee59236f2018-01-27 23:32:46 +01007566 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007567 }
Gilles Peskinec6b69072018-11-20 21:42:52 +01007568 global_data.rng_state = RNG_SEEDED;
Gilles Peskinee59236f2018-01-27 23:32:46 +01007569
Gilles Peskine4b734222019-07-24 15:56:31 +02007570#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
Gilles Peskine449bd832023-01-11 14:50:10 +01007571 status = psa_crypto_load_transaction();
7572 if (status == PSA_SUCCESS) {
7573 status = psa_crypto_recover_transaction(&psa_crypto_transaction);
7574 if (status != PSA_SUCCESS) {
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02007575 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007576 }
7577 status = psa_crypto_stop_transaction();
7578 } else if (status == PSA_ERROR_DOES_NOT_EXIST) {
Gilles Peskinefc762652019-07-22 19:30:34 +02007579 /* There's no transaction to complete. It's all good. */
7580 status = PSA_SUCCESS;
7581 }
Gilles Peskine4b734222019-07-24 15:56:31 +02007582#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
Gilles Peskinefc762652019-07-22 19:30:34 +02007583
Gilles Peskinec6b69072018-11-20 21:42:52 +01007584 /* All done. */
Gilles Peskinee59236f2018-01-27 23:32:46 +01007585 global_data.initialized = 1;
7586
7587exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01007588 if (status != PSA_SUCCESS) {
7589 mbedtls_psa_crypto_free();
7590 }
7591 return status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01007592}
7593
Yanray Wangffc3c482023-07-11 12:01:04 +08007594#if defined(PSA_WANT_ALG_SOME_PAKE)
Przemek Stekielca8d2b22023-01-17 16:21:33 +01007595psa_status_t psa_crypto_driver_pake_get_password_len(
7596 const psa_crypto_driver_pake_inputs_t *inputs,
7597 size_t *password_len)
7598{
7599 if (inputs->password_len == 0) {
7600 return PSA_ERROR_BAD_STATE;
7601 }
7602
7603 *password_len = inputs->password_len;
7604
7605 return PSA_SUCCESS;
7606}
7607
7608psa_status_t psa_crypto_driver_pake_get_password(
7609 const psa_crypto_driver_pake_inputs_t *inputs,
7610 uint8_t *buffer, size_t buffer_size, size_t *buffer_length)
7611{
7612 if (inputs->password_len == 0) {
7613 return PSA_ERROR_BAD_STATE;
7614 }
7615
7616 if (buffer_size < inputs->password_len) {
7617 return PSA_ERROR_BUFFER_TOO_SMALL;
7618 }
7619
7620 memcpy(buffer, inputs->password, inputs->password_len);
7621 *buffer_length = inputs->password_len;
7622
7623 return PSA_SUCCESS;
7624}
7625
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007626psa_status_t psa_crypto_driver_pake_get_user_len(
7627 const psa_crypto_driver_pake_inputs_t *inputs,
7628 size_t *user_len)
7629{
7630 if (inputs->user_len == 0) {
7631 return PSA_ERROR_BAD_STATE;
7632 }
7633
7634 *user_len = inputs->user_len;
7635
7636 return PSA_SUCCESS;
7637}
7638
7639psa_status_t psa_crypto_driver_pake_get_user(
7640 const psa_crypto_driver_pake_inputs_t *inputs,
Przemek Stekielc0e62502023-03-14 11:49:36 +01007641 uint8_t *user_id, size_t user_id_size, size_t *user_id_len)
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007642{
7643 if (inputs->user_len == 0) {
7644 return PSA_ERROR_BAD_STATE;
7645 }
7646
Przemek Stekielc0e62502023-03-14 11:49:36 +01007647 if (user_id_size < inputs->user_len) {
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007648 return PSA_ERROR_BUFFER_TOO_SMALL;
7649 }
7650
Przemek Stekielc0e62502023-03-14 11:49:36 +01007651 memcpy(user_id, inputs->user, inputs->user_len);
7652 *user_id_len = inputs->user_len;
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007653
7654 return PSA_SUCCESS;
7655}
7656
7657psa_status_t psa_crypto_driver_pake_get_peer_len(
7658 const psa_crypto_driver_pake_inputs_t *inputs,
7659 size_t *peer_len)
7660{
7661 if (inputs->peer_len == 0) {
7662 return PSA_ERROR_BAD_STATE;
7663 }
7664
7665 *peer_len = inputs->peer_len;
7666
7667 return PSA_SUCCESS;
7668}
7669
7670psa_status_t psa_crypto_driver_pake_get_peer(
7671 const psa_crypto_driver_pake_inputs_t *inputs,
Przemek Stekielc0e62502023-03-14 11:49:36 +01007672 uint8_t *peer_id, size_t peer_id_size, size_t *peer_id_length)
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007673{
7674 if (inputs->peer_len == 0) {
7675 return PSA_ERROR_BAD_STATE;
7676 }
7677
Przemek Stekielc0e62502023-03-14 11:49:36 +01007678 if (peer_id_size < inputs->peer_len) {
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007679 return PSA_ERROR_BUFFER_TOO_SMALL;
7680 }
7681
Przemek Stekielc0e62502023-03-14 11:49:36 +01007682 memcpy(peer_id, inputs->peer, inputs->peer_len);
7683 *peer_id_length = inputs->peer_len;
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007684
7685 return PSA_SUCCESS;
7686}
7687
Przemek Stekielca8d2b22023-01-17 16:21:33 +01007688psa_status_t psa_crypto_driver_pake_get_cipher_suite(
7689 const psa_crypto_driver_pake_inputs_t *inputs,
7690 psa_pake_cipher_suite_t *cipher_suite)
7691{
7692 if (inputs->cipher_suite.algorithm == PSA_ALG_NONE) {
7693 return PSA_ERROR_BAD_STATE;
7694 }
7695
7696 *cipher_suite = inputs->cipher_suite;
7697
7698 return PSA_SUCCESS;
7699}
7700
Neil Armstronga7d08c32022-06-01 18:21:20 +02007701psa_status_t psa_pake_setup(
7702 psa_pake_operation_t *operation,
7703 const psa_pake_cipher_suite_t *cipher_suite)
7704{
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007705 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007706
Przemek Stekiel1c3cfb42023-01-26 10:35:02 +01007707 if (operation->stage != PSA_PAKE_OPERATION_STAGE_SETUP) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007708 status = PSA_ERROR_BAD_STATE;
7709 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007710 }
7711
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01007712 if (PSA_ALG_IS_PAKE(cipher_suite->algorithm) == 0 ||
Przemek Stekiel51eac532022-12-07 11:04:51 +01007713 PSA_ALG_IS_HASH(cipher_suite->hash) == 0) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007714 status = PSA_ERROR_INVALID_ARGUMENT;
7715 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007716 }
7717
Przemek Stekiel51eac532022-12-07 11:04:51 +01007718 memset(&operation->data.inputs, 0, sizeof(operation->data.inputs));
7719
Przemek Stekiele12ed362022-12-21 12:54:46 +01007720 operation->alg = cipher_suite->algorithm;
Przemek Stekiel656b2592023-03-22 13:15:33 +01007721 operation->primitive = PSA_PAKE_PRIMITIVE(cipher_suite->type,
7722 cipher_suite->family, cipher_suite->bits);
Przemek Stekiel51eac532022-12-07 11:04:51 +01007723 operation->data.inputs.cipher_suite = *cipher_suite;
7724
Przemek Stekiel4aa99402023-02-27 13:00:57 +01007725#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01007726 if (operation->alg == PSA_ALG_JPAKE) {
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01007727 psa_jpake_computation_stage_t *computation_stage =
Przemek Stekieldde6a912023-01-26 08:46:37 +01007728 &operation->computation_stage.jpake;
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01007729
David Horstmann16f01512023-06-14 17:21:07 +01007730 memset(computation_stage, 0, sizeof(*computation_stage));
David Horstmanne7f21e62023-05-12 18:17:21 +01007731 computation_stage->step = PSA_PAKE_STEP_KEY_SHARE;
Przemek Stekiel80a88492023-02-20 13:32:22 +01007732 } else
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007733#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiel80a88492023-02-20 13:32:22 +01007734 {
7735 status = PSA_ERROR_NOT_SUPPORTED;
7736 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01007737 }
7738
Przemek Stekiel1c3cfb42023-01-26 10:35:02 +01007739 operation->stage = PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS;
7740
Przemek Stekiel51eac532022-12-07 11:04:51 +01007741 return PSA_SUCCESS;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007742exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007743 psa_pake_abort(operation);
7744 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02007745}
7746
7747psa_status_t psa_pake_set_password_key(
7748 psa_pake_operation_t *operation,
7749 mbedtls_svc_key_id_t password)
7750{
Neil Armstrong5ae60962022-09-15 11:29:46 +02007751 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel6c764412022-11-22 14:05:12 +01007752 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
7753 psa_key_slot_t *slot = NULL;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01007754 psa_key_attributes_t attributes;
7755 psa_key_type_t type;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007756
Przemek Stekiel51eac532022-12-07 11:04:51 +01007757 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007758 status = PSA_ERROR_BAD_STATE;
7759 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007760 }
7761
Przemek Stekiel6c764412022-11-22 14:05:12 +01007762 status = psa_get_and_lock_key_slot_with_policy(password, &slot,
7763 PSA_KEY_USAGE_DERIVE,
Przemek Stekield5d28a22023-01-26 10:46:05 +01007764 operation->alg);
Neil Armstrong5ae60962022-09-15 11:29:46 +02007765 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007766 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007767 }
7768
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01007769 attributes = (psa_key_attributes_t) {
Przemek Stekiel6c764412022-11-22 14:05:12 +01007770 .core = slot->attr
7771 };
Neil Armstrong5ae60962022-09-15 11:29:46 +02007772
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01007773 type = psa_get_key_type(&attributes);
Neil Armstrong5ae60962022-09-15 11:29:46 +02007774
Przemek Stekiel51eac532022-12-07 11:04:51 +01007775 if (type != PSA_KEY_TYPE_PASSWORD &&
7776 type != PSA_KEY_TYPE_PASSWORD_HASH) {
7777 status = PSA_ERROR_INVALID_ARGUMENT;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007778 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007779 }
7780
Przemek Stekiel51eac532022-12-07 11:04:51 +01007781 operation->data.inputs.password = mbedtls_calloc(1, slot->key.bytes);
7782 if (operation->data.inputs.password == NULL) {
Przemek Stekiele12ed362022-12-21 12:54:46 +01007783 status = PSA_ERROR_INSUFFICIENT_MEMORY;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007784 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007785 }
7786
7787 memcpy(operation->data.inputs.password, slot->key.data, slot->key.bytes);
7788 operation->data.inputs.password_len = slot->key.bytes;
Przemek Stekiel9dd24402023-01-26 15:06:09 +01007789 operation->data.inputs.attributes = attributes;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007790exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007791 if (status != PSA_SUCCESS) {
7792 psa_pake_abort(operation);
7793 }
Ryan Everett1b70a072024-01-04 10:32:49 +00007794 unlock_status = psa_unregister_read(slot);
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007795 return (status == PSA_SUCCESS) ? unlock_status : status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02007796}
7797
7798psa_status_t psa_pake_set_user(
7799 psa_pake_operation_t *operation,
7800 const uint8_t *user_id,
7801 size_t user_id_len)
7802{
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007803 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007804
7805 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007806 status = PSA_ERROR_BAD_STATE;
7807 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007808 }
7809
Przemek Stekiel51eac532022-12-07 11:04:51 +01007810 if (user_id_len == 0) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007811 status = PSA_ERROR_INVALID_ARGUMENT;
7812 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007813 }
7814
Przemek Stekielf309d6b2023-03-10 09:54:45 +01007815 if (operation->data.inputs.user_len != 0) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007816 status = PSA_ERROR_BAD_STATE;
7817 goto exit;
7818 }
7819
Przemek Stekielf309d6b2023-03-10 09:54:45 +01007820 operation->data.inputs.user = mbedtls_calloc(1, user_id_len);
7821 if (operation->data.inputs.user == NULL) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007822 status = PSA_ERROR_INSUFFICIENT_MEMORY;
7823 goto exit;
7824 }
7825
Przemek Stekielf309d6b2023-03-10 09:54:45 +01007826 memcpy(operation->data.inputs.user, user_id, user_id_len);
7827 operation->data.inputs.user_len = user_id_len;
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007828
7829 return PSA_SUCCESS;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007830exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007831 psa_pake_abort(operation);
7832 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02007833}
7834
7835psa_status_t psa_pake_set_peer(
7836 psa_pake_operation_t *operation,
7837 const uint8_t *peer_id,
7838 size_t peer_id_len)
7839{
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007840 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007841
7842 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007843 status = PSA_ERROR_BAD_STATE;
7844 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007845 }
7846
Przemek Stekiel51eac532022-12-07 11:04:51 +01007847 if (peer_id_len == 0) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007848 status = PSA_ERROR_INVALID_ARGUMENT;
7849 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007850 }
7851
Przemek Stekielf309d6b2023-03-10 09:54:45 +01007852 if (operation->data.inputs.peer_len != 0) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007853 status = PSA_ERROR_BAD_STATE;
7854 goto exit;
7855 }
7856
Przemek Stekielf309d6b2023-03-10 09:54:45 +01007857 operation->data.inputs.peer = mbedtls_calloc(1, peer_id_len);
7858 if (operation->data.inputs.peer == NULL) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007859 status = PSA_ERROR_INSUFFICIENT_MEMORY;
7860 goto exit;
7861 }
7862
Przemek Stekielf309d6b2023-03-10 09:54:45 +01007863 memcpy(operation->data.inputs.peer, peer_id, peer_id_len);
7864 operation->data.inputs.peer_len = peer_id_len;
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007865
7866 return PSA_SUCCESS;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007867exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007868 psa_pake_abort(operation);
7869 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02007870}
7871
7872psa_status_t psa_pake_set_role(
7873 psa_pake_operation_t *operation,
7874 psa_pake_role_t role)
7875{
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007876 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007877
Przemek Stekiel51eac532022-12-07 11:04:51 +01007878 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007879 status = PSA_ERROR_BAD_STATE;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007880 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007881 }
7882
Przemek Stekiel09104b82023-03-06 14:11:51 +01007883 switch (operation->alg) {
7884#if defined(PSA_WANT_ALG_JPAKE)
7885 case PSA_ALG_JPAKE:
7886 if (role == PSA_PAKE_ROLE_NONE) {
7887 return PSA_SUCCESS;
7888 }
7889 status = PSA_ERROR_INVALID_ARGUMENT;
7890 break;
7891#endif
7892 default:
7893 (void) role;
7894 status = PSA_ERROR_NOT_SUPPORTED;
7895 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007896 }
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007897exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007898 psa_pake_abort(operation);
7899 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02007900}
7901
David Horstmanne7f21e62023-05-12 18:17:21 +01007902/* Auxiliary function to convert core computation stage to single driver step. */
Przemek Stekiel4aa99402023-02-27 13:00:57 +01007903#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiel251e86a2023-02-17 14:30:50 +01007904static psa_crypto_driver_pake_step_t convert_jpake_computation_stage_to_driver_step(
Przemek Stekieldde6a912023-01-26 08:46:37 +01007905 psa_jpake_computation_stage_t *stage)
Przemek Stekielb09c4872023-01-17 12:05:38 +01007906{
David Horstmann74a3d8c2023-06-14 18:28:19 +01007907 psa_crypto_driver_pake_step_t key_share_step;
David Horstmann5da95602023-06-08 15:37:12 +01007908 if (stage->round == PSA_JPAKE_FIRST) {
David Horstmanne7f21e62023-05-12 18:17:21 +01007909 int is_x1;
David Horstmann74a3d8c2023-06-14 18:28:19 +01007910
David Horstmann024e5c52023-06-14 15:48:21 +01007911 if (stage->io_mode == PSA_JPAKE_OUTPUT) {
David Horstmanne7f21e62023-05-12 18:17:21 +01007912 is_x1 = (stage->outputs < 1);
7913 } else {
7914 is_x1 = (stage->inputs < 1);
7915 }
7916
David Horstmann74a3d8c2023-06-14 18:28:19 +01007917 key_share_step = is_x1 ?
7918 PSA_JPAKE_X1_STEP_KEY_SHARE :
7919 PSA_JPAKE_X2_STEP_KEY_SHARE;
David Horstmann5da95602023-06-08 15:37:12 +01007920 } else if (stage->round == PSA_JPAKE_SECOND) {
David Horstmann74a3d8c2023-06-14 18:28:19 +01007921 key_share_step = (stage->io_mode == PSA_JPAKE_OUTPUT) ?
7922 PSA_JPAKE_X2S_STEP_KEY_SHARE :
7923 PSA_JPAKE_X4S_STEP_KEY_SHARE;
7924 } else {
7925 return PSA_JPAKE_STEP_INVALID;
Przemek Stekielb09c4872023-01-17 12:05:38 +01007926 }
Agathiyan Bragadeesh387bfa52023-07-17 17:01:33 +01007927 return (psa_crypto_driver_pake_step_t) (key_share_step + stage->step - PSA_PAKE_STEP_KEY_SHARE);
Przemek Stekielb09c4872023-01-17 12:05:38 +01007928}
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007929#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekielb09c4872023-01-17 12:05:38 +01007930
Przemek Stekiel2797d372022-12-22 11:19:22 +01007931static psa_status_t psa_pake_complete_inputs(
7932 psa_pake_operation_t *operation)
7933{
Przemek Stekiel2797d372022-12-22 11:19:22 +01007934 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel18620a32023-01-17 16:34:52 +01007935 /* Create copy of the inputs on stack as inputs share memory
7936 with the driver context which will be setup by the driver. */
7937 psa_crypto_driver_pake_inputs_t inputs = operation->data.inputs;
Przemek Stekiel2797d372022-12-22 11:19:22 +01007938
Przemek Stekielfde11282023-03-13 16:06:09 +01007939 if (inputs.password_len == 0) {
Przemek Stekiel2797d372022-12-22 11:19:22 +01007940 return PSA_ERROR_BAD_STATE;
7941 }
7942
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007943 if (operation->alg == PSA_ALG_JPAKE) {
Przemek Stekielfde11282023-03-13 16:06:09 +01007944 if (inputs.user_len == 0 || inputs.peer_len == 0) {
7945 return PSA_ERROR_BAD_STATE;
7946 }
Przemek Stekieldff21d32023-02-14 20:09:10 +01007947 }
7948
Przemek Stekiel18620a32023-01-17 16:34:52 +01007949 /* Clear driver context */
7950 mbedtls_platform_zeroize(&operation->data, sizeof(operation->data));
7951
7952 status = psa_driver_wrapper_pake_setup(operation, &inputs);
Przemek Stekiel2797d372022-12-22 11:19:22 +01007953
7954 /* Driver is responsible for creating its own copy of the password. */
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01007955 mbedtls_zeroize_and_free(inputs.password, inputs.password_len);
Przemek Stekiel2797d372022-12-22 11:19:22 +01007956
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007957 /* User and peer are translated to role. */
7958 mbedtls_free(inputs.user);
7959 mbedtls_free(inputs.peer);
7960
Przemek Stekiel2797d372022-12-22 11:19:22 +01007961 if (status == PSA_SUCCESS) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01007962#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiel2797d372022-12-22 11:19:22 +01007963 if (operation->alg == PSA_ALG_JPAKE) {
Przemek Stekield93de322023-02-24 08:39:04 +01007964 operation->stage = PSA_PAKE_OPERATION_STAGE_COMPUTATION;
Przemek Stekiel80a88492023-02-20 13:32:22 +01007965 } else
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007966#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiel80a88492023-02-20 13:32:22 +01007967 {
7968 status = PSA_ERROR_NOT_SUPPORTED;
Przemek Stekiel2797d372022-12-22 11:19:22 +01007969 }
Przemek Stekiel2797d372022-12-22 11:19:22 +01007970 }
Przemek Stekiel2797d372022-12-22 11:19:22 +01007971 return status;
7972}
7973
Przemek Stekiel4aa99402023-02-27 13:00:57 +01007974#if defined(PSA_WANT_ALG_JPAKE)
David Horstmanne7f21e62023-05-12 18:17:21 +01007975static psa_status_t psa_jpake_prologue(
Przemek Stekiele12ed362022-12-21 12:54:46 +01007976 psa_pake_operation_t *operation,
David Horstmanne7f21e62023-05-12 18:17:21 +01007977 psa_pake_step_t step,
David Horstmann00ad6bf2023-06-14 15:44:24 +01007978 psa_jpake_io_mode_t io_mode)
Przemek Stekiele12ed362022-12-21 12:54:46 +01007979{
Przemek Stekiele12ed362022-12-21 12:54:46 +01007980 if (step != PSA_PAKE_STEP_KEY_SHARE &&
7981 step != PSA_PAKE_STEP_ZK_PUBLIC &&
7982 step != PSA_PAKE_STEP_ZK_PROOF) {
7983 return PSA_ERROR_INVALID_ARGUMENT;
7984 }
7985
Przemek Stekiel5eff1032023-02-21 19:10:36 +01007986 psa_jpake_computation_stage_t *computation_stage =
7987 &operation->computation_stage.jpake;
Przemek Stekiele12ed362022-12-21 12:54:46 +01007988
David Horstmann5da95602023-06-08 15:37:12 +01007989 if (computation_stage->round != PSA_JPAKE_FIRST &&
7990 computation_stage->round != PSA_JPAKE_SECOND) {
Przemek Stekiel5eff1032023-02-21 19:10:36 +01007991 return PSA_ERROR_BAD_STATE;
7992 }
7993
David Horstmanne7f21e62023-05-12 18:17:21 +01007994 /* Check that the step we are given is the one we were expecting */
7995 if (step != computation_stage->step) {
Przemek Stekiel5eff1032023-02-21 19:10:36 +01007996 return PSA_ERROR_BAD_STATE;
7997 }
7998
David Horstmanne7f21e62023-05-12 18:17:21 +01007999 if (step == PSA_PAKE_STEP_KEY_SHARE &&
8000 computation_stage->inputs == 0 &&
8001 computation_stage->outputs == 0) {
8002 /* Start of the round, so function decides whether we are inputting
8003 * or outputting */
David Horstmann024e5c52023-06-14 15:48:21 +01008004 computation_stage->io_mode = io_mode;
8005 } else if (computation_stage->io_mode != io_mode) {
David Horstmanne7f21e62023-05-12 18:17:21 +01008006 /* Middle of the round so the mode we are in must match the function
8007 * called by the user */
8008 return PSA_ERROR_BAD_STATE;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008009 }
8010
8011 return PSA_SUCCESS;
8012}
8013
David Horstmanne7f21e62023-05-12 18:17:21 +01008014static psa_status_t psa_jpake_epilogue(
8015 psa_pake_operation_t *operation,
David Horstmann00ad6bf2023-06-14 15:44:24 +01008016 psa_jpake_io_mode_t io_mode)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008017{
David Horstmanne7f21e62023-05-12 18:17:21 +01008018 psa_jpake_computation_stage_t *stage =
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008019 &operation->computation_stage.jpake;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008020
David Horstmanne7f21e62023-05-12 18:17:21 +01008021 if (stage->step == PSA_PAKE_STEP_ZK_PROOF) {
8022 /* End of an input/output */
David Horstmann00ad6bf2023-06-14 15:44:24 +01008023 if (io_mode == PSA_JPAKE_INPUT) {
David Horstmanne7f21e62023-05-12 18:17:21 +01008024 stage->inputs++;
David Horstmann246ec5a2023-06-27 10:33:06 +01008025 if (stage->inputs == PSA_JPAKE_EXPECTED_INPUTS(stage->round)) {
David Horstmann024e5c52023-06-14 15:48:21 +01008026 stage->io_mode = PSA_JPAKE_OUTPUT;
David Horstmanne7f21e62023-05-12 18:17:21 +01008027 }
8028 }
David Horstmann00ad6bf2023-06-14 15:44:24 +01008029 if (io_mode == PSA_JPAKE_OUTPUT) {
David Horstmanne7f21e62023-05-12 18:17:21 +01008030 stage->outputs++;
David Horstmann246ec5a2023-06-27 10:33:06 +01008031 if (stage->outputs == PSA_JPAKE_EXPECTED_OUTPUTS(stage->round)) {
David Horstmann024e5c52023-06-14 15:48:21 +01008032 stage->io_mode = PSA_JPAKE_INPUT;
David Horstmanne7f21e62023-05-12 18:17:21 +01008033 }
8034 }
David Horstmann246ec5a2023-06-27 10:33:06 +01008035 if (stage->inputs == PSA_JPAKE_EXPECTED_INPUTS(stage->round) &&
8036 stage->outputs == PSA_JPAKE_EXPECTED_OUTPUTS(stage->round)) {
David Horstmanne7f21e62023-05-12 18:17:21 +01008037 /* End of a round, move to the next round */
8038 stage->inputs = 0;
8039 stage->outputs = 0;
8040 stage->round++;
8041 }
8042 stage->step = PSA_PAKE_STEP_KEY_SHARE;
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008043 } else {
David Horstmanne7f21e62023-05-12 18:17:21 +01008044 stage->step++;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008045 }
Przemek Stekiele12ed362022-12-21 12:54:46 +01008046 return PSA_SUCCESS;
8047}
David Horstmanne7f21e62023-05-12 18:17:21 +01008048
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008049#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008050
Neil Armstronga7d08c32022-06-01 18:21:20 +02008051psa_status_t psa_pake_output(
8052 psa_pake_operation_t *operation,
8053 psa_pake_step_t step,
8054 uint8_t *output,
8055 size_t output_size,
8056 size_t *output_length)
8057{
Przemek Stekiel51eac532022-12-07 11:04:51 +01008058 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008059 psa_crypto_driver_pake_step_t driver_step = PSA_JPAKE_STEP_INVALID;
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01008060 *output_length = 0;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008061
8062 if (operation->stage == PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel2797d372022-12-22 11:19:22 +01008063 status = psa_pake_complete_inputs(operation);
8064 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008065 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008066 }
8067 }
8068
8069 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COMPUTATION) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008070 status = PSA_ERROR_BAD_STATE;
8071 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008072 }
8073
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01008074 if (output_size == 0) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008075 status = PSA_ERROR_INVALID_ARGUMENT;
8076 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008077 }
8078
Przemek Stekiele12ed362022-12-21 12:54:46 +01008079 switch (operation->alg) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008080#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008081 case PSA_ALG_JPAKE:
David Horstmann5da95602023-06-08 15:37:12 +01008082 status = psa_jpake_prologue(operation, step, PSA_JPAKE_OUTPUT);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008083 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008084 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008085 }
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008086 driver_step = convert_jpake_computation_stage_to_driver_step(
8087 &operation->computation_stage.jpake);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008088 break;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008089#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008090 default:
Przemek Stekiel80a88492023-02-20 13:32:22 +01008091 (void) step;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008092 status = PSA_ERROR_NOT_SUPPORTED;
8093 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008094 }
8095
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008096 status = psa_driver_wrapper_pake_output(operation, driver_step,
8097 output, output_size, output_length);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008098
8099 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008100 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008101 }
8102
8103 switch (operation->alg) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008104#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008105 case PSA_ALG_JPAKE:
David Horstmann5da95602023-06-08 15:37:12 +01008106 status = psa_jpake_epilogue(operation, PSA_JPAKE_OUTPUT);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008107 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008108 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008109 }
8110 break;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008111#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008112 default:
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008113 status = PSA_ERROR_NOT_SUPPORTED;
8114 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008115 }
8116
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008117 return PSA_SUCCESS;
8118exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008119 psa_pake_abort(operation);
8120 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008121}
8122
8123psa_status_t psa_pake_input(
8124 psa_pake_operation_t *operation,
8125 psa_pake_step_t step,
8126 const uint8_t *input,
8127 size_t input_length)
8128{
Przemek Stekiel51eac532022-12-07 11:04:51 +01008129 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008130 psa_crypto_driver_pake_step_t driver_step = PSA_JPAKE_STEP_INVALID;
Przemek Stekiel256c75d2023-03-23 14:09:34 +01008131 const size_t max_input_length = (size_t) PSA_PAKE_INPUT_SIZE(operation->alg,
8132 operation->primitive,
8133 step);
Przemek Stekiel51eac532022-12-07 11:04:51 +01008134
8135 if (operation->stage == PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel2797d372022-12-22 11:19:22 +01008136 status = psa_pake_complete_inputs(operation);
8137 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008138 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008139 }
8140 }
8141
8142 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COMPUTATION) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008143 status = PSA_ERROR_BAD_STATE;
8144 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008145 }
8146
Przemek Stekiel256c75d2023-03-23 14:09:34 +01008147 if (input_length == 0 || input_length > max_input_length) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008148 status = PSA_ERROR_INVALID_ARGUMENT;
8149 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008150 }
8151
Przemek Stekiele12ed362022-12-21 12:54:46 +01008152 switch (operation->alg) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008153#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008154 case PSA_ALG_JPAKE:
David Horstmann5da95602023-06-08 15:37:12 +01008155 status = psa_jpake_prologue(operation, step, PSA_JPAKE_INPUT);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008156 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008157 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008158 }
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008159 driver_step = convert_jpake_computation_stage_to_driver_step(
8160 &operation->computation_stage.jpake);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008161 break;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008162#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008163 default:
Przemek Stekiel80a88492023-02-20 13:32:22 +01008164 (void) step;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008165 status = PSA_ERROR_NOT_SUPPORTED;
8166 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008167 }
8168
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008169 status = psa_driver_wrapper_pake_input(operation, driver_step,
8170 input, input_length);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008171
8172 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008173 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008174 }
8175
8176 switch (operation->alg) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008177#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008178 case PSA_ALG_JPAKE:
David Horstmann5da95602023-06-08 15:37:12 +01008179 status = psa_jpake_epilogue(operation, PSA_JPAKE_INPUT);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008180 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008181 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008182 }
8183 break;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008184#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008185 default:
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008186 status = PSA_ERROR_NOT_SUPPORTED;
8187 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008188 }
8189
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008190 return PSA_SUCCESS;
8191exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008192 psa_pake_abort(operation);
8193 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008194}
8195
8196psa_status_t psa_pake_get_implicit_key(
8197 psa_pake_operation_t *operation,
8198 psa_key_derivation_operation_t *output)
8199{
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01008200 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008201 psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel251e86a2023-02-17 14:30:50 +01008202 uint8_t shared_key[MBEDTLS_PSA_JPAKE_BUFFER_SIZE];
Przemek Stekiel0c781802022-11-29 14:53:13 +01008203 size_t shared_key_len = 0;
8204
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01008205 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COMPUTATION) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008206 status = PSA_ERROR_BAD_STATE;
8207 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008208 }
8209
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008210#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008211 if (operation->alg == PSA_ALG_JPAKE) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008212 psa_jpake_computation_stage_t *computation_stage =
Przemek Stekiel083745e2023-02-23 17:28:23 +01008213 &operation->computation_stage.jpake;
David Horstmann5da95602023-06-08 15:37:12 +01008214 if (computation_stage->round != PSA_JPAKE_FINISHED) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008215 status = PSA_ERROR_BAD_STATE;
8216 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008217 }
Przemek Stekiel80a88492023-02-20 13:32:22 +01008218 } else
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008219#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiel80a88492023-02-20 13:32:22 +01008220 {
8221 status = PSA_ERROR_NOT_SUPPORTED;
8222 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008223 }
8224
Przemek Stekiel0c781802022-11-29 14:53:13 +01008225 status = psa_driver_wrapper_pake_get_implicit_key(operation,
8226 shared_key,
Przemek Stekiel6b648622023-02-19 22:55:33 +01008227 sizeof(shared_key),
Przemek Stekiel0c781802022-11-29 14:53:13 +01008228 &shared_key_len);
8229
8230 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008231 goto exit;
Przemek Stekiel0c781802022-11-29 14:53:13 +01008232 }
8233
8234 status = psa_key_derivation_input_bytes(output,
8235 PSA_KEY_DERIVATION_INPUT_SECRET,
8236 shared_key,
8237 shared_key_len);
8238
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008239 mbedtls_platform_zeroize(shared_key, sizeof(shared_key));
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008240exit:
8241 abort_status = psa_pake_abort(operation);
8242 return status == PSA_SUCCESS ? abort_status : status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008243}
8244
8245psa_status_t psa_pake_abort(
8246 psa_pake_operation_t *operation)
8247{
Przemek Stekield69dca92023-01-31 19:59:20 +01008248 psa_status_t status = PSA_SUCCESS;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008249
Przemek Stekield69dca92023-01-31 19:59:20 +01008250 if (operation->stage == PSA_PAKE_OPERATION_STAGE_COMPUTATION) {
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01008251 status = psa_driver_wrapper_pake_abort(operation);
Neil Armstrong5ae60962022-09-15 11:29:46 +02008252 }
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01008253
Przemek Stekiel26c909d2023-02-28 12:34:03 +01008254 if (operation->stage == PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
8255 if (operation->data.inputs.password != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01008256 mbedtls_zeroize_and_free(operation->data.inputs.password,
Przemek Stekielaa183422023-03-06 14:21:44 +01008257 operation->data.inputs.password_len);
Przemek Stekiel26c909d2023-02-28 12:34:03 +01008258 }
8259 if (operation->data.inputs.user != NULL) {
8260 mbedtls_free(operation->data.inputs.user);
8261 }
8262 if (operation->data.inputs.peer != NULL) {
8263 mbedtls_free(operation->data.inputs.peer);
8264 }
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01008265 }
Przemek Stekield69dca92023-01-31 19:59:20 +01008266 memset(operation, 0, sizeof(psa_pake_operation_t));
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01008267
Przemek Stekield69dca92023-01-31 19:59:20 +01008268 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008269}
Tom Cosgrove6d62fac2023-05-10 14:40:05 +01008270#endif /* PSA_WANT_ALG_SOME_PAKE */
Neil Armstronga7d08c32022-06-01 18:21:20 +02008271
Gilles Peskinee59236f2018-01-27 23:32:46 +01008272#endif /* MBEDTLS_PSA_CRYPTO_C */