blob: 847413ba76965a37a34d04ee2301d476817b5668 [file] [log] [blame]
Gilles Peskinee59236f2018-01-27 23:32:46 +01001/*
2 * PSA crypto layer on top of Mbed TLS crypto
3 */
Bence Szépkúti86974652020-06-15 11:59:37 +02004/*
Bence Szépkúti1e148272020-08-07 13:07:28 +02005 * Copyright The Mbed TLS Contributors
Gilles Peskinee59236f2018-01-27 23:32:46 +01006 * SPDX-License-Identifier: Apache-2.0
7 *
8 * Licensed under the Apache License, Version 2.0 (the "License"); you may
9 * not use this file except in compliance with the License.
10 * You may obtain a copy of the License at
11 *
12 * http://www.apache.org/licenses/LICENSE-2.0
13 *
14 * Unless required by applicable law or agreed to in writing, software
15 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
16 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17 * See the License for the specific language governing permissions and
18 * limitations under the License.
Gilles Peskinee59236f2018-01-27 23:32:46 +010019 */
20
Gilles Peskinedb09ef62020-06-03 01:43:33 +020021#include "common.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010022
23#if defined(MBEDTLS_PSA_CRYPTO_C)
mohammad160327010052018-07-03 13:16:15 +030024
John Durkop07cc04a2020-11-16 22:08:34 -080025#if defined(MBEDTLS_PSA_CRYPTO_CONFIG)
26#include "check_crypto_config.h"
27#endif
28
itayzafrir7723ab12019-02-14 10:28:02 +020029#include "psa_crypto_service_integration.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010030#include "psa/crypto.h"
31
Ronald Crond6d28882020-12-14 14:56:02 +010032#include "psa_crypto_cipher.h"
Gilles Peskine039b90c2018-12-07 18:24:41 +010033#include "psa_crypto_core.h"
Gilles Peskine5e769522018-11-20 21:59:56 +010034#include "psa_crypto_invasive.h"
Steven Cooremancd84cb42020-07-16 20:28:36 +020035#include "psa_crypto_driver_wrappers.h"
Ronald Cron00b7bfc2020-11-25 15:25:26 +010036#include "psa_crypto_ecp.h"
Steven Cooreman5f88e772021-03-15 11:07:12 +010037#include "psa_crypto_hash.h"
Ronald Cron00b7bfc2020-11-25 15:25:26 +010038#include "psa_crypto_rsa.h"
Ronald Cron7023db52020-11-20 18:17:42 +010039#include "psa_crypto_ecp.h"
Gilles Peskinea8ade162019-06-26 11:24:49 +020040#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined0890212019-06-24 14:34:43 +020041#include "psa_crypto_se.h"
Gilles Peskinea8ade162019-06-26 11:24:49 +020042#endif
Gilles Peskine961849f2018-11-30 18:54:54 +010043#include "psa_crypto_slot_management.h"
Darryl Greend49a4992018-06-18 17:27:26 +010044/* Include internal declarations that are useful for implementing persistently
45 * stored keys. */
46#include "psa_crypto_storage.h"
47
Gilles Peskineb2b64d32020-12-14 16:43:58 +010048#include "psa_crypto_random_impl.h"
Gilles Peskine90edc992020-11-13 15:39:19 +010049
Gilles Peskineb46bef22019-07-30 21:32:04 +020050#include <assert.h>
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010051#include <stdlib.h>
52#include <string.h>
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010053#include "mbedtls/platform.h"
Gilles Peskineff2d2002019-05-06 15:26:23 +020054#if !defined(MBEDTLS_PLATFORM_C)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010055#define mbedtls_calloc calloc
56#define mbedtls_free free
57#endif
58
Gilles Peskine1c49f1a2020-11-13 18:46:25 +010059#include "mbedtls/aes.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010060#include "mbedtls/arc4.h"
Gilles Peskine9a944802018-06-21 09:35:35 +020061#include "mbedtls/asn1.h"
Jaeden Amero25384a22019-01-10 10:23:21 +000062#include "mbedtls/asn1write.h"
Gilles Peskinea81d85b2018-06-26 16:10:23 +020063#include "mbedtls/bignum.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010064#include "mbedtls/blowfish.h"
65#include "mbedtls/camellia.h"
Gilles Peskine26869f22019-05-06 15:25:00 +020066#include "mbedtls/chacha20.h"
67#include "mbedtls/chachapoly.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010068#include "mbedtls/cipher.h"
69#include "mbedtls/ccm.h"
70#include "mbedtls/cmac.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010071#include "mbedtls/des.h"
Gilles Peskineb7ecdf02018-09-18 12:11:27 +020072#include "mbedtls/ecdh.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010073#include "mbedtls/ecp.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010074#include "mbedtls/entropy.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010075#include "mbedtls/error.h"
76#include "mbedtls/gcm.h"
77#include "mbedtls/md2.h"
78#include "mbedtls/md4.h"
79#include "mbedtls/md5.h"
Gilles Peskine20035e32018-02-03 22:44:14 +010080#include "mbedtls/md.h"
81#include "mbedtls/md_internal.h"
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010082#include "mbedtls/pk.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010083#include "mbedtls/pk_internal.h"
Gilles Peskine3f108122018-12-07 18:14:53 +010084#include "mbedtls/platform_util.h"
Janos Follath24eed8d2019-11-22 13:21:35 +000085#include "mbedtls/error.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010086#include "mbedtls/ripemd160.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010087#include "mbedtls/rsa.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010088#include "mbedtls/sha1.h"
89#include "mbedtls/sha256.h"
90#include "mbedtls/sha512.h"
91#include "mbedtls/xtea.h"
92
Gilles Peskine996deb12018-08-01 15:45:45 +020093#define ARRAY_LENGTH( array ) ( sizeof( array ) / sizeof( *( array ) ) )
94
Gilles Peskine9ef733f2018-02-07 21:05:37 +010095/* constant-time buffer comparison */
96static inline int safer_memcmp( const uint8_t *a, const uint8_t *b, size_t n )
97{
98 size_t i;
99 unsigned char diff = 0;
100
101 for( i = 0; i < n; i++ )
102 diff |= a[i] ^ b[i];
103
104 return( diff );
105}
106
107
108
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100109/****************************************************************/
110/* Global data, support functions and library management */
111/****************************************************************/
112
Gilles Peskine48c0ea12018-06-21 14:15:31 +0200113static int key_type_is_raw_bytes( psa_key_type_t type )
114{
Gilles Peskine78b3bb62018-08-10 16:03:41 +0200115 return( PSA_KEY_TYPE_IS_UNSTRUCTURED( type ) );
Gilles Peskine48c0ea12018-06-21 14:15:31 +0200116}
117
Gilles Peskine5a3c50e2018-12-04 12:27:09 +0100118/* Values for psa_global_data_t::rng_state */
119#define RNG_NOT_INITIALIZED 0
120#define RNG_INITIALIZED 1
121#define RNG_SEEDED 2
Gilles Peskinec6b69072018-11-20 21:42:52 +0100122
Gilles Peskine2d277862018-06-18 15:41:12 +0200123typedef struct
124{
Gilles Peskine30524eb2020-11-13 17:02:26 +0100125 mbedtls_psa_random_context_t rng;
Gilles Peskinec6b69072018-11-20 21:42:52 +0100126 unsigned initialized : 1;
Gilles Peskine5a3c50e2018-12-04 12:27:09 +0100127 unsigned rng_state : 2;
Gilles Peskinee59236f2018-01-27 23:32:46 +0100128} psa_global_data_t;
129
130static psa_global_data_t global_data;
131
Gilles Peskine5894e8e2020-12-14 14:54:06 +0100132#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
133mbedtls_psa_drbg_context_t *const mbedtls_psa_random_state =
134 &global_data.rng.drbg;
135#endif
136
itayzafrir0adf0fc2018-09-06 16:24:41 +0300137#define GUARD_MODULE_INITIALIZED \
138 if( global_data.initialized == 0 ) \
139 return( PSA_ERROR_BAD_STATE );
140
Steven Cooreman01164162020-07-20 15:31:37 +0200141psa_status_t mbedtls_to_psa_error( int ret )
Gilles Peskinee59236f2018-01-27 23:32:46 +0100142{
Gilles Peskinedbf68962021-01-06 20:04:23 +0100143 /* Mbed TLS error codes can combine a high-level error code and a
144 * low-level error code. The low-level error usually reflects the
145 * root cause better, so dispatch on that preferably. */
146 int low_level_ret = - ( -ret & 0x007f );
147 switch( low_level_ret != 0 ? low_level_ret : ret )
Gilles Peskinee59236f2018-01-27 23:32:46 +0100148 {
149 case 0:
150 return( PSA_SUCCESS );
Gilles Peskinea5905292018-02-07 20:59:33 +0100151
152 case MBEDTLS_ERR_AES_INVALID_KEY_LENGTH:
153 case MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH:
154 case MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE:
155 return( PSA_ERROR_NOT_SUPPORTED );
156 case MBEDTLS_ERR_AES_HW_ACCEL_FAILED:
157 return( PSA_ERROR_HARDWARE_FAILURE );
158
Manuel Pégourié-Gonnard93c08472021-04-15 12:23:55 +0200159 case MBEDTLS_ERR_ARC4_HW_ACCEL_FAILED:
160 return( PSA_ERROR_HARDWARE_FAILURE );
161
Gilles Peskine9a944802018-06-21 09:35:35 +0200162 case MBEDTLS_ERR_ASN1_OUT_OF_DATA:
163 case MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:
164 case MBEDTLS_ERR_ASN1_INVALID_LENGTH:
165 case MBEDTLS_ERR_ASN1_LENGTH_MISMATCH:
166 case MBEDTLS_ERR_ASN1_INVALID_DATA:
167 return( PSA_ERROR_INVALID_ARGUMENT );
168 case MBEDTLS_ERR_ASN1_ALLOC_FAILED:
169 return( PSA_ERROR_INSUFFICIENT_MEMORY );
170 case MBEDTLS_ERR_ASN1_BUF_TOO_SMALL:
171 return( PSA_ERROR_BUFFER_TOO_SMALL );
172
Jaeden Amero93e21112019-02-20 13:57:28 +0000173#if defined(MBEDTLS_ERR_BLOWFISH_BAD_INPUT_DATA)
Jaeden Amero892cd6d2019-02-11 12:21:12 +0000174 case MBEDTLS_ERR_BLOWFISH_BAD_INPUT_DATA:
Jaeden Amero93e21112019-02-20 13:57:28 +0000175#elif defined(MBEDTLS_ERR_BLOWFISH_INVALID_KEY_LENGTH)
176 case MBEDTLS_ERR_BLOWFISH_INVALID_KEY_LENGTH:
177#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100178 case MBEDTLS_ERR_BLOWFISH_INVALID_INPUT_LENGTH:
179 return( PSA_ERROR_NOT_SUPPORTED );
180 case MBEDTLS_ERR_BLOWFISH_HW_ACCEL_FAILED:
181 return( PSA_ERROR_HARDWARE_FAILURE );
182
Jaeden Amero93e21112019-02-20 13:57:28 +0000183#if defined(MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA)
Jaeden Amero892cd6d2019-02-11 12:21:12 +0000184 case MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA:
Jaeden Amero93e21112019-02-20 13:57:28 +0000185#elif defined(MBEDTLS_ERR_CAMELLIA_INVALID_KEY_LENGTH)
186 case MBEDTLS_ERR_CAMELLIA_INVALID_KEY_LENGTH:
187#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100188 case MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH:
189 return( PSA_ERROR_NOT_SUPPORTED );
190 case MBEDTLS_ERR_CAMELLIA_HW_ACCEL_FAILED:
191 return( PSA_ERROR_HARDWARE_FAILURE );
192
193 case MBEDTLS_ERR_CCM_BAD_INPUT:
194 return( PSA_ERROR_INVALID_ARGUMENT );
195 case MBEDTLS_ERR_CCM_AUTH_FAILED:
196 return( PSA_ERROR_INVALID_SIGNATURE );
197 case MBEDTLS_ERR_CCM_HW_ACCEL_FAILED:
198 return( PSA_ERROR_HARDWARE_FAILURE );
199
Gilles Peskine26869f22019-05-06 15:25:00 +0200200 case MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA:
201 return( PSA_ERROR_INVALID_ARGUMENT );
202
203 case MBEDTLS_ERR_CHACHAPOLY_BAD_STATE:
204 return( PSA_ERROR_BAD_STATE );
205 case MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED:
206 return( PSA_ERROR_INVALID_SIGNATURE );
207
Gilles Peskinea5905292018-02-07 20:59:33 +0100208 case MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE:
209 return( PSA_ERROR_NOT_SUPPORTED );
210 case MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA:
211 return( PSA_ERROR_INVALID_ARGUMENT );
212 case MBEDTLS_ERR_CIPHER_ALLOC_FAILED:
213 return( PSA_ERROR_INSUFFICIENT_MEMORY );
214 case MBEDTLS_ERR_CIPHER_INVALID_PADDING:
215 return( PSA_ERROR_INVALID_PADDING );
216 case MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED:
Fredrik Strupef90e3012020-09-28 16:11:33 +0200217 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskinea5905292018-02-07 20:59:33 +0100218 case MBEDTLS_ERR_CIPHER_AUTH_FAILED:
219 return( PSA_ERROR_INVALID_SIGNATURE );
220 case MBEDTLS_ERR_CIPHER_INVALID_CONTEXT:
Gilles Peskine4b3eb692019-05-16 21:35:18 +0200221 return( PSA_ERROR_CORRUPTION_DETECTED );
Gilles Peskinea5905292018-02-07 20:59:33 +0100222 case MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED:
223 return( PSA_ERROR_HARDWARE_FAILURE );
224
225 case MBEDTLS_ERR_CMAC_HW_ACCEL_FAILED:
226 return( PSA_ERROR_HARDWARE_FAILURE );
227
Gilles Peskine82e57d12020-11-13 21:31:17 +0100228#if !( defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) || \
229 defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE) )
Gilles Peskinebee96c82020-11-23 21:00:09 +0100230 /* Only check CTR_DRBG error codes if underlying mbedtls_xxx
231 * functions are passed a CTR_DRBG instance. */
Gilles Peskinea5905292018-02-07 20:59:33 +0100232 case MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED:
233 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
234 case MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG:
235 case MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG:
236 return( PSA_ERROR_NOT_SUPPORTED );
237 case MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR:
238 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
Gilles Peskine82e57d12020-11-13 21:31:17 +0100239#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100240
241 case MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH:
242 return( PSA_ERROR_NOT_SUPPORTED );
243 case MBEDTLS_ERR_DES_HW_ACCEL_FAILED:
244 return( PSA_ERROR_HARDWARE_FAILURE );
245
Gilles Peskinee59236f2018-01-27 23:32:46 +0100246 case MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED:
247 case MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE:
248 case MBEDTLS_ERR_ENTROPY_SOURCE_FAILED:
249 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
Gilles Peskinea5905292018-02-07 20:59:33 +0100250
251 case MBEDTLS_ERR_GCM_AUTH_FAILED:
252 return( PSA_ERROR_INVALID_SIGNATURE );
253 case MBEDTLS_ERR_GCM_BAD_INPUT:
Gilles Peskine8cac2e62018-08-21 15:07:38 +0200254 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskinea5905292018-02-07 20:59:33 +0100255 case MBEDTLS_ERR_GCM_HW_ACCEL_FAILED:
256 return( PSA_ERROR_HARDWARE_FAILURE );
257
Gilles Peskine82e57d12020-11-13 21:31:17 +0100258#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) && \
259 defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE)
Gilles Peskinebee96c82020-11-23 21:00:09 +0100260 /* Only check HMAC_DRBG error codes if underlying mbedtls_xxx
261 * functions are passed a HMAC_DRBG instance. */
Gilles Peskine82e57d12020-11-13 21:31:17 +0100262 case MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED:
263 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
264 case MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG:
265 case MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG:
266 return( PSA_ERROR_NOT_SUPPORTED );
267 case MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR:
268 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
269#endif
270
Manuel Pégourié-Gonnard93c08472021-04-15 12:23:55 +0200271 case MBEDTLS_ERR_MD2_HW_ACCEL_FAILED:
272 case MBEDTLS_ERR_MD4_HW_ACCEL_FAILED:
273 case MBEDTLS_ERR_MD5_HW_ACCEL_FAILED:
274 return( PSA_ERROR_HARDWARE_FAILURE );
275
Gilles Peskinea5905292018-02-07 20:59:33 +0100276 case MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE:
277 return( PSA_ERROR_NOT_SUPPORTED );
278 case MBEDTLS_ERR_MD_BAD_INPUT_DATA:
279 return( PSA_ERROR_INVALID_ARGUMENT );
280 case MBEDTLS_ERR_MD_ALLOC_FAILED:
281 return( PSA_ERROR_INSUFFICIENT_MEMORY );
282 case MBEDTLS_ERR_MD_FILE_IO_ERROR:
283 return( PSA_ERROR_STORAGE_FAILURE );
Manuel Pégourié-Gonnard93c08472021-04-15 12:23:55 +0200284 case MBEDTLS_ERR_MD_HW_ACCEL_FAILED:
285 return( PSA_ERROR_HARDWARE_FAILURE );
Gilles Peskinea5905292018-02-07 20:59:33 +0100286
Gilles Peskinef76aa772018-10-29 19:24:33 +0100287 case MBEDTLS_ERR_MPI_FILE_IO_ERROR:
288 return( PSA_ERROR_STORAGE_FAILURE );
289 case MBEDTLS_ERR_MPI_BAD_INPUT_DATA:
290 return( PSA_ERROR_INVALID_ARGUMENT );
291 case MBEDTLS_ERR_MPI_INVALID_CHARACTER:
292 return( PSA_ERROR_INVALID_ARGUMENT );
293 case MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL:
294 return( PSA_ERROR_BUFFER_TOO_SMALL );
295 case MBEDTLS_ERR_MPI_NEGATIVE_VALUE:
296 return( PSA_ERROR_INVALID_ARGUMENT );
297 case MBEDTLS_ERR_MPI_DIVISION_BY_ZERO:
298 return( PSA_ERROR_INVALID_ARGUMENT );
299 case MBEDTLS_ERR_MPI_NOT_ACCEPTABLE:
300 return( PSA_ERROR_INVALID_ARGUMENT );
301 case MBEDTLS_ERR_MPI_ALLOC_FAILED:
302 return( PSA_ERROR_INSUFFICIENT_MEMORY );
303
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100304 case MBEDTLS_ERR_PK_ALLOC_FAILED:
305 return( PSA_ERROR_INSUFFICIENT_MEMORY );
306 case MBEDTLS_ERR_PK_TYPE_MISMATCH:
307 case MBEDTLS_ERR_PK_BAD_INPUT_DATA:
308 return( PSA_ERROR_INVALID_ARGUMENT );
309 case MBEDTLS_ERR_PK_FILE_IO_ERROR:
Gilles Peskinea5905292018-02-07 20:59:33 +0100310 return( PSA_ERROR_STORAGE_FAILURE );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100311 case MBEDTLS_ERR_PK_KEY_INVALID_VERSION:
312 case MBEDTLS_ERR_PK_KEY_INVALID_FORMAT:
313 return( PSA_ERROR_INVALID_ARGUMENT );
314 case MBEDTLS_ERR_PK_UNKNOWN_PK_ALG:
315 return( PSA_ERROR_NOT_SUPPORTED );
316 case MBEDTLS_ERR_PK_PASSWORD_REQUIRED:
317 case MBEDTLS_ERR_PK_PASSWORD_MISMATCH:
318 return( PSA_ERROR_NOT_PERMITTED );
319 case MBEDTLS_ERR_PK_INVALID_PUBKEY:
320 return( PSA_ERROR_INVALID_ARGUMENT );
321 case MBEDTLS_ERR_PK_INVALID_ALG:
322 case MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE:
323 case MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE:
324 return( PSA_ERROR_NOT_SUPPORTED );
325 case MBEDTLS_ERR_PK_SIG_LEN_MISMATCH:
326 return( PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskinea5905292018-02-07 20:59:33 +0100327 case MBEDTLS_ERR_PK_HW_ACCEL_FAILED:
328 return( PSA_ERROR_HARDWARE_FAILURE );
329
Gilles Peskineff2d2002019-05-06 15:26:23 +0200330 case MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED:
331 return( PSA_ERROR_HARDWARE_FAILURE );
332 case MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
333 return( PSA_ERROR_NOT_SUPPORTED );
334
Manuel Pégourié-Gonnard93c08472021-04-15 12:23:55 +0200335 case MBEDTLS_ERR_RIPEMD160_HW_ACCEL_FAILED:
336 return( PSA_ERROR_HARDWARE_FAILURE );
337
Gilles Peskinea5905292018-02-07 20:59:33 +0100338 case MBEDTLS_ERR_RSA_BAD_INPUT_DATA:
339 return( PSA_ERROR_INVALID_ARGUMENT );
340 case MBEDTLS_ERR_RSA_INVALID_PADDING:
341 return( PSA_ERROR_INVALID_PADDING );
342 case MBEDTLS_ERR_RSA_KEY_GEN_FAILED:
343 return( PSA_ERROR_HARDWARE_FAILURE );
344 case MBEDTLS_ERR_RSA_KEY_CHECK_FAILED:
345 return( PSA_ERROR_INVALID_ARGUMENT );
346 case MBEDTLS_ERR_RSA_PUBLIC_FAILED:
347 case MBEDTLS_ERR_RSA_PRIVATE_FAILED:
Gilles Peskine4b3eb692019-05-16 21:35:18 +0200348 return( PSA_ERROR_CORRUPTION_DETECTED );
Gilles Peskinea5905292018-02-07 20:59:33 +0100349 case MBEDTLS_ERR_RSA_VERIFY_FAILED:
350 return( PSA_ERROR_INVALID_SIGNATURE );
351 case MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE:
352 return( PSA_ERROR_BUFFER_TOO_SMALL );
353 case MBEDTLS_ERR_RSA_RNG_FAILED:
Gilles Peskine40d81602020-11-25 00:09:47 +0100354 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
Gilles Peskinea5905292018-02-07 20:59:33 +0100355 case MBEDTLS_ERR_RSA_UNSUPPORTED_OPERATION:
356 return( PSA_ERROR_NOT_SUPPORTED );
357 case MBEDTLS_ERR_RSA_HW_ACCEL_FAILED:
358 return( PSA_ERROR_HARDWARE_FAILURE );
359
Manuel Pégourié-Gonnard93c08472021-04-15 12:23:55 +0200360 case MBEDTLS_ERR_SHA1_HW_ACCEL_FAILED:
361 case MBEDTLS_ERR_SHA256_HW_ACCEL_FAILED:
362 case MBEDTLS_ERR_SHA512_HW_ACCEL_FAILED:
363 return( PSA_ERROR_HARDWARE_FAILURE );
364
Gilles Peskinea5905292018-02-07 20:59:33 +0100365 case MBEDTLS_ERR_XTEA_INVALID_INPUT_LENGTH:
366 return( PSA_ERROR_INVALID_ARGUMENT );
367 case MBEDTLS_ERR_XTEA_HW_ACCEL_FAILED:
368 return( PSA_ERROR_HARDWARE_FAILURE );
369
itayzafrir5c753392018-05-08 11:18:38 +0300370 case MBEDTLS_ERR_ECP_BAD_INPUT_DATA:
itayzafrir7b30f8b2018-05-09 16:07:36 +0300371 case MBEDTLS_ERR_ECP_INVALID_KEY:
itayzafrir5c753392018-05-08 11:18:38 +0300372 return( PSA_ERROR_INVALID_ARGUMENT );
itayzafrir7b30f8b2018-05-09 16:07:36 +0300373 case MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL:
374 return( PSA_ERROR_BUFFER_TOO_SMALL );
375 case MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE:
376 return( PSA_ERROR_NOT_SUPPORTED );
377 case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH:
378 case MBEDTLS_ERR_ECP_VERIFY_FAILED:
379 return( PSA_ERROR_INVALID_SIGNATURE );
380 case MBEDTLS_ERR_ECP_ALLOC_FAILED:
381 return( PSA_ERROR_INSUFFICIENT_MEMORY );
Gilles Peskine40d81602020-11-25 00:09:47 +0100382 case MBEDTLS_ERR_ECP_RANDOM_FAILED:
383 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
itayzafrir7b30f8b2018-05-09 16:07:36 +0300384 case MBEDTLS_ERR_ECP_HW_ACCEL_FAILED:
385 return( PSA_ERROR_HARDWARE_FAILURE );
Gilles Peskine40d81602020-11-25 00:09:47 +0100386
Janos Follatha13b9052019-11-22 12:48:59 +0000387 case MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED:
388 return( PSA_ERROR_CORRUPTION_DETECTED );
itayzafrir5c753392018-05-08 11:18:38 +0300389
Gilles Peskinee59236f2018-01-27 23:32:46 +0100390 default:
David Saadab4ecc272019-02-14 13:48:10 +0200391 return( PSA_ERROR_GENERIC_ERROR );
Gilles Peskinee59236f2018-01-27 23:32:46 +0100392 }
393}
394
Gilles Peskineb0b255c2018-07-06 17:01:38 +0200395
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +0200396
397
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100398/****************************************************************/
399/* Key management */
400/****************************************************************/
401
Gilles Peskine73167e12019-07-12 23:44:37 +0200402#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
403static inline int psa_key_slot_is_external( const psa_key_slot_t *slot )
404{
Gilles Peskine8e338702019-07-30 20:06:31 +0200405 return( psa_key_lifetime_is_external( slot->attr.lifetime ) );
Gilles Peskine73167e12019-07-12 23:44:37 +0200406}
407#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
408
John Durkop07cc04a2020-11-16 22:08:34 -0800409/* For now the MBEDTLS_PSA_ACCEL_ guards are also used here since the
410 * current test driver in key_management.c is using this function
411 * when accelerators are used for ECC key pair and public key.
412 * Once that dependency is resolved these guards can be removed.
413 */
John Durkop9814fa22020-11-04 12:28:15 -0800414#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
John Durkop6ba40d12020-11-10 08:50:04 -0800415 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) || \
416 defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR) || \
417 defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY)
Paul Elliott8ff510a2020-06-02 17:19:28 +0100418mbedtls_ecp_group_id mbedtls_ecc_group_of_psa( psa_ecc_family_t curve,
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100419 size_t bits,
420 int bits_is_sloppy )
Gilles Peskine12313cd2018-06-20 00:20:32 +0200421{
422 switch( curve )
423 {
Paul Elliott8ff510a2020-06-02 17:19:28 +0100424 case PSA_ECC_FAMILY_SECP_R1:
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100425 switch( bits )
Gilles Peskine228abc52019-12-03 17:24:19 +0100426 {
Gilles Peskinea1684f42021-03-23 13:12:34 +0100427#if defined(PSA_WANT_ECC_SECP_R1_192)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100428 case 192:
Gilles Peskine228abc52019-12-03 17:24:19 +0100429 return( MBEDTLS_ECP_DP_SECP192R1 );
Gilles Peskinea1684f42021-03-23 13:12:34 +0100430#endif
431#if defined(PSA_WANT_ECC_SECP_R1_224)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100432 case 224:
Gilles Peskine228abc52019-12-03 17:24:19 +0100433 return( MBEDTLS_ECP_DP_SECP224R1 );
Gilles Peskinea1684f42021-03-23 13:12:34 +0100434#endif
435#if defined(PSA_WANT_ECC_SECP_R1_256)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100436 case 256:
Gilles Peskine228abc52019-12-03 17:24:19 +0100437 return( MBEDTLS_ECP_DP_SECP256R1 );
Gilles Peskinea1684f42021-03-23 13:12:34 +0100438#endif
439#if defined(PSA_WANT_ECC_SECP_R1_384)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100440 case 384:
Gilles Peskine228abc52019-12-03 17:24:19 +0100441 return( MBEDTLS_ECP_DP_SECP384R1 );
Gilles Peskinea1684f42021-03-23 13:12:34 +0100442#endif
443#if defined(PSA_WANT_ECC_SECP_R1_521)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100444 case 521:
Gilles Peskine228abc52019-12-03 17:24:19 +0100445 return( MBEDTLS_ECP_DP_SECP521R1 );
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100446 case 528:
447 if( bits_is_sloppy )
448 return( MBEDTLS_ECP_DP_SECP521R1 );
449 break;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100450#endif
Gilles Peskine228abc52019-12-03 17:24:19 +0100451 }
452 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100453
Paul Elliott8ff510a2020-06-02 17:19:28 +0100454 case PSA_ECC_FAMILY_BRAINPOOL_P_R1:
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100455 switch( bits )
Gilles Peskine228abc52019-12-03 17:24:19 +0100456 {
Gilles Peskinea1684f42021-03-23 13:12:34 +0100457#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100458 case 256:
Gilles Peskine228abc52019-12-03 17:24:19 +0100459 return( MBEDTLS_ECP_DP_BP256R1 );
Gilles Peskinea1684f42021-03-23 13:12:34 +0100460#endif
461#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100462 case 384:
Gilles Peskine228abc52019-12-03 17:24:19 +0100463 return( MBEDTLS_ECP_DP_BP384R1 );
Gilles Peskinea1684f42021-03-23 13:12:34 +0100464#endif
465#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100466 case 512:
Gilles Peskine228abc52019-12-03 17:24:19 +0100467 return( MBEDTLS_ECP_DP_BP512R1 );
Gilles Peskinea1684f42021-03-23 13:12:34 +0100468#endif
Gilles Peskine228abc52019-12-03 17:24:19 +0100469 }
470 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100471
Paul Elliott8ff510a2020-06-02 17:19:28 +0100472 case PSA_ECC_FAMILY_MONTGOMERY:
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100473 switch( bits )
Gilles Peskine228abc52019-12-03 17:24:19 +0100474 {
Gilles Peskinea1684f42021-03-23 13:12:34 +0100475#if defined(PSA_WANT_ECC_MONTGOMERY_255)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100476 case 255:
Gilles Peskine228abc52019-12-03 17:24:19 +0100477 return( MBEDTLS_ECP_DP_CURVE25519 );
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100478 case 256:
479 if( bits_is_sloppy )
480 return( MBEDTLS_ECP_DP_CURVE25519 );
481 break;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100482#endif
483#if defined(PSA_WANT_ECC_MONTGOMERY_448)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100484 case 448:
Gilles Peskine228abc52019-12-03 17:24:19 +0100485 return( MBEDTLS_ECP_DP_CURVE448 );
Gilles Peskinea1684f42021-03-23 13:12:34 +0100486#endif
Gilles Peskine228abc52019-12-03 17:24:19 +0100487 }
488 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100489
Paul Elliott8ff510a2020-06-02 17:19:28 +0100490 case PSA_ECC_FAMILY_SECP_K1:
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100491 switch( bits )
Gilles Peskine228abc52019-12-03 17:24:19 +0100492 {
Gilles Peskinea1684f42021-03-23 13:12:34 +0100493#if defined(PSA_WANT_ECC_SECP_K1_192)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100494 case 192:
Gilles Peskine228abc52019-12-03 17:24:19 +0100495 return( MBEDTLS_ECP_DP_SECP192K1 );
Gilles Peskinea1684f42021-03-23 13:12:34 +0100496#endif
497#if defined(PSA_WANT_ECC_SECP_K1_224)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100498 case 224:
Gilles Peskine228abc52019-12-03 17:24:19 +0100499 return( MBEDTLS_ECP_DP_SECP224K1 );
Gilles Peskinea1684f42021-03-23 13:12:34 +0100500#endif
501#if defined(PSA_WANT_ECC_SECP_K1_256)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100502 case 256:
Gilles Peskine228abc52019-12-03 17:24:19 +0100503 return( MBEDTLS_ECP_DP_SECP256K1 );
Gilles Peskinea1684f42021-03-23 13:12:34 +0100504#endif
Gilles Peskine228abc52019-12-03 17:24:19 +0100505 }
506 break;
Gilles Peskine12313cd2018-06-20 00:20:32 +0200507 }
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100508
Gilles Peskine71f45ba2021-03-23 14:17:55 +0100509 (void) bits_is_sloppy;
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100510 return( MBEDTLS_ECP_DP_NONE );
Gilles Peskine12313cd2018-06-20 00:20:32 +0200511}
John Durkop9814fa22020-11-04 12:28:15 -0800512#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
John Durkop6ba40d12020-11-10 08:50:04 -0800513 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) ||
514 * defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR) ||
515 * defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY) */
Gilles Peskine12313cd2018-06-20 00:20:32 +0200516
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200517static psa_status_t validate_unstructured_key_bit_size( psa_key_type_t type,
518 size_t bits )
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200519{
520 /* Check that the bit size is acceptable for the key type */
521 switch( type )
522 {
523 case PSA_KEY_TYPE_RAW_DATA:
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200524 case PSA_KEY_TYPE_HMAC:
Gilles Peskineea0fb492018-07-12 17:17:20 +0200525 case PSA_KEY_TYPE_DERIVE:
526 break;
Ronald Cron1f0db802021-03-12 09:59:30 +0100527#if defined(PSA_WANT_KEY_TYPE_AES)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200528 case PSA_KEY_TYPE_AES:
529 if( bits != 128 && bits != 192 && bits != 256 )
530 return( PSA_ERROR_INVALID_ARGUMENT );
531 break;
532#endif
Ronald Cron1f0db802021-03-12 09:59:30 +0100533#if defined(PSA_WANT_KEY_TYPE_CAMELLIA)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200534 case PSA_KEY_TYPE_CAMELLIA:
535 if( bits != 128 && bits != 192 && bits != 256 )
536 return( PSA_ERROR_INVALID_ARGUMENT );
537 break;
538#endif
Ronald Cron1f0db802021-03-12 09:59:30 +0100539#if defined(PSA_WANT_KEY_TYPE_DES)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200540 case PSA_KEY_TYPE_DES:
541 if( bits != 64 && bits != 128 && bits != 192 )
542 return( PSA_ERROR_INVALID_ARGUMENT );
543 break;
544#endif
Ronald Cron1f0db802021-03-12 09:59:30 +0100545#if defined(PSA_WANT_KEY_TYPE_ARC4)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200546 case PSA_KEY_TYPE_ARC4:
547 if( bits < 8 || bits > 2048 )
548 return( PSA_ERROR_INVALID_ARGUMENT );
549 break;
550#endif
Ronald Cron1f0db802021-03-12 09:59:30 +0100551#if defined(PSA_WANT_KEY_TYPE_CHACHA20)
Gilles Peskine26869f22019-05-06 15:25:00 +0200552 case PSA_KEY_TYPE_CHACHA20:
553 if( bits != 256 )
554 return( PSA_ERROR_INVALID_ARGUMENT );
555 break;
556#endif
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200557 default:
558 return( PSA_ERROR_NOT_SUPPORTED );
559 }
Gilles Peskineb54979a2018-06-21 09:32:47 +0200560 if( bits % 8 != 0 )
561 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200562
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200563 return( PSA_SUCCESS );
564}
565
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100566/** Check whether a given key type is valid for use with a given MAC algorithm
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100567 *
Steven Cooremancd640932021-03-08 12:00:27 +0100568 * Upon successful return of this function, the behavior of #PSA_MAC_LENGTH
569 * when called with the validated \p algorithm and \p key_type is well-defined.
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100570 *
571 * \param[in] algorithm The specific MAC algorithm (can be wildcard).
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100572 * \param[in] key_type The key type of the key to be used with the
573 * \p algorithm.
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100574 *
575 * \retval #PSA_SUCCESS
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100576 * The \p key_type is valid for use with the \p algorithm
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100577 * \retval #PSA_ERROR_INVALID_ARGUMENT
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100578 * The \p key_type is not valid for use with the \p algorithm
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100579 */
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100580MBEDTLS_STATIC_TESTABLE psa_status_t psa_mac_key_can_do(
Steven Cooreman58c94d32021-03-02 21:31:17 +0100581 psa_algorithm_t algorithm,
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100582 psa_key_type_t key_type )
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100583{
Steven Cooremancd640932021-03-08 12:00:27 +0100584 if( PSA_ALG_IS_HMAC( algorithm ) )
585 {
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100586 if( key_type == PSA_KEY_TYPE_HMAC )
587 return( PSA_SUCCESS );
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100588 }
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100589
590 if( PSA_ALG_IS_BLOCK_CIPHER_MAC( algorithm ) )
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100591 {
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100592 /* Check that we're calling PSA_BLOCK_CIPHER_BLOCK_LENGTH with a cipher
593 * key. */
594 if( ( key_type & PSA_KEY_TYPE_CATEGORY_MASK ) ==
595 PSA_KEY_TYPE_CATEGORY_SYMMETRIC )
596 {
597 /* PSA_BLOCK_CIPHER_BLOCK_LENGTH returns 1 for stream ciphers and
598 * the block length (larger than 1) for block ciphers. */
599 if( PSA_BLOCK_CIPHER_BLOCK_LENGTH( key_type ) > 1 )
600 return( PSA_SUCCESS );
601 }
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100602 }
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100603
604 return( PSA_ERROR_INVALID_ARGUMENT );
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100605}
606
Steven Cooreman7609b1f2021-04-06 16:45:06 +0200607psa_status_t psa_allocate_buffer_to_slot( psa_key_slot_t *slot,
608 size_t buffer_length )
Steven Cooreman75b74362020-07-28 14:30:13 +0200609{
Ronald Cronea0f8a62020-11-25 17:52:23 +0100610 if( slot->key.data != NULL )
Steven Cooreman29149862020-08-05 15:43:42 +0200611 return( PSA_ERROR_ALREADY_EXISTS );
Steven Cooreman75b74362020-07-28 14:30:13 +0200612
Ronald Cronea0f8a62020-11-25 17:52:23 +0100613 slot->key.data = mbedtls_calloc( 1, buffer_length );
614 if( slot->key.data == NULL )
Steven Cooreman29149862020-08-05 15:43:42 +0200615 return( PSA_ERROR_INSUFFICIENT_MEMORY );
Steven Cooreman75b74362020-07-28 14:30:13 +0200616
Ronald Cronea0f8a62020-11-25 17:52:23 +0100617 slot->key.bytes = buffer_length;
Steven Cooreman29149862020-08-05 15:43:42 +0200618 return( PSA_SUCCESS );
Steven Cooreman75b74362020-07-28 14:30:13 +0200619}
620
Steven Cooremanf7cebd42020-10-13 20:27:40 +0200621psa_status_t psa_copy_key_material_into_slot( psa_key_slot_t *slot,
622 const uint8_t* data,
623 size_t data_length )
624{
625 psa_status_t status = psa_allocate_buffer_to_slot( slot,
626 data_length );
627 if( status != PSA_SUCCESS )
628 return( status );
629
Ronald Cronea0f8a62020-11-25 17:52:23 +0100630 memcpy( slot->key.data, data, data_length );
Steven Cooremanf7cebd42020-10-13 20:27:40 +0200631 return( PSA_SUCCESS );
632}
633
Ronald Crona0fe59f2020-11-29 11:14:53 +0100634psa_status_t psa_import_key_into_slot(
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100635 const psa_key_attributes_t *attributes,
636 const uint8_t *data, size_t data_length,
637 uint8_t *key_buffer, size_t key_buffer_size,
638 size_t *key_buffer_length, size_t *bits )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100639{
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100640 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
641 psa_key_type_t type = attributes->core.type;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100642
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200643 /* zero-length keys are never supported. */
644 if( data_length == 0 )
645 return( PSA_ERROR_NOT_SUPPORTED );
646
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100647 if( key_type_is_raw_bytes( type ) )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100648 {
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100649 *bits = PSA_BYTES_TO_BITS( data_length );
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200650
Steven Cooreman75b74362020-07-28 14:30:13 +0200651 /* Ensure that the bytes-to-bits conversion hasn't overflown. */
652 if( data_length > SIZE_MAX / 8 )
653 return( PSA_ERROR_NOT_SUPPORTED );
654
Gilles Peskine1b9505c2019-08-07 10:59:45 +0200655 /* Enforce a size limit, and in particular ensure that the bit
656 * size fits in its representation type. */
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100657 if( ( *bits ) > PSA_MAX_KEY_BITS )
Gilles Peskinec744d992019-07-30 17:26:54 +0200658 return( PSA_ERROR_NOT_SUPPORTED );
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200659
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100660 status = validate_unstructured_key_bit_size( type, *bits );
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200661 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +0200662 return( status );
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200663
Ronald Crondd04d422020-11-28 15:14:42 +0100664 /* Copy the key material. */
665 memcpy( key_buffer, data, data_length );
666 *key_buffer_length = data_length;
667 (void)key_buffer_size;
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200668
Steven Cooreman40120f62020-10-29 11:42:22 +0100669 return( PSA_SUCCESS );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100670 }
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100671 else if( PSA_KEY_TYPE_IS_ASYMMETRIC( type ) )
Steven Cooreman19fd5742020-07-24 23:31:01 +0200672 {
John Durkop9814fa22020-11-04 12:28:15 -0800673#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
674 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100675 if( PSA_KEY_TYPE_IS_ECC( type ) )
Steven Cooreman3ea0ce42020-10-23 11:37:05 +0200676 {
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100677 return( mbedtls_psa_ecp_import_key( attributes,
678 data, data_length,
679 key_buffer, key_buffer_size,
680 key_buffer_length,
681 bits ) );
Steven Cooreman40120f62020-10-29 11:42:22 +0100682 }
John Durkop9814fa22020-11-04 12:28:15 -0800683#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
684 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
John Durkop0e005192020-10-31 22:06:54 -0700685#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
686 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100687 if( PSA_KEY_TYPE_IS_RSA( type ) )
Steven Cooreman3ea0ce42020-10-23 11:37:05 +0200688 {
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100689 return( mbedtls_psa_rsa_import_key( attributes,
690 data, data_length,
691 key_buffer, key_buffer_size,
692 key_buffer_length,
693 bits ) );
Steven Cooreman3ea0ce42020-10-23 11:37:05 +0200694 }
John Durkop9814fa22020-11-04 12:28:15 -0800695#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
696 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100697 }
Steven Cooreman40120f62020-10-29 11:42:22 +0100698
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100699 return( PSA_ERROR_NOT_SUPPORTED );
Darryl Green06fd18d2018-07-16 11:21:11 +0100700}
701
Gilles Peskinef603c712019-01-19 13:40:11 +0100702/** Calculate the intersection of two algorithm usage policies.
703 *
704 * Return 0 (which allows no operation) on incompatibility.
705 */
706static psa_algorithm_t psa_key_policy_algorithm_intersection(
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100707 psa_key_type_t key_type,
Gilles Peskinef603c712019-01-19 13:40:11 +0100708 psa_algorithm_t alg1,
709 psa_algorithm_t alg2 )
710{
Gilles Peskine549ea862019-05-22 11:45:59 +0200711 /* Common case: both sides actually specify the same policy. */
Gilles Peskinef603c712019-01-19 13:40:11 +0100712 if( alg1 == alg2 )
713 return( alg1 );
Steven Cooreman03488022021-02-18 12:07:20 +0100714 /* If the policies are from the same hash-and-sign family, check
715 * if one is a wildcard. If so the other has the specific algorithm. */
716 if( PSA_ALG_IS_HASH_AND_SIGN( alg1 ) &&
717 PSA_ALG_IS_HASH_AND_SIGN( alg2 ) &&
718 ( alg1 & ~PSA_ALG_HASH_MASK ) == ( alg2 & ~PSA_ALG_HASH_MASK ) )
Gilles Peskinef603c712019-01-19 13:40:11 +0100719 {
Steven Cooreman03488022021-02-18 12:07:20 +0100720 if( PSA_ALG_SIGN_GET_HASH( alg1 ) == PSA_ALG_ANY_HASH )
721 return( alg2 );
722 if( PSA_ALG_SIGN_GET_HASH( alg2 ) == PSA_ALG_ANY_HASH )
723 return( alg1 );
724 }
725 /* If the policies are from the same AEAD family, check whether
Steven Cooreman7de9e2d2021-02-22 17:05:56 +0100726 * one of them is a minimum-tag-length wildcard. Calculate the most
Steven Cooreman03488022021-02-18 12:07:20 +0100727 * restrictive tag length. */
728 if( PSA_ALG_IS_AEAD( alg1 ) && PSA_ALG_IS_AEAD( alg2 ) &&
729 ( PSA_ALG_AEAD_WITH_SHORTENED_TAG( alg1, 0 ) ==
730 PSA_ALG_AEAD_WITH_SHORTENED_TAG( alg2, 0 ) ) )
731 {
732 size_t alg1_len = PSA_ALG_AEAD_GET_TAG_LENGTH( alg1 );
733 size_t alg2_len = PSA_ALG_AEAD_GET_TAG_LENGTH( alg2 );
Steven Cooremancd640932021-03-08 12:00:27 +0100734 size_t restricted_len = alg1_len > alg2_len ? alg1_len : alg2_len;
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100735
Steven Cooreman7de9e2d2021-02-22 17:05:56 +0100736 /* If both are wildcards, return most restrictive wildcard */
Steven Cooremand927ed72021-02-22 19:59:35 +0100737 if( ( ( alg1 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG ) != 0 ) &&
738 ( ( alg2 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG ) != 0 ) )
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100739 {
Steven Cooremancd640932021-03-08 12:00:27 +0100740 return( PSA_ALG_AEAD_WITH_AT_LEAST_THIS_LENGTH_TAG(
741 alg1, restricted_len ) );
Steven Cooreman03488022021-02-18 12:07:20 +0100742 }
743 /* If only one is a wildcard, return specific algorithm if compatible. */
Steven Cooremand927ed72021-02-22 19:59:35 +0100744 if( ( ( alg1 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG ) != 0 ) &&
Steven Cooreman03488022021-02-18 12:07:20 +0100745 ( alg1_len <= alg2_len ) )
746 {
747 return( alg2 );
748 }
Steven Cooremand927ed72021-02-22 19:59:35 +0100749 if( ( ( alg2 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG ) != 0 ) &&
Steven Cooreman03488022021-02-18 12:07:20 +0100750 ( alg2_len <= alg1_len ) )
751 {
752 return( alg1 );
753 }
754 }
755 /* If the policies are from the same MAC family, check whether one
756 * of them is a minimum-MAC-length policy. Calculate the most
757 * restrictive tag length. */
758 if( PSA_ALG_IS_MAC( alg1 ) && PSA_ALG_IS_MAC( alg2 ) &&
759 ( PSA_ALG_FULL_LENGTH_MAC( alg1 ) ==
760 PSA_ALG_FULL_LENGTH_MAC( alg2 ) ) )
761 {
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100762 /* Validate the combination of key type and algorithm. Since the base
763 * algorithm of alg1 and alg2 are the same, we only need this once. */
764 if( PSA_SUCCESS != psa_mac_key_can_do( alg1, key_type ) )
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100765 return( 0 );
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100766
Steven Cooreman31a876d2021-03-03 20:47:40 +0100767 /* Get the (exact or at-least) output lengths for both sides of the
768 * requested intersection. None of the currently supported algorithms
769 * have an output length dependent on the actual key size, so setting it
770 * to a bogus value of 0 is currently OK.
771 *
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100772 * Note that for at-least-this-length wildcard algorithms, the output
773 * length is set to the shortest allowed length, which allows us to
774 * calculate the most restrictive tag length for the intersection. */
775 size_t alg1_len = PSA_MAC_LENGTH( key_type, 0, alg1 );
776 size_t alg2_len = PSA_MAC_LENGTH( key_type, 0, alg2 );
Steven Cooremancd640932021-03-08 12:00:27 +0100777 size_t restricted_len = alg1_len > alg2_len ? alg1_len : alg2_len;
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100778
Steven Cooremana1d83222021-02-25 10:20:29 +0100779 /* If both are wildcards, return most restrictive wildcard */
Steven Cooremand927ed72021-02-22 19:59:35 +0100780 if( ( ( alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG ) != 0 ) &&
781 ( ( alg2 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG ) != 0 ) )
Steven Cooreman03488022021-02-18 12:07:20 +0100782 {
Steven Cooremancd640932021-03-08 12:00:27 +0100783 return( PSA_ALG_AT_LEAST_THIS_LENGTH_MAC( alg1, restricted_len ) );
Steven Cooreman03488022021-02-18 12:07:20 +0100784 }
Steven Cooreman31a876d2021-03-03 20:47:40 +0100785
786 /* If only one is an at-least-this-length policy, the intersection would
787 * be the other (fixed-length) policy as long as said fixed length is
788 * equal to or larger than the shortest allowed length. */
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100789 if( ( alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG ) != 0 )
Steven Cooreman03488022021-02-18 12:07:20 +0100790 {
Steven Cooremancd640932021-03-08 12:00:27 +0100791 return( ( alg1_len <= alg2_len ) ? alg2 : 0 );
Steven Cooreman03488022021-02-18 12:07:20 +0100792 }
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100793 if( ( alg2 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG ) != 0 )
Steven Cooreman03488022021-02-18 12:07:20 +0100794 {
Steven Cooremancd640932021-03-08 12:00:27 +0100795 return( ( alg2_len <= alg1_len ) ? alg1 : 0 );
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100796 }
Steven Cooreman31a876d2021-03-03 20:47:40 +0100797
Steven Cooremancd640932021-03-08 12:00:27 +0100798 /* If none of them are wildcards, check whether they define the same tag
799 * length. This is still possible here when one is default-length and
800 * the other specific-length. Ensure to always return the
801 * specific-length version for the intersection. */
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100802 if( alg1_len == alg2_len )
803 return( PSA_ALG_TRUNCATED_MAC( alg1, alg1_len ) );
Gilles Peskinef603c712019-01-19 13:40:11 +0100804 }
805 /* If the policies are incompatible, allow nothing. */
806 return( 0 );
807}
808
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100809static int psa_key_algorithm_permits( psa_key_type_t key_type,
810 psa_algorithm_t policy_alg,
Gilles Peskined6f371b2019-05-10 19:33:38 +0200811 psa_algorithm_t requested_alg )
812{
Gilles Peskine549ea862019-05-22 11:45:59 +0200813 /* Common case: the policy only allows requested_alg. */
Gilles Peskined6f371b2019-05-10 19:33:38 +0200814 if( requested_alg == policy_alg )
815 return( 1 );
Steven Cooreman03488022021-02-18 12:07:20 +0100816 /* If policy_alg is a hash-and-sign with a wildcard for the hash,
817 * and requested_alg is the same hash-and-sign family with any hash,
818 * then requested_alg is compliant with policy_alg. */
819 if( PSA_ALG_IS_HASH_AND_SIGN( requested_alg ) &&
820 PSA_ALG_SIGN_GET_HASH( policy_alg ) == PSA_ALG_ANY_HASH )
Gilles Peskined6f371b2019-05-10 19:33:38 +0200821 {
Steven Cooreman03488022021-02-18 12:07:20 +0100822 return( ( policy_alg & ~PSA_ALG_HASH_MASK ) ==
823 ( requested_alg & ~PSA_ALG_HASH_MASK ) );
824 }
825 /* If policy_alg is a wildcard AEAD algorithm of the same base as
826 * the requested algorithm, check the requested tag length to be
827 * equal-length or longer than the wildcard-specified length. */
828 if( PSA_ALG_IS_AEAD( policy_alg ) &&
829 PSA_ALG_IS_AEAD( requested_alg ) &&
830 ( PSA_ALG_AEAD_WITH_SHORTENED_TAG( policy_alg, 0 ) ==
831 PSA_ALG_AEAD_WITH_SHORTENED_TAG( requested_alg, 0 ) ) &&
Steven Cooremand927ed72021-02-22 19:59:35 +0100832 ( ( policy_alg & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG ) != 0 ) )
Steven Cooreman03488022021-02-18 12:07:20 +0100833 {
834 return( PSA_ALG_AEAD_GET_TAG_LENGTH( policy_alg ) <=
835 PSA_ALG_AEAD_GET_TAG_LENGTH( requested_alg ) );
836 }
Steven Cooremancd640932021-03-08 12:00:27 +0100837 /* If policy_alg is a MAC algorithm of the same base as the requested
838 * algorithm, check whether their MAC lengths are compatible. */
Steven Cooreman03488022021-02-18 12:07:20 +0100839 if( PSA_ALG_IS_MAC( policy_alg ) &&
840 PSA_ALG_IS_MAC( requested_alg ) &&
841 ( PSA_ALG_FULL_LENGTH_MAC( policy_alg ) ==
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100842 PSA_ALG_FULL_LENGTH_MAC( requested_alg ) ) )
Steven Cooreman03488022021-02-18 12:07:20 +0100843 {
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100844 /* Validate the combination of key type and algorithm. Since the policy
845 * and requested algorithms are the same, we only need this once. */
846 if( PSA_SUCCESS != psa_mac_key_can_do( policy_alg, key_type ) )
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100847 return( 0 );
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100848
Steven Cooreman31a876d2021-03-03 20:47:40 +0100849 /* Get both the requested output length for the algorithm which is to be
850 * verified, and the default output length for the base algorithm.
851 * Note that none of the currently supported algorithms have an output
852 * length dependent on actual key size, so setting it to a bogus value
853 * of 0 is currently OK. */
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100854 size_t requested_output_length = PSA_MAC_LENGTH(
855 key_type, 0, requested_alg );
856 size_t default_output_length = PSA_MAC_LENGTH(
857 key_type, 0,
858 PSA_ALG_FULL_LENGTH_MAC( requested_alg ) );
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100859
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100860 /* If the policy is default-length, only allow an algorithm with
861 * a declared exact-length matching the default. */
862 if( PSA_MAC_TRUNCATED_LENGTH( policy_alg ) == 0 )
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100863 return( requested_output_length == default_output_length );
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100864
865 /* If the requested algorithm is default-length, allow it if the policy
Steven Cooremancd640932021-03-08 12:00:27 +0100866 * length exactly matches the default length. */
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100867 if( PSA_MAC_TRUNCATED_LENGTH( requested_alg ) == 0 &&
868 PSA_MAC_TRUNCATED_LENGTH( policy_alg ) == default_output_length )
869 {
870 return( 1 );
871 }
872
Steven Cooremancd640932021-03-08 12:00:27 +0100873 /* If policy_alg is an at-least-this-length wildcard MAC algorithm,
874 * check for the requested MAC length to be equal to or longer than the
875 * minimum allowed length. */
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100876 if( ( policy_alg & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG ) != 0 )
877 {
878 return( PSA_MAC_TRUNCATED_LENGTH( policy_alg ) <=
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100879 requested_output_length );
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100880 }
Gilles Peskined6f371b2019-05-10 19:33:38 +0200881 }
Steven Cooremance48e852020-10-05 16:02:45 +0200882 /* If policy_alg is a generic key agreement operation, then using it for
Steven Cooremanfa5e6312020-10-15 17:07:12 +0200883 * a key derivation with that key agreement should also be allowed. This
884 * behaviour is expected to be defined in a future specification version. */
Steven Cooremance48e852020-10-05 16:02:45 +0200885 if( PSA_ALG_IS_RAW_KEY_AGREEMENT( policy_alg ) &&
886 PSA_ALG_IS_KEY_AGREEMENT( requested_alg ) )
887 {
888 return( PSA_ALG_KEY_AGREEMENT_GET_BASE( requested_alg ) ==
889 policy_alg );
890 }
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100891 /* If it isn't explicitly permitted, it's forbidden. */
Gilles Peskined6f371b2019-05-10 19:33:38 +0200892 return( 0 );
893}
894
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100895/** Test whether a policy permits an algorithm.
896 *
897 * The caller must test usage flags separately.
Steven Cooreman7e39f052021-02-23 14:18:32 +0100898 *
Steven Cooreman5a172672021-03-02 21:27:42 +0100899 * \note This function requires providing the key type for which the policy is
900 * being validated, since some algorithm policy definitions (e.g. MAC)
901 * have different properties depending on what kind of cipher it is
902 * combined with.
903 *
Steven Cooreman7e39f052021-02-23 14:18:32 +0100904 * \retval PSA_SUCCESS When \p alg is a specific algorithm
905 * allowed by the \p policy.
906 * \retval PSA_ERROR_INVALID_ARGUMENT When \p alg is not a specific algorithm
907 * \retval PSA_ERROR_NOT_PERMITTED When \p alg is a specific algorithm, but
908 * the \p policy does not allow it.
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100909 */
Steven Cooreman7e39f052021-02-23 14:18:32 +0100910static psa_status_t psa_key_policy_permits( const psa_key_policy_t *policy,
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100911 psa_key_type_t key_type,
Steven Cooreman7e39f052021-02-23 14:18:32 +0100912 psa_algorithm_t alg )
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100913{
Steven Cooremand788fab2021-02-25 11:29:17 +0100914 /* '0' is not a valid algorithm */
915 if( alg == 0 )
916 return( PSA_ERROR_INVALID_ARGUMENT );
917
Steven Cooreman7e39f052021-02-23 14:18:32 +0100918 /* A requested algorithm cannot be a wildcard. */
919 if( PSA_ALG_IS_WILDCARD( alg ) )
920 return( PSA_ERROR_INVALID_ARGUMENT );
921
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100922 if( psa_key_algorithm_permits( key_type, policy->alg, alg ) ||
923 psa_key_algorithm_permits( key_type, policy->alg2, alg ) )
Steven Cooreman7e39f052021-02-23 14:18:32 +0100924 return( PSA_SUCCESS );
925 else
926 return( PSA_ERROR_NOT_PERMITTED );
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100927}
928
Gilles Peskinef603c712019-01-19 13:40:11 +0100929/** Restrict a key policy based on a constraint.
930 *
Steven Cooreman5a172672021-03-02 21:27:42 +0100931 * \note This function requires providing the key type for which the policy is
932 * being restricted, since some algorithm policy definitions (e.g. MAC)
933 * have different properties depending on what kind of cipher it is
934 * combined with.
935 *
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100936 * \param[in] key_type The key type for which to restrict the policy
Gilles Peskinef603c712019-01-19 13:40:11 +0100937 * \param[in,out] policy The policy to restrict.
938 * \param[in] constraint The policy constraint to apply.
939 *
940 * \retval #PSA_SUCCESS
941 * \c *policy contains the intersection of the original value of
942 * \c *policy and \c *constraint.
943 * \retval #PSA_ERROR_INVALID_ARGUMENT
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100944 * \c key_type, \c *policy and \c *constraint are incompatible.
Gilles Peskinef603c712019-01-19 13:40:11 +0100945 * \c *policy is unchanged.
946 */
947static psa_status_t psa_restrict_key_policy(
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100948 psa_key_type_t key_type,
Gilles Peskinef603c712019-01-19 13:40:11 +0100949 psa_key_policy_t *policy,
950 const psa_key_policy_t *constraint )
951{
952 psa_algorithm_t intersection_alg =
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100953 psa_key_policy_algorithm_intersection( key_type, policy->alg,
954 constraint->alg );
Gilles Peskined6f371b2019-05-10 19:33:38 +0200955 psa_algorithm_t intersection_alg2 =
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100956 psa_key_policy_algorithm_intersection( key_type, policy->alg2,
957 constraint->alg2 );
Gilles Peskinef603c712019-01-19 13:40:11 +0100958 if( intersection_alg == 0 && policy->alg != 0 && constraint->alg != 0 )
959 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskined6f371b2019-05-10 19:33:38 +0200960 if( intersection_alg2 == 0 && policy->alg2 != 0 && constraint->alg2 != 0 )
961 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskinef603c712019-01-19 13:40:11 +0100962 policy->usage &= constraint->usage;
963 policy->alg = intersection_alg;
Gilles Peskined6f371b2019-05-10 19:33:38 +0200964 policy->alg2 = intersection_alg2;
Gilles Peskinef603c712019-01-19 13:40:11 +0100965 return( PSA_SUCCESS );
966}
967
Ronald Cron5c522922020-11-14 16:35:34 +0100968/** Get the description of a key given its identifier and policy constraints
969 * and lock it.
Ronald Cronf95a2b12020-10-22 15:24:49 +0200970 *
Ronald Cron5c522922020-11-14 16:35:34 +0100971 * The key must have allow all the usage flags set in \p usage. If \p alg is
Steven Cooremand788fab2021-02-25 11:29:17 +0100972 * nonzero, the key must allow operations with this algorithm. If \p alg is
973 * zero, the algorithm is not checked.
Ronald Cron7587ae42020-11-11 15:04:25 +0100974 *
Ronald Cron5c522922020-11-14 16:35:34 +0100975 * In case of a persistent key, the function loads the description of the key
976 * into a key slot if not already done.
977 *
978 * On success, the returned key slot is locked. It is the responsibility of
979 * the caller to unlock the key slot when it does not access it anymore.
Ronald Cronf95a2b12020-10-22 15:24:49 +0200980 */
Ronald Cron5c522922020-11-14 16:35:34 +0100981static psa_status_t psa_get_and_lock_key_slot_with_policy(
982 mbedtls_svc_key_id_t key,
983 psa_key_slot_t **p_slot,
984 psa_key_usage_t usage,
985 psa_algorithm_t alg )
Darryl Green06fd18d2018-07-16 11:21:11 +0100986{
Ronald Cronf95a2b12020-10-22 15:24:49 +0200987 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
988 psa_key_slot_t *slot;
Darryl Green06fd18d2018-07-16 11:21:11 +0100989
Ronald Cron5c522922020-11-14 16:35:34 +0100990 status = psa_get_and_lock_key_slot( key, p_slot );
Darryl Green06fd18d2018-07-16 11:21:11 +0100991 if( status != PSA_SUCCESS )
992 return( status );
Ronald Cronf95a2b12020-10-22 15:24:49 +0200993 slot = *p_slot;
Darryl Green06fd18d2018-07-16 11:21:11 +0100994
995 /* Enforce that usage policy for the key slot contains all the flags
996 * required by the usage parameter. There is one exception: public
997 * keys can always be exported, so we treat public key objects as
998 * if they had the export flag. */
Gilles Peskine8e338702019-07-30 20:06:31 +0200999 if( PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->attr.type ) )
Darryl Green06fd18d2018-07-16 11:21:11 +01001000 usage &= ~PSA_KEY_USAGE_EXPORT;
Ronald Cronf95a2b12020-10-22 15:24:49 +02001001
Gilles Peskine8e338702019-07-30 20:06:31 +02001002 if( ( slot->attr.policy.usage & usage ) != usage )
Steven Cooreman328f11c2021-03-02 11:44:51 +01001003 {
1004 status = PSA_ERROR_NOT_PERMITTED;
Ronald Cronf95a2b12020-10-22 15:24:49 +02001005 goto error;
Steven Cooreman328f11c2021-03-02 11:44:51 +01001006 }
Gilles Peskine30f77cd2019-01-14 16:06:39 +01001007
1008 /* Enforce that the usage policy permits the requested algortihm. */
Steven Cooreman7e39f052021-02-23 14:18:32 +01001009 if( alg != 0 )
1010 {
Steven Cooreman5ad4bf72021-03-02 15:11:57 +01001011 status = psa_key_policy_permits( &slot->attr.policy,
1012 slot->attr.type,
1013 alg );
Steven Cooreman7e39f052021-02-23 14:18:32 +01001014 if( status != PSA_SUCCESS )
1015 goto error;
1016 }
Darryl Green06fd18d2018-07-16 11:21:11 +01001017
Darryl Green06fd18d2018-07-16 11:21:11 +01001018 return( PSA_SUCCESS );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001019
1020error:
1021 *p_slot = NULL;
Ronald Cron5c522922020-11-14 16:35:34 +01001022 psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001023
1024 return( status );
Darryl Green06fd18d2018-07-16 11:21:11 +01001025}
Darryl Green940d72c2018-07-13 13:18:51 +01001026
Ronald Cron5c522922020-11-14 16:35:34 +01001027/** Get a key slot containing a transparent key and lock it.
Gilles Peskine28f8f302019-07-24 13:30:31 +02001028 *
1029 * A transparent key is a key for which the key material is directly
1030 * available, as opposed to a key in a secure element.
1031 *
Ronald Cron5c522922020-11-14 16:35:34 +01001032 * This is a temporary function to use instead of
1033 * psa_get_and_lock_key_slot_with_policy() until secure element support is
1034 * fully implemented.
Ronald Cronf95a2b12020-10-22 15:24:49 +02001035 *
Ronald Cron5c522922020-11-14 16:35:34 +01001036 * On success, the returned key slot is locked. It is the responsibility of the
1037 * caller to unlock the key slot when it does not access it anymore.
Gilles Peskine28f8f302019-07-24 13:30:31 +02001038 */
1039#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Ronald Cron5c522922020-11-14 16:35:34 +01001040static psa_status_t psa_get_and_lock_transparent_key_slot_with_policy(
1041 mbedtls_svc_key_id_t key,
1042 psa_key_slot_t **p_slot,
1043 psa_key_usage_t usage,
1044 psa_algorithm_t alg )
Gilles Peskine28f8f302019-07-24 13:30:31 +02001045{
Ronald Cron5c522922020-11-14 16:35:34 +01001046 psa_status_t status = psa_get_and_lock_key_slot_with_policy( key, p_slot,
1047 usage, alg );
Gilles Peskine28f8f302019-07-24 13:30:31 +02001048 if( status != PSA_SUCCESS )
1049 return( status );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001050
Gilles Peskineadad8132019-07-25 11:31:23 +02001051 if( psa_key_slot_is_external( *p_slot ) )
Gilles Peskine28f8f302019-07-24 13:30:31 +02001052 {
Ronald Cron5c522922020-11-14 16:35:34 +01001053 psa_unlock_key_slot( *p_slot );
Gilles Peskine28f8f302019-07-24 13:30:31 +02001054 *p_slot = NULL;
1055 return( PSA_ERROR_NOT_SUPPORTED );
1056 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02001057
Gilles Peskine28f8f302019-07-24 13:30:31 +02001058 return( PSA_SUCCESS );
1059}
1060#else /* MBEDTLS_PSA_CRYPTO_SE_C */
1061/* With no secure element support, all keys are transparent. */
Ronald Cron5c522922020-11-14 16:35:34 +01001062#define psa_get_and_lock_transparent_key_slot_with_policy( key, p_slot, usage, alg ) \
1063 psa_get_and_lock_key_slot_with_policy( key, p_slot, usage, alg )
Gilles Peskine28f8f302019-07-24 13:30:31 +02001064#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1065
Steven Cooreman7ddee7f2021-04-07 18:08:30 +02001066psa_status_t psa_remove_key_data_from_memory( psa_key_slot_t *slot )
Darryl Green40225ba2018-11-15 14:48:15 +00001067{
Ronald Cronea0f8a62020-11-25 17:52:23 +01001068 /* Data pointer will always be either a valid pointer or NULL in an
1069 * initialized slot, so we can just free it. */
1070 if( slot->key.data != NULL )
1071 mbedtls_platform_zeroize( slot->key.data, slot->key.bytes);
1072
1073 mbedtls_free( slot->key.data );
1074 slot->key.data = NULL;
1075 slot->key.bytes = 0;
Darryl Green40225ba2018-11-15 14:48:15 +00001076
1077 return( PSA_SUCCESS );
1078}
1079
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001080/** Completely wipe a slot in memory, including its policy.
1081 * Persistent storage is not affected. */
Gilles Peskine66fb1262018-12-10 16:29:04 +01001082psa_status_t psa_wipe_key_slot( psa_key_slot_t *slot )
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001083{
1084 psa_status_t status = psa_remove_key_data_from_memory( slot );
Ronald Cronddd3d052020-10-30 14:07:07 +01001085
1086 /*
1087 * As the return error code may not be handled in case of multiple errors,
Ronald Cron5c522922020-11-14 16:35:34 +01001088 * do our best to report an unexpected lock counter: if available
Ronald Cronddd3d052020-10-30 14:07:07 +01001089 * call MBEDTLS_PARAM_FAILED that may terminate execution (if called as
1090 * part of the execution of a test suite this will stop the test suite
Ronald Cron4640c152020-11-13 10:11:01 +01001091 * execution).
Ronald Cronddd3d052020-10-30 14:07:07 +01001092 */
Ronald Cron5c522922020-11-14 16:35:34 +01001093 if( slot->lock_count != 1 )
Ronald Cronddd3d052020-10-30 14:07:07 +01001094 {
1095#ifdef MBEDTLS_CHECK_PARAMS
Ronald Cron5c522922020-11-14 16:35:34 +01001096 MBEDTLS_PARAM_FAILED( slot->lock_count == 1 );
Ronald Cronddd3d052020-10-30 14:07:07 +01001097#endif
Ronald Cronddd3d052020-10-30 14:07:07 +01001098 status = PSA_ERROR_CORRUPTION_DETECTED;
1099 }
1100
Gilles Peskine3f7cd622019-08-13 15:01:08 +02001101 /* Multipart operations may still be using the key. This is safe
1102 * because all multipart operation objects are independent from
1103 * the key slot: if they need to access the key after the setup
1104 * phase, they have a copy of the key. Note that this means that
1105 * key material can linger until all operations are completed. */
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001106 /* At this point, key material and other type-specific content has
1107 * been wiped. Clear remaining metadata. We can call memset and not
1108 * zeroize because the metadata is not particularly sensitive. */
1109 memset( slot, 0, sizeof( *slot ) );
1110 return( status );
1111}
1112
Ronald Croncf56a0a2020-08-04 09:51:30 +02001113psa_status_t psa_destroy_key( mbedtls_svc_key_id_t key )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001114{
Gilles Peskine2f060a82018-12-04 17:12:32 +01001115 psa_key_slot_t *slot;
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001116 psa_status_t status; /* status of the last operation */
1117 psa_status_t overall_status = PSA_SUCCESS;
Gilles Peskine354f7672019-07-12 23:46:38 +02001118#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1119 psa_se_drv_table_entry_t *driver;
1120#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001121
Ronald Croncf56a0a2020-08-04 09:51:30 +02001122 if( mbedtls_svc_key_id_is_null( key ) )
Gilles Peskine1841cf42019-10-08 15:48:25 +02001123 return( PSA_SUCCESS );
1124
Ronald Cronf2911112020-10-29 17:51:10 +01001125 /*
Ronald Cron19daca92020-11-10 18:08:03 +01001126 * Get the description of the key in a key slot. In case of a persistent
Ronald Cronf2911112020-10-29 17:51:10 +01001127 * key, this will load the key description from persistent memory if not
1128 * done yet. We cannot avoid this loading as without it we don't know if
1129 * the key is operated by an SE or not and this information is needed by
1130 * the current implementation.
1131 */
Ronald Cron5c522922020-11-14 16:35:34 +01001132 status = psa_get_and_lock_key_slot( key, &slot );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02001133 if( status != PSA_SUCCESS )
1134 return( status );
Gilles Peskine354f7672019-07-12 23:46:38 +02001135
Ronald Cronf2911112020-10-29 17:51:10 +01001136 /*
1137 * If the key slot containing the key description is under access by the
1138 * library (apart from the present access), the key cannot be destroyed
1139 * yet. For the time being, just return in error. Eventually (to be
1140 * implemented), the key should be destroyed when all accesses have
1141 * stopped.
1142 */
Ronald Cron5c522922020-11-14 16:35:34 +01001143 if( slot->lock_count > 1 )
Ronald Cronf2911112020-10-29 17:51:10 +01001144 {
Ronald Cron5c522922020-11-14 16:35:34 +01001145 psa_unlock_key_slot( slot );
Ronald Cronf2911112020-10-29 17:51:10 +01001146 return( PSA_ERROR_GENERIC_ERROR );
1147 }
1148
Gilles Peskine354f7672019-07-12 23:46:38 +02001149#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine8e338702019-07-30 20:06:31 +02001150 driver = psa_get_se_driver_entry( slot->attr.lifetime );
Gilles Peskine354f7672019-07-12 23:46:38 +02001151 if( driver != NULL )
Gilles Peskinefc762652019-07-22 19:30:34 +02001152 {
Gilles Peskine60450a42019-07-25 11:32:45 +02001153 /* For a key in a secure element, we need to do three things:
1154 * remove the key file in internal storage, destroy the
1155 * key inside the secure element, and update the driver's
1156 * persistent data. Start a transaction that will encompass these
1157 * three actions. */
Gilles Peskinefc762652019-07-22 19:30:34 +02001158 psa_crypto_prepare_transaction( PSA_CRYPTO_TRANSACTION_DESTROY_KEY );
Gilles Peskine8e338702019-07-30 20:06:31 +02001159 psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
Ronald Cronea0f8a62020-11-25 17:52:23 +01001160 psa_crypto_transaction.key.slot = psa_key_slot_get_slot_number( slot );
Gilles Peskine8e338702019-07-30 20:06:31 +02001161 psa_crypto_transaction.key.id = slot->attr.id;
Gilles Peskinefc762652019-07-22 19:30:34 +02001162 status = psa_crypto_save_transaction( );
1163 if( status != PSA_SUCCESS )
1164 {
Gilles Peskine66be51c2019-07-25 18:02:52 +02001165 (void) psa_crypto_stop_transaction( );
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001166 /* We should still try to destroy the key in the secure
1167 * element and the key metadata in storage. This is especially
1168 * important if the error is that the storage is full.
1169 * But how to do it exactly without risking an inconsistent
1170 * state after a reset?
1171 * https://github.com/ARMmbed/mbed-crypto/issues/215
1172 */
1173 overall_status = status;
1174 goto exit;
Gilles Peskinefc762652019-07-22 19:30:34 +02001175 }
1176
Ronald Cronea0f8a62020-11-25 17:52:23 +01001177 status = psa_destroy_se_key( driver,
1178 psa_key_slot_get_slot_number( slot ) );
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001179 if( overall_status == PSA_SUCCESS )
1180 overall_status = status;
Gilles Peskinefc762652019-07-22 19:30:34 +02001181 }
Gilles Peskine354f7672019-07-12 23:46:38 +02001182#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1183
Darryl Greend49a4992018-06-18 17:27:26 +01001184#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Ronald Crond98059d2020-10-23 18:00:55 +02001185 if( ! PSA_KEY_LIFETIME_IS_VOLATILE( slot->attr.lifetime ) )
Darryl Greend49a4992018-06-18 17:27:26 +01001186 {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001187 status = psa_destroy_persistent_key( slot->attr.id );
1188 if( overall_status == PSA_SUCCESS )
1189 overall_status = status;
1190
Gilles Peskine9ce31c42019-08-13 15:14:20 +02001191 /* TODO: other slots may have a copy of the same key. We should
1192 * invalidate them.
1193 * https://github.com/ARMmbed/mbed-crypto/issues/214
1194 */
Darryl Greend49a4992018-06-18 17:27:26 +01001195 }
1196#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
Gilles Peskine354f7672019-07-12 23:46:38 +02001197
Gilles Peskinefc762652019-07-22 19:30:34 +02001198#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1199 if( driver != NULL )
1200 {
Gilles Peskine725f22a2019-07-25 11:31:48 +02001201 status = psa_save_se_persistent_data( driver );
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001202 if( overall_status == PSA_SUCCESS )
1203 overall_status = status;
1204 status = psa_crypto_stop_transaction( );
1205 if( overall_status == PSA_SUCCESS )
1206 overall_status = status;
Gilles Peskinefc762652019-07-22 19:30:34 +02001207 }
1208#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1209
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001210#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1211exit:
1212#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001213 status = psa_wipe_key_slot( slot );
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001214 /* Prioritize CORRUPTION_DETECTED from wiping over a storage error */
1215 if( overall_status == PSA_SUCCESS )
1216 overall_status = status;
1217 return( overall_status );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001218}
1219
John Durkop07cc04a2020-11-16 22:08:34 -08001220#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
John Durkop0e005192020-10-31 22:06:54 -07001221 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Gilles Peskineb699f072019-04-26 16:06:02 +02001222static psa_status_t psa_get_rsa_public_exponent(
1223 const mbedtls_rsa_context *rsa,
1224 psa_key_attributes_t *attributes )
1225{
1226 mbedtls_mpi mpi;
Janos Follath24eed8d2019-11-22 13:21:35 +00001227 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskineb699f072019-04-26 16:06:02 +02001228 uint8_t *buffer = NULL;
1229 size_t buflen;
1230 mbedtls_mpi_init( &mpi );
1231
1232 ret = mbedtls_rsa_export( rsa, NULL, NULL, NULL, NULL, &mpi );
1233 if( ret != 0 )
1234 goto exit;
Gilles Peskine772c8b12019-04-26 17:37:21 +02001235 if( mbedtls_mpi_cmp_int( &mpi, 65537 ) == 0 )
1236 {
1237 /* It's the default value, which is reported as an empty string,
1238 * so there's nothing to do. */
1239 goto exit;
1240 }
Gilles Peskineb699f072019-04-26 16:06:02 +02001241
1242 buflen = mbedtls_mpi_size( &mpi );
1243 buffer = mbedtls_calloc( 1, buflen );
1244 if( buffer == NULL )
1245 {
1246 ret = MBEDTLS_ERR_MPI_ALLOC_FAILED;
1247 goto exit;
1248 }
1249 ret = mbedtls_mpi_write_binary( &mpi, buffer, buflen );
1250 if( ret != 0 )
1251 goto exit;
1252 attributes->domain_parameters = buffer;
1253 attributes->domain_parameters_size = buflen;
1254
1255exit:
1256 mbedtls_mpi_free( &mpi );
1257 if( ret != 0 )
1258 mbedtls_free( buffer );
1259 return( mbedtls_to_psa_error( ret ) );
1260}
John Durkop07cc04a2020-11-16 22:08:34 -08001261#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
John Durkop9814fa22020-11-04 12:28:15 -08001262 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Gilles Peskineb699f072019-04-26 16:06:02 +02001263
Gilles Peskinebfd322f2019-07-23 11:58:03 +02001264/** Retrieve all the publicly-accessible attributes of a key.
1265 */
Ronald Croncf56a0a2020-08-04 09:51:30 +02001266psa_status_t psa_get_key_attributes( mbedtls_svc_key_id_t key,
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001267 psa_key_attributes_t *attributes )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001268{
Ronald Cronf95a2b12020-10-22 15:24:49 +02001269 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01001270 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01001271 psa_key_slot_t *slot;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001272
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001273 psa_reset_key_attributes( attributes );
1274
Ronald Cron5c522922020-11-14 16:35:34 +01001275 status = psa_get_and_lock_key_slot_with_policy( key, &slot, 0, 0 );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02001276 if( status != PSA_SUCCESS )
1277 return( status );
Gilles Peskineb870b182018-07-06 16:02:09 +02001278
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001279 attributes->core = slot->attr;
Gilles Peskinec8000c02019-08-02 20:15:51 +02001280 attributes->core.flags &= ( MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY |
1281 MBEDTLS_PSA_KA_MASK_DUAL_USE );
1282
1283#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1284 if( psa_key_slot_is_external( slot ) )
Ronald Cronea0f8a62020-11-25 17:52:23 +01001285 psa_set_key_slot_number( attributes,
1286 psa_key_slot_get_slot_number( slot ) );
Gilles Peskinec8000c02019-08-02 20:15:51 +02001287#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskineb699f072019-04-26 16:06:02 +02001288
Gilles Peskine8e338702019-07-30 20:06:31 +02001289 switch( slot->attr.type )
Gilles Peskineb699f072019-04-26 16:06:02 +02001290 {
John Durkop07cc04a2020-11-16 22:08:34 -08001291#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
John Durkop0e005192020-10-31 22:06:54 -07001292 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Gilles Peskinec93b80c2019-05-16 19:39:54 +02001293 case PSA_KEY_TYPE_RSA_KEY_PAIR:
Gilles Peskineb699f072019-04-26 16:06:02 +02001294 case PSA_KEY_TYPE_RSA_PUBLIC_KEY:
Gilles Peskinedc5bfe92019-07-24 19:09:30 +02001295#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Janos Follath1d57a202019-08-13 12:15:34 +01001296 /* TODO: reporting the public exponent for opaque keys
Gilles Peskinec9d7f942019-08-13 16:17:16 +02001297 * is not yet implemented.
1298 * https://github.com/ARMmbed/mbed-crypto/issues/216
1299 */
Gilles Peskinec8000c02019-08-02 20:15:51 +02001300 if( psa_key_slot_is_external( slot ) )
Gilles Peskinedc5bfe92019-07-24 19:09:30 +02001301 break;
1302#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Steven Cooremana01795d2020-07-24 22:48:15 +02001303 {
Steven Cooremana2371e52020-07-28 14:30:39 +02001304 mbedtls_rsa_context *rsa = NULL;
Steven Cooremana01795d2020-07-24 22:48:15 +02001305
Ronald Cron90857082020-11-25 14:58:33 +01001306 status = mbedtls_psa_rsa_load_representation(
1307 slot->attr.type,
1308 slot->key.data,
1309 slot->key.bytes,
1310 &rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02001311 if( status != PSA_SUCCESS )
1312 break;
1313
Steven Cooremana2371e52020-07-28 14:30:39 +02001314 status = psa_get_rsa_public_exponent( rsa,
Steven Cooremana01795d2020-07-24 22:48:15 +02001315 attributes );
Steven Cooremana2371e52020-07-28 14:30:39 +02001316 mbedtls_rsa_free( rsa );
1317 mbedtls_free( rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02001318 }
Gilles Peskineb699f072019-04-26 16:06:02 +02001319 break;
John Durkop07cc04a2020-11-16 22:08:34 -08001320#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
John Durkop9814fa22020-11-04 12:28:15 -08001321 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Gilles Peskineb699f072019-04-26 16:06:02 +02001322 default:
1323 /* Nothing else to do. */
1324 break;
1325 }
1326
1327 if( status != PSA_SUCCESS )
1328 psa_reset_key_attributes( attributes );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001329
Ronald Cron5c522922020-11-14 16:35:34 +01001330 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001331
Ronald Cron5c522922020-11-14 16:35:34 +01001332 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001333}
1334
Gilles Peskinec8000c02019-08-02 20:15:51 +02001335#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1336psa_status_t psa_get_key_slot_number(
1337 const psa_key_attributes_t *attributes,
1338 psa_key_slot_number_t *slot_number )
1339{
1340 if( attributes->core.flags & MBEDTLS_PSA_KA_FLAG_HAS_SLOT_NUMBER )
1341 {
1342 *slot_number = attributes->slot_number;
1343 return( PSA_SUCCESS );
1344 }
1345 else
1346 return( PSA_ERROR_INVALID_ARGUMENT );
1347}
1348#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1349
Ronald Crond18b5f82020-11-25 16:46:05 +01001350static psa_status_t psa_export_key_buffer_internal( const uint8_t *key_buffer,
1351 size_t key_buffer_size,
Steven Cooremana01795d2020-07-24 22:48:15 +02001352 uint8_t *data,
1353 size_t data_size,
1354 size_t *data_length )
1355{
Ronald Crond18b5f82020-11-25 16:46:05 +01001356 if( key_buffer_size > data_size )
Steven Cooremana01795d2020-07-24 22:48:15 +02001357 return( PSA_ERROR_BUFFER_TOO_SMALL );
Ronald Crond18b5f82020-11-25 16:46:05 +01001358 memcpy( data, key_buffer, key_buffer_size );
1359 memset( data + key_buffer_size, 0,
1360 data_size - key_buffer_size );
1361 *data_length = key_buffer_size;
Steven Cooremana01795d2020-07-24 22:48:15 +02001362 return( PSA_SUCCESS );
1363}
1364
Ronald Cron7285cda2020-11-26 14:46:37 +01001365psa_status_t psa_export_key_internal(
Ronald Crond18b5f82020-11-25 16:46:05 +01001366 const psa_key_attributes_t *attributes,
1367 const uint8_t *key_buffer, size_t key_buffer_size,
1368 uint8_t *data, size_t data_size, size_t *data_length )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001369{
Ronald Crond18b5f82020-11-25 16:46:05 +01001370 psa_key_type_t type = attributes->core.type;
1371
Ronald Crond18b5f82020-11-25 16:46:05 +01001372 if( key_type_is_raw_bytes( type ) ||
1373 PSA_KEY_TYPE_IS_RSA( type ) ||
1374 PSA_KEY_TYPE_IS_ECC( type ) )
Ronald Cron9486f9d2020-11-26 13:36:23 +01001375 {
1376 return( psa_export_key_buffer_internal(
Ronald Crond18b5f82020-11-25 16:46:05 +01001377 key_buffer, key_buffer_size,
1378 data, data_size, data_length ) );
Ronald Cron9486f9d2020-11-26 13:36:23 +01001379 }
1380 else
1381 {
1382 /* This shouldn't happen in the reference implementation, but
1383 it is valid for a special-purpose implementation to omit
1384 support for exporting certain key types. */
1385 return( PSA_ERROR_NOT_SUPPORTED );
1386 }
1387}
1388
1389psa_status_t psa_export_key( mbedtls_svc_key_id_t key,
1390 uint8_t *data,
1391 size_t data_size,
1392 size_t *data_length )
1393{
1394 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
1395 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
1396 psa_key_slot_t *slot;
1397
Ronald Crone907e552021-01-18 13:22:38 +01001398 /* Reject a zero-length output buffer now, since this can never be a
1399 * valid key representation. This way we know that data must be a valid
1400 * pointer and we can do things like memset(data, ..., data_size). */
1401 if( data_size == 0 )
1402 return( PSA_ERROR_BUFFER_TOO_SMALL );
1403
Ronald Cron9486f9d2020-11-26 13:36:23 +01001404 /* Set the key to empty now, so that even when there are errors, we always
1405 * set data_length to a value between 0 and data_size. On error, setting
1406 * the key to empty is a good choice because an empty key representation is
1407 * unlikely to be accepted anywhere. */
Jaeden Amerof24c7f82018-06-27 17:20:43 +01001408 *data_length = 0;
1409
Ronald Cron9486f9d2020-11-26 13:36:23 +01001410 /* Export requires the EXPORT flag. There is an exception for public keys,
1411 * which don't require any flag, but
1412 * psa_get_and_lock_key_slot_with_policy() takes care of this.
1413 */
1414 status = psa_get_and_lock_key_slot_with_policy( key, &slot,
1415 PSA_KEY_USAGE_EXPORT, 0 );
1416 if( status != PSA_SUCCESS )
1417 return( status );
mohammad160306e79202018-03-28 13:17:44 +03001418
Ronald Crond18b5f82020-11-25 16:46:05 +01001419 psa_key_attributes_t attributes = {
1420 .core = slot->attr
1421 };
Ronald Cron67227982020-11-26 15:16:05 +01001422 status = psa_driver_wrapper_export_key( &attributes,
Ronald Crond18b5f82020-11-25 16:46:05 +01001423 slot->key.data, slot->key.bytes,
1424 data, data_size, data_length );
Ronald Cron9486f9d2020-11-26 13:36:23 +01001425
Ronald Cron9486f9d2020-11-26 13:36:23 +01001426 unlock_status = psa_unlock_key_slot( slot );
1427
1428 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
1429}
1430
Ronald Cron7285cda2020-11-26 14:46:37 +01001431psa_status_t psa_export_public_key_internal(
Ronald Crond18b5f82020-11-25 16:46:05 +01001432 const psa_key_attributes_t *attributes,
1433 const uint8_t *key_buffer,
1434 size_t key_buffer_size,
1435 uint8_t *data,
1436 size_t data_size,
1437 size_t *data_length )
Ronald Cron9486f9d2020-11-26 13:36:23 +01001438{
Ronald Crond18b5f82020-11-25 16:46:05 +01001439 psa_key_type_t type = attributes->core.type;
Ronald Crond18b5f82020-11-25 16:46:05 +01001440
Ronald Crond18b5f82020-11-25 16:46:05 +01001441 if( PSA_KEY_TYPE_IS_RSA( type ) || PSA_KEY_TYPE_IS_ECC( type ) )
Moran Peker17e36e12018-05-02 12:55:20 +03001442 {
Ronald Crond18b5f82020-11-25 16:46:05 +01001443 if( PSA_KEY_TYPE_IS_PUBLIC_KEY( type ) )
Gilles Peskine969ac722018-01-28 18:16:59 +01001444 {
Steven Cooreman560c28a2020-07-24 23:20:24 +02001445 /* Exporting public -> public */
Ronald Cron9486f9d2020-11-26 13:36:23 +01001446 return( psa_export_key_buffer_internal(
Ronald Crond18b5f82020-11-25 16:46:05 +01001447 key_buffer, key_buffer_size,
1448 data, data_size, data_length ) );
Steven Cooreman560c28a2020-07-24 23:20:24 +02001449 }
Steven Cooremanb9b84422020-10-14 14:39:20 +02001450
Ronald Crond18b5f82020-11-25 16:46:05 +01001451 if( PSA_KEY_TYPE_IS_RSA( type ) )
Steven Cooreman560c28a2020-07-24 23:20:24 +02001452 {
John Durkop0e005192020-10-31 22:06:54 -07001453#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
1454 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Ronald Crone5ca3d82020-11-26 16:36:16 +01001455 return( mbedtls_psa_rsa_export_public_key( attributes,
1456 key_buffer,
1457 key_buffer_size,
1458 data,
1459 data_size,
1460 data_length ) );
Darryl Green9e2d7a02018-07-24 16:33:30 +01001461#else
Steven Cooreman560c28a2020-07-24 23:20:24 +02001462 /* We don't know how to convert a private RSA key to public. */
1463 return( PSA_ERROR_NOT_SUPPORTED );
John Durkop9814fa22020-11-04 12:28:15 -08001464#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
1465 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Gilles Peskine969ac722018-01-28 18:16:59 +01001466 }
1467 else
Moran Pekera998bc62018-04-16 18:16:20 +03001468 {
John Durkop6ba40d12020-11-10 08:50:04 -08001469#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
1470 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
Ronald Crone5ca3d82020-11-26 16:36:16 +01001471 return( mbedtls_psa_ecp_export_public_key( attributes,
1472 key_buffer,
1473 key_buffer_size,
1474 data,
1475 data_size,
1476 data_length ) );
Steven Cooreman560c28a2020-07-24 23:20:24 +02001477#else
1478 /* We don't know how to convert a private ECC key to public */
Moran Pekera998bc62018-04-16 18:16:20 +03001479 return( PSA_ERROR_NOT_SUPPORTED );
John Durkop9814fa22020-11-04 12:28:15 -08001480#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
1481 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
Moran Pekera998bc62018-04-16 18:16:20 +03001482 }
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001483 }
Steven Cooreman560c28a2020-07-24 23:20:24 +02001484 else
1485 {
1486 /* This shouldn't happen in the reference implementation, but
1487 it is valid for a special-purpose implementation to omit
1488 support for exporting certain key types. */
1489 return( PSA_ERROR_NOT_SUPPORTED );
1490 }
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001491}
Ronald Crond18b5f82020-11-25 16:46:05 +01001492
Ronald Croncf56a0a2020-08-04 09:51:30 +02001493psa_status_t psa_export_public_key( mbedtls_svc_key_id_t key,
Gilles Peskine2d277862018-06-18 15:41:12 +02001494 uint8_t *data,
1495 size_t data_size,
1496 size_t *data_length )
Moran Pekerdd4ea382018-04-03 15:30:03 +03001497{
Ronald Cronf95a2b12020-10-22 15:24:49 +02001498 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01001499 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01001500 psa_key_slot_t *slot;
Darryl Greendd8fb772018-11-07 16:00:44 +00001501
Ronald Crone907e552021-01-18 13:22:38 +01001502 /* Reject a zero-length output buffer now, since this can never be a
1503 * valid key representation. This way we know that data must be a valid
1504 * pointer and we can do things like memset(data, ..., data_size). */
1505 if( data_size == 0 )
1506 return( PSA_ERROR_BUFFER_TOO_SMALL );
1507
Darryl Greendd8fb772018-11-07 16:00:44 +00001508 /* Set the key to empty now, so that even when there are errors, we always
1509 * set data_length to a value between 0 and data_size. On error, setting
1510 * the key to empty is a good choice because an empty key representation is
1511 * unlikely to be accepted anywhere. */
1512 *data_length = 0;
1513
1514 /* Exporting a public key doesn't require a usage flag. */
Ronald Cron5c522922020-11-14 16:35:34 +01001515 status = psa_get_and_lock_key_slot_with_policy( key, &slot, 0, 0 );
Darryl Greendd8fb772018-11-07 16:00:44 +00001516 if( status != PSA_SUCCESS )
1517 return( status );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001518
Ronald Cron9486f9d2020-11-26 13:36:23 +01001519 if( ! PSA_KEY_TYPE_IS_ASYMMETRIC( slot->attr.type ) )
1520 {
1521 status = PSA_ERROR_INVALID_ARGUMENT;
1522 goto exit;
1523 }
1524
Ronald Crond18b5f82020-11-25 16:46:05 +01001525 psa_key_attributes_t attributes = {
1526 .core = slot->attr
1527 };
Ronald Cron67227982020-11-26 15:16:05 +01001528 status = psa_driver_wrapper_export_public_key(
Ronald Crond18b5f82020-11-25 16:46:05 +01001529 &attributes, slot->key.data, slot->key.bytes,
1530 data, data_size, data_length );
Ronald Cron9486f9d2020-11-26 13:36:23 +01001531
1532exit:
Ronald Cron5c522922020-11-14 16:35:34 +01001533 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001534
Ronald Cron5c522922020-11-14 16:35:34 +01001535 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Moran Pekerdd4ea382018-04-03 15:30:03 +03001536}
1537
Gilles Peskine91e8c332019-08-02 19:19:39 +02001538#if defined(static_assert)
1539static_assert( ( MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE ) == 0,
1540 "One or more key attribute flag is listed as both external-only and dual-use" );
Gilles Peskine5a680562019-08-05 17:32:13 +02001541static_assert( ( PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE ) == 0,
Gilles Peskine094dac12019-08-07 18:19:46 +02001542 "One or more key attribute flag is listed as both internal-only and dual-use" );
Gilles Peskine5a680562019-08-05 17:32:13 +02001543static_assert( ( PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY ) == 0,
Gilles Peskine91e8c332019-08-02 19:19:39 +02001544 "One or more key attribute flag is listed as both internal-only and external-only" );
1545#endif
1546
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001547/** Validate that a key policy is internally well-formed.
1548 *
1549 * This function only rejects invalid policies. It does not validate the
1550 * consistency of the policy with respect to other attributes of the key
1551 * such as the key type.
1552 */
1553static psa_status_t psa_validate_key_policy( const psa_key_policy_t *policy )
Gilles Peskine4747d192019-04-17 15:05:45 +02001554{
1555 if( ( policy->usage & ~( PSA_KEY_USAGE_EXPORT |
Gilles Peskine8e0206a2019-05-14 14:24:28 +02001556 PSA_KEY_USAGE_COPY |
Gilles Peskine4747d192019-04-17 15:05:45 +02001557 PSA_KEY_USAGE_ENCRYPT |
1558 PSA_KEY_USAGE_DECRYPT |
gabor-mezei-arme8efa392021-04-14 21:14:28 +02001559 PSA_KEY_USAGE_SIGN_MESSAGE |
1560 PSA_KEY_USAGE_VERIFY_MESSAGE |
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01001561 PSA_KEY_USAGE_SIGN_HASH |
1562 PSA_KEY_USAGE_VERIFY_HASH |
Gilles Peskine4747d192019-04-17 15:05:45 +02001563 PSA_KEY_USAGE_DERIVE ) ) != 0 )
1564 return( PSA_ERROR_INVALID_ARGUMENT );
1565
Gilles Peskine4747d192019-04-17 15:05:45 +02001566 return( PSA_SUCCESS );
1567}
1568
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001569/** Validate the internal consistency of key attributes.
1570 *
1571 * This function only rejects invalid attribute values. If does not
1572 * validate the consistency of the attributes with any key data that may
1573 * be involved in the creation of the key.
1574 *
1575 * Call this function early in the key creation process.
1576 *
1577 * \param[in] attributes Key attributes for the new key.
1578 * \param[out] p_drv On any return, the driver for the key, if any.
1579 * NULL for a transparent key.
1580 *
1581 */
1582static psa_status_t psa_validate_key_attributes(
1583 const psa_key_attributes_t *attributes,
1584 psa_se_drv_table_entry_t **p_drv )
Darryl Green0c6575a2018-11-07 16:05:30 +00001585{
Steven Cooreman81fe7c32020-06-08 18:37:19 +02001586 psa_status_t status = PSA_ERROR_INVALID_ARGUMENT;
Ronald Crond2ed4812020-07-17 16:11:30 +02001587 psa_key_lifetime_t lifetime = psa_get_key_lifetime( attributes );
Ronald Cron65f38a32020-10-23 17:11:13 +02001588 mbedtls_svc_key_id_t key = psa_get_key_id( attributes );
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001589
Ronald Cron54b90082020-10-29 15:26:43 +01001590 status = psa_validate_key_location( lifetime, p_drv );
Steven Cooreman81fe7c32020-06-08 18:37:19 +02001591 if( status != PSA_SUCCESS )
1592 return( status );
1593
Ronald Crond2ed4812020-07-17 16:11:30 +02001594 status = psa_validate_key_persistence( lifetime );
Steven Cooreman81fe7c32020-06-08 18:37:19 +02001595 if( status != PSA_SUCCESS )
1596 return( status );
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001597
Ronald Cron65f38a32020-10-23 17:11:13 +02001598 if ( PSA_KEY_LIFETIME_IS_VOLATILE( lifetime ) )
1599 {
1600 if( MBEDTLS_SVC_KEY_ID_GET_KEY_ID( key ) != 0 )
1601 return( PSA_ERROR_INVALID_ARGUMENT );
1602 }
1603 else
Ronald Crond2ed4812020-07-17 16:11:30 +02001604 {
Ronald Cron77e412c2021-03-31 17:36:31 +02001605 if( !psa_is_valid_key_id( psa_get_key_id( attributes ), 0 ) )
1606 return( PSA_ERROR_INVALID_ARGUMENT );
Ronald Crond2ed4812020-07-17 16:11:30 +02001607 }
1608
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001609 status = psa_validate_key_policy( &attributes->core.policy );
Darryl Green0c6575a2018-11-07 16:05:30 +00001610 if( status != PSA_SUCCESS )
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001611 return( status );
1612
1613 /* Refuse to create overly large keys.
1614 * Note that this doesn't trigger on import if the attributes don't
1615 * explicitly specify a size (so psa_get_key_bits returns 0), so
1616 * psa_import_key() needs its own checks. */
1617 if( psa_get_key_bits( attributes ) > PSA_MAX_KEY_BITS )
1618 return( PSA_ERROR_NOT_SUPPORTED );
1619
Gilles Peskine91e8c332019-08-02 19:19:39 +02001620 /* Reject invalid flags. These should not be reachable through the API. */
1621 if( attributes->core.flags & ~ ( MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY |
1622 MBEDTLS_PSA_KA_MASK_DUAL_USE ) )
1623 return( PSA_ERROR_INVALID_ARGUMENT );
1624
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001625 return( PSA_SUCCESS );
1626}
1627
Gilles Peskine4747d192019-04-17 15:05:45 +02001628/** Prepare a key slot to receive key material.
1629 *
1630 * This function allocates a key slot and sets its metadata.
1631 *
1632 * If this function fails, call psa_fail_key_creation().
1633 *
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001634 * This function is intended to be used as follows:
1635 * -# Call psa_start_key_creation() to allocate a key slot, prepare
Ronald Croncf56a0a2020-08-04 09:51:30 +02001636 * it with the specified attributes, and in case of a volatile key assign it
1637 * a volatile key identifier.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001638 * -# Populate the slot with the key material.
1639 * -# Call psa_finish_key_creation() to finalize the creation of the slot.
1640 * In case of failure at any step, stop the sequence and call
1641 * psa_fail_key_creation().
1642 *
Ronald Cron5c522922020-11-14 16:35:34 +01001643 * On success, the key slot is locked. It is the responsibility of the caller
1644 * to unlock the key slot when it does not access it anymore.
Ronald Cronf95a2b12020-10-22 15:24:49 +02001645 *
Gilles Peskinedf179142019-07-15 22:02:14 +02001646 * \param method An identification of the calling function.
Gilles Peskine011e4282019-06-26 18:34:38 +02001647 * \param[in] attributes Key attributes for the new key.
Gilles Peskine011e4282019-06-26 18:34:38 +02001648 * \param[out] p_slot On success, a pointer to the prepared slot.
1649 * \param[out] p_drv On any return, the driver for the key, if any.
1650 * NULL for a transparent key.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001651 *
1652 * \retval #PSA_SUCCESS
1653 * The key slot is ready to receive key material.
1654 * \return If this function fails, the key slot is an invalid state.
1655 * You must call psa_fail_key_creation() to wipe and free the slot.
Gilles Peskine4747d192019-04-17 15:05:45 +02001656 */
1657static psa_status_t psa_start_key_creation(
Gilles Peskinedf179142019-07-15 22:02:14 +02001658 psa_key_creation_method_t method,
Gilles Peskine4747d192019-04-17 15:05:45 +02001659 const psa_key_attributes_t *attributes,
Gilles Peskine011e4282019-06-26 18:34:38 +02001660 psa_key_slot_t **p_slot,
Gilles Peskine8abe6a22019-07-12 23:40:35 +02001661 psa_se_drv_table_entry_t **p_drv )
Gilles Peskine4747d192019-04-17 15:05:45 +02001662{
1663 psa_status_t status;
Ronald Cron2a993152020-07-17 14:13:26 +02001664 psa_key_id_t volatile_key_id;
Gilles Peskine4747d192019-04-17 15:05:45 +02001665 psa_key_slot_t *slot;
1666
Gilles Peskinedf179142019-07-15 22:02:14 +02001667 (void) method;
Gilles Peskine011e4282019-06-26 18:34:38 +02001668 *p_drv = NULL;
1669
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001670 status = psa_validate_key_attributes( attributes, p_drv );
1671 if( status != PSA_SUCCESS )
1672 return( status );
1673
Ronald Cronc4d1b512020-07-31 11:26:37 +02001674 status = psa_get_empty_key_slot( &volatile_key_id, p_slot );
Gilles Peskine4747d192019-04-17 15:05:45 +02001675 if( status != PSA_SUCCESS )
1676 return( status );
1677 slot = *p_slot;
1678
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001679 /* We're storing the declared bit-size of the key. It's up to each
1680 * creation mechanism to verify that this information is correct.
1681 * It's automatically correct for mechanisms that use the bit-size as
Gilles Peskineb46bef22019-07-30 21:32:04 +02001682 * an input (generate, device) but not for those where the bit-size
Ronald Cronc4d1b512020-07-31 11:26:37 +02001683 * is optional (import, copy). In case of a volatile key, assign it the
1684 * volatile key identifier associated to the slot returned to contain its
1685 * definition. */
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001686
1687 slot->attr = attributes->core;
Ronald Cronc4d1b512020-07-31 11:26:37 +02001688 if( PSA_KEY_LIFETIME_IS_VOLATILE( slot->attr.lifetime ) )
1689 {
1690#if !defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER)
1691 slot->attr.id = volatile_key_id;
1692#else
1693 slot->attr.id.key_id = volatile_key_id;
1694#endif
1695 }
Gilles Peskinec744d992019-07-30 17:26:54 +02001696
Gilles Peskine91e8c332019-08-02 19:19:39 +02001697 /* Erase external-only flags from the internal copy. To access
Gilles Peskine013f5472019-08-07 15:42:14 +02001698 * external-only flags, query `attributes`. Thanks to the check
1699 * in psa_validate_key_attributes(), this leaves the dual-use
Gilles Peskineedbed562019-08-07 18:19:59 +02001700 * flags and any internal flag that psa_get_empty_key_slot()
Gilles Peskine013f5472019-08-07 15:42:14 +02001701 * may have set. */
1702 slot->attr.flags &= ~MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY;
Gilles Peskine91e8c332019-08-02 19:19:39 +02001703
Gilles Peskinecbaff462019-07-12 23:46:04 +02001704#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined7729582019-08-05 15:55:54 +02001705 /* For a key in a secure element, we need to do three things
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001706 * when creating or registering a persistent key:
Gilles Peskine60450a42019-07-25 11:32:45 +02001707 * create the key file in internal storage, create the
1708 * key inside the secure element, and update the driver's
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001709 * persistent data. This is done by starting a transaction that will
1710 * encompass these three actions.
1711 * For registering a volatile key, we just need to find an appropriate
1712 * slot number inside the SE. Since the key is designated volatile, creating
1713 * a transaction is not required. */
Gilles Peskine60450a42019-07-25 11:32:45 +02001714 /* The first thing to do is to find a slot number for the new key.
1715 * We save the slot number in persistent storage as part of the
1716 * transaction data. It will be needed to recover if the power
1717 * fails during the key creation process, to clean up on the secure
1718 * element side after restarting. Obtaining a slot number from the
1719 * secure element driver updates its persistent state, but we do not yet
1720 * save the driver's persistent state, so that if the power fails,
Gilles Peskinefc762652019-07-22 19:30:34 +02001721 * we can roll back to a state where the key doesn't exist. */
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001722 if( *p_drv != NULL )
Darryl Green0c6575a2018-11-07 16:05:30 +00001723 {
Ronald Cronea0f8a62020-11-25 17:52:23 +01001724 psa_key_slot_number_t slot_number;
Gilles Peskinee88c2c12019-08-05 16:44:14 +02001725 status = psa_find_se_slot_for_key( attributes, method, *p_drv,
Ronald Cronea0f8a62020-11-25 17:52:23 +01001726 &slot_number );
Gilles Peskinecbaff462019-07-12 23:46:04 +02001727 if( status != PSA_SUCCESS )
1728 return( status );
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001729
1730 if( ! PSA_KEY_LIFETIME_IS_VOLATILE( attributes->core.lifetime ) )
Gilles Peskine66be51c2019-07-25 18:02:52 +02001731 {
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001732 psa_crypto_prepare_transaction( PSA_CRYPTO_TRANSACTION_CREATE_KEY );
1733 psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
Ronald Cronea0f8a62020-11-25 17:52:23 +01001734 psa_crypto_transaction.key.slot = slot_number;
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001735 psa_crypto_transaction.key.id = slot->attr.id;
1736 status = psa_crypto_save_transaction( );
1737 if( status != PSA_SUCCESS )
1738 {
1739 (void) psa_crypto_stop_transaction( );
1740 return( status );
1741 }
Gilles Peskine66be51c2019-07-25 18:02:52 +02001742 }
Ronald Cronea0f8a62020-11-25 17:52:23 +01001743
1744 status = psa_copy_key_material_into_slot(
1745 slot, (uint8_t *)( &slot_number ), sizeof( slot_number ) );
Darryl Green0c6575a2018-11-07 16:05:30 +00001746 }
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001747
1748 if( *p_drv == NULL && method == PSA_KEY_CREATION_REGISTER )
1749 {
1750 /* Key registration only makes sense with a secure element. */
1751 return( PSA_ERROR_INVALID_ARGUMENT );
1752 }
Gilles Peskinecbaff462019-07-12 23:46:04 +02001753#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1754
Ronald Cronc4d1b512020-07-31 11:26:37 +02001755 return( PSA_SUCCESS );
Darryl Green0c6575a2018-11-07 16:05:30 +00001756}
Gilles Peskine4747d192019-04-17 15:05:45 +02001757
1758/** Finalize the creation of a key once its key material has been set.
1759 *
1760 * This entails writing the key to persistent storage.
1761 *
1762 * If this function fails, call psa_fail_key_creation().
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001763 * See the documentation of psa_start_key_creation() for the intended use
1764 * of this function.
Gilles Peskine4747d192019-04-17 15:05:45 +02001765 *
Ronald Cron5c522922020-11-14 16:35:34 +01001766 * If the finalization succeeds, the function unlocks the key slot (it was
1767 * locked by psa_start_key_creation()) and the key slot cannot be accessed
1768 * anymore as part of the key creation process.
Ronald Cron50972942020-11-14 11:28:25 +01001769 *
Gilles Peskine011e4282019-06-26 18:34:38 +02001770 * \param[in,out] slot Pointer to the slot with key material.
1771 * \param[in] driver The secure element driver for the key,
1772 * or NULL for a transparent key.
Ronald Cron81709fc2020-11-14 12:10:32 +01001773 * \param[out] key On success, identifier of the key. Note that the
1774 * key identifier is also stored in the key slot.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001775 *
1776 * \retval #PSA_SUCCESS
Ronald Croncf56a0a2020-08-04 09:51:30 +02001777 * The key was successfully created.
gabor-mezei-arm452b0a32020-11-09 17:42:55 +01001778 * \retval #PSA_ERROR_INSUFFICIENT_MEMORY
1779 * \retval #PSA_ERROR_INSUFFICIENT_STORAGE
1780 * \retval #PSA_ERROR_ALREADY_EXISTS
1781 * \retval #PSA_ERROR_DATA_INVALID
1782 * \retval #PSA_ERROR_DATA_CORRUPT
gabor-mezei-arm86326a92020-11-30 16:50:34 +01001783 * \retval #PSA_ERROR_STORAGE_FAILURE
gabor-mezei-arm452b0a32020-11-09 17:42:55 +01001784 *
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001785 * \return If this function fails, the key slot is an invalid state.
1786 * You must call psa_fail_key_creation() to wipe and free the slot.
Gilles Peskine4747d192019-04-17 15:05:45 +02001787 */
Gilles Peskine011e4282019-06-26 18:34:38 +02001788static psa_status_t psa_finish_key_creation(
1789 psa_key_slot_t *slot,
Ronald Cron81709fc2020-11-14 12:10:32 +01001790 psa_se_drv_table_entry_t *driver,
1791 mbedtls_svc_key_id_t *key)
Gilles Peskine4747d192019-04-17 15:05:45 +02001792{
1793 psa_status_t status = PSA_SUCCESS;
Gilles Peskine30afafd2019-04-25 13:47:40 +02001794 (void) slot;
Gilles Peskine011e4282019-06-26 18:34:38 +02001795 (void) driver;
Gilles Peskine4747d192019-04-17 15:05:45 +02001796
1797#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Steven Cooremanc59de6a2020-06-08 18:28:25 +02001798 if( ! PSA_KEY_LIFETIME_IS_VOLATILE( slot->attr.lifetime ) )
Gilles Peskine4747d192019-04-17 15:05:45 +02001799 {
Gilles Peskine1df83d42019-07-23 16:13:14 +02001800#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1801 if( driver != NULL )
1802 {
Gilles Peskineb46bef22019-07-30 21:32:04 +02001803 psa_se_key_data_storage_t data;
Ronald Cronea0f8a62020-11-25 17:52:23 +01001804 psa_key_slot_number_t slot_number =
1805 psa_key_slot_get_slot_number( slot ) ;
1806
Gilles Peskineb46bef22019-07-30 21:32:04 +02001807#if defined(static_assert)
Ronald Cronea0f8a62020-11-25 17:52:23 +01001808 static_assert( sizeof( slot_number ) ==
Gilles Peskineb46bef22019-07-30 21:32:04 +02001809 sizeof( data.slot_number ),
1810 "Slot number size does not match psa_se_key_data_storage_t" );
Gilles Peskineb46bef22019-07-30 21:32:04 +02001811#endif
Ronald Cronea0f8a62020-11-25 17:52:23 +01001812 memcpy( &data.slot_number, &slot_number, sizeof( slot_number ) );
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001813 status = psa_save_persistent_key( &slot->attr,
Gilles Peskineb46bef22019-07-30 21:32:04 +02001814 (uint8_t*) &data,
1815 sizeof( data ) );
Gilles Peskine1df83d42019-07-23 16:13:14 +02001816 }
1817 else
1818#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1819 {
Steven Cooreman40120f62020-10-29 11:42:22 +01001820 /* Key material is saved in export representation in the slot, so
1821 * just pass the slot buffer for storage. */
1822 status = psa_save_persistent_key( &slot->attr,
Ronald Cronea0f8a62020-11-25 17:52:23 +01001823 slot->key.data,
1824 slot->key.bytes );
Gilles Peskine1df83d42019-07-23 16:13:14 +02001825 }
Gilles Peskine4747d192019-04-17 15:05:45 +02001826 }
Darryl Green0c6575a2018-11-07 16:05:30 +00001827#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
1828
Gilles Peskinecbaff462019-07-12 23:46:04 +02001829#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined7729582019-08-05 15:55:54 +02001830 /* Finish the transaction for a key creation. This does not
1831 * happen when registering an existing key. Detect this case
1832 * by checking whether a transaction is in progress (actual
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001833 * creation of a persistent key in a secure element requires a transaction,
1834 * but registration or volatile key creation doesn't use one). */
Gilles Peskined7729582019-08-05 15:55:54 +02001835 if( driver != NULL &&
1836 psa_crypto_transaction.unknown.type == PSA_CRYPTO_TRANSACTION_CREATE_KEY )
Gilles Peskinecbaff462019-07-12 23:46:04 +02001837 {
1838 status = psa_save_se_persistent_data( driver );
1839 if( status != PSA_SUCCESS )
1840 {
Gilles Peskine8e338702019-07-30 20:06:31 +02001841 psa_destroy_persistent_key( slot->attr.id );
Gilles Peskinecbaff462019-07-12 23:46:04 +02001842 return( status );
1843 }
Gilles Peskinefc762652019-07-22 19:30:34 +02001844 status = psa_crypto_stop_transaction( );
Gilles Peskinecbaff462019-07-12 23:46:04 +02001845 }
1846#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1847
Ronald Cron50972942020-11-14 11:28:25 +01001848 if( status == PSA_SUCCESS )
Ronald Cron81709fc2020-11-14 12:10:32 +01001849 {
1850 *key = slot->attr.id;
Ronald Cron5c522922020-11-14 16:35:34 +01001851 status = psa_unlock_key_slot( slot );
Ronald Cron81709fc2020-11-14 12:10:32 +01001852 if( status != PSA_SUCCESS )
1853 *key = MBEDTLS_SVC_KEY_ID_INIT;
1854 }
Ronald Cron50972942020-11-14 11:28:25 +01001855
Gilles Peskine4747d192019-04-17 15:05:45 +02001856 return( status );
1857}
1858
1859/** Abort the creation of a key.
1860 *
1861 * You may call this function after calling psa_start_key_creation(),
1862 * or after psa_finish_key_creation() fails. In other circumstances, this
1863 * function may not clean up persistent storage.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001864 * See the documentation of psa_start_key_creation() for the intended use
1865 * of this function.
Gilles Peskine4747d192019-04-17 15:05:45 +02001866 *
Gilles Peskine011e4282019-06-26 18:34:38 +02001867 * \param[in,out] slot Pointer to the slot with key material.
1868 * \param[in] driver The secure element driver for the key,
1869 * or NULL for a transparent key.
Gilles Peskine4747d192019-04-17 15:05:45 +02001870 */
Gilles Peskine011e4282019-06-26 18:34:38 +02001871static void psa_fail_key_creation( psa_key_slot_t *slot,
Gilles Peskine8abe6a22019-07-12 23:40:35 +02001872 psa_se_drv_table_entry_t *driver )
Gilles Peskine4747d192019-04-17 15:05:45 +02001873{
Gilles Peskine011e4282019-06-26 18:34:38 +02001874 (void) driver;
1875
Gilles Peskine4747d192019-04-17 15:05:45 +02001876 if( slot == NULL )
1877 return;
Gilles Peskine011e4282019-06-26 18:34:38 +02001878
1879#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Janos Follath1d57a202019-08-13 12:15:34 +01001880 /* TODO: If the key has already been created in the secure
Gilles Peskine011e4282019-06-26 18:34:38 +02001881 * element, and the failure happened later (when saving metadata
1882 * to internal storage), we need to destroy the key in the secure
Gilles Peskinec9d7f942019-08-13 16:17:16 +02001883 * element.
1884 * https://github.com/ARMmbed/mbed-crypto/issues/217
1885 */
Gilles Peskinefc762652019-07-22 19:30:34 +02001886
Gilles Peskined7729582019-08-05 15:55:54 +02001887 /* Abort the ongoing transaction if any (there may not be one if
1888 * the creation process failed before starting one, or if the
1889 * key creation is a registration of a key in a secure element).
1890 * Earlier functions must already have done what it takes to undo any
1891 * partial creation. All that's left is to update the transaction data
1892 * itself. */
Gilles Peskinefc762652019-07-22 19:30:34 +02001893 (void) psa_crypto_stop_transaction( );
Gilles Peskine011e4282019-06-26 18:34:38 +02001894#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1895
Gilles Peskine4747d192019-04-17 15:05:45 +02001896 psa_wipe_key_slot( slot );
1897}
1898
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001899/** Validate optional attributes during key creation.
1900 *
1901 * Some key attributes are optional during key creation. If they are
1902 * specified in the attributes structure, check that they are consistent
1903 * with the data in the slot.
1904 *
1905 * This function should be called near the end of key creation, after
1906 * the slot in memory is fully populated but before saving persistent data.
1907 */
1908static psa_status_t psa_validate_optional_attributes(
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001909 const psa_key_slot_t *slot,
1910 const psa_key_attributes_t *attributes )
1911{
Gilles Peskine7e0cff92019-07-30 13:48:52 +02001912 if( attributes->core.type != 0 )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001913 {
Gilles Peskine8e338702019-07-30 20:06:31 +02001914 if( attributes->core.type != slot->attr.type )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001915 return( PSA_ERROR_INVALID_ARGUMENT );
1916 }
1917
1918 if( attributes->domain_parameters_size != 0 )
1919 {
John Durkop0e005192020-10-31 22:06:54 -07001920#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
1921 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Gilles Peskine8e338702019-07-30 20:06:31 +02001922 if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001923 {
Steven Cooremana2371e52020-07-28 14:30:39 +02001924 mbedtls_rsa_context *rsa = NULL;
Steven Cooreman75b74362020-07-28 14:30:13 +02001925 mbedtls_mpi actual, required;
Steven Cooreman6d839f02020-07-30 11:36:45 +02001926 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Steven Cooremana01795d2020-07-24 22:48:15 +02001927
Ronald Cron90857082020-11-25 14:58:33 +01001928 psa_status_t status = mbedtls_psa_rsa_load_representation(
1929 slot->attr.type,
1930 slot->key.data,
1931 slot->key.bytes,
1932 &rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02001933 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02001934 return( status );
Steven Cooreman75b74362020-07-28 14:30:13 +02001935
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001936 mbedtls_mpi_init( &actual );
1937 mbedtls_mpi_init( &required );
Steven Cooremana2371e52020-07-28 14:30:39 +02001938 ret = mbedtls_rsa_export( rsa,
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001939 NULL, NULL, NULL, NULL, &actual );
Steven Cooremana2371e52020-07-28 14:30:39 +02001940 mbedtls_rsa_free( rsa );
1941 mbedtls_free( rsa );
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001942 if( ret != 0 )
1943 goto rsa_exit;
1944 ret = mbedtls_mpi_read_binary( &required,
1945 attributes->domain_parameters,
1946 attributes->domain_parameters_size );
1947 if( ret != 0 )
1948 goto rsa_exit;
1949 if( mbedtls_mpi_cmp_mpi( &actual, &required ) != 0 )
1950 ret = MBEDTLS_ERR_RSA_BAD_INPUT_DATA;
1951 rsa_exit:
1952 mbedtls_mpi_free( &actual );
1953 mbedtls_mpi_free( &required );
1954 if( ret != 0)
1955 return( mbedtls_to_psa_error( ret ) );
1956 }
1957 else
John Durkop9814fa22020-11-04 12:28:15 -08001958#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
1959 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001960 {
1961 return( PSA_ERROR_INVALID_ARGUMENT );
1962 }
1963 }
1964
Gilles Peskine7e0cff92019-07-30 13:48:52 +02001965 if( attributes->core.bits != 0 )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001966 {
Gilles Peskineb46bef22019-07-30 21:32:04 +02001967 if( attributes->core.bits != slot->attr.bits )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001968 return( PSA_ERROR_INVALID_ARGUMENT );
1969 }
1970
1971 return( PSA_SUCCESS );
1972}
1973
Gilles Peskine4747d192019-04-17 15:05:45 +02001974psa_status_t psa_import_key( const psa_key_attributes_t *attributes,
Gilles Peskine4747d192019-04-17 15:05:45 +02001975 const uint8_t *data,
Gilles Peskine73676cb2019-05-15 20:15:10 +02001976 size_t data_length,
Ronald Croncf56a0a2020-08-04 09:51:30 +02001977 mbedtls_svc_key_id_t *key )
Gilles Peskine4747d192019-04-17 15:05:45 +02001978{
1979 psa_status_t status;
1980 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02001981 psa_se_drv_table_entry_t *driver = NULL;
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01001982 size_t bits;
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001983
Ronald Cron81709fc2020-11-14 12:10:32 +01001984 *key = MBEDTLS_SVC_KEY_ID_INIT;
1985
Gilles Peskine0f84d622019-09-12 19:03:13 +02001986 /* Reject zero-length symmetric keys (including raw data key objects).
1987 * This also rejects any key which might be encoded as an empty string,
1988 * which is never valid. */
1989 if( data_length == 0 )
1990 return( PSA_ERROR_INVALID_ARGUMENT );
1991
Gilles Peskinedf179142019-07-15 22:02:14 +02001992 status = psa_start_key_creation( PSA_KEY_CREATION_IMPORT, attributes,
Ronald Cron81709fc2020-11-14 12:10:32 +01001993 &slot, &driver );
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001994 if( status != PSA_SUCCESS )
1995 goto exit;
1996
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01001997 /* In the case of a transparent key or an opaque key stored in local
1998 * storage (thus not in the case of generating a key in a secure element
1999 * or cryptoprocessor with storage), we have to allocate a buffer to
2000 * hold the generated key material. */
2001 if( slot->key.data == NULL )
Gilles Peskine5d309672019-07-12 23:47:28 +02002002 {
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01002003 status = psa_allocate_buffer_to_slot( slot, data_length );
Gilles Peskineb46bef22019-07-30 21:32:04 +02002004 if( status != PSA_SUCCESS )
2005 goto exit;
Gilles Peskine5d309672019-07-12 23:47:28 +02002006 }
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01002007
2008 bits = slot->attr.bits;
2009 status = psa_driver_wrapper_import_key( attributes,
2010 data, data_length,
2011 slot->key.data,
2012 slot->key.bytes,
2013 &slot->key.bytes, &bits );
2014 if( status != PSA_SUCCESS )
2015 goto exit;
2016
2017 if( slot->attr.bits == 0 )
2018 slot->attr.bits = (psa_key_bits_t) bits;
2019 else if( bits != slot->attr.bits )
Steven Cooremanac3434f2021-01-15 17:36:02 +01002020 {
Steven Cooremanac3434f2021-01-15 17:36:02 +01002021 status = PSA_ERROR_INVALID_ARGUMENT;
2022 goto exit;
Gilles Peskine5d309672019-07-12 23:47:28 +02002023 }
Ronald Cron2ebfdcc2020-11-28 15:54:54 +01002024
Gilles Peskine1b8594a2019-07-31 17:21:46 +02002025 status = psa_validate_optional_attributes( slot, attributes );
Gilles Peskine18017402019-07-24 20:25:59 +02002026 if( status != PSA_SUCCESS )
2027 goto exit;
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002028
Ronald Cron81709fc2020-11-14 12:10:32 +01002029 status = psa_finish_key_creation( slot, driver, key );
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002030exit:
Gilles Peskine4747d192019-04-17 15:05:45 +02002031 if( status != PSA_SUCCESS )
Gilles Peskine011e4282019-06-26 18:34:38 +02002032 psa_fail_key_creation( slot, driver );
Ronald Cronf95a2b12020-10-22 15:24:49 +02002033
Gilles Peskine4747d192019-04-17 15:05:45 +02002034 return( status );
2035}
2036
Gilles Peskined7729582019-08-05 15:55:54 +02002037#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
2038psa_status_t mbedtls_psa_register_se_key(
2039 const psa_key_attributes_t *attributes )
2040{
2041 psa_status_t status;
2042 psa_key_slot_t *slot = NULL;
2043 psa_se_drv_table_entry_t *driver = NULL;
Ronald Croncf56a0a2020-08-04 09:51:30 +02002044 mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT;
Gilles Peskined7729582019-08-05 15:55:54 +02002045
2046 /* Leaving attributes unspecified is not currently supported.
2047 * It could make sense to query the key type and size from the
2048 * secure element, but not all secure elements support this
2049 * and the driver HAL doesn't currently support it. */
2050 if( psa_get_key_type( attributes ) == PSA_KEY_TYPE_NONE )
2051 return( PSA_ERROR_NOT_SUPPORTED );
2052 if( psa_get_key_bits( attributes ) == 0 )
2053 return( PSA_ERROR_NOT_SUPPORTED );
2054
2055 status = psa_start_key_creation( PSA_KEY_CREATION_REGISTER, attributes,
Ronald Cron81709fc2020-11-14 12:10:32 +01002056 &slot, &driver );
Gilles Peskined7729582019-08-05 15:55:54 +02002057 if( status != PSA_SUCCESS )
2058 goto exit;
2059
Ronald Cron81709fc2020-11-14 12:10:32 +01002060 status = psa_finish_key_creation( slot, driver, &key );
Gilles Peskined7729582019-08-05 15:55:54 +02002061
2062exit:
2063 if( status != PSA_SUCCESS )
Gilles Peskined7729582019-08-05 15:55:54 +02002064 psa_fail_key_creation( slot, driver );
Ronald Cronf95a2b12020-10-22 15:24:49 +02002065
Gilles Peskined7729582019-08-05 15:55:54 +02002066 /* Registration doesn't keep the key in RAM. */
Ronald Croncf56a0a2020-08-04 09:51:30 +02002067 psa_close_key( key );
Gilles Peskined7729582019-08-05 15:55:54 +02002068 return( status );
2069}
2070#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
2071
Gilles Peskinef603c712019-01-19 13:40:11 +01002072static psa_status_t psa_copy_key_material( const psa_key_slot_t *source,
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002073 psa_key_slot_t *target )
Gilles Peskinef603c712019-01-19 13:40:11 +01002074{
Steven Cooremanf7cebd42020-10-13 20:27:40 +02002075 psa_status_t status = psa_copy_key_material_into_slot( target,
Ronald Cronea0f8a62020-11-25 17:52:23 +01002076 source->key.data,
2077 source->key.bytes );
Gilles Peskinef603c712019-01-19 13:40:11 +01002078 if( status != PSA_SUCCESS )
Steven Cooreman398aee52020-10-13 14:35:45 +02002079 return( status );
Gilles Peskinef603c712019-01-19 13:40:11 +01002080
Steven Cooreman398aee52020-10-13 14:35:45 +02002081 target->attr.type = source->attr.type;
2082 target->attr.bits = source->attr.bits;
2083
2084 return( PSA_SUCCESS );
Gilles Peskinef603c712019-01-19 13:40:11 +01002085}
2086
Ronald Croncf56a0a2020-08-04 09:51:30 +02002087psa_status_t psa_copy_key( mbedtls_svc_key_id_t source_key,
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002088 const psa_key_attributes_t *specified_attributes,
Ronald Croncf56a0a2020-08-04 09:51:30 +02002089 mbedtls_svc_key_id_t *target_key )
Gilles Peskinef603c712019-01-19 13:40:11 +01002090{
Ronald Cronf95a2b12020-10-22 15:24:49 +02002091 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01002092 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinef603c712019-01-19 13:40:11 +01002093 psa_key_slot_t *source_slot = NULL;
2094 psa_key_slot_t *target_slot = NULL;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002095 psa_key_attributes_t actual_attributes = *specified_attributes;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02002096 psa_se_drv_table_entry_t *driver = NULL;
Gilles Peskinef603c712019-01-19 13:40:11 +01002097
Ronald Cron81709fc2020-11-14 12:10:32 +01002098 *target_key = MBEDTLS_SVC_KEY_ID_INIT;
2099
Ronald Cron5c522922020-11-14 16:35:34 +01002100 status = psa_get_and_lock_transparent_key_slot_with_policy(
2101 source_key, &source_slot, PSA_KEY_USAGE_COPY, 0 );
Gilles Peskinef603c712019-01-19 13:40:11 +01002102 if( status != PSA_SUCCESS )
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002103 goto exit;
2104
Gilles Peskine1b8594a2019-07-31 17:21:46 +02002105 status = psa_validate_optional_attributes( source_slot,
2106 specified_attributes );
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002107 if( status != PSA_SUCCESS )
2108 goto exit;
2109
Steven Cooreman1ac5ce32021-03-02 16:34:49 +01002110 status = psa_restrict_key_policy( source_slot->attr.type,
2111 &actual_attributes.core.policy,
Gilles Peskine8e338702019-07-30 20:06:31 +02002112 &source_slot->attr.policy );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002113 if( status != PSA_SUCCESS )
2114 goto exit;
2115
Ronald Cron81709fc2020-11-14 12:10:32 +01002116 status = psa_start_key_creation( PSA_KEY_CREATION_COPY, &actual_attributes,
2117 &target_slot, &driver );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002118 if( status != PSA_SUCCESS )
2119 goto exit;
2120
Gilles Peskinef4ee6622019-07-24 13:44:30 +02002121#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
2122 if( driver != NULL )
Gilles Peskinef603c712019-01-19 13:40:11 +01002123 {
Gilles Peskinef4ee6622019-07-24 13:44:30 +02002124 /* Copying to a secure element is not implemented yet. */
2125 status = PSA_ERROR_NOT_SUPPORTED;
2126 goto exit;
Gilles Peskinef603c712019-01-19 13:40:11 +01002127 }
Gilles Peskinef4ee6622019-07-24 13:44:30 +02002128#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskinef603c712019-01-19 13:40:11 +01002129
Ronald Cron6cc66312021-04-02 12:27:47 +02002130 if( psa_key_lifetime_is_external( actual_attributes.core.lifetime ) )
2131 {
2132 /*
2133 * Copying through an opaque driver is not implemented yet, consider
2134 * a lifetime with an external location as an invalid parameter for
2135 * now.
2136 */
2137 status = PSA_ERROR_INVALID_ARGUMENT;
2138 goto exit;
2139 }
2140
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002141 status = psa_copy_key_material( source_slot, target_slot );
Gilles Peskinef603c712019-01-19 13:40:11 +01002142 if( status != PSA_SUCCESS )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002143 goto exit;
Gilles Peskinef603c712019-01-19 13:40:11 +01002144
Ronald Cron81709fc2020-11-14 12:10:32 +01002145 status = psa_finish_key_creation( target_slot, driver, target_key );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002146exit:
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002147 if( status != PSA_SUCCESS )
Gilles Peskine011e4282019-06-26 18:34:38 +02002148 psa_fail_key_creation( target_slot, driver );
Ronald Cronf95a2b12020-10-22 15:24:49 +02002149
Ronald Cron5c522922020-11-14 16:35:34 +01002150 unlock_status = psa_unlock_key_slot( source_slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02002151
Ronald Cron5c522922020-11-14 16:35:34 +01002152 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskinef603c712019-01-19 13:40:11 +01002153}
2154
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02002155
2156
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01002157/****************************************************************/
Gilles Peskine20035e32018-02-03 22:44:14 +01002158/* Message digests */
2159/****************************************************************/
2160
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002161psa_status_t psa_hash_abort( psa_hash_operation_t *operation )
2162{
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002163 /* Aborting a non-active operation is allowed */
2164 if( operation->id == 0 )
2165 return( PSA_SUCCESS );
2166
2167 psa_status_t status = psa_driver_wrapper_hash_abort( operation );
2168 operation->id = 0;
2169
2170 return( status );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002171}
2172
Gilles Peskineda8191d1c2018-07-08 19:46:38 +02002173psa_status_t psa_hash_setup( psa_hash_operation_t *operation,
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002174 psa_algorithm_t alg )
2175{
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002176 /* A context must be freshly initialized before it can be set up. */
2177 if( operation->id != 0 )
2178 return( PSA_ERROR_BAD_STATE );
2179
2180 if( !PSA_ALG_IS_HASH( alg ) )
Steven Cooreman0e307642021-02-18 16:18:32 +01002181 return( PSA_ERROR_INVALID_ARGUMENT );
Jaeden Amero36ee5d02019-02-19 09:25:10 +00002182
Steven Cooremanb6bf4bb2021-03-15 19:00:14 +01002183 /* Ensure all of the context is zeroized, since PSA_HASH_OPERATION_INIT only
2184 * directly zeroes the int-sized dummy member of the context union. */
Steven Cooreman893232f2021-03-15 12:23:37 +01002185 memset( &operation->ctx, 0, sizeof( operation->ctx ) );
2186
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002187 return( psa_driver_wrapper_hash_setup( operation, alg ) );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002188}
2189
2190psa_status_t psa_hash_update( psa_hash_operation_t *operation,
2191 const uint8_t *input,
2192 size_t input_length )
2193{
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002194 if( operation->id == 0 )
2195 return( PSA_ERROR_BAD_STATE );
Gilles Peskine94e44542018-07-12 16:58:43 +02002196
Steven Cooremanc8288352021-03-04 14:02:19 +01002197 /* Don't require hash implementations to behave correctly on a
2198 * zero-length input, which may have an invalid pointer. */
2199 if( input_length == 0 )
2200 return( PSA_SUCCESS );
2201
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002202 psa_status_t status = psa_driver_wrapper_hash_update( operation,
2203 input, input_length );
2204 if( status != PSA_SUCCESS )
2205 psa_hash_abort( operation );
2206
2207 return( status );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002208}
2209
2210psa_status_t psa_hash_finish( psa_hash_operation_t *operation,
2211 uint8_t *hash,
2212 size_t hash_size,
2213 size_t *hash_length )
2214{
Steven Cooremanfbe09282021-03-08 18:41:12 +01002215 *hash_length = 0;
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002216 if( operation->id == 0 )
2217 return( PSA_ERROR_BAD_STATE );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002218
Steven Cooreman1e582352021-02-18 17:24:37 +01002219 psa_status_t status = psa_driver_wrapper_hash_finish(
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002220 operation, hash, hash_size, hash_length );
Steven Cooreman0e307642021-02-18 16:18:32 +01002221 psa_hash_abort( operation );
2222 return( status );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002223}
2224
Gilles Peskine2d277862018-06-18 15:41:12 +02002225psa_status_t psa_hash_verify( psa_hash_operation_t *operation,
2226 const uint8_t *hash,
2227 size_t hash_length )
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002228{
2229 uint8_t actual_hash[MBEDTLS_MD_MAX_SIZE];
2230 size_t actual_hash_length;
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002231 psa_status_t status = psa_hash_finish(
2232 operation,
Steven Cooreman1e582352021-02-18 17:24:37 +01002233 actual_hash, sizeof( actual_hash ),
2234 &actual_hash_length );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002235 if( status != PSA_SUCCESS )
2236 return( status );
2237 if( actual_hash_length != hash_length )
2238 return( PSA_ERROR_INVALID_SIGNATURE );
2239 if( safer_memcmp( hash, actual_hash, actual_hash_length ) != 0 )
2240 return( PSA_ERROR_INVALID_SIGNATURE );
2241 return( PSA_SUCCESS );
2242}
2243
Gilles Peskine0a749c82019-11-28 19:33:58 +01002244psa_status_t psa_hash_compute( psa_algorithm_t alg,
2245 const uint8_t *input, size_t input_length,
2246 uint8_t *hash, size_t hash_size,
2247 size_t *hash_length )
2248{
Steven Cooremanfbe09282021-03-08 18:41:12 +01002249 *hash_length = 0;
Steven Cooremanf66d5fd2021-03-08 18:40:40 +01002250 if( !PSA_ALG_IS_HASH( alg ) )
2251 return( PSA_ERROR_INVALID_ARGUMENT );
2252
Steven Cooreman1e582352021-02-18 17:24:37 +01002253 return( psa_driver_wrapper_hash_compute( alg, input, input_length,
2254 hash, hash_size, hash_length ) );
Gilles Peskine0a749c82019-11-28 19:33:58 +01002255}
2256
2257psa_status_t psa_hash_compare( psa_algorithm_t alg,
2258 const uint8_t *input, size_t input_length,
2259 const uint8_t *hash, size_t hash_length )
2260{
Steven Cooreman84d670d2021-02-18 16:22:53 +01002261 uint8_t actual_hash[MBEDTLS_MD_MAX_SIZE];
2262 size_t actual_hash_length;
Steven Cooremanf66d5fd2021-03-08 18:40:40 +01002263
2264 if( !PSA_ALG_IS_HASH( alg ) )
2265 return( PSA_ERROR_INVALID_ARGUMENT );
2266
Steven Cooreman1e582352021-02-18 17:24:37 +01002267 psa_status_t status = psa_driver_wrapper_hash_compute(
2268 alg, input, input_length,
2269 actual_hash, sizeof(actual_hash),
2270 &actual_hash_length );
Gilles Peskine0a749c82019-11-28 19:33:58 +01002271 if( status != PSA_SUCCESS )
Steven Cooreman84d670d2021-02-18 16:22:53 +01002272 return( status );
2273 if( actual_hash_length != hash_length )
2274 return( PSA_ERROR_INVALID_SIGNATURE );
2275 if( safer_memcmp( hash, actual_hash, actual_hash_length ) != 0 )
2276 return( PSA_ERROR_INVALID_SIGNATURE );
2277 return( PSA_SUCCESS );
Gilles Peskine0a749c82019-11-28 19:33:58 +01002278}
2279
Gilles Peskineeb35d782019-01-22 17:56:16 +01002280psa_status_t psa_hash_clone( const psa_hash_operation_t *source_operation,
2281 psa_hash_operation_t *target_operation )
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002282{
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002283 if( source_operation->id == 0 ||
2284 target_operation->id != 0 )
2285 {
2286 return( PSA_ERROR_BAD_STATE );
2287 }
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002288
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002289 psa_status_t status = psa_driver_wrapper_hash_clone( source_operation,
2290 target_operation );
2291 if( status != PSA_SUCCESS )
2292 psa_hash_abort( target_operation );
2293
2294 return( status );
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002295}
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002296
2297
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002298/****************************************************************/
Gilles Peskine8c9def32018-02-08 10:02:12 +01002299/* MAC */
2300/****************************************************************/
2301
John Durkop6ba40d12020-11-10 08:50:04 -08002302#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002303static size_t psa_get_hash_block_size( psa_algorithm_t alg )
Nir Sonnenschein96272412018-06-17 14:41:10 +03002304{
Gilles Peskine2d277862018-06-18 15:41:12 +02002305 switch( alg )
Nir Sonnenschein96272412018-06-17 14:41:10 +03002306 {
2307 case PSA_ALG_MD2:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002308 return( 16 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002309 case PSA_ALG_MD4:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002310 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002311 case PSA_ALG_MD5:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002312 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002313 case PSA_ALG_RIPEMD160:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002314 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002315 case PSA_ALG_SHA_1:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002316 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002317 case PSA_ALG_SHA_224:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002318 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002319 case PSA_ALG_SHA_256:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002320 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002321 case PSA_ALG_SHA_384:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002322 return( 128 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002323 case PSA_ALG_SHA_512:
Gilles Peskine2d277862018-06-18 15:41:12 +02002324 return( 128 );
2325 default:
2326 return( 0 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002327 }
2328}
John Durkop07cc04a2020-11-16 22:08:34 -08002329#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC) */
Nir Sonnenschein0c9ec532018-06-07 13:27:47 +03002330
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002331/* Initialize the MAC operation structure. Once this function has been
2332 * called, psa_mac_abort can run and will do the right thing. */
2333static psa_status_t psa_mac_init( psa_mac_operation_t *operation,
2334 psa_algorithm_t alg )
2335{
2336 psa_status_t status = PSA_ERROR_NOT_SUPPORTED;
2337
Steven Cooreman15472f82021-03-02 16:16:22 +01002338 operation->alg = PSA_ALG_FULL_LENGTH_MAC( alg );
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002339 operation->key_set = 0;
2340 operation->iv_set = 0;
2341 operation->iv_required = 0;
2342 operation->has_input = 0;
Gilles Peskine89167cb2018-07-08 20:12:23 +02002343 operation->is_sign = 0;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002344
Ronald Cron3d471812021-03-18 13:40:31 +01002345#if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC)
Steven Cooreman15472f82021-03-02 16:16:22 +01002346 if( operation->alg == PSA_ALG_CMAC )
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002347 {
2348 operation->iv_required = 0;
2349 mbedtls_cipher_init( &operation->ctx.cmac );
2350 status = PSA_SUCCESS;
2351 }
2352 else
Ronald Cron3d471812021-03-18 13:40:31 +01002353#endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */
John Durkopd0321952020-10-29 21:37:36 -07002354#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002355 if( PSA_ALG_IS_HMAC( operation->alg ) )
2356 {
Gilles Peskineff94abd2018-07-12 17:07:52 +02002357 /* We'll set up the hash operation later in psa_hmac_setup_internal. */
Steven Cooreman0e307642021-02-18 16:18:32 +01002358 operation->ctx.hmac.alg = 0;
Gilles Peskineff94abd2018-07-12 17:07:52 +02002359 status = PSA_SUCCESS;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002360 }
2361 else
John Durkopd0321952020-10-29 21:37:36 -07002362#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002363 {
Gilles Peskinec06e0712018-06-20 16:21:04 +02002364 if( ! PSA_ALG_IS_MAC( alg ) )
2365 status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002366 }
2367
2368 if( status != PSA_SUCCESS )
2369 memset( operation, 0, sizeof( *operation ) );
2370 return( status );
2371}
2372
John Durkop6ba40d12020-11-10 08:50:04 -08002373#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Gilles Peskine01126fa2018-07-12 17:04:55 +02002374static psa_status_t psa_hmac_abort_internal( psa_hmac_internal_data *hmac )
2375{
Gilles Peskine3f108122018-12-07 18:14:53 +01002376 mbedtls_platform_zeroize( hmac->opad, sizeof( hmac->opad ) );
Gilles Peskine01126fa2018-07-12 17:04:55 +02002377 return( psa_hash_abort( &hmac->hash_ctx ) );
2378}
John Durkop6ba40d12020-11-10 08:50:04 -08002379#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Gilles Peskine01126fa2018-07-12 17:04:55 +02002380
Gilles Peskine8c9def32018-02-08 10:02:12 +01002381psa_status_t psa_mac_abort( psa_mac_operation_t *operation )
2382{
Gilles Peskinefbfac682018-07-08 20:51:54 +02002383 if( operation->alg == 0 )
Gilles Peskine8c9def32018-02-08 10:02:12 +01002384 {
Gilles Peskinefbfac682018-07-08 20:51:54 +02002385 /* The object has (apparently) been initialized but it is not
2386 * in use. It's ok to call abort on such an object, and there's
2387 * nothing to do. */
2388 return( PSA_SUCCESS );
2389 }
2390 else
Ronald Cron3d471812021-03-18 13:40:31 +01002391#if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC)
Gilles Peskinefbfac682018-07-08 20:51:54 +02002392 if( operation->alg == PSA_ALG_CMAC )
2393 {
2394 mbedtls_cipher_free( &operation->ctx.cmac );
2395 }
2396 else
Ronald Cron3d471812021-03-18 13:40:31 +01002397#endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */
John Durkopd0321952020-10-29 21:37:36 -07002398#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Gilles Peskinefbfac682018-07-08 20:51:54 +02002399 if( PSA_ALG_IS_HMAC( operation->alg ) )
2400 {
Gilles Peskine01126fa2018-07-12 17:04:55 +02002401 psa_hmac_abort_internal( &operation->ctx.hmac );
Gilles Peskinefbfac682018-07-08 20:51:54 +02002402 }
2403 else
John Durkopd0321952020-10-29 21:37:36 -07002404#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Gilles Peskinefbfac682018-07-08 20:51:54 +02002405 {
2406 /* Sanity check (shouldn't happen: operation->alg should
2407 * always have been initialized to a valid value). */
2408 goto bad_state;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002409 }
Moran Peker41deec42018-04-04 15:43:05 +03002410
Gilles Peskine8c9def32018-02-08 10:02:12 +01002411 operation->alg = 0;
2412 operation->key_set = 0;
2413 operation->iv_set = 0;
2414 operation->iv_required = 0;
2415 operation->has_input = 0;
Gilles Peskine89167cb2018-07-08 20:12:23 +02002416 operation->is_sign = 0;
Moran Peker41deec42018-04-04 15:43:05 +03002417
Gilles Peskine8c9def32018-02-08 10:02:12 +01002418 return( PSA_SUCCESS );
Gilles Peskinefbfac682018-07-08 20:51:54 +02002419
2420bad_state:
2421 /* If abort is called on an uninitialized object, we can't trust
2422 * anything. Wipe the object in case it contains confidential data.
2423 * This may result in a memory leak if a pointer gets overwritten,
2424 * but it's too late to do anything about this. */
2425 memset( operation, 0, sizeof( *operation ) );
2426 return( PSA_ERROR_BAD_STATE );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002427}
2428
Ronald Cron3d471812021-03-18 13:40:31 +01002429#if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC)
Steven Cooreman15472f82021-03-02 16:16:22 +01002430static psa_status_t psa_cmac_setup( psa_mac_operation_t *operation,
2431 psa_key_slot_t *slot )
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002432{
Janos Follath24eed8d2019-11-22 13:21:35 +00002433 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Steven Cooreman15472f82021-03-02 16:16:22 +01002434 const mbedtls_cipher_info_t *cipher_info =
2435 mbedtls_cipher_info_from_psa( PSA_ALG_CMAC,
2436 slot->attr.type, slot->attr.bits,
2437 NULL );
2438 if( cipher_info == NULL )
2439 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002440
2441 ret = mbedtls_cipher_setup( &operation->ctx.cmac, cipher_info );
2442 if( ret != 0 )
Steven Cooreman15472f82021-03-02 16:16:22 +01002443 goto exit;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002444
2445 ret = mbedtls_cipher_cmac_starts( &operation->ctx.cmac,
Ronald Cronea0f8a62020-11-25 17:52:23 +01002446 slot->key.data,
Steven Cooreman15472f82021-03-02 16:16:22 +01002447 slot->attr.bits );
2448exit:
2449 return( mbedtls_to_psa_error( ret ) );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002450}
Ronald Cron3d471812021-03-18 13:40:31 +01002451#endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002452
John Durkop6ba40d12020-11-10 08:50:04 -08002453#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Gilles Peskine01126fa2018-07-12 17:04:55 +02002454static psa_status_t psa_hmac_setup_internal( psa_hmac_internal_data *hmac,
2455 const uint8_t *key,
2456 size_t key_length,
2457 psa_algorithm_t hash_alg )
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002458{
Gilles Peskinec11c4dc2019-07-15 11:06:38 +02002459 uint8_t ipad[PSA_HMAC_MAX_HASH_BLOCK_SIZE];
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002460 size_t i;
gabor-mezei-armcbcec212020-12-18 14:23:51 +01002461 size_t hash_size = PSA_HASH_LENGTH( hash_alg );
Gilles Peskine01126fa2018-07-12 17:04:55 +02002462 size_t block_size = psa_get_hash_block_size( hash_alg );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002463 psa_status_t status;
2464
Steven Cooreman0e307642021-02-18 16:18:32 +01002465 hmac->alg = hash_alg;
2466
Gilles Peskine9aa369e2018-07-16 00:36:29 +02002467 /* Sanity checks on block_size, to guarantee that there won't be a buffer
2468 * overflow below. This should never trigger if the hash algorithm
2469 * is implemented correctly. */
2470 /* The size checks against the ipad and opad buffers cannot be written
2471 * `block_size > sizeof( ipad ) || block_size > sizeof( hmac->opad )`
2472 * because that triggers -Wlogical-op on GCC 7.3. */
2473 if( block_size > sizeof( ipad ) )
2474 return( PSA_ERROR_NOT_SUPPORTED );
2475 if( block_size > sizeof( hmac->opad ) )
2476 return( PSA_ERROR_NOT_SUPPORTED );
2477 if( block_size < hash_size )
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002478 return( PSA_ERROR_NOT_SUPPORTED );
2479
Gilles Peskined223b522018-06-11 18:12:58 +02002480 if( key_length > block_size )
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002481 {
Gilles Peskine84b8fc82019-11-28 20:07:20 +01002482 status = psa_hash_compute( hash_alg, key, key_length,
2483 ipad, sizeof( ipad ), &key_length );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002484 if( status != PSA_SUCCESS )
Gilles Peskineb8be2882018-07-17 16:24:34 +02002485 goto cleanup;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002486 }
Gilles Peskine96889972018-07-12 17:07:03 +02002487 /* A 0-length key is not commonly used in HMAC when used as a MAC,
2488 * but it is permitted. It is common when HMAC is used in HKDF, for
2489 * example. Don't call `memcpy` in the 0-length because `key` could be
2490 * an invalid pointer which would make the behavior undefined. */
2491 else if( key_length != 0 )
Gilles Peskine01126fa2018-07-12 17:04:55 +02002492 memcpy( ipad, key, key_length );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002493
Gilles Peskined223b522018-06-11 18:12:58 +02002494 /* ipad contains the key followed by garbage. Xor and fill with 0x36
2495 * to create the ipad value. */
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002496 for( i = 0; i < key_length; i++ )
Gilles Peskined223b522018-06-11 18:12:58 +02002497 ipad[i] ^= 0x36;
2498 memset( ipad + key_length, 0x36, block_size - key_length );
2499
2500 /* Copy the key material from ipad to opad, flipping the requisite bits,
2501 * and filling the rest of opad with the requisite constant. */
2502 for( i = 0; i < key_length; i++ )
Gilles Peskine01126fa2018-07-12 17:04:55 +02002503 hmac->opad[i] = ipad[i] ^ 0x36 ^ 0x5C;
2504 memset( hmac->opad + key_length, 0x5C, block_size - key_length );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002505
Gilles Peskine01126fa2018-07-12 17:04:55 +02002506 status = psa_hash_setup( &hmac->hash_ctx, hash_alg );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002507 if( status != PSA_SUCCESS )
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02002508 goto cleanup;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002509
Gilles Peskine01126fa2018-07-12 17:04:55 +02002510 status = psa_hash_update( &hmac->hash_ctx, ipad, block_size );
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02002511
2512cleanup:
Steven Cooreman29149862020-08-05 15:43:42 +02002513 mbedtls_platform_zeroize( ipad, sizeof( ipad ) );
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02002514
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002515 return( status );
2516}
John Durkop6ba40d12020-11-10 08:50:04 -08002517#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002518
Gilles Peskine89167cb2018-07-08 20:12:23 +02002519static psa_status_t psa_mac_setup( psa_mac_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02002520 mbedtls_svc_key_id_t key,
Gilles Peskine89167cb2018-07-08 20:12:23 +02002521 psa_algorithm_t alg,
2522 int is_sign )
Gilles Peskine8c9def32018-02-08 10:02:12 +01002523{
Ronald Cronf95a2b12020-10-22 15:24:49 +02002524 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01002525 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01002526 psa_key_slot_t *slot;
Gilles Peskine89167cb2018-07-08 20:12:23 +02002527 psa_key_usage_t usage =
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01002528 is_sign ? PSA_KEY_USAGE_SIGN_HASH : PSA_KEY_USAGE_VERIFY_HASH;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002529
Jaeden Amero36ee5d02019-02-19 09:25:10 +00002530 /* A context must be freshly initialized before it can be set up. */
2531 if( operation->alg != 0 )
2532 {
2533 return( PSA_ERROR_BAD_STATE );
2534 }
2535
Steven Cooreman15472f82021-03-02 16:16:22 +01002536 status = psa_mac_init( operation, alg );
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002537 if( status != PSA_SUCCESS )
2538 return( status );
Gilles Peskine89167cb2018-07-08 20:12:23 +02002539 if( is_sign )
2540 operation->is_sign = 1;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002541
Ronald Cron5c522922020-11-14 16:35:34 +01002542 status = psa_get_and_lock_transparent_key_slot_with_policy(
2543 key, &slot, usage, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02002544 if( status != PSA_SUCCESS )
Gilles Peskinefbfac682018-07-08 20:51:54 +02002545 goto exit;
Steven Cooreman15472f82021-03-02 16:16:22 +01002546
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +01002547 /* Validate the combination of key type and algorithm */
2548 status = psa_mac_key_can_do( alg, slot->attr.type );
Steven Cooreman15472f82021-03-02 16:16:22 +01002549 if( status != PSA_SUCCESS )
2550 goto exit;
2551
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +01002552 /* Get the output length for the algorithm and key combination. None of the
2553 * currently supported algorithms have an output length dependent on actual
2554 * key size, so setting it to a bogus value is currently OK. */
2555 operation->mac_size = PSA_MAC_LENGTH( slot->attr.type, 0, alg );
Steven Cooreman15472f82021-03-02 16:16:22 +01002556
2557 if( operation->mac_size < 4 )
2558 {
2559 /* A very short MAC is too short for security since it can be
2560 * brute-forced. Ancient protocols with 32-bit MACs do exist,
2561 * so we make this our minimum, even though 32 bits is still
2562 * too small for security. */
2563 status = PSA_ERROR_NOT_SUPPORTED;
2564 goto exit;
2565 }
Gilles Peskineab1d7ab2018-07-06 16:07:47 +02002566
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +01002567 if( operation->mac_size >
2568 PSA_MAC_LENGTH( slot->attr.type, 0, PSA_ALG_FULL_LENGTH_MAC( alg ) ) )
2569 {
2570 /* It's impossible to "truncate" to a larger length than the full length
2571 * of the algorithm. */
2572 status = PSA_ERROR_INVALID_ARGUMENT;
2573 goto exit;
2574 }
2575
Ronald Cron3d471812021-03-18 13:40:31 +01002576#if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC)
Steven Cooreman15472f82021-03-02 16:16:22 +01002577 if( PSA_ALG_FULL_LENGTH_MAC( alg ) == PSA_ALG_CMAC )
Gilles Peskinefbfac682018-07-08 20:51:54 +02002578 {
Steven Cooreman15472f82021-03-02 16:16:22 +01002579 status = psa_cmac_setup( operation, slot );
Gilles Peskinefbfac682018-07-08 20:51:54 +02002580 }
2581 else
Ronald Cron3d471812021-03-18 13:40:31 +01002582#endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */
John Durkopd0321952020-10-29 21:37:36 -07002583#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Steven Cooreman15472f82021-03-02 16:16:22 +01002584 if( PSA_ALG_IS_HMAC( alg ) )
Gilles Peskinefbfac682018-07-08 20:51:54 +02002585 {
Gilles Peskine9aa369e2018-07-16 00:36:29 +02002586 /* Sanity check. This shouldn't fail on a valid configuration. */
Steven Cooreman1fb691a2021-03-08 12:01:55 +01002587 if( operation->mac_size > sizeof( operation->ctx.hmac.opad ) )
Gilles Peskine9aa369e2018-07-16 00:36:29 +02002588 {
2589 status = PSA_ERROR_NOT_SUPPORTED;
2590 goto exit;
2591 }
2592
Gilles Peskine8e338702019-07-30 20:06:31 +02002593 if( slot->attr.type != PSA_KEY_TYPE_HMAC )
Gilles Peskine01126fa2018-07-12 17:04:55 +02002594 {
2595 status = PSA_ERROR_INVALID_ARGUMENT;
2596 goto exit;
2597 }
Gilles Peskine9aa369e2018-07-16 00:36:29 +02002598
Gilles Peskine01126fa2018-07-12 17:04:55 +02002599 status = psa_hmac_setup_internal( &operation->ctx.hmac,
Ronald Cronea0f8a62020-11-25 17:52:23 +01002600 slot->key.data,
2601 slot->key.bytes,
Steven Cooreman15472f82021-03-02 16:16:22 +01002602 PSA_ALG_HMAC_GET_HASH( alg ) );
Gilles Peskinefbfac682018-07-08 20:51:54 +02002603 }
2604 else
John Durkopd0321952020-10-29 21:37:36 -07002605#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Gilles Peskinefbfac682018-07-08 20:51:54 +02002606 {
2607 status = PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002608 }
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002609
Gilles Peskinefbfac682018-07-08 20:51:54 +02002610exit:
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002611 if( status != PSA_SUCCESS )
Gilles Peskine8c9def32018-02-08 10:02:12 +01002612 {
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02002613 psa_mac_abort( operation );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002614 }
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002615 else
2616 {
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002617 operation->key_set = 1;
2618 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02002619
Ronald Cron5c522922020-11-14 16:35:34 +01002620 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02002621
Ronald Cron5c522922020-11-14 16:35:34 +01002622 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002623}
2624
Gilles Peskine89167cb2018-07-08 20:12:23 +02002625psa_status_t psa_mac_sign_setup( psa_mac_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02002626 mbedtls_svc_key_id_t key,
Gilles Peskine89167cb2018-07-08 20:12:23 +02002627 psa_algorithm_t alg )
2628{
Ronald Croncf56a0a2020-08-04 09:51:30 +02002629 return( psa_mac_setup( operation, key, alg, 1 ) );
Gilles Peskine89167cb2018-07-08 20:12:23 +02002630}
2631
2632psa_status_t psa_mac_verify_setup( psa_mac_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02002633 mbedtls_svc_key_id_t key,
Gilles Peskine89167cb2018-07-08 20:12:23 +02002634 psa_algorithm_t alg )
2635{
Ronald Croncf56a0a2020-08-04 09:51:30 +02002636 return( psa_mac_setup( operation, key, alg, 0 ) );
Gilles Peskine89167cb2018-07-08 20:12:23 +02002637}
2638
Gilles Peskine8c9def32018-02-08 10:02:12 +01002639psa_status_t psa_mac_update( psa_mac_operation_t *operation,
2640 const uint8_t *input,
2641 size_t input_length )
2642{
Gilles Peskinefbfac682018-07-08 20:51:54 +02002643 psa_status_t status = PSA_ERROR_BAD_STATE;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002644 if( ! operation->key_set )
Jaeden Ameroe236c2a2019-02-20 15:37:15 +00002645 return( PSA_ERROR_BAD_STATE );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002646 if( operation->iv_required && ! operation->iv_set )
Jaeden Ameroe236c2a2019-02-20 15:37:15 +00002647 return( PSA_ERROR_BAD_STATE );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002648 operation->has_input = 1;
2649
Ronald Cron3d471812021-03-18 13:40:31 +01002650#if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC)
Gilles Peskinefbfac682018-07-08 20:51:54 +02002651 if( operation->alg == PSA_ALG_CMAC )
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03002652 {
Gilles Peskinefbfac682018-07-08 20:51:54 +02002653 int ret = mbedtls_cipher_cmac_update( &operation->ctx.cmac,
2654 input, input_length );
2655 status = mbedtls_to_psa_error( ret );
2656 }
2657 else
Ronald Cron3d471812021-03-18 13:40:31 +01002658#endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */
John Durkopd0321952020-10-29 21:37:36 -07002659#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Gilles Peskinefbfac682018-07-08 20:51:54 +02002660 if( PSA_ALG_IS_HMAC( operation->alg ) )
2661 {
2662 status = psa_hash_update( &operation->ctx.hmac.hash_ctx, input,
2663 input_length );
2664 }
2665 else
John Durkopd0321952020-10-29 21:37:36 -07002666#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Gilles Peskinefbfac682018-07-08 20:51:54 +02002667 {
2668 /* This shouldn't happen if `operation` was initialized by
2669 * a setup function. */
Jaeden Ameroe236c2a2019-02-20 15:37:15 +00002670 return( PSA_ERROR_BAD_STATE );
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03002671 }
2672
Gilles Peskinefbfac682018-07-08 20:51:54 +02002673 if( status != PSA_SUCCESS )
2674 psa_mac_abort( operation );
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02002675 return( status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002676}
2677
John Durkop6ba40d12020-11-10 08:50:04 -08002678#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Gilles Peskine01126fa2018-07-12 17:04:55 +02002679static psa_status_t psa_hmac_finish_internal( psa_hmac_internal_data *hmac,
2680 uint8_t *mac,
2681 size_t mac_size )
2682{
Gilles Peskinec11c4dc2019-07-15 11:06:38 +02002683 uint8_t tmp[MBEDTLS_MD_MAX_SIZE];
Steven Cooreman0e307642021-02-18 16:18:32 +01002684 psa_algorithm_t hash_alg = hmac->alg;
Gilles Peskine01126fa2018-07-12 17:04:55 +02002685 size_t hash_size = 0;
2686 size_t block_size = psa_get_hash_block_size( hash_alg );
2687 psa_status_t status;
2688
Gilles Peskine01126fa2018-07-12 17:04:55 +02002689 status = psa_hash_finish( &hmac->hash_ctx, tmp, sizeof( tmp ), &hash_size );
2690 if( status != PSA_SUCCESS )
2691 return( status );
2692 /* From here on, tmp needs to be wiped. */
2693
2694 status = psa_hash_setup( &hmac->hash_ctx, hash_alg );
2695 if( status != PSA_SUCCESS )
2696 goto exit;
2697
2698 status = psa_hash_update( &hmac->hash_ctx, hmac->opad, block_size );
2699 if( status != PSA_SUCCESS )
2700 goto exit;
2701
2702 status = psa_hash_update( &hmac->hash_ctx, tmp, hash_size );
2703 if( status != PSA_SUCCESS )
2704 goto exit;
2705
Gilles Peskined911eb72018-08-14 15:18:45 +02002706 status = psa_hash_finish( &hmac->hash_ctx, tmp, sizeof( tmp ), &hash_size );
2707 if( status != PSA_SUCCESS )
2708 goto exit;
2709
2710 memcpy( mac, tmp, mac_size );
Gilles Peskine01126fa2018-07-12 17:04:55 +02002711
2712exit:
Gilles Peskine3f108122018-12-07 18:14:53 +01002713 mbedtls_platform_zeroize( tmp, hash_size );
Gilles Peskine01126fa2018-07-12 17:04:55 +02002714 return( status );
2715}
John Durkop6ba40d12020-11-10 08:50:04 -08002716#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Gilles Peskine01126fa2018-07-12 17:04:55 +02002717
mohammad16036df908f2018-04-02 08:34:15 -07002718static psa_status_t psa_mac_finish_internal( psa_mac_operation_t *operation,
Gilles Peskine2d277862018-06-18 15:41:12 +02002719 uint8_t *mac,
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002720 size_t mac_size )
Gilles Peskine8c9def32018-02-08 10:02:12 +01002721{
Gilles Peskine1d96fff2018-07-02 12:15:39 +02002722 if( ! operation->key_set )
2723 return( PSA_ERROR_BAD_STATE );
2724 if( operation->iv_required && ! operation->iv_set )
2725 return( PSA_ERROR_BAD_STATE );
2726
Gilles Peskine8c9def32018-02-08 10:02:12 +01002727 if( mac_size < operation->mac_size )
2728 return( PSA_ERROR_BUFFER_TOO_SMALL );
2729
Ronald Cron3d471812021-03-18 13:40:31 +01002730#if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC)
Gilles Peskinefbfac682018-07-08 20:51:54 +02002731 if( operation->alg == PSA_ALG_CMAC )
2732 {
gabor-mezei-armcbcec212020-12-18 14:23:51 +01002733 uint8_t tmp[PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE];
Gilles Peskined911eb72018-08-14 15:18:45 +02002734 int ret = mbedtls_cipher_cmac_finish( &operation->ctx.cmac, tmp );
2735 if( ret == 0 )
Gilles Peskine87b0ac42018-08-21 14:55:49 +02002736 memcpy( mac, tmp, operation->mac_size );
Gilles Peskine3f108122018-12-07 18:14:53 +01002737 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
Gilles Peskinefbfac682018-07-08 20:51:54 +02002738 return( mbedtls_to_psa_error( ret ) );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002739 }
Gilles Peskinefbfac682018-07-08 20:51:54 +02002740 else
Ronald Cron3d471812021-03-18 13:40:31 +01002741#endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */
John Durkopd0321952020-10-29 21:37:36 -07002742#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Gilles Peskinefbfac682018-07-08 20:51:54 +02002743 if( PSA_ALG_IS_HMAC( operation->alg ) )
2744 {
Gilles Peskine01126fa2018-07-12 17:04:55 +02002745 return( psa_hmac_finish_internal( &operation->ctx.hmac,
Gilles Peskined911eb72018-08-14 15:18:45 +02002746 mac, operation->mac_size ) );
Gilles Peskinefbfac682018-07-08 20:51:54 +02002747 }
2748 else
John Durkopd0321952020-10-29 21:37:36 -07002749#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Gilles Peskinefbfac682018-07-08 20:51:54 +02002750 {
2751 /* This shouldn't happen if `operation` was initialized by
2752 * a setup function. */
2753 return( PSA_ERROR_BAD_STATE );
2754 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002755}
2756
Gilles Peskineacd4be32018-07-08 19:56:25 +02002757psa_status_t psa_mac_sign_finish( psa_mac_operation_t *operation,
2758 uint8_t *mac,
2759 size_t mac_size,
2760 size_t *mac_length )
mohammad16036df908f2018-04-02 08:34:15 -07002761{
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002762 psa_status_t status;
2763
Jaeden Amero252ef282019-02-15 14:05:35 +00002764 if( operation->alg == 0 )
2765 {
2766 return( PSA_ERROR_BAD_STATE );
2767 }
2768
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002769 /* Fill the output buffer with something that isn't a valid mac
2770 * (barring an attack on the mac and deliberately-crafted input),
2771 * in case the caller doesn't check the return status properly. */
2772 *mac_length = mac_size;
2773 /* If mac_size is 0 then mac may be NULL and then the
2774 * call to memset would have undefined behavior. */
2775 if( mac_size != 0 )
2776 memset( mac, '!', mac_size );
2777
Gilles Peskine89167cb2018-07-08 20:12:23 +02002778 if( ! operation->is_sign )
2779 {
Jaeden Ameroe236c2a2019-02-20 15:37:15 +00002780 return( PSA_ERROR_BAD_STATE );
Gilles Peskine89167cb2018-07-08 20:12:23 +02002781 }
mohammad16036df908f2018-04-02 08:34:15 -07002782
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002783 status = psa_mac_finish_internal( operation, mac, mac_size );
2784
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002785 if( status == PSA_SUCCESS )
2786 {
2787 status = psa_mac_abort( operation );
2788 if( status == PSA_SUCCESS )
2789 *mac_length = operation->mac_size;
2790 else
2791 memset( mac, '!', mac_size );
2792 }
2793 else
2794 psa_mac_abort( operation );
2795 return( status );
mohammad16036df908f2018-04-02 08:34:15 -07002796}
2797
Gilles Peskineacd4be32018-07-08 19:56:25 +02002798psa_status_t psa_mac_verify_finish( psa_mac_operation_t *operation,
2799 const uint8_t *mac,
2800 size_t mac_length )
Gilles Peskine8c9def32018-02-08 10:02:12 +01002801{
Gilles Peskine828ed142018-06-18 23:25:51 +02002802 uint8_t actual_mac[PSA_MAC_MAX_SIZE];
mohammad16036df908f2018-04-02 08:34:15 -07002803 psa_status_t status;
2804
Jaeden Amero252ef282019-02-15 14:05:35 +00002805 if( operation->alg == 0 )
2806 {
2807 return( PSA_ERROR_BAD_STATE );
2808 }
2809
Gilles Peskine89167cb2018-07-08 20:12:23 +02002810 if( operation->is_sign )
2811 {
Jaeden Ameroe236c2a2019-02-20 15:37:15 +00002812 return( PSA_ERROR_BAD_STATE );
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002813 }
2814 if( operation->mac_size != mac_length )
2815 {
2816 status = PSA_ERROR_INVALID_SIGNATURE;
2817 goto cleanup;
Gilles Peskine89167cb2018-07-08 20:12:23 +02002818 }
mohammad16036df908f2018-04-02 08:34:15 -07002819
2820 status = psa_mac_finish_internal( operation,
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002821 actual_mac, sizeof( actual_mac ) );
Gilles Peskine28cd4162020-01-20 16:31:06 +01002822 if( status != PSA_SUCCESS )
2823 goto cleanup;
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002824
2825 if( safer_memcmp( mac, actual_mac, mac_length ) != 0 )
2826 status = PSA_ERROR_INVALID_SIGNATURE;
2827
2828cleanup:
2829 if( status == PSA_SUCCESS )
2830 status = psa_mac_abort( operation );
2831 else
2832 psa_mac_abort( operation );
2833
Gilles Peskine3f108122018-12-07 18:14:53 +01002834 mbedtls_platform_zeroize( actual_mac, sizeof( actual_mac ) );
Gilles Peskined911eb72018-08-14 15:18:45 +02002835
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002836 return( status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002837}
2838
2839
Gilles Peskine20035e32018-02-03 22:44:14 +01002840
Gilles Peskine20035e32018-02-03 22:44:14 +01002841/****************************************************************/
2842/* Asymmetric cryptography */
2843/****************************************************************/
2844
gabor-mezei-arm56980482021-05-05 13:56:27 +02002845static psa_status_t psa_sign_verify_check_alg( uint8_t do_hash,
2846 psa_algorithm_t alg )
gabor-mezei-armbc0088b2021-04-20 12:11:35 +02002847{
gabor-mezei-arm56980482021-05-05 13:56:27 +02002848 if( do_hash )
2849 {
2850 if( ! PSA_ALG_IS_SIGN_MESSAGE( alg ) )
2851 return( PSA_ERROR_INVALID_ARGUMENT );
gabor-mezei-armbc0088b2021-04-20 12:11:35 +02002852
gabor-mezei-arm56980482021-05-05 13:56:27 +02002853 if ( PSA_ALG_IS_HASH_AND_SIGN( alg ) )
2854 {
2855 if( ! PSA_ALG_IS_HASH( PSA_ALG_SIGN_GET_HASH( alg ) ) )
2856 return( PSA_ERROR_INVALID_ARGUMENT );
2857 }
2858 }
2859 else
2860 {
2861 if( ! PSA_ALG_IS_HASH_AND_SIGN( alg ) )
2862 return( PSA_ERROR_INVALID_ARGUMENT );
2863 }
2864
2865 return( PSA_SUCCESS );
2866}
gabor-mezei-armbc0088b2021-04-20 12:11:35 +02002867
2868static psa_status_t psa_sign_internal( mbedtls_svc_key_id_t key,
gabor-mezei-arm56980482021-05-05 13:56:27 +02002869 uint8_t do_hash,
gabor-mezei-armbc0088b2021-04-20 12:11:35 +02002870 psa_algorithm_t alg,
2871 const uint8_t * input,
2872 size_t input_length,
2873 uint8_t * signature,
2874 size_t signature_size,
2875 size_t * signature_length )
gabor-mezei-arme8efa392021-04-14 21:14:28 +02002876{
2877 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2878 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
2879 psa_key_slot_t *slot;
gabor-mezei-arme8efa392021-04-14 21:14:28 +02002880
2881 *signature_length = 0;
2882
gabor-mezei-arm56980482021-05-05 13:56:27 +02002883 status = psa_sign_verify_check_alg( do_hash, alg );
2884 if( status != PSA_SUCCESS )
2885 return status;
gabor-mezei-armbc0088b2021-04-20 12:11:35 +02002886
gabor-mezei-arme8efa392021-04-14 21:14:28 +02002887 /* Immediately reject a zero-length signature buffer. This guarantees
gabor-mezei-arm12ff4d52021-05-05 13:54:55 +02002888 * that signature must be a valid pointer. (On the other hand, the input
gabor-mezei-arme8efa392021-04-14 21:14:28 +02002889 * buffer can in principle be empty since it doesn't actually have
2890 * to be a hash.) */
2891 if( signature_size == 0 )
2892 return( PSA_ERROR_BUFFER_TOO_SMALL );
2893
gabor-mezei-armbc0088b2021-04-20 12:11:35 +02002894 status = psa_get_and_lock_key_slot_with_policy(
2895 key, &slot,
gabor-mezei-arm56980482021-05-05 13:56:27 +02002896 do_hash ? PSA_KEY_USAGE_SIGN_MESSAGE :
2897 PSA_KEY_USAGE_SIGN_HASH,
gabor-mezei-armbc0088b2021-04-20 12:11:35 +02002898 alg );
2899
gabor-mezei-arme8efa392021-04-14 21:14:28 +02002900 if( status != PSA_SUCCESS )
2901 goto exit;
2902
2903 if( ! PSA_KEY_TYPE_IS_KEY_PAIR( slot->attr.type ) )
2904 {
2905 status = PSA_ERROR_INVALID_ARGUMENT;
2906 goto exit;
2907 }
2908
2909 psa_key_attributes_t attributes = {
2910 .core = slot->attr
2911 };
2912
gabor-mezei-arm56980482021-05-05 13:56:27 +02002913 if( do_hash )
gabor-mezei-arme8efa392021-04-14 21:14:28 +02002914 {
gabor-mezei-armc53f4f62021-04-22 11:32:19 +02002915 status = psa_driver_wrapper_sign_message(
gabor-mezei-armbc0088b2021-04-20 12:11:35 +02002916 &attributes, slot->key.data, slot->key.bytes,
gabor-mezei-armc53f4f62021-04-22 11:32:19 +02002917 alg, input, input_length,
gabor-mezei-armbc0088b2021-04-20 12:11:35 +02002918 signature, signature_size, signature_length );
2919 }
gabor-mezei-arm56980482021-05-05 13:56:27 +02002920 else
gabor-mezei-armbc0088b2021-04-20 12:11:35 +02002921 {
2922
2923 status = psa_driver_wrapper_sign_hash(
2924 &attributes, slot->key.data, slot->key.bytes,
2925 alg, input, input_length,
2926 signature, signature_size, signature_length );
gabor-mezei-arme8efa392021-04-14 21:14:28 +02002927 }
2928
gabor-mezei-arme8efa392021-04-14 21:14:28 +02002929
2930exit:
2931 /* Fill the unused part of the output buffer (the whole buffer on error,
2932 * the trailing part on success) with something that isn't a valid signature
2933 * (barring an attack on the signature and deliberately-crafted input),
2934 * in case the caller doesn't check the return status properly. */
2935 if( status == PSA_SUCCESS )
2936 memset( signature + *signature_length, '!',
2937 signature_size - *signature_length );
2938 else
2939 memset( signature, '!', signature_size );
2940 /* If signature_size is 0 then we have nothing to do. We must not call
2941 * memset because signature may be NULL in this case. */
2942
2943 unlock_status = psa_unlock_key_slot( slot );
2944
2945 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
2946}
2947
gabor-mezei-armbc0088b2021-04-20 12:11:35 +02002948static psa_status_t psa_verify_internal( mbedtls_svc_key_id_t key,
gabor-mezei-arm56980482021-05-05 13:56:27 +02002949 uint8_t do_hash,
gabor-mezei-armbc0088b2021-04-20 12:11:35 +02002950 psa_algorithm_t alg,
2951 const uint8_t * input,
2952 size_t input_length,
2953 const uint8_t * signature,
2954 size_t signature_length )
gabor-mezei-arme8efa392021-04-14 21:14:28 +02002955{
2956 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2957 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
2958 psa_key_slot_t *slot;
gabor-mezei-arme8efa392021-04-14 21:14:28 +02002959
gabor-mezei-arm56980482021-05-05 13:56:27 +02002960 status = psa_sign_verify_check_alg( do_hash, alg );
2961 if( status != PSA_SUCCESS )
2962 return status;
gabor-mezei-armbc0088b2021-04-20 12:11:35 +02002963
gabor-mezei-armbc0088b2021-04-20 12:11:35 +02002964 status = psa_get_and_lock_key_slot_with_policy(
2965 key, &slot,
gabor-mezei-arm56980482021-05-05 13:56:27 +02002966 do_hash ? PSA_KEY_USAGE_VERIFY_MESSAGE :
2967 PSA_KEY_USAGE_VERIFY_HASH,
gabor-mezei-armbc0088b2021-04-20 12:11:35 +02002968 alg );
gabor-mezei-arme8efa392021-04-14 21:14:28 +02002969
gabor-mezei-arme8efa392021-04-14 21:14:28 +02002970 if( status != PSA_SUCCESS )
2971 return( status );
2972
2973 psa_key_attributes_t attributes = {
2974 .core = slot->attr
2975 };
2976
gabor-mezei-arm56980482021-05-05 13:56:27 +02002977 if( do_hash )
gabor-mezei-arme8efa392021-04-14 21:14:28 +02002978 {
gabor-mezei-armc53f4f62021-04-22 11:32:19 +02002979 status = psa_driver_wrapper_verify_message(
gabor-mezei-armbc0088b2021-04-20 12:11:35 +02002980 &attributes, slot->key.data, slot->key.bytes,
gabor-mezei-armc53f4f62021-04-22 11:32:19 +02002981 alg, input, input_length,
gabor-mezei-armbc0088b2021-04-20 12:11:35 +02002982 signature, signature_length );
gabor-mezei-arme8efa392021-04-14 21:14:28 +02002983 }
gabor-mezei-arm56980482021-05-05 13:56:27 +02002984 else
gabor-mezei-armbc0088b2021-04-20 12:11:35 +02002985 {
2986 status = psa_driver_wrapper_verify_hash(
2987 &attributes, slot->key.data, slot->key.bytes,
2988 alg, input, input_length,
2989 signature, signature_length );
2990 }
gabor-mezei-arme8efa392021-04-14 21:14:28 +02002991
gabor-mezei-arme8efa392021-04-14 21:14:28 +02002992 unlock_status = psa_unlock_key_slot( slot );
2993
2994 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
gabor-mezei-armbc0088b2021-04-20 12:11:35 +02002995
2996}
2997
gabor-mezei-armc53f4f62021-04-22 11:32:19 +02002998psa_status_t psa_sign_message_internal(
2999 const psa_key_attributes_t *attributes,
3000 const uint8_t *key_buffer,
3001 size_t key_buffer_size,
3002 psa_algorithm_t alg,
3003 const uint8_t *input,
3004 size_t input_length,
3005 uint8_t *signature,
3006 size_t signature_size,
3007 size_t *signature_length )
3008{
3009 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-armc53f4f62021-04-22 11:32:19 +02003010
gabor-mezei-armbfbe4652021-04-29 16:48:44 +02003011 if ( PSA_ALG_IS_HASH_AND_SIGN( alg ) )
3012 {
gabor-mezei-arm9719a842021-05-03 16:26:20 +02003013 size_t hash_length;
3014 uint8_t hash[PSA_HASH_MAX_SIZE];
3015
gabor-mezei-armbfbe4652021-04-29 16:48:44 +02003016 status = psa_driver_wrapper_hash_compute(
3017 PSA_ALG_SIGN_GET_HASH( alg ),
3018 input, input_length,
3019 hash, sizeof( hash ), &hash_length );
gabor-mezei-armc53f4f62021-04-22 11:32:19 +02003020
gabor-mezei-armbfbe4652021-04-29 16:48:44 +02003021 if( status != PSA_SUCCESS )
3022 return status;
gabor-mezei-arm9719a842021-05-03 16:26:20 +02003023
3024 return psa_driver_wrapper_sign_hash(
3025 attributes, key_buffer, key_buffer_size,
3026 alg, hash, hash_length,
3027 signature, signature_size, signature_length );
gabor-mezei-armbfbe4652021-04-29 16:48:44 +02003028 }
gabor-mezei-armc53f4f62021-04-22 11:32:19 +02003029
gabor-mezei-arm56980482021-05-05 13:56:27 +02003030 return( PSA_ERROR_NOT_SUPPORTED );
gabor-mezei-armc53f4f62021-04-22 11:32:19 +02003031}
3032
gabor-mezei-armbc0088b2021-04-20 12:11:35 +02003033psa_status_t psa_sign_message( mbedtls_svc_key_id_t key,
3034 psa_algorithm_t alg,
3035 const uint8_t * input,
3036 size_t input_length,
3037 uint8_t * signature,
3038 size_t signature_size,
3039 size_t * signature_length )
3040{
3041 return psa_sign_internal(
gabor-mezei-arm56980482021-05-05 13:56:27 +02003042 key, 1, alg, input, input_length,
gabor-mezei-armbc0088b2021-04-20 12:11:35 +02003043 signature, signature_size, signature_length );
3044}
3045
gabor-mezei-armc53f4f62021-04-22 11:32:19 +02003046psa_status_t psa_verify_message_internal(
3047 const psa_key_attributes_t *attributes,
3048 const uint8_t *key_buffer,
3049 size_t key_buffer_size,
3050 psa_algorithm_t alg,
3051 const uint8_t *input,
3052 size_t input_length,
3053 const uint8_t *signature,
3054 size_t signature_length )
3055{
3056 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-armc53f4f62021-04-22 11:32:19 +02003057
gabor-mezei-armbfbe4652021-04-29 16:48:44 +02003058 if ( PSA_ALG_IS_HASH_AND_SIGN( alg ) )
3059 {
gabor-mezei-arm9719a842021-05-03 16:26:20 +02003060 size_t hash_length;
3061 uint8_t hash[PSA_HASH_MAX_SIZE];
3062
gabor-mezei-armbfbe4652021-04-29 16:48:44 +02003063 status = psa_driver_wrapper_hash_compute(
3064 PSA_ALG_SIGN_GET_HASH( alg ),
3065 input, input_length,
3066 hash, sizeof( hash ), &hash_length );
gabor-mezei-armc53f4f62021-04-22 11:32:19 +02003067
gabor-mezei-armbfbe4652021-04-29 16:48:44 +02003068 if( status != PSA_SUCCESS )
3069 return status;
gabor-mezei-arm9719a842021-05-03 16:26:20 +02003070
3071 return psa_driver_wrapper_verify_hash(
3072 attributes, key_buffer, key_buffer_size,
3073 alg, hash, hash_length,
3074 signature, signature_length );
gabor-mezei-armbfbe4652021-04-29 16:48:44 +02003075 }
gabor-mezei-armc53f4f62021-04-22 11:32:19 +02003076
gabor-mezei-armfc8d0ae2021-04-29 16:53:58 +02003077 return psa_driver_wrapper_verify_hash(
gabor-mezei-armc53f4f62021-04-22 11:32:19 +02003078 attributes, key_buffer, key_buffer_size,
gabor-mezei-arm9719a842021-05-03 16:26:20 +02003079 alg, input, input_length,
gabor-mezei-armc53f4f62021-04-22 11:32:19 +02003080 signature, signature_length );
3081}
3082
gabor-mezei-armbc0088b2021-04-20 12:11:35 +02003083psa_status_t psa_verify_message( mbedtls_svc_key_id_t key,
3084 psa_algorithm_t alg,
3085 const uint8_t * input,
3086 size_t input_length,
3087 const uint8_t * signature,
3088 size_t signature_length )
3089{
3090 return psa_verify_internal(
gabor-mezei-arm56980482021-05-05 13:56:27 +02003091 key, 1, alg, input, input_length,
gabor-mezei-armbc0088b2021-04-20 12:11:35 +02003092 signature, signature_length );
gabor-mezei-arme8efa392021-04-14 21:14:28 +02003093}
3094
Ronald Cron67b1eb32020-12-08 17:37:27 +01003095psa_status_t psa_sign_hash_internal(
Ronald Cron18659932020-12-08 16:32:23 +01003096 const psa_key_attributes_t *attributes,
3097 const uint8_t *key_buffer, size_t key_buffer_size,
3098 psa_algorithm_t alg, const uint8_t *hash, size_t hash_length,
3099 uint8_t *signature, size_t signature_size, size_t *signature_length )
Gilles Peskine20035e32018-02-03 22:44:14 +01003100{
Ronald Cron99b8ed72021-02-17 10:33:32 +01003101 if( attributes->core.type == PSA_KEY_TYPE_RSA_KEY_PAIR )
Gilles Peskine20035e32018-02-03 22:44:14 +01003102 {
Ronald Cron4501c982021-03-19 20:09:32 +01003103 if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) ||
3104 PSA_ALG_IS_RSA_PSS( alg) )
Steven Cooremanacda8342020-07-24 23:09:52 +02003105 {
Ronald Cron4501c982021-03-19 20:09:32 +01003106#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
3107 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
3108 return( mbedtls_psa_rsa_sign_hash(
Ronald Cron072722c2020-12-09 16:36:19 +01003109 attributes,
3110 key_buffer, key_buffer_size,
3111 alg, hash, hash_length,
3112 signature, signature_size, signature_length ) );
Ronald Cron4501c982021-03-19 20:09:32 +01003113#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
3114 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
Steven Cooremanacda8342020-07-24 23:09:52 +02003115 }
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003116 else
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003117 {
Ronald Cron8a494f32021-02-17 09:49:51 +01003118 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003119 }
Gilles Peskinee59236f2018-01-27 23:32:46 +01003120 }
3121 else
Ronald Cron4501c982021-03-19 20:09:32 +01003122 if( PSA_KEY_TYPE_IS_ECC( attributes->core.type ) )
3123 {
3124 if( PSA_ALG_IS_ECDSA( alg ) )
3125 {
3126#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3127 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
3128 return( mbedtls_psa_ecdsa_sign_hash(
3129 attributes,
3130 key_buffer, key_buffer_size,
3131 alg, hash, hash_length,
3132 signature, signature_size, signature_length ) );
Gilles Peskinee59236f2018-01-27 23:32:46 +01003133#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3134 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Ronald Cron4501c982021-03-19 20:09:32 +01003135 }
3136 else
3137 {
3138 return( PSA_ERROR_INVALID_ARGUMENT );
3139 }
Ronald Cron8a494f32021-02-17 09:49:51 +01003140 }
Ronald Cron4501c982021-03-19 20:09:32 +01003141
3142 (void)key_buffer;
3143 (void)key_buffer_size;
3144 (void)hash;
3145 (void)hash_length;
3146 (void)signature;
3147 (void)signature_size;
3148 (void)signature_length;
3149
3150 return( PSA_ERROR_NOT_SUPPORTED );
Ronald Cron18659932020-12-08 16:32:23 +01003151}
Gilles Peskinee59236f2018-01-27 23:32:46 +01003152
3153psa_status_t psa_sign_hash( mbedtls_svc_key_id_t key,
3154 psa_algorithm_t alg,
3155 const uint8_t *hash,
3156 size_t hash_length,
3157 uint8_t *signature,
3158 size_t signature_size,
3159 size_t *signature_length )
3160{
gabor-mezei-armbc0088b2021-04-20 12:11:35 +02003161 return psa_sign_internal(
gabor-mezei-arm56980482021-05-05 13:56:27 +02003162 key, 0, alg, hash, hash_length,
Ronald Cron9f17aa42020-12-08 17:07:25 +01003163 signature, signature_size, signature_length );
itayzafrir5c753392018-05-08 11:18:38 +03003164}
3165
Ronald Cron67b1eb32020-12-08 17:37:27 +01003166psa_status_t psa_verify_hash_internal(
Ronald Cron18659932020-12-08 16:32:23 +01003167 const psa_key_attributes_t *attributes,
3168 const uint8_t *key_buffer, size_t key_buffer_size,
3169 psa_algorithm_t alg, const uint8_t *hash, size_t hash_length,
3170 const uint8_t *signature, size_t signature_length )
itayzafrir5c753392018-05-08 11:18:38 +03003171{
Ronald Cron99b8ed72021-02-17 10:33:32 +01003172 if( PSA_KEY_TYPE_IS_RSA( attributes->core.type ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003173 {
Ronald Cron4501c982021-03-19 20:09:32 +01003174 if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) ||
3175 PSA_ALG_IS_RSA_PSS( alg) )
Steven Cooremanacda8342020-07-24 23:09:52 +02003176 {
Ronald Cron4501c982021-03-19 20:09:32 +01003177#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
3178 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
3179 return( mbedtls_psa_rsa_verify_hash(
Ronald Cron072722c2020-12-09 16:36:19 +01003180 attributes,
3181 key_buffer, key_buffer_size,
3182 alg, hash, hash_length,
3183 signature, signature_length ) );
Ronald Cron4501c982021-03-19 20:09:32 +01003184#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
3185 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
Steven Cooremanacda8342020-07-24 23:09:52 +02003186 }
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003187 else
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003188 {
Ronald Cron8a494f32021-02-17 09:49:51 +01003189 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003190 }
itayzafrir5c753392018-05-08 11:18:38 +03003191 }
Gilles Peskinee59236f2018-01-27 23:32:46 +01003192 else
Ronald Cron4501c982021-03-19 20:09:32 +01003193 if( PSA_KEY_TYPE_IS_ECC( attributes->core.type ) )
Gilles Peskinee59236f2018-01-27 23:32:46 +01003194 {
Ronald Cron4501c982021-03-19 20:09:32 +01003195 if( PSA_ALG_IS_ECDSA( alg ) )
3196 {
3197#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3198 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
3199 return( mbedtls_psa_ecdsa_verify_hash(
3200 attributes,
3201 key_buffer, key_buffer_size,
3202 alg, hash, hash_length,
3203 signature, signature_length ) );
3204#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3205 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
3206 }
3207 else
3208 {
3209 return( PSA_ERROR_INVALID_ARGUMENT );
3210 }
Ronald Cron8a494f32021-02-17 09:49:51 +01003211 }
Ronald Cron4501c982021-03-19 20:09:32 +01003212
3213 (void)key_buffer;
3214 (void)key_buffer_size;
3215 (void)hash;
3216 (void)hash_length;
3217 (void)signature;
3218 (void)signature_length;
3219
3220 return( PSA_ERROR_NOT_SUPPORTED );
Ronald Cron18659932020-12-08 16:32:23 +01003221}
3222
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003223psa_status_t psa_verify_hash( mbedtls_svc_key_id_t key,
3224 psa_algorithm_t alg,
3225 const uint8_t *hash,
3226 size_t hash_length,
3227 const uint8_t *signature,
3228 size_t signature_length )
3229{
gabor-mezei-armbc0088b2021-04-20 12:11:35 +02003230 return psa_verify_internal(
gabor-mezei-arm56980482021-05-05 13:56:27 +02003231 key, 0, alg, hash, hash_length,
Ronald Cron9f17aa42020-12-08 17:07:25 +01003232 signature, signature_length );
Gilles Peskinee59236f2018-01-27 23:32:46 +01003233}
3234
John Durkop0e005192020-10-31 22:06:54 -07003235#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
Gilles Peskine072ac562018-06-30 00:21:29 +02003236static void psa_rsa_oaep_set_padding_mode( psa_algorithm_t alg,
3237 mbedtls_rsa_context *rsa )
3238{
3239 psa_algorithm_t hash_alg = PSA_ALG_RSA_OAEP_GET_HASH( alg );
3240 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
3241 mbedtls_md_type_t md_alg = mbedtls_md_get_type( md_info );
3242 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
3243}
John Durkop0e005192020-10-31 22:06:54 -07003244#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */
Gilles Peskine072ac562018-06-30 00:21:29 +02003245
Ronald Croncf56a0a2020-08-04 09:51:30 +02003246psa_status_t psa_asymmetric_encrypt( mbedtls_svc_key_id_t key,
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003247 psa_algorithm_t alg,
3248 const uint8_t *input,
3249 size_t input_length,
3250 const uint8_t *salt,
3251 size_t salt_length,
3252 uint8_t *output,
3253 size_t output_size,
3254 size_t *output_length )
3255{
Ronald Cronf95a2b12020-10-22 15:24:49 +02003256 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01003257 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01003258 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003259
Darryl Green5cc689a2018-07-24 15:34:10 +01003260 (void) input;
3261 (void) input_length;
3262 (void) salt;
3263 (void) output;
3264 (void) output_size;
3265
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003266 *output_length = 0;
3267
Gilles Peskineb3fc05d2018-06-30 19:04:35 +02003268 if( ! PSA_ALG_IS_RSA_OAEP( alg ) && salt_length != 0 )
3269 return( PSA_ERROR_INVALID_ARGUMENT );
3270
Ronald Cron5c522922020-11-14 16:35:34 +01003271 status = psa_get_and_lock_transparent_key_slot_with_policy(
3272 key, &slot, PSA_KEY_USAGE_ENCRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003273 if( status != PSA_SUCCESS )
3274 return( status );
Gilles Peskine8e338702019-07-30 20:06:31 +02003275 if( ! ( PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->attr.type ) ||
3276 PSA_KEY_TYPE_IS_KEY_PAIR( slot->attr.type ) ) )
Ronald Cronf95a2b12020-10-22 15:24:49 +02003277 {
3278 status = PSA_ERROR_INVALID_ARGUMENT;
3279 goto exit;
3280 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003281
John Durkop6ba40d12020-11-10 08:50:04 -08003282#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \
3283 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
Gilles Peskine8e338702019-07-30 20:06:31 +02003284 if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003285 {
Steven Cooremana2371e52020-07-28 14:30:39 +02003286 mbedtls_rsa_context *rsa = NULL;
Ronald Cron90857082020-11-25 14:58:33 +01003287 status = mbedtls_psa_rsa_load_representation( slot->attr.type,
3288 slot->key.data,
3289 slot->key.bytes,
3290 &rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02003291 if( status != PSA_SUCCESS )
Steven Cooreman4fed4552020-08-03 14:46:03 +02003292 goto rsa_exit;
Steven Cooremana2371e52020-07-28 14:30:39 +02003293
3294 if( output_size < mbedtls_rsa_get_len( rsa ) )
Steven Cooremana01795d2020-07-24 22:48:15 +02003295 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02003296 status = PSA_ERROR_BUFFER_TOO_SMALL;
3297 goto rsa_exit;
Steven Cooremana01795d2020-07-24 22:48:15 +02003298 }
John Durkop0e005192020-10-31 22:06:54 -07003299#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT)
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003300 if( alg == PSA_ALG_RSA_PKCS1V15_CRYPT )
3301 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02003302 status = mbedtls_to_psa_error(
3303 mbedtls_rsa_pkcs1_encrypt( rsa,
Gilles Peskine30524eb2020-11-13 17:02:26 +01003304 mbedtls_psa_get_random,
Gilles Peskine5894e8e2020-12-14 14:54:06 +01003305 MBEDTLS_PSA_RANDOM_STATE,
Steven Cooreman4fed4552020-08-03 14:46:03 +02003306 MBEDTLS_RSA_PUBLIC,
3307 input_length,
3308 input,
3309 output ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003310 }
3311 else
John Durkop0e005192020-10-31 22:06:54 -07003312#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT */
3313#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003314 if( PSA_ALG_IS_RSA_OAEP( alg ) )
3315 {
Steven Cooremana2371e52020-07-28 14:30:39 +02003316 psa_rsa_oaep_set_padding_mode( alg, rsa );
Steven Cooreman4fed4552020-08-03 14:46:03 +02003317 status = mbedtls_to_psa_error(
3318 mbedtls_rsa_rsaes_oaep_encrypt( rsa,
Gilles Peskine30524eb2020-11-13 17:02:26 +01003319 mbedtls_psa_get_random,
Gilles Peskine5894e8e2020-12-14 14:54:06 +01003320 MBEDTLS_PSA_RANDOM_STATE,
Steven Cooreman4fed4552020-08-03 14:46:03 +02003321 MBEDTLS_RSA_PUBLIC,
3322 salt, salt_length,
3323 input_length,
3324 input,
3325 output ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003326 }
3327 else
John Durkop0e005192020-10-31 22:06:54 -07003328#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP */
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003329 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02003330 status = PSA_ERROR_INVALID_ARGUMENT;
3331 goto rsa_exit;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003332 }
Steven Cooreman4fed4552020-08-03 14:46:03 +02003333rsa_exit:
3334 if( status == PSA_SUCCESS )
Steven Cooremana2371e52020-07-28 14:30:39 +02003335 *output_length = mbedtls_rsa_get_len( rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02003336
Steven Cooremana2371e52020-07-28 14:30:39 +02003337 mbedtls_rsa_free( rsa );
3338 mbedtls_free( rsa );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003339 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003340 else
John Durkop9814fa22020-11-04 12:28:15 -08003341#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) ||
John Durkop6ba40d12020-11-10 08:50:04 -08003342 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003343 {
Ronald Cronf95a2b12020-10-22 15:24:49 +02003344 status = PSA_ERROR_NOT_SUPPORTED;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003345 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02003346
3347exit:
Ronald Cron5c522922020-11-14 16:35:34 +01003348 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02003349
Ronald Cron5c522922020-11-14 16:35:34 +01003350 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskine5b051bc2018-05-31 13:25:48 +02003351}
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003352
Ronald Croncf56a0a2020-08-04 09:51:30 +02003353psa_status_t psa_asymmetric_decrypt( mbedtls_svc_key_id_t key,
Gilles Peskine61b91d42018-06-08 16:09:36 +02003354 psa_algorithm_t alg,
3355 const uint8_t *input,
3356 size_t input_length,
3357 const uint8_t *salt,
3358 size_t salt_length,
3359 uint8_t *output,
3360 size_t output_size,
3361 size_t *output_length )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003362{
Ronald Cronf95a2b12020-10-22 15:24:49 +02003363 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01003364 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01003365 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003366
Darryl Green5cc689a2018-07-24 15:34:10 +01003367 (void) input;
3368 (void) input_length;
3369 (void) salt;
3370 (void) output;
3371 (void) output_size;
3372
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03003373 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003374
Gilles Peskineb3fc05d2018-06-30 19:04:35 +02003375 if( ! PSA_ALG_IS_RSA_OAEP( alg ) && salt_length != 0 )
3376 return( PSA_ERROR_INVALID_ARGUMENT );
3377
Ronald Cron5c522922020-11-14 16:35:34 +01003378 status = psa_get_and_lock_transparent_key_slot_with_policy(
3379 key, &slot, PSA_KEY_USAGE_DECRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003380 if( status != PSA_SUCCESS )
3381 return( status );
Gilles Peskine8e338702019-07-30 20:06:31 +02003382 if( ! PSA_KEY_TYPE_IS_KEY_PAIR( slot->attr.type ) )
Ronald Cronf95a2b12020-10-22 15:24:49 +02003383 {
3384 status = PSA_ERROR_INVALID_ARGUMENT;
3385 goto exit;
3386 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003387
John Durkop6ba40d12020-11-10 08:50:04 -08003388#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \
3389 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
Gilles Peskine8e338702019-07-30 20:06:31 +02003390 if( slot->attr.type == PSA_KEY_TYPE_RSA_KEY_PAIR )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003391 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02003392 mbedtls_rsa_context *rsa = NULL;
Ronald Cron90857082020-11-25 14:58:33 +01003393 status = mbedtls_psa_rsa_load_representation( slot->attr.type,
3394 slot->key.data,
3395 slot->key.bytes,
3396 &rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02003397 if( status != PSA_SUCCESS )
Ronald Cronf95a2b12020-10-22 15:24:49 +02003398 goto exit;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003399
Steven Cooremana2371e52020-07-28 14:30:39 +02003400 if( input_length != mbedtls_rsa_get_len( rsa ) )
Steven Cooremana01795d2020-07-24 22:48:15 +02003401 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02003402 status = PSA_ERROR_INVALID_ARGUMENT;
3403 goto rsa_exit;
Steven Cooremana01795d2020-07-24 22:48:15 +02003404 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003405
John Durkop0e005192020-10-31 22:06:54 -07003406#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT)
Gilles Peskine6afe7892018-05-31 13:16:08 +02003407 if( alg == PSA_ALG_RSA_PKCS1V15_CRYPT )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003408 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02003409 status = mbedtls_to_psa_error(
3410 mbedtls_rsa_pkcs1_decrypt( rsa,
Gilles Peskine30524eb2020-11-13 17:02:26 +01003411 mbedtls_psa_get_random,
Gilles Peskine5894e8e2020-12-14 14:54:06 +01003412 MBEDTLS_PSA_RANDOM_STATE,
Steven Cooreman4fed4552020-08-03 14:46:03 +02003413 MBEDTLS_RSA_PRIVATE,
3414 output_length,
3415 input,
3416 output,
3417 output_size ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003418 }
3419 else
John Durkop0e005192020-10-31 22:06:54 -07003420#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT */
3421#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
Gilles Peskine55bf3d12018-06-26 15:53:48 +02003422 if( PSA_ALG_IS_RSA_OAEP( alg ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003423 {
Steven Cooremana2371e52020-07-28 14:30:39 +02003424 psa_rsa_oaep_set_padding_mode( alg, rsa );
Steven Cooreman4fed4552020-08-03 14:46:03 +02003425 status = mbedtls_to_psa_error(
3426 mbedtls_rsa_rsaes_oaep_decrypt( rsa,
Gilles Peskine30524eb2020-11-13 17:02:26 +01003427 mbedtls_psa_get_random,
Gilles Peskine5894e8e2020-12-14 14:54:06 +01003428 MBEDTLS_PSA_RANDOM_STATE,
Steven Cooreman4fed4552020-08-03 14:46:03 +02003429 MBEDTLS_RSA_PRIVATE,
3430 salt, salt_length,
3431 output_length,
3432 input,
3433 output,
3434 output_size ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003435 }
3436 else
John Durkop0e005192020-10-31 22:06:54 -07003437#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP */
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003438 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02003439 status = PSA_ERROR_INVALID_ARGUMENT;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003440 }
Nir Sonnenschein717a0402018-06-04 16:36:15 +03003441
Steven Cooreman4fed4552020-08-03 14:46:03 +02003442rsa_exit:
Steven Cooremana2371e52020-07-28 14:30:39 +02003443 mbedtls_rsa_free( rsa );
3444 mbedtls_free( rsa );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003445 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003446 else
John Durkop6ba40d12020-11-10 08:50:04 -08003447#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) ||
3448 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003449 {
Ronald Cronf95a2b12020-10-22 15:24:49 +02003450 status = PSA_ERROR_NOT_SUPPORTED;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003451 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02003452
3453exit:
Ronald Cron5c522922020-11-14 16:35:34 +01003454 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02003455
Ronald Cron5c522922020-11-14 16:35:34 +01003456 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskine5b051bc2018-05-31 13:25:48 +02003457}
Gilles Peskinee59236f2018-01-27 23:32:46 +01003458
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02003459
3460
mohammad1603503973b2018-03-12 15:59:30 +02003461/****************************************************************/
3462/* Symmetric cryptography */
3463/****************************************************************/
3464
Ronald Cronab99ac22020-10-01 16:38:28 +02003465static psa_status_t psa_cipher_setup( psa_cipher_operation_t *operation,
3466 mbedtls_svc_key_id_t key,
3467 psa_algorithm_t alg,
3468 mbedtls_operation_t cipher_operation )
3469{
3470 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3471 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
3472 psa_key_slot_t *slot;
3473 psa_key_usage_t usage = ( cipher_operation == MBEDTLS_ENCRYPT ?
3474 PSA_KEY_USAGE_ENCRYPT :
3475 PSA_KEY_USAGE_DECRYPT );
3476
3477 /* A context must be freshly initialized before it can be set up. */
Ronald Cron49fafa92021-03-10 08:34:23 +01003478 if( operation->id != 0 )
Ronald Cronab99ac22020-10-01 16:38:28 +02003479 return( PSA_ERROR_BAD_STATE );
3480
3481 /* The requested algorithm must be one that can be processed by cipher. */
3482 if( ! PSA_ALG_IS_CIPHER( alg ) )
3483 return( PSA_ERROR_INVALID_ARGUMENT );
3484
3485 /* Fetch key material from key storage. */
3486 status = psa_get_and_lock_key_slot_with_policy( key, &slot, usage, alg );
3487 if( status != PSA_SUCCESS )
3488 goto exit;
3489
Ronald Cron49fafa92021-03-10 08:34:23 +01003490 /* Initialize the operation struct members, except for id. The id member
Ronald Cronab99ac22020-10-01 16:38:28 +02003491 * is used to indicate to psa_cipher_abort that there are resources to free,
Ronald Cron49fafa92021-03-10 08:34:23 +01003492 * so we only set it (in the driver wrapper) after resources have been
3493 * allocated/initialized. */
Ronald Cronab99ac22020-10-01 16:38:28 +02003494 operation->iv_set = 0;
Ronald Cronab99ac22020-10-01 16:38:28 +02003495 if( alg == PSA_ALG_ECB_NO_PADDING )
3496 operation->iv_required = 0;
3497 else
3498 operation->iv_required = 1;
Ronald Cron5618a392021-03-26 09:52:26 +01003499 operation->default_iv_length = PSA_CIPHER_IV_LENGTH( slot->attr.type, alg );
Ronald Cronab99ac22020-10-01 16:38:28 +02003500
Ronald Crona4af55f2020-12-14 14:36:06 +01003501 psa_key_attributes_t attributes = {
3502 .core = slot->attr
3503 };
3504
Ronald Cronab99ac22020-10-01 16:38:28 +02003505 /* Try doing the operation through a driver before using software fallback. */
3506 if( cipher_operation == MBEDTLS_ENCRYPT )
Ronald Crona4af55f2020-12-14 14:36:06 +01003507 status = psa_driver_wrapper_cipher_encrypt_setup( operation,
3508 &attributes,
3509 slot->key.data,
3510 slot->key.bytes,
Ronald Cronab99ac22020-10-01 16:38:28 +02003511 alg );
3512 else
Ronald Crona4af55f2020-12-14 14:36:06 +01003513 status = psa_driver_wrapper_cipher_decrypt_setup( operation,
3514 &attributes,
3515 slot->key.data,
3516 slot->key.bytes,
Ronald Cronab99ac22020-10-01 16:38:28 +02003517 alg );
3518
Gilles Peskine9ab61b62019-02-25 17:43:14 +01003519exit:
Ronald Cron06aa4422021-03-09 17:32:57 +01003520 if( status != PSA_SUCCESS )
Gilles Peskine9ab61b62019-02-25 17:43:14 +01003521 psa_cipher_abort( operation );
Ronald Cronf95a2b12020-10-22 15:24:49 +02003522
Ronald Cron5c522922020-11-14 16:35:34 +01003523 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02003524
Ronald Cron5c522922020-11-14 16:35:34 +01003525 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
mohammad1603503973b2018-03-12 15:59:30 +02003526}
3527
Gilles Peskinefe119512018-07-08 21:39:34 +02003528psa_status_t psa_cipher_encrypt_setup( psa_cipher_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02003529 mbedtls_svc_key_id_t key,
Gilles Peskinefe119512018-07-08 21:39:34 +02003530 psa_algorithm_t alg )
mohammad16038481e742018-03-18 13:57:31 +02003531{
Ronald Croncf56a0a2020-08-04 09:51:30 +02003532 return( psa_cipher_setup( operation, key, alg, MBEDTLS_ENCRYPT ) );
mohammad16038481e742018-03-18 13:57:31 +02003533}
3534
Gilles Peskinefe119512018-07-08 21:39:34 +02003535psa_status_t psa_cipher_decrypt_setup( psa_cipher_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02003536 mbedtls_svc_key_id_t key,
Gilles Peskinefe119512018-07-08 21:39:34 +02003537 psa_algorithm_t alg )
mohammad16038481e742018-03-18 13:57:31 +02003538{
Ronald Croncf56a0a2020-08-04 09:51:30 +02003539 return( psa_cipher_setup( operation, key, alg, MBEDTLS_DECRYPT ) );
mohammad16038481e742018-03-18 13:57:31 +02003540}
3541
Gilles Peskinefe119512018-07-08 21:39:34 +02003542psa_status_t psa_cipher_generate_iv( psa_cipher_operation_t *operation,
Andrew Thoelke163639b2019-05-15 12:33:23 +01003543 uint8_t *iv,
Gilles Peskinefe119512018-07-08 21:39:34 +02003544 size_t iv_size,
3545 size_t *iv_length )
mohammad1603503973b2018-03-12 15:59:30 +02003546{
Ronald Cron6d051732020-10-01 14:10:20 +02003547 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cronc45b4af2020-09-29 16:18:05 +02003548
Ronald Cron5618a392021-03-26 09:52:26 +01003549 *iv_length = 0;
3550
Ronald Cron49fafa92021-03-10 08:34:23 +01003551 if( operation->id == 0 )
Ronald Cronc45b4af2020-09-29 16:18:05 +02003552 {
3553 return( PSA_ERROR_BAD_STATE );
3554 }
3555
Steven Cooreman7df02922020-09-09 15:28:49 +02003556 if( operation->iv_set || ! operation->iv_required )
3557 {
3558 return( PSA_ERROR_BAD_STATE );
3559 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02003560
Ronald Cron5618a392021-03-26 09:52:26 +01003561 if( iv_size < operation->default_iv_length )
3562 {
3563 status = PSA_ERROR_BUFFER_TOO_SMALL;
3564 goto exit;
3565 }
Gilles Peskinee553c652018-06-04 16:22:46 +02003566
Ronald Cron5618a392021-03-26 09:52:26 +01003567 status = psa_generate_random( iv, operation->default_iv_length );
3568 if( status != PSA_SUCCESS )
3569 goto exit;
3570
3571 status = psa_driver_wrapper_cipher_set_iv( operation,
3572 iv,
3573 operation->default_iv_length );
3574
3575exit:
Steven Cooreman7df02922020-09-09 15:28:49 +02003576 if( status == PSA_SUCCESS )
Ronald Cron5618a392021-03-26 09:52:26 +01003577 {
Steven Cooreman7df02922020-09-09 15:28:49 +02003578 operation->iv_set = 1;
Ronald Cron5618a392021-03-26 09:52:26 +01003579 *iv_length = operation->default_iv_length;
3580 }
Steven Cooreman7df02922020-09-09 15:28:49 +02003581 else
Moran Peker395db872018-05-31 14:07:14 +03003582 psa_cipher_abort( operation );
Ronald Cron6d051732020-10-01 14:10:20 +02003583
itayzafrir534bd7c2018-08-02 13:56:32 +03003584 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02003585}
3586
Gilles Peskinefe119512018-07-08 21:39:34 +02003587psa_status_t psa_cipher_set_iv( psa_cipher_operation_t *operation,
Andrew Thoelke163639b2019-05-15 12:33:23 +01003588 const uint8_t *iv,
Gilles Peskinefe119512018-07-08 21:39:34 +02003589 size_t iv_length )
mohammad1603503973b2018-03-12 15:59:30 +02003590{
Ronald Cron6d051732020-10-01 14:10:20 +02003591 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cronc45b4af2020-09-29 16:18:05 +02003592
Ronald Cron49fafa92021-03-10 08:34:23 +01003593 if( operation->id == 0 )
Ronald Cronc45b4af2020-09-29 16:18:05 +02003594 return( PSA_ERROR_BAD_STATE );
Ronald Cronc45b4af2020-09-29 16:18:05 +02003595
Steven Cooreman7df02922020-09-09 15:28:49 +02003596 if( operation->iv_set || ! operation->iv_required )
Steven Cooreman7df02922020-09-09 15:28:49 +02003597 return( PSA_ERROR_BAD_STATE );
Ronald Crona0d68172021-03-26 10:15:08 +01003598
3599 if( iv_length > PSA_CIPHER_IV_MAX_SIZE )
3600 return( PSA_ERROR_INVALID_ARGUMENT );
Steven Cooremand3feccd2020-09-01 15:56:14 +02003601
Ronald Crondd24c9b2020-12-15 14:10:01 +01003602 status = psa_driver_wrapper_cipher_set_iv( operation,
3603 iv,
3604 iv_length );
Steven Cooremand3feccd2020-09-01 15:56:14 +02003605
itayzafrir534bd7c2018-08-02 13:56:32 +03003606 if( status == PSA_SUCCESS )
3607 operation->iv_set = 1;
3608 else
mohammad1603503973b2018-03-12 15:59:30 +02003609 psa_cipher_abort( operation );
itayzafrir534bd7c2018-08-02 13:56:32 +03003610 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02003611}
3612
Gilles Peskinee553c652018-06-04 16:22:46 +02003613psa_status_t psa_cipher_update( psa_cipher_operation_t *operation,
3614 const uint8_t *input,
3615 size_t input_length,
Andrew Thoelke163639b2019-05-15 12:33:23 +01003616 uint8_t *output,
Gilles Peskinee553c652018-06-04 16:22:46 +02003617 size_t output_size,
3618 size_t *output_length )
mohammad1603503973b2018-03-12 15:59:30 +02003619{
Steven Cooremanffecb7b2020-08-25 15:13:13 +02003620 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron6d051732020-10-01 14:10:20 +02003621
Ronald Cron49fafa92021-03-10 08:34:23 +01003622 if( operation->id == 0 )
Steven Cooreman7df02922020-09-09 15:28:49 +02003623 {
3624 return( PSA_ERROR_BAD_STATE );
3625 }
3626 if( operation->iv_required && ! operation->iv_set )
3627 {
3628 return( PSA_ERROR_BAD_STATE );
3629 }
Jaeden Ameroab439972019-02-15 14:12:05 +00003630
Ronald Crondd24c9b2020-12-15 14:10:01 +01003631 status = psa_driver_wrapper_cipher_update( operation,
3632 input,
3633 input_length,
3634 output,
3635 output_size,
3636 output_length );
itayzafrir534bd7c2018-08-02 13:56:32 +03003637 if( status != PSA_SUCCESS )
mohammad1603503973b2018-03-12 15:59:30 +02003638 psa_cipher_abort( operation );
Ronald Cron6d051732020-10-01 14:10:20 +02003639
itayzafrir534bd7c2018-08-02 13:56:32 +03003640 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02003641}
3642
Gilles Peskinee553c652018-06-04 16:22:46 +02003643psa_status_t psa_cipher_finish( psa_cipher_operation_t *operation,
3644 uint8_t *output,
3645 size_t output_size,
3646 size_t *output_length )
mohammad1603503973b2018-03-12 15:59:30 +02003647{
David Saadab4ecc272019-02-14 13:48:10 +02003648 psa_status_t status = PSA_ERROR_GENERIC_ERROR;
Ronald Cron6d051732020-10-01 14:10:20 +02003649
Ronald Cron49fafa92021-03-10 08:34:23 +01003650 if( operation->id == 0 )
Steven Cooreman7df02922020-09-09 15:28:49 +02003651 {
3652 return( PSA_ERROR_BAD_STATE );
3653 }
3654 if( operation->iv_required && ! operation->iv_set )
3655 {
3656 return( PSA_ERROR_BAD_STATE );
3657 }
Moran Pekerbed71a22018-04-22 20:19:20 +03003658
Ronald Crondd24c9b2020-12-15 14:10:01 +01003659 status = psa_driver_wrapper_cipher_finish( operation,
3660 output,
3661 output_size,
3662 output_length );
Steven Cooremanef8575e2020-09-11 11:44:50 +02003663 if( status == PSA_SUCCESS )
3664 return( psa_cipher_abort( operation ) );
3665 else
3666 {
3667 *output_length = 0;
Steven Cooremanef8575e2020-09-11 11:44:50 +02003668 (void) psa_cipher_abort( operation );
Janos Follath315b51c2018-07-09 16:04:51 +01003669
Steven Cooremanef8575e2020-09-11 11:44:50 +02003670 return( status );
3671 }
mohammad1603503973b2018-03-12 15:59:30 +02003672}
3673
Gilles Peskinee553c652018-06-04 16:22:46 +02003674psa_status_t psa_cipher_abort( psa_cipher_operation_t *operation )
3675{
Ronald Cron49fafa92021-03-10 08:34:23 +01003676 if( operation->id == 0 )
Gilles Peskine81736312018-06-26 15:04:31 +02003677 {
Steven Cooremana07b9972020-09-10 14:54:14 +02003678 /* The object has (apparently) been initialized but it is not (yet)
Gilles Peskine81736312018-06-26 15:04:31 +02003679 * in use. It's ok to call abort on such an object, and there's
3680 * nothing to do. */
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02003681 return( PSA_SUCCESS );
Gilles Peskine81736312018-06-26 15:04:31 +02003682 }
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02003683
Ronald Crondd24c9b2020-12-15 14:10:01 +01003684 psa_driver_wrapper_cipher_abort( operation );
Gilles Peskinee553c652018-06-04 16:22:46 +02003685
Ronald Cron49fafa92021-03-10 08:34:23 +01003686 operation->id = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03003687 operation->iv_set = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03003688 operation->iv_required = 0;
Moran Peker41deec42018-04-04 15:43:05 +03003689
Moran Peker395db872018-05-31 14:07:14 +03003690 return( PSA_SUCCESS );
mohammad1603503973b2018-03-12 15:59:30 +02003691}
3692
mohammad16035955c982018-04-26 00:53:03 +03003693/****************************************************************/
3694/* AEAD */
3695/****************************************************************/
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02003696
Ronald Croncf56a0a2020-08-04 09:51:30 +02003697psa_status_t psa_aead_encrypt( mbedtls_svc_key_id_t key,
mohammad16035955c982018-04-26 00:53:03 +03003698 psa_algorithm_t alg,
3699 const uint8_t *nonce,
3700 size_t nonce_length,
3701 const uint8_t *additional_data,
3702 size_t additional_data_length,
3703 const uint8_t *plaintext,
3704 size_t plaintext_length,
3705 uint8_t *ciphertext,
3706 size_t ciphertext_size,
3707 size_t *ciphertext_length )
3708{
Ronald Cron215633c2021-03-16 17:15:37 +01003709 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3710 psa_key_slot_t *slot;
Gilles Peskine2d277862018-06-18 15:41:12 +02003711
mohammad1603f08a5502018-06-03 15:05:47 +03003712 *ciphertext_length = 0;
mohammad1603e58e6842018-05-09 04:58:32 -07003713
Steven Cooremanea7ab132021-03-17 16:28:00 +01003714 if( !PSA_ALG_IS_AEAD( alg ) || PSA_ALG_IS_WILDCARD( alg ) )
3715 return( PSA_ERROR_NOT_SUPPORTED );
3716
Ronald Cron9a986162021-03-26 12:40:07 +01003717 status = psa_get_and_lock_key_slot_with_policy(
Ronald Cron215633c2021-03-16 17:15:37 +01003718 key, &slot, PSA_KEY_USAGE_ENCRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003719 if( status != PSA_SUCCESS )
3720 return( status );
mohammad16035955c982018-04-26 00:53:03 +03003721
Ronald Cron215633c2021-03-16 17:15:37 +01003722 psa_key_attributes_t attributes = {
3723 .core = slot->attr
3724 };
mohammad16035955c982018-04-26 00:53:03 +03003725
Ronald Cronde822812021-03-17 16:08:20 +01003726 status = psa_driver_wrapper_aead_encrypt(
Ronald Cron215633c2021-03-16 17:15:37 +01003727 &attributes, slot->key.data, slot->key.bytes,
3728 alg,
3729 nonce, nonce_length,
3730 additional_data, additional_data_length,
3731 plaintext, plaintext_length,
3732 ciphertext, ciphertext_size, ciphertext_length );
Gilles Peskine2d277862018-06-18 15:41:12 +02003733
Gilles Peskineedf9a652018-08-17 18:11:56 +02003734 if( status != PSA_SUCCESS && ciphertext_size != 0 )
3735 memset( ciphertext, 0, ciphertext_size );
Gilles Peskine2d277862018-06-18 15:41:12 +02003736
Ronald Cron9f310172021-03-16 16:36:37 +01003737 psa_unlock_key_slot( slot );
mohammad16035955c982018-04-26 00:53:03 +03003738
mohammad16035955c982018-04-26 00:53:03 +03003739 return( status );
Gilles Peskineee652a32018-06-01 19:23:52 +02003740}
3741
Ronald Croncf56a0a2020-08-04 09:51:30 +02003742psa_status_t psa_aead_decrypt( mbedtls_svc_key_id_t key,
mohammad16035955c982018-04-26 00:53:03 +03003743 psa_algorithm_t alg,
3744 const uint8_t *nonce,
3745 size_t nonce_length,
3746 const uint8_t *additional_data,
3747 size_t additional_data_length,
3748 const uint8_t *ciphertext,
3749 size_t ciphertext_length,
3750 uint8_t *plaintext,
3751 size_t plaintext_size,
3752 size_t *plaintext_length )
3753{
Ronald Cron215633c2021-03-16 17:15:37 +01003754 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3755 psa_key_slot_t *slot;
Gilles Peskine2d277862018-06-18 15:41:12 +02003756
Gilles Peskineee652a32018-06-01 19:23:52 +02003757 *plaintext_length = 0;
mohammad16039e5a5152018-04-26 12:07:35 +03003758
Steven Cooremanea7ab132021-03-17 16:28:00 +01003759 if( !PSA_ALG_IS_AEAD( alg ) || PSA_ALG_IS_WILDCARD( alg ) )
3760 return( PSA_ERROR_NOT_SUPPORTED );
3761
Ronald Cron9a986162021-03-26 12:40:07 +01003762 status = psa_get_and_lock_key_slot_with_policy(
Ronald Cron215633c2021-03-16 17:15:37 +01003763 key, &slot, PSA_KEY_USAGE_DECRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003764 if( status != PSA_SUCCESS )
3765 return( status );
mohammad16035955c982018-04-26 00:53:03 +03003766
Ronald Cron215633c2021-03-16 17:15:37 +01003767 psa_key_attributes_t attributes = {
3768 .core = slot->attr
3769 };
Gilles Peskinef7e7b012019-05-06 15:27:16 +02003770
Ronald Cronde822812021-03-17 16:08:20 +01003771 status = psa_driver_wrapper_aead_decrypt(
Ronald Cron215633c2021-03-16 17:15:37 +01003772 &attributes, slot->key.data, slot->key.bytes,
3773 alg,
3774 nonce, nonce_length,
3775 additional_data, additional_data_length,
3776 ciphertext, ciphertext_length,
3777 plaintext, plaintext_size, plaintext_length );
Gilles Peskinea40d7742018-06-01 16:28:30 +02003778
Gilles Peskineedf9a652018-08-17 18:11:56 +02003779 if( status != PSA_SUCCESS && plaintext_size != 0 )
3780 memset( plaintext, 0, plaintext_size );
mohammad160360a64d02018-06-03 17:20:42 +03003781
Ronald Cron215633c2021-03-16 17:15:37 +01003782 psa_unlock_key_slot( slot );
3783
Gilles Peskineedf9a652018-08-17 18:11:56 +02003784 return( status );
mohammad16035955c982018-04-26 00:53:03 +03003785}
3786
Gilles Peskinee59236f2018-01-27 23:32:46 +01003787/****************************************************************/
Gilles Peskineeab56e42018-07-12 17:12:33 +02003788/* Generators */
3789/****************************************************************/
3790
John Durkop07cc04a2020-11-16 22:08:34 -08003791#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF) || \
3792 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
3793 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
3794#define AT_LEAST_ONE_BUILTIN_KDF
3795#endif
3796
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01003797#define HKDF_STATE_INIT 0 /* no input yet */
3798#define HKDF_STATE_STARTED 1 /* got salt */
3799#define HKDF_STATE_KEYED 2 /* got key */
3800#define HKDF_STATE_OUTPUT 3 /* output started */
3801
Gilles Peskinecbe66502019-05-16 16:59:18 +02003802static psa_algorithm_t psa_key_derivation_get_kdf_alg(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003803 const psa_key_derivation_operation_t *operation )
Gilles Peskine969c5d62019-01-16 15:53:06 +01003804{
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003805 if ( PSA_ALG_IS_KEY_AGREEMENT( operation->alg ) )
3806 return( PSA_ALG_KEY_AGREEMENT_GET_KDF( operation->alg ) );
Gilles Peskine969c5d62019-01-16 15:53:06 +01003807 else
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003808 return( operation->alg );
Gilles Peskine969c5d62019-01-16 15:53:06 +01003809}
3810
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003811psa_status_t psa_key_derivation_abort( psa_key_derivation_operation_t *operation )
Gilles Peskineeab56e42018-07-12 17:12:33 +02003812{
3813 psa_status_t status = PSA_SUCCESS;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003814 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg( operation );
Gilles Peskine969c5d62019-01-16 15:53:06 +01003815 if( kdf_alg == 0 )
Gilles Peskineeab56e42018-07-12 17:12:33 +02003816 {
3817 /* The object has (apparently) been initialized but it is not
3818 * in use. It's ok to call abort on such an object, and there's
3819 * nothing to do. */
3820 }
3821 else
John Durkopd0321952020-10-29 21:37:36 -07003822#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Gilles Peskine969c5d62019-01-16 15:53:06 +01003823 if( PSA_ALG_IS_HKDF( kdf_alg ) )
Gilles Peskinebef7f142018-07-12 17:22:21 +02003824 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003825 mbedtls_free( operation->ctx.hkdf.info );
3826 status = psa_hmac_abort_internal( &operation->ctx.hkdf.hmac );
Gilles Peskinebef7f142018-07-12 17:22:21 +02003827 }
John Durkop07cc04a2020-11-16 22:08:34 -08003828 else
3829#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF */
3830#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
3831 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
3832 if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003833 /* TLS-1.2 PSK-to-MS KDF uses the same core as TLS-1.2 PRF */
Gilles Peskine969c5d62019-01-16 15:53:06 +01003834 PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003835 {
Janos Follath6a1d2622019-06-11 10:37:28 +01003836 if( operation->ctx.tls12_prf.seed != NULL )
3837 {
3838 mbedtls_platform_zeroize( operation->ctx.tls12_prf.seed,
3839 operation->ctx.tls12_prf.seed_length );
3840 mbedtls_free( operation->ctx.tls12_prf.seed );
3841 }
3842
3843 if( operation->ctx.tls12_prf.label != NULL )
3844 {
3845 mbedtls_platform_zeroize( operation->ctx.tls12_prf.label,
3846 operation->ctx.tls12_prf.label_length );
3847 mbedtls_free( operation->ctx.tls12_prf.label );
3848 }
3849
3850 status = psa_hmac_abort_internal( &operation->ctx.tls12_prf.hmac );
3851
3852 /* We leave the fields Ai and output_block to be erased safely by the
3853 * mbedtls_platform_zeroize() in the end of this function. */
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003854 }
Gilles Peskinebef7f142018-07-12 17:22:21 +02003855 else
John Durkop07cc04a2020-11-16 22:08:34 -08003856#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) ||
3857 * defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) */
Gilles Peskineeab56e42018-07-12 17:12:33 +02003858 {
3859 status = PSA_ERROR_BAD_STATE;
3860 }
Janos Follath083036a2019-06-11 10:22:26 +01003861 mbedtls_platform_zeroize( operation, sizeof( *operation ) );
Gilles Peskineeab56e42018-07-12 17:12:33 +02003862 return( status );
3863}
3864
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003865psa_status_t psa_key_derivation_get_capacity(const psa_key_derivation_operation_t *operation,
Gilles Peskineeab56e42018-07-12 17:12:33 +02003866 size_t *capacity)
3867{
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003868 if( operation->alg == 0 )
Jaeden Amerocf2010c2019-02-15 13:05:49 +00003869 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003870 /* This is a blank key derivation operation. */
Steven Cooreman29149862020-08-05 15:43:42 +02003871 return( PSA_ERROR_BAD_STATE );
Jaeden Amerocf2010c2019-02-15 13:05:49 +00003872 }
3873
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003874 *capacity = operation->capacity;
Gilles Peskineeab56e42018-07-12 17:12:33 +02003875 return( PSA_SUCCESS );
3876}
3877
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003878psa_status_t psa_key_derivation_set_capacity( psa_key_derivation_operation_t *operation,
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01003879 size_t capacity )
3880{
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003881 if( operation->alg == 0 )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01003882 return( PSA_ERROR_BAD_STATE );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003883 if( capacity > operation->capacity )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01003884 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003885 operation->capacity = capacity;
Gilles Peskineeab56e42018-07-12 17:12:33 +02003886 return( PSA_SUCCESS );
3887}
3888
John Durkopd0321952020-10-29 21:37:36 -07003889#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003890/* Read some bytes from an HKDF-based operation. This performs a chunk
Gilles Peskinebef7f142018-07-12 17:22:21 +02003891 * of the expand phase of the HKDF algorithm. */
Gilles Peskinecbe66502019-05-16 16:59:18 +02003892static psa_status_t psa_key_derivation_hkdf_read( psa_hkdf_key_derivation_t *hkdf,
Gilles Peskinebef7f142018-07-12 17:22:21 +02003893 psa_algorithm_t hash_alg,
3894 uint8_t *output,
3895 size_t output_length )
3896{
gabor-mezei-armcbcec212020-12-18 14:23:51 +01003897 uint8_t hash_length = PSA_HASH_LENGTH( hash_alg );
Gilles Peskinebef7f142018-07-12 17:22:21 +02003898 psa_status_t status;
3899
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01003900 if( hkdf->state < HKDF_STATE_KEYED || ! hkdf->info_set )
3901 return( PSA_ERROR_BAD_STATE );
3902 hkdf->state = HKDF_STATE_OUTPUT;
3903
Gilles Peskinebef7f142018-07-12 17:22:21 +02003904 while( output_length != 0 )
3905 {
3906 /* Copy what remains of the current block */
3907 uint8_t n = hash_length - hkdf->offset_in_block;
3908 if( n > output_length )
3909 n = (uint8_t) output_length;
3910 memcpy( output, hkdf->output_block + hkdf->offset_in_block, n );
3911 output += n;
3912 output_length -= n;
3913 hkdf->offset_in_block += n;
Gilles Peskined54931c2018-07-17 21:06:59 +02003914 if( output_length == 0 )
Gilles Peskinebef7f142018-07-12 17:22:21 +02003915 break;
Gilles Peskined54931c2018-07-17 21:06:59 +02003916 /* We can't be wanting more output after block 0xff, otherwise
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02003917 * the capacity check in psa_key_derivation_output_bytes() would have
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003918 * prevented this call. It could happen only if the operation
Gilles Peskined54931c2018-07-17 21:06:59 +02003919 * object was corrupted or if this function is called directly
3920 * inside the library. */
3921 if( hkdf->block_number == 0xff )
3922 return( PSA_ERROR_BAD_STATE );
Gilles Peskinebef7f142018-07-12 17:22:21 +02003923
3924 /* We need a new block */
3925 ++hkdf->block_number;
3926 hkdf->offset_in_block = 0;
3927 status = psa_hmac_setup_internal( &hkdf->hmac,
3928 hkdf->prk, hash_length,
3929 hash_alg );
3930 if( status != PSA_SUCCESS )
3931 return( status );
3932 if( hkdf->block_number != 1 )
3933 {
3934 status = psa_hash_update( &hkdf->hmac.hash_ctx,
3935 hkdf->output_block,
3936 hash_length );
3937 if( status != PSA_SUCCESS )
3938 return( status );
3939 }
3940 status = psa_hash_update( &hkdf->hmac.hash_ctx,
3941 hkdf->info,
3942 hkdf->info_length );
3943 if( status != PSA_SUCCESS )
3944 return( status );
3945 status = psa_hash_update( &hkdf->hmac.hash_ctx,
3946 &hkdf->block_number, 1 );
3947 if( status != PSA_SUCCESS )
3948 return( status );
3949 status = psa_hmac_finish_internal( &hkdf->hmac,
3950 hkdf->output_block,
3951 sizeof( hkdf->output_block ) );
3952 if( status != PSA_SUCCESS )
3953 return( status );
3954 }
3955
3956 return( PSA_SUCCESS );
3957}
John Durkop07cc04a2020-11-16 22:08:34 -08003958#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003959
John Durkop07cc04a2020-11-16 22:08:34 -08003960#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
3961 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Janos Follath7742fee2019-06-17 12:58:10 +01003962static psa_status_t psa_key_derivation_tls12_prf_generate_next_block(
3963 psa_tls12_prf_key_derivation_t *tls12_prf,
3964 psa_algorithm_t alg )
3965{
3966 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( alg );
gabor-mezei-armcbcec212020-12-18 14:23:51 +01003967 uint8_t hash_length = PSA_HASH_LENGTH( hash_alg );
Janos Follathea29bfb2019-06-19 12:21:20 +01003968 psa_hash_operation_t backup = PSA_HASH_OPERATION_INIT;
3969 psa_status_t status, cleanup_status;
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003970
Janos Follath7742fee2019-06-17 12:58:10 +01003971 /* We can't be wanting more output after block 0xff, otherwise
3972 * the capacity check in psa_key_derivation_output_bytes() would have
3973 * prevented this call. It could happen only if the operation
3974 * object was corrupted or if this function is called directly
3975 * inside the library. */
3976 if( tls12_prf->block_number == 0xff )
Janos Follath30090bc2019-06-25 10:15:04 +01003977 return( PSA_ERROR_CORRUPTION_DETECTED );
Janos Follath7742fee2019-06-17 12:58:10 +01003978
3979 /* We need a new block */
3980 ++tls12_prf->block_number;
Janos Follath844eb0e2019-06-19 12:10:49 +01003981 tls12_prf->left_in_block = hash_length;
Janos Follath7742fee2019-06-17 12:58:10 +01003982
3983 /* Recall the definition of the TLS-1.2-PRF from RFC 5246:
3984 *
3985 * PRF(secret, label, seed) = P_<hash>(secret, label + seed)
3986 *
3987 * P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
3988 * HMAC_hash(secret, A(2) + seed) +
3989 * HMAC_hash(secret, A(3) + seed) + ...
3990 *
3991 * A(0) = seed
Janos Follathea29bfb2019-06-19 12:21:20 +01003992 * A(i) = HMAC_hash(secret, A(i-1))
Janos Follath7742fee2019-06-17 12:58:10 +01003993 *
Janos Follathea29bfb2019-06-19 12:21:20 +01003994 * The `psa_tls12_prf_key_derivation` structure saves the block
Janos Follath7742fee2019-06-17 12:58:10 +01003995 * `HMAC_hash(secret, A(i) + seed)` from which the output
Janos Follath76c39842019-06-26 12:50:36 +01003996 * is currently extracted as `output_block` and where i is
3997 * `block_number`.
Janos Follath7742fee2019-06-17 12:58:10 +01003998 */
3999
Janos Follathea29bfb2019-06-19 12:21:20 +01004000 /* Save the hash context before using it, to preserve the hash state with
4001 * only the inner padding in it. We need this, because inner padding depends
4002 * on the key (secret in the RFC's terminology). */
4003 status = psa_hash_clone( &tls12_prf->hmac.hash_ctx, &backup );
4004 if( status != PSA_SUCCESS )
4005 goto cleanup;
4006
4007 /* Calculate A(i) where i = tls12_prf->block_number. */
4008 if( tls12_prf->block_number == 1 )
4009 {
4010 /* A(1) = HMAC_hash(secret, A(0)), where A(0) = seed. (The RFC overloads
4011 * the variable seed and in this instance means it in the context of the
4012 * P_hash function, where seed = label + seed.) */
4013 status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
4014 tls12_prf->label, tls12_prf->label_length );
4015 if( status != PSA_SUCCESS )
4016 goto cleanup;
4017 status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
4018 tls12_prf->seed, tls12_prf->seed_length );
4019 if( status != PSA_SUCCESS )
4020 goto cleanup;
4021 }
4022 else
4023 {
4024 /* A(i) = HMAC_hash(secret, A(i-1)) */
4025 status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
4026 tls12_prf->Ai, hash_length );
4027 if( status != PSA_SUCCESS )
4028 goto cleanup;
4029 }
4030
4031 status = psa_hmac_finish_internal( &tls12_prf->hmac,
4032 tls12_prf->Ai, hash_length );
4033 if( status != PSA_SUCCESS )
4034 goto cleanup;
4035 status = psa_hash_clone( &backup, &tls12_prf->hmac.hash_ctx );
4036 if( status != PSA_SUCCESS )
4037 goto cleanup;
4038
4039 /* Calculate HMAC_hash(secret, A(i) + label + seed). */
4040 status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
4041 tls12_prf->Ai, hash_length );
4042 if( status != PSA_SUCCESS )
4043 goto cleanup;
4044 status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
4045 tls12_prf->label, tls12_prf->label_length );
4046 if( status != PSA_SUCCESS )
4047 goto cleanup;
4048 status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
4049 tls12_prf->seed, tls12_prf->seed_length );
4050 if( status != PSA_SUCCESS )
4051 goto cleanup;
4052 status = psa_hmac_finish_internal( &tls12_prf->hmac,
4053 tls12_prf->output_block, hash_length );
4054 if( status != PSA_SUCCESS )
4055 goto cleanup;
4056 status = psa_hash_clone( &backup, &tls12_prf->hmac.hash_ctx );
4057 if( status != PSA_SUCCESS )
4058 goto cleanup;
4059
Janos Follath7742fee2019-06-17 12:58:10 +01004060
4061cleanup:
4062
Janos Follathea29bfb2019-06-19 12:21:20 +01004063 cleanup_status = psa_hash_abort( &backup );
4064 if( status == PSA_SUCCESS && cleanup_status != PSA_SUCCESS )
4065 status = cleanup_status;
4066
4067 return( status );
Janos Follath7742fee2019-06-17 12:58:10 +01004068}
Hanno Beckerc8a41d72018-10-09 17:33:01 +01004069
Janos Follath844eb0e2019-06-19 12:10:49 +01004070static psa_status_t psa_key_derivation_tls12_prf_read(
4071 psa_tls12_prf_key_derivation_t *tls12_prf,
4072 psa_algorithm_t alg,
4073 uint8_t *output,
4074 size_t output_length )
4075{
4076 psa_algorithm_t hash_alg = PSA_ALG_TLS12_PRF_GET_HASH( alg );
gabor-mezei-armcbcec212020-12-18 14:23:51 +01004077 uint8_t hash_length = PSA_HASH_LENGTH( hash_alg );
Janos Follath844eb0e2019-06-19 12:10:49 +01004078 psa_status_t status;
4079 uint8_t offset, length;
4080
4081 while( output_length != 0 )
4082 {
4083 /* Check if we have fully processed the current block. */
4084 if( tls12_prf->left_in_block == 0 )
4085 {
4086 status = psa_key_derivation_tls12_prf_generate_next_block( tls12_prf,
4087 alg );
4088 if( status != PSA_SUCCESS )
4089 return( status );
4090
4091 continue;
4092 }
4093
4094 if( tls12_prf->left_in_block > output_length )
4095 length = (uint8_t) output_length;
4096 else
4097 length = tls12_prf->left_in_block;
4098
4099 offset = hash_length - tls12_prf->left_in_block;
4100 memcpy( output, tls12_prf->output_block + offset, length );
4101 output += length;
4102 output_length -= length;
4103 tls12_prf->left_in_block -= length;
4104 }
4105
4106 return( PSA_SUCCESS );
4107}
John Durkop07cc04a2020-11-16 22:08:34 -08004108#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF ||
4109 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Gilles Peskinebef7f142018-07-12 17:22:21 +02004110
Janos Follath6c6c8fc2019-06-17 12:38:20 +01004111psa_status_t psa_key_derivation_output_bytes(
4112 psa_key_derivation_operation_t *operation,
4113 uint8_t *output,
4114 size_t output_length )
Gilles Peskineeab56e42018-07-12 17:12:33 +02004115{
4116 psa_status_t status;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004117 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg( operation );
Gilles Peskineeab56e42018-07-12 17:12:33 +02004118
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004119 if( operation->alg == 0 )
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004120 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004121 /* This is a blank operation. */
Steven Cooreman29149862020-08-05 15:43:42 +02004122 return( PSA_ERROR_BAD_STATE );
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004123 }
4124
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004125 if( output_length > operation->capacity )
Gilles Peskineeab56e42018-07-12 17:12:33 +02004126 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004127 operation->capacity = 0;
Gilles Peskineeab56e42018-07-12 17:12:33 +02004128 /* Go through the error path to wipe all confidential data now
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004129 * that the operation object is useless. */
David Saadab4ecc272019-02-14 13:48:10 +02004130 status = PSA_ERROR_INSUFFICIENT_DATA;
Gilles Peskineeab56e42018-07-12 17:12:33 +02004131 goto exit;
4132 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004133 if( output_length == 0 && operation->capacity == 0 )
Gilles Peskineeab56e42018-07-12 17:12:33 +02004134 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004135 /* Edge case: this is a finished operation, and 0 bytes
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004136 * were requested. The right error in this case could
Gilles Peskineeab56e42018-07-12 17:12:33 +02004137 * be either INSUFFICIENT_CAPACITY or BAD_STATE. Return
4138 * INSUFFICIENT_CAPACITY, which is right for a finished
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004139 * operation, for consistency with the case when
Gilles Peskineeab56e42018-07-12 17:12:33 +02004140 * output_length > 0. */
David Saadab4ecc272019-02-14 13:48:10 +02004141 return( PSA_ERROR_INSUFFICIENT_DATA );
Gilles Peskineeab56e42018-07-12 17:12:33 +02004142 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004143 operation->capacity -= output_length;
Gilles Peskineeab56e42018-07-12 17:12:33 +02004144
John Durkopd0321952020-10-29 21:37:36 -07004145#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Gilles Peskine969c5d62019-01-16 15:53:06 +01004146 if( PSA_ALG_IS_HKDF( kdf_alg ) )
Gilles Peskinebef7f142018-07-12 17:22:21 +02004147 {
Gilles Peskine969c5d62019-01-16 15:53:06 +01004148 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( kdf_alg );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004149 status = psa_key_derivation_hkdf_read( &operation->ctx.hkdf, hash_alg,
Gilles Peskinebef7f142018-07-12 17:22:21 +02004150 output, output_length );
4151 }
Janos Follathadbec812019-06-14 11:05:39 +01004152 else
John Durkop07cc04a2020-11-16 22:08:34 -08004153#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */
4154#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
4155 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Janos Follathadbec812019-06-14 11:05:39 +01004156 if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
John Durkop07cc04a2020-11-16 22:08:34 -08004157 PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Hanno Beckerc8a41d72018-10-09 17:33:01 +01004158 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004159 status = psa_key_derivation_tls12_prf_read( &operation->ctx.tls12_prf,
Gilles Peskine969c5d62019-01-16 15:53:06 +01004160 kdf_alg, output,
Hanno Beckerc8a41d72018-10-09 17:33:01 +01004161 output_length );
4162 }
Gilles Peskinebef7f142018-07-12 17:22:21 +02004163 else
John Durkop07cc04a2020-11-16 22:08:34 -08004164#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF ||
4165 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Gilles Peskineeab56e42018-07-12 17:12:33 +02004166 {
Steven Cooreman74afe472021-02-10 17:19:22 +01004167 (void) kdf_alg;
Gilles Peskineeab56e42018-07-12 17:12:33 +02004168 return( PSA_ERROR_BAD_STATE );
4169 }
4170
4171exit:
4172 if( status != PSA_SUCCESS )
4173 {
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004174 /* Preserve the algorithm upon errors, but clear all sensitive state.
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004175 * This allows us to differentiate between exhausted operations and
4176 * blank operations, so we can return PSA_ERROR_BAD_STATE on blank
4177 * operations. */
4178 psa_algorithm_t alg = operation->alg;
4179 psa_key_derivation_abort( operation );
4180 operation->alg = alg;
Gilles Peskineeab56e42018-07-12 17:12:33 +02004181 memset( output, '!', output_length );
4182 }
4183 return( status );
4184}
4185
David Brown7807bf72021-02-09 16:28:23 -07004186#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Gilles Peskine08542d82018-07-19 17:05:42 +02004187static void psa_des_set_key_parity( uint8_t *data, size_t data_size )
4188{
4189 if( data_size >= 8 )
4190 mbedtls_des_key_set_parity( data );
4191 if( data_size >= 16 )
4192 mbedtls_des_key_set_parity( data + 8 );
4193 if( data_size >= 24 )
4194 mbedtls_des_key_set_parity( data + 16 );
4195}
David Brown7807bf72021-02-09 16:28:23 -07004196#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */
Gilles Peskine08542d82018-07-19 17:05:42 +02004197
Adrian L. Shaw5a5a79a2019-05-03 15:44:28 +01004198static psa_status_t psa_generate_derived_key_internal(
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004199 psa_key_slot_t *slot,
4200 size_t bits,
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004201 psa_key_derivation_operation_t *operation )
Gilles Peskineeab56e42018-07-12 17:12:33 +02004202{
4203 uint8_t *data = NULL;
4204 size_t bytes = PSA_BITS_TO_BYTES( bits );
4205 psa_status_t status;
4206
Gilles Peskine8e338702019-07-30 20:06:31 +02004207 if( ! key_type_is_raw_bytes( slot->attr.type ) )
Gilles Peskineeab56e42018-07-12 17:12:33 +02004208 return( PSA_ERROR_INVALID_ARGUMENT );
4209 if( bits % 8 != 0 )
4210 return( PSA_ERROR_INVALID_ARGUMENT );
4211 data = mbedtls_calloc( 1, bytes );
4212 if( data == NULL )
4213 return( PSA_ERROR_INSUFFICIENT_MEMORY );
4214
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004215 status = psa_key_derivation_output_bytes( operation, data, bytes );
Gilles Peskineeab56e42018-07-12 17:12:33 +02004216 if( status != PSA_SUCCESS )
4217 goto exit;
David Brown12ca5032021-02-11 11:02:00 -07004218#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Gilles Peskine8e338702019-07-30 20:06:31 +02004219 if( slot->attr.type == PSA_KEY_TYPE_DES )
Gilles Peskine08542d82018-07-19 17:05:42 +02004220 psa_des_set_key_parity( data, bytes );
David Brown8107e312021-02-12 08:08:46 -07004221#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */
Ronald Crondd04d422020-11-28 15:14:42 +01004222
4223 status = psa_allocate_buffer_to_slot( slot, bytes );
4224 if( status != PSA_SUCCESS )
Paul Elliottda3e7db2021-02-09 18:58:20 +00004225 goto exit;
Ronald Crondd04d422020-11-28 15:14:42 +01004226
Ronald Cronbf33c932020-11-28 18:06:53 +01004227 slot->attr.bits = (psa_key_bits_t) bits;
Ronald Cron2ebfdcc2020-11-28 15:54:54 +01004228 psa_key_attributes_t attributes = {
4229 .core = slot->attr
4230 };
4231
Ronald Cronbf33c932020-11-28 18:06:53 +01004232 status = psa_driver_wrapper_import_key( &attributes,
4233 data, bytes,
4234 slot->key.data,
4235 slot->key.bytes,
4236 &slot->key.bytes, &bits );
4237 if( bits != slot->attr.bits )
4238 status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskineeab56e42018-07-12 17:12:33 +02004239
4240exit:
4241 mbedtls_free( data );
4242 return( status );
4243}
4244
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02004245psa_status_t psa_key_derivation_output_key( const psa_key_attributes_t *attributes,
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004246 psa_key_derivation_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02004247 mbedtls_svc_key_id_t *key )
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004248{
4249 psa_status_t status;
4250 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02004251 psa_se_drv_table_entry_t *driver = NULL;
Gilles Peskine0f84d622019-09-12 19:03:13 +02004252
Ronald Cron81709fc2020-11-14 12:10:32 +01004253 *key = MBEDTLS_SVC_KEY_ID_INIT;
4254
Gilles Peskine0f84d622019-09-12 19:03:13 +02004255 /* Reject any attempt to create a zero-length key so that we don't
4256 * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
4257 if( psa_get_key_bits( attributes ) == 0 )
4258 return( PSA_ERROR_INVALID_ARGUMENT );
4259
Gilles Peskine178c9aa2019-09-24 18:21:06 +02004260 if( ! operation->can_output_key )
4261 return( PSA_ERROR_NOT_PERMITTED );
4262
Ronald Cron81709fc2020-11-14 12:10:32 +01004263 status = psa_start_key_creation( PSA_KEY_CREATION_DERIVE, attributes,
4264 &slot, &driver );
Gilles Peskinef4ee6622019-07-24 13:44:30 +02004265#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
4266 if( driver != NULL )
4267 {
4268 /* Deriving a key in a secure element is not implemented yet. */
4269 status = PSA_ERROR_NOT_SUPPORTED;
4270 }
4271#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004272 if( status == PSA_SUCCESS )
4273 {
Adrian L. Shaw5a5a79a2019-05-03 15:44:28 +01004274 status = psa_generate_derived_key_internal( slot,
Gilles Peskine7e0cff92019-07-30 13:48:52 +02004275 attributes->core.bits,
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004276 operation );
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004277 }
4278 if( status == PSA_SUCCESS )
Ronald Cron81709fc2020-11-14 12:10:32 +01004279 status = psa_finish_key_creation( slot, driver, key );
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004280 if( status != PSA_SUCCESS )
Gilles Peskine011e4282019-06-26 18:34:38 +02004281 psa_fail_key_creation( slot, driver );
Ronald Cronf95a2b12020-10-22 15:24:49 +02004282
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004283 return( status );
4284}
4285
Gilles Peskineeab56e42018-07-12 17:12:33 +02004286
4287
4288/****************************************************************/
Gilles Peskineea0fb492018-07-12 17:17:20 +02004289/* Key derivation */
4290/****************************************************************/
4291
Steven Cooreman932ffb72021-02-15 12:14:32 +01004292#if defined(AT_LEAST_ONE_BUILTIN_KDF)
Gilles Peskine969c5d62019-01-16 15:53:06 +01004293static psa_status_t psa_key_derivation_setup_kdf(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004294 psa_key_derivation_operation_t *operation,
Gilles Peskine969c5d62019-01-16 15:53:06 +01004295 psa_algorithm_t kdf_alg )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004296{
John Durkop07cc04a2020-11-16 22:08:34 -08004297 int is_kdf_alg_supported;
4298
Janos Follath5fe19732019-06-20 15:09:30 +01004299 /* Make sure that operation->ctx is properly zero-initialised. (Macro
4300 * initialisers for this union leave some bytes unspecified.) */
4301 memset( &operation->ctx, 0, sizeof( operation->ctx ) );
4302
Gilles Peskine969c5d62019-01-16 15:53:06 +01004303 /* Make sure that kdf_alg is a supported key derivation algorithm. */
John Durkopd0321952020-10-29 21:37:36 -07004304#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
John Durkop07cc04a2020-11-16 22:08:34 -08004305 if( PSA_ALG_IS_HKDF( kdf_alg ) )
4306 is_kdf_alg_supported = 1;
4307 else
4308#endif
4309#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF)
4310 if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) )
4311 is_kdf_alg_supported = 1;
4312 else
4313#endif
4314#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
4315 if( PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
4316 is_kdf_alg_supported = 1;
4317 else
4318#endif
4319 is_kdf_alg_supported = 0;
4320
4321 if( is_kdf_alg_supported )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004322 {
Gilles Peskine969c5d62019-01-16 15:53:06 +01004323 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( kdf_alg );
gabor-mezei-armcbcec212020-12-18 14:23:51 +01004324 size_t hash_size = PSA_HASH_LENGTH( hash_alg );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004325 if( hash_size == 0 )
4326 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine969c5d62019-01-16 15:53:06 +01004327 if( ( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
4328 PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) ) &&
Gilles Peskineab4b2012019-04-12 15:06:27 +02004329 ! ( hash_alg == PSA_ALG_SHA_256 || hash_alg == PSA_ALG_SHA_384 ) )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004330 {
4331 return( PSA_ERROR_NOT_SUPPORTED );
4332 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004333 operation->capacity = 255 * hash_size;
Gilles Peskine969c5d62019-01-16 15:53:06 +01004334 return( PSA_SUCCESS );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004335 }
John Durkop07cc04a2020-11-16 22:08:34 -08004336
4337 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine969c5d62019-01-16 15:53:06 +01004338}
John Durkop07cc04a2020-11-16 22:08:34 -08004339#endif /* AT_LEAST_ONE_BUILTIN_KDF */
Gilles Peskine969c5d62019-01-16 15:53:06 +01004340
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004341psa_status_t psa_key_derivation_setup( psa_key_derivation_operation_t *operation,
Gilles Peskine969c5d62019-01-16 15:53:06 +01004342 psa_algorithm_t alg )
4343{
4344 psa_status_t status;
4345
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004346 if( operation->alg != 0 )
Gilles Peskine969c5d62019-01-16 15:53:06 +01004347 return( PSA_ERROR_BAD_STATE );
4348
Gilles Peskine6843c292019-01-18 16:44:49 +01004349 if( PSA_ALG_IS_RAW_KEY_AGREEMENT( alg ) )
4350 return( PSA_ERROR_INVALID_ARGUMENT );
4351 else if( PSA_ALG_IS_KEY_AGREEMENT( alg ) )
Gilles Peskine969c5d62019-01-16 15:53:06 +01004352 {
Steven Cooreman932ffb72021-02-15 12:14:32 +01004353#if defined(AT_LEAST_ONE_BUILTIN_KDF)
Gilles Peskine969c5d62019-01-16 15:53:06 +01004354 psa_algorithm_t kdf_alg = PSA_ALG_KEY_AGREEMENT_GET_KDF( alg );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004355 status = psa_key_derivation_setup_kdf( operation, kdf_alg );
Steven Cooreman932ffb72021-02-15 12:14:32 +01004356#else
4357 return( PSA_ERROR_NOT_SUPPORTED );
4358#endif /* AT_LEAST_ONE_BUILTIN_KDF */
Gilles Peskine969c5d62019-01-16 15:53:06 +01004359 }
4360 else if( PSA_ALG_IS_KEY_DERIVATION( alg ) )
4361 {
Steven Cooreman932ffb72021-02-15 12:14:32 +01004362#if defined(AT_LEAST_ONE_BUILTIN_KDF)
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004363 status = psa_key_derivation_setup_kdf( operation, alg );
Steven Cooreman932ffb72021-02-15 12:14:32 +01004364#else
4365 return( PSA_ERROR_NOT_SUPPORTED );
4366#endif /* AT_LEAST_ONE_BUILTIN_KDF */
Gilles Peskine969c5d62019-01-16 15:53:06 +01004367 }
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004368 else
4369 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine969c5d62019-01-16 15:53:06 +01004370
4371 if( status == PSA_SUCCESS )
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004372 operation->alg = alg;
Gilles Peskine969c5d62019-01-16 15:53:06 +01004373 return( status );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004374}
4375
John Durkopd0321952020-10-29 21:37:36 -07004376#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Gilles Peskinecbe66502019-05-16 16:59:18 +02004377static psa_status_t psa_hkdf_input( psa_hkdf_key_derivation_t *hkdf,
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004378 psa_algorithm_t hash_alg,
4379 psa_key_derivation_step_t step,
4380 const uint8_t *data,
4381 size_t data_length )
4382{
4383 psa_status_t status;
4384 switch( step )
4385 {
Gilles Peskine03410b52019-05-16 16:05:19 +02004386 case PSA_KEY_DERIVATION_INPUT_SALT:
Gilles Peskine2b522db2019-04-12 15:11:49 +02004387 if( hkdf->state != HKDF_STATE_INIT )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004388 return( PSA_ERROR_BAD_STATE );
Gilles Peskine2b522db2019-04-12 15:11:49 +02004389 status = psa_hmac_setup_internal( &hkdf->hmac,
4390 data, data_length,
4391 hash_alg );
4392 if( status != PSA_SUCCESS )
4393 return( status );
4394 hkdf->state = HKDF_STATE_STARTED;
4395 return( PSA_SUCCESS );
Gilles Peskine03410b52019-05-16 16:05:19 +02004396 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004397 /* If no salt was provided, use an empty salt. */
4398 if( hkdf->state == HKDF_STATE_INIT )
4399 {
4400 status = psa_hmac_setup_internal( &hkdf->hmac,
4401 NULL, 0,
Gilles Peskinef9ee6332019-04-11 21:22:52 +02004402 hash_alg );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004403 if( status != PSA_SUCCESS )
4404 return( status );
4405 hkdf->state = HKDF_STATE_STARTED;
4406 }
Gilles Peskine2b522db2019-04-12 15:11:49 +02004407 if( hkdf->state != HKDF_STATE_STARTED )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004408 return( PSA_ERROR_BAD_STATE );
Gilles Peskine2b522db2019-04-12 15:11:49 +02004409 status = psa_hash_update( &hkdf->hmac.hash_ctx,
4410 data, data_length );
4411 if( status != PSA_SUCCESS )
4412 return( status );
4413 status = psa_hmac_finish_internal( &hkdf->hmac,
4414 hkdf->prk,
4415 sizeof( hkdf->prk ) );
4416 if( status != PSA_SUCCESS )
4417 return( status );
gabor-mezei-armcbcec212020-12-18 14:23:51 +01004418 hkdf->offset_in_block = PSA_HASH_LENGTH( hash_alg );
Gilles Peskine2b522db2019-04-12 15:11:49 +02004419 hkdf->block_number = 0;
4420 hkdf->state = HKDF_STATE_KEYED;
4421 return( PSA_SUCCESS );
Gilles Peskine03410b52019-05-16 16:05:19 +02004422 case PSA_KEY_DERIVATION_INPUT_INFO:
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004423 if( hkdf->state == HKDF_STATE_OUTPUT )
4424 return( PSA_ERROR_BAD_STATE );
4425 if( hkdf->info_set )
4426 return( PSA_ERROR_BAD_STATE );
4427 hkdf->info_length = data_length;
4428 if( data_length != 0 )
4429 {
4430 hkdf->info = mbedtls_calloc( 1, data_length );
4431 if( hkdf->info == NULL )
4432 return( PSA_ERROR_INSUFFICIENT_MEMORY );
4433 memcpy( hkdf->info, data, data_length );
4434 }
4435 hkdf->info_set = 1;
4436 return( PSA_SUCCESS );
4437 default:
4438 return( PSA_ERROR_INVALID_ARGUMENT );
4439 }
4440}
John Durkop07cc04a2020-11-16 22:08:34 -08004441#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */
Janos Follathb03233e2019-06-11 15:30:30 +01004442
John Durkop07cc04a2020-11-16 22:08:34 -08004443#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
4444 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Janos Follathf08e2652019-06-13 09:05:41 +01004445static psa_status_t psa_tls12_prf_set_seed( psa_tls12_prf_key_derivation_t *prf,
4446 const uint8_t *data,
4447 size_t data_length )
4448{
Gilles Peskine43f958b2020-12-13 14:55:14 +01004449 if( prf->state != PSA_TLS12_PRF_STATE_INIT )
Janos Follathf08e2652019-06-13 09:05:41 +01004450 return( PSA_ERROR_BAD_STATE );
4451
Janos Follathd6dce9f2019-07-04 09:11:38 +01004452 if( data_length != 0 )
4453 {
4454 prf->seed = mbedtls_calloc( 1, data_length );
4455 if( prf->seed == NULL )
4456 return( PSA_ERROR_INSUFFICIENT_MEMORY );
Janos Follathf08e2652019-06-13 09:05:41 +01004457
Janos Follathd6dce9f2019-07-04 09:11:38 +01004458 memcpy( prf->seed, data, data_length );
4459 prf->seed_length = data_length;
4460 }
Janos Follathf08e2652019-06-13 09:05:41 +01004461
Gilles Peskine43f958b2020-12-13 14:55:14 +01004462 prf->state = PSA_TLS12_PRF_STATE_SEED_SET;
Janos Follathf08e2652019-06-13 09:05:41 +01004463
4464 return( PSA_SUCCESS );
4465}
4466
Janos Follath81550542019-06-13 14:26:34 +01004467static psa_status_t psa_tls12_prf_set_key( psa_tls12_prf_key_derivation_t *prf,
4468 psa_algorithm_t hash_alg,
4469 const uint8_t *data,
4470 size_t data_length )
4471{
4472 psa_status_t status;
Gilles Peskine43f958b2020-12-13 14:55:14 +01004473 if( prf->state != PSA_TLS12_PRF_STATE_SEED_SET )
Janos Follath81550542019-06-13 14:26:34 +01004474 return( PSA_ERROR_BAD_STATE );
4475
4476 status = psa_hmac_setup_internal( &prf->hmac, data, data_length, hash_alg );
4477 if( status != PSA_SUCCESS )
4478 return( status );
4479
Gilles Peskine43f958b2020-12-13 14:55:14 +01004480 prf->state = PSA_TLS12_PRF_STATE_KEY_SET;
Janos Follath81550542019-06-13 14:26:34 +01004481
4482 return( PSA_SUCCESS );
4483}
4484
Janos Follath63028dd2019-06-13 09:15:47 +01004485static psa_status_t psa_tls12_prf_set_label( psa_tls12_prf_key_derivation_t *prf,
4486 const uint8_t *data,
4487 size_t data_length )
4488{
Gilles Peskine43f958b2020-12-13 14:55:14 +01004489 if( prf->state != PSA_TLS12_PRF_STATE_KEY_SET )
Janos Follath63028dd2019-06-13 09:15:47 +01004490 return( PSA_ERROR_BAD_STATE );
4491
Janos Follathd6dce9f2019-07-04 09:11:38 +01004492 if( data_length != 0 )
4493 {
4494 prf->label = mbedtls_calloc( 1, data_length );
4495 if( prf->label == NULL )
4496 return( PSA_ERROR_INSUFFICIENT_MEMORY );
Janos Follath63028dd2019-06-13 09:15:47 +01004497
Janos Follathd6dce9f2019-07-04 09:11:38 +01004498 memcpy( prf->label, data, data_length );
4499 prf->label_length = data_length;
4500 }
Janos Follath63028dd2019-06-13 09:15:47 +01004501
Gilles Peskine43f958b2020-12-13 14:55:14 +01004502 prf->state = PSA_TLS12_PRF_STATE_LABEL_SET;
Janos Follath63028dd2019-06-13 09:15:47 +01004503
4504 return( PSA_SUCCESS );
4505}
4506
Janos Follathb03233e2019-06-11 15:30:30 +01004507static psa_status_t psa_tls12_prf_input( psa_tls12_prf_key_derivation_t *prf,
4508 psa_algorithm_t hash_alg,
4509 psa_key_derivation_step_t step,
4510 const uint8_t *data,
4511 size_t data_length )
4512{
Janos Follathb03233e2019-06-11 15:30:30 +01004513 switch( step )
4514 {
Janos Follathf08e2652019-06-13 09:05:41 +01004515 case PSA_KEY_DERIVATION_INPUT_SEED:
4516 return( psa_tls12_prf_set_seed( prf, data, data_length ) );
Janos Follath81550542019-06-13 14:26:34 +01004517 case PSA_KEY_DERIVATION_INPUT_SECRET:
4518 return( psa_tls12_prf_set_key( prf, hash_alg, data, data_length ) );
Janos Follath63028dd2019-06-13 09:15:47 +01004519 case PSA_KEY_DERIVATION_INPUT_LABEL:
4520 return( psa_tls12_prf_set_label( prf, data, data_length ) );
Janos Follathb03233e2019-06-11 15:30:30 +01004521 default:
4522 return( PSA_ERROR_INVALID_ARGUMENT );
4523 }
4524}
John Durkop07cc04a2020-11-16 22:08:34 -08004525#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) ||
4526 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
4527
4528#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
4529static psa_status_t psa_tls12_prf_psk_to_ms_set_key(
4530 psa_tls12_prf_key_derivation_t *prf,
4531 psa_algorithm_t hash_alg,
4532 const uint8_t *data,
4533 size_t data_length )
4534{
4535 psa_status_t status;
gabor-mezei-armcbcec212020-12-18 14:23:51 +01004536 uint8_t pms[ 4 + 2 * PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE ];
John Durkop07cc04a2020-11-16 22:08:34 -08004537 uint8_t *cur = pms;
4538
gabor-mezei-armcbcec212020-12-18 14:23:51 +01004539 if( data_length > PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE )
John Durkop07cc04a2020-11-16 22:08:34 -08004540 return( PSA_ERROR_INVALID_ARGUMENT );
4541
4542 /* Quoting RFC 4279, Section 2:
4543 *
4544 * The premaster secret is formed as follows: if the PSK is N octets
4545 * long, concatenate a uint16 with the value N, N zero octets, a second
4546 * uint16 with the value N, and the PSK itself.
4547 */
4548
4549 *cur++ = ( data_length >> 8 ) & 0xff;
4550 *cur++ = ( data_length >> 0 ) & 0xff;
4551 memset( cur, 0, data_length );
4552 cur += data_length;
4553 *cur++ = pms[0];
4554 *cur++ = pms[1];
4555 memcpy( cur, data, data_length );
4556 cur += data_length;
4557
4558 status = psa_tls12_prf_set_key( prf, hash_alg, pms, cur - pms );
4559
4560 mbedtls_platform_zeroize( pms, sizeof( pms ) );
4561 return( status );
4562}
Janos Follath6660f0e2019-06-17 08:44:03 +01004563
4564static psa_status_t psa_tls12_prf_psk_to_ms_input(
4565 psa_tls12_prf_key_derivation_t *prf,
4566 psa_algorithm_t hash_alg,
4567 psa_key_derivation_step_t step,
4568 const uint8_t *data,
4569 size_t data_length )
4570{
4571 if( step == PSA_KEY_DERIVATION_INPUT_SECRET )
Janos Follath0c1ed842019-06-28 13:35:36 +01004572 {
Janos Follath6660f0e2019-06-17 08:44:03 +01004573 return( psa_tls12_prf_psk_to_ms_set_key( prf, hash_alg,
4574 data, data_length ) );
Janos Follath0c1ed842019-06-28 13:35:36 +01004575 }
Janos Follath6660f0e2019-06-17 08:44:03 +01004576
4577 return( psa_tls12_prf_input( prf, hash_alg, step, data, data_length ) );
4578}
John Durkop07cc04a2020-11-16 22:08:34 -08004579#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004580
Gilles Peskineb8965192019-09-24 16:21:10 +02004581/** Check whether the given key type is acceptable for the given
4582 * input step of a key derivation.
4583 *
4584 * Secret inputs must have the type #PSA_KEY_TYPE_DERIVE.
4585 * Non-secret inputs must have the type #PSA_KEY_TYPE_RAW_DATA.
4586 * Both secret and non-secret inputs can alternatively have the type
4587 * #PSA_KEY_TYPE_NONE, which is never the type of a key object, meaning
4588 * that the input was passed as a buffer rather than via a key object.
4589 */
Gilles Peskine224b0d62019-09-23 18:13:17 +02004590static int psa_key_derivation_check_input_type(
4591 psa_key_derivation_step_t step,
4592 psa_key_type_t key_type )
4593{
4594 switch( step )
4595 {
4596 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskineb8965192019-09-24 16:21:10 +02004597 if( key_type == PSA_KEY_TYPE_DERIVE )
4598 return( PSA_SUCCESS );
4599 if( key_type == PSA_KEY_TYPE_NONE )
Gilles Peskine224b0d62019-09-23 18:13:17 +02004600 return( PSA_SUCCESS );
4601 break;
4602 case PSA_KEY_DERIVATION_INPUT_LABEL:
4603 case PSA_KEY_DERIVATION_INPUT_SALT:
4604 case PSA_KEY_DERIVATION_INPUT_INFO:
4605 case PSA_KEY_DERIVATION_INPUT_SEED:
Gilles Peskineb8965192019-09-24 16:21:10 +02004606 if( key_type == PSA_KEY_TYPE_RAW_DATA )
4607 return( PSA_SUCCESS );
4608 if( key_type == PSA_KEY_TYPE_NONE )
Gilles Peskine224b0d62019-09-23 18:13:17 +02004609 return( PSA_SUCCESS );
4610 break;
4611 }
4612 return( PSA_ERROR_INVALID_ARGUMENT );
4613}
4614
Janos Follathb80a94e2019-06-12 15:54:46 +01004615static psa_status_t psa_key_derivation_input_internal(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004616 psa_key_derivation_operation_t *operation,
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01004617 psa_key_derivation_step_t step,
Gilles Peskine224b0d62019-09-23 18:13:17 +02004618 psa_key_type_t key_type,
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01004619 const uint8_t *data,
4620 size_t data_length )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004621{
Gilles Peskine46d7faf2019-09-23 19:22:55 +02004622 psa_status_t status;
4623 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg( operation );
4624
4625 status = psa_key_derivation_check_input_type( step, key_type );
Gilles Peskine224b0d62019-09-23 18:13:17 +02004626 if( status != PSA_SUCCESS )
4627 goto exit;
4628
John Durkopd0321952020-10-29 21:37:36 -07004629#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Gilles Peskine969c5d62019-01-16 15:53:06 +01004630 if( PSA_ALG_IS_HKDF( kdf_alg ) )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004631 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004632 status = psa_hkdf_input( &operation->ctx.hkdf,
Gilles Peskine969c5d62019-01-16 15:53:06 +01004633 PSA_ALG_HKDF_GET_HASH( kdf_alg ),
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004634 step, data, data_length );
4635 }
John Durkop07cc04a2020-11-16 22:08:34 -08004636 else
4637#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */
4638#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF)
4639 if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004640 {
Janos Follathb03233e2019-06-11 15:30:30 +01004641 status = psa_tls12_prf_input( &operation->ctx.tls12_prf,
4642 PSA_ALG_HKDF_GET_HASH( kdf_alg ),
4643 step, data, data_length );
Janos Follath6660f0e2019-06-17 08:44:03 +01004644 }
John Durkop07cc04a2020-11-16 22:08:34 -08004645 else
4646#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF */
4647#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
4648 if( PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Janos Follath6660f0e2019-06-17 08:44:03 +01004649 {
4650 status = psa_tls12_prf_psk_to_ms_input( &operation->ctx.tls12_prf,
4651 PSA_ALG_HKDF_GET_HASH( kdf_alg ),
4652 step, data, data_length );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004653 }
4654 else
John Durkop07cc04a2020-11-16 22:08:34 -08004655#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004656 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004657 /* This can't happen unless the operation object was not initialized */
Steven Cooreman74afe472021-02-10 17:19:22 +01004658 (void) data;
4659 (void) data_length;
4660 (void) kdf_alg;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004661 return( PSA_ERROR_BAD_STATE );
4662 }
4663
Gilles Peskine224b0d62019-09-23 18:13:17 +02004664exit:
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004665 if( status != PSA_SUCCESS )
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004666 psa_key_derivation_abort( operation );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004667 return( status );
4668}
4669
Janos Follath51f4a0f2019-06-14 11:35:55 +01004670psa_status_t psa_key_derivation_input_bytes(
4671 psa_key_derivation_operation_t *operation,
4672 psa_key_derivation_step_t step,
4673 const uint8_t *data,
4674 size_t data_length )
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01004675{
Gilles Peskineb8965192019-09-24 16:21:10 +02004676 return( psa_key_derivation_input_internal( operation, step,
4677 PSA_KEY_TYPE_NONE,
Janos Follathc5621512019-06-14 11:27:57 +01004678 data, data_length ) );
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01004679}
4680
Janos Follath51f4a0f2019-06-14 11:35:55 +01004681psa_status_t psa_key_derivation_input_key(
4682 psa_key_derivation_operation_t *operation,
4683 psa_key_derivation_step_t step,
Ronald Croncf56a0a2020-08-04 09:51:30 +02004684 mbedtls_svc_key_id_t key )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004685{
Ronald Cronf95a2b12020-10-22 15:24:49 +02004686 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01004687 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004688 psa_key_slot_t *slot;
Gilles Peskine178c9aa2019-09-24 18:21:06 +02004689
Ronald Cron5c522922020-11-14 16:35:34 +01004690 status = psa_get_and_lock_transparent_key_slot_with_policy(
4691 key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004692 if( status != PSA_SUCCESS )
Gilles Peskine593773d2019-09-23 18:17:40 +02004693 {
4694 psa_key_derivation_abort( operation );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004695 return( status );
Gilles Peskine593773d2019-09-23 18:17:40 +02004696 }
Gilles Peskine178c9aa2019-09-24 18:21:06 +02004697
4698 /* Passing a key object as a SECRET input unlocks the permission
4699 * to output to a key object. */
4700 if( step == PSA_KEY_DERIVATION_INPUT_SECRET )
4701 operation->can_output_key = 1;
4702
Ronald Cronf95a2b12020-10-22 15:24:49 +02004703 status = psa_key_derivation_input_internal( operation,
4704 step, slot->attr.type,
Ronald Cronea0f8a62020-11-25 17:52:23 +01004705 slot->key.data,
4706 slot->key.bytes );
Ronald Cronf95a2b12020-10-22 15:24:49 +02004707
Ronald Cron5c522922020-11-14 16:35:34 +01004708 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02004709
Ronald Cron5c522922020-11-14 16:35:34 +01004710 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004711}
Gilles Peskineea0fb492018-07-12 17:17:20 +02004712
4713
4714
4715/****************************************************************/
Gilles Peskine01d718c2018-09-18 12:01:02 +02004716/* Key agreement */
4717/****************************************************************/
4718
John Durkop6ba40d12020-11-10 08:50:04 -08004719#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004720static psa_status_t psa_key_agreement_ecdh( const uint8_t *peer_key,
4721 size_t peer_key_length,
4722 const mbedtls_ecp_keypair *our_key,
4723 uint8_t *shared_secret,
4724 size_t shared_secret_size,
4725 size_t *shared_secret_length )
4726{
Steven Cooremand4867872020-08-05 16:31:39 +02004727 mbedtls_ecp_keypair *their_key = NULL;
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004728 mbedtls_ecdh_context ecdh;
Jaeden Amero97271b32019-01-10 19:38:51 +00004729 psa_status_t status;
Gilles Peskinec7ef5b32019-12-12 16:58:00 +01004730 size_t bits = 0;
Paul Elliott8ff510a2020-06-02 17:19:28 +01004731 psa_ecc_family_t curve = mbedtls_ecc_group_to_psa( our_key->grp.id, &bits );
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004732 mbedtls_ecdh_init( &ecdh );
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004733
Ronald Cron90857082020-11-25 14:58:33 +01004734 status = mbedtls_psa_ecp_load_representation(
4735 PSA_KEY_TYPE_ECC_PUBLIC_KEY(curve),
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +01004736 bits,
Ronald Cron90857082020-11-25 14:58:33 +01004737 peer_key,
4738 peer_key_length,
4739 &their_key );
Jaeden Amero97271b32019-01-10 19:38:51 +00004740 if( status != PSA_SUCCESS )
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004741 goto exit;
4742
Jaeden Amero97271b32019-01-10 19:38:51 +00004743 status = mbedtls_to_psa_error(
Steven Cooremana2371e52020-07-28 14:30:39 +02004744 mbedtls_ecdh_get_params( &ecdh, their_key, MBEDTLS_ECDH_THEIRS ) );
Jaeden Amero97271b32019-01-10 19:38:51 +00004745 if( status != PSA_SUCCESS )
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004746 goto exit;
Jaeden Amero97271b32019-01-10 19:38:51 +00004747 status = mbedtls_to_psa_error(
4748 mbedtls_ecdh_get_params( &ecdh, our_key, MBEDTLS_ECDH_OURS ) );
4749 if( status != PSA_SUCCESS )
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004750 goto exit;
4751
Jaeden Amero97271b32019-01-10 19:38:51 +00004752 status = mbedtls_to_psa_error(
4753 mbedtls_ecdh_calc_secret( &ecdh,
4754 shared_secret_length,
4755 shared_secret, shared_secret_size,
Gilles Peskine30524eb2020-11-13 17:02:26 +01004756 mbedtls_psa_get_random,
Gilles Peskine5894e8e2020-12-14 14:54:06 +01004757 MBEDTLS_PSA_RANDOM_STATE ) );
Gilles Peskinec7ef5b32019-12-12 16:58:00 +01004758 if( status != PSA_SUCCESS )
4759 goto exit;
4760 if( PSA_BITS_TO_BYTES( bits ) != *shared_secret_length )
4761 status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004762
4763exit:
Gilles Peskine3e819b72019-12-20 14:09:55 +01004764 if( status != PSA_SUCCESS )
4765 mbedtls_platform_zeroize( shared_secret, shared_secret_size );
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004766 mbedtls_ecdh_free( &ecdh );
Steven Cooremana2371e52020-07-28 14:30:39 +02004767 mbedtls_ecp_keypair_free( their_key );
Steven Cooreman6d839f02020-07-30 11:36:45 +02004768 mbedtls_free( their_key );
Steven Cooremana2371e52020-07-28 14:30:39 +02004769
Jaeden Amero97271b32019-01-10 19:38:51 +00004770 return( status );
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004771}
John Durkop6ba40d12020-11-10 08:50:04 -08004772#endif /* MBEDTLS_PSA_BUILTIN_ALG_ECDH */
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004773
Gilles Peskine01d718c2018-09-18 12:01:02 +02004774#define PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE MBEDTLS_ECP_MAX_BYTES
4775
Gilles Peskine0216fe12019-04-11 21:23:21 +02004776static psa_status_t psa_key_agreement_raw_internal( psa_algorithm_t alg,
4777 psa_key_slot_t *private_key,
4778 const uint8_t *peer_key,
4779 size_t peer_key_length,
4780 uint8_t *shared_secret,
4781 size_t shared_secret_size,
4782 size_t *shared_secret_length )
Gilles Peskine01d718c2018-09-18 12:01:02 +02004783{
Gilles Peskine0216fe12019-04-11 21:23:21 +02004784 switch( alg )
Gilles Peskine01d718c2018-09-18 12:01:02 +02004785 {
John Durkop6ba40d12020-11-10 08:50:04 -08004786#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
Gilles Peskine0216fe12019-04-11 21:23:21 +02004787 case PSA_ALG_ECDH:
Gilles Peskine8e338702019-07-30 20:06:31 +02004788 if( ! PSA_KEY_TYPE_IS_ECC_KEY_PAIR( private_key->attr.type ) )
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004789 return( PSA_ERROR_INVALID_ARGUMENT );
Steven Cooremana2371e52020-07-28 14:30:39 +02004790 mbedtls_ecp_keypair *ecp = NULL;
Ronald Cron90857082020-11-25 14:58:33 +01004791 psa_status_t status = mbedtls_psa_ecp_load_representation(
4792 private_key->attr.type,
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +01004793 private_key->attr.bits,
Ronald Cron90857082020-11-25 14:58:33 +01004794 private_key->key.data,
4795 private_key->key.bytes,
4796 &ecp );
Steven Cooremanacda8342020-07-24 23:09:52 +02004797 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02004798 return( status );
Steven Cooremanacda8342020-07-24 23:09:52 +02004799 status = psa_key_agreement_ecdh( peer_key, peer_key_length,
Steven Cooremana2371e52020-07-28 14:30:39 +02004800 ecp,
Steven Cooremanacda8342020-07-24 23:09:52 +02004801 shared_secret, shared_secret_size,
4802 shared_secret_length );
Steven Cooremana2371e52020-07-28 14:30:39 +02004803 mbedtls_ecp_keypair_free( ecp );
4804 mbedtls_free( ecp );
Steven Cooreman29149862020-08-05 15:43:42 +02004805 return( status );
John Durkop6ba40d12020-11-10 08:50:04 -08004806#endif /* MBEDTLS_PSA_BUILTIN_ALG_ECDH */
Gilles Peskine01d718c2018-09-18 12:01:02 +02004807 default:
Gilles Peskine93f85002018-11-16 16:43:31 +01004808 (void) private_key;
4809 (void) peer_key;
4810 (void) peer_key_length;
Gilles Peskine0216fe12019-04-11 21:23:21 +02004811 (void) shared_secret;
4812 (void) shared_secret_size;
4813 (void) shared_secret_length;
Gilles Peskine01d718c2018-09-18 12:01:02 +02004814 return( PSA_ERROR_NOT_SUPPORTED );
4815 }
Gilles Peskine0216fe12019-04-11 21:23:21 +02004816}
4817
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02004818/* Note that if this function fails, you must call psa_key_derivation_abort()
Gilles Peskine01d718c2018-09-18 12:01:02 +02004819 * to potentially free embedded data structures and wipe confidential data.
4820 */
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004821static psa_status_t psa_key_agreement_internal( psa_key_derivation_operation_t *operation,
Gilles Peskine969c5d62019-01-16 15:53:06 +01004822 psa_key_derivation_step_t step,
Gilles Peskine01d718c2018-09-18 12:01:02 +02004823 psa_key_slot_t *private_key,
4824 const uint8_t *peer_key,
Gilles Peskine969c5d62019-01-16 15:53:06 +01004825 size_t peer_key_length )
Gilles Peskine01d718c2018-09-18 12:01:02 +02004826{
4827 psa_status_t status;
4828 uint8_t shared_secret[PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE];
4829 size_t shared_secret_length = 0;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004830 psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE( operation->alg );
Gilles Peskine01d718c2018-09-18 12:01:02 +02004831
4832 /* Step 1: run the secret agreement algorithm to generate the shared
4833 * secret. */
Gilles Peskine0216fe12019-04-11 21:23:21 +02004834 status = psa_key_agreement_raw_internal( ka_alg,
4835 private_key,
4836 peer_key, peer_key_length,
itayzafrir0adf0fc2018-09-06 16:24:41 +03004837 shared_secret,
4838 sizeof( shared_secret ),
Gilles Peskine05d69892018-06-19 22:00:52 +02004839 &shared_secret_length );
Gilles Peskine53d991e2018-07-12 01:14:59 +02004840 if( status != PSA_SUCCESS )
Gilles Peskine12313cd2018-06-20 00:20:32 +02004841 goto exit;
4842
Gilles Peskineb0b255c2018-07-06 17:01:38 +02004843 /* Step 2: set up the key derivation to generate key material from
Gilles Peskine224b0d62019-09-23 18:13:17 +02004844 * the shared secret. A shared secret is permitted wherever a key
4845 * of type DERIVE is permitted. */
Janos Follathb80a94e2019-06-12 15:54:46 +01004846 status = psa_key_derivation_input_internal( operation, step,
Gilles Peskine224b0d62019-09-23 18:13:17 +02004847 PSA_KEY_TYPE_DERIVE,
Janos Follathb80a94e2019-06-12 15:54:46 +01004848 shared_secret,
4849 shared_secret_length );
Gilles Peskine12313cd2018-06-20 00:20:32 +02004850exit:
Gilles Peskine3f108122018-12-07 18:14:53 +01004851 mbedtls_platform_zeroize( shared_secret, shared_secret_length );
Gilles Peskine12313cd2018-06-20 00:20:32 +02004852 return( status );
4853}
4854
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004855psa_status_t psa_key_derivation_key_agreement( psa_key_derivation_operation_t *operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02004856 psa_key_derivation_step_t step,
Ronald Croncf56a0a2020-08-04 09:51:30 +02004857 mbedtls_svc_key_id_t private_key,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02004858 const uint8_t *peer_key,
4859 size_t peer_key_length )
Gilles Peskine12313cd2018-06-20 00:20:32 +02004860{
Ronald Cronf95a2b12020-10-22 15:24:49 +02004861 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01004862 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01004863 psa_key_slot_t *slot;
Ronald Cronf95a2b12020-10-22 15:24:49 +02004864
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004865 if( ! PSA_ALG_IS_KEY_AGREEMENT( operation->alg ) )
Gilles Peskine12313cd2018-06-20 00:20:32 +02004866 return( PSA_ERROR_INVALID_ARGUMENT );
Ronald Cron5c522922020-11-14 16:35:34 +01004867 status = psa_get_and_lock_transparent_key_slot_with_policy(
4868 private_key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg );
Gilles Peskine12313cd2018-06-20 00:20:32 +02004869 if( status != PSA_SUCCESS )
4870 return( status );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004871 status = psa_key_agreement_internal( operation, step,
Gilles Peskine346797d2018-11-16 16:05:06 +01004872 slot,
Gilles Peskine969c5d62019-01-16 15:53:06 +01004873 peer_key, peer_key_length );
Gilles Peskine346797d2018-11-16 16:05:06 +01004874 if( status != PSA_SUCCESS )
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004875 psa_key_derivation_abort( operation );
Steven Cooremanfa5e6312020-10-15 17:07:12 +02004876 else
4877 {
4878 /* If a private key has been added as SECRET, we allow the derived
4879 * key material to be used as a key in PSA Crypto. */
4880 if( step == PSA_KEY_DERIVATION_INPUT_SECRET )
4881 operation->can_output_key = 1;
4882 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02004883
Ronald Cron5c522922020-11-14 16:35:34 +01004884 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02004885
Ronald Cron5c522922020-11-14 16:35:34 +01004886 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskineaf3baab2018-06-27 22:55:52 +02004887}
4888
Gilles Peskinebe697d82019-05-16 18:00:41 +02004889psa_status_t psa_raw_key_agreement( psa_algorithm_t alg,
Ronald Croncf56a0a2020-08-04 09:51:30 +02004890 mbedtls_svc_key_id_t private_key,
Gilles Peskinebe697d82019-05-16 18:00:41 +02004891 const uint8_t *peer_key,
4892 size_t peer_key_length,
4893 uint8_t *output,
4894 size_t output_size,
4895 size_t *output_length )
Gilles Peskine0216fe12019-04-11 21:23:21 +02004896{
Ronald Cronf95a2b12020-10-22 15:24:49 +02004897 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01004898 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cronf95a2b12020-10-22 15:24:49 +02004899 psa_key_slot_t *slot = NULL;
Gilles Peskine0216fe12019-04-11 21:23:21 +02004900
4901 if( ! PSA_ALG_IS_KEY_AGREEMENT( alg ) )
4902 {
4903 status = PSA_ERROR_INVALID_ARGUMENT;
4904 goto exit;
4905 }
Ronald Cron5c522922020-11-14 16:35:34 +01004906 status = psa_get_and_lock_transparent_key_slot_with_policy(
4907 private_key, &slot, PSA_KEY_USAGE_DERIVE, alg );
Gilles Peskine0216fe12019-04-11 21:23:21 +02004908 if( status != PSA_SUCCESS )
4909 goto exit;
4910
4911 status = psa_key_agreement_raw_internal( alg, slot,
4912 peer_key, peer_key_length,
4913 output, output_size,
4914 output_length );
4915
4916exit:
4917 if( status != PSA_SUCCESS )
4918 {
4919 /* If an error happens and is not handled properly, the output
4920 * may be used as a key to protect sensitive data. Arrange for such
4921 * a key to be random, which is likely to result in decryption or
4922 * verification errors. This is better than filling the buffer with
4923 * some constant data such as zeros, which would result in the data
4924 * being protected with a reproducible, easily knowable key.
4925 */
4926 psa_generate_random( output, output_size );
4927 *output_length = output_size;
4928 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02004929
Ronald Cron5c522922020-11-14 16:35:34 +01004930 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02004931
Ronald Cron5c522922020-11-14 16:35:34 +01004932 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskine0216fe12019-04-11 21:23:21 +02004933}
Gilles Peskine86a440b2018-11-12 18:39:40 +01004934
4935
Gilles Peskine30524eb2020-11-13 17:02:26 +01004936
Gilles Peskine86a440b2018-11-12 18:39:40 +01004937/****************************************************************/
4938/* Random generation */
Gilles Peskine53d991e2018-07-12 01:14:59 +02004939/****************************************************************/
Gilles Peskine12313cd2018-06-20 00:20:32 +02004940
Gilles Peskine30524eb2020-11-13 17:02:26 +01004941/** Initialize the PSA random generator.
4942 */
4943static void mbedtls_psa_random_init( mbedtls_psa_random_context_t *rng )
4944{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01004945#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
4946 memset( rng, 0, sizeof( *rng ) );
4947#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
4948
Gilles Peskine30524eb2020-11-13 17:02:26 +01004949 /* Set default configuration if
4950 * mbedtls_psa_crypto_configure_entropy_sources() hasn't been called. */
4951 if( rng->entropy_init == NULL )
4952 rng->entropy_init = mbedtls_entropy_init;
4953 if( rng->entropy_free == NULL )
4954 rng->entropy_free = mbedtls_entropy_free;
4955
4956 rng->entropy_init( &rng->entropy );
4957#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \
4958 defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES)
4959 /* The PSA entropy injection feature depends on using NV seed as an entropy
4960 * source. Add NV seed as an entropy source for PSA entropy injection. */
4961 mbedtls_entropy_add_source( &rng->entropy,
4962 mbedtls_nv_seed_poll, NULL,
4963 MBEDTLS_ENTROPY_BLOCK_SIZE,
4964 MBEDTLS_ENTROPY_SOURCE_STRONG );
4965#endif
4966
Gilles Peskine5894e8e2020-12-14 14:54:06 +01004967 mbedtls_psa_drbg_init( MBEDTLS_PSA_RANDOM_STATE );
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01004968#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01004969}
4970
4971/** Deinitialize the PSA random generator.
4972 */
4973static void mbedtls_psa_random_free( mbedtls_psa_random_context_t *rng )
4974{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01004975#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
4976 memset( rng, 0, sizeof( *rng ) );
4977#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine5894e8e2020-12-14 14:54:06 +01004978 mbedtls_psa_drbg_free( MBEDTLS_PSA_RANDOM_STATE );
Gilles Peskine30524eb2020-11-13 17:02:26 +01004979 rng->entropy_free( &rng->entropy );
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01004980#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01004981}
4982
4983/** Seed the PSA random generator.
4984 */
4985static psa_status_t mbedtls_psa_random_seed( mbedtls_psa_random_context_t *rng )
4986{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01004987#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
4988 /* Do nothing: the external RNG seeds itself. */
4989 (void) rng;
4990 return( PSA_SUCCESS );
4991#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01004992 const unsigned char drbg_seed[] = "PSA";
Gilles Peskine5894e8e2020-12-14 14:54:06 +01004993 int ret = mbedtls_psa_drbg_seed( &rng->entropy,
4994 drbg_seed, sizeof( drbg_seed ) - 1 );
Gilles Peskine30524eb2020-11-13 17:02:26 +01004995 return mbedtls_to_psa_error( ret );
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01004996#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01004997}
4998
Gilles Peskinee59236f2018-01-27 23:32:46 +01004999psa_status_t psa_generate_random( uint8_t *output,
5000 size_t output_size )
5001{
Gilles Peskinee59236f2018-01-27 23:32:46 +01005002 GUARD_MODULE_INITIALIZED;
5003
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01005004#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
5005
5006 size_t output_length = 0;
5007 psa_status_t status = mbedtls_psa_external_get_random( &global_data.rng,
5008 output, output_size,
5009 &output_length );
5010 if( status != PSA_SUCCESS )
5011 return( status );
5012 /* Breaking up a request into smaller chunks is currently not supported
5013 * for the extrernal RNG interface. */
5014 if( output_length != output_size )
5015 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
5016 return( PSA_SUCCESS );
5017
5018#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
5019
Gilles Peskine71ddab92021-01-04 21:01:07 +01005020 while( output_size > 0 )
Gilles Peskinef181eca2019-08-07 13:49:00 +02005021 {
Gilles Peskine71ddab92021-01-04 21:01:07 +01005022 size_t request_size =
5023 ( output_size > MBEDTLS_PSA_RANDOM_MAX_REQUEST ?
5024 MBEDTLS_PSA_RANDOM_MAX_REQUEST :
5025 output_size );
Gilles Peskine0c59ba82021-01-05 14:10:59 +01005026 int ret = mbedtls_psa_get_random( MBEDTLS_PSA_RANDOM_STATE,
5027 output, request_size );
Gilles Peskinef181eca2019-08-07 13:49:00 +02005028 if( ret != 0 )
5029 return( mbedtls_to_psa_error( ret ) );
Gilles Peskine71ddab92021-01-04 21:01:07 +01005030 output_size -= request_size;
5031 output += request_size;
Gilles Peskinef181eca2019-08-07 13:49:00 +02005032 }
Gilles Peskine0c59ba82021-01-05 14:10:59 +01005033 return( PSA_SUCCESS );
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01005034#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskinee59236f2018-01-27 23:32:46 +01005035}
5036
Gilles Peskine8814fc42020-12-14 15:33:44 +01005037/* Wrapper function allowing the classic API to use the PSA RNG.
Gilles Peskine9c3e0602021-01-05 16:03:55 +01005038 *
5039 * `mbedtls_psa_get_random(MBEDTLS_PSA_RANDOM_STATE, ...)` calls
5040 * `psa_generate_random(...)`. The state parameter is ignored since the
5041 * PSA API doesn't support passing an explicit state.
5042 *
5043 * In the non-external case, psa_generate_random() calls an
5044 * `mbedtls_xxx_drbg_random` function which has exactly the same signature
5045 * and semantics as mbedtls_psa_get_random(). As an optimization,
5046 * instead of doing this back-and-forth between the PSA API and the
5047 * classic API, psa_crypto_random_impl.h defines `mbedtls_psa_get_random`
5048 * as a constant function pointer to `mbedtls_xxx_drbg_random`.
Gilles Peskine8814fc42020-12-14 15:33:44 +01005049 */
5050#if defined (MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
5051int mbedtls_psa_get_random( void *p_rng,
5052 unsigned char *output,
5053 size_t output_size )
5054{
Gilles Peskine9c3e0602021-01-05 16:03:55 +01005055 /* This function takes a pointer to the RNG state because that's what
5056 * classic mbedtls functions using an RNG expect. The PSA RNG manages
5057 * its own state internally and doesn't let the caller access that state.
5058 * So we just ignore the state parameter, and in practice we'll pass
5059 * NULL. */
Gilles Peskine8814fc42020-12-14 15:33:44 +01005060 (void) p_rng;
5061 psa_status_t status = psa_generate_random( output, output_size );
5062 if( status == PSA_SUCCESS )
5063 return( 0 );
5064 else
5065 return( MBEDTLS_ERR_ENTROPY_SOURCE_FAILED );
5066}
5067#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
5068
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01005069#if defined(MBEDTLS_PSA_INJECT_ENTROPY)
5070#include "mbedtls/entropy_poll.h"
5071
Gilles Peskine7228da22019-07-15 11:06:15 +02005072psa_status_t mbedtls_psa_inject_entropy( const uint8_t *seed,
Netanel Gonen2bcd3122018-11-19 11:53:02 +02005073 size_t seed_size )
5074{
Netanel Gonen2bcd3122018-11-19 11:53:02 +02005075 if( global_data.initialized )
5076 return( PSA_ERROR_NOT_PERMITTED );
Netanel Gonen21f37cb2018-11-19 11:53:55 +02005077
5078 if( ( ( seed_size < MBEDTLS_ENTROPY_MIN_PLATFORM ) ||
5079 ( seed_size < MBEDTLS_ENTROPY_BLOCK_SIZE ) ) ||
5080 ( seed_size > MBEDTLS_ENTROPY_MAX_SEED_SIZE ) )
5081 return( PSA_ERROR_INVALID_ARGUMENT );
5082
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01005083 return( mbedtls_psa_storage_inject_entropy( seed, seed_size ) );
Netanel Gonen2bcd3122018-11-19 11:53:02 +02005084}
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01005085#endif /* MBEDTLS_PSA_INJECT_ENTROPY */
Netanel Gonen2bcd3122018-11-19 11:53:02 +02005086
Ronald Cron3772afe2021-02-08 16:10:05 +01005087/** Validate the key type and size for key generation
Ronald Cron01b2aba2020-10-05 09:42:02 +02005088 *
Ronald Cron3772afe2021-02-08 16:10:05 +01005089 * \param type The key type
5090 * \param bits The number of bits of the key
Ronald Cron01b2aba2020-10-05 09:42:02 +02005091 *
5092 * \retval #PSA_SUCCESS
Ronald Cron3772afe2021-02-08 16:10:05 +01005093 * The key type and size are valid.
Ronald Cron01b2aba2020-10-05 09:42:02 +02005094 * \retval #PSA_ERROR_INVALID_ARGUMENT
5095 * The size in bits of the key is not valid.
5096 * \retval #PSA_ERROR_NOT_SUPPORTED
5097 * The type and/or the size in bits of the key or the combination of
5098 * the two is not supported.
5099 */
Ronald Cron3772afe2021-02-08 16:10:05 +01005100static psa_status_t psa_validate_key_type_and_size_for_key_generation(
5101 psa_key_type_t type, size_t bits )
Gilles Peskinee59236f2018-01-27 23:32:46 +01005102{
Ronald Cronf3bb7612020-10-02 20:11:59 +02005103 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinee59236f2018-01-27 23:32:46 +01005104
Gilles Peskinee59236f2018-01-27 23:32:46 +01005105 if( key_type_is_raw_bytes( type ) )
5106 {
Ronald Cronf3bb7612020-10-02 20:11:59 +02005107 status = validate_unstructured_key_bit_size( type, bits );
Gilles Peskinee59236f2018-01-27 23:32:46 +01005108 if( status != PSA_SUCCESS )
5109 return( status );
Ronald Cron01b2aba2020-10-05 09:42:02 +02005110 }
5111 else
Ronald Cron5c4d3862020-12-07 11:07:24 +01005112#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR)
Ronald Cron01b2aba2020-10-05 09:42:02 +02005113 if( PSA_KEY_TYPE_IS_RSA( type ) && PSA_KEY_TYPE_IS_KEY_PAIR( type ) )
5114 {
5115 if( bits > PSA_VENDOR_RSA_MAX_KEY_BITS )
5116 return( PSA_ERROR_NOT_SUPPORTED );
Steven Cooreman81be2fa2020-07-24 22:04:59 +02005117
Ronald Cron01b2aba2020-10-05 09:42:02 +02005118 /* Accept only byte-aligned keys, for the same reasons as
5119 * in psa_import_rsa_key(). */
5120 if( bits % 8 != 0 )
5121 return( PSA_ERROR_NOT_SUPPORTED );
Ronald Cron01b2aba2020-10-05 09:42:02 +02005122 }
5123 else
Ronald Cron5c4d3862020-12-07 11:07:24 +01005124#endif /* defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR) */
Ronald Cron01b2aba2020-10-05 09:42:02 +02005125
Ronald Cron5c4d3862020-12-07 11:07:24 +01005126#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR)
Ronald Cron01b2aba2020-10-05 09:42:02 +02005127 if( PSA_KEY_TYPE_IS_ECC( type ) && PSA_KEY_TYPE_IS_KEY_PAIR( type ) )
5128 {
Ronald Crond81ab562021-02-16 09:01:16 +01005129 /* To avoid empty block, return successfully here. */
5130 return( PSA_SUCCESS );
Ronald Cron01b2aba2020-10-05 09:42:02 +02005131 }
5132 else
Ronald Cron5c4d3862020-12-07 11:07:24 +01005133#endif /* defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) */
Ronald Cron01b2aba2020-10-05 09:42:02 +02005134 {
5135 return( PSA_ERROR_NOT_SUPPORTED );
5136 }
5137
5138 return( PSA_SUCCESS );
5139}
5140
Ronald Cron55ed0592020-10-05 10:30:40 +02005141psa_status_t psa_generate_key_internal(
Ronald Cron2a38a6b2020-10-02 20:02:04 +02005142 const psa_key_attributes_t *attributes,
5143 uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length )
Ronald Cron01b2aba2020-10-05 09:42:02 +02005144{
5145 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron2a38a6b2020-10-02 20:02:04 +02005146 psa_key_type_t type = attributes->core.type;
Ronald Cron01b2aba2020-10-05 09:42:02 +02005147
Ronald Cron2a38a6b2020-10-02 20:02:04 +02005148 if( ( attributes->domain_parameters == NULL ) &&
5149 ( attributes->domain_parameters_size != 0 ) )
Ronald Cron01b2aba2020-10-05 09:42:02 +02005150 return( PSA_ERROR_INVALID_ARGUMENT );
5151
Ronald Cron01b2aba2020-10-05 09:42:02 +02005152 if( key_type_is_raw_bytes( type ) )
5153 {
Ronald Cron2a38a6b2020-10-02 20:02:04 +02005154 status = psa_generate_random( key_buffer, key_buffer_size );
Gilles Peskinee59236f2018-01-27 23:32:46 +01005155 if( status != PSA_SUCCESS )
Gilles Peskinee59236f2018-01-27 23:32:46 +01005156 return( status );
Steven Cooreman81be2fa2020-07-24 22:04:59 +02005157
David Brown12ca5032021-02-11 11:02:00 -07005158#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Gilles Peskinee59236f2018-01-27 23:32:46 +01005159 if( type == PSA_KEY_TYPE_DES )
Ronald Cron2a38a6b2020-10-02 20:02:04 +02005160 psa_des_set_key_parity( key_buffer, key_buffer_size );
David Brown8107e312021-02-12 08:08:46 -07005161#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */
Gilles Peskinee59236f2018-01-27 23:32:46 +01005162 }
5163 else
5164
John Durkop07cc04a2020-11-16 22:08:34 -08005165#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR)
Gilles Peskinec93b80c2019-05-16 19:39:54 +02005166 if ( type == PSA_KEY_TYPE_RSA_KEY_PAIR )
Gilles Peskinee59236f2018-01-27 23:32:46 +01005167 {
Ronald Cron9e18fc12020-11-05 17:36:40 +01005168 return( mbedtls_psa_rsa_generate_key( attributes,
5169 key_buffer,
5170 key_buffer_size,
5171 key_buffer_length ) );
Gilles Peskinee59236f2018-01-27 23:32:46 +01005172 }
5173 else
John Durkop07cc04a2020-11-16 22:08:34 -08005174#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) */
Gilles Peskinee59236f2018-01-27 23:32:46 +01005175
John Durkop9814fa22020-11-04 12:28:15 -08005176#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR)
Gilles Peskinec93b80c2019-05-16 19:39:54 +02005177 if ( PSA_KEY_TYPE_IS_ECC( type ) && PSA_KEY_TYPE_IS_KEY_PAIR( type ) )
Gilles Peskinee59236f2018-01-27 23:32:46 +01005178 {
Ronald Cron7023db52020-11-20 18:17:42 +01005179 return( mbedtls_psa_ecp_generate_key( attributes,
5180 key_buffer,
5181 key_buffer_size,
5182 key_buffer_length ) );
Gilles Peskinee59236f2018-01-27 23:32:46 +01005183 }
5184 else
John Durkop9814fa22020-11-04 12:28:15 -08005185#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) */
Steven Cooreman29149862020-08-05 15:43:42 +02005186 {
Ronald Cron2a38a6b2020-10-02 20:02:04 +02005187 (void)key_buffer_length;
Gilles Peskinee59236f2018-01-27 23:32:46 +01005188 return( PSA_ERROR_NOT_SUPPORTED );
Steven Cooreman29149862020-08-05 15:43:42 +02005189 }
Gilles Peskinee59236f2018-01-27 23:32:46 +01005190
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005191 return( PSA_SUCCESS );
5192}
Darryl Green0c6575a2018-11-07 16:05:30 +00005193
Gilles Peskine35ef36b2019-05-16 19:42:05 +02005194psa_status_t psa_generate_key( const psa_key_attributes_t *attributes,
Ronald Croncf56a0a2020-08-04 09:51:30 +02005195 mbedtls_svc_key_id_t *key )
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005196{
5197 psa_status_t status;
5198 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02005199 psa_se_drv_table_entry_t *driver = NULL;
Ronald Cron2b56bc82020-10-05 10:02:26 +02005200 size_t key_buffer_size;
Gilles Peskine11792082019-08-06 18:36:36 +02005201
Ronald Cron81709fc2020-11-14 12:10:32 +01005202 *key = MBEDTLS_SVC_KEY_ID_INIT;
5203
Gilles Peskine0f84d622019-09-12 19:03:13 +02005204 /* Reject any attempt to create a zero-length key so that we don't
5205 * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
5206 if( psa_get_key_bits( attributes ) == 0 )
5207 return( PSA_ERROR_INVALID_ARGUMENT );
5208
Ronald Cron81709fc2020-11-14 12:10:32 +01005209 status = psa_start_key_creation( PSA_KEY_CREATION_GENERATE, attributes,
5210 &slot, &driver );
Gilles Peskine11792082019-08-06 18:36:36 +02005211 if( status != PSA_SUCCESS )
5212 goto exit;
5213
Ronald Cron977c2472020-10-13 08:32:21 +02005214 /* In the case of a transparent key or an opaque key stored in local
5215 * storage (thus not in the case of generating a key in a secure element
5216 * or cryptoprocessor with storage), we have to allocate a buffer to
5217 * hold the generated key material. */
5218 if( slot->key.data == NULL )
5219 {
5220 if ( PSA_KEY_LIFETIME_GET_LOCATION( attributes->core.lifetime ) ==
5221 PSA_KEY_LOCATION_LOCAL_STORAGE )
5222 {
Ronald Cron3772afe2021-02-08 16:10:05 +01005223 status = psa_validate_key_type_and_size_for_key_generation(
5224 attributes->core.type, attributes->core.bits );
5225 if( status != PSA_SUCCESS )
5226 goto exit;
5227
5228 key_buffer_size = PSA_EXPORT_KEY_OUTPUT_SIZE(
5229 attributes->core.type,
5230 attributes->core.bits );
Ronald Cron977c2472020-10-13 08:32:21 +02005231 }
5232 else
5233 {
5234 status = psa_driver_wrapper_get_key_buffer_size(
5235 attributes, &key_buffer_size );
Ronald Cron3772afe2021-02-08 16:10:05 +01005236 if( status != PSA_SUCCESS )
5237 goto exit;
Ronald Cron977c2472020-10-13 08:32:21 +02005238 }
Ronald Cron977c2472020-10-13 08:32:21 +02005239
5240 status = psa_allocate_buffer_to_slot( slot, key_buffer_size );
5241 if( status != PSA_SUCCESS )
5242 goto exit;
5243 }
5244
Steven Cooreman2a1664c2020-07-20 15:33:08 +02005245 status = psa_driver_wrapper_generate_key( attributes,
Ronald Cron977c2472020-10-13 08:32:21 +02005246 slot->key.data, slot->key.bytes, &slot->key.bytes );
Gilles Peskine11792082019-08-06 18:36:36 +02005247
Ronald Cron2b56bc82020-10-05 10:02:26 +02005248 if( status != PSA_SUCCESS )
5249 psa_remove_key_data_from_memory( slot );
5250
Gilles Peskine11792082019-08-06 18:36:36 +02005251exit:
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005252 if( status == PSA_SUCCESS )
Ronald Cron81709fc2020-11-14 12:10:32 +01005253 status = psa_finish_key_creation( slot, driver, key );
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005254 if( status != PSA_SUCCESS )
Gilles Peskine011e4282019-06-26 18:34:38 +02005255 psa_fail_key_creation( slot, driver );
Ronald Cronf95a2b12020-10-22 15:24:49 +02005256
Darryl Green0c6575a2018-11-07 16:05:30 +00005257 return( status );
Gilles Peskinee59236f2018-01-27 23:32:46 +01005258}
5259
Gilles Peskinee59236f2018-01-27 23:32:46 +01005260/****************************************************************/
5261/* Module setup */
5262/****************************************************************/
5263
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01005264#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
Gilles Peskine5e769522018-11-20 21:59:56 +01005265psa_status_t mbedtls_psa_crypto_configure_entropy_sources(
5266 void (* entropy_init )( mbedtls_entropy_context *ctx ),
5267 void (* entropy_free )( mbedtls_entropy_context *ctx ) )
5268{
5269 if( global_data.rng_state != RNG_NOT_INITIALIZED )
5270 return( PSA_ERROR_BAD_STATE );
Gilles Peskine30524eb2020-11-13 17:02:26 +01005271 global_data.rng.entropy_init = entropy_init;
5272 global_data.rng.entropy_free = entropy_free;
Gilles Peskine5e769522018-11-20 21:59:56 +01005273 return( PSA_SUCCESS );
5274}
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01005275#endif /* !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) */
Gilles Peskine5e769522018-11-20 21:59:56 +01005276
Gilles Peskinee59236f2018-01-27 23:32:46 +01005277void mbedtls_psa_crypto_free( void )
5278{
Gilles Peskine66fb1262018-12-10 16:29:04 +01005279 psa_wipe_all_key_slots( );
Gilles Peskinec6b69072018-11-20 21:42:52 +01005280 if( global_data.rng_state != RNG_NOT_INITIALIZED )
5281 {
Gilles Peskine30524eb2020-11-13 17:02:26 +01005282 mbedtls_psa_random_free( &global_data.rng );
Gilles Peskinec6b69072018-11-20 21:42:52 +01005283 }
5284 /* Wipe all remaining data, including configuration.
5285 * In particular, this sets all state indicator to the value
5286 * indicating "uninitialized". */
Gilles Peskine3f108122018-12-07 18:14:53 +01005287 mbedtls_platform_zeroize( &global_data, sizeof( global_data ) );
Gilles Peskinea8ade162019-06-26 11:24:49 +02005288#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined0890212019-06-24 14:34:43 +02005289 /* Unregister all secure element drivers, so that we restart from
5290 * a pristine state. */
5291 psa_unregister_all_se_drivers( );
Gilles Peskinea8ade162019-06-26 11:24:49 +02005292#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskinee59236f2018-01-27 23:32:46 +01005293}
5294
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02005295#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
5296/** Recover a transaction that was interrupted by a power failure.
5297 *
5298 * This function is called during initialization, before psa_crypto_init()
5299 * returns. If this function returns a failure status, the initialization
5300 * fails.
5301 */
5302static psa_status_t psa_crypto_recover_transaction(
5303 const psa_crypto_transaction_t *transaction )
5304{
5305 switch( transaction->unknown.type )
5306 {
5307 case PSA_CRYPTO_TRANSACTION_CREATE_KEY:
5308 case PSA_CRYPTO_TRANSACTION_DESTROY_KEY:
Janos Follath1d57a202019-08-13 12:15:34 +01005309 /* TODO - fall through to the failure case until this
Gilles Peskinec9d7f942019-08-13 16:17:16 +02005310 * is implemented.
5311 * https://github.com/ARMmbed/mbed-crypto/issues/218
5312 */
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02005313 default:
5314 /* We found an unsupported transaction in the storage.
5315 * We don't know what state the storage is in. Give up. */
gabor-mezei-armfe309242020-11-09 17:39:56 +01005316 return( PSA_ERROR_DATA_INVALID );
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02005317 }
5318}
5319#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
5320
Gilles Peskinee59236f2018-01-27 23:32:46 +01005321psa_status_t psa_crypto_init( void )
5322{
Gilles Peskine66fb1262018-12-10 16:29:04 +01005323 psa_status_t status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01005324
Gilles Peskinec6b69072018-11-20 21:42:52 +01005325 /* Double initialization is explicitly allowed. */
Gilles Peskinee59236f2018-01-27 23:32:46 +01005326 if( global_data.initialized != 0 )
5327 return( PSA_SUCCESS );
5328
Gilles Peskine30524eb2020-11-13 17:02:26 +01005329 /* Initialize and seed the random generator. */
5330 mbedtls_psa_random_init( &global_data.rng );
Gilles Peskinec6b69072018-11-20 21:42:52 +01005331 global_data.rng_state = RNG_INITIALIZED;
Gilles Peskine30524eb2020-11-13 17:02:26 +01005332 status = mbedtls_psa_random_seed( &global_data.rng );
Gilles Peskine66fb1262018-12-10 16:29:04 +01005333 if( status != PSA_SUCCESS )
Gilles Peskinee59236f2018-01-27 23:32:46 +01005334 goto exit;
Gilles Peskinec6b69072018-11-20 21:42:52 +01005335 global_data.rng_state = RNG_SEEDED;
Gilles Peskinee59236f2018-01-27 23:32:46 +01005336
Gilles Peskine66fb1262018-12-10 16:29:04 +01005337 status = psa_initialize_key_slots( );
5338 if( status != PSA_SUCCESS )
5339 goto exit;
Gilles Peskinec6b69072018-11-20 21:42:52 +01005340
Gilles Peskined9348f22019-10-01 15:22:29 +02005341#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
5342 status = psa_init_all_se_drivers( );
5343 if( status != PSA_SUCCESS )
5344 goto exit;
5345#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
5346
Gilles Peskine4b734222019-07-24 15:56:31 +02005347#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
Gilles Peskinefc762652019-07-22 19:30:34 +02005348 status = psa_crypto_load_transaction( );
5349 if( status == PSA_SUCCESS )
5350 {
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02005351 status = psa_crypto_recover_transaction( &psa_crypto_transaction );
5352 if( status != PSA_SUCCESS )
5353 goto exit;
5354 status = psa_crypto_stop_transaction( );
Gilles Peskinefc762652019-07-22 19:30:34 +02005355 }
5356 else if( status == PSA_ERROR_DOES_NOT_EXIST )
5357 {
5358 /* There's no transaction to complete. It's all good. */
5359 status = PSA_SUCCESS;
5360 }
Gilles Peskine4b734222019-07-24 15:56:31 +02005361#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
Gilles Peskinefc762652019-07-22 19:30:34 +02005362
Gilles Peskinec6b69072018-11-20 21:42:52 +01005363 /* All done. */
Gilles Peskinee59236f2018-01-27 23:32:46 +01005364 global_data.initialized = 1;
5365
5366exit:
Gilles Peskine66fb1262018-12-10 16:29:04 +01005367 if( status != PSA_SUCCESS )
Gilles Peskinee59236f2018-01-27 23:32:46 +01005368 mbedtls_psa_crypto_free( );
Gilles Peskine66fb1262018-12-10 16:29:04 +01005369 return( status );
Gilles Peskinee59236f2018-01-27 23:32:46 +01005370}
5371
5372#endif /* MBEDTLS_PSA_CRYPTO_C */