blob: cea165cbbc621c0df20c96ded17576788c268c8e [file] [log] [blame]
Gilles Peskinee59236f2018-01-27 23:32:46 +01001/*
2 * PSA crypto layer on top of Mbed TLS crypto
3 */
Bence Szépkúti86974652020-06-15 11:59:37 +02004/*
Bence Szépkúti1e148272020-08-07 13:07:28 +02005 * Copyright The Mbed TLS Contributors
Gilles Peskinee59236f2018-01-27 23:32:46 +01006 * SPDX-License-Identifier: Apache-2.0
7 *
8 * Licensed under the Apache License, Version 2.0 (the "License"); you may
9 * not use this file except in compliance with the License.
10 * You may obtain a copy of the License at
11 *
12 * http://www.apache.org/licenses/LICENSE-2.0
13 *
14 * Unless required by applicable law or agreed to in writing, software
15 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
16 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17 * See the License for the specific language governing permissions and
18 * limitations under the License.
Gilles Peskinee59236f2018-01-27 23:32:46 +010019 */
20
Gilles Peskinedb09ef62020-06-03 01:43:33 +020021#include "common.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010022
23#if defined(MBEDTLS_PSA_CRYPTO_C)
mohammad160327010052018-07-03 13:16:15 +030024
John Durkop07cc04a2020-11-16 22:08:34 -080025#if defined(MBEDTLS_PSA_CRYPTO_CONFIG)
26#include "check_crypto_config.h"
27#endif
28
Gilles Peskinee59236f2018-01-27 23:32:46 +010029#include "psa/crypto.h"
30
Ronald Crond6d28882020-12-14 14:56:02 +010031#include "psa_crypto_cipher.h"
Gilles Peskine039b90c2018-12-07 18:24:41 +010032#include "psa_crypto_core.h"
Gilles Peskine5e769522018-11-20 21:59:56 +010033#include "psa_crypto_invasive.h"
Steven Cooremancd84cb42020-07-16 20:28:36 +020034#include "psa_crypto_driver_wrappers.h"
Ronald Cron00b7bfc2020-11-25 15:25:26 +010035#include "psa_crypto_ecp.h"
Steven Cooreman5f88e772021-03-15 11:07:12 +010036#include "psa_crypto_hash.h"
Steven Cooreman82c66b62021-03-19 17:39:17 +010037#include "psa_crypto_mac.h"
Ronald Cron00b7bfc2020-11-25 15:25:26 +010038#include "psa_crypto_rsa.h"
Ronald Cron7023db52020-11-20 18:17:42 +010039#include "psa_crypto_ecp.h"
Gilles Peskinea8ade162019-06-26 11:24:49 +020040#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined0890212019-06-24 14:34:43 +020041#include "psa_crypto_se.h"
Gilles Peskinea8ade162019-06-26 11:24:49 +020042#endif
Gilles Peskine961849f2018-11-30 18:54:54 +010043#include "psa_crypto_slot_management.h"
Darryl Greend49a4992018-06-18 17:27:26 +010044/* Include internal declarations that are useful for implementing persistently
45 * stored keys. */
46#include "psa_crypto_storage.h"
47
Gilles Peskineb2b64d32020-12-14 16:43:58 +010048#include "psa_crypto_random_impl.h"
Gilles Peskine90edc992020-11-13 15:39:19 +010049
Gilles Peskineb46bef22019-07-30 21:32:04 +020050#include <assert.h>
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010051#include <stdlib.h>
52#include <string.h>
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010053#include "mbedtls/platform.h"
Gilles Peskineff2d2002019-05-06 15:26:23 +020054#if !defined(MBEDTLS_PLATFORM_C)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010055#define mbedtls_calloc calloc
56#define mbedtls_free free
57#endif
58
Gilles Peskine1c49f1a2020-11-13 18:46:25 +010059#include "mbedtls/aes.h"
Gilles Peskine9a944802018-06-21 09:35:35 +020060#include "mbedtls/asn1.h"
Jaeden Amero25384a22019-01-10 10:23:21 +000061#include "mbedtls/asn1write.h"
Gilles Peskinea81d85b2018-06-26 16:10:23 +020062#include "mbedtls/bignum.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010063#include "mbedtls/camellia.h"
Gilles Peskine26869f22019-05-06 15:25:00 +020064#include "mbedtls/chacha20.h"
65#include "mbedtls/chachapoly.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010066#include "mbedtls/cipher.h"
67#include "mbedtls/ccm.h"
68#include "mbedtls/cmac.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010069#include "mbedtls/des.h"
Gilles Peskineb7ecdf02018-09-18 12:11:27 +020070#include "mbedtls/ecdh.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010071#include "mbedtls/ecp.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010072#include "mbedtls/entropy.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010073#include "mbedtls/error.h"
74#include "mbedtls/gcm.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010075#include "mbedtls/md5.h"
Gilles Peskine20035e32018-02-03 22:44:14 +010076#include "mbedtls/md.h"
Chris Jonesdaacb592021-03-09 17:03:29 +000077#include "md_wrap.h"
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010078#include "mbedtls/pk.h"
Chris Jonesdaacb592021-03-09 17:03:29 +000079#include "pk_wrap.h"
Gilles Peskine3f108122018-12-07 18:14:53 +010080#include "mbedtls/platform_util.h"
Janos Follath24eed8d2019-11-22 13:21:35 +000081#include "mbedtls/error.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010082#include "mbedtls/ripemd160.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010083#include "mbedtls/rsa.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010084#include "mbedtls/sha1.h"
85#include "mbedtls/sha256.h"
86#include "mbedtls/sha512.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010087
Gilles Peskine996deb12018-08-01 15:45:45 +020088#define ARRAY_LENGTH( array ) ( sizeof( array ) / sizeof( *( array ) ) )
89
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010090/****************************************************************/
91/* Global data, support functions and library management */
92/****************************************************************/
93
Gilles Peskine48c0ea12018-06-21 14:15:31 +020094static int key_type_is_raw_bytes( psa_key_type_t type )
95{
Gilles Peskine78b3bb62018-08-10 16:03:41 +020096 return( PSA_KEY_TYPE_IS_UNSTRUCTURED( type ) );
Gilles Peskine48c0ea12018-06-21 14:15:31 +020097}
98
Gilles Peskine5a3c50e2018-12-04 12:27:09 +010099/* Values for psa_global_data_t::rng_state */
100#define RNG_NOT_INITIALIZED 0
101#define RNG_INITIALIZED 1
102#define RNG_SEEDED 2
Gilles Peskinec6b69072018-11-20 21:42:52 +0100103
Gilles Peskine2d277862018-06-18 15:41:12 +0200104typedef struct
105{
Gilles Peskine30524eb2020-11-13 17:02:26 +0100106 mbedtls_psa_random_context_t rng;
Gilles Peskinec6b69072018-11-20 21:42:52 +0100107 unsigned initialized : 1;
Gilles Peskine5a3c50e2018-12-04 12:27:09 +0100108 unsigned rng_state : 2;
Gilles Peskinee59236f2018-01-27 23:32:46 +0100109} psa_global_data_t;
110
111static psa_global_data_t global_data;
112
Gilles Peskine5894e8e2020-12-14 14:54:06 +0100113#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
114mbedtls_psa_drbg_context_t *const mbedtls_psa_random_state =
115 &global_data.rng.drbg;
116#endif
117
itayzafrir0adf0fc2018-09-06 16:24:41 +0300118#define GUARD_MODULE_INITIALIZED \
119 if( global_data.initialized == 0 ) \
120 return( PSA_ERROR_BAD_STATE );
121
Steven Cooreman01164162020-07-20 15:31:37 +0200122psa_status_t mbedtls_to_psa_error( int ret )
Gilles Peskinee59236f2018-01-27 23:32:46 +0100123{
Gilles Peskinedbf68962021-01-06 20:04:23 +0100124 /* Mbed TLS error codes can combine a high-level error code and a
125 * low-level error code. The low-level error usually reflects the
126 * root cause better, so dispatch on that preferably. */
127 int low_level_ret = - ( -ret & 0x007f );
128 switch( low_level_ret != 0 ? low_level_ret : ret )
Gilles Peskinee59236f2018-01-27 23:32:46 +0100129 {
130 case 0:
131 return( PSA_SUCCESS );
Gilles Peskinea5905292018-02-07 20:59:33 +0100132
133 case MBEDTLS_ERR_AES_INVALID_KEY_LENGTH:
134 case MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH:
Gilles Peskinea5905292018-02-07 20:59:33 +0100135 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine9a944802018-06-21 09:35:35 +0200136 case MBEDTLS_ERR_ASN1_OUT_OF_DATA:
137 case MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:
138 case MBEDTLS_ERR_ASN1_INVALID_LENGTH:
139 case MBEDTLS_ERR_ASN1_LENGTH_MISMATCH:
140 case MBEDTLS_ERR_ASN1_INVALID_DATA:
141 return( PSA_ERROR_INVALID_ARGUMENT );
142 case MBEDTLS_ERR_ASN1_ALLOC_FAILED:
143 return( PSA_ERROR_INSUFFICIENT_MEMORY );
144 case MBEDTLS_ERR_ASN1_BUF_TOO_SMALL:
145 return( PSA_ERROR_BUFFER_TOO_SMALL );
146
Jaeden Amero93e21112019-02-20 13:57:28 +0000147#if defined(MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA)
Jaeden Amero892cd6d2019-02-11 12:21:12 +0000148 case MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA:
Jaeden Amero93e21112019-02-20 13:57:28 +0000149#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100150 case MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH:
151 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskinea5905292018-02-07 20:59:33 +0100152
153 case MBEDTLS_ERR_CCM_BAD_INPUT:
154 return( PSA_ERROR_INVALID_ARGUMENT );
155 case MBEDTLS_ERR_CCM_AUTH_FAILED:
156 return( PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskinea5905292018-02-07 20:59:33 +0100157
Gilles Peskine26869f22019-05-06 15:25:00 +0200158 case MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA:
159 return( PSA_ERROR_INVALID_ARGUMENT );
160
161 case MBEDTLS_ERR_CHACHAPOLY_BAD_STATE:
162 return( PSA_ERROR_BAD_STATE );
163 case MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED:
164 return( PSA_ERROR_INVALID_SIGNATURE );
165
Gilles Peskinea5905292018-02-07 20:59:33 +0100166 case MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE:
167 return( PSA_ERROR_NOT_SUPPORTED );
168 case MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA:
169 return( PSA_ERROR_INVALID_ARGUMENT );
170 case MBEDTLS_ERR_CIPHER_ALLOC_FAILED:
171 return( PSA_ERROR_INSUFFICIENT_MEMORY );
172 case MBEDTLS_ERR_CIPHER_INVALID_PADDING:
173 return( PSA_ERROR_INVALID_PADDING );
174 case MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED:
Fredrik Strupef90e3012020-09-28 16:11:33 +0200175 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskinea5905292018-02-07 20:59:33 +0100176 case MBEDTLS_ERR_CIPHER_AUTH_FAILED:
177 return( PSA_ERROR_INVALID_SIGNATURE );
178 case MBEDTLS_ERR_CIPHER_INVALID_CONTEXT:
Gilles Peskine4b3eb692019-05-16 21:35:18 +0200179 return( PSA_ERROR_CORRUPTION_DETECTED );
Gilles Peskinea5905292018-02-07 20:59:33 +0100180
Gilles Peskine82e57d12020-11-13 21:31:17 +0100181#if !( defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) || \
182 defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE) )
Gilles Peskinebee96c82020-11-23 21:00:09 +0100183 /* Only check CTR_DRBG error codes if underlying mbedtls_xxx
184 * functions are passed a CTR_DRBG instance. */
Gilles Peskinea5905292018-02-07 20:59:33 +0100185 case MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED:
186 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
187 case MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG:
188 case MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG:
189 return( PSA_ERROR_NOT_SUPPORTED );
190 case MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR:
191 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
Gilles Peskine82e57d12020-11-13 21:31:17 +0100192#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100193
194 case MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH:
195 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskinea5905292018-02-07 20:59:33 +0100196
Gilles Peskinee59236f2018-01-27 23:32:46 +0100197 case MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED:
198 case MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE:
199 case MBEDTLS_ERR_ENTROPY_SOURCE_FAILED:
200 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
Gilles Peskinea5905292018-02-07 20:59:33 +0100201
202 case MBEDTLS_ERR_GCM_AUTH_FAILED:
203 return( PSA_ERROR_INVALID_SIGNATURE );
204 case MBEDTLS_ERR_GCM_BAD_INPUT:
Gilles Peskine8cac2e62018-08-21 15:07:38 +0200205 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskinea5905292018-02-07 20:59:33 +0100206
Gilles Peskine82e57d12020-11-13 21:31:17 +0100207#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) && \
208 defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE)
Gilles Peskinebee96c82020-11-23 21:00:09 +0100209 /* Only check HMAC_DRBG error codes if underlying mbedtls_xxx
210 * functions are passed a HMAC_DRBG instance. */
Gilles Peskine82e57d12020-11-13 21:31:17 +0100211 case MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED:
212 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
213 case MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG:
214 case MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG:
215 return( PSA_ERROR_NOT_SUPPORTED );
216 case MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR:
217 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
218#endif
219
Gilles Peskinea5905292018-02-07 20:59:33 +0100220 case MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE:
221 return( PSA_ERROR_NOT_SUPPORTED );
222 case MBEDTLS_ERR_MD_BAD_INPUT_DATA:
223 return( PSA_ERROR_INVALID_ARGUMENT );
224 case MBEDTLS_ERR_MD_ALLOC_FAILED:
225 return( PSA_ERROR_INSUFFICIENT_MEMORY );
226 case MBEDTLS_ERR_MD_FILE_IO_ERROR:
227 return( PSA_ERROR_STORAGE_FAILURE );
Gilles Peskinea5905292018-02-07 20:59:33 +0100228
Gilles Peskinef76aa772018-10-29 19:24:33 +0100229 case MBEDTLS_ERR_MPI_FILE_IO_ERROR:
230 return( PSA_ERROR_STORAGE_FAILURE );
231 case MBEDTLS_ERR_MPI_BAD_INPUT_DATA:
232 return( PSA_ERROR_INVALID_ARGUMENT );
233 case MBEDTLS_ERR_MPI_INVALID_CHARACTER:
234 return( PSA_ERROR_INVALID_ARGUMENT );
235 case MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL:
236 return( PSA_ERROR_BUFFER_TOO_SMALL );
237 case MBEDTLS_ERR_MPI_NEGATIVE_VALUE:
238 return( PSA_ERROR_INVALID_ARGUMENT );
239 case MBEDTLS_ERR_MPI_DIVISION_BY_ZERO:
240 return( PSA_ERROR_INVALID_ARGUMENT );
241 case MBEDTLS_ERR_MPI_NOT_ACCEPTABLE:
242 return( PSA_ERROR_INVALID_ARGUMENT );
243 case MBEDTLS_ERR_MPI_ALLOC_FAILED:
244 return( PSA_ERROR_INSUFFICIENT_MEMORY );
245
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100246 case MBEDTLS_ERR_PK_ALLOC_FAILED:
247 return( PSA_ERROR_INSUFFICIENT_MEMORY );
248 case MBEDTLS_ERR_PK_TYPE_MISMATCH:
249 case MBEDTLS_ERR_PK_BAD_INPUT_DATA:
250 return( PSA_ERROR_INVALID_ARGUMENT );
251 case MBEDTLS_ERR_PK_FILE_IO_ERROR:
Gilles Peskinea5905292018-02-07 20:59:33 +0100252 return( PSA_ERROR_STORAGE_FAILURE );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100253 case MBEDTLS_ERR_PK_KEY_INVALID_VERSION:
254 case MBEDTLS_ERR_PK_KEY_INVALID_FORMAT:
255 return( PSA_ERROR_INVALID_ARGUMENT );
256 case MBEDTLS_ERR_PK_UNKNOWN_PK_ALG:
257 return( PSA_ERROR_NOT_SUPPORTED );
258 case MBEDTLS_ERR_PK_PASSWORD_REQUIRED:
259 case MBEDTLS_ERR_PK_PASSWORD_MISMATCH:
260 return( PSA_ERROR_NOT_PERMITTED );
261 case MBEDTLS_ERR_PK_INVALID_PUBKEY:
262 return( PSA_ERROR_INVALID_ARGUMENT );
263 case MBEDTLS_ERR_PK_INVALID_ALG:
264 case MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE:
265 case MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE:
266 return( PSA_ERROR_NOT_SUPPORTED );
267 case MBEDTLS_ERR_PK_SIG_LEN_MISMATCH:
268 return( PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskinef9f1bdf2021-06-23 20:32:27 +0200269 case MBEDTLS_ERR_PK_BUFFER_TOO_SMALL:
270 return( PSA_ERROR_BUFFER_TOO_SMALL );
Gilles Peskinea5905292018-02-07 20:59:33 +0100271
Gilles Peskineff2d2002019-05-06 15:26:23 +0200272 case MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED:
273 return( PSA_ERROR_HARDWARE_FAILURE );
274 case MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
275 return( PSA_ERROR_NOT_SUPPORTED );
276
Gilles Peskinea5905292018-02-07 20:59:33 +0100277 case MBEDTLS_ERR_RSA_BAD_INPUT_DATA:
278 return( PSA_ERROR_INVALID_ARGUMENT );
279 case MBEDTLS_ERR_RSA_INVALID_PADDING:
280 return( PSA_ERROR_INVALID_PADDING );
281 case MBEDTLS_ERR_RSA_KEY_GEN_FAILED:
282 return( PSA_ERROR_HARDWARE_FAILURE );
283 case MBEDTLS_ERR_RSA_KEY_CHECK_FAILED:
284 return( PSA_ERROR_INVALID_ARGUMENT );
285 case MBEDTLS_ERR_RSA_PUBLIC_FAILED:
286 case MBEDTLS_ERR_RSA_PRIVATE_FAILED:
Gilles Peskine4b3eb692019-05-16 21:35:18 +0200287 return( PSA_ERROR_CORRUPTION_DETECTED );
Gilles Peskinea5905292018-02-07 20:59:33 +0100288 case MBEDTLS_ERR_RSA_VERIFY_FAILED:
289 return( PSA_ERROR_INVALID_SIGNATURE );
290 case MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE:
291 return( PSA_ERROR_BUFFER_TOO_SMALL );
292 case MBEDTLS_ERR_RSA_RNG_FAILED:
Gilles Peskine40d81602020-11-25 00:09:47 +0100293 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
Manuel Pégourié-Gonnard93c08472021-04-15 12:23:55 +0200294
itayzafrir5c753392018-05-08 11:18:38 +0300295 case MBEDTLS_ERR_ECP_BAD_INPUT_DATA:
itayzafrir7b30f8b2018-05-09 16:07:36 +0300296 case MBEDTLS_ERR_ECP_INVALID_KEY:
itayzafrir5c753392018-05-08 11:18:38 +0300297 return( PSA_ERROR_INVALID_ARGUMENT );
itayzafrir7b30f8b2018-05-09 16:07:36 +0300298 case MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL:
299 return( PSA_ERROR_BUFFER_TOO_SMALL );
300 case MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE:
301 return( PSA_ERROR_NOT_SUPPORTED );
302 case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH:
303 case MBEDTLS_ERR_ECP_VERIFY_FAILED:
304 return( PSA_ERROR_INVALID_SIGNATURE );
305 case MBEDTLS_ERR_ECP_ALLOC_FAILED:
306 return( PSA_ERROR_INSUFFICIENT_MEMORY );
Gilles Peskine40d81602020-11-25 00:09:47 +0100307 case MBEDTLS_ERR_ECP_RANDOM_FAILED:
308 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
Gilles Peskine40d81602020-11-25 00:09:47 +0100309
Janos Follatha13b9052019-11-22 12:48:59 +0000310 case MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED:
311 return( PSA_ERROR_CORRUPTION_DETECTED );
itayzafrir5c753392018-05-08 11:18:38 +0300312
Gilles Peskinee59236f2018-01-27 23:32:46 +0100313 default:
David Saadab4ecc272019-02-14 13:48:10 +0200314 return( PSA_ERROR_GENERIC_ERROR );
Gilles Peskinee59236f2018-01-27 23:32:46 +0100315 }
316}
317
Gilles Peskineb0b255c2018-07-06 17:01:38 +0200318
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +0200319
320
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100321/****************************************************************/
322/* Key management */
323/****************************************************************/
324
John Durkop07cc04a2020-11-16 22:08:34 -0800325/* For now the MBEDTLS_PSA_ACCEL_ guards are also used here since the
326 * current test driver in key_management.c is using this function
327 * when accelerators are used for ECC key pair and public key.
328 * Once that dependency is resolved these guards can be removed.
329 */
John Durkop9814fa22020-11-04 12:28:15 -0800330#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
John Durkop6ba40d12020-11-10 08:50:04 -0800331 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) || \
332 defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR) || \
333 defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY)
Paul Elliott8ff510a2020-06-02 17:19:28 +0100334mbedtls_ecp_group_id mbedtls_ecc_group_of_psa( psa_ecc_family_t curve,
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100335 size_t bits,
336 int bits_is_sloppy )
Gilles Peskine12313cd2018-06-20 00:20:32 +0200337{
338 switch( curve )
339 {
Paul Elliott8ff510a2020-06-02 17:19:28 +0100340 case PSA_ECC_FAMILY_SECP_R1:
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100341 switch( bits )
Gilles Peskine228abc52019-12-03 17:24:19 +0100342 {
Gilles Peskinea1684f42021-03-23 13:12:34 +0100343#if defined(PSA_WANT_ECC_SECP_R1_192)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100344 case 192:
Gilles Peskine228abc52019-12-03 17:24:19 +0100345 return( MBEDTLS_ECP_DP_SECP192R1 );
Gilles Peskinea1684f42021-03-23 13:12:34 +0100346#endif
347#if defined(PSA_WANT_ECC_SECP_R1_224)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100348 case 224:
Gilles Peskine228abc52019-12-03 17:24:19 +0100349 return( MBEDTLS_ECP_DP_SECP224R1 );
Gilles Peskinea1684f42021-03-23 13:12:34 +0100350#endif
351#if defined(PSA_WANT_ECC_SECP_R1_256)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100352 case 256:
Gilles Peskine228abc52019-12-03 17:24:19 +0100353 return( MBEDTLS_ECP_DP_SECP256R1 );
Gilles Peskinea1684f42021-03-23 13:12:34 +0100354#endif
355#if defined(PSA_WANT_ECC_SECP_R1_384)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100356 case 384:
Gilles Peskine228abc52019-12-03 17:24:19 +0100357 return( MBEDTLS_ECP_DP_SECP384R1 );
Gilles Peskinea1684f42021-03-23 13:12:34 +0100358#endif
359#if defined(PSA_WANT_ECC_SECP_R1_521)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100360 case 521:
Gilles Peskine228abc52019-12-03 17:24:19 +0100361 return( MBEDTLS_ECP_DP_SECP521R1 );
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100362 case 528:
363 if( bits_is_sloppy )
364 return( MBEDTLS_ECP_DP_SECP521R1 );
365 break;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100366#endif
Gilles Peskine228abc52019-12-03 17:24:19 +0100367 }
368 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100369
Paul Elliott8ff510a2020-06-02 17:19:28 +0100370 case PSA_ECC_FAMILY_BRAINPOOL_P_R1:
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100371 switch( bits )
Gilles Peskine228abc52019-12-03 17:24:19 +0100372 {
Gilles Peskinea1684f42021-03-23 13:12:34 +0100373#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100374 case 256:
Gilles Peskine228abc52019-12-03 17:24:19 +0100375 return( MBEDTLS_ECP_DP_BP256R1 );
Gilles Peskinea1684f42021-03-23 13:12:34 +0100376#endif
377#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100378 case 384:
Gilles Peskine228abc52019-12-03 17:24:19 +0100379 return( MBEDTLS_ECP_DP_BP384R1 );
Gilles Peskinea1684f42021-03-23 13:12:34 +0100380#endif
381#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100382 case 512:
Gilles Peskine228abc52019-12-03 17:24:19 +0100383 return( MBEDTLS_ECP_DP_BP512R1 );
Gilles Peskinea1684f42021-03-23 13:12:34 +0100384#endif
Gilles Peskine228abc52019-12-03 17:24:19 +0100385 }
386 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100387
Paul Elliott8ff510a2020-06-02 17:19:28 +0100388 case PSA_ECC_FAMILY_MONTGOMERY:
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100389 switch( bits )
Gilles Peskine228abc52019-12-03 17:24:19 +0100390 {
Gilles Peskinea1684f42021-03-23 13:12:34 +0100391#if defined(PSA_WANT_ECC_MONTGOMERY_255)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100392 case 255:
Gilles Peskine228abc52019-12-03 17:24:19 +0100393 return( MBEDTLS_ECP_DP_CURVE25519 );
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100394 case 256:
395 if( bits_is_sloppy )
396 return( MBEDTLS_ECP_DP_CURVE25519 );
397 break;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100398#endif
399#if defined(PSA_WANT_ECC_MONTGOMERY_448)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100400 case 448:
Gilles Peskine228abc52019-12-03 17:24:19 +0100401 return( MBEDTLS_ECP_DP_CURVE448 );
Gilles Peskinea1684f42021-03-23 13:12:34 +0100402#endif
Gilles Peskine228abc52019-12-03 17:24:19 +0100403 }
404 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100405
Paul Elliott8ff510a2020-06-02 17:19:28 +0100406 case PSA_ECC_FAMILY_SECP_K1:
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100407 switch( bits )
Gilles Peskine228abc52019-12-03 17:24:19 +0100408 {
Gilles Peskinea1684f42021-03-23 13:12:34 +0100409#if defined(PSA_WANT_ECC_SECP_K1_192)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100410 case 192:
Gilles Peskine228abc52019-12-03 17:24:19 +0100411 return( MBEDTLS_ECP_DP_SECP192K1 );
Gilles Peskinea1684f42021-03-23 13:12:34 +0100412#endif
413#if defined(PSA_WANT_ECC_SECP_K1_224)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100414 case 224:
Gilles Peskine228abc52019-12-03 17:24:19 +0100415 return( MBEDTLS_ECP_DP_SECP224K1 );
Gilles Peskinea1684f42021-03-23 13:12:34 +0100416#endif
417#if defined(PSA_WANT_ECC_SECP_K1_256)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100418 case 256:
Gilles Peskine228abc52019-12-03 17:24:19 +0100419 return( MBEDTLS_ECP_DP_SECP256K1 );
Gilles Peskinea1684f42021-03-23 13:12:34 +0100420#endif
Gilles Peskine228abc52019-12-03 17:24:19 +0100421 }
422 break;
Gilles Peskine12313cd2018-06-20 00:20:32 +0200423 }
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100424
Gilles Peskine71f45ba2021-03-23 14:17:55 +0100425 (void) bits_is_sloppy;
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100426 return( MBEDTLS_ECP_DP_NONE );
Gilles Peskine12313cd2018-06-20 00:20:32 +0200427}
John Durkop9814fa22020-11-04 12:28:15 -0800428#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
John Durkop6ba40d12020-11-10 08:50:04 -0800429 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) ||
430 * defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR) ||
431 * defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY) */
Gilles Peskine12313cd2018-06-20 00:20:32 +0200432
Archana4d7ae1d2021-07-07 02:50:22 +0530433psa_status_t psa_validate_unstructured_key_bit_size( psa_key_type_t type,
434 size_t bits )
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200435{
436 /* Check that the bit size is acceptable for the key type */
437 switch( type )
438 {
439 case PSA_KEY_TYPE_RAW_DATA:
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200440 case PSA_KEY_TYPE_HMAC:
Gilles Peskineea0fb492018-07-12 17:17:20 +0200441 case PSA_KEY_TYPE_DERIVE:
442 break;
Ronald Cron1f0db802021-03-12 09:59:30 +0100443#if defined(PSA_WANT_KEY_TYPE_AES)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200444 case PSA_KEY_TYPE_AES:
445 if( bits != 128 && bits != 192 && bits != 256 )
446 return( PSA_ERROR_INVALID_ARGUMENT );
447 break;
448#endif
Ronald Cron1f0db802021-03-12 09:59:30 +0100449#if defined(PSA_WANT_KEY_TYPE_CAMELLIA)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200450 case PSA_KEY_TYPE_CAMELLIA:
451 if( bits != 128 && bits != 192 && bits != 256 )
452 return( PSA_ERROR_INVALID_ARGUMENT );
453 break;
454#endif
Ronald Cron1f0db802021-03-12 09:59:30 +0100455#if defined(PSA_WANT_KEY_TYPE_DES)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200456 case PSA_KEY_TYPE_DES:
457 if( bits != 64 && bits != 128 && bits != 192 )
458 return( PSA_ERROR_INVALID_ARGUMENT );
459 break;
460#endif
Ronald Cron1f0db802021-03-12 09:59:30 +0100461#if defined(PSA_WANT_KEY_TYPE_CHACHA20)
Gilles Peskine26869f22019-05-06 15:25:00 +0200462 case PSA_KEY_TYPE_CHACHA20:
463 if( bits != 256 )
464 return( PSA_ERROR_INVALID_ARGUMENT );
465 break;
466#endif
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200467 default:
468 return( PSA_ERROR_NOT_SUPPORTED );
469 }
Gilles Peskineb54979a2018-06-21 09:32:47 +0200470 if( bits % 8 != 0 )
471 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200472
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200473 return( PSA_SUCCESS );
474}
475
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100476/** Check whether a given key type is valid for use with a given MAC algorithm
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100477 *
Steven Cooremancd640932021-03-08 12:00:27 +0100478 * Upon successful return of this function, the behavior of #PSA_MAC_LENGTH
479 * when called with the validated \p algorithm and \p key_type is well-defined.
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100480 *
481 * \param[in] algorithm The specific MAC algorithm (can be wildcard).
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100482 * \param[in] key_type The key type of the key to be used with the
483 * \p algorithm.
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100484 *
485 * \retval #PSA_SUCCESS
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100486 * The \p key_type is valid for use with the \p algorithm
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100487 * \retval #PSA_ERROR_INVALID_ARGUMENT
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100488 * The \p key_type is not valid for use with the \p algorithm
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100489 */
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100490MBEDTLS_STATIC_TESTABLE psa_status_t psa_mac_key_can_do(
Steven Cooreman58c94d32021-03-02 21:31:17 +0100491 psa_algorithm_t algorithm,
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100492 psa_key_type_t key_type )
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100493{
Steven Cooremancd640932021-03-08 12:00:27 +0100494 if( PSA_ALG_IS_HMAC( algorithm ) )
495 {
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100496 if( key_type == PSA_KEY_TYPE_HMAC )
497 return( PSA_SUCCESS );
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100498 }
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100499
500 if( PSA_ALG_IS_BLOCK_CIPHER_MAC( algorithm ) )
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100501 {
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100502 /* Check that we're calling PSA_BLOCK_CIPHER_BLOCK_LENGTH with a cipher
503 * key. */
504 if( ( key_type & PSA_KEY_TYPE_CATEGORY_MASK ) ==
505 PSA_KEY_TYPE_CATEGORY_SYMMETRIC )
506 {
507 /* PSA_BLOCK_CIPHER_BLOCK_LENGTH returns 1 for stream ciphers and
508 * the block length (larger than 1) for block ciphers. */
509 if( PSA_BLOCK_CIPHER_BLOCK_LENGTH( key_type ) > 1 )
510 return( PSA_SUCCESS );
511 }
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100512 }
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100513
514 return( PSA_ERROR_INVALID_ARGUMENT );
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100515}
516
Steven Cooreman7609b1f2021-04-06 16:45:06 +0200517psa_status_t psa_allocate_buffer_to_slot( psa_key_slot_t *slot,
518 size_t buffer_length )
Steven Cooreman75b74362020-07-28 14:30:13 +0200519{
Ronald Cronea0f8a62020-11-25 17:52:23 +0100520 if( slot->key.data != NULL )
Steven Cooreman29149862020-08-05 15:43:42 +0200521 return( PSA_ERROR_ALREADY_EXISTS );
Steven Cooreman75b74362020-07-28 14:30:13 +0200522
Ronald Cronea0f8a62020-11-25 17:52:23 +0100523 slot->key.data = mbedtls_calloc( 1, buffer_length );
524 if( slot->key.data == NULL )
Steven Cooreman29149862020-08-05 15:43:42 +0200525 return( PSA_ERROR_INSUFFICIENT_MEMORY );
Steven Cooreman75b74362020-07-28 14:30:13 +0200526
Ronald Cronea0f8a62020-11-25 17:52:23 +0100527 slot->key.bytes = buffer_length;
Steven Cooreman29149862020-08-05 15:43:42 +0200528 return( PSA_SUCCESS );
Steven Cooreman75b74362020-07-28 14:30:13 +0200529}
530
Steven Cooremanf7cebd42020-10-13 20:27:40 +0200531psa_status_t psa_copy_key_material_into_slot( psa_key_slot_t *slot,
532 const uint8_t* data,
533 size_t data_length )
534{
535 psa_status_t status = psa_allocate_buffer_to_slot( slot,
536 data_length );
537 if( status != PSA_SUCCESS )
538 return( status );
539
Ronald Cronea0f8a62020-11-25 17:52:23 +0100540 memcpy( slot->key.data, data, data_length );
Steven Cooremanf7cebd42020-10-13 20:27:40 +0200541 return( PSA_SUCCESS );
542}
543
Ronald Crona0fe59f2020-11-29 11:14:53 +0100544psa_status_t psa_import_key_into_slot(
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100545 const psa_key_attributes_t *attributes,
546 const uint8_t *data, size_t data_length,
547 uint8_t *key_buffer, size_t key_buffer_size,
548 size_t *key_buffer_length, size_t *bits )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100549{
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100550 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
551 psa_key_type_t type = attributes->core.type;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100552
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200553 /* zero-length keys are never supported. */
554 if( data_length == 0 )
555 return( PSA_ERROR_NOT_SUPPORTED );
556
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100557 if( key_type_is_raw_bytes( type ) )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100558 {
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100559 *bits = PSA_BYTES_TO_BITS( data_length );
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200560
Steven Cooreman75b74362020-07-28 14:30:13 +0200561 /* Ensure that the bytes-to-bits conversion hasn't overflown. */
562 if( data_length > SIZE_MAX / 8 )
Archana4d7ae1d2021-07-07 02:50:22 +0530563 return( status );
Steven Cooreman75b74362020-07-28 14:30:13 +0200564
Gilles Peskine1b9505c2019-08-07 10:59:45 +0200565 /* Enforce a size limit, and in particular ensure that the bit
566 * size fits in its representation type. */
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100567 if( ( *bits ) > PSA_MAX_KEY_BITS )
Archana4d7ae1d2021-07-07 02:50:22 +0530568 return( status );
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200569
Archana4d7ae1d2021-07-07 02:50:22 +0530570 status = psa_validate_unstructured_key_bit_size( attributes->core.type, *bits );
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200571 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +0200572 return( status );
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200573
Ronald Crondd04d422020-11-28 15:14:42 +0100574 /* Copy the key material. */
575 memcpy( key_buffer, data, data_length );
576 *key_buffer_length = data_length;
577 (void)key_buffer_size;
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200578
Steven Cooreman40120f62020-10-29 11:42:22 +0100579 return( PSA_SUCCESS );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100580 }
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100581 else if( PSA_KEY_TYPE_IS_ASYMMETRIC( type ) )
Steven Cooreman19fd5742020-07-24 23:31:01 +0200582 {
John Durkop9814fa22020-11-04 12:28:15 -0800583#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
584 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100585 if( PSA_KEY_TYPE_IS_ECC( type ) )
Steven Cooreman3ea0ce42020-10-23 11:37:05 +0200586 {
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100587 return( mbedtls_psa_ecp_import_key( attributes,
588 data, data_length,
589 key_buffer, key_buffer_size,
590 key_buffer_length,
591 bits ) );
Steven Cooreman40120f62020-10-29 11:42:22 +0100592 }
John Durkop9814fa22020-11-04 12:28:15 -0800593#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
594 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
John Durkop0e005192020-10-31 22:06:54 -0700595#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
596 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100597 if( PSA_KEY_TYPE_IS_RSA( type ) )
Steven Cooreman3ea0ce42020-10-23 11:37:05 +0200598 {
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100599 return( mbedtls_psa_rsa_import_key( attributes,
600 data, data_length,
601 key_buffer, key_buffer_size,
602 key_buffer_length,
603 bits ) );
Steven Cooreman3ea0ce42020-10-23 11:37:05 +0200604 }
John Durkop9814fa22020-11-04 12:28:15 -0800605#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
606 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100607 }
Steven Cooreman40120f62020-10-29 11:42:22 +0100608
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100609 return( PSA_ERROR_NOT_SUPPORTED );
Darryl Green06fd18d2018-07-16 11:21:11 +0100610}
611
Gilles Peskinef603c712019-01-19 13:40:11 +0100612/** Calculate the intersection of two algorithm usage policies.
613 *
614 * Return 0 (which allows no operation) on incompatibility.
615 */
616static psa_algorithm_t psa_key_policy_algorithm_intersection(
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100617 psa_key_type_t key_type,
Gilles Peskinef603c712019-01-19 13:40:11 +0100618 psa_algorithm_t alg1,
619 psa_algorithm_t alg2 )
620{
Gilles Peskine549ea862019-05-22 11:45:59 +0200621 /* Common case: both sides actually specify the same policy. */
Gilles Peskinef603c712019-01-19 13:40:11 +0100622 if( alg1 == alg2 )
623 return( alg1 );
Steven Cooreman03488022021-02-18 12:07:20 +0100624 /* If the policies are from the same hash-and-sign family, check
625 * if one is a wildcard. If so the other has the specific algorithm. */
626 if( PSA_ALG_IS_HASH_AND_SIGN( alg1 ) &&
627 PSA_ALG_IS_HASH_AND_SIGN( alg2 ) &&
628 ( alg1 & ~PSA_ALG_HASH_MASK ) == ( alg2 & ~PSA_ALG_HASH_MASK ) )
Gilles Peskinef603c712019-01-19 13:40:11 +0100629 {
Steven Cooreman03488022021-02-18 12:07:20 +0100630 if( PSA_ALG_SIGN_GET_HASH( alg1 ) == PSA_ALG_ANY_HASH )
631 return( alg2 );
632 if( PSA_ALG_SIGN_GET_HASH( alg2 ) == PSA_ALG_ANY_HASH )
633 return( alg1 );
634 }
635 /* If the policies are from the same AEAD family, check whether
Steven Cooreman7de9e2d2021-02-22 17:05:56 +0100636 * one of them is a minimum-tag-length wildcard. Calculate the most
Steven Cooreman03488022021-02-18 12:07:20 +0100637 * restrictive tag length. */
638 if( PSA_ALG_IS_AEAD( alg1 ) && PSA_ALG_IS_AEAD( alg2 ) &&
639 ( PSA_ALG_AEAD_WITH_SHORTENED_TAG( alg1, 0 ) ==
640 PSA_ALG_AEAD_WITH_SHORTENED_TAG( alg2, 0 ) ) )
641 {
642 size_t alg1_len = PSA_ALG_AEAD_GET_TAG_LENGTH( alg1 );
643 size_t alg2_len = PSA_ALG_AEAD_GET_TAG_LENGTH( alg2 );
Steven Cooremancd640932021-03-08 12:00:27 +0100644 size_t restricted_len = alg1_len > alg2_len ? alg1_len : alg2_len;
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100645
Steven Cooreman7de9e2d2021-02-22 17:05:56 +0100646 /* If both are wildcards, return most restrictive wildcard */
Steven Cooremand927ed72021-02-22 19:59:35 +0100647 if( ( ( alg1 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG ) != 0 ) &&
648 ( ( alg2 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG ) != 0 ) )
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100649 {
Steven Cooremancd640932021-03-08 12:00:27 +0100650 return( PSA_ALG_AEAD_WITH_AT_LEAST_THIS_LENGTH_TAG(
651 alg1, restricted_len ) );
Steven Cooreman03488022021-02-18 12:07:20 +0100652 }
653 /* If only one is a wildcard, return specific algorithm if compatible. */
Steven Cooremand927ed72021-02-22 19:59:35 +0100654 if( ( ( alg1 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG ) != 0 ) &&
Steven Cooreman03488022021-02-18 12:07:20 +0100655 ( alg1_len <= alg2_len ) )
656 {
657 return( alg2 );
658 }
Steven Cooremand927ed72021-02-22 19:59:35 +0100659 if( ( ( alg2 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG ) != 0 ) &&
Steven Cooreman03488022021-02-18 12:07:20 +0100660 ( alg2_len <= alg1_len ) )
661 {
662 return( alg1 );
663 }
664 }
665 /* If the policies are from the same MAC family, check whether one
666 * of them is a minimum-MAC-length policy. Calculate the most
667 * restrictive tag length. */
668 if( PSA_ALG_IS_MAC( alg1 ) && PSA_ALG_IS_MAC( alg2 ) &&
669 ( PSA_ALG_FULL_LENGTH_MAC( alg1 ) ==
670 PSA_ALG_FULL_LENGTH_MAC( alg2 ) ) )
671 {
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100672 /* Validate the combination of key type and algorithm. Since the base
673 * algorithm of alg1 and alg2 are the same, we only need this once. */
674 if( PSA_SUCCESS != psa_mac_key_can_do( alg1, key_type ) )
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100675 return( 0 );
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100676
Steven Cooreman31a876d2021-03-03 20:47:40 +0100677 /* Get the (exact or at-least) output lengths for both sides of the
678 * requested intersection. None of the currently supported algorithms
679 * have an output length dependent on the actual key size, so setting it
680 * to a bogus value of 0 is currently OK.
681 *
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100682 * Note that for at-least-this-length wildcard algorithms, the output
683 * length is set to the shortest allowed length, which allows us to
684 * calculate the most restrictive tag length for the intersection. */
685 size_t alg1_len = PSA_MAC_LENGTH( key_type, 0, alg1 );
686 size_t alg2_len = PSA_MAC_LENGTH( key_type, 0, alg2 );
Steven Cooremancd640932021-03-08 12:00:27 +0100687 size_t restricted_len = alg1_len > alg2_len ? alg1_len : alg2_len;
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100688
Steven Cooremana1d83222021-02-25 10:20:29 +0100689 /* If both are wildcards, return most restrictive wildcard */
Steven Cooremand927ed72021-02-22 19:59:35 +0100690 if( ( ( alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG ) != 0 ) &&
691 ( ( alg2 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG ) != 0 ) )
Steven Cooreman03488022021-02-18 12:07:20 +0100692 {
Steven Cooremancd640932021-03-08 12:00:27 +0100693 return( PSA_ALG_AT_LEAST_THIS_LENGTH_MAC( alg1, restricted_len ) );
Steven Cooreman03488022021-02-18 12:07:20 +0100694 }
Steven Cooreman31a876d2021-03-03 20:47:40 +0100695
696 /* If only one is an at-least-this-length policy, the intersection would
697 * be the other (fixed-length) policy as long as said fixed length is
698 * equal to or larger than the shortest allowed length. */
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100699 if( ( alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG ) != 0 )
Steven Cooreman03488022021-02-18 12:07:20 +0100700 {
Steven Cooremancd640932021-03-08 12:00:27 +0100701 return( ( alg1_len <= alg2_len ) ? alg2 : 0 );
Steven Cooreman03488022021-02-18 12:07:20 +0100702 }
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100703 if( ( alg2 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG ) != 0 )
Steven Cooreman03488022021-02-18 12:07:20 +0100704 {
Steven Cooremancd640932021-03-08 12:00:27 +0100705 return( ( alg2_len <= alg1_len ) ? alg1 : 0 );
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100706 }
Steven Cooreman31a876d2021-03-03 20:47:40 +0100707
Steven Cooremancd640932021-03-08 12:00:27 +0100708 /* If none of them are wildcards, check whether they define the same tag
709 * length. This is still possible here when one is default-length and
710 * the other specific-length. Ensure to always return the
711 * specific-length version for the intersection. */
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100712 if( alg1_len == alg2_len )
713 return( PSA_ALG_TRUNCATED_MAC( alg1, alg1_len ) );
Gilles Peskinef603c712019-01-19 13:40:11 +0100714 }
715 /* If the policies are incompatible, allow nothing. */
716 return( 0 );
717}
718
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100719static int psa_key_algorithm_permits( psa_key_type_t key_type,
720 psa_algorithm_t policy_alg,
Gilles Peskined6f371b2019-05-10 19:33:38 +0200721 psa_algorithm_t requested_alg )
722{
Gilles Peskine549ea862019-05-22 11:45:59 +0200723 /* Common case: the policy only allows requested_alg. */
Gilles Peskined6f371b2019-05-10 19:33:38 +0200724 if( requested_alg == policy_alg )
725 return( 1 );
Steven Cooreman03488022021-02-18 12:07:20 +0100726 /* If policy_alg is a hash-and-sign with a wildcard for the hash,
727 * and requested_alg is the same hash-and-sign family with any hash,
728 * then requested_alg is compliant with policy_alg. */
729 if( PSA_ALG_IS_HASH_AND_SIGN( requested_alg ) &&
730 PSA_ALG_SIGN_GET_HASH( policy_alg ) == PSA_ALG_ANY_HASH )
Gilles Peskined6f371b2019-05-10 19:33:38 +0200731 {
Steven Cooreman03488022021-02-18 12:07:20 +0100732 return( ( policy_alg & ~PSA_ALG_HASH_MASK ) ==
733 ( requested_alg & ~PSA_ALG_HASH_MASK ) );
734 }
735 /* If policy_alg is a wildcard AEAD algorithm of the same base as
736 * the requested algorithm, check the requested tag length to be
737 * equal-length or longer than the wildcard-specified length. */
738 if( PSA_ALG_IS_AEAD( policy_alg ) &&
739 PSA_ALG_IS_AEAD( requested_alg ) &&
740 ( PSA_ALG_AEAD_WITH_SHORTENED_TAG( policy_alg, 0 ) ==
741 PSA_ALG_AEAD_WITH_SHORTENED_TAG( requested_alg, 0 ) ) &&
Steven Cooremand927ed72021-02-22 19:59:35 +0100742 ( ( policy_alg & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG ) != 0 ) )
Steven Cooreman03488022021-02-18 12:07:20 +0100743 {
744 return( PSA_ALG_AEAD_GET_TAG_LENGTH( policy_alg ) <=
745 PSA_ALG_AEAD_GET_TAG_LENGTH( requested_alg ) );
746 }
Steven Cooremancd640932021-03-08 12:00:27 +0100747 /* If policy_alg is a MAC algorithm of the same base as the requested
748 * algorithm, check whether their MAC lengths are compatible. */
Steven Cooreman03488022021-02-18 12:07:20 +0100749 if( PSA_ALG_IS_MAC( policy_alg ) &&
750 PSA_ALG_IS_MAC( requested_alg ) &&
751 ( PSA_ALG_FULL_LENGTH_MAC( policy_alg ) ==
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100752 PSA_ALG_FULL_LENGTH_MAC( requested_alg ) ) )
Steven Cooreman03488022021-02-18 12:07:20 +0100753 {
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100754 /* Validate the combination of key type and algorithm. Since the policy
755 * and requested algorithms are the same, we only need this once. */
756 if( PSA_SUCCESS != psa_mac_key_can_do( policy_alg, key_type ) )
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100757 return( 0 );
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100758
Steven Cooreman31a876d2021-03-03 20:47:40 +0100759 /* Get both the requested output length for the algorithm which is to be
760 * verified, and the default output length for the base algorithm.
761 * Note that none of the currently supported algorithms have an output
762 * length dependent on actual key size, so setting it to a bogus value
763 * of 0 is currently OK. */
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100764 size_t requested_output_length = PSA_MAC_LENGTH(
765 key_type, 0, requested_alg );
766 size_t default_output_length = PSA_MAC_LENGTH(
767 key_type, 0,
768 PSA_ALG_FULL_LENGTH_MAC( requested_alg ) );
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100769
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100770 /* If the policy is default-length, only allow an algorithm with
771 * a declared exact-length matching the default. */
772 if( PSA_MAC_TRUNCATED_LENGTH( policy_alg ) == 0 )
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100773 return( requested_output_length == default_output_length );
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100774
775 /* If the requested algorithm is default-length, allow it if the policy
Steven Cooremancd640932021-03-08 12:00:27 +0100776 * length exactly matches the default length. */
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100777 if( PSA_MAC_TRUNCATED_LENGTH( requested_alg ) == 0 &&
778 PSA_MAC_TRUNCATED_LENGTH( policy_alg ) == default_output_length )
779 {
780 return( 1 );
781 }
782
Steven Cooremancd640932021-03-08 12:00:27 +0100783 /* If policy_alg is an at-least-this-length wildcard MAC algorithm,
784 * check for the requested MAC length to be equal to or longer than the
785 * minimum allowed length. */
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100786 if( ( policy_alg & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG ) != 0 )
787 {
788 return( PSA_MAC_TRUNCATED_LENGTH( policy_alg ) <=
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100789 requested_output_length );
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100790 }
Gilles Peskined6f371b2019-05-10 19:33:38 +0200791 }
Steven Cooremance48e852020-10-05 16:02:45 +0200792 /* If policy_alg is a generic key agreement operation, then using it for
Steven Cooremanfa5e6312020-10-15 17:07:12 +0200793 * a key derivation with that key agreement should also be allowed. This
794 * behaviour is expected to be defined in a future specification version. */
Steven Cooremance48e852020-10-05 16:02:45 +0200795 if( PSA_ALG_IS_RAW_KEY_AGREEMENT( policy_alg ) &&
796 PSA_ALG_IS_KEY_AGREEMENT( requested_alg ) )
797 {
798 return( PSA_ALG_KEY_AGREEMENT_GET_BASE( requested_alg ) ==
799 policy_alg );
800 }
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100801 /* If it isn't explicitly permitted, it's forbidden. */
Gilles Peskined6f371b2019-05-10 19:33:38 +0200802 return( 0 );
803}
804
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100805/** Test whether a policy permits an algorithm.
806 *
807 * The caller must test usage flags separately.
Steven Cooreman7e39f052021-02-23 14:18:32 +0100808 *
Steven Cooreman5a172672021-03-02 21:27:42 +0100809 * \note This function requires providing the key type for which the policy is
810 * being validated, since some algorithm policy definitions (e.g. MAC)
811 * have different properties depending on what kind of cipher it is
812 * combined with.
813 *
Steven Cooreman7e39f052021-02-23 14:18:32 +0100814 * \retval PSA_SUCCESS When \p alg is a specific algorithm
815 * allowed by the \p policy.
816 * \retval PSA_ERROR_INVALID_ARGUMENT When \p alg is not a specific algorithm
817 * \retval PSA_ERROR_NOT_PERMITTED When \p alg is a specific algorithm, but
818 * the \p policy does not allow it.
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100819 */
Steven Cooreman7e39f052021-02-23 14:18:32 +0100820static psa_status_t psa_key_policy_permits( const psa_key_policy_t *policy,
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100821 psa_key_type_t key_type,
Steven Cooreman7e39f052021-02-23 14:18:32 +0100822 psa_algorithm_t alg )
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100823{
Steven Cooremand788fab2021-02-25 11:29:17 +0100824 /* '0' is not a valid algorithm */
825 if( alg == 0 )
826 return( PSA_ERROR_INVALID_ARGUMENT );
827
Steven Cooreman7e39f052021-02-23 14:18:32 +0100828 /* A requested algorithm cannot be a wildcard. */
829 if( PSA_ALG_IS_WILDCARD( alg ) )
830 return( PSA_ERROR_INVALID_ARGUMENT );
831
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100832 if( psa_key_algorithm_permits( key_type, policy->alg, alg ) ||
833 psa_key_algorithm_permits( key_type, policy->alg2, alg ) )
Steven Cooreman7e39f052021-02-23 14:18:32 +0100834 return( PSA_SUCCESS );
835 else
836 return( PSA_ERROR_NOT_PERMITTED );
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100837}
838
Gilles Peskinef603c712019-01-19 13:40:11 +0100839/** Restrict a key policy based on a constraint.
840 *
Steven Cooreman5a172672021-03-02 21:27:42 +0100841 * \note This function requires providing the key type for which the policy is
842 * being restricted, since some algorithm policy definitions (e.g. MAC)
843 * have different properties depending on what kind of cipher it is
844 * combined with.
845 *
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100846 * \param[in] key_type The key type for which to restrict the policy
Gilles Peskinef603c712019-01-19 13:40:11 +0100847 * \param[in,out] policy The policy to restrict.
848 * \param[in] constraint The policy constraint to apply.
849 *
850 * \retval #PSA_SUCCESS
851 * \c *policy contains the intersection of the original value of
852 * \c *policy and \c *constraint.
853 * \retval #PSA_ERROR_INVALID_ARGUMENT
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100854 * \c key_type, \c *policy and \c *constraint are incompatible.
Gilles Peskinef603c712019-01-19 13:40:11 +0100855 * \c *policy is unchanged.
856 */
857static psa_status_t psa_restrict_key_policy(
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100858 psa_key_type_t key_type,
Gilles Peskinef603c712019-01-19 13:40:11 +0100859 psa_key_policy_t *policy,
860 const psa_key_policy_t *constraint )
861{
862 psa_algorithm_t intersection_alg =
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100863 psa_key_policy_algorithm_intersection( key_type, policy->alg,
864 constraint->alg );
Gilles Peskined6f371b2019-05-10 19:33:38 +0200865 psa_algorithm_t intersection_alg2 =
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100866 psa_key_policy_algorithm_intersection( key_type, policy->alg2,
867 constraint->alg2 );
Gilles Peskinef603c712019-01-19 13:40:11 +0100868 if( intersection_alg == 0 && policy->alg != 0 && constraint->alg != 0 )
869 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskined6f371b2019-05-10 19:33:38 +0200870 if( intersection_alg2 == 0 && policy->alg2 != 0 && constraint->alg2 != 0 )
871 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskinef603c712019-01-19 13:40:11 +0100872 policy->usage &= constraint->usage;
873 policy->alg = intersection_alg;
Gilles Peskined6f371b2019-05-10 19:33:38 +0200874 policy->alg2 = intersection_alg2;
Gilles Peskinef603c712019-01-19 13:40:11 +0100875 return( PSA_SUCCESS );
876}
877
Ronald Cron5c522922020-11-14 16:35:34 +0100878/** Get the description of a key given its identifier and policy constraints
879 * and lock it.
Ronald Cronf95a2b12020-10-22 15:24:49 +0200880 *
Ronald Cron5c522922020-11-14 16:35:34 +0100881 * The key must have allow all the usage flags set in \p usage. If \p alg is
Steven Cooremand788fab2021-02-25 11:29:17 +0100882 * nonzero, the key must allow operations with this algorithm. If \p alg is
883 * zero, the algorithm is not checked.
Ronald Cron7587ae42020-11-11 15:04:25 +0100884 *
Ronald Cron5c522922020-11-14 16:35:34 +0100885 * In case of a persistent key, the function loads the description of the key
886 * into a key slot if not already done.
887 *
888 * On success, the returned key slot is locked. It is the responsibility of
889 * the caller to unlock the key slot when it does not access it anymore.
Ronald Cronf95a2b12020-10-22 15:24:49 +0200890 */
Ronald Cron5c522922020-11-14 16:35:34 +0100891static psa_status_t psa_get_and_lock_key_slot_with_policy(
892 mbedtls_svc_key_id_t key,
893 psa_key_slot_t **p_slot,
894 psa_key_usage_t usage,
895 psa_algorithm_t alg )
Darryl Green06fd18d2018-07-16 11:21:11 +0100896{
Ronald Cronf95a2b12020-10-22 15:24:49 +0200897 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
898 psa_key_slot_t *slot;
Darryl Green06fd18d2018-07-16 11:21:11 +0100899
Ronald Cron5c522922020-11-14 16:35:34 +0100900 status = psa_get_and_lock_key_slot( key, p_slot );
Darryl Green06fd18d2018-07-16 11:21:11 +0100901 if( status != PSA_SUCCESS )
902 return( status );
Ronald Cronf95a2b12020-10-22 15:24:49 +0200903 slot = *p_slot;
Darryl Green06fd18d2018-07-16 11:21:11 +0100904
905 /* Enforce that usage policy for the key slot contains all the flags
906 * required by the usage parameter. There is one exception: public
907 * keys can always be exported, so we treat public key objects as
908 * if they had the export flag. */
Gilles Peskine8e338702019-07-30 20:06:31 +0200909 if( PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->attr.type ) )
Darryl Green06fd18d2018-07-16 11:21:11 +0100910 usage &= ~PSA_KEY_USAGE_EXPORT;
Ronald Cronf95a2b12020-10-22 15:24:49 +0200911
Gilles Peskine8e338702019-07-30 20:06:31 +0200912 if( ( slot->attr.policy.usage & usage ) != usage )
Steven Cooreman328f11c2021-03-02 11:44:51 +0100913 {
914 status = PSA_ERROR_NOT_PERMITTED;
Ronald Cronf95a2b12020-10-22 15:24:49 +0200915 goto error;
Steven Cooreman328f11c2021-03-02 11:44:51 +0100916 }
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100917
918 /* Enforce that the usage policy permits the requested algortihm. */
Steven Cooreman7e39f052021-02-23 14:18:32 +0100919 if( alg != 0 )
920 {
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100921 status = psa_key_policy_permits( &slot->attr.policy,
922 slot->attr.type,
923 alg );
Steven Cooreman7e39f052021-02-23 14:18:32 +0100924 if( status != PSA_SUCCESS )
925 goto error;
926 }
Darryl Green06fd18d2018-07-16 11:21:11 +0100927
Darryl Green06fd18d2018-07-16 11:21:11 +0100928 return( PSA_SUCCESS );
Ronald Cronf95a2b12020-10-22 15:24:49 +0200929
930error:
931 *p_slot = NULL;
Ronald Cron5c522922020-11-14 16:35:34 +0100932 psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +0200933
934 return( status );
Darryl Green06fd18d2018-07-16 11:21:11 +0100935}
Darryl Green940d72c2018-07-13 13:18:51 +0100936
Ronald Cron5c522922020-11-14 16:35:34 +0100937/** Get a key slot containing a transparent key and lock it.
Gilles Peskine28f8f302019-07-24 13:30:31 +0200938 *
939 * A transparent key is a key for which the key material is directly
Ronald Cronddae0f52021-08-24 15:39:44 +0200940 * available, as opposed to a key in a secure element and/or to be used
941 * by a secure element.
Gilles Peskine28f8f302019-07-24 13:30:31 +0200942 *
Ronald Cronddae0f52021-08-24 15:39:44 +0200943 * This is a temporary function that may be used instead of
944 * psa_get_and_lock_key_slot_with_policy() when there is no opaque key support
945 * for a cryptographic operation.
Ronald Cronf95a2b12020-10-22 15:24:49 +0200946 *
Ronald Cron5c522922020-11-14 16:35:34 +0100947 * On success, the returned key slot is locked. It is the responsibility of the
948 * caller to unlock the key slot when it does not access it anymore.
Gilles Peskine28f8f302019-07-24 13:30:31 +0200949 */
Ronald Cron5c522922020-11-14 16:35:34 +0100950static psa_status_t psa_get_and_lock_transparent_key_slot_with_policy(
951 mbedtls_svc_key_id_t key,
952 psa_key_slot_t **p_slot,
953 psa_key_usage_t usage,
954 psa_algorithm_t alg )
Gilles Peskine28f8f302019-07-24 13:30:31 +0200955{
Ronald Cron5c522922020-11-14 16:35:34 +0100956 psa_status_t status = psa_get_and_lock_key_slot_with_policy( key, p_slot,
957 usage, alg );
Gilles Peskine28f8f302019-07-24 13:30:31 +0200958 if( status != PSA_SUCCESS )
959 return( status );
Ronald Cronf95a2b12020-10-22 15:24:49 +0200960
Ronald Cronddae0f52021-08-24 15:39:44 +0200961 if( psa_key_lifetime_is_external( (*p_slot)->attr.lifetime ) )
Gilles Peskine28f8f302019-07-24 13:30:31 +0200962 {
Ronald Cron5c522922020-11-14 16:35:34 +0100963 psa_unlock_key_slot( *p_slot );
Gilles Peskine28f8f302019-07-24 13:30:31 +0200964 *p_slot = NULL;
965 return( PSA_ERROR_NOT_SUPPORTED );
966 }
Ronald Cronf95a2b12020-10-22 15:24:49 +0200967
Gilles Peskine28f8f302019-07-24 13:30:31 +0200968 return( PSA_SUCCESS );
969}
Gilles Peskine28f8f302019-07-24 13:30:31 +0200970
Steven Cooreman7ddee7f2021-04-07 18:08:30 +0200971psa_status_t psa_remove_key_data_from_memory( psa_key_slot_t *slot )
Darryl Green40225ba2018-11-15 14:48:15 +0000972{
Ronald Cronea0f8a62020-11-25 17:52:23 +0100973 /* Data pointer will always be either a valid pointer or NULL in an
974 * initialized slot, so we can just free it. */
975 if( slot->key.data != NULL )
976 mbedtls_platform_zeroize( slot->key.data, slot->key.bytes);
977
978 mbedtls_free( slot->key.data );
979 slot->key.data = NULL;
980 slot->key.bytes = 0;
Darryl Green40225ba2018-11-15 14:48:15 +0000981
982 return( PSA_SUCCESS );
983}
984
Gilles Peskinef77ed1f2018-12-03 11:58:46 +0100985/** Completely wipe a slot in memory, including its policy.
986 * Persistent storage is not affected. */
Gilles Peskine66fb1262018-12-10 16:29:04 +0100987psa_status_t psa_wipe_key_slot( psa_key_slot_t *slot )
Gilles Peskinef77ed1f2018-12-03 11:58:46 +0100988{
989 psa_status_t status = psa_remove_key_data_from_memory( slot );
Ronald Cronddd3d052020-10-30 14:07:07 +0100990
TRodziewicz18cddc02021-07-13 12:19:15 +0200991 /*
992 * As the return error code may not be handled in case of multiple errors,
TRodziewiczc9890e92021-07-14 10:16:26 +0200993 * do our best to report an unexpected lock counter. Assert with
994 * MBEDTLS_TEST_HOOK_TEST_ASSERT that the lock counter is equal to one:
995 * if the MBEDTLS_TEST_HOOKS configuration option is enabled and the
996 * function is called as part of the execution of a test suite, the
997 * execution of the test suite is stopped in error if the assertion fails.
TRodziewicz18cddc02021-07-13 12:19:15 +0200998 */
Ronald Cron5c522922020-11-14 16:35:34 +0100999 if( slot->lock_count != 1 )
Ronald Cronddd3d052020-10-30 14:07:07 +01001000 {
TRodziewicz7871c2e2021-07-07 17:29:43 +02001001 MBEDTLS_TEST_HOOK_TEST_ASSERT( slot->lock_count == 1 );
Ronald Cronddd3d052020-10-30 14:07:07 +01001002 status = PSA_ERROR_CORRUPTION_DETECTED;
1003 }
1004
Gilles Peskine3f7cd622019-08-13 15:01:08 +02001005 /* Multipart operations may still be using the key. This is safe
1006 * because all multipart operation objects are independent from
1007 * the key slot: if they need to access the key after the setup
1008 * phase, they have a copy of the key. Note that this means that
1009 * key material can linger until all operations are completed. */
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001010 /* At this point, key material and other type-specific content has
1011 * been wiped. Clear remaining metadata. We can call memset and not
1012 * zeroize because the metadata is not particularly sensitive. */
1013 memset( slot, 0, sizeof( *slot ) );
1014 return( status );
1015}
1016
Ronald Croncf56a0a2020-08-04 09:51:30 +02001017psa_status_t psa_destroy_key( mbedtls_svc_key_id_t key )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001018{
Gilles Peskine2f060a82018-12-04 17:12:32 +01001019 psa_key_slot_t *slot;
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001020 psa_status_t status; /* status of the last operation */
1021 psa_status_t overall_status = PSA_SUCCESS;
Gilles Peskine354f7672019-07-12 23:46:38 +02001022#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1023 psa_se_drv_table_entry_t *driver;
1024#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001025
Ronald Croncf56a0a2020-08-04 09:51:30 +02001026 if( mbedtls_svc_key_id_is_null( key ) )
Gilles Peskine1841cf42019-10-08 15:48:25 +02001027 return( PSA_SUCCESS );
1028
Ronald Cronf2911112020-10-29 17:51:10 +01001029 /*
Ronald Cron19daca92020-11-10 18:08:03 +01001030 * Get the description of the key in a key slot. In case of a persistent
Ronald Cronf2911112020-10-29 17:51:10 +01001031 * key, this will load the key description from persistent memory if not
1032 * done yet. We cannot avoid this loading as without it we don't know if
1033 * the key is operated by an SE or not and this information is needed by
1034 * the current implementation.
1035 */
Ronald Cron5c522922020-11-14 16:35:34 +01001036 status = psa_get_and_lock_key_slot( key, &slot );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02001037 if( status != PSA_SUCCESS )
1038 return( status );
Gilles Peskine354f7672019-07-12 23:46:38 +02001039
Ronald Cronf2911112020-10-29 17:51:10 +01001040 /*
1041 * If the key slot containing the key description is under access by the
1042 * library (apart from the present access), the key cannot be destroyed
1043 * yet. For the time being, just return in error. Eventually (to be
1044 * implemented), the key should be destroyed when all accesses have
1045 * stopped.
1046 */
Ronald Cron5c522922020-11-14 16:35:34 +01001047 if( slot->lock_count > 1 )
Ronald Cronf2911112020-10-29 17:51:10 +01001048 {
Ronald Cron5c522922020-11-14 16:35:34 +01001049 psa_unlock_key_slot( slot );
Ronald Cronf2911112020-10-29 17:51:10 +01001050 return( PSA_ERROR_GENERIC_ERROR );
1051 }
1052
Gilles Peskine6687cd02021-04-21 22:32:05 +02001053 if( PSA_KEY_LIFETIME_IS_READ_ONLY( slot->attr.lifetime ) )
1054 {
1055 /* Refuse the destruction of a read-only key (which may or may not work
1056 * if we attempt it, depending on whether the key is merely read-only
1057 * by policy or actually physically read-only).
Gilles Peskinef9a046e2021-06-07 23:27:54 +02001058 * Just do the best we can, which is to wipe the copy in memory
1059 * (done in this function's cleanup code). */
1060 overall_status = PSA_ERROR_NOT_PERMITTED;
1061 goto exit;
Gilles Peskine6687cd02021-04-21 22:32:05 +02001062 }
1063
Gilles Peskine354f7672019-07-12 23:46:38 +02001064#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine8e338702019-07-30 20:06:31 +02001065 driver = psa_get_se_driver_entry( slot->attr.lifetime );
Gilles Peskine354f7672019-07-12 23:46:38 +02001066 if( driver != NULL )
Gilles Peskinefc762652019-07-22 19:30:34 +02001067 {
Gilles Peskine60450a42019-07-25 11:32:45 +02001068 /* For a key in a secure element, we need to do three things:
1069 * remove the key file in internal storage, destroy the
1070 * key inside the secure element, and update the driver's
1071 * persistent data. Start a transaction that will encompass these
1072 * three actions. */
Gilles Peskinefc762652019-07-22 19:30:34 +02001073 psa_crypto_prepare_transaction( PSA_CRYPTO_TRANSACTION_DESTROY_KEY );
Gilles Peskine8e338702019-07-30 20:06:31 +02001074 psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
Ronald Cronea0f8a62020-11-25 17:52:23 +01001075 psa_crypto_transaction.key.slot = psa_key_slot_get_slot_number( slot );
Gilles Peskine8e338702019-07-30 20:06:31 +02001076 psa_crypto_transaction.key.id = slot->attr.id;
Gilles Peskinefc762652019-07-22 19:30:34 +02001077 status = psa_crypto_save_transaction( );
1078 if( status != PSA_SUCCESS )
1079 {
Gilles Peskine66be51c2019-07-25 18:02:52 +02001080 (void) psa_crypto_stop_transaction( );
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001081 /* We should still try to destroy the key in the secure
1082 * element and the key metadata in storage. This is especially
1083 * important if the error is that the storage is full.
1084 * But how to do it exactly without risking an inconsistent
1085 * state after a reset?
1086 * https://github.com/ARMmbed/mbed-crypto/issues/215
1087 */
1088 overall_status = status;
1089 goto exit;
Gilles Peskinefc762652019-07-22 19:30:34 +02001090 }
1091
Ronald Cronea0f8a62020-11-25 17:52:23 +01001092 status = psa_destroy_se_key( driver,
1093 psa_key_slot_get_slot_number( slot ) );
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001094 if( overall_status == PSA_SUCCESS )
1095 overall_status = status;
Gilles Peskinefc762652019-07-22 19:30:34 +02001096 }
Gilles Peskine354f7672019-07-12 23:46:38 +02001097#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1098
Darryl Greend49a4992018-06-18 17:27:26 +01001099#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Ronald Crond98059d2020-10-23 18:00:55 +02001100 if( ! PSA_KEY_LIFETIME_IS_VOLATILE( slot->attr.lifetime ) )
Darryl Greend49a4992018-06-18 17:27:26 +01001101 {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001102 status = psa_destroy_persistent_key( slot->attr.id );
1103 if( overall_status == PSA_SUCCESS )
1104 overall_status = status;
1105
Gilles Peskine9ce31c42019-08-13 15:14:20 +02001106 /* TODO: other slots may have a copy of the same key. We should
1107 * invalidate them.
1108 * https://github.com/ARMmbed/mbed-crypto/issues/214
1109 */
Darryl Greend49a4992018-06-18 17:27:26 +01001110 }
1111#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
Gilles Peskine354f7672019-07-12 23:46:38 +02001112
Gilles Peskinefc762652019-07-22 19:30:34 +02001113#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1114 if( driver != NULL )
1115 {
Gilles Peskine725f22a2019-07-25 11:31:48 +02001116 status = psa_save_se_persistent_data( driver );
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001117 if( overall_status == PSA_SUCCESS )
1118 overall_status = status;
1119 status = psa_crypto_stop_transaction( );
1120 if( overall_status == PSA_SUCCESS )
1121 overall_status = status;
Gilles Peskinefc762652019-07-22 19:30:34 +02001122 }
1123#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1124
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001125exit:
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001126 status = psa_wipe_key_slot( slot );
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001127 /* Prioritize CORRUPTION_DETECTED from wiping over a storage error */
Gilles Peskinef9a046e2021-06-07 23:27:54 +02001128 if( status != PSA_SUCCESS )
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001129 overall_status = status;
1130 return( overall_status );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001131}
1132
John Durkop07cc04a2020-11-16 22:08:34 -08001133#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
John Durkop0e005192020-10-31 22:06:54 -07001134 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Gilles Peskineb699f072019-04-26 16:06:02 +02001135static psa_status_t psa_get_rsa_public_exponent(
1136 const mbedtls_rsa_context *rsa,
1137 psa_key_attributes_t *attributes )
1138{
1139 mbedtls_mpi mpi;
Janos Follath24eed8d2019-11-22 13:21:35 +00001140 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskineb699f072019-04-26 16:06:02 +02001141 uint8_t *buffer = NULL;
1142 size_t buflen;
1143 mbedtls_mpi_init( &mpi );
1144
1145 ret = mbedtls_rsa_export( rsa, NULL, NULL, NULL, NULL, &mpi );
1146 if( ret != 0 )
1147 goto exit;
Gilles Peskine772c8b12019-04-26 17:37:21 +02001148 if( mbedtls_mpi_cmp_int( &mpi, 65537 ) == 0 )
1149 {
1150 /* It's the default value, which is reported as an empty string,
1151 * so there's nothing to do. */
1152 goto exit;
1153 }
Gilles Peskineb699f072019-04-26 16:06:02 +02001154
1155 buflen = mbedtls_mpi_size( &mpi );
1156 buffer = mbedtls_calloc( 1, buflen );
1157 if( buffer == NULL )
1158 {
1159 ret = MBEDTLS_ERR_MPI_ALLOC_FAILED;
1160 goto exit;
1161 }
1162 ret = mbedtls_mpi_write_binary( &mpi, buffer, buflen );
1163 if( ret != 0 )
1164 goto exit;
1165 attributes->domain_parameters = buffer;
1166 attributes->domain_parameters_size = buflen;
1167
1168exit:
1169 mbedtls_mpi_free( &mpi );
1170 if( ret != 0 )
1171 mbedtls_free( buffer );
1172 return( mbedtls_to_psa_error( ret ) );
1173}
John Durkop07cc04a2020-11-16 22:08:34 -08001174#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
John Durkop9814fa22020-11-04 12:28:15 -08001175 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Gilles Peskineb699f072019-04-26 16:06:02 +02001176
Gilles Peskinebfd322f2019-07-23 11:58:03 +02001177/** Retrieve all the publicly-accessible attributes of a key.
1178 */
Ronald Croncf56a0a2020-08-04 09:51:30 +02001179psa_status_t psa_get_key_attributes( mbedtls_svc_key_id_t key,
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001180 psa_key_attributes_t *attributes )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001181{
Ronald Cronf95a2b12020-10-22 15:24:49 +02001182 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01001183 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01001184 psa_key_slot_t *slot;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001185
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001186 psa_reset_key_attributes( attributes );
1187
Ronald Cron5c522922020-11-14 16:35:34 +01001188 status = psa_get_and_lock_key_slot_with_policy( key, &slot, 0, 0 );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02001189 if( status != PSA_SUCCESS )
1190 return( status );
Gilles Peskineb870b182018-07-06 16:02:09 +02001191
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001192 attributes->core = slot->attr;
Gilles Peskinec8000c02019-08-02 20:15:51 +02001193 attributes->core.flags &= ( MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY |
1194 MBEDTLS_PSA_KA_MASK_DUAL_USE );
1195
1196#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Ronald Cron512ad812021-08-24 15:50:05 +02001197 if( psa_get_se_driver_entry( slot->attr.lifetime ) != NULL )
Ronald Cronea0f8a62020-11-25 17:52:23 +01001198 psa_set_key_slot_number( attributes,
1199 psa_key_slot_get_slot_number( slot ) );
Gilles Peskinec8000c02019-08-02 20:15:51 +02001200#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskineb699f072019-04-26 16:06:02 +02001201
Gilles Peskine8e338702019-07-30 20:06:31 +02001202 switch( slot->attr.type )
Gilles Peskineb699f072019-04-26 16:06:02 +02001203 {
John Durkop07cc04a2020-11-16 22:08:34 -08001204#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
John Durkop0e005192020-10-31 22:06:54 -07001205 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Gilles Peskinec93b80c2019-05-16 19:39:54 +02001206 case PSA_KEY_TYPE_RSA_KEY_PAIR:
Gilles Peskineb699f072019-04-26 16:06:02 +02001207 case PSA_KEY_TYPE_RSA_PUBLIC_KEY:
Janos Follath1d57a202019-08-13 12:15:34 +01001208 /* TODO: reporting the public exponent for opaque keys
Gilles Peskinec9d7f942019-08-13 16:17:16 +02001209 * is not yet implemented.
1210 * https://github.com/ARMmbed/mbed-crypto/issues/216
1211 */
Ronald Cron9b8b69c2021-08-24 16:00:51 +02001212 if( ! psa_key_lifetime_is_external( slot->attr.lifetime ) )
Steven Cooremana01795d2020-07-24 22:48:15 +02001213 {
Steven Cooremana2371e52020-07-28 14:30:39 +02001214 mbedtls_rsa_context *rsa = NULL;
Steven Cooremana01795d2020-07-24 22:48:15 +02001215
Ronald Cron90857082020-11-25 14:58:33 +01001216 status = mbedtls_psa_rsa_load_representation(
1217 slot->attr.type,
1218 slot->key.data,
1219 slot->key.bytes,
1220 &rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02001221 if( status != PSA_SUCCESS )
1222 break;
1223
Steven Cooremana2371e52020-07-28 14:30:39 +02001224 status = psa_get_rsa_public_exponent( rsa,
Steven Cooremana01795d2020-07-24 22:48:15 +02001225 attributes );
Steven Cooremana2371e52020-07-28 14:30:39 +02001226 mbedtls_rsa_free( rsa );
1227 mbedtls_free( rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02001228 }
Gilles Peskineb699f072019-04-26 16:06:02 +02001229 break;
John Durkop07cc04a2020-11-16 22:08:34 -08001230#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
John Durkop9814fa22020-11-04 12:28:15 -08001231 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Gilles Peskineb699f072019-04-26 16:06:02 +02001232 default:
1233 /* Nothing else to do. */
1234 break;
1235 }
1236
1237 if( status != PSA_SUCCESS )
1238 psa_reset_key_attributes( attributes );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001239
Ronald Cron5c522922020-11-14 16:35:34 +01001240 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001241
Ronald Cron5c522922020-11-14 16:35:34 +01001242 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001243}
1244
Gilles Peskinec8000c02019-08-02 20:15:51 +02001245#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1246psa_status_t psa_get_key_slot_number(
1247 const psa_key_attributes_t *attributes,
1248 psa_key_slot_number_t *slot_number )
1249{
1250 if( attributes->core.flags & MBEDTLS_PSA_KA_FLAG_HAS_SLOT_NUMBER )
1251 {
1252 *slot_number = attributes->slot_number;
1253 return( PSA_SUCCESS );
1254 }
1255 else
1256 return( PSA_ERROR_INVALID_ARGUMENT );
1257}
1258#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1259
Ronald Crond18b5f82020-11-25 16:46:05 +01001260static psa_status_t psa_export_key_buffer_internal( const uint8_t *key_buffer,
1261 size_t key_buffer_size,
Steven Cooremana01795d2020-07-24 22:48:15 +02001262 uint8_t *data,
1263 size_t data_size,
1264 size_t *data_length )
1265{
Ronald Crond18b5f82020-11-25 16:46:05 +01001266 if( key_buffer_size > data_size )
Steven Cooremana01795d2020-07-24 22:48:15 +02001267 return( PSA_ERROR_BUFFER_TOO_SMALL );
Ronald Crond18b5f82020-11-25 16:46:05 +01001268 memcpy( data, key_buffer, key_buffer_size );
1269 memset( data + key_buffer_size, 0,
1270 data_size - key_buffer_size );
1271 *data_length = key_buffer_size;
Steven Cooremana01795d2020-07-24 22:48:15 +02001272 return( PSA_SUCCESS );
1273}
1274
Ronald Cron7285cda2020-11-26 14:46:37 +01001275psa_status_t psa_export_key_internal(
Ronald Crond18b5f82020-11-25 16:46:05 +01001276 const psa_key_attributes_t *attributes,
1277 const uint8_t *key_buffer, size_t key_buffer_size,
1278 uint8_t *data, size_t data_size, size_t *data_length )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001279{
Ronald Crond18b5f82020-11-25 16:46:05 +01001280 psa_key_type_t type = attributes->core.type;
1281
Ronald Crond18b5f82020-11-25 16:46:05 +01001282 if( key_type_is_raw_bytes( type ) ||
1283 PSA_KEY_TYPE_IS_RSA( type ) ||
1284 PSA_KEY_TYPE_IS_ECC( type ) )
Ronald Cron9486f9d2020-11-26 13:36:23 +01001285 {
1286 return( psa_export_key_buffer_internal(
Ronald Crond18b5f82020-11-25 16:46:05 +01001287 key_buffer, key_buffer_size,
1288 data, data_size, data_length ) );
Ronald Cron9486f9d2020-11-26 13:36:23 +01001289 }
1290 else
1291 {
1292 /* This shouldn't happen in the reference implementation, but
1293 it is valid for a special-purpose implementation to omit
1294 support for exporting certain key types. */
1295 return( PSA_ERROR_NOT_SUPPORTED );
1296 }
1297}
1298
1299psa_status_t psa_export_key( mbedtls_svc_key_id_t key,
1300 uint8_t *data,
1301 size_t data_size,
1302 size_t *data_length )
1303{
1304 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
1305 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
1306 psa_key_slot_t *slot;
1307
Ronald Crone907e552021-01-18 13:22:38 +01001308 /* Reject a zero-length output buffer now, since this can never be a
1309 * valid key representation. This way we know that data must be a valid
1310 * pointer and we can do things like memset(data, ..., data_size). */
1311 if( data_size == 0 )
1312 return( PSA_ERROR_BUFFER_TOO_SMALL );
1313
Ronald Cron9486f9d2020-11-26 13:36:23 +01001314 /* Set the key to empty now, so that even when there are errors, we always
1315 * set data_length to a value between 0 and data_size. On error, setting
1316 * the key to empty is a good choice because an empty key representation is
1317 * unlikely to be accepted anywhere. */
Jaeden Amerof24c7f82018-06-27 17:20:43 +01001318 *data_length = 0;
1319
Ronald Cron9486f9d2020-11-26 13:36:23 +01001320 /* Export requires the EXPORT flag. There is an exception for public keys,
1321 * which don't require any flag, but
1322 * psa_get_and_lock_key_slot_with_policy() takes care of this.
1323 */
1324 status = psa_get_and_lock_key_slot_with_policy( key, &slot,
1325 PSA_KEY_USAGE_EXPORT, 0 );
1326 if( status != PSA_SUCCESS )
1327 return( status );
mohammad160306e79202018-03-28 13:17:44 +03001328
Ronald Crond18b5f82020-11-25 16:46:05 +01001329 psa_key_attributes_t attributes = {
1330 .core = slot->attr
1331 };
Ronald Cron67227982020-11-26 15:16:05 +01001332 status = psa_driver_wrapper_export_key( &attributes,
Ronald Crond18b5f82020-11-25 16:46:05 +01001333 slot->key.data, slot->key.bytes,
1334 data, data_size, data_length );
Ronald Cron9486f9d2020-11-26 13:36:23 +01001335
Ronald Cron9486f9d2020-11-26 13:36:23 +01001336 unlock_status = psa_unlock_key_slot( slot );
1337
1338 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
1339}
1340
Ronald Cron7285cda2020-11-26 14:46:37 +01001341psa_status_t psa_export_public_key_internal(
Ronald Crond18b5f82020-11-25 16:46:05 +01001342 const psa_key_attributes_t *attributes,
1343 const uint8_t *key_buffer,
1344 size_t key_buffer_size,
1345 uint8_t *data,
1346 size_t data_size,
1347 size_t *data_length )
Ronald Cron9486f9d2020-11-26 13:36:23 +01001348{
Ronald Crond18b5f82020-11-25 16:46:05 +01001349 psa_key_type_t type = attributes->core.type;
Ronald Crond18b5f82020-11-25 16:46:05 +01001350
Ronald Crond18b5f82020-11-25 16:46:05 +01001351 if( PSA_KEY_TYPE_IS_RSA( type ) || PSA_KEY_TYPE_IS_ECC( type ) )
Moran Peker17e36e12018-05-02 12:55:20 +03001352 {
Ronald Crond18b5f82020-11-25 16:46:05 +01001353 if( PSA_KEY_TYPE_IS_PUBLIC_KEY( type ) )
Gilles Peskine969ac722018-01-28 18:16:59 +01001354 {
Steven Cooreman560c28a2020-07-24 23:20:24 +02001355 /* Exporting public -> public */
Ronald Cron9486f9d2020-11-26 13:36:23 +01001356 return( psa_export_key_buffer_internal(
Ronald Crond18b5f82020-11-25 16:46:05 +01001357 key_buffer, key_buffer_size,
1358 data, data_size, data_length ) );
Steven Cooreman560c28a2020-07-24 23:20:24 +02001359 }
Steven Cooremanb9b84422020-10-14 14:39:20 +02001360
Ronald Crond18b5f82020-11-25 16:46:05 +01001361 if( PSA_KEY_TYPE_IS_RSA( type ) )
Steven Cooreman560c28a2020-07-24 23:20:24 +02001362 {
John Durkop0e005192020-10-31 22:06:54 -07001363#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
1364 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Ronald Crone5ca3d82020-11-26 16:36:16 +01001365 return( mbedtls_psa_rsa_export_public_key( attributes,
1366 key_buffer,
1367 key_buffer_size,
1368 data,
1369 data_size,
1370 data_length ) );
Darryl Green9e2d7a02018-07-24 16:33:30 +01001371#else
Steven Cooreman560c28a2020-07-24 23:20:24 +02001372 /* We don't know how to convert a private RSA key to public. */
1373 return( PSA_ERROR_NOT_SUPPORTED );
John Durkop9814fa22020-11-04 12:28:15 -08001374#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
1375 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Gilles Peskine969ac722018-01-28 18:16:59 +01001376 }
1377 else
Moran Pekera998bc62018-04-16 18:16:20 +03001378 {
John Durkop6ba40d12020-11-10 08:50:04 -08001379#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
1380 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
Ronald Crone5ca3d82020-11-26 16:36:16 +01001381 return( mbedtls_psa_ecp_export_public_key( attributes,
1382 key_buffer,
1383 key_buffer_size,
1384 data,
1385 data_size,
1386 data_length ) );
Steven Cooreman560c28a2020-07-24 23:20:24 +02001387#else
1388 /* We don't know how to convert a private ECC key to public */
Moran Pekera998bc62018-04-16 18:16:20 +03001389 return( PSA_ERROR_NOT_SUPPORTED );
John Durkop9814fa22020-11-04 12:28:15 -08001390#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
1391 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
Moran Pekera998bc62018-04-16 18:16:20 +03001392 }
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001393 }
Steven Cooreman560c28a2020-07-24 23:20:24 +02001394 else
1395 {
1396 /* This shouldn't happen in the reference implementation, but
1397 it is valid for a special-purpose implementation to omit
1398 support for exporting certain key types. */
1399 return( PSA_ERROR_NOT_SUPPORTED );
1400 }
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001401}
Ronald Crond18b5f82020-11-25 16:46:05 +01001402
Ronald Croncf56a0a2020-08-04 09:51:30 +02001403psa_status_t psa_export_public_key( mbedtls_svc_key_id_t key,
Gilles Peskine2d277862018-06-18 15:41:12 +02001404 uint8_t *data,
1405 size_t data_size,
1406 size_t *data_length )
Moran Pekerdd4ea382018-04-03 15:30:03 +03001407{
Ronald Cronf95a2b12020-10-22 15:24:49 +02001408 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01001409 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01001410 psa_key_slot_t *slot;
Darryl Greendd8fb772018-11-07 16:00:44 +00001411
Ronald Crone907e552021-01-18 13:22:38 +01001412 /* Reject a zero-length output buffer now, since this can never be a
1413 * valid key representation. This way we know that data must be a valid
1414 * pointer and we can do things like memset(data, ..., data_size). */
1415 if( data_size == 0 )
1416 return( PSA_ERROR_BUFFER_TOO_SMALL );
1417
Darryl Greendd8fb772018-11-07 16:00:44 +00001418 /* Set the key to empty now, so that even when there are errors, we always
1419 * set data_length to a value between 0 and data_size. On error, setting
1420 * the key to empty is a good choice because an empty key representation is
1421 * unlikely to be accepted anywhere. */
1422 *data_length = 0;
1423
1424 /* Exporting a public key doesn't require a usage flag. */
Ronald Cron5c522922020-11-14 16:35:34 +01001425 status = psa_get_and_lock_key_slot_with_policy( key, &slot, 0, 0 );
Darryl Greendd8fb772018-11-07 16:00:44 +00001426 if( status != PSA_SUCCESS )
1427 return( status );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001428
Ronald Cron9486f9d2020-11-26 13:36:23 +01001429 if( ! PSA_KEY_TYPE_IS_ASYMMETRIC( slot->attr.type ) )
1430 {
1431 status = PSA_ERROR_INVALID_ARGUMENT;
1432 goto exit;
1433 }
1434
Ronald Crond18b5f82020-11-25 16:46:05 +01001435 psa_key_attributes_t attributes = {
1436 .core = slot->attr
1437 };
Ronald Cron67227982020-11-26 15:16:05 +01001438 status = psa_driver_wrapper_export_public_key(
Ronald Crond18b5f82020-11-25 16:46:05 +01001439 &attributes, slot->key.data, slot->key.bytes,
1440 data, data_size, data_length );
Ronald Cron9486f9d2020-11-26 13:36:23 +01001441
1442exit:
Ronald Cron5c522922020-11-14 16:35:34 +01001443 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001444
Ronald Cron5c522922020-11-14 16:35:34 +01001445 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Moran Pekerdd4ea382018-04-03 15:30:03 +03001446}
1447
Gilles Peskine91e8c332019-08-02 19:19:39 +02001448#if defined(static_assert)
1449static_assert( ( MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE ) == 0,
1450 "One or more key attribute flag is listed as both external-only and dual-use" );
Gilles Peskine5a680562019-08-05 17:32:13 +02001451static_assert( ( PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE ) == 0,
Gilles Peskine094dac12019-08-07 18:19:46 +02001452 "One or more key attribute flag is listed as both internal-only and dual-use" );
Gilles Peskine5a680562019-08-05 17:32:13 +02001453static_assert( ( PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY ) == 0,
Gilles Peskine91e8c332019-08-02 19:19:39 +02001454 "One or more key attribute flag is listed as both internal-only and external-only" );
1455#endif
1456
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001457/** Validate that a key policy is internally well-formed.
1458 *
1459 * This function only rejects invalid policies. It does not validate the
1460 * consistency of the policy with respect to other attributes of the key
1461 * such as the key type.
1462 */
1463static psa_status_t psa_validate_key_policy( const psa_key_policy_t *policy )
Gilles Peskine4747d192019-04-17 15:05:45 +02001464{
1465 if( ( policy->usage & ~( PSA_KEY_USAGE_EXPORT |
Gilles Peskine8e0206a2019-05-14 14:24:28 +02001466 PSA_KEY_USAGE_COPY |
Gilles Peskine4747d192019-04-17 15:05:45 +02001467 PSA_KEY_USAGE_ENCRYPT |
1468 PSA_KEY_USAGE_DECRYPT |
gabor-mezei-arm4a210192021-04-14 21:14:28 +02001469 PSA_KEY_USAGE_SIGN_MESSAGE |
1470 PSA_KEY_USAGE_VERIFY_MESSAGE |
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01001471 PSA_KEY_USAGE_SIGN_HASH |
1472 PSA_KEY_USAGE_VERIFY_HASH |
Manuel Pégourié-Gonnard805251b2021-05-04 09:49:59 +02001473 PSA_KEY_USAGE_VERIFY_DERIVATION |
Gilles Peskine4747d192019-04-17 15:05:45 +02001474 PSA_KEY_USAGE_DERIVE ) ) != 0 )
1475 return( PSA_ERROR_INVALID_ARGUMENT );
1476
Gilles Peskine4747d192019-04-17 15:05:45 +02001477 return( PSA_SUCCESS );
1478}
1479
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001480/** Validate the internal consistency of key attributes.
1481 *
1482 * This function only rejects invalid attribute values. If does not
1483 * validate the consistency of the attributes with any key data that may
1484 * be involved in the creation of the key.
1485 *
1486 * Call this function early in the key creation process.
1487 *
1488 * \param[in] attributes Key attributes for the new key.
1489 * \param[out] p_drv On any return, the driver for the key, if any.
1490 * NULL for a transparent key.
1491 *
1492 */
1493static psa_status_t psa_validate_key_attributes(
1494 const psa_key_attributes_t *attributes,
1495 psa_se_drv_table_entry_t **p_drv )
Darryl Green0c6575a2018-11-07 16:05:30 +00001496{
Steven Cooreman81fe7c32020-06-08 18:37:19 +02001497 psa_status_t status = PSA_ERROR_INVALID_ARGUMENT;
Ronald Crond2ed4812020-07-17 16:11:30 +02001498 psa_key_lifetime_t lifetime = psa_get_key_lifetime( attributes );
Ronald Cron65f38a32020-10-23 17:11:13 +02001499 mbedtls_svc_key_id_t key = psa_get_key_id( attributes );
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001500
Ronald Cron54b90082020-10-29 15:26:43 +01001501 status = psa_validate_key_location( lifetime, p_drv );
Steven Cooreman81fe7c32020-06-08 18:37:19 +02001502 if( status != PSA_SUCCESS )
1503 return( status );
1504
Ronald Crond2ed4812020-07-17 16:11:30 +02001505 status = psa_validate_key_persistence( lifetime );
Steven Cooreman81fe7c32020-06-08 18:37:19 +02001506 if( status != PSA_SUCCESS )
1507 return( status );
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001508
Ronald Cron65f38a32020-10-23 17:11:13 +02001509 if ( PSA_KEY_LIFETIME_IS_VOLATILE( lifetime ) )
1510 {
1511 if( MBEDTLS_SVC_KEY_ID_GET_KEY_ID( key ) != 0 )
1512 return( PSA_ERROR_INVALID_ARGUMENT );
1513 }
1514 else
Ronald Crond2ed4812020-07-17 16:11:30 +02001515 {
Ronald Cron77e412c2021-03-31 17:36:31 +02001516 if( !psa_is_valid_key_id( psa_get_key_id( attributes ), 0 ) )
1517 return( PSA_ERROR_INVALID_ARGUMENT );
Ronald Crond2ed4812020-07-17 16:11:30 +02001518 }
1519
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001520 status = psa_validate_key_policy( &attributes->core.policy );
Darryl Green0c6575a2018-11-07 16:05:30 +00001521 if( status != PSA_SUCCESS )
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001522 return( status );
1523
1524 /* Refuse to create overly large keys.
1525 * Note that this doesn't trigger on import if the attributes don't
1526 * explicitly specify a size (so psa_get_key_bits returns 0), so
1527 * psa_import_key() needs its own checks. */
1528 if( psa_get_key_bits( attributes ) > PSA_MAX_KEY_BITS )
1529 return( PSA_ERROR_NOT_SUPPORTED );
1530
Gilles Peskine91e8c332019-08-02 19:19:39 +02001531 /* Reject invalid flags. These should not be reachable through the API. */
1532 if( attributes->core.flags & ~ ( MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY |
1533 MBEDTLS_PSA_KA_MASK_DUAL_USE ) )
1534 return( PSA_ERROR_INVALID_ARGUMENT );
1535
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001536 return( PSA_SUCCESS );
1537}
1538
Gilles Peskine4747d192019-04-17 15:05:45 +02001539/** Prepare a key slot to receive key material.
1540 *
1541 * This function allocates a key slot and sets its metadata.
1542 *
1543 * If this function fails, call psa_fail_key_creation().
1544 *
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001545 * This function is intended to be used as follows:
1546 * -# Call psa_start_key_creation() to allocate a key slot, prepare
Ronald Croncf56a0a2020-08-04 09:51:30 +02001547 * it with the specified attributes, and in case of a volatile key assign it
1548 * a volatile key identifier.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001549 * -# Populate the slot with the key material.
1550 * -# Call psa_finish_key_creation() to finalize the creation of the slot.
1551 * In case of failure at any step, stop the sequence and call
1552 * psa_fail_key_creation().
1553 *
Ronald Cron5c522922020-11-14 16:35:34 +01001554 * On success, the key slot is locked. It is the responsibility of the caller
1555 * to unlock the key slot when it does not access it anymore.
Ronald Cronf95a2b12020-10-22 15:24:49 +02001556 *
Gilles Peskinedf179142019-07-15 22:02:14 +02001557 * \param method An identification of the calling function.
Gilles Peskine011e4282019-06-26 18:34:38 +02001558 * \param[in] attributes Key attributes for the new key.
Gilles Peskine011e4282019-06-26 18:34:38 +02001559 * \param[out] p_slot On success, a pointer to the prepared slot.
1560 * \param[out] p_drv On any return, the driver for the key, if any.
1561 * NULL for a transparent key.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001562 *
1563 * \retval #PSA_SUCCESS
1564 * The key slot is ready to receive key material.
1565 * \return If this function fails, the key slot is an invalid state.
1566 * You must call psa_fail_key_creation() to wipe and free the slot.
Gilles Peskine4747d192019-04-17 15:05:45 +02001567 */
1568static psa_status_t psa_start_key_creation(
Gilles Peskinedf179142019-07-15 22:02:14 +02001569 psa_key_creation_method_t method,
Gilles Peskine4747d192019-04-17 15:05:45 +02001570 const psa_key_attributes_t *attributes,
Gilles Peskine011e4282019-06-26 18:34:38 +02001571 psa_key_slot_t **p_slot,
Gilles Peskine8abe6a22019-07-12 23:40:35 +02001572 psa_se_drv_table_entry_t **p_drv )
Gilles Peskine4747d192019-04-17 15:05:45 +02001573{
1574 psa_status_t status;
Ronald Cron2a993152020-07-17 14:13:26 +02001575 psa_key_id_t volatile_key_id;
Gilles Peskine4747d192019-04-17 15:05:45 +02001576 psa_key_slot_t *slot;
1577
Gilles Peskinedf179142019-07-15 22:02:14 +02001578 (void) method;
Gilles Peskine011e4282019-06-26 18:34:38 +02001579 *p_drv = NULL;
1580
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001581 status = psa_validate_key_attributes( attributes, p_drv );
1582 if( status != PSA_SUCCESS )
1583 return( status );
1584
Ronald Cronc4d1b512020-07-31 11:26:37 +02001585 status = psa_get_empty_key_slot( &volatile_key_id, p_slot );
Gilles Peskine4747d192019-04-17 15:05:45 +02001586 if( status != PSA_SUCCESS )
1587 return( status );
1588 slot = *p_slot;
1589
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001590 /* We're storing the declared bit-size of the key. It's up to each
1591 * creation mechanism to verify that this information is correct.
1592 * It's automatically correct for mechanisms that use the bit-size as
Gilles Peskineb46bef22019-07-30 21:32:04 +02001593 * an input (generate, device) but not for those where the bit-size
Ronald Cronc4d1b512020-07-31 11:26:37 +02001594 * is optional (import, copy). In case of a volatile key, assign it the
1595 * volatile key identifier associated to the slot returned to contain its
1596 * definition. */
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001597
1598 slot->attr = attributes->core;
Ronald Cronc4d1b512020-07-31 11:26:37 +02001599 if( PSA_KEY_LIFETIME_IS_VOLATILE( slot->attr.lifetime ) )
1600 {
1601#if !defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER)
1602 slot->attr.id = volatile_key_id;
1603#else
1604 slot->attr.id.key_id = volatile_key_id;
1605#endif
1606 }
Gilles Peskinec744d992019-07-30 17:26:54 +02001607
Gilles Peskine91e8c332019-08-02 19:19:39 +02001608 /* Erase external-only flags from the internal copy. To access
Gilles Peskine013f5472019-08-07 15:42:14 +02001609 * external-only flags, query `attributes`. Thanks to the check
1610 * in psa_validate_key_attributes(), this leaves the dual-use
Gilles Peskineedbed562019-08-07 18:19:59 +02001611 * flags and any internal flag that psa_get_empty_key_slot()
Gilles Peskine013f5472019-08-07 15:42:14 +02001612 * may have set. */
1613 slot->attr.flags &= ~MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY;
Gilles Peskine91e8c332019-08-02 19:19:39 +02001614
Gilles Peskinecbaff462019-07-12 23:46:04 +02001615#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined7729582019-08-05 15:55:54 +02001616 /* For a key in a secure element, we need to do three things
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001617 * when creating or registering a persistent key:
Gilles Peskine60450a42019-07-25 11:32:45 +02001618 * create the key file in internal storage, create the
1619 * key inside the secure element, and update the driver's
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001620 * persistent data. This is done by starting a transaction that will
1621 * encompass these three actions.
1622 * For registering a volatile key, we just need to find an appropriate
1623 * slot number inside the SE. Since the key is designated volatile, creating
1624 * a transaction is not required. */
Gilles Peskine60450a42019-07-25 11:32:45 +02001625 /* The first thing to do is to find a slot number for the new key.
1626 * We save the slot number in persistent storage as part of the
1627 * transaction data. It will be needed to recover if the power
1628 * fails during the key creation process, to clean up on the secure
1629 * element side after restarting. Obtaining a slot number from the
1630 * secure element driver updates its persistent state, but we do not yet
1631 * save the driver's persistent state, so that if the power fails,
Gilles Peskinefc762652019-07-22 19:30:34 +02001632 * we can roll back to a state where the key doesn't exist. */
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001633 if( *p_drv != NULL )
Darryl Green0c6575a2018-11-07 16:05:30 +00001634 {
Ronald Cronea0f8a62020-11-25 17:52:23 +01001635 psa_key_slot_number_t slot_number;
Gilles Peskinee88c2c12019-08-05 16:44:14 +02001636 status = psa_find_se_slot_for_key( attributes, method, *p_drv,
Ronald Cronea0f8a62020-11-25 17:52:23 +01001637 &slot_number );
Gilles Peskinecbaff462019-07-12 23:46:04 +02001638 if( status != PSA_SUCCESS )
1639 return( status );
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001640
1641 if( ! PSA_KEY_LIFETIME_IS_VOLATILE( attributes->core.lifetime ) )
Gilles Peskine66be51c2019-07-25 18:02:52 +02001642 {
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001643 psa_crypto_prepare_transaction( PSA_CRYPTO_TRANSACTION_CREATE_KEY );
1644 psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
Ronald Cronea0f8a62020-11-25 17:52:23 +01001645 psa_crypto_transaction.key.slot = slot_number;
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001646 psa_crypto_transaction.key.id = slot->attr.id;
1647 status = psa_crypto_save_transaction( );
1648 if( status != PSA_SUCCESS )
1649 {
1650 (void) psa_crypto_stop_transaction( );
1651 return( status );
1652 }
Gilles Peskine66be51c2019-07-25 18:02:52 +02001653 }
Ronald Cronea0f8a62020-11-25 17:52:23 +01001654
1655 status = psa_copy_key_material_into_slot(
1656 slot, (uint8_t *)( &slot_number ), sizeof( slot_number ) );
Darryl Green0c6575a2018-11-07 16:05:30 +00001657 }
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001658
1659 if( *p_drv == NULL && method == PSA_KEY_CREATION_REGISTER )
1660 {
1661 /* Key registration only makes sense with a secure element. */
1662 return( PSA_ERROR_INVALID_ARGUMENT );
1663 }
Gilles Peskinecbaff462019-07-12 23:46:04 +02001664#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1665
Ronald Cronc4d1b512020-07-31 11:26:37 +02001666 return( PSA_SUCCESS );
Darryl Green0c6575a2018-11-07 16:05:30 +00001667}
Gilles Peskine4747d192019-04-17 15:05:45 +02001668
1669/** Finalize the creation of a key once its key material has been set.
1670 *
1671 * This entails writing the key to persistent storage.
1672 *
1673 * If this function fails, call psa_fail_key_creation().
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001674 * See the documentation of psa_start_key_creation() for the intended use
1675 * of this function.
Gilles Peskine4747d192019-04-17 15:05:45 +02001676 *
Ronald Cron5c522922020-11-14 16:35:34 +01001677 * If the finalization succeeds, the function unlocks the key slot (it was
1678 * locked by psa_start_key_creation()) and the key slot cannot be accessed
1679 * anymore as part of the key creation process.
Ronald Cron50972942020-11-14 11:28:25 +01001680 *
Gilles Peskine011e4282019-06-26 18:34:38 +02001681 * \param[in,out] slot Pointer to the slot with key material.
1682 * \param[in] driver The secure element driver for the key,
1683 * or NULL for a transparent key.
Ronald Cron81709fc2020-11-14 12:10:32 +01001684 * \param[out] key On success, identifier of the key. Note that the
1685 * key identifier is also stored in the key slot.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001686 *
1687 * \retval #PSA_SUCCESS
Ronald Croncf56a0a2020-08-04 09:51:30 +02001688 * The key was successfully created.
gabor-mezei-arm452b0a32020-11-09 17:42:55 +01001689 * \retval #PSA_ERROR_INSUFFICIENT_MEMORY
1690 * \retval #PSA_ERROR_INSUFFICIENT_STORAGE
1691 * \retval #PSA_ERROR_ALREADY_EXISTS
1692 * \retval #PSA_ERROR_DATA_INVALID
1693 * \retval #PSA_ERROR_DATA_CORRUPT
gabor-mezei-arm86326a92020-11-30 16:50:34 +01001694 * \retval #PSA_ERROR_STORAGE_FAILURE
gabor-mezei-arm452b0a32020-11-09 17:42:55 +01001695 *
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001696 * \return If this function fails, the key slot is an invalid state.
1697 * You must call psa_fail_key_creation() to wipe and free the slot.
Gilles Peskine4747d192019-04-17 15:05:45 +02001698 */
Gilles Peskine011e4282019-06-26 18:34:38 +02001699static psa_status_t psa_finish_key_creation(
1700 psa_key_slot_t *slot,
Ronald Cron81709fc2020-11-14 12:10:32 +01001701 psa_se_drv_table_entry_t *driver,
1702 mbedtls_svc_key_id_t *key)
Gilles Peskine4747d192019-04-17 15:05:45 +02001703{
1704 psa_status_t status = PSA_SUCCESS;
Gilles Peskine30afafd2019-04-25 13:47:40 +02001705 (void) slot;
Gilles Peskine011e4282019-06-26 18:34:38 +02001706 (void) driver;
Gilles Peskine4747d192019-04-17 15:05:45 +02001707
1708#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Steven Cooremanc59de6a2020-06-08 18:28:25 +02001709 if( ! PSA_KEY_LIFETIME_IS_VOLATILE( slot->attr.lifetime ) )
Gilles Peskine4747d192019-04-17 15:05:45 +02001710 {
Gilles Peskine1df83d42019-07-23 16:13:14 +02001711#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1712 if( driver != NULL )
1713 {
Gilles Peskineb46bef22019-07-30 21:32:04 +02001714 psa_se_key_data_storage_t data;
Ronald Cronea0f8a62020-11-25 17:52:23 +01001715 psa_key_slot_number_t slot_number =
1716 psa_key_slot_get_slot_number( slot ) ;
1717
Gilles Peskineb46bef22019-07-30 21:32:04 +02001718#if defined(static_assert)
Ronald Cronea0f8a62020-11-25 17:52:23 +01001719 static_assert( sizeof( slot_number ) ==
Gilles Peskineb46bef22019-07-30 21:32:04 +02001720 sizeof( data.slot_number ),
1721 "Slot number size does not match psa_se_key_data_storage_t" );
Gilles Peskineb46bef22019-07-30 21:32:04 +02001722#endif
Ronald Cronea0f8a62020-11-25 17:52:23 +01001723 memcpy( &data.slot_number, &slot_number, sizeof( slot_number ) );
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001724 status = psa_save_persistent_key( &slot->attr,
Gilles Peskineb46bef22019-07-30 21:32:04 +02001725 (uint8_t*) &data,
1726 sizeof( data ) );
Gilles Peskine1df83d42019-07-23 16:13:14 +02001727 }
1728 else
1729#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1730 {
Steven Cooreman40120f62020-10-29 11:42:22 +01001731 /* Key material is saved in export representation in the slot, so
1732 * just pass the slot buffer for storage. */
1733 status = psa_save_persistent_key( &slot->attr,
Ronald Cronea0f8a62020-11-25 17:52:23 +01001734 slot->key.data,
1735 slot->key.bytes );
Gilles Peskine1df83d42019-07-23 16:13:14 +02001736 }
Gilles Peskine4747d192019-04-17 15:05:45 +02001737 }
Darryl Green0c6575a2018-11-07 16:05:30 +00001738#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
1739
Gilles Peskinecbaff462019-07-12 23:46:04 +02001740#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined7729582019-08-05 15:55:54 +02001741 /* Finish the transaction for a key creation. This does not
1742 * happen when registering an existing key. Detect this case
1743 * by checking whether a transaction is in progress (actual
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001744 * creation of a persistent key in a secure element requires a transaction,
1745 * but registration or volatile key creation doesn't use one). */
Gilles Peskined7729582019-08-05 15:55:54 +02001746 if( driver != NULL &&
1747 psa_crypto_transaction.unknown.type == PSA_CRYPTO_TRANSACTION_CREATE_KEY )
Gilles Peskinecbaff462019-07-12 23:46:04 +02001748 {
1749 status = psa_save_se_persistent_data( driver );
1750 if( status != PSA_SUCCESS )
1751 {
Gilles Peskine8e338702019-07-30 20:06:31 +02001752 psa_destroy_persistent_key( slot->attr.id );
Gilles Peskinecbaff462019-07-12 23:46:04 +02001753 return( status );
1754 }
Gilles Peskinefc762652019-07-22 19:30:34 +02001755 status = psa_crypto_stop_transaction( );
Gilles Peskinecbaff462019-07-12 23:46:04 +02001756 }
1757#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1758
Ronald Cron50972942020-11-14 11:28:25 +01001759 if( status == PSA_SUCCESS )
Ronald Cron81709fc2020-11-14 12:10:32 +01001760 {
1761 *key = slot->attr.id;
Ronald Cron5c522922020-11-14 16:35:34 +01001762 status = psa_unlock_key_slot( slot );
Ronald Cron81709fc2020-11-14 12:10:32 +01001763 if( status != PSA_SUCCESS )
1764 *key = MBEDTLS_SVC_KEY_ID_INIT;
1765 }
Ronald Cron50972942020-11-14 11:28:25 +01001766
Gilles Peskine4747d192019-04-17 15:05:45 +02001767 return( status );
1768}
1769
1770/** Abort the creation of a key.
1771 *
1772 * You may call this function after calling psa_start_key_creation(),
1773 * or after psa_finish_key_creation() fails. In other circumstances, this
1774 * function may not clean up persistent storage.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001775 * See the documentation of psa_start_key_creation() for the intended use
1776 * of this function.
Gilles Peskine4747d192019-04-17 15:05:45 +02001777 *
Gilles Peskine011e4282019-06-26 18:34:38 +02001778 * \param[in,out] slot Pointer to the slot with key material.
1779 * \param[in] driver The secure element driver for the key,
1780 * or NULL for a transparent key.
Gilles Peskine4747d192019-04-17 15:05:45 +02001781 */
Gilles Peskine011e4282019-06-26 18:34:38 +02001782static void psa_fail_key_creation( psa_key_slot_t *slot,
Gilles Peskine8abe6a22019-07-12 23:40:35 +02001783 psa_se_drv_table_entry_t *driver )
Gilles Peskine4747d192019-04-17 15:05:45 +02001784{
Gilles Peskine011e4282019-06-26 18:34:38 +02001785 (void) driver;
1786
Gilles Peskine4747d192019-04-17 15:05:45 +02001787 if( slot == NULL )
1788 return;
Gilles Peskine011e4282019-06-26 18:34:38 +02001789
1790#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Janos Follath1d57a202019-08-13 12:15:34 +01001791 /* TODO: If the key has already been created in the secure
Gilles Peskine011e4282019-06-26 18:34:38 +02001792 * element, and the failure happened later (when saving metadata
1793 * to internal storage), we need to destroy the key in the secure
Gilles Peskinec9d7f942019-08-13 16:17:16 +02001794 * element.
1795 * https://github.com/ARMmbed/mbed-crypto/issues/217
1796 */
Gilles Peskinefc762652019-07-22 19:30:34 +02001797
Gilles Peskined7729582019-08-05 15:55:54 +02001798 /* Abort the ongoing transaction if any (there may not be one if
1799 * the creation process failed before starting one, or if the
1800 * key creation is a registration of a key in a secure element).
1801 * Earlier functions must already have done what it takes to undo any
1802 * partial creation. All that's left is to update the transaction data
1803 * itself. */
Gilles Peskinefc762652019-07-22 19:30:34 +02001804 (void) psa_crypto_stop_transaction( );
Gilles Peskine011e4282019-06-26 18:34:38 +02001805#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1806
Gilles Peskine4747d192019-04-17 15:05:45 +02001807 psa_wipe_key_slot( slot );
1808}
1809
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001810/** Validate optional attributes during key creation.
1811 *
1812 * Some key attributes are optional during key creation. If they are
1813 * specified in the attributes structure, check that they are consistent
1814 * with the data in the slot.
1815 *
1816 * This function should be called near the end of key creation, after
1817 * the slot in memory is fully populated but before saving persistent data.
1818 */
1819static psa_status_t psa_validate_optional_attributes(
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001820 const psa_key_slot_t *slot,
1821 const psa_key_attributes_t *attributes )
1822{
Gilles Peskine7e0cff92019-07-30 13:48:52 +02001823 if( attributes->core.type != 0 )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001824 {
Gilles Peskine8e338702019-07-30 20:06:31 +02001825 if( attributes->core.type != slot->attr.type )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001826 return( PSA_ERROR_INVALID_ARGUMENT );
1827 }
1828
1829 if( attributes->domain_parameters_size != 0 )
1830 {
John Durkop0e005192020-10-31 22:06:54 -07001831#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
1832 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Gilles Peskine8e338702019-07-30 20:06:31 +02001833 if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001834 {
Steven Cooremana2371e52020-07-28 14:30:39 +02001835 mbedtls_rsa_context *rsa = NULL;
Steven Cooreman75b74362020-07-28 14:30:13 +02001836 mbedtls_mpi actual, required;
Steven Cooreman6d839f02020-07-30 11:36:45 +02001837 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Steven Cooremana01795d2020-07-24 22:48:15 +02001838
Ronald Cron90857082020-11-25 14:58:33 +01001839 psa_status_t status = mbedtls_psa_rsa_load_representation(
1840 slot->attr.type,
1841 slot->key.data,
1842 slot->key.bytes,
1843 &rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02001844 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02001845 return( status );
Steven Cooreman75b74362020-07-28 14:30:13 +02001846
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001847 mbedtls_mpi_init( &actual );
1848 mbedtls_mpi_init( &required );
Steven Cooremana2371e52020-07-28 14:30:39 +02001849 ret = mbedtls_rsa_export( rsa,
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001850 NULL, NULL, NULL, NULL, &actual );
Steven Cooremana2371e52020-07-28 14:30:39 +02001851 mbedtls_rsa_free( rsa );
1852 mbedtls_free( rsa );
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001853 if( ret != 0 )
1854 goto rsa_exit;
1855 ret = mbedtls_mpi_read_binary( &required,
1856 attributes->domain_parameters,
1857 attributes->domain_parameters_size );
1858 if( ret != 0 )
1859 goto rsa_exit;
1860 if( mbedtls_mpi_cmp_mpi( &actual, &required ) != 0 )
1861 ret = MBEDTLS_ERR_RSA_BAD_INPUT_DATA;
1862 rsa_exit:
1863 mbedtls_mpi_free( &actual );
1864 mbedtls_mpi_free( &required );
1865 if( ret != 0)
1866 return( mbedtls_to_psa_error( ret ) );
1867 }
1868 else
John Durkop9814fa22020-11-04 12:28:15 -08001869#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
1870 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001871 {
1872 return( PSA_ERROR_INVALID_ARGUMENT );
1873 }
1874 }
1875
Gilles Peskine7e0cff92019-07-30 13:48:52 +02001876 if( attributes->core.bits != 0 )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001877 {
Gilles Peskineb46bef22019-07-30 21:32:04 +02001878 if( attributes->core.bits != slot->attr.bits )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001879 return( PSA_ERROR_INVALID_ARGUMENT );
1880 }
1881
1882 return( PSA_SUCCESS );
1883}
1884
Gilles Peskine4747d192019-04-17 15:05:45 +02001885psa_status_t psa_import_key( const psa_key_attributes_t *attributes,
Gilles Peskine4747d192019-04-17 15:05:45 +02001886 const uint8_t *data,
Gilles Peskine73676cb2019-05-15 20:15:10 +02001887 size_t data_length,
Ronald Croncf56a0a2020-08-04 09:51:30 +02001888 mbedtls_svc_key_id_t *key )
Gilles Peskine4747d192019-04-17 15:05:45 +02001889{
1890 psa_status_t status;
1891 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02001892 psa_se_drv_table_entry_t *driver = NULL;
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01001893 size_t bits;
Archanad8a83dc2021-06-14 10:04:16 +05301894 size_t storage_size = data_length;
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001895
Ronald Cron81709fc2020-11-14 12:10:32 +01001896 *key = MBEDTLS_SVC_KEY_ID_INIT;
1897
Gilles Peskine0f84d622019-09-12 19:03:13 +02001898 /* Reject zero-length symmetric keys (including raw data key objects).
1899 * This also rejects any key which might be encoded as an empty string,
1900 * which is never valid. */
1901 if( data_length == 0 )
1902 return( PSA_ERROR_INVALID_ARGUMENT );
1903
Gilles Peskinedf179142019-07-15 22:02:14 +02001904 status = psa_start_key_creation( PSA_KEY_CREATION_IMPORT, attributes,
Ronald Cron81709fc2020-11-14 12:10:32 +01001905 &slot, &driver );
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001906 if( status != PSA_SUCCESS )
1907 goto exit;
1908
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01001909 /* In the case of a transparent key or an opaque key stored in local
Archana4d7ae1d2021-07-07 02:50:22 +05301910 * storage( thus not in the case of the old-style secure element interface
1911 * (MBEDTLS_PSA_CRYPTO_SE_C)),we have to allocate a buffer to hold the
1912 * imported key material. */
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01001913 if( slot->key.data == NULL )
Gilles Peskine5d309672019-07-12 23:47:28 +02001914 {
Archanad8a83dc2021-06-14 10:04:16 +05301915 if( psa_key_lifetime_is_external( attributes->core.lifetime ) )
1916 {
1917 status = psa_driver_wrapper_get_key_buffer_size_from_key_data( attributes, data,
1918 data_length , &storage_size );
1919 if( status != PSA_SUCCESS )
1920 goto exit;
1921 }
1922 status = psa_allocate_buffer_to_slot( slot, storage_size );
Gilles Peskineb46bef22019-07-30 21:32:04 +02001923 if( status != PSA_SUCCESS )
1924 goto exit;
Gilles Peskine5d309672019-07-12 23:47:28 +02001925 }
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01001926
1927 bits = slot->attr.bits;
1928 status = psa_driver_wrapper_import_key( attributes,
1929 data, data_length,
1930 slot->key.data,
1931 slot->key.bytes,
1932 &slot->key.bytes, &bits );
1933 if( status != PSA_SUCCESS )
1934 goto exit;
1935
1936 if( slot->attr.bits == 0 )
1937 slot->attr.bits = (psa_key_bits_t) bits;
1938 else if( bits != slot->attr.bits )
Steven Cooremanac3434f2021-01-15 17:36:02 +01001939 {
Steven Cooremanac3434f2021-01-15 17:36:02 +01001940 status = PSA_ERROR_INVALID_ARGUMENT;
1941 goto exit;
Gilles Peskine5d309672019-07-12 23:47:28 +02001942 }
Ronald Cron2ebfdcc2020-11-28 15:54:54 +01001943
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001944 status = psa_validate_optional_attributes( slot, attributes );
Gilles Peskine18017402019-07-24 20:25:59 +02001945 if( status != PSA_SUCCESS )
1946 goto exit;
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001947
Ronald Cron81709fc2020-11-14 12:10:32 +01001948 status = psa_finish_key_creation( slot, driver, key );
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001949exit:
Gilles Peskine4747d192019-04-17 15:05:45 +02001950 if( status != PSA_SUCCESS )
Gilles Peskine011e4282019-06-26 18:34:38 +02001951 psa_fail_key_creation( slot, driver );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001952
Gilles Peskine4747d192019-04-17 15:05:45 +02001953 return( status );
1954}
1955
Gilles Peskined7729582019-08-05 15:55:54 +02001956#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1957psa_status_t mbedtls_psa_register_se_key(
1958 const psa_key_attributes_t *attributes )
1959{
1960 psa_status_t status;
1961 psa_key_slot_t *slot = NULL;
1962 psa_se_drv_table_entry_t *driver = NULL;
Ronald Croncf56a0a2020-08-04 09:51:30 +02001963 mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT;
Gilles Peskined7729582019-08-05 15:55:54 +02001964
1965 /* Leaving attributes unspecified is not currently supported.
1966 * It could make sense to query the key type and size from the
1967 * secure element, but not all secure elements support this
1968 * and the driver HAL doesn't currently support it. */
1969 if( psa_get_key_type( attributes ) == PSA_KEY_TYPE_NONE )
1970 return( PSA_ERROR_NOT_SUPPORTED );
1971 if( psa_get_key_bits( attributes ) == 0 )
1972 return( PSA_ERROR_NOT_SUPPORTED );
1973
1974 status = psa_start_key_creation( PSA_KEY_CREATION_REGISTER, attributes,
Ronald Cron81709fc2020-11-14 12:10:32 +01001975 &slot, &driver );
Gilles Peskined7729582019-08-05 15:55:54 +02001976 if( status != PSA_SUCCESS )
1977 goto exit;
1978
Ronald Cron81709fc2020-11-14 12:10:32 +01001979 status = psa_finish_key_creation( slot, driver, &key );
Gilles Peskined7729582019-08-05 15:55:54 +02001980
1981exit:
1982 if( status != PSA_SUCCESS )
Gilles Peskined7729582019-08-05 15:55:54 +02001983 psa_fail_key_creation( slot, driver );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001984
Gilles Peskined7729582019-08-05 15:55:54 +02001985 /* Registration doesn't keep the key in RAM. */
Ronald Croncf56a0a2020-08-04 09:51:30 +02001986 psa_close_key( key );
Gilles Peskined7729582019-08-05 15:55:54 +02001987 return( status );
1988}
1989#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1990
Gilles Peskinef603c712019-01-19 13:40:11 +01001991static psa_status_t psa_copy_key_material( const psa_key_slot_t *source,
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001992 psa_key_slot_t *target )
Gilles Peskinef603c712019-01-19 13:40:11 +01001993{
Steven Cooremanf7cebd42020-10-13 20:27:40 +02001994 psa_status_t status = psa_copy_key_material_into_slot( target,
Ronald Cronea0f8a62020-11-25 17:52:23 +01001995 source->key.data,
1996 source->key.bytes );
Gilles Peskinef603c712019-01-19 13:40:11 +01001997 if( status != PSA_SUCCESS )
Steven Cooreman398aee52020-10-13 14:35:45 +02001998 return( status );
Gilles Peskinef603c712019-01-19 13:40:11 +01001999
Steven Cooreman398aee52020-10-13 14:35:45 +02002000 target->attr.type = source->attr.type;
2001 target->attr.bits = source->attr.bits;
2002
2003 return( PSA_SUCCESS );
Gilles Peskinef603c712019-01-19 13:40:11 +01002004}
2005
Ronald Croncf56a0a2020-08-04 09:51:30 +02002006psa_status_t psa_copy_key( mbedtls_svc_key_id_t source_key,
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002007 const psa_key_attributes_t *specified_attributes,
Ronald Croncf56a0a2020-08-04 09:51:30 +02002008 mbedtls_svc_key_id_t *target_key )
Gilles Peskinef603c712019-01-19 13:40:11 +01002009{
Ronald Cronf95a2b12020-10-22 15:24:49 +02002010 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01002011 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinef603c712019-01-19 13:40:11 +01002012 psa_key_slot_t *source_slot = NULL;
2013 psa_key_slot_t *target_slot = NULL;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002014 psa_key_attributes_t actual_attributes = *specified_attributes;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02002015 psa_se_drv_table_entry_t *driver = NULL;
Gilles Peskinef603c712019-01-19 13:40:11 +01002016
Ronald Cron81709fc2020-11-14 12:10:32 +01002017 *target_key = MBEDTLS_SVC_KEY_ID_INIT;
2018
Ronald Cron5c522922020-11-14 16:35:34 +01002019 status = psa_get_and_lock_transparent_key_slot_with_policy(
2020 source_key, &source_slot, PSA_KEY_USAGE_COPY, 0 );
Gilles Peskinef603c712019-01-19 13:40:11 +01002021 if( status != PSA_SUCCESS )
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002022 goto exit;
2023
Gilles Peskine1b8594a2019-07-31 17:21:46 +02002024 status = psa_validate_optional_attributes( source_slot,
2025 specified_attributes );
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002026 if( status != PSA_SUCCESS )
2027 goto exit;
2028
Steven Cooreman1ac5ce32021-03-02 16:34:49 +01002029 status = psa_restrict_key_policy( source_slot->attr.type,
2030 &actual_attributes.core.policy,
Gilles Peskine8e338702019-07-30 20:06:31 +02002031 &source_slot->attr.policy );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002032 if( status != PSA_SUCCESS )
2033 goto exit;
2034
Ronald Cron81709fc2020-11-14 12:10:32 +01002035 status = psa_start_key_creation( PSA_KEY_CREATION_COPY, &actual_attributes,
2036 &target_slot, &driver );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002037 if( status != PSA_SUCCESS )
2038 goto exit;
2039
Gilles Peskinef4ee6622019-07-24 13:44:30 +02002040#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
2041 if( driver != NULL )
Gilles Peskinef603c712019-01-19 13:40:11 +01002042 {
Gilles Peskinef4ee6622019-07-24 13:44:30 +02002043 /* Copying to a secure element is not implemented yet. */
2044 status = PSA_ERROR_NOT_SUPPORTED;
2045 goto exit;
Gilles Peskinef603c712019-01-19 13:40:11 +01002046 }
Gilles Peskinef4ee6622019-07-24 13:44:30 +02002047#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskinef603c712019-01-19 13:40:11 +01002048
Ronald Cron6cc66312021-04-02 12:27:47 +02002049 if( psa_key_lifetime_is_external( actual_attributes.core.lifetime ) )
2050 {
2051 /*
2052 * Copying through an opaque driver is not implemented yet, consider
2053 * a lifetime with an external location as an invalid parameter for
2054 * now.
2055 */
2056 status = PSA_ERROR_INVALID_ARGUMENT;
2057 goto exit;
2058 }
2059
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002060 status = psa_copy_key_material( source_slot, target_slot );
Gilles Peskinef603c712019-01-19 13:40:11 +01002061 if( status != PSA_SUCCESS )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002062 goto exit;
Gilles Peskinef603c712019-01-19 13:40:11 +01002063
Ronald Cron81709fc2020-11-14 12:10:32 +01002064 status = psa_finish_key_creation( target_slot, driver, target_key );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002065exit:
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002066 if( status != PSA_SUCCESS )
Gilles Peskine011e4282019-06-26 18:34:38 +02002067 psa_fail_key_creation( target_slot, driver );
Ronald Cronf95a2b12020-10-22 15:24:49 +02002068
Ronald Cron5c522922020-11-14 16:35:34 +01002069 unlock_status = psa_unlock_key_slot( source_slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02002070
Ronald Cron5c522922020-11-14 16:35:34 +01002071 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskinef603c712019-01-19 13:40:11 +01002072}
2073
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02002074
2075
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01002076/****************************************************************/
Gilles Peskine20035e32018-02-03 22:44:14 +01002077/* Message digests */
2078/****************************************************************/
2079
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002080psa_status_t psa_hash_abort( psa_hash_operation_t *operation )
2081{
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002082 /* Aborting a non-active operation is allowed */
2083 if( operation->id == 0 )
2084 return( PSA_SUCCESS );
2085
2086 psa_status_t status = psa_driver_wrapper_hash_abort( operation );
2087 operation->id = 0;
2088
2089 return( status );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002090}
2091
Gilles Peskineda8191d1c2018-07-08 19:46:38 +02002092psa_status_t psa_hash_setup( psa_hash_operation_t *operation,
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002093 psa_algorithm_t alg )
2094{
Dave Rodgman685b6a72021-06-24 11:49:14 +01002095 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002096
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002097 /* A context must be freshly initialized before it can be set up. */
2098 if( operation->id != 0 )
Dave Rodgmanb5dd7c72021-06-24 16:17:43 +01002099 {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002100 status = PSA_ERROR_BAD_STATE;
2101 goto exit;
2102 }
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002103
2104 if( !PSA_ALG_IS_HASH( alg ) )
Dave Rodgmanb5dd7c72021-06-24 16:17:43 +01002105 {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002106 status = PSA_ERROR_INVALID_ARGUMENT;
2107 goto exit;
2108 }
Jaeden Amero36ee5d02019-02-19 09:25:10 +00002109
Steven Cooremanb6bf4bb2021-03-15 19:00:14 +01002110 /* Ensure all of the context is zeroized, since PSA_HASH_OPERATION_INIT only
2111 * directly zeroes the int-sized dummy member of the context union. */
Steven Cooreman893232f2021-03-15 12:23:37 +01002112 memset( &operation->ctx, 0, sizeof( operation->ctx ) );
2113
Dave Rodgman685b6a72021-06-24 11:49:14 +01002114 status = psa_driver_wrapper_hash_setup( operation, alg );
2115
2116exit:
2117 if( status != PSA_SUCCESS )
Dave Rodgmanb5dd7c72021-06-24 16:17:43 +01002118 psa_hash_abort( operation );
Dave Rodgman685b6a72021-06-24 11:49:14 +01002119
2120 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002121}
2122
2123psa_status_t psa_hash_update( psa_hash_operation_t *operation,
2124 const uint8_t *input,
2125 size_t input_length )
2126{
Dave Rodgman685b6a72021-06-24 11:49:14 +01002127 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2128
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002129 if( operation->id == 0 )
Dave Rodgmanb5dd7c72021-06-24 16:17:43 +01002130 {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002131 status = PSA_ERROR_BAD_STATE;
2132 goto exit;
2133 }
Gilles Peskine94e44542018-07-12 16:58:43 +02002134
Steven Cooremanc8288352021-03-04 14:02:19 +01002135 /* Don't require hash implementations to behave correctly on a
2136 * zero-length input, which may have an invalid pointer. */
2137 if( input_length == 0 )
2138 return( PSA_SUCCESS );
2139
Dave Rodgman685b6a72021-06-24 11:49:14 +01002140 status = psa_driver_wrapper_hash_update( operation, input, input_length );
2141
2142exit:
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002143 if( status != PSA_SUCCESS )
2144 psa_hash_abort( operation );
2145
2146 return( status );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002147}
2148
2149psa_status_t psa_hash_finish( psa_hash_operation_t *operation,
2150 uint8_t *hash,
2151 size_t hash_size,
2152 size_t *hash_length )
2153{
Steven Cooremanfbe09282021-03-08 18:41:12 +01002154 *hash_length = 0;
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002155 if( operation->id == 0 )
2156 return( PSA_ERROR_BAD_STATE );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002157
Steven Cooreman1e582352021-02-18 17:24:37 +01002158 psa_status_t status = psa_driver_wrapper_hash_finish(
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002159 operation, hash, hash_size, hash_length );
Steven Cooreman0e307642021-02-18 16:18:32 +01002160 psa_hash_abort( operation );
2161 return( status );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002162}
2163
Gilles Peskine2d277862018-06-18 15:41:12 +02002164psa_status_t psa_hash_verify( psa_hash_operation_t *operation,
2165 const uint8_t *hash,
2166 size_t hash_length )
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002167{
2168 uint8_t actual_hash[MBEDTLS_MD_MAX_SIZE];
2169 size_t actual_hash_length;
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002170 psa_status_t status = psa_hash_finish(
2171 operation,
Steven Cooreman1e582352021-02-18 17:24:37 +01002172 actual_hash, sizeof( actual_hash ),
2173 &actual_hash_length );
Dave Rodgman685b6a72021-06-24 11:49:14 +01002174
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002175 if( status != PSA_SUCCESS )
Dave Rodgman685b6a72021-06-24 11:49:14 +01002176 goto exit;
2177
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002178 if( actual_hash_length != hash_length )
Dave Rodgmanb5dd7c72021-06-24 16:17:43 +01002179 {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002180 status = PSA_ERROR_INVALID_SIGNATURE;
2181 goto exit;
2182 }
2183
Steven Cooreman36876a02021-04-29 16:37:59 +02002184 if( mbedtls_psa_safer_memcmp( hash, actual_hash, actual_hash_length ) != 0 )
Dave Rodgman685b6a72021-06-24 11:49:14 +01002185 status = PSA_ERROR_INVALID_SIGNATURE;
2186
2187exit:
2188 if( status != PSA_SUCCESS )
2189 psa_hash_abort(operation);
2190
2191 return( status );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002192}
2193
Gilles Peskine0a749c82019-11-28 19:33:58 +01002194psa_status_t psa_hash_compute( psa_algorithm_t alg,
2195 const uint8_t *input, size_t input_length,
2196 uint8_t *hash, size_t hash_size,
2197 size_t *hash_length )
2198{
Steven Cooremanfbe09282021-03-08 18:41:12 +01002199 *hash_length = 0;
Steven Cooremanf66d5fd2021-03-08 18:40:40 +01002200 if( !PSA_ALG_IS_HASH( alg ) )
2201 return( PSA_ERROR_INVALID_ARGUMENT );
2202
Steven Cooreman1e582352021-02-18 17:24:37 +01002203 return( psa_driver_wrapper_hash_compute( alg, input, input_length,
2204 hash, hash_size, hash_length ) );
Gilles Peskine0a749c82019-11-28 19:33:58 +01002205}
2206
2207psa_status_t psa_hash_compare( psa_algorithm_t alg,
2208 const uint8_t *input, size_t input_length,
2209 const uint8_t *hash, size_t hash_length )
2210{
Steven Cooreman84d670d2021-02-18 16:22:53 +01002211 uint8_t actual_hash[MBEDTLS_MD_MAX_SIZE];
2212 size_t actual_hash_length;
Steven Cooremanf66d5fd2021-03-08 18:40:40 +01002213
2214 if( !PSA_ALG_IS_HASH( alg ) )
2215 return( PSA_ERROR_INVALID_ARGUMENT );
2216
Steven Cooreman1e582352021-02-18 17:24:37 +01002217 psa_status_t status = psa_driver_wrapper_hash_compute(
2218 alg, input, input_length,
2219 actual_hash, sizeof(actual_hash),
2220 &actual_hash_length );
Gilles Peskine0a749c82019-11-28 19:33:58 +01002221 if( status != PSA_SUCCESS )
Steven Cooreman84d670d2021-02-18 16:22:53 +01002222 return( status );
2223 if( actual_hash_length != hash_length )
2224 return( PSA_ERROR_INVALID_SIGNATURE );
Steven Cooreman36876a02021-04-29 16:37:59 +02002225 if( mbedtls_psa_safer_memcmp( hash, actual_hash, actual_hash_length ) != 0 )
Steven Cooreman84d670d2021-02-18 16:22:53 +01002226 return( PSA_ERROR_INVALID_SIGNATURE );
2227 return( PSA_SUCCESS );
Gilles Peskine0a749c82019-11-28 19:33:58 +01002228}
2229
Gilles Peskineeb35d782019-01-22 17:56:16 +01002230psa_status_t psa_hash_clone( const psa_hash_operation_t *source_operation,
2231 psa_hash_operation_t *target_operation )
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002232{
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002233 if( source_operation->id == 0 ||
2234 target_operation->id != 0 )
2235 {
2236 return( PSA_ERROR_BAD_STATE );
2237 }
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002238
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002239 psa_status_t status = psa_driver_wrapper_hash_clone( source_operation,
2240 target_operation );
2241 if( status != PSA_SUCCESS )
2242 psa_hash_abort( target_operation );
2243
2244 return( status );
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002245}
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002246
2247
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002248/****************************************************************/
Gilles Peskine8c9def32018-02-08 10:02:12 +01002249/* MAC */
2250/****************************************************************/
2251
Steven Cooremane6804192021-03-19 18:28:56 +01002252psa_status_t psa_mac_abort( psa_mac_operation_t *operation )
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002253{
Steven Cooremane6804192021-03-19 18:28:56 +01002254 /* Aborting a non-active operation is allowed */
2255 if( operation->id == 0 )
2256 return( PSA_SUCCESS );
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002257
Steven Cooremane6804192021-03-19 18:28:56 +01002258 psa_status_t status = psa_driver_wrapper_mac_abort( operation );
Steven Cooreman72f736a2021-05-07 14:14:37 +02002259 operation->mac_size = 0;
2260 operation->is_sign = 0;
Steven Cooremane6804192021-03-19 18:28:56 +01002261 operation->id = 0;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002262
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002263 return( status );
2264}
2265
Ronald Cron2dff3b22021-06-17 16:33:22 +02002266static psa_status_t psa_mac_finalize_alg_and_key_validation(
2267 psa_algorithm_t alg,
Ronald Cron79bdd822021-06-17 16:46:44 +02002268 const psa_key_attributes_t *attributes,
2269 uint8_t *mac_size )
Gilles Peskine8c9def32018-02-08 10:02:12 +01002270{
Ronald Cronf95a2b12020-10-22 15:24:49 +02002271 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron79bdd822021-06-17 16:46:44 +02002272 psa_key_type_t key_type = psa_get_key_type( attributes );
2273 size_t key_bits = psa_get_key_bits( attributes );
Steven Cooreman77e2cc52021-03-19 17:05:52 +01002274
Ronald Cron28ea0502021-06-17 16:10:24 +02002275 if( ! PSA_ALG_IS_MAC( alg ) )
Ronald Cron79bdd822021-06-17 16:46:44 +02002276 return( PSA_ERROR_INVALID_ARGUMENT );
Steven Cooremane6804192021-03-19 18:28:56 +01002277
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +01002278 /* Validate the combination of key type and algorithm */
Ronald Cron79bdd822021-06-17 16:46:44 +02002279 status = psa_mac_key_can_do( alg, key_type );
Steven Cooreman15472f82021-03-02 16:16:22 +01002280 if( status != PSA_SUCCESS )
Ronald Cron79bdd822021-06-17 16:46:44 +02002281 return( status );
Steven Cooreman15472f82021-03-02 16:16:22 +01002282
Steven Cooremand1a68f12021-05-10 11:13:41 +02002283 /* Get the output length for the algorithm and key combination */
Ronald Cron79bdd822021-06-17 16:46:44 +02002284 *mac_size = PSA_MAC_LENGTH( key_type, key_bits, alg );
Steven Cooreman15472f82021-03-02 16:16:22 +01002285
Ronald Cron79bdd822021-06-17 16:46:44 +02002286 if( *mac_size < 4 )
Steven Cooreman15472f82021-03-02 16:16:22 +01002287 {
2288 /* A very short MAC is too short for security since it can be
2289 * brute-forced. Ancient protocols with 32-bit MACs do exist,
2290 * so we make this our minimum, even though 32 bits is still
2291 * too small for security. */
Ronald Cron79bdd822021-06-17 16:46:44 +02002292 return( PSA_ERROR_NOT_SUPPORTED );
Steven Cooreman15472f82021-03-02 16:16:22 +01002293 }
Gilles Peskineab1d7ab2018-07-06 16:07:47 +02002294
Ronald Cron79bdd822021-06-17 16:46:44 +02002295 if( *mac_size > PSA_MAC_LENGTH( key_type, key_bits,
2296 PSA_ALG_FULL_LENGTH_MAC( alg ) ) )
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +01002297 {
2298 /* It's impossible to "truncate" to a larger length than the full length
2299 * of the algorithm. */
Ronald Cron79bdd822021-06-17 16:46:44 +02002300 return( PSA_ERROR_INVALID_ARGUMENT );
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +01002301 }
2302
Ronald Cron79bdd822021-06-17 16:46:44 +02002303 return( PSA_SUCCESS );
Ronald Cron2dff3b22021-06-17 16:33:22 +02002304}
2305
Gilles Peskinee59236f2018-01-27 23:32:46 +01002306static psa_status_t psa_mac_setup( psa_mac_operation_t *operation,
2307 mbedtls_svc_key_id_t key,
2308 psa_algorithm_t alg,
2309 int is_sign )
2310{
2311 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2312 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Dave Rodgman54648242021-06-24 11:49:45 +01002313 psa_key_slot_t *slot = NULL;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002314
2315 /* A context must be freshly initialized before it can be set up. */
2316 if( operation->id != 0 )
Dave Rodgmanb5dd7c72021-06-24 16:17:43 +01002317 {
Dave Rodgman54648242021-06-24 11:49:45 +01002318 status = PSA_ERROR_BAD_STATE;
2319 goto exit;
2320 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002321
Gilles Peskine8c9def32018-02-08 10:02:12 +01002322 status = psa_get_and_lock_key_slot_with_policy(
2323 key,
2324 &slot,
Mateusz Starzykce0e6a92021-08-17 15:24:32 +02002325 is_sign ? PSA_KEY_USAGE_SIGN_MESSAGE : PSA_KEY_USAGE_VERIFY_MESSAGE,
Gilles Peskine8c9def32018-02-08 10:02:12 +01002326 alg );
2327 if( status != PSA_SUCCESS )
Dave Rodgman54648242021-06-24 11:49:45 +01002328 goto exit;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002329
2330 psa_key_attributes_t attributes = {
2331 .core = slot->attr
2332 };
2333
Ronald Cron79bdd822021-06-17 16:46:44 +02002334 status = psa_mac_finalize_alg_and_key_validation( alg, &attributes,
2335 &operation->mac_size );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002336 if( status != PSA_SUCCESS )
2337 goto exit;
2338
2339 operation->is_sign = is_sign;
Steven Cooremane6804192021-03-19 18:28:56 +01002340 /* Dispatch the MAC setup call with validated input */
2341 if( is_sign )
Gilles Peskinefbfac682018-07-08 20:51:54 +02002342 {
Steven Cooremane6804192021-03-19 18:28:56 +01002343 status = psa_driver_wrapper_mac_sign_setup( operation,
2344 &attributes,
2345 slot->key.data,
2346 slot->key.bytes,
2347 alg );
Gilles Peskinefbfac682018-07-08 20:51:54 +02002348 }
2349 else
Gilles Peskinefbfac682018-07-08 20:51:54 +02002350 {
Steven Cooremane6804192021-03-19 18:28:56 +01002351 status = psa_driver_wrapper_mac_verify_setup( operation,
2352 &attributes,
2353 slot->key.data,
2354 slot->key.bytes,
2355 alg );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002356 }
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002357
Gilles Peskinefbfac682018-07-08 20:51:54 +02002358exit:
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002359 if( status != PSA_SUCCESS )
Steven Cooremane6804192021-03-19 18:28:56 +01002360 psa_mac_abort( operation );
Ronald Cronf95a2b12020-10-22 15:24:49 +02002361
Ronald Cron5c522922020-11-14 16:35:34 +01002362 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02002363
Ronald Cron5c522922020-11-14 16:35:34 +01002364 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002365}
2366
Gilles Peskine89167cb2018-07-08 20:12:23 +02002367psa_status_t psa_mac_sign_setup( psa_mac_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02002368 mbedtls_svc_key_id_t key,
Gilles Peskine89167cb2018-07-08 20:12:23 +02002369 psa_algorithm_t alg )
2370{
Ronald Croncf56a0a2020-08-04 09:51:30 +02002371 return( psa_mac_setup( operation, key, alg, 1 ) );
Gilles Peskine89167cb2018-07-08 20:12:23 +02002372}
2373
2374psa_status_t psa_mac_verify_setup( psa_mac_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02002375 mbedtls_svc_key_id_t key,
Gilles Peskine89167cb2018-07-08 20:12:23 +02002376 psa_algorithm_t alg )
2377{
Ronald Croncf56a0a2020-08-04 09:51:30 +02002378 return( psa_mac_setup( operation, key, alg, 0 ) );
Gilles Peskine89167cb2018-07-08 20:12:23 +02002379}
2380
Steven Cooreman6e7f2912021-03-19 18:38:46 +01002381psa_status_t psa_mac_update( psa_mac_operation_t *operation,
Gilles Peskine8c9def32018-02-08 10:02:12 +01002382 const uint8_t *input,
2383 size_t input_length )
2384{
Steven Cooreman6e7f2912021-03-19 18:38:46 +01002385 if( operation->id == 0 )
Jaeden Ameroe236c2a2019-02-20 15:37:15 +00002386 return( PSA_ERROR_BAD_STATE );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002387
Steven Cooreman6e7f2912021-03-19 18:38:46 +01002388 /* Don't require hash implementations to behave correctly on a
2389 * zero-length input, which may have an invalid pointer. */
2390 if( input_length == 0 )
2391 return( PSA_SUCCESS );
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03002392
Steven Cooreman6e7f2912021-03-19 18:38:46 +01002393 psa_status_t status = psa_driver_wrapper_mac_update( operation,
2394 input, input_length );
Gilles Peskinefbfac682018-07-08 20:51:54 +02002395 if( status != PSA_SUCCESS )
Steven Cooreman6e7f2912021-03-19 18:38:46 +01002396 psa_mac_abort( operation );
2397
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02002398 return( status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002399}
2400
Steven Cooremana5b860a2021-03-19 19:04:39 +01002401psa_status_t psa_mac_sign_finish( psa_mac_operation_t *operation,
Gilles Peskineacd4be32018-07-08 19:56:25 +02002402 uint8_t *mac,
2403 size_t mac_size,
2404 size_t *mac_length )
mohammad16036df908f2018-04-02 08:34:15 -07002405{
Steven Cooremana5b860a2021-03-19 19:04:39 +01002406 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2407 psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED;
Steven Cooreman77e2cc52021-03-19 17:05:52 +01002408
Steven Cooremana5b860a2021-03-19 19:04:39 +01002409 if( operation->id == 0 )
Dave Rodgman8036bdd2021-06-24 16:19:08 +01002410 {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002411 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002412 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002413 }
Jaeden Amero252ef282019-02-15 14:05:35 +00002414
Steven Cooreman72f736a2021-05-07 14:14:37 +02002415 if( ! operation->is_sign )
Dave Rodgmanb5dd7c72021-06-24 16:17:43 +01002416 {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002417 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002418 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002419 }
Steven Cooreman72f736a2021-05-07 14:14:37 +02002420
Steven Cooreman8af5c5c2021-05-11 11:09:13 +02002421 /* Sanity check. This will guarantee that mac_size != 0 (and so mac != NULL)
2422 * once all the error checks are done. */
2423 if( operation->mac_size == 0 )
Dave Rodgmanb5dd7c72021-06-24 16:17:43 +01002424 {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002425 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002426 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002427 }
Steven Cooreman8af5c5c2021-05-11 11:09:13 +02002428
2429 if( mac_size < operation->mac_size )
Dave Rodgmanb5dd7c72021-06-24 16:17:43 +01002430 {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002431 status = PSA_ERROR_BUFFER_TOO_SMALL;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002432 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002433 }
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002434
Steven Cooremana5b860a2021-03-19 19:04:39 +01002435 status = psa_driver_wrapper_mac_sign_finish( operation,
Steven Cooreman72f736a2021-05-07 14:14:37 +02002436 mac, operation->mac_size,
2437 mac_length );
2438
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002439exit:
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002440 /* In case of success, set the potential excess room in the output buffer
2441 * to an invalid value, to avoid potentially leaking a longer MAC.
2442 * In case of error, set the output length and content to a safe default,
2443 * such that in case the caller misses an error check, the output would be
2444 * an unachievable MAC.
2445 */
2446 if( status != PSA_SUCCESS )
Steven Cooreman72f736a2021-05-07 14:14:37 +02002447 {
Steven Cooreman72f736a2021-05-07 14:14:37 +02002448 *mac_length = mac_size;
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002449 operation->mac_size = 0;
Steven Cooreman72f736a2021-05-07 14:14:37 +02002450 }
mohammad16036df908f2018-04-02 08:34:15 -07002451
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002452 if( mac_size > operation->mac_size )
2453 memset( &mac[operation->mac_size], '!',
2454 mac_size - operation->mac_size );
2455
Steven Cooremana5b860a2021-03-19 19:04:39 +01002456 abort_status = psa_mac_abort( operation );
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002457
Steven Cooremana5b860a2021-03-19 19:04:39 +01002458 return( status == PSA_SUCCESS ? abort_status : status );
mohammad16036df908f2018-04-02 08:34:15 -07002459}
2460
Steven Cooremana5b860a2021-03-19 19:04:39 +01002461psa_status_t psa_mac_verify_finish( psa_mac_operation_t *operation,
Gilles Peskineacd4be32018-07-08 19:56:25 +02002462 const uint8_t *mac,
2463 size_t mac_length )
Gilles Peskine8c9def32018-02-08 10:02:12 +01002464{
Steven Cooremana5b860a2021-03-19 19:04:39 +01002465 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2466 psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED;
Steven Cooreman77e2cc52021-03-19 17:05:52 +01002467
Steven Cooremana5b860a2021-03-19 19:04:39 +01002468 if( operation->id == 0 )
Dave Rodgmanb5dd7c72021-06-24 16:17:43 +01002469 {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002470 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002471 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002472 }
Jaeden Amero252ef282019-02-15 14:05:35 +00002473
Steven Cooreman72f736a2021-05-07 14:14:37 +02002474 if( operation->is_sign )
Dave Rodgmanb5dd7c72021-06-24 16:17:43 +01002475 {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002476 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002477 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002478 }
Steven Cooreman72f736a2021-05-07 14:14:37 +02002479
2480 if( operation->mac_size != mac_length )
2481 {
2482 status = PSA_ERROR_INVALID_SIGNATURE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002483 goto exit;
Steven Cooreman72f736a2021-05-07 14:14:37 +02002484 }
2485
Steven Cooremana5b860a2021-03-19 19:04:39 +01002486 status = psa_driver_wrapper_mac_verify_finish( operation,
2487 mac, mac_length );
Steven Cooreman72f736a2021-05-07 14:14:37 +02002488
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002489exit:
Steven Cooremana5b860a2021-03-19 19:04:39 +01002490 abort_status = psa_mac_abort( operation );
mohammad16036df908f2018-04-02 08:34:15 -07002491
Steven Cooremana5b860a2021-03-19 19:04:39 +01002492 return( status == PSA_SUCCESS ? abort_status : status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002493}
2494
Ronald Croncd989b52021-06-18 14:23:33 +02002495static psa_status_t psa_mac_compute_internal( mbedtls_svc_key_id_t key,
2496 psa_algorithm_t alg,
2497 const uint8_t *input,
2498 size_t input_length,
2499 uint8_t *mac,
2500 size_t mac_size,
2501 size_t *mac_length,
2502 int is_sign )
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002503{
2504 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron51131b52021-06-17 17:17:20 +02002505 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
2506 psa_key_slot_t *slot;
2507 uint8_t operation_mac_size = 0;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002508
Ronald Cron51131b52021-06-17 17:17:20 +02002509 status = psa_get_and_lock_key_slot_with_policy(
Mateusz Starzykce0e6a92021-08-17 15:24:32 +02002510 key,
2511 &slot,
2512 is_sign ? PSA_KEY_USAGE_SIGN_MESSAGE : PSA_KEY_USAGE_VERIFY_MESSAGE,
Ronald Croncd989b52021-06-18 14:23:33 +02002513 alg );
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002514 if( status != PSA_SUCCESS )
2515 goto exit;
2516
Ronald Cron51131b52021-06-17 17:17:20 +02002517 psa_key_attributes_t attributes = {
2518 .core = slot->attr
2519 };
2520
2521 status = psa_mac_finalize_alg_and_key_validation( alg, &attributes,
2522 &operation_mac_size );
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002523 if( status != PSA_SUCCESS )
2524 goto exit;
2525
Ronald Cron51131b52021-06-17 17:17:20 +02002526 if( mac_size < operation_mac_size )
2527 {
2528 status = PSA_ERROR_BUFFER_TOO_SMALL;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002529 goto exit;
Ronald Cron51131b52021-06-17 17:17:20 +02002530 }
2531
2532 status = psa_driver_wrapper_mac_compute(
2533 &attributes,
2534 slot->key.data, slot->key.bytes,
2535 alg,
2536 input, input_length,
2537 mac, operation_mac_size, mac_length );
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002538
2539exit:
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002540 /* In case of success, set the potential excess room in the output buffer
2541 * to an invalid value, to avoid potentially leaking a longer MAC.
2542 * In case of error, set the output length and content to a safe default,
2543 * such that in case the caller misses an error check, the output would be
2544 * an unachievable MAC.
2545 */
2546 if( status != PSA_SUCCESS )
Ronald Cron51131b52021-06-17 17:17:20 +02002547 {
Ronald Cron51131b52021-06-17 17:17:20 +02002548 *mac_length = mac_size;
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002549 operation_mac_size = 0;
Ronald Cron51131b52021-06-17 17:17:20 +02002550 }
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002551 if( mac_size > operation_mac_size )
2552 memset( &mac[operation_mac_size], '!', mac_size - operation_mac_size );
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002553
Ronald Cron51131b52021-06-17 17:17:20 +02002554 unlock_status = psa_unlock_key_slot( slot );
2555
2556 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002557}
2558
Ronald Croncd989b52021-06-18 14:23:33 +02002559psa_status_t psa_mac_compute( mbedtls_svc_key_id_t key,
2560 psa_algorithm_t alg,
2561 const uint8_t *input,
2562 size_t input_length,
2563 uint8_t *mac,
2564 size_t mac_size,
2565 size_t *mac_length)
2566{
2567 return( psa_mac_compute_internal( key, alg,
2568 input, input_length,
2569 mac, mac_size, mac_length, 1 ) );
2570}
2571
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002572psa_status_t psa_mac_verify( mbedtls_svc_key_id_t key,
2573 psa_algorithm_t alg,
2574 const uint8_t *input,
2575 size_t input_length,
2576 const uint8_t *mac,
2577 size_t mac_length)
2578{
2579 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Crona587cbc2021-06-18 14:51:29 +02002580 uint8_t actual_mac[PSA_MAC_MAX_SIZE];
2581 size_t actual_mac_length;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002582
Ronald Crona587cbc2021-06-18 14:51:29 +02002583 status = psa_mac_compute_internal( key, alg,
2584 input, input_length,
2585 actual_mac, sizeof( actual_mac ),
2586 &actual_mac_length, 0 );
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002587 if( status != PSA_SUCCESS )
2588 goto exit;
2589
Ronald Crona587cbc2021-06-18 14:51:29 +02002590 if( mac_length != actual_mac_length )
2591 {
2592 status = PSA_ERROR_INVALID_SIGNATURE;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002593 goto exit;
Ronald Crona587cbc2021-06-18 14:51:29 +02002594 }
2595 if( mbedtls_psa_safer_memcmp( mac, actual_mac, actual_mac_length ) != 0 )
2596 {
2597 status = PSA_ERROR_INVALID_SIGNATURE;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002598 goto exit;
Ronald Crona587cbc2021-06-18 14:51:29 +02002599 }
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002600
2601exit:
Ronald Crona587cbc2021-06-18 14:51:29 +02002602 mbedtls_platform_zeroize( actual_mac, sizeof( actual_mac ) );
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002603
2604 return ( status );
2605}
Gilles Peskinee59236f2018-01-27 23:32:46 +01002606
Gilles Peskinee59236f2018-01-27 23:32:46 +01002607/****************************************************************/
2608/* Asymmetric cryptography */
2609/****************************************************************/
2610
gabor-mezei-armf0486182021-05-12 11:03:09 +02002611static psa_status_t psa_sign_verify_check_alg( int input_is_message,
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002612 psa_algorithm_t alg )
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002613{
gabor-mezei-armf0486182021-05-12 11:03:09 +02002614 if( input_is_message )
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002615 {
2616 if( ! PSA_ALG_IS_SIGN_MESSAGE( alg ) )
2617 return( PSA_ERROR_INVALID_ARGUMENT );
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002618
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002619 if ( PSA_ALG_IS_HASH_AND_SIGN( alg ) )
2620 {
2621 if( ! PSA_ALG_IS_HASH( PSA_ALG_SIGN_GET_HASH( alg ) ) )
2622 return( PSA_ERROR_INVALID_ARGUMENT );
2623 }
2624 }
2625 else
2626 {
2627 if( ! PSA_ALG_IS_HASH_AND_SIGN( alg ) )
2628 return( PSA_ERROR_INVALID_ARGUMENT );
2629 }
2630
2631 return( PSA_SUCCESS );
2632}
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002633
2634static psa_status_t psa_sign_internal( mbedtls_svc_key_id_t key,
gabor-mezei-armf0486182021-05-12 11:03:09 +02002635 int input_is_message,
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002636 psa_algorithm_t alg,
2637 const uint8_t * input,
2638 size_t input_length,
2639 uint8_t * signature,
2640 size_t signature_size,
2641 size_t * signature_length )
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002642{
2643 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2644 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
2645 psa_key_slot_t *slot;
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002646
2647 *signature_length = 0;
2648
gabor-mezei-armf0486182021-05-12 11:03:09 +02002649 status = psa_sign_verify_check_alg( input_is_message, alg );
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002650 if( status != PSA_SUCCESS )
2651 return status;
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002652
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002653 /* Immediately reject a zero-length signature buffer. This guarantees
gabor-mezei-arm12b4f342021-05-05 13:54:55 +02002654 * that signature must be a valid pointer. (On the other hand, the input
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002655 * buffer can in principle be empty since it doesn't actually have
2656 * to be a hash.) */
2657 if( signature_size == 0 )
2658 return( PSA_ERROR_BUFFER_TOO_SMALL );
2659
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002660 status = psa_get_and_lock_key_slot_with_policy(
2661 key, &slot,
gabor-mezei-armf0486182021-05-12 11:03:09 +02002662 input_is_message ? PSA_KEY_USAGE_SIGN_MESSAGE :
2663 PSA_KEY_USAGE_SIGN_HASH,
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002664 alg );
2665
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002666 if( status != PSA_SUCCESS )
2667 goto exit;
2668
2669 if( ! PSA_KEY_TYPE_IS_KEY_PAIR( slot->attr.type ) )
2670 {
2671 status = PSA_ERROR_INVALID_ARGUMENT;
2672 goto exit;
2673 }
2674
2675 psa_key_attributes_t attributes = {
2676 .core = slot->attr
2677 };
2678
gabor-mezei-armf0486182021-05-12 11:03:09 +02002679 if( input_is_message )
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002680 {
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002681 status = psa_driver_wrapper_sign_message(
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002682 &attributes, slot->key.data, slot->key.bytes,
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002683 alg, input, input_length,
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002684 signature, signature_size, signature_length );
2685 }
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002686 else
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002687 {
2688
2689 status = psa_driver_wrapper_sign_hash(
2690 &attributes, slot->key.data, slot->key.bytes,
2691 alg, input, input_length,
2692 signature, signature_size, signature_length );
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002693 }
2694
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002695
2696exit:
2697 /* Fill the unused part of the output buffer (the whole buffer on error,
2698 * the trailing part on success) with something that isn't a valid signature
2699 * (barring an attack on the signature and deliberately-crafted input),
2700 * in case the caller doesn't check the return status properly. */
2701 if( status == PSA_SUCCESS )
2702 memset( signature + *signature_length, '!',
2703 signature_size - *signature_length );
2704 else
2705 memset( signature, '!', signature_size );
2706 /* If signature_size is 0 then we have nothing to do. We must not call
2707 * memset because signature may be NULL in this case. */
2708
2709 unlock_status = psa_unlock_key_slot( slot );
2710
2711 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
2712}
2713
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002714static psa_status_t psa_verify_internal( mbedtls_svc_key_id_t key,
gabor-mezei-armf0486182021-05-12 11:03:09 +02002715 int input_is_message,
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002716 psa_algorithm_t alg,
2717 const uint8_t * input,
2718 size_t input_length,
2719 const uint8_t * signature,
2720 size_t signature_length )
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002721{
2722 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2723 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
2724 psa_key_slot_t *slot;
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002725
gabor-mezei-armf0486182021-05-12 11:03:09 +02002726 status = psa_sign_verify_check_alg( input_is_message, alg );
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002727 if( status != PSA_SUCCESS )
2728 return status;
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002729
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002730 status = psa_get_and_lock_key_slot_with_policy(
2731 key, &slot,
gabor-mezei-armf0486182021-05-12 11:03:09 +02002732 input_is_message ? PSA_KEY_USAGE_VERIFY_MESSAGE :
2733 PSA_KEY_USAGE_VERIFY_HASH,
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002734 alg );
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002735
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002736 if( status != PSA_SUCCESS )
2737 return( status );
2738
2739 psa_key_attributes_t attributes = {
2740 .core = slot->attr
2741 };
2742
gabor-mezei-armf0486182021-05-12 11:03:09 +02002743 if( input_is_message )
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002744 {
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002745 status = psa_driver_wrapper_verify_message(
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002746 &attributes, slot->key.data, slot->key.bytes,
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002747 alg, input, input_length,
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002748 signature, signature_length );
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002749 }
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002750 else
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002751 {
2752 status = psa_driver_wrapper_verify_hash(
2753 &attributes, slot->key.data, slot->key.bytes,
2754 alg, input, input_length,
2755 signature, signature_length );
2756 }
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002757
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002758 unlock_status = psa_unlock_key_slot( slot );
2759
2760 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002761
2762}
2763
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02002764psa_status_t psa_sign_message_builtin(
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002765 const psa_key_attributes_t *attributes,
2766 const uint8_t *key_buffer,
2767 size_t key_buffer_size,
2768 psa_algorithm_t alg,
2769 const uint8_t *input,
2770 size_t input_length,
2771 uint8_t *signature,
2772 size_t signature_size,
2773 size_t *signature_length )
2774{
2775 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002776
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002777 if ( PSA_ALG_IS_HASH_AND_SIGN( alg ) )
2778 {
gabor-mezei-armf9820f92021-05-03 16:26:20 +02002779 size_t hash_length;
2780 uint8_t hash[PSA_HASH_MAX_SIZE];
2781
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002782 status = psa_driver_wrapper_hash_compute(
2783 PSA_ALG_SIGN_GET_HASH( alg ),
2784 input, input_length,
2785 hash, sizeof( hash ), &hash_length );
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002786
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002787 if( status != PSA_SUCCESS )
2788 return status;
gabor-mezei-armf9820f92021-05-03 16:26:20 +02002789
2790 return psa_driver_wrapper_sign_hash(
2791 attributes, key_buffer, key_buffer_size,
2792 alg, hash, hash_length,
2793 signature, signature_size, signature_length );
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002794 }
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002795
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002796 return( PSA_ERROR_NOT_SUPPORTED );
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002797}
2798
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002799psa_status_t psa_sign_message( mbedtls_svc_key_id_t key,
2800 psa_algorithm_t alg,
2801 const uint8_t * input,
2802 size_t input_length,
2803 uint8_t * signature,
2804 size_t signature_size,
2805 size_t * signature_length )
2806{
2807 return psa_sign_internal(
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002808 key, 1, alg, input, input_length,
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002809 signature, signature_size, signature_length );
2810}
2811
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02002812psa_status_t psa_verify_message_builtin(
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002813 const psa_key_attributes_t *attributes,
2814 const uint8_t *key_buffer,
2815 size_t key_buffer_size,
2816 psa_algorithm_t alg,
2817 const uint8_t *input,
2818 size_t input_length,
2819 const uint8_t *signature,
2820 size_t signature_length )
2821{
2822 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002823
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002824 if ( PSA_ALG_IS_HASH_AND_SIGN( alg ) )
2825 {
gabor-mezei-armf9820f92021-05-03 16:26:20 +02002826 size_t hash_length;
2827 uint8_t hash[PSA_HASH_MAX_SIZE];
2828
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002829 status = psa_driver_wrapper_hash_compute(
2830 PSA_ALG_SIGN_GET_HASH( alg ),
2831 input, input_length,
2832 hash, sizeof( hash ), &hash_length );
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002833
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002834 if( status != PSA_SUCCESS )
2835 return status;
gabor-mezei-armf9820f92021-05-03 16:26:20 +02002836
2837 return psa_driver_wrapper_verify_hash(
2838 attributes, key_buffer, key_buffer_size,
2839 alg, hash, hash_length,
2840 signature, signature_length );
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002841 }
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002842
gabor-mezei-arm474a35f2021-05-05 13:59:01 +02002843 return( PSA_ERROR_NOT_SUPPORTED );
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002844}
2845
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002846psa_status_t psa_verify_message( mbedtls_svc_key_id_t key,
2847 psa_algorithm_t alg,
2848 const uint8_t * input,
2849 size_t input_length,
2850 const uint8_t * signature,
2851 size_t signature_length )
2852{
2853 return psa_verify_internal(
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002854 key, 1, alg, input, input_length,
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002855 signature, signature_length );
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002856}
2857
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02002858psa_status_t psa_sign_hash_builtin(
Ronald Cron18659932020-12-08 16:32:23 +01002859 const psa_key_attributes_t *attributes,
2860 const uint8_t *key_buffer, size_t key_buffer_size,
2861 psa_algorithm_t alg, const uint8_t *hash, size_t hash_length,
2862 uint8_t *signature, size_t signature_size, size_t *signature_length )
Gilles Peskinee59236f2018-01-27 23:32:46 +01002863{
Ronald Cron99b8ed72021-02-17 10:33:32 +01002864 if( attributes->core.type == PSA_KEY_TYPE_RSA_KEY_PAIR )
Gilles Peskinee59236f2018-01-27 23:32:46 +01002865 {
Ronald Cron4501c982021-03-19 20:09:32 +01002866 if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) ||
2867 PSA_ALG_IS_RSA_PSS( alg) )
Steven Cooremanacda8342020-07-24 23:09:52 +02002868 {
Ronald Cron4501c982021-03-19 20:09:32 +01002869#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
2870 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
2871 return( mbedtls_psa_rsa_sign_hash(
Ronald Cron072722c2020-12-09 16:36:19 +01002872 attributes,
2873 key_buffer, key_buffer_size,
2874 alg, hash, hash_length,
2875 signature, signature_size, signature_length ) );
Ronald Cron4501c982021-03-19 20:09:32 +01002876#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
2877 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
Steven Cooremanacda8342020-07-24 23:09:52 +02002878 }
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002879 else
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002880 {
Ronald Cron8a494f32021-02-17 09:49:51 +01002881 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002882 }
Gilles Peskinee59236f2018-01-27 23:32:46 +01002883 }
2884 else
Ronald Cron4501c982021-03-19 20:09:32 +01002885 if( PSA_KEY_TYPE_IS_ECC( attributes->core.type ) )
2886 {
2887 if( PSA_ALG_IS_ECDSA( alg ) )
2888 {
2889#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
2890 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
2891 return( mbedtls_psa_ecdsa_sign_hash(
2892 attributes,
2893 key_buffer, key_buffer_size,
2894 alg, hash, hash_length,
2895 signature, signature_size, signature_length ) );
Gilles Peskinee59236f2018-01-27 23:32:46 +01002896#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
2897 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Ronald Cron4501c982021-03-19 20:09:32 +01002898 }
2899 else
2900 {
2901 return( PSA_ERROR_INVALID_ARGUMENT );
2902 }
Ronald Cron8a494f32021-02-17 09:49:51 +01002903 }
Ronald Cron4501c982021-03-19 20:09:32 +01002904
2905 (void)key_buffer;
2906 (void)key_buffer_size;
2907 (void)hash;
2908 (void)hash_length;
2909 (void)signature;
2910 (void)signature_size;
2911 (void)signature_length;
2912
2913 return( PSA_ERROR_NOT_SUPPORTED );
Ronald Cron18659932020-12-08 16:32:23 +01002914}
Gilles Peskinee59236f2018-01-27 23:32:46 +01002915
2916psa_status_t psa_sign_hash( mbedtls_svc_key_id_t key,
2917 psa_algorithm_t alg,
2918 const uint8_t *hash,
2919 size_t hash_length,
2920 uint8_t *signature,
2921 size_t signature_size,
2922 size_t *signature_length )
2923{
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002924 return psa_sign_internal(
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002925 key, 0, alg, hash, hash_length,
Ronald Cron9f17aa42020-12-08 17:07:25 +01002926 signature, signature_size, signature_length );
itayzafrir5c753392018-05-08 11:18:38 +03002927}
2928
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02002929psa_status_t psa_verify_hash_builtin(
Ronald Cron18659932020-12-08 16:32:23 +01002930 const psa_key_attributes_t *attributes,
2931 const uint8_t *key_buffer, size_t key_buffer_size,
2932 psa_algorithm_t alg, const uint8_t *hash, size_t hash_length,
2933 const uint8_t *signature, size_t signature_length )
itayzafrir5c753392018-05-08 11:18:38 +03002934{
Ronald Cron99b8ed72021-02-17 10:33:32 +01002935 if( PSA_KEY_TYPE_IS_RSA( attributes->core.type ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002936 {
Ronald Cron4501c982021-03-19 20:09:32 +01002937 if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) ||
2938 PSA_ALG_IS_RSA_PSS( alg) )
Steven Cooremanacda8342020-07-24 23:09:52 +02002939 {
Ronald Cron4501c982021-03-19 20:09:32 +01002940#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
2941 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
2942 return( mbedtls_psa_rsa_verify_hash(
Ronald Cron072722c2020-12-09 16:36:19 +01002943 attributes,
2944 key_buffer, key_buffer_size,
2945 alg, hash, hash_length,
2946 signature, signature_length ) );
Ronald Cron4501c982021-03-19 20:09:32 +01002947#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
2948 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
Steven Cooremanacda8342020-07-24 23:09:52 +02002949 }
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002950 else
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002951 {
Ronald Cron8a494f32021-02-17 09:49:51 +01002952 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002953 }
itayzafrir5c753392018-05-08 11:18:38 +03002954 }
Gilles Peskinee59236f2018-01-27 23:32:46 +01002955 else
Ronald Cron4501c982021-03-19 20:09:32 +01002956 if( PSA_KEY_TYPE_IS_ECC( attributes->core.type ) )
Gilles Peskinee59236f2018-01-27 23:32:46 +01002957 {
Ronald Cron4501c982021-03-19 20:09:32 +01002958 if( PSA_ALG_IS_ECDSA( alg ) )
2959 {
2960#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
2961 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
2962 return( mbedtls_psa_ecdsa_verify_hash(
2963 attributes,
2964 key_buffer, key_buffer_size,
2965 alg, hash, hash_length,
2966 signature, signature_length ) );
2967#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
2968 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
2969 }
2970 else
2971 {
2972 return( PSA_ERROR_INVALID_ARGUMENT );
2973 }
Ronald Cron8a494f32021-02-17 09:49:51 +01002974 }
Ronald Cron4501c982021-03-19 20:09:32 +01002975
2976 (void)key_buffer;
2977 (void)key_buffer_size;
2978 (void)hash;
2979 (void)hash_length;
2980 (void)signature;
2981 (void)signature_length;
2982
2983 return( PSA_ERROR_NOT_SUPPORTED );
Ronald Cron18659932020-12-08 16:32:23 +01002984}
2985
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002986psa_status_t psa_verify_hash( mbedtls_svc_key_id_t key,
2987 psa_algorithm_t alg,
2988 const uint8_t *hash,
2989 size_t hash_length,
2990 const uint8_t *signature,
2991 size_t signature_length )
2992{
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002993 return psa_verify_internal(
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002994 key, 0, alg, hash, hash_length,
Ronald Cron9f17aa42020-12-08 17:07:25 +01002995 signature, signature_length );
Gilles Peskinee59236f2018-01-27 23:32:46 +01002996}
2997
John Durkop0e005192020-10-31 22:06:54 -07002998#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
Ronald Cronea7631b2021-06-03 18:51:59 +02002999static int psa_rsa_oaep_set_padding_mode( psa_algorithm_t alg,
3000 mbedtls_rsa_context *rsa )
Gilles Peskine072ac562018-06-30 00:21:29 +02003001{
3002 psa_algorithm_t hash_alg = PSA_ALG_RSA_OAEP_GET_HASH( alg );
3003 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
3004 mbedtls_md_type_t md_alg = mbedtls_md_get_type( md_info );
Ronald Cronea7631b2021-06-03 18:51:59 +02003005
3006 return( mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg ) );
Gilles Peskine072ac562018-06-30 00:21:29 +02003007}
John Durkop0e005192020-10-31 22:06:54 -07003008#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */
Gilles Peskine072ac562018-06-30 00:21:29 +02003009
Ronald Croncf56a0a2020-08-04 09:51:30 +02003010psa_status_t psa_asymmetric_encrypt( mbedtls_svc_key_id_t key,
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003011 psa_algorithm_t alg,
3012 const uint8_t *input,
3013 size_t input_length,
3014 const uint8_t *salt,
3015 size_t salt_length,
3016 uint8_t *output,
3017 size_t output_size,
3018 size_t *output_length )
3019{
Ronald Cronf95a2b12020-10-22 15:24:49 +02003020 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01003021 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01003022 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003023
Darryl Green5cc689a2018-07-24 15:34:10 +01003024 (void) input;
3025 (void) input_length;
3026 (void) salt;
3027 (void) output;
3028 (void) output_size;
3029
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003030 *output_length = 0;
3031
Gilles Peskineb3fc05d2018-06-30 19:04:35 +02003032 if( ! PSA_ALG_IS_RSA_OAEP( alg ) && salt_length != 0 )
3033 return( PSA_ERROR_INVALID_ARGUMENT );
3034
Ronald Cron5c522922020-11-14 16:35:34 +01003035 status = psa_get_and_lock_transparent_key_slot_with_policy(
3036 key, &slot, PSA_KEY_USAGE_ENCRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003037 if( status != PSA_SUCCESS )
3038 return( status );
Gilles Peskine8e338702019-07-30 20:06:31 +02003039 if( ! ( PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->attr.type ) ||
3040 PSA_KEY_TYPE_IS_KEY_PAIR( slot->attr.type ) ) )
Ronald Cronf95a2b12020-10-22 15:24:49 +02003041 {
3042 status = PSA_ERROR_INVALID_ARGUMENT;
3043 goto exit;
3044 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003045
John Durkop6ba40d12020-11-10 08:50:04 -08003046#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \
3047 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
Gilles Peskine8e338702019-07-30 20:06:31 +02003048 if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003049 {
Steven Cooremana2371e52020-07-28 14:30:39 +02003050 mbedtls_rsa_context *rsa = NULL;
Ronald Cron90857082020-11-25 14:58:33 +01003051 status = mbedtls_psa_rsa_load_representation( slot->attr.type,
3052 slot->key.data,
3053 slot->key.bytes,
3054 &rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02003055 if( status != PSA_SUCCESS )
Steven Cooreman4fed4552020-08-03 14:46:03 +02003056 goto rsa_exit;
Steven Cooremana2371e52020-07-28 14:30:39 +02003057
3058 if( output_size < mbedtls_rsa_get_len( rsa ) )
Steven Cooremana01795d2020-07-24 22:48:15 +02003059 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02003060 status = PSA_ERROR_BUFFER_TOO_SMALL;
3061 goto rsa_exit;
Steven Cooremana01795d2020-07-24 22:48:15 +02003062 }
John Durkop0e005192020-10-31 22:06:54 -07003063#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT)
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003064 if( alg == PSA_ALG_RSA_PKCS1V15_CRYPT )
3065 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02003066 status = mbedtls_to_psa_error(
3067 mbedtls_rsa_pkcs1_encrypt( rsa,
Gilles Peskine30524eb2020-11-13 17:02:26 +01003068 mbedtls_psa_get_random,
Gilles Peskine5894e8e2020-12-14 14:54:06 +01003069 MBEDTLS_PSA_RANDOM_STATE,
Steven Cooreman4fed4552020-08-03 14:46:03 +02003070 input_length,
3071 input,
3072 output ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003073 }
3074 else
John Durkop0e005192020-10-31 22:06:54 -07003075#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT */
3076#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003077 if( PSA_ALG_IS_RSA_OAEP( alg ) )
3078 {
Ronald Cronea7631b2021-06-03 18:51:59 +02003079 status = mbedtls_to_psa_error(
3080 psa_rsa_oaep_set_padding_mode( alg, rsa ) );
3081 if( status != PSA_SUCCESS )
3082 goto rsa_exit;
3083
Steven Cooreman4fed4552020-08-03 14:46:03 +02003084 status = mbedtls_to_psa_error(
3085 mbedtls_rsa_rsaes_oaep_encrypt( rsa,
Gilles Peskine30524eb2020-11-13 17:02:26 +01003086 mbedtls_psa_get_random,
Gilles Peskine5894e8e2020-12-14 14:54:06 +01003087 MBEDTLS_PSA_RANDOM_STATE,
Steven Cooreman4fed4552020-08-03 14:46:03 +02003088 salt, salt_length,
3089 input_length,
3090 input,
3091 output ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003092 }
3093 else
John Durkop0e005192020-10-31 22:06:54 -07003094#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP */
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003095 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02003096 status = PSA_ERROR_INVALID_ARGUMENT;
3097 goto rsa_exit;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003098 }
Steven Cooreman4fed4552020-08-03 14:46:03 +02003099rsa_exit:
3100 if( status == PSA_SUCCESS )
Steven Cooremana2371e52020-07-28 14:30:39 +02003101 *output_length = mbedtls_rsa_get_len( rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02003102
Steven Cooremana2371e52020-07-28 14:30:39 +02003103 mbedtls_rsa_free( rsa );
3104 mbedtls_free( rsa );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003105 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003106 else
John Durkop9814fa22020-11-04 12:28:15 -08003107#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) ||
John Durkop6ba40d12020-11-10 08:50:04 -08003108 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003109 {
Ronald Cronf95a2b12020-10-22 15:24:49 +02003110 status = PSA_ERROR_NOT_SUPPORTED;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003111 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02003112
3113exit:
Ronald Cron5c522922020-11-14 16:35:34 +01003114 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02003115
Ronald Cron5c522922020-11-14 16:35:34 +01003116 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskine5b051bc2018-05-31 13:25:48 +02003117}
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003118
Ronald Croncf56a0a2020-08-04 09:51:30 +02003119psa_status_t psa_asymmetric_decrypt( mbedtls_svc_key_id_t key,
Gilles Peskine61b91d42018-06-08 16:09:36 +02003120 psa_algorithm_t alg,
3121 const uint8_t *input,
3122 size_t input_length,
3123 const uint8_t *salt,
3124 size_t salt_length,
3125 uint8_t *output,
3126 size_t output_size,
3127 size_t *output_length )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003128{
Ronald Cronf95a2b12020-10-22 15:24:49 +02003129 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01003130 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01003131 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003132
Darryl Green5cc689a2018-07-24 15:34:10 +01003133 (void) input;
3134 (void) input_length;
3135 (void) salt;
3136 (void) output;
3137 (void) output_size;
3138
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03003139 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003140
Gilles Peskineb3fc05d2018-06-30 19:04:35 +02003141 if( ! PSA_ALG_IS_RSA_OAEP( alg ) && salt_length != 0 )
3142 return( PSA_ERROR_INVALID_ARGUMENT );
3143
Ronald Cron5c522922020-11-14 16:35:34 +01003144 status = psa_get_and_lock_transparent_key_slot_with_policy(
3145 key, &slot, PSA_KEY_USAGE_DECRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003146 if( status != PSA_SUCCESS )
3147 return( status );
Gilles Peskine8e338702019-07-30 20:06:31 +02003148 if( ! PSA_KEY_TYPE_IS_KEY_PAIR( slot->attr.type ) )
Ronald Cronf95a2b12020-10-22 15:24:49 +02003149 {
3150 status = PSA_ERROR_INVALID_ARGUMENT;
3151 goto exit;
3152 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003153
John Durkop6ba40d12020-11-10 08:50:04 -08003154#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \
3155 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
Gilles Peskine8e338702019-07-30 20:06:31 +02003156 if( slot->attr.type == PSA_KEY_TYPE_RSA_KEY_PAIR )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003157 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02003158 mbedtls_rsa_context *rsa = NULL;
Ronald Cron90857082020-11-25 14:58:33 +01003159 status = mbedtls_psa_rsa_load_representation( slot->attr.type,
3160 slot->key.data,
3161 slot->key.bytes,
3162 &rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02003163 if( status != PSA_SUCCESS )
Ronald Cronf95a2b12020-10-22 15:24:49 +02003164 goto exit;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003165
Steven Cooremana2371e52020-07-28 14:30:39 +02003166 if( input_length != mbedtls_rsa_get_len( rsa ) )
Steven Cooremana01795d2020-07-24 22:48:15 +02003167 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02003168 status = PSA_ERROR_INVALID_ARGUMENT;
3169 goto rsa_exit;
Steven Cooremana01795d2020-07-24 22:48:15 +02003170 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003171
John Durkop0e005192020-10-31 22:06:54 -07003172#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT)
Gilles Peskine6afe7892018-05-31 13:16:08 +02003173 if( alg == PSA_ALG_RSA_PKCS1V15_CRYPT )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003174 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02003175 status = mbedtls_to_psa_error(
3176 mbedtls_rsa_pkcs1_decrypt( rsa,
Gilles Peskine30524eb2020-11-13 17:02:26 +01003177 mbedtls_psa_get_random,
Gilles Peskine5894e8e2020-12-14 14:54:06 +01003178 MBEDTLS_PSA_RANDOM_STATE,
Steven Cooreman4fed4552020-08-03 14:46:03 +02003179 output_length,
3180 input,
3181 output,
3182 output_size ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003183 }
3184 else
John Durkop0e005192020-10-31 22:06:54 -07003185#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT */
3186#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
Gilles Peskine55bf3d12018-06-26 15:53:48 +02003187 if( PSA_ALG_IS_RSA_OAEP( alg ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003188 {
Ronald Cronea7631b2021-06-03 18:51:59 +02003189 status = mbedtls_to_psa_error(
3190 psa_rsa_oaep_set_padding_mode( alg, rsa ) );
3191 if( status != PSA_SUCCESS )
3192 goto rsa_exit;
3193
Steven Cooreman4fed4552020-08-03 14:46:03 +02003194 status = mbedtls_to_psa_error(
3195 mbedtls_rsa_rsaes_oaep_decrypt( rsa,
Gilles Peskine30524eb2020-11-13 17:02:26 +01003196 mbedtls_psa_get_random,
Gilles Peskine5894e8e2020-12-14 14:54:06 +01003197 MBEDTLS_PSA_RANDOM_STATE,
Steven Cooreman4fed4552020-08-03 14:46:03 +02003198 salt, salt_length,
3199 output_length,
3200 input,
3201 output,
3202 output_size ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003203 }
3204 else
John Durkop0e005192020-10-31 22:06:54 -07003205#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP */
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003206 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02003207 status = PSA_ERROR_INVALID_ARGUMENT;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003208 }
Nir Sonnenschein717a0402018-06-04 16:36:15 +03003209
Steven Cooreman4fed4552020-08-03 14:46:03 +02003210rsa_exit:
Steven Cooremana2371e52020-07-28 14:30:39 +02003211 mbedtls_rsa_free( rsa );
3212 mbedtls_free( rsa );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003213 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003214 else
John Durkop6ba40d12020-11-10 08:50:04 -08003215#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) ||
3216 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003217 {
Ronald Cronf95a2b12020-10-22 15:24:49 +02003218 status = PSA_ERROR_NOT_SUPPORTED;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003219 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02003220
3221exit:
Ronald Cron5c522922020-11-14 16:35:34 +01003222 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02003223
Ronald Cron5c522922020-11-14 16:35:34 +01003224 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskine5b051bc2018-05-31 13:25:48 +02003225}
Gilles Peskinee59236f2018-01-27 23:32:46 +01003226
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02003227
3228
mohammad1603503973b2018-03-12 15:59:30 +02003229/****************************************************************/
3230/* Symmetric cryptography */
3231/****************************************************************/
3232
Ronald Cronab99ac22020-10-01 16:38:28 +02003233static psa_status_t psa_cipher_setup( psa_cipher_operation_t *operation,
3234 mbedtls_svc_key_id_t key,
3235 psa_algorithm_t alg,
3236 mbedtls_operation_t cipher_operation )
3237{
3238 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3239 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Dave Rodgman54648242021-06-24 11:49:45 +01003240 psa_key_slot_t *slot = NULL;
Ronald Cronab99ac22020-10-01 16:38:28 +02003241 psa_key_usage_t usage = ( cipher_operation == MBEDTLS_ENCRYPT ?
3242 PSA_KEY_USAGE_ENCRYPT :
3243 PSA_KEY_USAGE_DECRYPT );
3244
3245 /* A context must be freshly initialized before it can be set up. */
Ronald Cron49fafa92021-03-10 08:34:23 +01003246 if( operation->id != 0 )
Dave Rodgmanb5dd7c72021-06-24 16:17:43 +01003247 {
Dave Rodgman54648242021-06-24 11:49:45 +01003248 status = PSA_ERROR_BAD_STATE;
3249 goto exit;
3250 }
Ronald Cronab99ac22020-10-01 16:38:28 +02003251
Ronald Cronab99ac22020-10-01 16:38:28 +02003252 if( ! PSA_ALG_IS_CIPHER( alg ) )
Dave Rodgmanb5dd7c72021-06-24 16:17:43 +01003253 {
Dave Rodgman54648242021-06-24 11:49:45 +01003254 status = PSA_ERROR_INVALID_ARGUMENT;
3255 goto exit;
3256 }
Ronald Cronab99ac22020-10-01 16:38:28 +02003257
Ronald Cronab99ac22020-10-01 16:38:28 +02003258 status = psa_get_and_lock_key_slot_with_policy( key, &slot, usage, alg );
3259 if( status != PSA_SUCCESS )
3260 goto exit;
3261
Ronald Cron49fafa92021-03-10 08:34:23 +01003262 /* Initialize the operation struct members, except for id. The id member
Ronald Cronab99ac22020-10-01 16:38:28 +02003263 * is used to indicate to psa_cipher_abort that there are resources to free,
Ronald Cron49fafa92021-03-10 08:34:23 +01003264 * so we only set it (in the driver wrapper) after resources have been
3265 * allocated/initialized. */
Ronald Cronab99ac22020-10-01 16:38:28 +02003266 operation->iv_set = 0;
Ronald Cronab99ac22020-10-01 16:38:28 +02003267 if( alg == PSA_ALG_ECB_NO_PADDING )
3268 operation->iv_required = 0;
3269 else
3270 operation->iv_required = 1;
Ronald Cron5618a392021-03-26 09:52:26 +01003271 operation->default_iv_length = PSA_CIPHER_IV_LENGTH( slot->attr.type, alg );
Ronald Cronab99ac22020-10-01 16:38:28 +02003272
Ronald Crona4af55f2020-12-14 14:36:06 +01003273 psa_key_attributes_t attributes = {
3274 .core = slot->attr
3275 };
3276
Ronald Cronab99ac22020-10-01 16:38:28 +02003277 /* Try doing the operation through a driver before using software fallback. */
3278 if( cipher_operation == MBEDTLS_ENCRYPT )
Ronald Crona4af55f2020-12-14 14:36:06 +01003279 status = psa_driver_wrapper_cipher_encrypt_setup( operation,
3280 &attributes,
3281 slot->key.data,
3282 slot->key.bytes,
Ronald Cronab99ac22020-10-01 16:38:28 +02003283 alg );
3284 else
Ronald Crona4af55f2020-12-14 14:36:06 +01003285 status = psa_driver_wrapper_cipher_decrypt_setup( operation,
3286 &attributes,
3287 slot->key.data,
3288 slot->key.bytes,
Ronald Cronab99ac22020-10-01 16:38:28 +02003289 alg );
3290
Gilles Peskine9ab61b62019-02-25 17:43:14 +01003291exit:
Ronald Cron06aa4422021-03-09 17:32:57 +01003292 if( status != PSA_SUCCESS )
Gilles Peskine9ab61b62019-02-25 17:43:14 +01003293 psa_cipher_abort( operation );
Ronald Cronf95a2b12020-10-22 15:24:49 +02003294
Ronald Cron5c522922020-11-14 16:35:34 +01003295 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02003296
Ronald Cron5c522922020-11-14 16:35:34 +01003297 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
mohammad1603503973b2018-03-12 15:59:30 +02003298}
3299
Gilles Peskinefe119512018-07-08 21:39:34 +02003300psa_status_t psa_cipher_encrypt_setup( psa_cipher_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02003301 mbedtls_svc_key_id_t key,
Gilles Peskinefe119512018-07-08 21:39:34 +02003302 psa_algorithm_t alg )
mohammad16038481e742018-03-18 13:57:31 +02003303{
Ronald Croncf56a0a2020-08-04 09:51:30 +02003304 return( psa_cipher_setup( operation, key, alg, MBEDTLS_ENCRYPT ) );
mohammad16038481e742018-03-18 13:57:31 +02003305}
3306
Gilles Peskinefe119512018-07-08 21:39:34 +02003307psa_status_t psa_cipher_decrypt_setup( psa_cipher_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02003308 mbedtls_svc_key_id_t key,
Gilles Peskinefe119512018-07-08 21:39:34 +02003309 psa_algorithm_t alg )
mohammad16038481e742018-03-18 13:57:31 +02003310{
Ronald Croncf56a0a2020-08-04 09:51:30 +02003311 return( psa_cipher_setup( operation, key, alg, MBEDTLS_DECRYPT ) );
mohammad16038481e742018-03-18 13:57:31 +02003312}
3313
Gilles Peskinefe119512018-07-08 21:39:34 +02003314psa_status_t psa_cipher_generate_iv( psa_cipher_operation_t *operation,
Andrew Thoelke163639b2019-05-15 12:33:23 +01003315 uint8_t *iv,
Gilles Peskinefe119512018-07-08 21:39:34 +02003316 size_t iv_size,
3317 size_t *iv_length )
mohammad1603503973b2018-03-12 15:59:30 +02003318{
Ronald Cron6d051732020-10-01 14:10:20 +02003319 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cronc45b4af2020-09-29 16:18:05 +02003320
Ronald Cron5618a392021-03-26 09:52:26 +01003321 *iv_length = 0;
3322
Ronald Cron49fafa92021-03-10 08:34:23 +01003323 if( operation->id == 0 )
Ronald Cronc45b4af2020-09-29 16:18:05 +02003324 {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01003325 status = PSA_ERROR_BAD_STATE;
3326 goto exit;
Ronald Cronc45b4af2020-09-29 16:18:05 +02003327 }
3328
Steven Cooreman7df02922020-09-09 15:28:49 +02003329 if( operation->iv_set || ! operation->iv_required )
3330 {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01003331 status = PSA_ERROR_BAD_STATE;
3332 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02003333 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02003334
Ronald Cron5618a392021-03-26 09:52:26 +01003335 if( iv_size < operation->default_iv_length )
3336 {
3337 status = PSA_ERROR_BUFFER_TOO_SMALL;
3338 goto exit;
3339 }
Gilles Peskinee553c652018-06-04 16:22:46 +02003340
Ronald Cron5618a392021-03-26 09:52:26 +01003341 status = psa_generate_random( iv, operation->default_iv_length );
3342 if( status != PSA_SUCCESS )
3343 goto exit;
3344
3345 status = psa_driver_wrapper_cipher_set_iv( operation,
3346 iv,
3347 operation->default_iv_length );
3348
3349exit:
Steven Cooreman7df02922020-09-09 15:28:49 +02003350 if( status == PSA_SUCCESS )
Ronald Cron5618a392021-03-26 09:52:26 +01003351 {
Steven Cooreman7df02922020-09-09 15:28:49 +02003352 operation->iv_set = 1;
Ronald Cron5618a392021-03-26 09:52:26 +01003353 *iv_length = operation->default_iv_length;
3354 }
Steven Cooreman7df02922020-09-09 15:28:49 +02003355 else
Moran Peker395db872018-05-31 14:07:14 +03003356 psa_cipher_abort( operation );
Ronald Cron6d051732020-10-01 14:10:20 +02003357
itayzafrir534bd7c2018-08-02 13:56:32 +03003358 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02003359}
3360
Gilles Peskinefe119512018-07-08 21:39:34 +02003361psa_status_t psa_cipher_set_iv( psa_cipher_operation_t *operation,
Andrew Thoelke163639b2019-05-15 12:33:23 +01003362 const uint8_t *iv,
Gilles Peskinefe119512018-07-08 21:39:34 +02003363 size_t iv_length )
mohammad1603503973b2018-03-12 15:59:30 +02003364{
Ronald Cron6d051732020-10-01 14:10:20 +02003365 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cronc45b4af2020-09-29 16:18:05 +02003366
Ronald Cron49fafa92021-03-10 08:34:23 +01003367 if( operation->id == 0 )
Dave Rodgmanb5dd7c72021-06-24 16:17:43 +01003368 {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01003369 status = PSA_ERROR_BAD_STATE;
3370 goto exit;
3371 }
Ronald Cronc45b4af2020-09-29 16:18:05 +02003372
Steven Cooreman7df02922020-09-09 15:28:49 +02003373 if( operation->iv_set || ! operation->iv_required )
Dave Rodgmanb5dd7c72021-06-24 16:17:43 +01003374 {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01003375 status = PSA_ERROR_BAD_STATE;
3376 goto exit;
3377 }
Ronald Crona0d68172021-03-26 10:15:08 +01003378
3379 if( iv_length > PSA_CIPHER_IV_MAX_SIZE )
Dave Rodgmanb5dd7c72021-06-24 16:17:43 +01003380 {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01003381 status = PSA_ERROR_INVALID_ARGUMENT;
3382 goto exit;
3383 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02003384
Ronald Crondd24c9b2020-12-15 14:10:01 +01003385 status = psa_driver_wrapper_cipher_set_iv( operation,
3386 iv,
3387 iv_length );
Steven Cooremand3feccd2020-09-01 15:56:14 +02003388
Dave Rodgman38e62ae2021-06-23 11:38:39 +01003389exit:
itayzafrir534bd7c2018-08-02 13:56:32 +03003390 if( status == PSA_SUCCESS )
3391 operation->iv_set = 1;
3392 else
mohammad1603503973b2018-03-12 15:59:30 +02003393 psa_cipher_abort( operation );
itayzafrir534bd7c2018-08-02 13:56:32 +03003394 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02003395}
3396
Gilles Peskinee553c652018-06-04 16:22:46 +02003397psa_status_t psa_cipher_update( psa_cipher_operation_t *operation,
3398 const uint8_t *input,
3399 size_t input_length,
Andrew Thoelke163639b2019-05-15 12:33:23 +01003400 uint8_t *output,
Gilles Peskinee553c652018-06-04 16:22:46 +02003401 size_t output_size,
3402 size_t *output_length )
mohammad1603503973b2018-03-12 15:59:30 +02003403{
Steven Cooremanffecb7b2020-08-25 15:13:13 +02003404 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron6d051732020-10-01 14:10:20 +02003405
Ronald Cron49fafa92021-03-10 08:34:23 +01003406 if( operation->id == 0 )
Steven Cooreman7df02922020-09-09 15:28:49 +02003407 {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01003408 status = PSA_ERROR_BAD_STATE;
3409 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02003410 }
Dave Rodgman38e62ae2021-06-23 11:38:39 +01003411
Steven Cooreman7df02922020-09-09 15:28:49 +02003412 if( operation->iv_required && ! operation->iv_set )
3413 {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01003414 status = PSA_ERROR_BAD_STATE;
3415 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02003416 }
Jaeden Ameroab439972019-02-15 14:12:05 +00003417
Ronald Crondd24c9b2020-12-15 14:10:01 +01003418 status = psa_driver_wrapper_cipher_update( operation,
3419 input,
3420 input_length,
3421 output,
3422 output_size,
3423 output_length );
Dave Rodgman38e62ae2021-06-23 11:38:39 +01003424
3425exit:
itayzafrir534bd7c2018-08-02 13:56:32 +03003426 if( status != PSA_SUCCESS )
mohammad1603503973b2018-03-12 15:59:30 +02003427 psa_cipher_abort( operation );
Ronald Cron6d051732020-10-01 14:10:20 +02003428
itayzafrir534bd7c2018-08-02 13:56:32 +03003429 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02003430}
3431
Gilles Peskinee553c652018-06-04 16:22:46 +02003432psa_status_t psa_cipher_finish( psa_cipher_operation_t *operation,
3433 uint8_t *output,
3434 size_t output_size,
3435 size_t *output_length )
mohammad1603503973b2018-03-12 15:59:30 +02003436{
David Saadab4ecc272019-02-14 13:48:10 +02003437 psa_status_t status = PSA_ERROR_GENERIC_ERROR;
Ronald Cron6d051732020-10-01 14:10:20 +02003438
Ronald Cron49fafa92021-03-10 08:34:23 +01003439 if( operation->id == 0 )
Steven Cooreman7df02922020-09-09 15:28:49 +02003440 {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01003441 status = PSA_ERROR_BAD_STATE;
3442 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02003443 }
Dave Rodgman38e62ae2021-06-23 11:38:39 +01003444
Steven Cooreman7df02922020-09-09 15:28:49 +02003445 if( operation->iv_required && ! operation->iv_set )
3446 {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01003447 status = PSA_ERROR_BAD_STATE;
3448 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02003449 }
Moran Pekerbed71a22018-04-22 20:19:20 +03003450
Ronald Crondd24c9b2020-12-15 14:10:01 +01003451 status = psa_driver_wrapper_cipher_finish( operation,
3452 output,
3453 output_size,
3454 output_length );
Dave Rodgman38e62ae2021-06-23 11:38:39 +01003455
3456exit:
Steven Cooremanef8575e2020-09-11 11:44:50 +02003457 if( status == PSA_SUCCESS )
3458 return( psa_cipher_abort( operation ) );
3459 else
3460 {
3461 *output_length = 0;
Steven Cooremanef8575e2020-09-11 11:44:50 +02003462 (void) psa_cipher_abort( operation );
Janos Follath315b51c2018-07-09 16:04:51 +01003463
Steven Cooremanef8575e2020-09-11 11:44:50 +02003464 return( status );
3465 }
mohammad1603503973b2018-03-12 15:59:30 +02003466}
3467
Gilles Peskinee553c652018-06-04 16:22:46 +02003468psa_status_t psa_cipher_abort( psa_cipher_operation_t *operation )
3469{
Ronald Cron49fafa92021-03-10 08:34:23 +01003470 if( operation->id == 0 )
Gilles Peskine81736312018-06-26 15:04:31 +02003471 {
Steven Cooremana07b9972020-09-10 14:54:14 +02003472 /* The object has (apparently) been initialized but it is not (yet)
Gilles Peskine81736312018-06-26 15:04:31 +02003473 * in use. It's ok to call abort on such an object, and there's
3474 * nothing to do. */
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02003475 return( PSA_SUCCESS );
Gilles Peskine81736312018-06-26 15:04:31 +02003476 }
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02003477
Ronald Crondd24c9b2020-12-15 14:10:01 +01003478 psa_driver_wrapper_cipher_abort( operation );
Gilles Peskinee553c652018-06-04 16:22:46 +02003479
Ronald Cron49fafa92021-03-10 08:34:23 +01003480 operation->id = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03003481 operation->iv_set = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03003482 operation->iv_required = 0;
Moran Peker41deec42018-04-04 15:43:05 +03003483
Moran Peker395db872018-05-31 14:07:14 +03003484 return( PSA_SUCCESS );
mohammad1603503973b2018-03-12 15:59:30 +02003485}
3486
gabor-mezei-armba0fa752021-03-01 15:04:24 +01003487psa_status_t psa_cipher_encrypt( mbedtls_svc_key_id_t key,
3488 psa_algorithm_t alg,
3489 const uint8_t *input,
3490 size_t input_length,
3491 uint8_t *output,
3492 size_t output_size,
3493 size_t *output_length )
3494{
3495 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arma9449a02021-03-25 11:17:10 +01003496 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
3497 psa_key_slot_t *slot;
3498 psa_key_type_t key_type;
3499 size_t iv_length;
gabor-mezei-armba0fa752021-03-01 15:04:24 +01003500
gabor-mezei-arm6f4e5bb2021-06-25 15:21:11 +02003501 *output_length = 0;
3502
gabor-mezei-arma9449a02021-03-25 11:17:10 +01003503 if( ! PSA_ALG_IS_CIPHER( alg ) )
3504 return( PSA_ERROR_INVALID_ARGUMENT );
3505
gabor-mezei-arma9449a02021-03-25 11:17:10 +01003506 status = psa_get_and_lock_key_slot_with_policy( key, &slot,
3507 PSA_KEY_USAGE_ENCRYPT,
3508 alg );
gabor-mezei-armba0fa752021-03-01 15:04:24 +01003509 if( status != PSA_SUCCESS )
gabor-mezei-arma9449a02021-03-25 11:17:10 +01003510 return( status );
gabor-mezei-armba0fa752021-03-01 15:04:24 +01003511
gabor-mezei-arma9449a02021-03-25 11:17:10 +01003512 psa_key_attributes_t attributes = {
3513 .core = slot->attr
3514 };
3515
3516 key_type = slot->attr.type;
3517 iv_length = PSA_CIPHER_IV_LENGTH( key_type, alg );
3518
3519 if( iv_length > 0 )
gabor-mezei-armba0fa752021-03-01 15:04:24 +01003520 {
gabor-mezei-arma9449a02021-03-25 11:17:10 +01003521 if( output_size < iv_length )
3522 {
3523 status = PSA_ERROR_BUFFER_TOO_SMALL;
3524 goto exit;
3525 }
3526
3527 status = psa_generate_random( output, iv_length );
gabor-mezei-armba0fa752021-03-01 15:04:24 +01003528 if( status != PSA_SUCCESS )
3529 goto exit;
3530 }
3531
gabor-mezei-arma9449a02021-03-25 11:17:10 +01003532 status = psa_driver_wrapper_cipher_encrypt(
3533 &attributes, slot->key.data, slot->key.bytes,
3534 alg, input, input_length,
3535 output, output_size, output_length );
gabor-mezei-armba0fa752021-03-01 15:04:24 +01003536
3537exit:
gabor-mezei-arma9449a02021-03-25 11:17:10 +01003538 unlock_status = psa_unlock_key_slot( slot );
gabor-mezei-armba0fa752021-03-01 15:04:24 +01003539
gabor-mezei-arma9449a02021-03-25 11:17:10 +01003540 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
gabor-mezei-armba0fa752021-03-01 15:04:24 +01003541}
3542
3543psa_status_t psa_cipher_decrypt( mbedtls_svc_key_id_t key,
3544 psa_algorithm_t alg,
3545 const uint8_t *input,
3546 size_t input_length,
3547 uint8_t *output,
3548 size_t output_size,
3549 size_t *output_length )
3550{
3551 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arma9449a02021-03-25 11:17:10 +01003552 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
3553 psa_key_slot_t *slot;
gabor-mezei-armba0fa752021-03-01 15:04:24 +01003554
gabor-mezei-arm6f4e5bb2021-06-25 15:21:11 +02003555 *output_length = 0;
3556
gabor-mezei-arma9449a02021-03-25 11:17:10 +01003557 if( ! PSA_ALG_IS_CIPHER( alg ) )
3558 return( PSA_ERROR_INVALID_ARGUMENT );
3559
gabor-mezei-arma9449a02021-03-25 11:17:10 +01003560 status = psa_get_and_lock_key_slot_with_policy( key, &slot,
3561 PSA_KEY_USAGE_DECRYPT,
3562 alg );
gabor-mezei-armba0fa752021-03-01 15:04:24 +01003563 if( status != PSA_SUCCESS )
gabor-mezei-arma9449a02021-03-25 11:17:10 +01003564 return( status );
gabor-mezei-armba0fa752021-03-01 15:04:24 +01003565
gabor-mezei-arma9449a02021-03-25 11:17:10 +01003566 psa_key_attributes_t attributes = {
3567 .core = slot->attr
3568 };
gabor-mezei-armba0fa752021-03-01 15:04:24 +01003569
gabor-mezei-arm258ae072021-06-25 15:25:38 +02003570 if( input_length < PSA_CIPHER_IV_LENGTH( slot->attr.type, alg ) )
3571 {
3572 status = PSA_ERROR_INVALID_ARGUMENT;
3573 goto exit;
3574 }
3575
gabor-mezei-arma9449a02021-03-25 11:17:10 +01003576 status = psa_driver_wrapper_cipher_decrypt(
3577 &attributes, slot->key.data, slot->key.bytes,
3578 alg, input, input_length,
3579 output, output_size, output_length );
gabor-mezei-armba0fa752021-03-01 15:04:24 +01003580
gabor-mezei-arm258ae072021-06-25 15:25:38 +02003581exit:
gabor-mezei-arma9449a02021-03-25 11:17:10 +01003582 unlock_status = psa_unlock_key_slot( slot );
gabor-mezei-armba0fa752021-03-01 15:04:24 +01003583
gabor-mezei-arma9449a02021-03-25 11:17:10 +01003584 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
gabor-mezei-armba0fa752021-03-01 15:04:24 +01003585}
3586
3587
mohammad16035955c982018-04-26 00:53:03 +03003588/****************************************************************/
3589/* AEAD */
3590/****************************************************************/
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02003591
Ronald Croncf56a0a2020-08-04 09:51:30 +02003592psa_status_t psa_aead_encrypt( mbedtls_svc_key_id_t key,
mohammad16035955c982018-04-26 00:53:03 +03003593 psa_algorithm_t alg,
3594 const uint8_t *nonce,
3595 size_t nonce_length,
3596 const uint8_t *additional_data,
3597 size_t additional_data_length,
3598 const uint8_t *plaintext,
3599 size_t plaintext_length,
3600 uint8_t *ciphertext,
3601 size_t ciphertext_size,
3602 size_t *ciphertext_length )
3603{
Ronald Cron215633c2021-03-16 17:15:37 +01003604 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3605 psa_key_slot_t *slot;
Gilles Peskine2d277862018-06-18 15:41:12 +02003606
mohammad1603f08a5502018-06-03 15:05:47 +03003607 *ciphertext_length = 0;
mohammad1603e58e6842018-05-09 04:58:32 -07003608
Steven Cooremanea7ab132021-03-17 16:28:00 +01003609 if( !PSA_ALG_IS_AEAD( alg ) || PSA_ALG_IS_WILDCARD( alg ) )
3610 return( PSA_ERROR_NOT_SUPPORTED );
3611
Ronald Cron9a986162021-03-26 12:40:07 +01003612 status = psa_get_and_lock_key_slot_with_policy(
Ronald Cron215633c2021-03-16 17:15:37 +01003613 key, &slot, PSA_KEY_USAGE_ENCRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003614 if( status != PSA_SUCCESS )
3615 return( status );
mohammad16035955c982018-04-26 00:53:03 +03003616
Ronald Cron215633c2021-03-16 17:15:37 +01003617 psa_key_attributes_t attributes = {
3618 .core = slot->attr
3619 };
mohammad16035955c982018-04-26 00:53:03 +03003620
Ronald Cronde822812021-03-17 16:08:20 +01003621 status = psa_driver_wrapper_aead_encrypt(
Ronald Cron215633c2021-03-16 17:15:37 +01003622 &attributes, slot->key.data, slot->key.bytes,
3623 alg,
3624 nonce, nonce_length,
3625 additional_data, additional_data_length,
3626 plaintext, plaintext_length,
3627 ciphertext, ciphertext_size, ciphertext_length );
Gilles Peskine2d277862018-06-18 15:41:12 +02003628
Gilles Peskineedf9a652018-08-17 18:11:56 +02003629 if( status != PSA_SUCCESS && ciphertext_size != 0 )
3630 memset( ciphertext, 0, ciphertext_size );
Gilles Peskine2d277862018-06-18 15:41:12 +02003631
Ronald Cron9f310172021-03-16 16:36:37 +01003632 psa_unlock_key_slot( slot );
mohammad16035955c982018-04-26 00:53:03 +03003633
mohammad16035955c982018-04-26 00:53:03 +03003634 return( status );
Gilles Peskineee652a32018-06-01 19:23:52 +02003635}
3636
Ronald Croncf56a0a2020-08-04 09:51:30 +02003637psa_status_t psa_aead_decrypt( mbedtls_svc_key_id_t key,
mohammad16035955c982018-04-26 00:53:03 +03003638 psa_algorithm_t alg,
3639 const uint8_t *nonce,
3640 size_t nonce_length,
3641 const uint8_t *additional_data,
3642 size_t additional_data_length,
3643 const uint8_t *ciphertext,
3644 size_t ciphertext_length,
3645 uint8_t *plaintext,
3646 size_t plaintext_size,
3647 size_t *plaintext_length )
3648{
Ronald Cron215633c2021-03-16 17:15:37 +01003649 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3650 psa_key_slot_t *slot;
Gilles Peskine2d277862018-06-18 15:41:12 +02003651
Gilles Peskineee652a32018-06-01 19:23:52 +02003652 *plaintext_length = 0;
mohammad16039e5a5152018-04-26 12:07:35 +03003653
Steven Cooremanea7ab132021-03-17 16:28:00 +01003654 if( !PSA_ALG_IS_AEAD( alg ) || PSA_ALG_IS_WILDCARD( alg ) )
3655 return( PSA_ERROR_NOT_SUPPORTED );
3656
Ronald Cron9a986162021-03-26 12:40:07 +01003657 status = psa_get_and_lock_key_slot_with_policy(
Ronald Cron215633c2021-03-16 17:15:37 +01003658 key, &slot, PSA_KEY_USAGE_DECRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003659 if( status != PSA_SUCCESS )
3660 return( status );
mohammad16035955c982018-04-26 00:53:03 +03003661
Ronald Cron215633c2021-03-16 17:15:37 +01003662 psa_key_attributes_t attributes = {
3663 .core = slot->attr
3664 };
Gilles Peskinef7e7b012019-05-06 15:27:16 +02003665
Ronald Cronde822812021-03-17 16:08:20 +01003666 status = psa_driver_wrapper_aead_decrypt(
Ronald Cron215633c2021-03-16 17:15:37 +01003667 &attributes, slot->key.data, slot->key.bytes,
3668 alg,
3669 nonce, nonce_length,
3670 additional_data, additional_data_length,
3671 ciphertext, ciphertext_length,
3672 plaintext, plaintext_size, plaintext_length );
Gilles Peskinea40d7742018-06-01 16:28:30 +02003673
Gilles Peskineedf9a652018-08-17 18:11:56 +02003674 if( status != PSA_SUCCESS && plaintext_size != 0 )
3675 memset( plaintext, 0, plaintext_size );
mohammad160360a64d02018-06-03 17:20:42 +03003676
Ronald Cron215633c2021-03-16 17:15:37 +01003677 psa_unlock_key_slot( slot );
3678
Gilles Peskineedf9a652018-08-17 18:11:56 +02003679 return( status );
mohammad16035955c982018-04-26 00:53:03 +03003680}
3681
Gilles Peskinee59236f2018-01-27 23:32:46 +01003682/****************************************************************/
Gilles Peskineeab56e42018-07-12 17:12:33 +02003683/* Generators */
3684/****************************************************************/
3685
John Durkop07cc04a2020-11-16 22:08:34 -08003686#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF) || \
3687 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
3688 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
3689#define AT_LEAST_ONE_BUILTIN_KDF
Steven Cooreman094a77e2021-05-06 17:58:36 +02003690#endif /* At least one builtin KDF */
3691
3692#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF) || \
3693 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
3694 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
3695static psa_status_t psa_key_derivation_start_hmac(
3696 psa_mac_operation_t *operation,
3697 psa_algorithm_t hash_alg,
3698 const uint8_t *hmac_key,
3699 size_t hmac_key_length )
3700{
3701 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3702 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
3703 psa_set_key_type( &attributes, PSA_KEY_TYPE_HMAC );
3704 psa_set_key_bits( &attributes, PSA_BYTES_TO_BITS( hmac_key_length ) );
3705 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_SIGN_HASH );
3706
Steven Cooreman72f736a2021-05-07 14:14:37 +02003707 operation->is_sign = 1;
3708 operation->mac_size = PSA_HASH_LENGTH( hash_alg );
3709
Steven Cooreman094a77e2021-05-06 17:58:36 +02003710 status = psa_driver_wrapper_mac_sign_setup( operation,
3711 &attributes,
3712 hmac_key, hmac_key_length,
3713 PSA_ALG_HMAC( hash_alg ) );
3714
3715 psa_reset_key_attributes( &attributes );
3716 return( status );
3717}
3718#endif /* KDF algorithms reliant on HMAC */
John Durkop07cc04a2020-11-16 22:08:34 -08003719
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01003720#define HKDF_STATE_INIT 0 /* no input yet */
3721#define HKDF_STATE_STARTED 1 /* got salt */
3722#define HKDF_STATE_KEYED 2 /* got key */
3723#define HKDF_STATE_OUTPUT 3 /* output started */
3724
Gilles Peskinecbe66502019-05-16 16:59:18 +02003725static psa_algorithm_t psa_key_derivation_get_kdf_alg(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003726 const psa_key_derivation_operation_t *operation )
Gilles Peskine969c5d62019-01-16 15:53:06 +01003727{
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003728 if ( PSA_ALG_IS_KEY_AGREEMENT( operation->alg ) )
3729 return( PSA_ALG_KEY_AGREEMENT_GET_KDF( operation->alg ) );
Gilles Peskine969c5d62019-01-16 15:53:06 +01003730 else
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003731 return( operation->alg );
Gilles Peskine969c5d62019-01-16 15:53:06 +01003732}
3733
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003734psa_status_t psa_key_derivation_abort( psa_key_derivation_operation_t *operation )
Gilles Peskineeab56e42018-07-12 17:12:33 +02003735{
3736 psa_status_t status = PSA_SUCCESS;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003737 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg( operation );
Gilles Peskine969c5d62019-01-16 15:53:06 +01003738 if( kdf_alg == 0 )
Gilles Peskineeab56e42018-07-12 17:12:33 +02003739 {
3740 /* The object has (apparently) been initialized but it is not
3741 * in use. It's ok to call abort on such an object, and there's
3742 * nothing to do. */
3743 }
3744 else
John Durkopd0321952020-10-29 21:37:36 -07003745#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Gilles Peskine969c5d62019-01-16 15:53:06 +01003746 if( PSA_ALG_IS_HKDF( kdf_alg ) )
Gilles Peskinebef7f142018-07-12 17:22:21 +02003747 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003748 mbedtls_free( operation->ctx.hkdf.info );
Steven Cooremand1ed1d92021-04-29 19:11:25 +02003749 status = psa_mac_abort( &operation->ctx.hkdf.hmac );
Gilles Peskinebef7f142018-07-12 17:22:21 +02003750 }
John Durkop07cc04a2020-11-16 22:08:34 -08003751 else
3752#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF */
3753#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
3754 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
3755 if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003756 /* TLS-1.2 PSK-to-MS KDF uses the same core as TLS-1.2 PRF */
Gilles Peskine969c5d62019-01-16 15:53:06 +01003757 PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003758 {
Steven Cooremana6df6042021-04-29 19:32:25 +02003759 if( operation->ctx.tls12_prf.secret != NULL )
3760 {
3761 mbedtls_platform_zeroize( operation->ctx.tls12_prf.secret,
3762 operation->ctx.tls12_prf.secret_length );
3763 mbedtls_free( operation->ctx.tls12_prf.secret );
3764 }
3765
Janos Follath6a1d2622019-06-11 10:37:28 +01003766 if( operation->ctx.tls12_prf.seed != NULL )
3767 {
3768 mbedtls_platform_zeroize( operation->ctx.tls12_prf.seed,
3769 operation->ctx.tls12_prf.seed_length );
3770 mbedtls_free( operation->ctx.tls12_prf.seed );
3771 }
3772
3773 if( operation->ctx.tls12_prf.label != NULL )
3774 {
3775 mbedtls_platform_zeroize( operation->ctx.tls12_prf.label,
3776 operation->ctx.tls12_prf.label_length );
3777 mbedtls_free( operation->ctx.tls12_prf.label );
3778 }
3779
Steven Cooremana6df6042021-04-29 19:32:25 +02003780 status = PSA_SUCCESS;
Janos Follath6a1d2622019-06-11 10:37:28 +01003781
3782 /* We leave the fields Ai and output_block to be erased safely by the
3783 * mbedtls_platform_zeroize() in the end of this function. */
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003784 }
Gilles Peskinebef7f142018-07-12 17:22:21 +02003785 else
John Durkop07cc04a2020-11-16 22:08:34 -08003786#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) ||
3787 * defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) */
Gilles Peskineeab56e42018-07-12 17:12:33 +02003788 {
3789 status = PSA_ERROR_BAD_STATE;
3790 }
Janos Follath083036a2019-06-11 10:22:26 +01003791 mbedtls_platform_zeroize( operation, sizeof( *operation ) );
Gilles Peskineeab56e42018-07-12 17:12:33 +02003792 return( status );
3793}
3794
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003795psa_status_t psa_key_derivation_get_capacity(const psa_key_derivation_operation_t *operation,
Gilles Peskineeab56e42018-07-12 17:12:33 +02003796 size_t *capacity)
3797{
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003798 if( operation->alg == 0 )
Jaeden Amerocf2010c2019-02-15 13:05:49 +00003799 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003800 /* This is a blank key derivation operation. */
Steven Cooreman29149862020-08-05 15:43:42 +02003801 return( PSA_ERROR_BAD_STATE );
Jaeden Amerocf2010c2019-02-15 13:05:49 +00003802 }
3803
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003804 *capacity = operation->capacity;
Gilles Peskineeab56e42018-07-12 17:12:33 +02003805 return( PSA_SUCCESS );
3806}
3807
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003808psa_status_t psa_key_derivation_set_capacity( psa_key_derivation_operation_t *operation,
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01003809 size_t capacity )
3810{
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003811 if( operation->alg == 0 )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01003812 return( PSA_ERROR_BAD_STATE );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003813 if( capacity > operation->capacity )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01003814 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003815 operation->capacity = capacity;
Gilles Peskineeab56e42018-07-12 17:12:33 +02003816 return( PSA_SUCCESS );
3817}
3818
John Durkopd0321952020-10-29 21:37:36 -07003819#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003820/* Read some bytes from an HKDF-based operation. This performs a chunk
Gilles Peskinebef7f142018-07-12 17:22:21 +02003821 * of the expand phase of the HKDF algorithm. */
Gilles Peskinecbe66502019-05-16 16:59:18 +02003822static psa_status_t psa_key_derivation_hkdf_read( psa_hkdf_key_derivation_t *hkdf,
Steven Cooremand1ed1d92021-04-29 19:11:25 +02003823 psa_algorithm_t hash_alg,
3824 uint8_t *output,
3825 size_t output_length )
Gilles Peskinebef7f142018-07-12 17:22:21 +02003826{
gabor-mezei-armcbcec212020-12-18 14:23:51 +01003827 uint8_t hash_length = PSA_HASH_LENGTH( hash_alg );
Steven Cooremand1ed1d92021-04-29 19:11:25 +02003828 size_t hmac_output_length;
Gilles Peskinebef7f142018-07-12 17:22:21 +02003829 psa_status_t status;
3830
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01003831 if( hkdf->state < HKDF_STATE_KEYED || ! hkdf->info_set )
3832 return( PSA_ERROR_BAD_STATE );
3833 hkdf->state = HKDF_STATE_OUTPUT;
3834
Gilles Peskinebef7f142018-07-12 17:22:21 +02003835 while( output_length != 0 )
3836 {
3837 /* Copy what remains of the current block */
3838 uint8_t n = hash_length - hkdf->offset_in_block;
3839 if( n > output_length )
3840 n = (uint8_t) output_length;
3841 memcpy( output, hkdf->output_block + hkdf->offset_in_block, n );
3842 output += n;
3843 output_length -= n;
3844 hkdf->offset_in_block += n;
Gilles Peskined54931c2018-07-17 21:06:59 +02003845 if( output_length == 0 )
Gilles Peskinebef7f142018-07-12 17:22:21 +02003846 break;
Gilles Peskined54931c2018-07-17 21:06:59 +02003847 /* We can't be wanting more output after block 0xff, otherwise
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02003848 * the capacity check in psa_key_derivation_output_bytes() would have
Gilles Peskine51ae0e42019-05-16 17:31:03 +02003849 * prevented this call. It could happen only if the operation
Gilles Peskined54931c2018-07-17 21:06:59 +02003850 * object was corrupted or if this function is called directly
3851 * inside the library. */
3852 if( hkdf->block_number == 0xff )
3853 return( PSA_ERROR_BAD_STATE );
Gilles Peskinebef7f142018-07-12 17:22:21 +02003854
3855 /* We need a new block */
3856 ++hkdf->block_number;
3857 hkdf->offset_in_block = 0;
Steven Cooremand1ed1d92021-04-29 19:11:25 +02003858
Steven Cooreman094a77e2021-05-06 17:58:36 +02003859 status = psa_key_derivation_start_hmac( &hkdf->hmac,
3860 hash_alg,
3861 hkdf->prk,
3862 hash_length );
Gilles Peskinebef7f142018-07-12 17:22:21 +02003863 if( status != PSA_SUCCESS )
3864 return( status );
Steven Cooremand1ed1d92021-04-29 19:11:25 +02003865
Gilles Peskinebef7f142018-07-12 17:22:21 +02003866 if( hkdf->block_number != 1 )
3867 {
Steven Cooremand1ed1d92021-04-29 19:11:25 +02003868 status = psa_mac_update( &hkdf->hmac,
3869 hkdf->output_block,
3870 hash_length );
Gilles Peskinebef7f142018-07-12 17:22:21 +02003871 if( status != PSA_SUCCESS )
3872 return( status );
3873 }
Steven Cooremand1ed1d92021-04-29 19:11:25 +02003874 status = psa_mac_update( &hkdf->hmac,
3875 hkdf->info,
3876 hkdf->info_length );
Gilles Peskinebef7f142018-07-12 17:22:21 +02003877 if( status != PSA_SUCCESS )
3878 return( status );
Steven Cooremand1ed1d92021-04-29 19:11:25 +02003879 status = psa_mac_update( &hkdf->hmac,
3880 &hkdf->block_number, 1 );
Gilles Peskinebef7f142018-07-12 17:22:21 +02003881 if( status != PSA_SUCCESS )
3882 return( status );
Steven Cooremand1ed1d92021-04-29 19:11:25 +02003883 status = psa_mac_sign_finish( &hkdf->hmac,
3884 hkdf->output_block,
3885 sizeof( hkdf->output_block ),
3886 &hmac_output_length );
Gilles Peskinebef7f142018-07-12 17:22:21 +02003887 if( status != PSA_SUCCESS )
3888 return( status );
3889 }
3890
3891 return( PSA_SUCCESS );
3892}
John Durkop07cc04a2020-11-16 22:08:34 -08003893#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003894
John Durkop07cc04a2020-11-16 22:08:34 -08003895#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
3896 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Janos Follath7742fee2019-06-17 12:58:10 +01003897static psa_status_t psa_key_derivation_tls12_prf_generate_next_block(
3898 psa_tls12_prf_key_derivation_t *tls12_prf,
3899 psa_algorithm_t alg )
3900{
3901 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( alg );
gabor-mezei-armcbcec212020-12-18 14:23:51 +01003902 uint8_t hash_length = PSA_HASH_LENGTH( hash_alg );
Steven Cooremana6df6042021-04-29 19:32:25 +02003903 psa_mac_operation_t hmac = PSA_MAC_OPERATION_INIT;
3904 size_t hmac_output_length;
Janos Follathea29bfb2019-06-19 12:21:20 +01003905 psa_status_t status, cleanup_status;
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003906
Janos Follath7742fee2019-06-17 12:58:10 +01003907 /* We can't be wanting more output after block 0xff, otherwise
3908 * the capacity check in psa_key_derivation_output_bytes() would have
3909 * prevented this call. It could happen only if the operation
3910 * object was corrupted or if this function is called directly
3911 * inside the library. */
3912 if( tls12_prf->block_number == 0xff )
Janos Follath30090bc2019-06-25 10:15:04 +01003913 return( PSA_ERROR_CORRUPTION_DETECTED );
Janos Follath7742fee2019-06-17 12:58:10 +01003914
3915 /* We need a new block */
3916 ++tls12_prf->block_number;
Janos Follath844eb0e2019-06-19 12:10:49 +01003917 tls12_prf->left_in_block = hash_length;
Janos Follath7742fee2019-06-17 12:58:10 +01003918
3919 /* Recall the definition of the TLS-1.2-PRF from RFC 5246:
3920 *
3921 * PRF(secret, label, seed) = P_<hash>(secret, label + seed)
3922 *
3923 * P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
3924 * HMAC_hash(secret, A(2) + seed) +
3925 * HMAC_hash(secret, A(3) + seed) + ...
3926 *
3927 * A(0) = seed
Janos Follathea29bfb2019-06-19 12:21:20 +01003928 * A(i) = HMAC_hash(secret, A(i-1))
Janos Follath7742fee2019-06-17 12:58:10 +01003929 *
Janos Follathea29bfb2019-06-19 12:21:20 +01003930 * The `psa_tls12_prf_key_derivation` structure saves the block
Janos Follath7742fee2019-06-17 12:58:10 +01003931 * `HMAC_hash(secret, A(i) + seed)` from which the output
Janos Follath76c39842019-06-26 12:50:36 +01003932 * is currently extracted as `output_block` and where i is
3933 * `block_number`.
Janos Follath7742fee2019-06-17 12:58:10 +01003934 */
3935
Steven Cooreman094a77e2021-05-06 17:58:36 +02003936 status = psa_key_derivation_start_hmac( &hmac,
3937 hash_alg,
3938 tls12_prf->secret,
3939 tls12_prf->secret_length );
Janos Follathea29bfb2019-06-19 12:21:20 +01003940 if( status != PSA_SUCCESS )
3941 goto cleanup;
3942
3943 /* Calculate A(i) where i = tls12_prf->block_number. */
3944 if( tls12_prf->block_number == 1 )
3945 {
3946 /* A(1) = HMAC_hash(secret, A(0)), where A(0) = seed. (The RFC overloads
3947 * the variable seed and in this instance means it in the context of the
3948 * P_hash function, where seed = label + seed.) */
Steven Cooremana6df6042021-04-29 19:32:25 +02003949 status = psa_mac_update( &hmac,
3950 tls12_prf->label,
3951 tls12_prf->label_length );
Janos Follathea29bfb2019-06-19 12:21:20 +01003952 if( status != PSA_SUCCESS )
3953 goto cleanup;
Steven Cooremana6df6042021-04-29 19:32:25 +02003954 status = psa_mac_update( &hmac,
3955 tls12_prf->seed,
3956 tls12_prf->seed_length );
Janos Follathea29bfb2019-06-19 12:21:20 +01003957 if( status != PSA_SUCCESS )
3958 goto cleanup;
3959 }
3960 else
3961 {
3962 /* A(i) = HMAC_hash(secret, A(i-1)) */
Steven Cooremana6df6042021-04-29 19:32:25 +02003963 status = psa_mac_update( &hmac, tls12_prf->Ai, hash_length );
Janos Follathea29bfb2019-06-19 12:21:20 +01003964 if( status != PSA_SUCCESS )
3965 goto cleanup;
3966 }
3967
Steven Cooremana6df6042021-04-29 19:32:25 +02003968 status = psa_mac_sign_finish( &hmac,
3969 tls12_prf->Ai, hash_length,
3970 &hmac_output_length );
3971 if( hmac_output_length != hash_length )
3972 status = PSA_ERROR_CORRUPTION_DETECTED;
Janos Follathea29bfb2019-06-19 12:21:20 +01003973 if( status != PSA_SUCCESS )
3974 goto cleanup;
3975
3976 /* Calculate HMAC_hash(secret, A(i) + label + seed). */
Steven Cooreman094a77e2021-05-06 17:58:36 +02003977 status = psa_key_derivation_start_hmac( &hmac,
3978 hash_alg,
3979 tls12_prf->secret,
3980 tls12_prf->secret_length );
Janos Follathea29bfb2019-06-19 12:21:20 +01003981 if( status != PSA_SUCCESS )
3982 goto cleanup;
Steven Cooremana6df6042021-04-29 19:32:25 +02003983 status = psa_mac_update( &hmac, tls12_prf->Ai, hash_length );
Janos Follathea29bfb2019-06-19 12:21:20 +01003984 if( status != PSA_SUCCESS )
3985 goto cleanup;
Steven Cooremana6df6042021-04-29 19:32:25 +02003986 status = psa_mac_update( &hmac, tls12_prf->label, tls12_prf->label_length );
Janos Follathea29bfb2019-06-19 12:21:20 +01003987 if( status != PSA_SUCCESS )
3988 goto cleanup;
Steven Cooremana6df6042021-04-29 19:32:25 +02003989 status = psa_mac_update( &hmac, tls12_prf->seed, tls12_prf->seed_length );
Janos Follathea29bfb2019-06-19 12:21:20 +01003990 if( status != PSA_SUCCESS )
3991 goto cleanup;
Steven Cooremana6df6042021-04-29 19:32:25 +02003992 status = psa_mac_sign_finish( &hmac,
3993 tls12_prf->output_block, hash_length,
3994 &hmac_output_length );
Janos Follathea29bfb2019-06-19 12:21:20 +01003995 if( status != PSA_SUCCESS )
3996 goto cleanup;
3997
Janos Follath7742fee2019-06-17 12:58:10 +01003998
3999cleanup:
Steven Cooremana6df6042021-04-29 19:32:25 +02004000 cleanup_status = psa_mac_abort( &hmac );
Janos Follathea29bfb2019-06-19 12:21:20 +01004001 if( status == PSA_SUCCESS && cleanup_status != PSA_SUCCESS )
4002 status = cleanup_status;
4003
4004 return( status );
Janos Follath7742fee2019-06-17 12:58:10 +01004005}
Hanno Beckerc8a41d72018-10-09 17:33:01 +01004006
Janos Follath844eb0e2019-06-19 12:10:49 +01004007static psa_status_t psa_key_derivation_tls12_prf_read(
4008 psa_tls12_prf_key_derivation_t *tls12_prf,
4009 psa_algorithm_t alg,
4010 uint8_t *output,
4011 size_t output_length )
4012{
4013 psa_algorithm_t hash_alg = PSA_ALG_TLS12_PRF_GET_HASH( alg );
gabor-mezei-armcbcec212020-12-18 14:23:51 +01004014 uint8_t hash_length = PSA_HASH_LENGTH( hash_alg );
Janos Follath844eb0e2019-06-19 12:10:49 +01004015 psa_status_t status;
4016 uint8_t offset, length;
4017
Gilles Peskineb1edaec2021-06-11 22:41:46 +02004018 switch( tls12_prf->state )
4019 {
4020 case PSA_TLS12_PRF_STATE_LABEL_SET:
4021 tls12_prf->state = PSA_TLS12_PRF_STATE_OUTPUT;
4022 break;
4023 case PSA_TLS12_PRF_STATE_OUTPUT:
4024 break;
4025 default:
4026 return( PSA_ERROR_BAD_STATE );
4027 }
4028
Janos Follath844eb0e2019-06-19 12:10:49 +01004029 while( output_length != 0 )
4030 {
4031 /* Check if we have fully processed the current block. */
4032 if( tls12_prf->left_in_block == 0 )
4033 {
4034 status = psa_key_derivation_tls12_prf_generate_next_block( tls12_prf,
4035 alg );
4036 if( status != PSA_SUCCESS )
4037 return( status );
4038
4039 continue;
4040 }
4041
4042 if( tls12_prf->left_in_block > output_length )
4043 length = (uint8_t) output_length;
4044 else
4045 length = tls12_prf->left_in_block;
4046
4047 offset = hash_length - tls12_prf->left_in_block;
4048 memcpy( output, tls12_prf->output_block + offset, length );
4049 output += length;
4050 output_length -= length;
4051 tls12_prf->left_in_block -= length;
4052 }
4053
4054 return( PSA_SUCCESS );
4055}
John Durkop07cc04a2020-11-16 22:08:34 -08004056#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF ||
4057 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Gilles Peskinebef7f142018-07-12 17:22:21 +02004058
Janos Follath6c6c8fc2019-06-17 12:38:20 +01004059psa_status_t psa_key_derivation_output_bytes(
4060 psa_key_derivation_operation_t *operation,
4061 uint8_t *output,
4062 size_t output_length )
Gilles Peskineeab56e42018-07-12 17:12:33 +02004063{
4064 psa_status_t status;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004065 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg( operation );
Gilles Peskineeab56e42018-07-12 17:12:33 +02004066
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004067 if( operation->alg == 0 )
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004068 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004069 /* This is a blank operation. */
Steven Cooreman29149862020-08-05 15:43:42 +02004070 return( PSA_ERROR_BAD_STATE );
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004071 }
4072
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004073 if( output_length > operation->capacity )
Gilles Peskineeab56e42018-07-12 17:12:33 +02004074 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004075 operation->capacity = 0;
Gilles Peskineeab56e42018-07-12 17:12:33 +02004076 /* Go through the error path to wipe all confidential data now
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004077 * that the operation object is useless. */
David Saadab4ecc272019-02-14 13:48:10 +02004078 status = PSA_ERROR_INSUFFICIENT_DATA;
Gilles Peskineeab56e42018-07-12 17:12:33 +02004079 goto exit;
4080 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004081 if( output_length == 0 && operation->capacity == 0 )
Gilles Peskineeab56e42018-07-12 17:12:33 +02004082 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004083 /* Edge case: this is a finished operation, and 0 bytes
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004084 * were requested. The right error in this case could
Gilles Peskineeab56e42018-07-12 17:12:33 +02004085 * be either INSUFFICIENT_CAPACITY or BAD_STATE. Return
4086 * INSUFFICIENT_CAPACITY, which is right for a finished
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004087 * operation, for consistency with the case when
Gilles Peskineeab56e42018-07-12 17:12:33 +02004088 * output_length > 0. */
David Saadab4ecc272019-02-14 13:48:10 +02004089 return( PSA_ERROR_INSUFFICIENT_DATA );
Gilles Peskineeab56e42018-07-12 17:12:33 +02004090 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004091 operation->capacity -= output_length;
Gilles Peskineeab56e42018-07-12 17:12:33 +02004092
John Durkopd0321952020-10-29 21:37:36 -07004093#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Gilles Peskine969c5d62019-01-16 15:53:06 +01004094 if( PSA_ALG_IS_HKDF( kdf_alg ) )
Gilles Peskinebef7f142018-07-12 17:22:21 +02004095 {
Gilles Peskine969c5d62019-01-16 15:53:06 +01004096 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( kdf_alg );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004097 status = psa_key_derivation_hkdf_read( &operation->ctx.hkdf, hash_alg,
Gilles Peskinebef7f142018-07-12 17:22:21 +02004098 output, output_length );
4099 }
Janos Follathadbec812019-06-14 11:05:39 +01004100 else
John Durkop07cc04a2020-11-16 22:08:34 -08004101#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */
4102#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
4103 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Janos Follathadbec812019-06-14 11:05:39 +01004104 if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
John Durkop07cc04a2020-11-16 22:08:34 -08004105 PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Hanno Beckerc8a41d72018-10-09 17:33:01 +01004106 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004107 status = psa_key_derivation_tls12_prf_read( &operation->ctx.tls12_prf,
Steven Cooremana6df6042021-04-29 19:32:25 +02004108 kdf_alg, output,
4109 output_length );
Hanno Beckerc8a41d72018-10-09 17:33:01 +01004110 }
Gilles Peskinebef7f142018-07-12 17:22:21 +02004111 else
John Durkop07cc04a2020-11-16 22:08:34 -08004112#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF ||
4113 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Gilles Peskineeab56e42018-07-12 17:12:33 +02004114 {
Steven Cooreman74afe472021-02-10 17:19:22 +01004115 (void) kdf_alg;
Gilles Peskineeab56e42018-07-12 17:12:33 +02004116 return( PSA_ERROR_BAD_STATE );
4117 }
4118
4119exit:
4120 if( status != PSA_SUCCESS )
4121 {
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004122 /* Preserve the algorithm upon errors, but clear all sensitive state.
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004123 * This allows us to differentiate between exhausted operations and
4124 * blank operations, so we can return PSA_ERROR_BAD_STATE on blank
4125 * operations. */
4126 psa_algorithm_t alg = operation->alg;
4127 psa_key_derivation_abort( operation );
4128 operation->alg = alg;
Gilles Peskineeab56e42018-07-12 17:12:33 +02004129 memset( output, '!', output_length );
4130 }
4131 return( status );
4132}
4133
David Brown7807bf72021-02-09 16:28:23 -07004134#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Gilles Peskine08542d82018-07-19 17:05:42 +02004135static void psa_des_set_key_parity( uint8_t *data, size_t data_size )
4136{
4137 if( data_size >= 8 )
4138 mbedtls_des_key_set_parity( data );
4139 if( data_size >= 16 )
4140 mbedtls_des_key_set_parity( data + 8 );
4141 if( data_size >= 24 )
4142 mbedtls_des_key_set_parity( data + 16 );
4143}
David Brown7807bf72021-02-09 16:28:23 -07004144#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */
Gilles Peskine08542d82018-07-19 17:05:42 +02004145
Adrian L. Shaw5a5a79a2019-05-03 15:44:28 +01004146static psa_status_t psa_generate_derived_key_internal(
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004147 psa_key_slot_t *slot,
4148 size_t bits,
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004149 psa_key_derivation_operation_t *operation )
Gilles Peskineeab56e42018-07-12 17:12:33 +02004150{
4151 uint8_t *data = NULL;
4152 size_t bytes = PSA_BITS_TO_BYTES( bits );
Archanad8a83dc2021-06-14 10:04:16 +05304153 size_t storage_size = bytes;
Gilles Peskineeab56e42018-07-12 17:12:33 +02004154 psa_status_t status;
4155
Gilles Peskine8e338702019-07-30 20:06:31 +02004156 if( ! key_type_is_raw_bytes( slot->attr.type ) )
Gilles Peskineeab56e42018-07-12 17:12:33 +02004157 return( PSA_ERROR_INVALID_ARGUMENT );
4158 if( bits % 8 != 0 )
4159 return( PSA_ERROR_INVALID_ARGUMENT );
4160 data = mbedtls_calloc( 1, bytes );
4161 if( data == NULL )
4162 return( PSA_ERROR_INSUFFICIENT_MEMORY );
4163
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004164 status = psa_key_derivation_output_bytes( operation, data, bytes );
Gilles Peskineeab56e42018-07-12 17:12:33 +02004165 if( status != PSA_SUCCESS )
4166 goto exit;
David Brown12ca5032021-02-11 11:02:00 -07004167#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Gilles Peskine8e338702019-07-30 20:06:31 +02004168 if( slot->attr.type == PSA_KEY_TYPE_DES )
Gilles Peskine08542d82018-07-19 17:05:42 +02004169 psa_des_set_key_parity( data, bytes );
David Brown8107e312021-02-12 08:08:46 -07004170#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */
Ronald Crondd04d422020-11-28 15:14:42 +01004171
Ronald Cronbf33c932020-11-28 18:06:53 +01004172 slot->attr.bits = (psa_key_bits_t) bits;
Ronald Cron2ebfdcc2020-11-28 15:54:54 +01004173 psa_key_attributes_t attributes = {
4174 .core = slot->attr
4175 };
4176
Archanad8a83dc2021-06-14 10:04:16 +05304177 if( psa_key_lifetime_is_external( attributes.core.lifetime ) )
4178 {
4179 status = psa_driver_wrapper_get_key_buffer_size( &attributes, &storage_size );
4180 if( status != PSA_SUCCESS )
4181 goto exit;
4182 }
4183 status = psa_allocate_buffer_to_slot( slot, storage_size );
4184 if( status != PSA_SUCCESS )
4185 goto exit;
4186
Ronald Cronbf33c932020-11-28 18:06:53 +01004187 status = psa_driver_wrapper_import_key( &attributes,
4188 data, bytes,
4189 slot->key.data,
4190 slot->key.bytes,
4191 &slot->key.bytes, &bits );
4192 if( bits != slot->attr.bits )
4193 status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskineeab56e42018-07-12 17:12:33 +02004194
4195exit:
4196 mbedtls_free( data );
4197 return( status );
4198}
4199
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02004200psa_status_t psa_key_derivation_output_key( const psa_key_attributes_t *attributes,
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004201 psa_key_derivation_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02004202 mbedtls_svc_key_id_t *key )
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004203{
4204 psa_status_t status;
4205 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02004206 psa_se_drv_table_entry_t *driver = NULL;
Gilles Peskine0f84d622019-09-12 19:03:13 +02004207
Ronald Cron81709fc2020-11-14 12:10:32 +01004208 *key = MBEDTLS_SVC_KEY_ID_INIT;
4209
Gilles Peskine0f84d622019-09-12 19:03:13 +02004210 /* Reject any attempt to create a zero-length key so that we don't
4211 * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
4212 if( psa_get_key_bits( attributes ) == 0 )
4213 return( PSA_ERROR_INVALID_ARGUMENT );
4214
Gilles Peskine178c9aa2019-09-24 18:21:06 +02004215 if( ! operation->can_output_key )
4216 return( PSA_ERROR_NOT_PERMITTED );
4217
Ronald Cron81709fc2020-11-14 12:10:32 +01004218 status = psa_start_key_creation( PSA_KEY_CREATION_DERIVE, attributes,
4219 &slot, &driver );
Gilles Peskinef4ee6622019-07-24 13:44:30 +02004220#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
4221 if( driver != NULL )
4222 {
4223 /* Deriving a key in a secure element is not implemented yet. */
4224 status = PSA_ERROR_NOT_SUPPORTED;
4225 }
4226#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004227 if( status == PSA_SUCCESS )
4228 {
Adrian L. Shaw5a5a79a2019-05-03 15:44:28 +01004229 status = psa_generate_derived_key_internal( slot,
Gilles Peskine7e0cff92019-07-30 13:48:52 +02004230 attributes->core.bits,
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004231 operation );
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004232 }
4233 if( status == PSA_SUCCESS )
Ronald Cron81709fc2020-11-14 12:10:32 +01004234 status = psa_finish_key_creation( slot, driver, key );
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004235 if( status != PSA_SUCCESS )
Gilles Peskine011e4282019-06-26 18:34:38 +02004236 psa_fail_key_creation( slot, driver );
Ronald Cronf95a2b12020-10-22 15:24:49 +02004237
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004238 return( status );
4239}
4240
Gilles Peskineeab56e42018-07-12 17:12:33 +02004241
4242
4243/****************************************************************/
Gilles Peskineea0fb492018-07-12 17:17:20 +02004244/* Key derivation */
4245/****************************************************************/
4246
Steven Cooreman932ffb72021-02-15 12:14:32 +01004247#if defined(AT_LEAST_ONE_BUILTIN_KDF)
Gilles Peskine969c5d62019-01-16 15:53:06 +01004248static psa_status_t psa_key_derivation_setup_kdf(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004249 psa_key_derivation_operation_t *operation,
Gilles Peskine969c5d62019-01-16 15:53:06 +01004250 psa_algorithm_t kdf_alg )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004251{
John Durkop07cc04a2020-11-16 22:08:34 -08004252 int is_kdf_alg_supported;
4253
Janos Follath5fe19732019-06-20 15:09:30 +01004254 /* Make sure that operation->ctx is properly zero-initialised. (Macro
4255 * initialisers for this union leave some bytes unspecified.) */
4256 memset( &operation->ctx, 0, sizeof( operation->ctx ) );
4257
Gilles Peskine969c5d62019-01-16 15:53:06 +01004258 /* Make sure that kdf_alg is a supported key derivation algorithm. */
John Durkopd0321952020-10-29 21:37:36 -07004259#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
John Durkop07cc04a2020-11-16 22:08:34 -08004260 if( PSA_ALG_IS_HKDF( kdf_alg ) )
4261 is_kdf_alg_supported = 1;
4262 else
4263#endif
4264#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF)
4265 if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) )
4266 is_kdf_alg_supported = 1;
4267 else
4268#endif
4269#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
4270 if( PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
4271 is_kdf_alg_supported = 1;
4272 else
4273#endif
4274 is_kdf_alg_supported = 0;
4275
4276 if( is_kdf_alg_supported )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004277 {
Gilles Peskine969c5d62019-01-16 15:53:06 +01004278 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( kdf_alg );
gabor-mezei-armcbcec212020-12-18 14:23:51 +01004279 size_t hash_size = PSA_HASH_LENGTH( hash_alg );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004280 if( hash_size == 0 )
4281 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine969c5d62019-01-16 15:53:06 +01004282 if( ( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
4283 PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) ) &&
Gilles Peskineab4b2012019-04-12 15:06:27 +02004284 ! ( hash_alg == PSA_ALG_SHA_256 || hash_alg == PSA_ALG_SHA_384 ) )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004285 {
4286 return( PSA_ERROR_NOT_SUPPORTED );
4287 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004288 operation->capacity = 255 * hash_size;
Gilles Peskine969c5d62019-01-16 15:53:06 +01004289 return( PSA_SUCCESS );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004290 }
John Durkop07cc04a2020-11-16 22:08:34 -08004291
4292 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine969c5d62019-01-16 15:53:06 +01004293}
John Durkop07cc04a2020-11-16 22:08:34 -08004294#endif /* AT_LEAST_ONE_BUILTIN_KDF */
Gilles Peskine969c5d62019-01-16 15:53:06 +01004295
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004296psa_status_t psa_key_derivation_setup( psa_key_derivation_operation_t *operation,
Gilles Peskine969c5d62019-01-16 15:53:06 +01004297 psa_algorithm_t alg )
4298{
4299 psa_status_t status;
4300
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004301 if( operation->alg != 0 )
Gilles Peskine969c5d62019-01-16 15:53:06 +01004302 return( PSA_ERROR_BAD_STATE );
4303
Gilles Peskine6843c292019-01-18 16:44:49 +01004304 if( PSA_ALG_IS_RAW_KEY_AGREEMENT( alg ) )
4305 return( PSA_ERROR_INVALID_ARGUMENT );
4306 else if( PSA_ALG_IS_KEY_AGREEMENT( alg ) )
Gilles Peskine969c5d62019-01-16 15:53:06 +01004307 {
Steven Cooreman932ffb72021-02-15 12:14:32 +01004308#if defined(AT_LEAST_ONE_BUILTIN_KDF)
Gilles Peskine969c5d62019-01-16 15:53:06 +01004309 psa_algorithm_t kdf_alg = PSA_ALG_KEY_AGREEMENT_GET_KDF( alg );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004310 status = psa_key_derivation_setup_kdf( operation, kdf_alg );
Steven Cooreman932ffb72021-02-15 12:14:32 +01004311#else
4312 return( PSA_ERROR_NOT_SUPPORTED );
4313#endif /* AT_LEAST_ONE_BUILTIN_KDF */
Gilles Peskine969c5d62019-01-16 15:53:06 +01004314 }
4315 else if( PSA_ALG_IS_KEY_DERIVATION( alg ) )
4316 {
Steven Cooreman932ffb72021-02-15 12:14:32 +01004317#if defined(AT_LEAST_ONE_BUILTIN_KDF)
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004318 status = psa_key_derivation_setup_kdf( operation, alg );
Steven Cooreman932ffb72021-02-15 12:14:32 +01004319#else
4320 return( PSA_ERROR_NOT_SUPPORTED );
4321#endif /* AT_LEAST_ONE_BUILTIN_KDF */
Gilles Peskine969c5d62019-01-16 15:53:06 +01004322 }
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004323 else
4324 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine969c5d62019-01-16 15:53:06 +01004325
4326 if( status == PSA_SUCCESS )
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004327 operation->alg = alg;
Gilles Peskine969c5d62019-01-16 15:53:06 +01004328 return( status );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004329}
4330
John Durkopd0321952020-10-29 21:37:36 -07004331#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Gilles Peskinecbe66502019-05-16 16:59:18 +02004332static psa_status_t psa_hkdf_input( psa_hkdf_key_derivation_t *hkdf,
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004333 psa_algorithm_t hash_alg,
4334 psa_key_derivation_step_t step,
4335 const uint8_t *data,
4336 size_t data_length )
4337{
4338 psa_status_t status;
4339 switch( step )
4340 {
Gilles Peskine03410b52019-05-16 16:05:19 +02004341 case PSA_KEY_DERIVATION_INPUT_SALT:
Gilles Peskine2b522db2019-04-12 15:11:49 +02004342 if( hkdf->state != HKDF_STATE_INIT )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004343 return( PSA_ERROR_BAD_STATE );
Steven Cooremand1ed1d92021-04-29 19:11:25 +02004344 else
4345 {
Steven Cooreman094a77e2021-05-06 17:58:36 +02004346 status = psa_key_derivation_start_hmac( &hkdf->hmac,
4347 hash_alg,
4348 data, data_length );
Steven Cooremand1ed1d92021-04-29 19:11:25 +02004349 if( status != PSA_SUCCESS )
4350 return( status );
4351 hkdf->state = HKDF_STATE_STARTED;
4352 return( PSA_SUCCESS );
4353 }
Gilles Peskine03410b52019-05-16 16:05:19 +02004354 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004355 /* If no salt was provided, use an empty salt. */
4356 if( hkdf->state == HKDF_STATE_INIT )
4357 {
Steven Cooreman094a77e2021-05-06 17:58:36 +02004358 status = psa_key_derivation_start_hmac( &hkdf->hmac,
4359 hash_alg,
4360 NULL, 0 );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004361 if( status != PSA_SUCCESS )
4362 return( status );
4363 hkdf->state = HKDF_STATE_STARTED;
4364 }
Gilles Peskine2b522db2019-04-12 15:11:49 +02004365 if( hkdf->state != HKDF_STATE_STARTED )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004366 return( PSA_ERROR_BAD_STATE );
Steven Cooremand1ed1d92021-04-29 19:11:25 +02004367 status = psa_mac_update( &hkdf->hmac,
4368 data, data_length );
Gilles Peskine2b522db2019-04-12 15:11:49 +02004369 if( status != PSA_SUCCESS )
4370 return( status );
Steven Cooremand1ed1d92021-04-29 19:11:25 +02004371 status = psa_mac_sign_finish( &hkdf->hmac,
4372 hkdf->prk,
4373 sizeof( hkdf->prk ),
4374 &data_length );
Gilles Peskine2b522db2019-04-12 15:11:49 +02004375 if( status != PSA_SUCCESS )
4376 return( status );
gabor-mezei-armcbcec212020-12-18 14:23:51 +01004377 hkdf->offset_in_block = PSA_HASH_LENGTH( hash_alg );
Gilles Peskine2b522db2019-04-12 15:11:49 +02004378 hkdf->block_number = 0;
4379 hkdf->state = HKDF_STATE_KEYED;
4380 return( PSA_SUCCESS );
Gilles Peskine03410b52019-05-16 16:05:19 +02004381 case PSA_KEY_DERIVATION_INPUT_INFO:
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004382 if( hkdf->state == HKDF_STATE_OUTPUT )
4383 return( PSA_ERROR_BAD_STATE );
4384 if( hkdf->info_set )
4385 return( PSA_ERROR_BAD_STATE );
4386 hkdf->info_length = data_length;
4387 if( data_length != 0 )
4388 {
4389 hkdf->info = mbedtls_calloc( 1, data_length );
4390 if( hkdf->info == NULL )
4391 return( PSA_ERROR_INSUFFICIENT_MEMORY );
4392 memcpy( hkdf->info, data, data_length );
4393 }
4394 hkdf->info_set = 1;
4395 return( PSA_SUCCESS );
4396 default:
4397 return( PSA_ERROR_INVALID_ARGUMENT );
4398 }
4399}
John Durkop07cc04a2020-11-16 22:08:34 -08004400#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */
Janos Follathb03233e2019-06-11 15:30:30 +01004401
John Durkop07cc04a2020-11-16 22:08:34 -08004402#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
4403 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Janos Follathf08e2652019-06-13 09:05:41 +01004404static psa_status_t psa_tls12_prf_set_seed( psa_tls12_prf_key_derivation_t *prf,
4405 const uint8_t *data,
4406 size_t data_length )
4407{
Gilles Peskine43f958b2020-12-13 14:55:14 +01004408 if( prf->state != PSA_TLS12_PRF_STATE_INIT )
Janos Follathf08e2652019-06-13 09:05:41 +01004409 return( PSA_ERROR_BAD_STATE );
4410
Janos Follathd6dce9f2019-07-04 09:11:38 +01004411 if( data_length != 0 )
4412 {
4413 prf->seed = mbedtls_calloc( 1, data_length );
4414 if( prf->seed == NULL )
4415 return( PSA_ERROR_INSUFFICIENT_MEMORY );
Janos Follathf08e2652019-06-13 09:05:41 +01004416
Janos Follathd6dce9f2019-07-04 09:11:38 +01004417 memcpy( prf->seed, data, data_length );
4418 prf->seed_length = data_length;
4419 }
Janos Follathf08e2652019-06-13 09:05:41 +01004420
Gilles Peskine43f958b2020-12-13 14:55:14 +01004421 prf->state = PSA_TLS12_PRF_STATE_SEED_SET;
Janos Follathf08e2652019-06-13 09:05:41 +01004422
4423 return( PSA_SUCCESS );
4424}
4425
Janos Follath81550542019-06-13 14:26:34 +01004426static psa_status_t psa_tls12_prf_set_key( psa_tls12_prf_key_derivation_t *prf,
Janos Follath81550542019-06-13 14:26:34 +01004427 const uint8_t *data,
4428 size_t data_length )
4429{
Gilles Peskine43f958b2020-12-13 14:55:14 +01004430 if( prf->state != PSA_TLS12_PRF_STATE_SEED_SET )
Janos Follath81550542019-06-13 14:26:34 +01004431 return( PSA_ERROR_BAD_STATE );
4432
Steven Cooremana6df6042021-04-29 19:32:25 +02004433 if( data_length != 0 )
4434 {
4435 prf->secret = mbedtls_calloc( 1, data_length );
4436 if( prf->secret == NULL )
4437 return( PSA_ERROR_INSUFFICIENT_MEMORY );
4438
4439 memcpy( prf->secret, data, data_length );
4440 prf->secret_length = data_length;
4441 }
Janos Follath81550542019-06-13 14:26:34 +01004442
Gilles Peskine43f958b2020-12-13 14:55:14 +01004443 prf->state = PSA_TLS12_PRF_STATE_KEY_SET;
Janos Follath81550542019-06-13 14:26:34 +01004444
4445 return( PSA_SUCCESS );
4446}
4447
Janos Follath63028dd2019-06-13 09:15:47 +01004448static psa_status_t psa_tls12_prf_set_label( psa_tls12_prf_key_derivation_t *prf,
4449 const uint8_t *data,
4450 size_t data_length )
4451{
Gilles Peskine43f958b2020-12-13 14:55:14 +01004452 if( prf->state != PSA_TLS12_PRF_STATE_KEY_SET )
Janos Follath63028dd2019-06-13 09:15:47 +01004453 return( PSA_ERROR_BAD_STATE );
4454
Janos Follathd6dce9f2019-07-04 09:11:38 +01004455 if( data_length != 0 )
4456 {
4457 prf->label = mbedtls_calloc( 1, data_length );
4458 if( prf->label == NULL )
4459 return( PSA_ERROR_INSUFFICIENT_MEMORY );
Janos Follath63028dd2019-06-13 09:15:47 +01004460
Janos Follathd6dce9f2019-07-04 09:11:38 +01004461 memcpy( prf->label, data, data_length );
4462 prf->label_length = data_length;
4463 }
Janos Follath63028dd2019-06-13 09:15:47 +01004464
Gilles Peskine43f958b2020-12-13 14:55:14 +01004465 prf->state = PSA_TLS12_PRF_STATE_LABEL_SET;
Janos Follath63028dd2019-06-13 09:15:47 +01004466
4467 return( PSA_SUCCESS );
4468}
4469
Janos Follathb03233e2019-06-11 15:30:30 +01004470static psa_status_t psa_tls12_prf_input( psa_tls12_prf_key_derivation_t *prf,
Janos Follathb03233e2019-06-11 15:30:30 +01004471 psa_key_derivation_step_t step,
4472 const uint8_t *data,
4473 size_t data_length )
4474{
Janos Follathb03233e2019-06-11 15:30:30 +01004475 switch( step )
4476 {
Janos Follathf08e2652019-06-13 09:05:41 +01004477 case PSA_KEY_DERIVATION_INPUT_SEED:
4478 return( psa_tls12_prf_set_seed( prf, data, data_length ) );
Janos Follath81550542019-06-13 14:26:34 +01004479 case PSA_KEY_DERIVATION_INPUT_SECRET:
Steven Cooremana6df6042021-04-29 19:32:25 +02004480 return( psa_tls12_prf_set_key( prf, data, data_length ) );
Janos Follath63028dd2019-06-13 09:15:47 +01004481 case PSA_KEY_DERIVATION_INPUT_LABEL:
4482 return( psa_tls12_prf_set_label( prf, data, data_length ) );
Janos Follathb03233e2019-06-11 15:30:30 +01004483 default:
4484 return( PSA_ERROR_INVALID_ARGUMENT );
4485 }
4486}
John Durkop07cc04a2020-11-16 22:08:34 -08004487#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) ||
4488 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
4489
4490#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
4491static psa_status_t psa_tls12_prf_psk_to_ms_set_key(
4492 psa_tls12_prf_key_derivation_t *prf,
John Durkop07cc04a2020-11-16 22:08:34 -08004493 const uint8_t *data,
4494 size_t data_length )
4495{
4496 psa_status_t status;
gabor-mezei-armcbcec212020-12-18 14:23:51 +01004497 uint8_t pms[ 4 + 2 * PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE ];
John Durkop07cc04a2020-11-16 22:08:34 -08004498 uint8_t *cur = pms;
4499
gabor-mezei-armcbcec212020-12-18 14:23:51 +01004500 if( data_length > PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE )
John Durkop07cc04a2020-11-16 22:08:34 -08004501 return( PSA_ERROR_INVALID_ARGUMENT );
4502
4503 /* Quoting RFC 4279, Section 2:
4504 *
4505 * The premaster secret is formed as follows: if the PSK is N octets
4506 * long, concatenate a uint16 with the value N, N zero octets, a second
4507 * uint16 with the value N, and the PSK itself.
4508 */
4509
Joe Subbiani5ecac212021-06-24 13:00:03 +01004510 *cur++ = MBEDTLS_BYTE_1( data_length );
4511 *cur++ = MBEDTLS_BYTE_0( data_length );
John Durkop07cc04a2020-11-16 22:08:34 -08004512 memset( cur, 0, data_length );
4513 cur += data_length;
4514 *cur++ = pms[0];
4515 *cur++ = pms[1];
4516 memcpy( cur, data, data_length );
4517 cur += data_length;
4518
Steven Cooremana6df6042021-04-29 19:32:25 +02004519 status = psa_tls12_prf_set_key( prf, pms, cur - pms );
John Durkop07cc04a2020-11-16 22:08:34 -08004520
4521 mbedtls_platform_zeroize( pms, sizeof( pms ) );
4522 return( status );
4523}
Janos Follath6660f0e2019-06-17 08:44:03 +01004524
4525static psa_status_t psa_tls12_prf_psk_to_ms_input(
4526 psa_tls12_prf_key_derivation_t *prf,
Janos Follath6660f0e2019-06-17 08:44:03 +01004527 psa_key_derivation_step_t step,
4528 const uint8_t *data,
4529 size_t data_length )
4530{
4531 if( step == PSA_KEY_DERIVATION_INPUT_SECRET )
Janos Follath0c1ed842019-06-28 13:35:36 +01004532 {
Steven Cooremana6df6042021-04-29 19:32:25 +02004533 return( psa_tls12_prf_psk_to_ms_set_key( prf,
Janos Follath6660f0e2019-06-17 08:44:03 +01004534 data, data_length ) );
Janos Follath0c1ed842019-06-28 13:35:36 +01004535 }
Janos Follath6660f0e2019-06-17 08:44:03 +01004536
Steven Cooremana6df6042021-04-29 19:32:25 +02004537 return( psa_tls12_prf_input( prf, step, data, data_length ) );
Janos Follath6660f0e2019-06-17 08:44:03 +01004538}
John Durkop07cc04a2020-11-16 22:08:34 -08004539#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004540
Gilles Peskineb8965192019-09-24 16:21:10 +02004541/** Check whether the given key type is acceptable for the given
4542 * input step of a key derivation.
4543 *
4544 * Secret inputs must have the type #PSA_KEY_TYPE_DERIVE.
4545 * Non-secret inputs must have the type #PSA_KEY_TYPE_RAW_DATA.
4546 * Both secret and non-secret inputs can alternatively have the type
4547 * #PSA_KEY_TYPE_NONE, which is never the type of a key object, meaning
4548 * that the input was passed as a buffer rather than via a key object.
4549 */
Gilles Peskine224b0d62019-09-23 18:13:17 +02004550static int psa_key_derivation_check_input_type(
4551 psa_key_derivation_step_t step,
4552 psa_key_type_t key_type )
4553{
4554 switch( step )
4555 {
4556 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskineb8965192019-09-24 16:21:10 +02004557 if( key_type == PSA_KEY_TYPE_DERIVE )
4558 return( PSA_SUCCESS );
4559 if( key_type == PSA_KEY_TYPE_NONE )
Gilles Peskine224b0d62019-09-23 18:13:17 +02004560 return( PSA_SUCCESS );
4561 break;
4562 case PSA_KEY_DERIVATION_INPUT_LABEL:
4563 case PSA_KEY_DERIVATION_INPUT_SALT:
4564 case PSA_KEY_DERIVATION_INPUT_INFO:
4565 case PSA_KEY_DERIVATION_INPUT_SEED:
Gilles Peskineb8965192019-09-24 16:21:10 +02004566 if( key_type == PSA_KEY_TYPE_RAW_DATA )
4567 return( PSA_SUCCESS );
4568 if( key_type == PSA_KEY_TYPE_NONE )
Gilles Peskine224b0d62019-09-23 18:13:17 +02004569 return( PSA_SUCCESS );
4570 break;
4571 }
4572 return( PSA_ERROR_INVALID_ARGUMENT );
4573}
4574
Janos Follathb80a94e2019-06-12 15:54:46 +01004575static psa_status_t psa_key_derivation_input_internal(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004576 psa_key_derivation_operation_t *operation,
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01004577 psa_key_derivation_step_t step,
Gilles Peskine224b0d62019-09-23 18:13:17 +02004578 psa_key_type_t key_type,
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01004579 const uint8_t *data,
4580 size_t data_length )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004581{
Gilles Peskine46d7faf2019-09-23 19:22:55 +02004582 psa_status_t status;
4583 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg( operation );
4584
4585 status = psa_key_derivation_check_input_type( step, key_type );
Gilles Peskine224b0d62019-09-23 18:13:17 +02004586 if( status != PSA_SUCCESS )
4587 goto exit;
4588
John Durkopd0321952020-10-29 21:37:36 -07004589#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Gilles Peskine969c5d62019-01-16 15:53:06 +01004590 if( PSA_ALG_IS_HKDF( kdf_alg ) )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004591 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004592 status = psa_hkdf_input( &operation->ctx.hkdf,
Gilles Peskine969c5d62019-01-16 15:53:06 +01004593 PSA_ALG_HKDF_GET_HASH( kdf_alg ),
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004594 step, data, data_length );
4595 }
John Durkop07cc04a2020-11-16 22:08:34 -08004596 else
4597#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */
4598#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF)
4599 if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004600 {
Janos Follathb03233e2019-06-11 15:30:30 +01004601 status = psa_tls12_prf_input( &operation->ctx.tls12_prf,
Janos Follathb03233e2019-06-11 15:30:30 +01004602 step, data, data_length );
Janos Follath6660f0e2019-06-17 08:44:03 +01004603 }
John Durkop07cc04a2020-11-16 22:08:34 -08004604 else
4605#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF */
4606#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
4607 if( PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Janos Follath6660f0e2019-06-17 08:44:03 +01004608 {
4609 status = psa_tls12_prf_psk_to_ms_input( &operation->ctx.tls12_prf,
Janos Follath6660f0e2019-06-17 08:44:03 +01004610 step, data, data_length );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004611 }
4612 else
John Durkop07cc04a2020-11-16 22:08:34 -08004613#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004614 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004615 /* This can't happen unless the operation object was not initialized */
Steven Cooreman74afe472021-02-10 17:19:22 +01004616 (void) data;
4617 (void) data_length;
4618 (void) kdf_alg;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004619 return( PSA_ERROR_BAD_STATE );
4620 }
4621
Gilles Peskine224b0d62019-09-23 18:13:17 +02004622exit:
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004623 if( status != PSA_SUCCESS )
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004624 psa_key_derivation_abort( operation );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004625 return( status );
4626}
4627
Janos Follath51f4a0f2019-06-14 11:35:55 +01004628psa_status_t psa_key_derivation_input_bytes(
4629 psa_key_derivation_operation_t *operation,
4630 psa_key_derivation_step_t step,
4631 const uint8_t *data,
4632 size_t data_length )
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01004633{
Gilles Peskineb8965192019-09-24 16:21:10 +02004634 return( psa_key_derivation_input_internal( operation, step,
4635 PSA_KEY_TYPE_NONE,
Janos Follathc5621512019-06-14 11:27:57 +01004636 data, data_length ) );
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01004637}
4638
Janos Follath51f4a0f2019-06-14 11:35:55 +01004639psa_status_t psa_key_derivation_input_key(
4640 psa_key_derivation_operation_t *operation,
4641 psa_key_derivation_step_t step,
Ronald Croncf56a0a2020-08-04 09:51:30 +02004642 mbedtls_svc_key_id_t key )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004643{
Ronald Cronf95a2b12020-10-22 15:24:49 +02004644 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01004645 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004646 psa_key_slot_t *slot;
Gilles Peskine178c9aa2019-09-24 18:21:06 +02004647
Ronald Cron5c522922020-11-14 16:35:34 +01004648 status = psa_get_and_lock_transparent_key_slot_with_policy(
4649 key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004650 if( status != PSA_SUCCESS )
Gilles Peskine593773d2019-09-23 18:17:40 +02004651 {
4652 psa_key_derivation_abort( operation );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004653 return( status );
Gilles Peskine593773d2019-09-23 18:17:40 +02004654 }
Gilles Peskine178c9aa2019-09-24 18:21:06 +02004655
4656 /* Passing a key object as a SECRET input unlocks the permission
4657 * to output to a key object. */
4658 if( step == PSA_KEY_DERIVATION_INPUT_SECRET )
4659 operation->can_output_key = 1;
4660
Ronald Cronf95a2b12020-10-22 15:24:49 +02004661 status = psa_key_derivation_input_internal( operation,
4662 step, slot->attr.type,
Ronald Cronea0f8a62020-11-25 17:52:23 +01004663 slot->key.data,
4664 slot->key.bytes );
Ronald Cronf95a2b12020-10-22 15:24:49 +02004665
Ronald Cron5c522922020-11-14 16:35:34 +01004666 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02004667
Ronald Cron5c522922020-11-14 16:35:34 +01004668 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004669}
Gilles Peskineea0fb492018-07-12 17:17:20 +02004670
4671
4672
4673/****************************************************************/
Gilles Peskine01d718c2018-09-18 12:01:02 +02004674/* Key agreement */
4675/****************************************************************/
4676
John Durkop6ba40d12020-11-10 08:50:04 -08004677#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004678static psa_status_t psa_key_agreement_ecdh( const uint8_t *peer_key,
4679 size_t peer_key_length,
4680 const mbedtls_ecp_keypair *our_key,
4681 uint8_t *shared_secret,
4682 size_t shared_secret_size,
4683 size_t *shared_secret_length )
4684{
Steven Cooremand4867872020-08-05 16:31:39 +02004685 mbedtls_ecp_keypair *their_key = NULL;
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004686 mbedtls_ecdh_context ecdh;
Jaeden Amero97271b32019-01-10 19:38:51 +00004687 psa_status_t status;
Gilles Peskinec7ef5b32019-12-12 16:58:00 +01004688 size_t bits = 0;
Paul Elliott8ff510a2020-06-02 17:19:28 +01004689 psa_ecc_family_t curve = mbedtls_ecc_group_to_psa( our_key->grp.id, &bits );
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004690 mbedtls_ecdh_init( &ecdh );
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004691
Ronald Cron90857082020-11-25 14:58:33 +01004692 status = mbedtls_psa_ecp_load_representation(
4693 PSA_KEY_TYPE_ECC_PUBLIC_KEY(curve),
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +01004694 bits,
Ronald Cron90857082020-11-25 14:58:33 +01004695 peer_key,
4696 peer_key_length,
4697 &their_key );
Jaeden Amero97271b32019-01-10 19:38:51 +00004698 if( status != PSA_SUCCESS )
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004699 goto exit;
4700
Jaeden Amero97271b32019-01-10 19:38:51 +00004701 status = mbedtls_to_psa_error(
Steven Cooremana2371e52020-07-28 14:30:39 +02004702 mbedtls_ecdh_get_params( &ecdh, their_key, MBEDTLS_ECDH_THEIRS ) );
Jaeden Amero97271b32019-01-10 19:38:51 +00004703 if( status != PSA_SUCCESS )
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004704 goto exit;
Jaeden Amero97271b32019-01-10 19:38:51 +00004705 status = mbedtls_to_psa_error(
4706 mbedtls_ecdh_get_params( &ecdh, our_key, MBEDTLS_ECDH_OURS ) );
4707 if( status != PSA_SUCCESS )
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004708 goto exit;
4709
Jaeden Amero97271b32019-01-10 19:38:51 +00004710 status = mbedtls_to_psa_error(
4711 mbedtls_ecdh_calc_secret( &ecdh,
4712 shared_secret_length,
4713 shared_secret, shared_secret_size,
Gilles Peskine30524eb2020-11-13 17:02:26 +01004714 mbedtls_psa_get_random,
Gilles Peskine5894e8e2020-12-14 14:54:06 +01004715 MBEDTLS_PSA_RANDOM_STATE ) );
Gilles Peskinec7ef5b32019-12-12 16:58:00 +01004716 if( status != PSA_SUCCESS )
4717 goto exit;
4718 if( PSA_BITS_TO_BYTES( bits ) != *shared_secret_length )
4719 status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004720
4721exit:
Gilles Peskine3e819b72019-12-20 14:09:55 +01004722 if( status != PSA_SUCCESS )
4723 mbedtls_platform_zeroize( shared_secret, shared_secret_size );
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004724 mbedtls_ecdh_free( &ecdh );
Steven Cooremana2371e52020-07-28 14:30:39 +02004725 mbedtls_ecp_keypair_free( their_key );
Steven Cooreman6d839f02020-07-30 11:36:45 +02004726 mbedtls_free( their_key );
Steven Cooremana2371e52020-07-28 14:30:39 +02004727
Jaeden Amero97271b32019-01-10 19:38:51 +00004728 return( status );
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004729}
John Durkop6ba40d12020-11-10 08:50:04 -08004730#endif /* MBEDTLS_PSA_BUILTIN_ALG_ECDH */
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004731
Gilles Peskine01d718c2018-09-18 12:01:02 +02004732#define PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE MBEDTLS_ECP_MAX_BYTES
4733
Gilles Peskine0216fe12019-04-11 21:23:21 +02004734static psa_status_t psa_key_agreement_raw_internal( psa_algorithm_t alg,
4735 psa_key_slot_t *private_key,
4736 const uint8_t *peer_key,
4737 size_t peer_key_length,
4738 uint8_t *shared_secret,
4739 size_t shared_secret_size,
4740 size_t *shared_secret_length )
Gilles Peskine01d718c2018-09-18 12:01:02 +02004741{
Gilles Peskine0216fe12019-04-11 21:23:21 +02004742 switch( alg )
Gilles Peskine01d718c2018-09-18 12:01:02 +02004743 {
John Durkop6ba40d12020-11-10 08:50:04 -08004744#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
Gilles Peskine0216fe12019-04-11 21:23:21 +02004745 case PSA_ALG_ECDH:
Gilles Peskine8e338702019-07-30 20:06:31 +02004746 if( ! PSA_KEY_TYPE_IS_ECC_KEY_PAIR( private_key->attr.type ) )
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004747 return( PSA_ERROR_INVALID_ARGUMENT );
Steven Cooremana2371e52020-07-28 14:30:39 +02004748 mbedtls_ecp_keypair *ecp = NULL;
Ronald Cron90857082020-11-25 14:58:33 +01004749 psa_status_t status = mbedtls_psa_ecp_load_representation(
4750 private_key->attr.type,
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +01004751 private_key->attr.bits,
Ronald Cron90857082020-11-25 14:58:33 +01004752 private_key->key.data,
4753 private_key->key.bytes,
4754 &ecp );
Steven Cooremanacda8342020-07-24 23:09:52 +02004755 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02004756 return( status );
Steven Cooremanacda8342020-07-24 23:09:52 +02004757 status = psa_key_agreement_ecdh( peer_key, peer_key_length,
Steven Cooremana2371e52020-07-28 14:30:39 +02004758 ecp,
Steven Cooremanacda8342020-07-24 23:09:52 +02004759 shared_secret, shared_secret_size,
4760 shared_secret_length );
Steven Cooremana2371e52020-07-28 14:30:39 +02004761 mbedtls_ecp_keypair_free( ecp );
4762 mbedtls_free( ecp );
Steven Cooreman29149862020-08-05 15:43:42 +02004763 return( status );
John Durkop6ba40d12020-11-10 08:50:04 -08004764#endif /* MBEDTLS_PSA_BUILTIN_ALG_ECDH */
Gilles Peskine01d718c2018-09-18 12:01:02 +02004765 default:
Gilles Peskine93f85002018-11-16 16:43:31 +01004766 (void) private_key;
4767 (void) peer_key;
4768 (void) peer_key_length;
Gilles Peskine0216fe12019-04-11 21:23:21 +02004769 (void) shared_secret;
4770 (void) shared_secret_size;
4771 (void) shared_secret_length;
Gilles Peskine01d718c2018-09-18 12:01:02 +02004772 return( PSA_ERROR_NOT_SUPPORTED );
4773 }
Gilles Peskine0216fe12019-04-11 21:23:21 +02004774}
4775
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02004776/* Note that if this function fails, you must call psa_key_derivation_abort()
Gilles Peskine01d718c2018-09-18 12:01:02 +02004777 * to potentially free embedded data structures and wipe confidential data.
4778 */
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004779static psa_status_t psa_key_agreement_internal( psa_key_derivation_operation_t *operation,
Gilles Peskine969c5d62019-01-16 15:53:06 +01004780 psa_key_derivation_step_t step,
Gilles Peskine01d718c2018-09-18 12:01:02 +02004781 psa_key_slot_t *private_key,
4782 const uint8_t *peer_key,
Gilles Peskine969c5d62019-01-16 15:53:06 +01004783 size_t peer_key_length )
Gilles Peskine01d718c2018-09-18 12:01:02 +02004784{
4785 psa_status_t status;
4786 uint8_t shared_secret[PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE];
4787 size_t shared_secret_length = 0;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004788 psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE( operation->alg );
Gilles Peskine01d718c2018-09-18 12:01:02 +02004789
4790 /* Step 1: run the secret agreement algorithm to generate the shared
4791 * secret. */
Gilles Peskine0216fe12019-04-11 21:23:21 +02004792 status = psa_key_agreement_raw_internal( ka_alg,
4793 private_key,
4794 peer_key, peer_key_length,
itayzafrir0adf0fc2018-09-06 16:24:41 +03004795 shared_secret,
4796 sizeof( shared_secret ),
Gilles Peskine05d69892018-06-19 22:00:52 +02004797 &shared_secret_length );
Gilles Peskine53d991e2018-07-12 01:14:59 +02004798 if( status != PSA_SUCCESS )
Gilles Peskine12313cd2018-06-20 00:20:32 +02004799 goto exit;
4800
Gilles Peskineb0b255c2018-07-06 17:01:38 +02004801 /* Step 2: set up the key derivation to generate key material from
Gilles Peskine224b0d62019-09-23 18:13:17 +02004802 * the shared secret. A shared secret is permitted wherever a key
4803 * of type DERIVE is permitted. */
Janos Follathb80a94e2019-06-12 15:54:46 +01004804 status = psa_key_derivation_input_internal( operation, step,
Gilles Peskine224b0d62019-09-23 18:13:17 +02004805 PSA_KEY_TYPE_DERIVE,
Janos Follathb80a94e2019-06-12 15:54:46 +01004806 shared_secret,
4807 shared_secret_length );
Gilles Peskine12313cd2018-06-20 00:20:32 +02004808exit:
Gilles Peskine3f108122018-12-07 18:14:53 +01004809 mbedtls_platform_zeroize( shared_secret, shared_secret_length );
Gilles Peskine12313cd2018-06-20 00:20:32 +02004810 return( status );
4811}
4812
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004813psa_status_t psa_key_derivation_key_agreement( psa_key_derivation_operation_t *operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02004814 psa_key_derivation_step_t step,
Ronald Croncf56a0a2020-08-04 09:51:30 +02004815 mbedtls_svc_key_id_t private_key,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02004816 const uint8_t *peer_key,
4817 size_t peer_key_length )
Gilles Peskine12313cd2018-06-20 00:20:32 +02004818{
Ronald Cronf95a2b12020-10-22 15:24:49 +02004819 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01004820 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01004821 psa_key_slot_t *slot;
Ronald Cronf95a2b12020-10-22 15:24:49 +02004822
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004823 if( ! PSA_ALG_IS_KEY_AGREEMENT( operation->alg ) )
Gilles Peskine12313cd2018-06-20 00:20:32 +02004824 return( PSA_ERROR_INVALID_ARGUMENT );
Ronald Cron5c522922020-11-14 16:35:34 +01004825 status = psa_get_and_lock_transparent_key_slot_with_policy(
4826 private_key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg );
Gilles Peskine12313cd2018-06-20 00:20:32 +02004827 if( status != PSA_SUCCESS )
4828 return( status );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004829 status = psa_key_agreement_internal( operation, step,
Gilles Peskine346797d2018-11-16 16:05:06 +01004830 slot,
Gilles Peskine969c5d62019-01-16 15:53:06 +01004831 peer_key, peer_key_length );
Gilles Peskine346797d2018-11-16 16:05:06 +01004832 if( status != PSA_SUCCESS )
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004833 psa_key_derivation_abort( operation );
Steven Cooremanfa5e6312020-10-15 17:07:12 +02004834 else
4835 {
4836 /* If a private key has been added as SECRET, we allow the derived
4837 * key material to be used as a key in PSA Crypto. */
4838 if( step == PSA_KEY_DERIVATION_INPUT_SECRET )
4839 operation->can_output_key = 1;
4840 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02004841
Ronald Cron5c522922020-11-14 16:35:34 +01004842 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02004843
Ronald Cron5c522922020-11-14 16:35:34 +01004844 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskineaf3baab2018-06-27 22:55:52 +02004845}
4846
Gilles Peskinebe697d82019-05-16 18:00:41 +02004847psa_status_t psa_raw_key_agreement( psa_algorithm_t alg,
Ronald Croncf56a0a2020-08-04 09:51:30 +02004848 mbedtls_svc_key_id_t private_key,
Gilles Peskinebe697d82019-05-16 18:00:41 +02004849 const uint8_t *peer_key,
4850 size_t peer_key_length,
4851 uint8_t *output,
4852 size_t output_size,
4853 size_t *output_length )
Gilles Peskine0216fe12019-04-11 21:23:21 +02004854{
Ronald Cronf95a2b12020-10-22 15:24:49 +02004855 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01004856 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cronf95a2b12020-10-22 15:24:49 +02004857 psa_key_slot_t *slot = NULL;
Gilles Peskine0216fe12019-04-11 21:23:21 +02004858
4859 if( ! PSA_ALG_IS_KEY_AGREEMENT( alg ) )
4860 {
4861 status = PSA_ERROR_INVALID_ARGUMENT;
4862 goto exit;
4863 }
Ronald Cron5c522922020-11-14 16:35:34 +01004864 status = psa_get_and_lock_transparent_key_slot_with_policy(
4865 private_key, &slot, PSA_KEY_USAGE_DERIVE, alg );
Gilles Peskine0216fe12019-04-11 21:23:21 +02004866 if( status != PSA_SUCCESS )
4867 goto exit;
4868
4869 status = psa_key_agreement_raw_internal( alg, slot,
4870 peer_key, peer_key_length,
4871 output, output_size,
4872 output_length );
4873
4874exit:
4875 if( status != PSA_SUCCESS )
4876 {
4877 /* If an error happens and is not handled properly, the output
4878 * may be used as a key to protect sensitive data. Arrange for such
4879 * a key to be random, which is likely to result in decryption or
4880 * verification errors. This is better than filling the buffer with
4881 * some constant data such as zeros, which would result in the data
4882 * being protected with a reproducible, easily knowable key.
4883 */
4884 psa_generate_random( output, output_size );
4885 *output_length = output_size;
4886 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02004887
Ronald Cron5c522922020-11-14 16:35:34 +01004888 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02004889
Ronald Cron5c522922020-11-14 16:35:34 +01004890 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskine0216fe12019-04-11 21:23:21 +02004891}
Gilles Peskine86a440b2018-11-12 18:39:40 +01004892
4893
Gilles Peskine30524eb2020-11-13 17:02:26 +01004894
Gilles Peskine86a440b2018-11-12 18:39:40 +01004895/****************************************************************/
4896/* Random generation */
Gilles Peskine53d991e2018-07-12 01:14:59 +02004897/****************************************************************/
Gilles Peskine12313cd2018-06-20 00:20:32 +02004898
Gilles Peskine30524eb2020-11-13 17:02:26 +01004899/** Initialize the PSA random generator.
4900 */
4901static void mbedtls_psa_random_init( mbedtls_psa_random_context_t *rng )
4902{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01004903#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
4904 memset( rng, 0, sizeof( *rng ) );
4905#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
4906
Gilles Peskine30524eb2020-11-13 17:02:26 +01004907 /* Set default configuration if
4908 * mbedtls_psa_crypto_configure_entropy_sources() hasn't been called. */
4909 if( rng->entropy_init == NULL )
4910 rng->entropy_init = mbedtls_entropy_init;
4911 if( rng->entropy_free == NULL )
4912 rng->entropy_free = mbedtls_entropy_free;
4913
4914 rng->entropy_init( &rng->entropy );
4915#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \
4916 defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES)
4917 /* The PSA entropy injection feature depends on using NV seed as an entropy
4918 * source. Add NV seed as an entropy source for PSA entropy injection. */
4919 mbedtls_entropy_add_source( &rng->entropy,
4920 mbedtls_nv_seed_poll, NULL,
4921 MBEDTLS_ENTROPY_BLOCK_SIZE,
4922 MBEDTLS_ENTROPY_SOURCE_STRONG );
4923#endif
4924
Gilles Peskine5894e8e2020-12-14 14:54:06 +01004925 mbedtls_psa_drbg_init( MBEDTLS_PSA_RANDOM_STATE );
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01004926#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01004927}
4928
4929/** Deinitialize the PSA random generator.
4930 */
4931static void mbedtls_psa_random_free( mbedtls_psa_random_context_t *rng )
4932{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01004933#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
4934 memset( rng, 0, sizeof( *rng ) );
4935#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine5894e8e2020-12-14 14:54:06 +01004936 mbedtls_psa_drbg_free( MBEDTLS_PSA_RANDOM_STATE );
Gilles Peskine30524eb2020-11-13 17:02:26 +01004937 rng->entropy_free( &rng->entropy );
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01004938#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01004939}
4940
4941/** Seed the PSA random generator.
4942 */
4943static psa_status_t mbedtls_psa_random_seed( mbedtls_psa_random_context_t *rng )
4944{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01004945#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
4946 /* Do nothing: the external RNG seeds itself. */
4947 (void) rng;
4948 return( PSA_SUCCESS );
4949#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01004950 const unsigned char drbg_seed[] = "PSA";
Gilles Peskine5894e8e2020-12-14 14:54:06 +01004951 int ret = mbedtls_psa_drbg_seed( &rng->entropy,
4952 drbg_seed, sizeof( drbg_seed ) - 1 );
Gilles Peskine30524eb2020-11-13 17:02:26 +01004953 return mbedtls_to_psa_error( ret );
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01004954#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01004955}
4956
Gilles Peskinee59236f2018-01-27 23:32:46 +01004957psa_status_t psa_generate_random( uint8_t *output,
4958 size_t output_size )
4959{
Gilles Peskinee59236f2018-01-27 23:32:46 +01004960 GUARD_MODULE_INITIALIZED;
4961
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01004962#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
4963
4964 size_t output_length = 0;
4965 psa_status_t status = mbedtls_psa_external_get_random( &global_data.rng,
4966 output, output_size,
4967 &output_length );
4968 if( status != PSA_SUCCESS )
4969 return( status );
4970 /* Breaking up a request into smaller chunks is currently not supported
4971 * for the extrernal RNG interface. */
4972 if( output_length != output_size )
4973 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
4974 return( PSA_SUCCESS );
4975
4976#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
4977
Gilles Peskine71ddab92021-01-04 21:01:07 +01004978 while( output_size > 0 )
Gilles Peskinef181eca2019-08-07 13:49:00 +02004979 {
Gilles Peskine71ddab92021-01-04 21:01:07 +01004980 size_t request_size =
4981 ( output_size > MBEDTLS_PSA_RANDOM_MAX_REQUEST ?
4982 MBEDTLS_PSA_RANDOM_MAX_REQUEST :
4983 output_size );
Gilles Peskine0c59ba82021-01-05 14:10:59 +01004984 int ret = mbedtls_psa_get_random( MBEDTLS_PSA_RANDOM_STATE,
4985 output, request_size );
Gilles Peskinef181eca2019-08-07 13:49:00 +02004986 if( ret != 0 )
4987 return( mbedtls_to_psa_error( ret ) );
Gilles Peskine71ddab92021-01-04 21:01:07 +01004988 output_size -= request_size;
4989 output += request_size;
Gilles Peskinef181eca2019-08-07 13:49:00 +02004990 }
Gilles Peskine0c59ba82021-01-05 14:10:59 +01004991 return( PSA_SUCCESS );
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01004992#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskinee59236f2018-01-27 23:32:46 +01004993}
4994
Gilles Peskine8814fc42020-12-14 15:33:44 +01004995/* Wrapper function allowing the classic API to use the PSA RNG.
Gilles Peskine9c3e0602021-01-05 16:03:55 +01004996 *
4997 * `mbedtls_psa_get_random(MBEDTLS_PSA_RANDOM_STATE, ...)` calls
4998 * `psa_generate_random(...)`. The state parameter is ignored since the
4999 * PSA API doesn't support passing an explicit state.
5000 *
5001 * In the non-external case, psa_generate_random() calls an
5002 * `mbedtls_xxx_drbg_random` function which has exactly the same signature
5003 * and semantics as mbedtls_psa_get_random(). As an optimization,
5004 * instead of doing this back-and-forth between the PSA API and the
5005 * classic API, psa_crypto_random_impl.h defines `mbedtls_psa_get_random`
5006 * as a constant function pointer to `mbedtls_xxx_drbg_random`.
Gilles Peskine8814fc42020-12-14 15:33:44 +01005007 */
5008#if defined (MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
5009int mbedtls_psa_get_random( void *p_rng,
5010 unsigned char *output,
5011 size_t output_size )
5012{
Gilles Peskine9c3e0602021-01-05 16:03:55 +01005013 /* This function takes a pointer to the RNG state because that's what
5014 * classic mbedtls functions using an RNG expect. The PSA RNG manages
5015 * its own state internally and doesn't let the caller access that state.
5016 * So we just ignore the state parameter, and in practice we'll pass
5017 * NULL. */
Gilles Peskine8814fc42020-12-14 15:33:44 +01005018 (void) p_rng;
5019 psa_status_t status = psa_generate_random( output, output_size );
5020 if( status == PSA_SUCCESS )
5021 return( 0 );
5022 else
5023 return( MBEDTLS_ERR_ENTROPY_SOURCE_FAILED );
5024}
5025#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
5026
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01005027#if defined(MBEDTLS_PSA_INJECT_ENTROPY)
Chris Jonesea0a8652021-03-09 19:11:19 +00005028#include "entropy_poll.h"
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01005029
Gilles Peskine7228da22019-07-15 11:06:15 +02005030psa_status_t mbedtls_psa_inject_entropy( const uint8_t *seed,
Netanel Gonen2bcd3122018-11-19 11:53:02 +02005031 size_t seed_size )
5032{
Netanel Gonen2bcd3122018-11-19 11:53:02 +02005033 if( global_data.initialized )
5034 return( PSA_ERROR_NOT_PERMITTED );
Netanel Gonen21f37cb2018-11-19 11:53:55 +02005035
5036 if( ( ( seed_size < MBEDTLS_ENTROPY_MIN_PLATFORM ) ||
5037 ( seed_size < MBEDTLS_ENTROPY_BLOCK_SIZE ) ) ||
5038 ( seed_size > MBEDTLS_ENTROPY_MAX_SEED_SIZE ) )
5039 return( PSA_ERROR_INVALID_ARGUMENT );
5040
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01005041 return( mbedtls_psa_storage_inject_entropy( seed, seed_size ) );
Netanel Gonen2bcd3122018-11-19 11:53:02 +02005042}
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01005043#endif /* MBEDTLS_PSA_INJECT_ENTROPY */
Netanel Gonen2bcd3122018-11-19 11:53:02 +02005044
Ronald Cron3772afe2021-02-08 16:10:05 +01005045/** Validate the key type and size for key generation
Ronald Cron01b2aba2020-10-05 09:42:02 +02005046 *
Ronald Cron3772afe2021-02-08 16:10:05 +01005047 * \param type The key type
5048 * \param bits The number of bits of the key
Ronald Cron01b2aba2020-10-05 09:42:02 +02005049 *
5050 * \retval #PSA_SUCCESS
Ronald Cron3772afe2021-02-08 16:10:05 +01005051 * The key type and size are valid.
Ronald Cron01b2aba2020-10-05 09:42:02 +02005052 * \retval #PSA_ERROR_INVALID_ARGUMENT
5053 * The size in bits of the key is not valid.
5054 * \retval #PSA_ERROR_NOT_SUPPORTED
5055 * The type and/or the size in bits of the key or the combination of
5056 * the two is not supported.
5057 */
Ronald Cron3772afe2021-02-08 16:10:05 +01005058static psa_status_t psa_validate_key_type_and_size_for_key_generation(
5059 psa_key_type_t type, size_t bits )
Gilles Peskinee59236f2018-01-27 23:32:46 +01005060{
Ronald Cronf3bb7612020-10-02 20:11:59 +02005061 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinee59236f2018-01-27 23:32:46 +01005062
Gilles Peskinee59236f2018-01-27 23:32:46 +01005063 if( key_type_is_raw_bytes( type ) )
5064 {
Archana4d7ae1d2021-07-07 02:50:22 +05305065 status = psa_validate_unstructured_key_bit_size( type, bits );
Gilles Peskinee59236f2018-01-27 23:32:46 +01005066 if( status != PSA_SUCCESS )
5067 return( status );
Ronald Cron01b2aba2020-10-05 09:42:02 +02005068 }
5069 else
Ronald Cron5c4d3862020-12-07 11:07:24 +01005070#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR)
Ronald Cron01b2aba2020-10-05 09:42:02 +02005071 if( PSA_KEY_TYPE_IS_RSA( type ) && PSA_KEY_TYPE_IS_KEY_PAIR( type ) )
5072 {
5073 if( bits > PSA_VENDOR_RSA_MAX_KEY_BITS )
5074 return( PSA_ERROR_NOT_SUPPORTED );
Steven Cooreman81be2fa2020-07-24 22:04:59 +02005075
Ronald Cron01b2aba2020-10-05 09:42:02 +02005076 /* Accept only byte-aligned keys, for the same reasons as
5077 * in psa_import_rsa_key(). */
5078 if( bits % 8 != 0 )
5079 return( PSA_ERROR_NOT_SUPPORTED );
Ronald Cron01b2aba2020-10-05 09:42:02 +02005080 }
5081 else
Ronald Cron5c4d3862020-12-07 11:07:24 +01005082#endif /* defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR) */
Ronald Cron01b2aba2020-10-05 09:42:02 +02005083
Ronald Cron5c4d3862020-12-07 11:07:24 +01005084#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR)
Ronald Cron01b2aba2020-10-05 09:42:02 +02005085 if( PSA_KEY_TYPE_IS_ECC( type ) && PSA_KEY_TYPE_IS_KEY_PAIR( type ) )
5086 {
Ronald Crond81ab562021-02-16 09:01:16 +01005087 /* To avoid empty block, return successfully here. */
5088 return( PSA_SUCCESS );
Ronald Cron01b2aba2020-10-05 09:42:02 +02005089 }
5090 else
Ronald Cron5c4d3862020-12-07 11:07:24 +01005091#endif /* defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) */
Ronald Cron01b2aba2020-10-05 09:42:02 +02005092 {
5093 return( PSA_ERROR_NOT_SUPPORTED );
5094 }
5095
5096 return( PSA_SUCCESS );
5097}
5098
Ronald Cron55ed0592020-10-05 10:30:40 +02005099psa_status_t psa_generate_key_internal(
Ronald Cron2a38a6b2020-10-02 20:02:04 +02005100 const psa_key_attributes_t *attributes,
5101 uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length )
Ronald Cron01b2aba2020-10-05 09:42:02 +02005102{
5103 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron2a38a6b2020-10-02 20:02:04 +02005104 psa_key_type_t type = attributes->core.type;
Ronald Cron01b2aba2020-10-05 09:42:02 +02005105
Ronald Cron2a38a6b2020-10-02 20:02:04 +02005106 if( ( attributes->domain_parameters == NULL ) &&
5107 ( attributes->domain_parameters_size != 0 ) )
Ronald Cron01b2aba2020-10-05 09:42:02 +02005108 return( PSA_ERROR_INVALID_ARGUMENT );
5109
Ronald Cron01b2aba2020-10-05 09:42:02 +02005110 if( key_type_is_raw_bytes( type ) )
5111 {
Ronald Cron2a38a6b2020-10-02 20:02:04 +02005112 status = psa_generate_random( key_buffer, key_buffer_size );
Gilles Peskinee59236f2018-01-27 23:32:46 +01005113 if( status != PSA_SUCCESS )
Gilles Peskinee59236f2018-01-27 23:32:46 +01005114 return( status );
Steven Cooreman81be2fa2020-07-24 22:04:59 +02005115
David Brown12ca5032021-02-11 11:02:00 -07005116#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Gilles Peskinee59236f2018-01-27 23:32:46 +01005117 if( type == PSA_KEY_TYPE_DES )
Ronald Cron2a38a6b2020-10-02 20:02:04 +02005118 psa_des_set_key_parity( key_buffer, key_buffer_size );
David Brown8107e312021-02-12 08:08:46 -07005119#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */
Gilles Peskinee59236f2018-01-27 23:32:46 +01005120 }
5121 else
5122
Jaeden Amero424fa932021-05-14 08:34:32 +01005123#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) && \
5124 defined(MBEDTLS_GENPRIME)
Gilles Peskinec93b80c2019-05-16 19:39:54 +02005125 if ( type == PSA_KEY_TYPE_RSA_KEY_PAIR )
Gilles Peskinee59236f2018-01-27 23:32:46 +01005126 {
Ronald Cron9e18fc12020-11-05 17:36:40 +01005127 return( mbedtls_psa_rsa_generate_key( attributes,
5128 key_buffer,
5129 key_buffer_size,
5130 key_buffer_length ) );
Gilles Peskinee59236f2018-01-27 23:32:46 +01005131 }
5132 else
Jaeden Amero424fa932021-05-14 08:34:32 +01005133#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR)
5134 * defined(MBEDTLS_GENPRIME) */
Gilles Peskinee59236f2018-01-27 23:32:46 +01005135
John Durkop9814fa22020-11-04 12:28:15 -08005136#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR)
Gilles Peskinec93b80c2019-05-16 19:39:54 +02005137 if ( PSA_KEY_TYPE_IS_ECC( type ) && PSA_KEY_TYPE_IS_KEY_PAIR( type ) )
Gilles Peskinee59236f2018-01-27 23:32:46 +01005138 {
Ronald Cron7023db52020-11-20 18:17:42 +01005139 return( mbedtls_psa_ecp_generate_key( attributes,
5140 key_buffer,
5141 key_buffer_size,
5142 key_buffer_length ) );
Gilles Peskinee59236f2018-01-27 23:32:46 +01005143 }
5144 else
John Durkop9814fa22020-11-04 12:28:15 -08005145#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) */
Steven Cooreman29149862020-08-05 15:43:42 +02005146 {
Ronald Cron2a38a6b2020-10-02 20:02:04 +02005147 (void)key_buffer_length;
Gilles Peskinee59236f2018-01-27 23:32:46 +01005148 return( PSA_ERROR_NOT_SUPPORTED );
Steven Cooreman29149862020-08-05 15:43:42 +02005149 }
Gilles Peskinee59236f2018-01-27 23:32:46 +01005150
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005151 return( PSA_SUCCESS );
5152}
Darryl Green0c6575a2018-11-07 16:05:30 +00005153
Gilles Peskine35ef36b2019-05-16 19:42:05 +02005154psa_status_t psa_generate_key( const psa_key_attributes_t *attributes,
Ronald Croncf56a0a2020-08-04 09:51:30 +02005155 mbedtls_svc_key_id_t *key )
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005156{
5157 psa_status_t status;
5158 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02005159 psa_se_drv_table_entry_t *driver = NULL;
Ronald Cron2b56bc82020-10-05 10:02:26 +02005160 size_t key_buffer_size;
Gilles Peskine11792082019-08-06 18:36:36 +02005161
Ronald Cron81709fc2020-11-14 12:10:32 +01005162 *key = MBEDTLS_SVC_KEY_ID_INIT;
5163
Gilles Peskine0f84d622019-09-12 19:03:13 +02005164 /* Reject any attempt to create a zero-length key so that we don't
5165 * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
5166 if( psa_get_key_bits( attributes ) == 0 )
5167 return( PSA_ERROR_INVALID_ARGUMENT );
5168
Ronald Cron81709fc2020-11-14 12:10:32 +01005169 status = psa_start_key_creation( PSA_KEY_CREATION_GENERATE, attributes,
5170 &slot, &driver );
Gilles Peskine11792082019-08-06 18:36:36 +02005171 if( status != PSA_SUCCESS )
5172 goto exit;
5173
Ronald Cron977c2472020-10-13 08:32:21 +02005174 /* In the case of a transparent key or an opaque key stored in local
Archana4d7ae1d2021-07-07 02:50:22 +05305175 * storage( thus not in the case of the old-style secure element interface
5176 * (MBEDTLS_PSA_CRYPTO_SE_C)),we have to allocate a buffer to hold the
5177 * imported key material. */
Ronald Cron977c2472020-10-13 08:32:21 +02005178 if( slot->key.data == NULL )
5179 {
5180 if ( PSA_KEY_LIFETIME_GET_LOCATION( attributes->core.lifetime ) ==
5181 PSA_KEY_LOCATION_LOCAL_STORAGE )
5182 {
Ronald Cron3772afe2021-02-08 16:10:05 +01005183 status = psa_validate_key_type_and_size_for_key_generation(
5184 attributes->core.type, attributes->core.bits );
5185 if( status != PSA_SUCCESS )
5186 goto exit;
5187
5188 key_buffer_size = PSA_EXPORT_KEY_OUTPUT_SIZE(
5189 attributes->core.type,
5190 attributes->core.bits );
Ronald Cron977c2472020-10-13 08:32:21 +02005191 }
5192 else
5193 {
5194 status = psa_driver_wrapper_get_key_buffer_size(
5195 attributes, &key_buffer_size );
Ronald Cron3772afe2021-02-08 16:10:05 +01005196 if( status != PSA_SUCCESS )
5197 goto exit;
Ronald Cron977c2472020-10-13 08:32:21 +02005198 }
Ronald Cron977c2472020-10-13 08:32:21 +02005199
5200 status = psa_allocate_buffer_to_slot( slot, key_buffer_size );
5201 if( status != PSA_SUCCESS )
5202 goto exit;
5203 }
5204
Steven Cooreman2a1664c2020-07-20 15:33:08 +02005205 status = psa_driver_wrapper_generate_key( attributes,
Ronald Cron977c2472020-10-13 08:32:21 +02005206 slot->key.data, slot->key.bytes, &slot->key.bytes );
Gilles Peskine11792082019-08-06 18:36:36 +02005207
Ronald Cron2b56bc82020-10-05 10:02:26 +02005208 if( status != PSA_SUCCESS )
5209 psa_remove_key_data_from_memory( slot );
5210
Gilles Peskine11792082019-08-06 18:36:36 +02005211exit:
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005212 if( status == PSA_SUCCESS )
Ronald Cron81709fc2020-11-14 12:10:32 +01005213 status = psa_finish_key_creation( slot, driver, key );
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005214 if( status != PSA_SUCCESS )
Gilles Peskine011e4282019-06-26 18:34:38 +02005215 psa_fail_key_creation( slot, driver );
Ronald Cronf95a2b12020-10-22 15:24:49 +02005216
Darryl Green0c6575a2018-11-07 16:05:30 +00005217 return( status );
Gilles Peskinee59236f2018-01-27 23:32:46 +01005218}
5219
Gilles Peskinee59236f2018-01-27 23:32:46 +01005220/****************************************************************/
5221/* Module setup */
5222/****************************************************************/
5223
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01005224#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
Gilles Peskine5e769522018-11-20 21:59:56 +01005225psa_status_t mbedtls_psa_crypto_configure_entropy_sources(
5226 void (* entropy_init )( mbedtls_entropy_context *ctx ),
5227 void (* entropy_free )( mbedtls_entropy_context *ctx ) )
5228{
5229 if( global_data.rng_state != RNG_NOT_INITIALIZED )
5230 return( PSA_ERROR_BAD_STATE );
Gilles Peskine30524eb2020-11-13 17:02:26 +01005231 global_data.rng.entropy_init = entropy_init;
5232 global_data.rng.entropy_free = entropy_free;
Gilles Peskine5e769522018-11-20 21:59:56 +01005233 return( PSA_SUCCESS );
5234}
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01005235#endif /* !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) */
Gilles Peskine5e769522018-11-20 21:59:56 +01005236
Gilles Peskinee59236f2018-01-27 23:32:46 +01005237void mbedtls_psa_crypto_free( void )
5238{
Gilles Peskine66fb1262018-12-10 16:29:04 +01005239 psa_wipe_all_key_slots( );
Gilles Peskinec6b69072018-11-20 21:42:52 +01005240 if( global_data.rng_state != RNG_NOT_INITIALIZED )
5241 {
Gilles Peskine30524eb2020-11-13 17:02:26 +01005242 mbedtls_psa_random_free( &global_data.rng );
Gilles Peskinec6b69072018-11-20 21:42:52 +01005243 }
5244 /* Wipe all remaining data, including configuration.
5245 * In particular, this sets all state indicator to the value
5246 * indicating "uninitialized". */
Gilles Peskine3f108122018-12-07 18:14:53 +01005247 mbedtls_platform_zeroize( &global_data, sizeof( global_data ) );
Gilles Peskinea8ade162019-06-26 11:24:49 +02005248#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined0890212019-06-24 14:34:43 +02005249 /* Unregister all secure element drivers, so that we restart from
5250 * a pristine state. */
5251 psa_unregister_all_se_drivers( );
Gilles Peskinea8ade162019-06-26 11:24:49 +02005252#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskinee59236f2018-01-27 23:32:46 +01005253}
5254
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02005255#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
5256/** Recover a transaction that was interrupted by a power failure.
5257 *
5258 * This function is called during initialization, before psa_crypto_init()
5259 * returns. If this function returns a failure status, the initialization
5260 * fails.
5261 */
5262static psa_status_t psa_crypto_recover_transaction(
5263 const psa_crypto_transaction_t *transaction )
5264{
5265 switch( transaction->unknown.type )
5266 {
5267 case PSA_CRYPTO_TRANSACTION_CREATE_KEY:
5268 case PSA_CRYPTO_TRANSACTION_DESTROY_KEY:
Janos Follath1d57a202019-08-13 12:15:34 +01005269 /* TODO - fall through to the failure case until this
Gilles Peskinec9d7f942019-08-13 16:17:16 +02005270 * is implemented.
5271 * https://github.com/ARMmbed/mbed-crypto/issues/218
5272 */
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02005273 default:
5274 /* We found an unsupported transaction in the storage.
5275 * We don't know what state the storage is in. Give up. */
gabor-mezei-armfe309242020-11-09 17:39:56 +01005276 return( PSA_ERROR_DATA_INVALID );
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02005277 }
5278}
5279#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
5280
Gilles Peskinee59236f2018-01-27 23:32:46 +01005281psa_status_t psa_crypto_init( void )
5282{
Gilles Peskine66fb1262018-12-10 16:29:04 +01005283 psa_status_t status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01005284
Gilles Peskinec6b69072018-11-20 21:42:52 +01005285 /* Double initialization is explicitly allowed. */
Gilles Peskinee59236f2018-01-27 23:32:46 +01005286 if( global_data.initialized != 0 )
5287 return( PSA_SUCCESS );
5288
Gilles Peskine30524eb2020-11-13 17:02:26 +01005289 /* Initialize and seed the random generator. */
5290 mbedtls_psa_random_init( &global_data.rng );
Gilles Peskinec6b69072018-11-20 21:42:52 +01005291 global_data.rng_state = RNG_INITIALIZED;
Gilles Peskine30524eb2020-11-13 17:02:26 +01005292 status = mbedtls_psa_random_seed( &global_data.rng );
Gilles Peskine66fb1262018-12-10 16:29:04 +01005293 if( status != PSA_SUCCESS )
Gilles Peskinee59236f2018-01-27 23:32:46 +01005294 goto exit;
Gilles Peskinec6b69072018-11-20 21:42:52 +01005295 global_data.rng_state = RNG_SEEDED;
Gilles Peskinee59236f2018-01-27 23:32:46 +01005296
Gilles Peskine66fb1262018-12-10 16:29:04 +01005297 status = psa_initialize_key_slots( );
5298 if( status != PSA_SUCCESS )
5299 goto exit;
Gilles Peskinec6b69072018-11-20 21:42:52 +01005300
Gilles Peskined9348f22019-10-01 15:22:29 +02005301#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
5302 status = psa_init_all_se_drivers( );
5303 if( status != PSA_SUCCESS )
5304 goto exit;
5305#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
5306
Gilles Peskine4b734222019-07-24 15:56:31 +02005307#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
Gilles Peskinefc762652019-07-22 19:30:34 +02005308 status = psa_crypto_load_transaction( );
5309 if( status == PSA_SUCCESS )
5310 {
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02005311 status = psa_crypto_recover_transaction( &psa_crypto_transaction );
5312 if( status != PSA_SUCCESS )
5313 goto exit;
5314 status = psa_crypto_stop_transaction( );
Gilles Peskinefc762652019-07-22 19:30:34 +02005315 }
5316 else if( status == PSA_ERROR_DOES_NOT_EXIST )
5317 {
5318 /* There's no transaction to complete. It's all good. */
5319 status = PSA_SUCCESS;
5320 }
Gilles Peskine4b734222019-07-24 15:56:31 +02005321#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
Gilles Peskinefc762652019-07-22 19:30:34 +02005322
Gilles Peskinec6b69072018-11-20 21:42:52 +01005323 /* All done. */
Gilles Peskinee59236f2018-01-27 23:32:46 +01005324 global_data.initialized = 1;
5325
5326exit:
Gilles Peskine66fb1262018-12-10 16:29:04 +01005327 if( status != PSA_SUCCESS )
Gilles Peskinee59236f2018-01-27 23:32:46 +01005328 mbedtls_psa_crypto_free( );
Gilles Peskine66fb1262018-12-10 16:29:04 +01005329 return( status );
Gilles Peskinee59236f2018-01-27 23:32:46 +01005330}
5331
5332#endif /* MBEDTLS_PSA_CRYPTO_C */