blob: ecb00f0b0fbab8304249441cb63c8b62eb553c0f [file] [log] [blame]
Gilles Peskinee59236f2018-01-27 23:32:46 +01001/*
2 * PSA crypto layer on top of Mbed TLS crypto
3 */
Bence Szépkúti86974652020-06-15 11:59:37 +02004/*
Bence Szépkúti1e148272020-08-07 13:07:28 +02005 * Copyright The Mbed TLS Contributors
Gilles Peskinee59236f2018-01-27 23:32:46 +01006 * SPDX-License-Identifier: Apache-2.0
7 *
8 * Licensed under the Apache License, Version 2.0 (the "License"); you may
9 * not use this file except in compliance with the License.
10 * You may obtain a copy of the License at
11 *
12 * http://www.apache.org/licenses/LICENSE-2.0
13 *
14 * Unless required by applicable law or agreed to in writing, software
15 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
16 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17 * See the License for the specific language governing permissions and
18 * limitations under the License.
Gilles Peskinee59236f2018-01-27 23:32:46 +010019 */
20
Gilles Peskinedb09ef62020-06-03 01:43:33 +020021#include "common.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010022
23#if defined(MBEDTLS_PSA_CRYPTO_C)
mohammad160327010052018-07-03 13:16:15 +030024
John Durkop07cc04a2020-11-16 22:08:34 -080025#if defined(MBEDTLS_PSA_CRYPTO_CONFIG)
26#include "check_crypto_config.h"
27#endif
28
itayzafrir7723ab12019-02-14 10:28:02 +020029#include "psa_crypto_service_integration.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010030#include "psa/crypto.h"
31
Gilles Peskine039b90c2018-12-07 18:24:41 +010032#include "psa_crypto_core.h"
Gilles Peskine5e769522018-11-20 21:59:56 +010033#include "psa_crypto_invasive.h"
Steven Cooremancd84cb42020-07-16 20:28:36 +020034#include "psa_crypto_driver_wrappers.h"
Ronald Cron00b7bfc2020-11-25 15:25:26 +010035#include "psa_crypto_ecp.h"
36#include "psa_crypto_rsa.h"
Ronald Cron7023db52020-11-20 18:17:42 +010037#include "psa_crypto_ecp.h"
Gilles Peskinea8ade162019-06-26 11:24:49 +020038#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined0890212019-06-24 14:34:43 +020039#include "psa_crypto_se.h"
Gilles Peskinea8ade162019-06-26 11:24:49 +020040#endif
Gilles Peskine961849f2018-11-30 18:54:54 +010041#include "psa_crypto_slot_management.h"
Darryl Greend49a4992018-06-18 17:27:26 +010042/* Include internal declarations that are useful for implementing persistently
43 * stored keys. */
44#include "psa_crypto_storage.h"
45
Gilles Peskineb2b64d32020-12-14 16:43:58 +010046#include "psa_crypto_random_impl.h"
Gilles Peskine90edc992020-11-13 15:39:19 +010047
Gilles Peskineb46bef22019-07-30 21:32:04 +020048#include <assert.h>
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010049#include <stdlib.h>
50#include <string.h>
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010051#include "mbedtls/platform.h"
Gilles Peskineff2d2002019-05-06 15:26:23 +020052#if !defined(MBEDTLS_PLATFORM_C)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010053#define mbedtls_calloc calloc
54#define mbedtls_free free
55#endif
56
Gilles Peskine1c49f1a2020-11-13 18:46:25 +010057#include "mbedtls/aes.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010058#include "mbedtls/arc4.h"
Gilles Peskine9a944802018-06-21 09:35:35 +020059#include "mbedtls/asn1.h"
Jaeden Amero25384a22019-01-10 10:23:21 +000060#include "mbedtls/asn1write.h"
Gilles Peskinea81d85b2018-06-26 16:10:23 +020061#include "mbedtls/bignum.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010062#include "mbedtls/blowfish.h"
63#include "mbedtls/camellia.h"
Gilles Peskine26869f22019-05-06 15:25:00 +020064#include "mbedtls/chacha20.h"
65#include "mbedtls/chachapoly.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010066#include "mbedtls/cipher.h"
67#include "mbedtls/ccm.h"
68#include "mbedtls/cmac.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010069#include "mbedtls/des.h"
Gilles Peskineb7ecdf02018-09-18 12:11:27 +020070#include "mbedtls/ecdh.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010071#include "mbedtls/ecp.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010072#include "mbedtls/entropy.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010073#include "mbedtls/error.h"
74#include "mbedtls/gcm.h"
75#include "mbedtls/md2.h"
76#include "mbedtls/md4.h"
77#include "mbedtls/md5.h"
Gilles Peskine20035e32018-02-03 22:44:14 +010078#include "mbedtls/md.h"
79#include "mbedtls/md_internal.h"
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010080#include "mbedtls/pk.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010081#include "mbedtls/pk_internal.h"
Gilles Peskine3f108122018-12-07 18:14:53 +010082#include "mbedtls/platform_util.h"
Janos Follath24eed8d2019-11-22 13:21:35 +000083#include "mbedtls/error.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010084#include "mbedtls/ripemd160.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010085#include "mbedtls/rsa.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010086#include "mbedtls/sha1.h"
87#include "mbedtls/sha256.h"
88#include "mbedtls/sha512.h"
89#include "mbedtls/xtea.h"
90
Gilles Peskine996deb12018-08-01 15:45:45 +020091#define ARRAY_LENGTH( array ) ( sizeof( array ) / sizeof( *( array ) ) )
92
Gilles Peskine9ef733f2018-02-07 21:05:37 +010093/* constant-time buffer comparison */
94static inline int safer_memcmp( const uint8_t *a, const uint8_t *b, size_t n )
95{
96 size_t i;
97 unsigned char diff = 0;
98
99 for( i = 0; i < n; i++ )
100 diff |= a[i] ^ b[i];
101
102 return( diff );
103}
104
105
106
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100107/****************************************************************/
108/* Global data, support functions and library management */
109/****************************************************************/
110
Gilles Peskine48c0ea12018-06-21 14:15:31 +0200111static int key_type_is_raw_bytes( psa_key_type_t type )
112{
Gilles Peskine78b3bb62018-08-10 16:03:41 +0200113 return( PSA_KEY_TYPE_IS_UNSTRUCTURED( type ) );
Gilles Peskine48c0ea12018-06-21 14:15:31 +0200114}
115
Gilles Peskine5a3c50e2018-12-04 12:27:09 +0100116/* Values for psa_global_data_t::rng_state */
117#define RNG_NOT_INITIALIZED 0
118#define RNG_INITIALIZED 1
119#define RNG_SEEDED 2
Gilles Peskinec6b69072018-11-20 21:42:52 +0100120
Gilles Peskine2d277862018-06-18 15:41:12 +0200121typedef struct
122{
Gilles Peskine30524eb2020-11-13 17:02:26 +0100123 mbedtls_psa_random_context_t rng;
Gilles Peskinec6b69072018-11-20 21:42:52 +0100124 unsigned initialized : 1;
Gilles Peskine5a3c50e2018-12-04 12:27:09 +0100125 unsigned rng_state : 2;
Gilles Peskinee59236f2018-01-27 23:32:46 +0100126} psa_global_data_t;
127
128static psa_global_data_t global_data;
129
Gilles Peskine5894e8e2020-12-14 14:54:06 +0100130#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
131mbedtls_psa_drbg_context_t *const mbedtls_psa_random_state =
132 &global_data.rng.drbg;
133#endif
134
itayzafrir0adf0fc2018-09-06 16:24:41 +0300135#define GUARD_MODULE_INITIALIZED \
136 if( global_data.initialized == 0 ) \
137 return( PSA_ERROR_BAD_STATE );
138
Steven Cooreman01164162020-07-20 15:31:37 +0200139psa_status_t mbedtls_to_psa_error( int ret )
Gilles Peskinee59236f2018-01-27 23:32:46 +0100140{
Gilles Peskinedbf68962021-01-06 20:04:23 +0100141 /* Mbed TLS error codes can combine a high-level error code and a
142 * low-level error code. The low-level error usually reflects the
143 * root cause better, so dispatch on that preferably. */
144 int low_level_ret = - ( -ret & 0x007f );
145 switch( low_level_ret != 0 ? low_level_ret : ret )
Gilles Peskinee59236f2018-01-27 23:32:46 +0100146 {
147 case 0:
148 return( PSA_SUCCESS );
Gilles Peskinea5905292018-02-07 20:59:33 +0100149
150 case MBEDTLS_ERR_AES_INVALID_KEY_LENGTH:
151 case MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH:
152 case MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE:
153 return( PSA_ERROR_NOT_SUPPORTED );
154 case MBEDTLS_ERR_AES_HW_ACCEL_FAILED:
155 return( PSA_ERROR_HARDWARE_FAILURE );
156
157 case MBEDTLS_ERR_ARC4_HW_ACCEL_FAILED:
158 return( PSA_ERROR_HARDWARE_FAILURE );
159
Gilles Peskine9a944802018-06-21 09:35:35 +0200160 case MBEDTLS_ERR_ASN1_OUT_OF_DATA:
161 case MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:
162 case MBEDTLS_ERR_ASN1_INVALID_LENGTH:
163 case MBEDTLS_ERR_ASN1_LENGTH_MISMATCH:
164 case MBEDTLS_ERR_ASN1_INVALID_DATA:
165 return( PSA_ERROR_INVALID_ARGUMENT );
166 case MBEDTLS_ERR_ASN1_ALLOC_FAILED:
167 return( PSA_ERROR_INSUFFICIENT_MEMORY );
168 case MBEDTLS_ERR_ASN1_BUF_TOO_SMALL:
169 return( PSA_ERROR_BUFFER_TOO_SMALL );
170
Jaeden Amero93e21112019-02-20 13:57:28 +0000171#if defined(MBEDTLS_ERR_BLOWFISH_BAD_INPUT_DATA)
Jaeden Amero892cd6d2019-02-11 12:21:12 +0000172 case MBEDTLS_ERR_BLOWFISH_BAD_INPUT_DATA:
Jaeden Amero93e21112019-02-20 13:57:28 +0000173#elif defined(MBEDTLS_ERR_BLOWFISH_INVALID_KEY_LENGTH)
174 case MBEDTLS_ERR_BLOWFISH_INVALID_KEY_LENGTH:
175#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100176 case MBEDTLS_ERR_BLOWFISH_INVALID_INPUT_LENGTH:
177 return( PSA_ERROR_NOT_SUPPORTED );
178 case MBEDTLS_ERR_BLOWFISH_HW_ACCEL_FAILED:
179 return( PSA_ERROR_HARDWARE_FAILURE );
180
Jaeden Amero93e21112019-02-20 13:57:28 +0000181#if defined(MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA)
Jaeden Amero892cd6d2019-02-11 12:21:12 +0000182 case MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA:
Jaeden Amero93e21112019-02-20 13:57:28 +0000183#elif defined(MBEDTLS_ERR_CAMELLIA_INVALID_KEY_LENGTH)
184 case MBEDTLS_ERR_CAMELLIA_INVALID_KEY_LENGTH:
185#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100186 case MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH:
187 return( PSA_ERROR_NOT_SUPPORTED );
188 case MBEDTLS_ERR_CAMELLIA_HW_ACCEL_FAILED:
189 return( PSA_ERROR_HARDWARE_FAILURE );
190
191 case MBEDTLS_ERR_CCM_BAD_INPUT:
192 return( PSA_ERROR_INVALID_ARGUMENT );
193 case MBEDTLS_ERR_CCM_AUTH_FAILED:
194 return( PSA_ERROR_INVALID_SIGNATURE );
195 case MBEDTLS_ERR_CCM_HW_ACCEL_FAILED:
196 return( PSA_ERROR_HARDWARE_FAILURE );
197
Gilles Peskine26869f22019-05-06 15:25:00 +0200198 case MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA:
199 return( PSA_ERROR_INVALID_ARGUMENT );
200
201 case MBEDTLS_ERR_CHACHAPOLY_BAD_STATE:
202 return( PSA_ERROR_BAD_STATE );
203 case MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED:
204 return( PSA_ERROR_INVALID_SIGNATURE );
205
Gilles Peskinea5905292018-02-07 20:59:33 +0100206 case MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE:
207 return( PSA_ERROR_NOT_SUPPORTED );
208 case MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA:
209 return( PSA_ERROR_INVALID_ARGUMENT );
210 case MBEDTLS_ERR_CIPHER_ALLOC_FAILED:
211 return( PSA_ERROR_INSUFFICIENT_MEMORY );
212 case MBEDTLS_ERR_CIPHER_INVALID_PADDING:
213 return( PSA_ERROR_INVALID_PADDING );
214 case MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED:
Fredrik Strupef90e3012020-09-28 16:11:33 +0200215 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskinea5905292018-02-07 20:59:33 +0100216 case MBEDTLS_ERR_CIPHER_AUTH_FAILED:
217 return( PSA_ERROR_INVALID_SIGNATURE );
218 case MBEDTLS_ERR_CIPHER_INVALID_CONTEXT:
Gilles Peskine4b3eb692019-05-16 21:35:18 +0200219 return( PSA_ERROR_CORRUPTION_DETECTED );
Gilles Peskinea5905292018-02-07 20:59:33 +0100220 case MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED:
221 return( PSA_ERROR_HARDWARE_FAILURE );
222
223 case MBEDTLS_ERR_CMAC_HW_ACCEL_FAILED:
224 return( PSA_ERROR_HARDWARE_FAILURE );
225
Gilles Peskine82e57d12020-11-13 21:31:17 +0100226#if !( defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) || \
227 defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE) )
Gilles Peskinebee96c82020-11-23 21:00:09 +0100228 /* Only check CTR_DRBG error codes if underlying mbedtls_xxx
229 * functions are passed a CTR_DRBG instance. */
Gilles Peskinea5905292018-02-07 20:59:33 +0100230 case MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED:
231 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
232 case MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG:
233 case MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG:
234 return( PSA_ERROR_NOT_SUPPORTED );
235 case MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR:
236 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
Gilles Peskine82e57d12020-11-13 21:31:17 +0100237#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100238
239 case MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH:
240 return( PSA_ERROR_NOT_SUPPORTED );
241 case MBEDTLS_ERR_DES_HW_ACCEL_FAILED:
242 return( PSA_ERROR_HARDWARE_FAILURE );
243
Gilles Peskinee59236f2018-01-27 23:32:46 +0100244 case MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED:
245 case MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE:
246 case MBEDTLS_ERR_ENTROPY_SOURCE_FAILED:
247 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
Gilles Peskinea5905292018-02-07 20:59:33 +0100248
249 case MBEDTLS_ERR_GCM_AUTH_FAILED:
250 return( PSA_ERROR_INVALID_SIGNATURE );
251 case MBEDTLS_ERR_GCM_BAD_INPUT:
Gilles Peskine8cac2e62018-08-21 15:07:38 +0200252 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskinea5905292018-02-07 20:59:33 +0100253 case MBEDTLS_ERR_GCM_HW_ACCEL_FAILED:
254 return( PSA_ERROR_HARDWARE_FAILURE );
255
Gilles Peskine82e57d12020-11-13 21:31:17 +0100256#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) && \
257 defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE)
Gilles Peskinebee96c82020-11-23 21:00:09 +0100258 /* Only check HMAC_DRBG error codes if underlying mbedtls_xxx
259 * functions are passed a HMAC_DRBG instance. */
Gilles Peskine82e57d12020-11-13 21:31:17 +0100260 case MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED:
261 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
262 case MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG:
263 case MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG:
264 return( PSA_ERROR_NOT_SUPPORTED );
265 case MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR:
266 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
267#endif
268
Gilles Peskinea5905292018-02-07 20:59:33 +0100269 case MBEDTLS_ERR_MD2_HW_ACCEL_FAILED:
270 case MBEDTLS_ERR_MD4_HW_ACCEL_FAILED:
271 case MBEDTLS_ERR_MD5_HW_ACCEL_FAILED:
272 return( PSA_ERROR_HARDWARE_FAILURE );
273
274 case MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE:
275 return( PSA_ERROR_NOT_SUPPORTED );
276 case MBEDTLS_ERR_MD_BAD_INPUT_DATA:
277 return( PSA_ERROR_INVALID_ARGUMENT );
278 case MBEDTLS_ERR_MD_ALLOC_FAILED:
279 return( PSA_ERROR_INSUFFICIENT_MEMORY );
280 case MBEDTLS_ERR_MD_FILE_IO_ERROR:
281 return( PSA_ERROR_STORAGE_FAILURE );
282 case MBEDTLS_ERR_MD_HW_ACCEL_FAILED:
283 return( PSA_ERROR_HARDWARE_FAILURE );
284
Gilles Peskinef76aa772018-10-29 19:24:33 +0100285 case MBEDTLS_ERR_MPI_FILE_IO_ERROR:
286 return( PSA_ERROR_STORAGE_FAILURE );
287 case MBEDTLS_ERR_MPI_BAD_INPUT_DATA:
288 return( PSA_ERROR_INVALID_ARGUMENT );
289 case MBEDTLS_ERR_MPI_INVALID_CHARACTER:
290 return( PSA_ERROR_INVALID_ARGUMENT );
291 case MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL:
292 return( PSA_ERROR_BUFFER_TOO_SMALL );
293 case MBEDTLS_ERR_MPI_NEGATIVE_VALUE:
294 return( PSA_ERROR_INVALID_ARGUMENT );
295 case MBEDTLS_ERR_MPI_DIVISION_BY_ZERO:
296 return( PSA_ERROR_INVALID_ARGUMENT );
297 case MBEDTLS_ERR_MPI_NOT_ACCEPTABLE:
298 return( PSA_ERROR_INVALID_ARGUMENT );
299 case MBEDTLS_ERR_MPI_ALLOC_FAILED:
300 return( PSA_ERROR_INSUFFICIENT_MEMORY );
301
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100302 case MBEDTLS_ERR_PK_ALLOC_FAILED:
303 return( PSA_ERROR_INSUFFICIENT_MEMORY );
304 case MBEDTLS_ERR_PK_TYPE_MISMATCH:
305 case MBEDTLS_ERR_PK_BAD_INPUT_DATA:
306 return( PSA_ERROR_INVALID_ARGUMENT );
307 case MBEDTLS_ERR_PK_FILE_IO_ERROR:
Gilles Peskinea5905292018-02-07 20:59:33 +0100308 return( PSA_ERROR_STORAGE_FAILURE );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100309 case MBEDTLS_ERR_PK_KEY_INVALID_VERSION:
310 case MBEDTLS_ERR_PK_KEY_INVALID_FORMAT:
311 return( PSA_ERROR_INVALID_ARGUMENT );
312 case MBEDTLS_ERR_PK_UNKNOWN_PK_ALG:
313 return( PSA_ERROR_NOT_SUPPORTED );
314 case MBEDTLS_ERR_PK_PASSWORD_REQUIRED:
315 case MBEDTLS_ERR_PK_PASSWORD_MISMATCH:
316 return( PSA_ERROR_NOT_PERMITTED );
317 case MBEDTLS_ERR_PK_INVALID_PUBKEY:
318 return( PSA_ERROR_INVALID_ARGUMENT );
319 case MBEDTLS_ERR_PK_INVALID_ALG:
320 case MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE:
321 case MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE:
322 return( PSA_ERROR_NOT_SUPPORTED );
323 case MBEDTLS_ERR_PK_SIG_LEN_MISMATCH:
324 return( PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskinea5905292018-02-07 20:59:33 +0100325 case MBEDTLS_ERR_PK_HW_ACCEL_FAILED:
326 return( PSA_ERROR_HARDWARE_FAILURE );
327
Gilles Peskineff2d2002019-05-06 15:26:23 +0200328 case MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED:
329 return( PSA_ERROR_HARDWARE_FAILURE );
330 case MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
331 return( PSA_ERROR_NOT_SUPPORTED );
332
Gilles Peskinea5905292018-02-07 20:59:33 +0100333 case MBEDTLS_ERR_RIPEMD160_HW_ACCEL_FAILED:
334 return( PSA_ERROR_HARDWARE_FAILURE );
335
336 case MBEDTLS_ERR_RSA_BAD_INPUT_DATA:
337 return( PSA_ERROR_INVALID_ARGUMENT );
338 case MBEDTLS_ERR_RSA_INVALID_PADDING:
339 return( PSA_ERROR_INVALID_PADDING );
340 case MBEDTLS_ERR_RSA_KEY_GEN_FAILED:
341 return( PSA_ERROR_HARDWARE_FAILURE );
342 case MBEDTLS_ERR_RSA_KEY_CHECK_FAILED:
343 return( PSA_ERROR_INVALID_ARGUMENT );
344 case MBEDTLS_ERR_RSA_PUBLIC_FAILED:
345 case MBEDTLS_ERR_RSA_PRIVATE_FAILED:
Gilles Peskine4b3eb692019-05-16 21:35:18 +0200346 return( PSA_ERROR_CORRUPTION_DETECTED );
Gilles Peskinea5905292018-02-07 20:59:33 +0100347 case MBEDTLS_ERR_RSA_VERIFY_FAILED:
348 return( PSA_ERROR_INVALID_SIGNATURE );
349 case MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE:
350 return( PSA_ERROR_BUFFER_TOO_SMALL );
351 case MBEDTLS_ERR_RSA_RNG_FAILED:
Gilles Peskine40d81602020-11-25 00:09:47 +0100352 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
Gilles Peskinea5905292018-02-07 20:59:33 +0100353 case MBEDTLS_ERR_RSA_UNSUPPORTED_OPERATION:
354 return( PSA_ERROR_NOT_SUPPORTED );
355 case MBEDTLS_ERR_RSA_HW_ACCEL_FAILED:
356 return( PSA_ERROR_HARDWARE_FAILURE );
357
358 case MBEDTLS_ERR_SHA1_HW_ACCEL_FAILED:
359 case MBEDTLS_ERR_SHA256_HW_ACCEL_FAILED:
360 case MBEDTLS_ERR_SHA512_HW_ACCEL_FAILED:
361 return( PSA_ERROR_HARDWARE_FAILURE );
362
363 case MBEDTLS_ERR_XTEA_INVALID_INPUT_LENGTH:
364 return( PSA_ERROR_INVALID_ARGUMENT );
365 case MBEDTLS_ERR_XTEA_HW_ACCEL_FAILED:
366 return( PSA_ERROR_HARDWARE_FAILURE );
367
itayzafrir5c753392018-05-08 11:18:38 +0300368 case MBEDTLS_ERR_ECP_BAD_INPUT_DATA:
itayzafrir7b30f8b2018-05-09 16:07:36 +0300369 case MBEDTLS_ERR_ECP_INVALID_KEY:
itayzafrir5c753392018-05-08 11:18:38 +0300370 return( PSA_ERROR_INVALID_ARGUMENT );
itayzafrir7b30f8b2018-05-09 16:07:36 +0300371 case MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL:
372 return( PSA_ERROR_BUFFER_TOO_SMALL );
373 case MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE:
374 return( PSA_ERROR_NOT_SUPPORTED );
375 case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH:
376 case MBEDTLS_ERR_ECP_VERIFY_FAILED:
377 return( PSA_ERROR_INVALID_SIGNATURE );
378 case MBEDTLS_ERR_ECP_ALLOC_FAILED:
379 return( PSA_ERROR_INSUFFICIENT_MEMORY );
Gilles Peskine40d81602020-11-25 00:09:47 +0100380 case MBEDTLS_ERR_ECP_RANDOM_FAILED:
381 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
itayzafrir7b30f8b2018-05-09 16:07:36 +0300382 case MBEDTLS_ERR_ECP_HW_ACCEL_FAILED:
383 return( PSA_ERROR_HARDWARE_FAILURE );
Gilles Peskine40d81602020-11-25 00:09:47 +0100384
Janos Follatha13b9052019-11-22 12:48:59 +0000385 case MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED:
386 return( PSA_ERROR_CORRUPTION_DETECTED );
itayzafrir5c753392018-05-08 11:18:38 +0300387
Gilles Peskinee59236f2018-01-27 23:32:46 +0100388 default:
David Saadab4ecc272019-02-14 13:48:10 +0200389 return( PSA_ERROR_GENERIC_ERROR );
Gilles Peskinee59236f2018-01-27 23:32:46 +0100390 }
391}
392
Gilles Peskineb0b255c2018-07-06 17:01:38 +0200393
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +0200394
395
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100396/****************************************************************/
397/* Key management */
398/****************************************************************/
399
Gilles Peskine73167e12019-07-12 23:44:37 +0200400#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
401static inline int psa_key_slot_is_external( const psa_key_slot_t *slot )
402{
Gilles Peskine8e338702019-07-30 20:06:31 +0200403 return( psa_key_lifetime_is_external( slot->attr.lifetime ) );
Gilles Peskine73167e12019-07-12 23:44:37 +0200404}
405#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
406
John Durkop07cc04a2020-11-16 22:08:34 -0800407/* For now the MBEDTLS_PSA_ACCEL_ guards are also used here since the
408 * current test driver in key_management.c is using this function
409 * when accelerators are used for ECC key pair and public key.
410 * Once that dependency is resolved these guards can be removed.
411 */
John Durkop9814fa22020-11-04 12:28:15 -0800412#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
John Durkop6ba40d12020-11-10 08:50:04 -0800413 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) || \
414 defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR) || \
415 defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY)
Paul Elliott8ff510a2020-06-02 17:19:28 +0100416mbedtls_ecp_group_id mbedtls_ecc_group_of_psa( psa_ecc_family_t curve,
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100417 size_t bits,
418 int bits_is_sloppy )
Gilles Peskine12313cd2018-06-20 00:20:32 +0200419{
420 switch( curve )
421 {
Paul Elliott8ff510a2020-06-02 17:19:28 +0100422 case PSA_ECC_FAMILY_SECP_R1:
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100423 switch( bits )
Gilles Peskine228abc52019-12-03 17:24:19 +0100424 {
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100425 case 192:
Gilles Peskine228abc52019-12-03 17:24:19 +0100426 return( MBEDTLS_ECP_DP_SECP192R1 );
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100427 case 224:
Gilles Peskine228abc52019-12-03 17:24:19 +0100428 return( MBEDTLS_ECP_DP_SECP224R1 );
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100429 case 256:
Gilles Peskine228abc52019-12-03 17:24:19 +0100430 return( MBEDTLS_ECP_DP_SECP256R1 );
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100431 case 384:
Gilles Peskine228abc52019-12-03 17:24:19 +0100432 return( MBEDTLS_ECP_DP_SECP384R1 );
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100433 case 521:
Gilles Peskine228abc52019-12-03 17:24:19 +0100434 return( MBEDTLS_ECP_DP_SECP521R1 );
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100435 case 528:
436 if( bits_is_sloppy )
437 return( MBEDTLS_ECP_DP_SECP521R1 );
438 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100439 }
440 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100441
Paul Elliott8ff510a2020-06-02 17:19:28 +0100442 case PSA_ECC_FAMILY_BRAINPOOL_P_R1:
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100443 switch( bits )
Gilles Peskine228abc52019-12-03 17:24:19 +0100444 {
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100445 case 256:
Gilles Peskine228abc52019-12-03 17:24:19 +0100446 return( MBEDTLS_ECP_DP_BP256R1 );
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100447 case 384:
Gilles Peskine228abc52019-12-03 17:24:19 +0100448 return( MBEDTLS_ECP_DP_BP384R1 );
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100449 case 512:
Gilles Peskine228abc52019-12-03 17:24:19 +0100450 return( MBEDTLS_ECP_DP_BP512R1 );
Gilles Peskine228abc52019-12-03 17:24:19 +0100451 }
452 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100453
Paul Elliott8ff510a2020-06-02 17:19:28 +0100454 case PSA_ECC_FAMILY_MONTGOMERY:
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100455 switch( bits )
Gilles Peskine228abc52019-12-03 17:24:19 +0100456 {
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100457 case 255:
Gilles Peskine228abc52019-12-03 17:24:19 +0100458 return( MBEDTLS_ECP_DP_CURVE25519 );
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100459 case 256:
460 if( bits_is_sloppy )
461 return( MBEDTLS_ECP_DP_CURVE25519 );
462 break;
463 case 448:
Gilles Peskine228abc52019-12-03 17:24:19 +0100464 return( MBEDTLS_ECP_DP_CURVE448 );
Gilles Peskine228abc52019-12-03 17:24:19 +0100465 }
466 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100467
Paul Elliott8ff510a2020-06-02 17:19:28 +0100468 case PSA_ECC_FAMILY_SECP_K1:
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100469 switch( bits )
Gilles Peskine228abc52019-12-03 17:24:19 +0100470 {
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100471 case 192:
Gilles Peskine228abc52019-12-03 17:24:19 +0100472 return( MBEDTLS_ECP_DP_SECP192K1 );
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100473 case 224:
Gilles Peskine228abc52019-12-03 17:24:19 +0100474 return( MBEDTLS_ECP_DP_SECP224K1 );
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100475 case 256:
Gilles Peskine228abc52019-12-03 17:24:19 +0100476 return( MBEDTLS_ECP_DP_SECP256K1 );
Gilles Peskine228abc52019-12-03 17:24:19 +0100477 }
478 break;
Gilles Peskine12313cd2018-06-20 00:20:32 +0200479 }
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100480
481 return( MBEDTLS_ECP_DP_NONE );
Gilles Peskine12313cd2018-06-20 00:20:32 +0200482}
John Durkop9814fa22020-11-04 12:28:15 -0800483#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
John Durkop6ba40d12020-11-10 08:50:04 -0800484 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) ||
485 * defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR) ||
486 * defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY) */
Gilles Peskine12313cd2018-06-20 00:20:32 +0200487
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200488static psa_status_t validate_unstructured_key_bit_size( psa_key_type_t type,
489 size_t bits )
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200490{
491 /* Check that the bit size is acceptable for the key type */
492 switch( type )
493 {
494 case PSA_KEY_TYPE_RAW_DATA:
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200495 case PSA_KEY_TYPE_HMAC:
Gilles Peskineea0fb492018-07-12 17:17:20 +0200496 case PSA_KEY_TYPE_DERIVE:
497 break;
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200498#if defined(MBEDTLS_AES_C)
499 case PSA_KEY_TYPE_AES:
500 if( bits != 128 && bits != 192 && bits != 256 )
501 return( PSA_ERROR_INVALID_ARGUMENT );
502 break;
503#endif
504#if defined(MBEDTLS_CAMELLIA_C)
505 case PSA_KEY_TYPE_CAMELLIA:
506 if( bits != 128 && bits != 192 && bits != 256 )
507 return( PSA_ERROR_INVALID_ARGUMENT );
508 break;
509#endif
510#if defined(MBEDTLS_DES_C)
511 case PSA_KEY_TYPE_DES:
512 if( bits != 64 && bits != 128 && bits != 192 )
513 return( PSA_ERROR_INVALID_ARGUMENT );
514 break;
515#endif
516#if defined(MBEDTLS_ARC4_C)
517 case PSA_KEY_TYPE_ARC4:
518 if( bits < 8 || bits > 2048 )
519 return( PSA_ERROR_INVALID_ARGUMENT );
520 break;
521#endif
Gilles Peskine26869f22019-05-06 15:25:00 +0200522#if defined(MBEDTLS_CHACHA20_C)
523 case PSA_KEY_TYPE_CHACHA20:
524 if( bits != 256 )
525 return( PSA_ERROR_INVALID_ARGUMENT );
526 break;
527#endif
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200528 default:
529 return( PSA_ERROR_NOT_SUPPORTED );
530 }
Gilles Peskineb54979a2018-06-21 09:32:47 +0200531 if( bits % 8 != 0 )
532 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200533
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200534 return( PSA_SUCCESS );
535}
536
Gilles Peskineb46bef22019-07-30 21:32:04 +0200537/** Return the size of the key in the given slot, in bits.
538 *
539 * \param[in] slot A key slot.
540 *
541 * \return The key size in bits, read from the metadata in the slot.
542 */
543static inline size_t psa_get_key_slot_bits( const psa_key_slot_t *slot )
544{
545 return( slot->attr.bits );
546}
547
Steven Cooreman75b74362020-07-28 14:30:13 +0200548/** Try to allocate a buffer to an empty key slot.
549 *
550 * \param[in,out] slot Key slot to attach buffer to.
551 * \param[in] buffer_length Requested size of the buffer.
552 *
553 * \retval #PSA_SUCCESS
554 * The buffer has been successfully allocated.
555 * \retval #PSA_ERROR_INSUFFICIENT_MEMORY
556 * Not enough memory was available for allocation.
557 * \retval #PSA_ERROR_ALREADY_EXISTS
558 * Trying to allocate a buffer to a non-empty key slot.
559 */
560static psa_status_t psa_allocate_buffer_to_slot( psa_key_slot_t *slot,
561 size_t buffer_length )
562{
Ronald Cronea0f8a62020-11-25 17:52:23 +0100563 if( slot->key.data != NULL )
Steven Cooreman29149862020-08-05 15:43:42 +0200564 return( PSA_ERROR_ALREADY_EXISTS );
Steven Cooreman75b74362020-07-28 14:30:13 +0200565
Ronald Cronea0f8a62020-11-25 17:52:23 +0100566 slot->key.data = mbedtls_calloc( 1, buffer_length );
567 if( slot->key.data == NULL )
Steven Cooreman29149862020-08-05 15:43:42 +0200568 return( PSA_ERROR_INSUFFICIENT_MEMORY );
Steven Cooreman75b74362020-07-28 14:30:13 +0200569
Ronald Cronea0f8a62020-11-25 17:52:23 +0100570 slot->key.bytes = buffer_length;
Steven Cooreman29149862020-08-05 15:43:42 +0200571 return( PSA_SUCCESS );
Steven Cooreman75b74362020-07-28 14:30:13 +0200572}
573
Steven Cooremanf7cebd42020-10-13 20:27:40 +0200574psa_status_t psa_copy_key_material_into_slot( psa_key_slot_t *slot,
575 const uint8_t* data,
576 size_t data_length )
577{
578 psa_status_t status = psa_allocate_buffer_to_slot( slot,
579 data_length );
580 if( status != PSA_SUCCESS )
581 return( status );
582
Ronald Cronea0f8a62020-11-25 17:52:23 +0100583 memcpy( slot->key.data, data, data_length );
Steven Cooremanf7cebd42020-10-13 20:27:40 +0200584 return( PSA_SUCCESS );
585}
586
Ronald Crona0fe59f2020-11-29 11:14:53 +0100587psa_status_t psa_import_key_into_slot(
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100588 const psa_key_attributes_t *attributes,
589 const uint8_t *data, size_t data_length,
590 uint8_t *key_buffer, size_t key_buffer_size,
591 size_t *key_buffer_length, size_t *bits )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100592{
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100593 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
594 psa_key_type_t type = attributes->core.type;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100595
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200596 /* zero-length keys are never supported. */
597 if( data_length == 0 )
598 return( PSA_ERROR_NOT_SUPPORTED );
599
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100600 if( key_type_is_raw_bytes( type ) )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100601 {
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100602 *bits = PSA_BYTES_TO_BITS( data_length );
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200603
Steven Cooreman75b74362020-07-28 14:30:13 +0200604 /* Ensure that the bytes-to-bits conversion hasn't overflown. */
605 if( data_length > SIZE_MAX / 8 )
606 return( PSA_ERROR_NOT_SUPPORTED );
607
Gilles Peskine1b9505c2019-08-07 10:59:45 +0200608 /* Enforce a size limit, and in particular ensure that the bit
609 * size fits in its representation type. */
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100610 if( ( *bits ) > PSA_MAX_KEY_BITS )
Gilles Peskinec744d992019-07-30 17:26:54 +0200611 return( PSA_ERROR_NOT_SUPPORTED );
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200612
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100613 status = validate_unstructured_key_bit_size( type, *bits );
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200614 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +0200615 return( status );
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200616
Ronald Crondd04d422020-11-28 15:14:42 +0100617 /* Copy the key material. */
618 memcpy( key_buffer, data, data_length );
619 *key_buffer_length = data_length;
620 (void)key_buffer_size;
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200621
Steven Cooreman40120f62020-10-29 11:42:22 +0100622 return( PSA_SUCCESS );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100623 }
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100624 else if( PSA_KEY_TYPE_IS_ASYMMETRIC( type ) )
Steven Cooreman19fd5742020-07-24 23:31:01 +0200625 {
John Durkop9814fa22020-11-04 12:28:15 -0800626#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
627 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100628 if( PSA_KEY_TYPE_IS_ECC( type ) )
Steven Cooreman3ea0ce42020-10-23 11:37:05 +0200629 {
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100630 return( mbedtls_psa_ecp_import_key( attributes,
631 data, data_length,
632 key_buffer, key_buffer_size,
633 key_buffer_length,
634 bits ) );
Steven Cooreman40120f62020-10-29 11:42:22 +0100635 }
John Durkop9814fa22020-11-04 12:28:15 -0800636#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
637 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
John Durkop0e005192020-10-31 22:06:54 -0700638#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
639 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100640 if( PSA_KEY_TYPE_IS_RSA( type ) )
Steven Cooreman3ea0ce42020-10-23 11:37:05 +0200641 {
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100642 return( mbedtls_psa_rsa_import_key( attributes,
643 data, data_length,
644 key_buffer, key_buffer_size,
645 key_buffer_length,
646 bits ) );
Steven Cooreman3ea0ce42020-10-23 11:37:05 +0200647 }
John Durkop9814fa22020-11-04 12:28:15 -0800648#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
649 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100650 }
Steven Cooreman40120f62020-10-29 11:42:22 +0100651
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100652 return( PSA_ERROR_NOT_SUPPORTED );
Darryl Green06fd18d2018-07-16 11:21:11 +0100653}
654
Gilles Peskinef603c712019-01-19 13:40:11 +0100655/** Calculate the intersection of two algorithm usage policies.
656 *
657 * Return 0 (which allows no operation) on incompatibility.
658 */
659static psa_algorithm_t psa_key_policy_algorithm_intersection(
660 psa_algorithm_t alg1,
661 psa_algorithm_t alg2 )
662{
Gilles Peskine549ea862019-05-22 11:45:59 +0200663 /* Common case: both sides actually specify the same policy. */
Gilles Peskinef603c712019-01-19 13:40:11 +0100664 if( alg1 == alg2 )
665 return( alg1 );
666 /* If the policies are from the same hash-and-sign family, check
667 * if one is a wildcard. If so the other has the specific algorithm. */
668 if( PSA_ALG_IS_HASH_AND_SIGN( alg1 ) &&
669 PSA_ALG_IS_HASH_AND_SIGN( alg2 ) &&
670 ( alg1 & ~PSA_ALG_HASH_MASK ) == ( alg2 & ~PSA_ALG_HASH_MASK ) )
671 {
672 if( PSA_ALG_SIGN_GET_HASH( alg1 ) == PSA_ALG_ANY_HASH )
673 return( alg2 );
674 if( PSA_ALG_SIGN_GET_HASH( alg2 ) == PSA_ALG_ANY_HASH )
675 return( alg1 );
676 }
677 /* If the policies are incompatible, allow nothing. */
678 return( 0 );
679}
680
Gilles Peskined6f371b2019-05-10 19:33:38 +0200681static int psa_key_algorithm_permits( psa_algorithm_t policy_alg,
682 psa_algorithm_t requested_alg )
683{
Gilles Peskine549ea862019-05-22 11:45:59 +0200684 /* Common case: the policy only allows requested_alg. */
Gilles Peskined6f371b2019-05-10 19:33:38 +0200685 if( requested_alg == policy_alg )
686 return( 1 );
687 /* If policy_alg is a hash-and-sign with a wildcard for the hash,
Gilles Peskine549ea862019-05-22 11:45:59 +0200688 * and requested_alg is the same hash-and-sign family with any hash,
689 * then requested_alg is compliant with policy_alg. */
Gilles Peskined6f371b2019-05-10 19:33:38 +0200690 if( PSA_ALG_IS_HASH_AND_SIGN( requested_alg ) &&
691 PSA_ALG_SIGN_GET_HASH( policy_alg ) == PSA_ALG_ANY_HASH )
692 {
693 return( ( policy_alg & ~PSA_ALG_HASH_MASK ) ==
694 ( requested_alg & ~PSA_ALG_HASH_MASK ) );
695 }
Steven Cooremance48e852020-10-05 16:02:45 +0200696 /* If policy_alg is a generic key agreement operation, then using it for
Steven Cooremanfa5e6312020-10-15 17:07:12 +0200697 * a key derivation with that key agreement should also be allowed. This
698 * behaviour is expected to be defined in a future specification version. */
Steven Cooremance48e852020-10-05 16:02:45 +0200699 if( PSA_ALG_IS_RAW_KEY_AGREEMENT( policy_alg ) &&
700 PSA_ALG_IS_KEY_AGREEMENT( requested_alg ) )
701 {
702 return( PSA_ALG_KEY_AGREEMENT_GET_BASE( requested_alg ) ==
703 policy_alg );
704 }
Gilles Peskined6f371b2019-05-10 19:33:38 +0200705 /* If it isn't permitted, it's forbidden. */
706 return( 0 );
707}
708
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100709/** Test whether a policy permits an algorithm.
710 *
711 * The caller must test usage flags separately.
712 */
713static int psa_key_policy_permits( const psa_key_policy_t *policy,
714 psa_algorithm_t alg )
715{
Gilles Peskined6f371b2019-05-10 19:33:38 +0200716 return( psa_key_algorithm_permits( policy->alg, alg ) ||
717 psa_key_algorithm_permits( policy->alg2, alg ) );
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100718}
719
Gilles Peskinef603c712019-01-19 13:40:11 +0100720/** Restrict a key policy based on a constraint.
721 *
722 * \param[in,out] policy The policy to restrict.
723 * \param[in] constraint The policy constraint to apply.
724 *
725 * \retval #PSA_SUCCESS
726 * \c *policy contains the intersection of the original value of
727 * \c *policy and \c *constraint.
728 * \retval #PSA_ERROR_INVALID_ARGUMENT
729 * \c *policy and \c *constraint are incompatible.
730 * \c *policy is unchanged.
731 */
732static psa_status_t psa_restrict_key_policy(
733 psa_key_policy_t *policy,
734 const psa_key_policy_t *constraint )
735{
736 psa_algorithm_t intersection_alg =
737 psa_key_policy_algorithm_intersection( policy->alg, constraint->alg );
Gilles Peskined6f371b2019-05-10 19:33:38 +0200738 psa_algorithm_t intersection_alg2 =
739 psa_key_policy_algorithm_intersection( policy->alg2, constraint->alg2 );
Gilles Peskinef603c712019-01-19 13:40:11 +0100740 if( intersection_alg == 0 && policy->alg != 0 && constraint->alg != 0 )
741 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskined6f371b2019-05-10 19:33:38 +0200742 if( intersection_alg2 == 0 && policy->alg2 != 0 && constraint->alg2 != 0 )
743 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskinef603c712019-01-19 13:40:11 +0100744 policy->usage &= constraint->usage;
745 policy->alg = intersection_alg;
Gilles Peskined6f371b2019-05-10 19:33:38 +0200746 policy->alg2 = intersection_alg2;
Gilles Peskinef603c712019-01-19 13:40:11 +0100747 return( PSA_SUCCESS );
748}
749
Ronald Cron5c522922020-11-14 16:35:34 +0100750/** Get the description of a key given its identifier and policy constraints
751 * and lock it.
Ronald Cronf95a2b12020-10-22 15:24:49 +0200752 *
Ronald Cron5c522922020-11-14 16:35:34 +0100753 * The key must have allow all the usage flags set in \p usage. If \p alg is
754 * nonzero, the key must allow operations with this algorithm.
Ronald Cron7587ae42020-11-11 15:04:25 +0100755 *
Ronald Cron5c522922020-11-14 16:35:34 +0100756 * In case of a persistent key, the function loads the description of the key
757 * into a key slot if not already done.
758 *
759 * On success, the returned key slot is locked. It is the responsibility of
760 * the caller to unlock the key slot when it does not access it anymore.
Ronald Cronf95a2b12020-10-22 15:24:49 +0200761 */
Ronald Cron5c522922020-11-14 16:35:34 +0100762static psa_status_t psa_get_and_lock_key_slot_with_policy(
763 mbedtls_svc_key_id_t key,
764 psa_key_slot_t **p_slot,
765 psa_key_usage_t usage,
766 psa_algorithm_t alg )
Darryl Green06fd18d2018-07-16 11:21:11 +0100767{
Ronald Cronf95a2b12020-10-22 15:24:49 +0200768 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
769 psa_key_slot_t *slot;
Darryl Green06fd18d2018-07-16 11:21:11 +0100770
Ronald Cron5c522922020-11-14 16:35:34 +0100771 status = psa_get_and_lock_key_slot( key, p_slot );
Darryl Green06fd18d2018-07-16 11:21:11 +0100772 if( status != PSA_SUCCESS )
773 return( status );
Ronald Cronf95a2b12020-10-22 15:24:49 +0200774 slot = *p_slot;
Darryl Green06fd18d2018-07-16 11:21:11 +0100775
776 /* Enforce that usage policy for the key slot contains all the flags
777 * required by the usage parameter. There is one exception: public
778 * keys can always be exported, so we treat public key objects as
779 * if they had the export flag. */
Gilles Peskine8e338702019-07-30 20:06:31 +0200780 if( PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->attr.type ) )
Darryl Green06fd18d2018-07-16 11:21:11 +0100781 usage &= ~PSA_KEY_USAGE_EXPORT;
Ronald Cronf95a2b12020-10-22 15:24:49 +0200782
783 status = PSA_ERROR_NOT_PERMITTED;
Gilles Peskine8e338702019-07-30 20:06:31 +0200784 if( ( slot->attr.policy.usage & usage ) != usage )
Ronald Cronf95a2b12020-10-22 15:24:49 +0200785 goto error;
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100786
787 /* Enforce that the usage policy permits the requested algortihm. */
Gilles Peskine8e338702019-07-30 20:06:31 +0200788 if( alg != 0 && ! psa_key_policy_permits( &slot->attr.policy, alg ) )
Ronald Cronf95a2b12020-10-22 15:24:49 +0200789 goto error;
Darryl Green06fd18d2018-07-16 11:21:11 +0100790
Darryl Green06fd18d2018-07-16 11:21:11 +0100791 return( PSA_SUCCESS );
Ronald Cronf95a2b12020-10-22 15:24:49 +0200792
793error:
794 *p_slot = NULL;
Ronald Cron5c522922020-11-14 16:35:34 +0100795 psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +0200796
797 return( status );
Darryl Green06fd18d2018-07-16 11:21:11 +0100798}
Darryl Green940d72c2018-07-13 13:18:51 +0100799
Ronald Cron5c522922020-11-14 16:35:34 +0100800/** Get a key slot containing a transparent key and lock it.
Gilles Peskine28f8f302019-07-24 13:30:31 +0200801 *
802 * A transparent key is a key for which the key material is directly
803 * available, as opposed to a key in a secure element.
804 *
Ronald Cron5c522922020-11-14 16:35:34 +0100805 * This is a temporary function to use instead of
806 * psa_get_and_lock_key_slot_with_policy() until secure element support is
807 * fully implemented.
Ronald Cronf95a2b12020-10-22 15:24:49 +0200808 *
Ronald Cron5c522922020-11-14 16:35:34 +0100809 * On success, the returned key slot is locked. It is the responsibility of the
810 * caller to unlock the key slot when it does not access it anymore.
Gilles Peskine28f8f302019-07-24 13:30:31 +0200811 */
812#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Ronald Cron5c522922020-11-14 16:35:34 +0100813static psa_status_t psa_get_and_lock_transparent_key_slot_with_policy(
814 mbedtls_svc_key_id_t key,
815 psa_key_slot_t **p_slot,
816 psa_key_usage_t usage,
817 psa_algorithm_t alg )
Gilles Peskine28f8f302019-07-24 13:30:31 +0200818{
Ronald Cron5c522922020-11-14 16:35:34 +0100819 psa_status_t status = psa_get_and_lock_key_slot_with_policy( key, p_slot,
820 usage, alg );
Gilles Peskine28f8f302019-07-24 13:30:31 +0200821 if( status != PSA_SUCCESS )
822 return( status );
Ronald Cronf95a2b12020-10-22 15:24:49 +0200823
Gilles Peskineadad8132019-07-25 11:31:23 +0200824 if( psa_key_slot_is_external( *p_slot ) )
Gilles Peskine28f8f302019-07-24 13:30:31 +0200825 {
Ronald Cron5c522922020-11-14 16:35:34 +0100826 psa_unlock_key_slot( *p_slot );
Gilles Peskine28f8f302019-07-24 13:30:31 +0200827 *p_slot = NULL;
828 return( PSA_ERROR_NOT_SUPPORTED );
829 }
Ronald Cronf95a2b12020-10-22 15:24:49 +0200830
Gilles Peskine28f8f302019-07-24 13:30:31 +0200831 return( PSA_SUCCESS );
832}
833#else /* MBEDTLS_PSA_CRYPTO_SE_C */
834/* With no secure element support, all keys are transparent. */
Ronald Cron5c522922020-11-14 16:35:34 +0100835#define psa_get_and_lock_transparent_key_slot_with_policy( key, p_slot, usage, alg ) \
836 psa_get_and_lock_key_slot_with_policy( key, p_slot, usage, alg )
Gilles Peskine28f8f302019-07-24 13:30:31 +0200837#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
838
Gilles Peskinef77ed1f2018-12-03 11:58:46 +0100839/** Wipe key data from a slot. Preserve metadata such as the policy. */
Gilles Peskine2f060a82018-12-04 17:12:32 +0100840static psa_status_t psa_remove_key_data_from_memory( psa_key_slot_t *slot )
Darryl Green40225ba2018-11-15 14:48:15 +0000841{
Ronald Cronea0f8a62020-11-25 17:52:23 +0100842 /* Data pointer will always be either a valid pointer or NULL in an
843 * initialized slot, so we can just free it. */
844 if( slot->key.data != NULL )
845 mbedtls_platform_zeroize( slot->key.data, slot->key.bytes);
846
847 mbedtls_free( slot->key.data );
848 slot->key.data = NULL;
849 slot->key.bytes = 0;
Darryl Green40225ba2018-11-15 14:48:15 +0000850
851 return( PSA_SUCCESS );
852}
853
Gilles Peskinef77ed1f2018-12-03 11:58:46 +0100854/** Completely wipe a slot in memory, including its policy.
855 * Persistent storage is not affected. */
Gilles Peskine66fb1262018-12-10 16:29:04 +0100856psa_status_t psa_wipe_key_slot( psa_key_slot_t *slot )
Gilles Peskinef77ed1f2018-12-03 11:58:46 +0100857{
858 psa_status_t status = psa_remove_key_data_from_memory( slot );
Ronald Cronddd3d052020-10-30 14:07:07 +0100859
860 /*
861 * As the return error code may not be handled in case of multiple errors,
Ronald Cron5c522922020-11-14 16:35:34 +0100862 * do our best to report an unexpected lock counter: if available
Ronald Cronddd3d052020-10-30 14:07:07 +0100863 * call MBEDTLS_PARAM_FAILED that may terminate execution (if called as
864 * part of the execution of a test suite this will stop the test suite
Ronald Cron4640c152020-11-13 10:11:01 +0100865 * execution).
Ronald Cronddd3d052020-10-30 14:07:07 +0100866 */
Ronald Cron5c522922020-11-14 16:35:34 +0100867 if( slot->lock_count != 1 )
Ronald Cronddd3d052020-10-30 14:07:07 +0100868 {
869#ifdef MBEDTLS_CHECK_PARAMS
Ronald Cron5c522922020-11-14 16:35:34 +0100870 MBEDTLS_PARAM_FAILED( slot->lock_count == 1 );
Ronald Cronddd3d052020-10-30 14:07:07 +0100871#endif
Ronald Cronddd3d052020-10-30 14:07:07 +0100872 status = PSA_ERROR_CORRUPTION_DETECTED;
873 }
874
Gilles Peskine3f7cd622019-08-13 15:01:08 +0200875 /* Multipart operations may still be using the key. This is safe
876 * because all multipart operation objects are independent from
877 * the key slot: if they need to access the key after the setup
878 * phase, they have a copy of the key. Note that this means that
879 * key material can linger until all operations are completed. */
Gilles Peskinef77ed1f2018-12-03 11:58:46 +0100880 /* At this point, key material and other type-specific content has
881 * been wiped. Clear remaining metadata. We can call memset and not
882 * zeroize because the metadata is not particularly sensitive. */
883 memset( slot, 0, sizeof( *slot ) );
884 return( status );
885}
886
Ronald Croncf56a0a2020-08-04 09:51:30 +0200887psa_status_t psa_destroy_key( mbedtls_svc_key_id_t key )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100888{
Gilles Peskine2f060a82018-12-04 17:12:32 +0100889 psa_key_slot_t *slot;
Gilles Peskine4b7f3402019-08-13 15:58:36 +0200890 psa_status_t status; /* status of the last operation */
891 psa_status_t overall_status = PSA_SUCCESS;
Gilles Peskine354f7672019-07-12 23:46:38 +0200892#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
893 psa_se_drv_table_entry_t *driver;
894#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100895
Ronald Croncf56a0a2020-08-04 09:51:30 +0200896 if( mbedtls_svc_key_id_is_null( key ) )
Gilles Peskine1841cf42019-10-08 15:48:25 +0200897 return( PSA_SUCCESS );
898
Ronald Cronf2911112020-10-29 17:51:10 +0100899 /*
Ronald Cron19daca92020-11-10 18:08:03 +0100900 * Get the description of the key in a key slot. In case of a persistent
Ronald Cronf2911112020-10-29 17:51:10 +0100901 * key, this will load the key description from persistent memory if not
902 * done yet. We cannot avoid this loading as without it we don't know if
903 * the key is operated by an SE or not and this information is needed by
904 * the current implementation.
905 */
Ronald Cron5c522922020-11-14 16:35:34 +0100906 status = psa_get_and_lock_key_slot( key, &slot );
Gilles Peskineb0b255c2018-07-06 17:01:38 +0200907 if( status != PSA_SUCCESS )
908 return( status );
Gilles Peskine354f7672019-07-12 23:46:38 +0200909
Ronald Cronf2911112020-10-29 17:51:10 +0100910 /*
911 * If the key slot containing the key description is under access by the
912 * library (apart from the present access), the key cannot be destroyed
913 * yet. For the time being, just return in error. Eventually (to be
914 * implemented), the key should be destroyed when all accesses have
915 * stopped.
916 */
Ronald Cron5c522922020-11-14 16:35:34 +0100917 if( slot->lock_count > 1 )
Ronald Cronf2911112020-10-29 17:51:10 +0100918 {
Ronald Cron5c522922020-11-14 16:35:34 +0100919 psa_unlock_key_slot( slot );
Ronald Cronf2911112020-10-29 17:51:10 +0100920 return( PSA_ERROR_GENERIC_ERROR );
921 }
922
Gilles Peskine354f7672019-07-12 23:46:38 +0200923#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine8e338702019-07-30 20:06:31 +0200924 driver = psa_get_se_driver_entry( slot->attr.lifetime );
Gilles Peskine354f7672019-07-12 23:46:38 +0200925 if( driver != NULL )
Gilles Peskinefc762652019-07-22 19:30:34 +0200926 {
Gilles Peskine60450a42019-07-25 11:32:45 +0200927 /* For a key in a secure element, we need to do three things:
928 * remove the key file in internal storage, destroy the
929 * key inside the secure element, and update the driver's
930 * persistent data. Start a transaction that will encompass these
931 * three actions. */
Gilles Peskinefc762652019-07-22 19:30:34 +0200932 psa_crypto_prepare_transaction( PSA_CRYPTO_TRANSACTION_DESTROY_KEY );
Gilles Peskine8e338702019-07-30 20:06:31 +0200933 psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
Ronald Cronea0f8a62020-11-25 17:52:23 +0100934 psa_crypto_transaction.key.slot = psa_key_slot_get_slot_number( slot );
Gilles Peskine8e338702019-07-30 20:06:31 +0200935 psa_crypto_transaction.key.id = slot->attr.id;
Gilles Peskinefc762652019-07-22 19:30:34 +0200936 status = psa_crypto_save_transaction( );
937 if( status != PSA_SUCCESS )
938 {
Gilles Peskine66be51c2019-07-25 18:02:52 +0200939 (void) psa_crypto_stop_transaction( );
Gilles Peskine4b7f3402019-08-13 15:58:36 +0200940 /* We should still try to destroy the key in the secure
941 * element and the key metadata in storage. This is especially
942 * important if the error is that the storage is full.
943 * But how to do it exactly without risking an inconsistent
944 * state after a reset?
945 * https://github.com/ARMmbed/mbed-crypto/issues/215
946 */
947 overall_status = status;
948 goto exit;
Gilles Peskinefc762652019-07-22 19:30:34 +0200949 }
950
Ronald Cronea0f8a62020-11-25 17:52:23 +0100951 status = psa_destroy_se_key( driver,
952 psa_key_slot_get_slot_number( slot ) );
Gilles Peskine4b7f3402019-08-13 15:58:36 +0200953 if( overall_status == PSA_SUCCESS )
954 overall_status = status;
Gilles Peskinefc762652019-07-22 19:30:34 +0200955 }
Gilles Peskine354f7672019-07-12 23:46:38 +0200956#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
957
Darryl Greend49a4992018-06-18 17:27:26 +0100958#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Ronald Crond98059d2020-10-23 18:00:55 +0200959 if( ! PSA_KEY_LIFETIME_IS_VOLATILE( slot->attr.lifetime ) )
Darryl Greend49a4992018-06-18 17:27:26 +0100960 {
Gilles Peskine4b7f3402019-08-13 15:58:36 +0200961 status = psa_destroy_persistent_key( slot->attr.id );
962 if( overall_status == PSA_SUCCESS )
963 overall_status = status;
964
Gilles Peskine9ce31c42019-08-13 15:14:20 +0200965 /* TODO: other slots may have a copy of the same key. We should
966 * invalidate them.
967 * https://github.com/ARMmbed/mbed-crypto/issues/214
968 */
Darryl Greend49a4992018-06-18 17:27:26 +0100969 }
970#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
Gilles Peskine354f7672019-07-12 23:46:38 +0200971
Gilles Peskinefc762652019-07-22 19:30:34 +0200972#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
973 if( driver != NULL )
974 {
Gilles Peskine725f22a2019-07-25 11:31:48 +0200975 status = psa_save_se_persistent_data( driver );
Gilles Peskine4b7f3402019-08-13 15:58:36 +0200976 if( overall_status == PSA_SUCCESS )
977 overall_status = status;
978 status = psa_crypto_stop_transaction( );
979 if( overall_status == PSA_SUCCESS )
980 overall_status = status;
Gilles Peskinefc762652019-07-22 19:30:34 +0200981 }
982#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
983
Gilles Peskine4b7f3402019-08-13 15:58:36 +0200984#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
985exit:
986#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskinef77ed1f2018-12-03 11:58:46 +0100987 status = psa_wipe_key_slot( slot );
Gilles Peskine4b7f3402019-08-13 15:58:36 +0200988 /* Prioritize CORRUPTION_DETECTED from wiping over a storage error */
989 if( overall_status == PSA_SUCCESS )
990 overall_status = status;
991 return( overall_status );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100992}
993
John Durkop07cc04a2020-11-16 22:08:34 -0800994#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
John Durkop0e005192020-10-31 22:06:54 -0700995 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Gilles Peskineb699f072019-04-26 16:06:02 +0200996static psa_status_t psa_get_rsa_public_exponent(
997 const mbedtls_rsa_context *rsa,
998 psa_key_attributes_t *attributes )
999{
1000 mbedtls_mpi mpi;
Janos Follath24eed8d2019-11-22 13:21:35 +00001001 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskineb699f072019-04-26 16:06:02 +02001002 uint8_t *buffer = NULL;
1003 size_t buflen;
1004 mbedtls_mpi_init( &mpi );
1005
1006 ret = mbedtls_rsa_export( rsa, NULL, NULL, NULL, NULL, &mpi );
1007 if( ret != 0 )
1008 goto exit;
Gilles Peskine772c8b12019-04-26 17:37:21 +02001009 if( mbedtls_mpi_cmp_int( &mpi, 65537 ) == 0 )
1010 {
1011 /* It's the default value, which is reported as an empty string,
1012 * so there's nothing to do. */
1013 goto exit;
1014 }
Gilles Peskineb699f072019-04-26 16:06:02 +02001015
1016 buflen = mbedtls_mpi_size( &mpi );
1017 buffer = mbedtls_calloc( 1, buflen );
1018 if( buffer == NULL )
1019 {
1020 ret = MBEDTLS_ERR_MPI_ALLOC_FAILED;
1021 goto exit;
1022 }
1023 ret = mbedtls_mpi_write_binary( &mpi, buffer, buflen );
1024 if( ret != 0 )
1025 goto exit;
1026 attributes->domain_parameters = buffer;
1027 attributes->domain_parameters_size = buflen;
1028
1029exit:
1030 mbedtls_mpi_free( &mpi );
1031 if( ret != 0 )
1032 mbedtls_free( buffer );
1033 return( mbedtls_to_psa_error( ret ) );
1034}
John Durkop07cc04a2020-11-16 22:08:34 -08001035#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
John Durkop9814fa22020-11-04 12:28:15 -08001036 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Gilles Peskineb699f072019-04-26 16:06:02 +02001037
Gilles Peskinebfd322f2019-07-23 11:58:03 +02001038/** Retrieve all the publicly-accessible attributes of a key.
1039 */
Ronald Croncf56a0a2020-08-04 09:51:30 +02001040psa_status_t psa_get_key_attributes( mbedtls_svc_key_id_t key,
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001041 psa_key_attributes_t *attributes )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001042{
Ronald Cronf95a2b12020-10-22 15:24:49 +02001043 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01001044 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01001045 psa_key_slot_t *slot;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001046
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001047 psa_reset_key_attributes( attributes );
1048
Ronald Cron5c522922020-11-14 16:35:34 +01001049 status = psa_get_and_lock_key_slot_with_policy( key, &slot, 0, 0 );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02001050 if( status != PSA_SUCCESS )
1051 return( status );
Gilles Peskineb870b182018-07-06 16:02:09 +02001052
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001053 attributes->core = slot->attr;
Gilles Peskinec8000c02019-08-02 20:15:51 +02001054 attributes->core.flags &= ( MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY |
1055 MBEDTLS_PSA_KA_MASK_DUAL_USE );
1056
1057#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1058 if( psa_key_slot_is_external( slot ) )
Ronald Cronea0f8a62020-11-25 17:52:23 +01001059 psa_set_key_slot_number( attributes,
1060 psa_key_slot_get_slot_number( slot ) );
Gilles Peskinec8000c02019-08-02 20:15:51 +02001061#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskineb699f072019-04-26 16:06:02 +02001062
Gilles Peskine8e338702019-07-30 20:06:31 +02001063 switch( slot->attr.type )
Gilles Peskineb699f072019-04-26 16:06:02 +02001064 {
John Durkop07cc04a2020-11-16 22:08:34 -08001065#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
John Durkop0e005192020-10-31 22:06:54 -07001066 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Gilles Peskinec93b80c2019-05-16 19:39:54 +02001067 case PSA_KEY_TYPE_RSA_KEY_PAIR:
Gilles Peskineb699f072019-04-26 16:06:02 +02001068 case PSA_KEY_TYPE_RSA_PUBLIC_KEY:
Gilles Peskinedc5bfe92019-07-24 19:09:30 +02001069#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Janos Follath1d57a202019-08-13 12:15:34 +01001070 /* TODO: reporting the public exponent for opaque keys
Gilles Peskinec9d7f942019-08-13 16:17:16 +02001071 * is not yet implemented.
1072 * https://github.com/ARMmbed/mbed-crypto/issues/216
1073 */
Gilles Peskinec8000c02019-08-02 20:15:51 +02001074 if( psa_key_slot_is_external( slot ) )
Gilles Peskinedc5bfe92019-07-24 19:09:30 +02001075 break;
1076#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Steven Cooremana01795d2020-07-24 22:48:15 +02001077 {
Steven Cooremana2371e52020-07-28 14:30:39 +02001078 mbedtls_rsa_context *rsa = NULL;
Steven Cooremana01795d2020-07-24 22:48:15 +02001079
Ronald Cron90857082020-11-25 14:58:33 +01001080 status = mbedtls_psa_rsa_load_representation(
1081 slot->attr.type,
1082 slot->key.data,
1083 slot->key.bytes,
1084 &rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02001085 if( status != PSA_SUCCESS )
1086 break;
1087
Steven Cooremana2371e52020-07-28 14:30:39 +02001088 status = psa_get_rsa_public_exponent( rsa,
Steven Cooremana01795d2020-07-24 22:48:15 +02001089 attributes );
Steven Cooremana2371e52020-07-28 14:30:39 +02001090 mbedtls_rsa_free( rsa );
1091 mbedtls_free( rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02001092 }
Gilles Peskineb699f072019-04-26 16:06:02 +02001093 break;
John Durkop07cc04a2020-11-16 22:08:34 -08001094#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
John Durkop9814fa22020-11-04 12:28:15 -08001095 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Gilles Peskineb699f072019-04-26 16:06:02 +02001096 default:
1097 /* Nothing else to do. */
1098 break;
1099 }
1100
1101 if( status != PSA_SUCCESS )
1102 psa_reset_key_attributes( attributes );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001103
Ronald Cron5c522922020-11-14 16:35:34 +01001104 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001105
Ronald Cron5c522922020-11-14 16:35:34 +01001106 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001107}
1108
Gilles Peskinec8000c02019-08-02 20:15:51 +02001109#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1110psa_status_t psa_get_key_slot_number(
1111 const psa_key_attributes_t *attributes,
1112 psa_key_slot_number_t *slot_number )
1113{
1114 if( attributes->core.flags & MBEDTLS_PSA_KA_FLAG_HAS_SLOT_NUMBER )
1115 {
1116 *slot_number = attributes->slot_number;
1117 return( PSA_SUCCESS );
1118 }
1119 else
1120 return( PSA_ERROR_INVALID_ARGUMENT );
1121}
1122#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1123
Ronald Crond18b5f82020-11-25 16:46:05 +01001124static psa_status_t psa_export_key_buffer_internal( const uint8_t *key_buffer,
1125 size_t key_buffer_size,
Steven Cooremana01795d2020-07-24 22:48:15 +02001126 uint8_t *data,
1127 size_t data_size,
1128 size_t *data_length )
1129{
Ronald Crond18b5f82020-11-25 16:46:05 +01001130 if( key_buffer_size > data_size )
Steven Cooremana01795d2020-07-24 22:48:15 +02001131 return( PSA_ERROR_BUFFER_TOO_SMALL );
Ronald Crond18b5f82020-11-25 16:46:05 +01001132 memcpy( data, key_buffer, key_buffer_size );
1133 memset( data + key_buffer_size, 0,
1134 data_size - key_buffer_size );
1135 *data_length = key_buffer_size;
Steven Cooremana01795d2020-07-24 22:48:15 +02001136 return( PSA_SUCCESS );
1137}
1138
Ronald Cron7285cda2020-11-26 14:46:37 +01001139psa_status_t psa_export_key_internal(
Ronald Crond18b5f82020-11-25 16:46:05 +01001140 const psa_key_attributes_t *attributes,
1141 const uint8_t *key_buffer, size_t key_buffer_size,
1142 uint8_t *data, size_t data_size, size_t *data_length )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001143{
Ronald Crond18b5f82020-11-25 16:46:05 +01001144 psa_key_type_t type = attributes->core.type;
1145
Ronald Crond18b5f82020-11-25 16:46:05 +01001146 if( key_type_is_raw_bytes( type ) ||
1147 PSA_KEY_TYPE_IS_RSA( type ) ||
1148 PSA_KEY_TYPE_IS_ECC( type ) )
Ronald Cron9486f9d2020-11-26 13:36:23 +01001149 {
1150 return( psa_export_key_buffer_internal(
Ronald Crond18b5f82020-11-25 16:46:05 +01001151 key_buffer, key_buffer_size,
1152 data, data_size, data_length ) );
Ronald Cron9486f9d2020-11-26 13:36:23 +01001153 }
1154 else
1155 {
1156 /* This shouldn't happen in the reference implementation, but
1157 it is valid for a special-purpose implementation to omit
1158 support for exporting certain key types. */
1159 return( PSA_ERROR_NOT_SUPPORTED );
1160 }
1161}
1162
1163psa_status_t psa_export_key( mbedtls_svc_key_id_t key,
1164 uint8_t *data,
1165 size_t data_size,
1166 size_t *data_length )
1167{
1168 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
1169 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
1170 psa_key_slot_t *slot;
1171
Ronald Crone907e552021-01-18 13:22:38 +01001172 /* Reject a zero-length output buffer now, since this can never be a
1173 * valid key representation. This way we know that data must be a valid
1174 * pointer and we can do things like memset(data, ..., data_size). */
1175 if( data_size == 0 )
1176 return( PSA_ERROR_BUFFER_TOO_SMALL );
1177
Ronald Cron9486f9d2020-11-26 13:36:23 +01001178 /* Set the key to empty now, so that even when there are errors, we always
1179 * set data_length to a value between 0 and data_size. On error, setting
1180 * the key to empty is a good choice because an empty key representation is
1181 * unlikely to be accepted anywhere. */
Jaeden Amerof24c7f82018-06-27 17:20:43 +01001182 *data_length = 0;
1183
Ronald Cron9486f9d2020-11-26 13:36:23 +01001184 /* Export requires the EXPORT flag. There is an exception for public keys,
1185 * which don't require any flag, but
1186 * psa_get_and_lock_key_slot_with_policy() takes care of this.
1187 */
1188 status = psa_get_and_lock_key_slot_with_policy( key, &slot,
1189 PSA_KEY_USAGE_EXPORT, 0 );
1190 if( status != PSA_SUCCESS )
1191 return( status );
mohammad160306e79202018-03-28 13:17:44 +03001192
Ronald Crond18b5f82020-11-25 16:46:05 +01001193 psa_key_attributes_t attributes = {
1194 .core = slot->attr
1195 };
Ronald Cron67227982020-11-26 15:16:05 +01001196 status = psa_driver_wrapper_export_key( &attributes,
Ronald Crond18b5f82020-11-25 16:46:05 +01001197 slot->key.data, slot->key.bytes,
1198 data, data_size, data_length );
Ronald Cron9486f9d2020-11-26 13:36:23 +01001199
Ronald Cron9486f9d2020-11-26 13:36:23 +01001200 unlock_status = psa_unlock_key_slot( slot );
1201
1202 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
1203}
1204
Ronald Cron7285cda2020-11-26 14:46:37 +01001205psa_status_t psa_export_public_key_internal(
Ronald Crond18b5f82020-11-25 16:46:05 +01001206 const psa_key_attributes_t *attributes,
1207 const uint8_t *key_buffer,
1208 size_t key_buffer_size,
1209 uint8_t *data,
1210 size_t data_size,
1211 size_t *data_length )
Ronald Cron9486f9d2020-11-26 13:36:23 +01001212{
Ronald Crond18b5f82020-11-25 16:46:05 +01001213 psa_key_type_t type = attributes->core.type;
Ronald Crond18b5f82020-11-25 16:46:05 +01001214
Ronald Crond18b5f82020-11-25 16:46:05 +01001215 if( PSA_KEY_TYPE_IS_RSA( type ) || PSA_KEY_TYPE_IS_ECC( type ) )
Moran Peker17e36e12018-05-02 12:55:20 +03001216 {
Ronald Crond18b5f82020-11-25 16:46:05 +01001217 if( PSA_KEY_TYPE_IS_PUBLIC_KEY( type ) )
Gilles Peskine969ac722018-01-28 18:16:59 +01001218 {
Steven Cooreman560c28a2020-07-24 23:20:24 +02001219 /* Exporting public -> public */
Ronald Cron9486f9d2020-11-26 13:36:23 +01001220 return( psa_export_key_buffer_internal(
Ronald Crond18b5f82020-11-25 16:46:05 +01001221 key_buffer, key_buffer_size,
1222 data, data_size, data_length ) );
Steven Cooreman560c28a2020-07-24 23:20:24 +02001223 }
Steven Cooremanb9b84422020-10-14 14:39:20 +02001224
Ronald Crond18b5f82020-11-25 16:46:05 +01001225 if( PSA_KEY_TYPE_IS_RSA( type ) )
Steven Cooreman560c28a2020-07-24 23:20:24 +02001226 {
John Durkop0e005192020-10-31 22:06:54 -07001227#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
1228 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Ronald Crone5ca3d82020-11-26 16:36:16 +01001229 return( mbedtls_psa_rsa_export_public_key( attributes,
1230 key_buffer,
1231 key_buffer_size,
1232 data,
1233 data_size,
1234 data_length ) );
Darryl Green9e2d7a02018-07-24 16:33:30 +01001235#else
Steven Cooreman560c28a2020-07-24 23:20:24 +02001236 /* We don't know how to convert a private RSA key to public. */
1237 return( PSA_ERROR_NOT_SUPPORTED );
John Durkop9814fa22020-11-04 12:28:15 -08001238#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
1239 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Gilles Peskine969ac722018-01-28 18:16:59 +01001240 }
1241 else
Moran Pekera998bc62018-04-16 18:16:20 +03001242 {
John Durkop6ba40d12020-11-10 08:50:04 -08001243#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
1244 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
Ronald Crone5ca3d82020-11-26 16:36:16 +01001245 return( mbedtls_psa_ecp_export_public_key( attributes,
1246 key_buffer,
1247 key_buffer_size,
1248 data,
1249 data_size,
1250 data_length ) );
Steven Cooreman560c28a2020-07-24 23:20:24 +02001251#else
1252 /* We don't know how to convert a private ECC key to public */
Moran Pekera998bc62018-04-16 18:16:20 +03001253 return( PSA_ERROR_NOT_SUPPORTED );
John Durkop9814fa22020-11-04 12:28:15 -08001254#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
1255 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
Moran Pekera998bc62018-04-16 18:16:20 +03001256 }
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001257 }
Steven Cooreman560c28a2020-07-24 23:20:24 +02001258 else
1259 {
1260 /* This shouldn't happen in the reference implementation, but
1261 it is valid for a special-purpose implementation to omit
1262 support for exporting certain key types. */
1263 return( PSA_ERROR_NOT_SUPPORTED );
1264 }
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001265}
Ronald Crond18b5f82020-11-25 16:46:05 +01001266
Ronald Croncf56a0a2020-08-04 09:51:30 +02001267psa_status_t psa_export_public_key( mbedtls_svc_key_id_t key,
Gilles Peskine2d277862018-06-18 15:41:12 +02001268 uint8_t *data,
1269 size_t data_size,
1270 size_t *data_length )
Moran Pekerdd4ea382018-04-03 15:30:03 +03001271{
Ronald Cronf95a2b12020-10-22 15:24:49 +02001272 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01001273 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01001274 psa_key_slot_t *slot;
Darryl Greendd8fb772018-11-07 16:00:44 +00001275
Ronald Crone907e552021-01-18 13:22:38 +01001276 /* Reject a zero-length output buffer now, since this can never be a
1277 * valid key representation. This way we know that data must be a valid
1278 * pointer and we can do things like memset(data, ..., data_size). */
1279 if( data_size == 0 )
1280 return( PSA_ERROR_BUFFER_TOO_SMALL );
1281
Darryl Greendd8fb772018-11-07 16:00:44 +00001282 /* Set the key to empty now, so that even when there are errors, we always
1283 * set data_length to a value between 0 and data_size. On error, setting
1284 * the key to empty is a good choice because an empty key representation is
1285 * unlikely to be accepted anywhere. */
1286 *data_length = 0;
1287
1288 /* Exporting a public key doesn't require a usage flag. */
Ronald Cron5c522922020-11-14 16:35:34 +01001289 status = psa_get_and_lock_key_slot_with_policy( key, &slot, 0, 0 );
Darryl Greendd8fb772018-11-07 16:00:44 +00001290 if( status != PSA_SUCCESS )
1291 return( status );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001292
Ronald Cron9486f9d2020-11-26 13:36:23 +01001293 if( ! PSA_KEY_TYPE_IS_ASYMMETRIC( slot->attr.type ) )
1294 {
1295 status = PSA_ERROR_INVALID_ARGUMENT;
1296 goto exit;
1297 }
1298
Ronald Crond18b5f82020-11-25 16:46:05 +01001299 psa_key_attributes_t attributes = {
1300 .core = slot->attr
1301 };
Ronald Cron67227982020-11-26 15:16:05 +01001302 status = psa_driver_wrapper_export_public_key(
Ronald Crond18b5f82020-11-25 16:46:05 +01001303 &attributes, slot->key.data, slot->key.bytes,
1304 data, data_size, data_length );
Ronald Cron9486f9d2020-11-26 13:36:23 +01001305
1306exit:
Ronald Cron5c522922020-11-14 16:35:34 +01001307 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001308
Ronald Cron5c522922020-11-14 16:35:34 +01001309 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Moran Pekerdd4ea382018-04-03 15:30:03 +03001310}
1311
Gilles Peskine91e8c332019-08-02 19:19:39 +02001312#if defined(static_assert)
1313static_assert( ( MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE ) == 0,
1314 "One or more key attribute flag is listed as both external-only and dual-use" );
Gilles Peskine5a680562019-08-05 17:32:13 +02001315static_assert( ( PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE ) == 0,
Gilles Peskine094dac12019-08-07 18:19:46 +02001316 "One or more key attribute flag is listed as both internal-only and dual-use" );
Gilles Peskine5a680562019-08-05 17:32:13 +02001317static_assert( ( PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY ) == 0,
Gilles Peskine91e8c332019-08-02 19:19:39 +02001318 "One or more key attribute flag is listed as both internal-only and external-only" );
1319#endif
1320
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001321/** Validate that a key policy is internally well-formed.
1322 *
1323 * This function only rejects invalid policies. It does not validate the
1324 * consistency of the policy with respect to other attributes of the key
1325 * such as the key type.
1326 */
1327static psa_status_t psa_validate_key_policy( const psa_key_policy_t *policy )
Gilles Peskine4747d192019-04-17 15:05:45 +02001328{
1329 if( ( policy->usage & ~( PSA_KEY_USAGE_EXPORT |
Gilles Peskine8e0206a2019-05-14 14:24:28 +02001330 PSA_KEY_USAGE_COPY |
Gilles Peskine4747d192019-04-17 15:05:45 +02001331 PSA_KEY_USAGE_ENCRYPT |
1332 PSA_KEY_USAGE_DECRYPT |
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01001333 PSA_KEY_USAGE_SIGN_HASH |
1334 PSA_KEY_USAGE_VERIFY_HASH |
Gilles Peskine4747d192019-04-17 15:05:45 +02001335 PSA_KEY_USAGE_DERIVE ) ) != 0 )
1336 return( PSA_ERROR_INVALID_ARGUMENT );
1337
Gilles Peskine4747d192019-04-17 15:05:45 +02001338 return( PSA_SUCCESS );
1339}
1340
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001341/** Validate the internal consistency of key attributes.
1342 *
1343 * This function only rejects invalid attribute values. If does not
1344 * validate the consistency of the attributes with any key data that may
1345 * be involved in the creation of the key.
1346 *
1347 * Call this function early in the key creation process.
1348 *
1349 * \param[in] attributes Key attributes for the new key.
1350 * \param[out] p_drv On any return, the driver for the key, if any.
1351 * NULL for a transparent key.
1352 *
1353 */
1354static psa_status_t psa_validate_key_attributes(
1355 const psa_key_attributes_t *attributes,
1356 psa_se_drv_table_entry_t **p_drv )
Darryl Green0c6575a2018-11-07 16:05:30 +00001357{
Steven Cooreman81fe7c32020-06-08 18:37:19 +02001358 psa_status_t status = PSA_ERROR_INVALID_ARGUMENT;
Ronald Crond2ed4812020-07-17 16:11:30 +02001359 psa_key_lifetime_t lifetime = psa_get_key_lifetime( attributes );
Ronald Cron65f38a32020-10-23 17:11:13 +02001360 mbedtls_svc_key_id_t key = psa_get_key_id( attributes );
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001361
Ronald Cron54b90082020-10-29 15:26:43 +01001362 status = psa_validate_key_location( lifetime, p_drv );
Steven Cooreman81fe7c32020-06-08 18:37:19 +02001363 if( status != PSA_SUCCESS )
1364 return( status );
1365
Ronald Crond2ed4812020-07-17 16:11:30 +02001366 status = psa_validate_key_persistence( lifetime );
Steven Cooreman81fe7c32020-06-08 18:37:19 +02001367 if( status != PSA_SUCCESS )
1368 return( status );
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001369
Ronald Cron65f38a32020-10-23 17:11:13 +02001370 if ( PSA_KEY_LIFETIME_IS_VOLATILE( lifetime ) )
1371 {
1372 if( MBEDTLS_SVC_KEY_ID_GET_KEY_ID( key ) != 0 )
1373 return( PSA_ERROR_INVALID_ARGUMENT );
1374 }
1375 else
Ronald Crond2ed4812020-07-17 16:11:30 +02001376 {
Ronald Croncbd7bea2020-11-11 14:57:44 +01001377 status = psa_validate_key_id( psa_get_key_id( attributes ), 0 );
Ronald Crond2ed4812020-07-17 16:11:30 +02001378 if( status != PSA_SUCCESS )
1379 return( status );
1380 }
1381
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001382 status = psa_validate_key_policy( &attributes->core.policy );
Darryl Green0c6575a2018-11-07 16:05:30 +00001383 if( status != PSA_SUCCESS )
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001384 return( status );
1385
1386 /* Refuse to create overly large keys.
1387 * Note that this doesn't trigger on import if the attributes don't
1388 * explicitly specify a size (so psa_get_key_bits returns 0), so
1389 * psa_import_key() needs its own checks. */
1390 if( psa_get_key_bits( attributes ) > PSA_MAX_KEY_BITS )
1391 return( PSA_ERROR_NOT_SUPPORTED );
1392
Gilles Peskine91e8c332019-08-02 19:19:39 +02001393 /* Reject invalid flags. These should not be reachable through the API. */
1394 if( attributes->core.flags & ~ ( MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY |
1395 MBEDTLS_PSA_KA_MASK_DUAL_USE ) )
1396 return( PSA_ERROR_INVALID_ARGUMENT );
1397
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001398 return( PSA_SUCCESS );
1399}
1400
Gilles Peskine4747d192019-04-17 15:05:45 +02001401/** Prepare a key slot to receive key material.
1402 *
1403 * This function allocates a key slot and sets its metadata.
1404 *
1405 * If this function fails, call psa_fail_key_creation().
1406 *
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001407 * This function is intended to be used as follows:
1408 * -# Call psa_start_key_creation() to allocate a key slot, prepare
Ronald Croncf56a0a2020-08-04 09:51:30 +02001409 * it with the specified attributes, and in case of a volatile key assign it
1410 * a volatile key identifier.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001411 * -# Populate the slot with the key material.
1412 * -# Call psa_finish_key_creation() to finalize the creation of the slot.
1413 * In case of failure at any step, stop the sequence and call
1414 * psa_fail_key_creation().
1415 *
Ronald Cron5c522922020-11-14 16:35:34 +01001416 * On success, the key slot is locked. It is the responsibility of the caller
1417 * to unlock the key slot when it does not access it anymore.
Ronald Cronf95a2b12020-10-22 15:24:49 +02001418 *
Gilles Peskinedf179142019-07-15 22:02:14 +02001419 * \param method An identification of the calling function.
Gilles Peskine011e4282019-06-26 18:34:38 +02001420 * \param[in] attributes Key attributes for the new key.
Gilles Peskine011e4282019-06-26 18:34:38 +02001421 * \param[out] p_slot On success, a pointer to the prepared slot.
1422 * \param[out] p_drv On any return, the driver for the key, if any.
1423 * NULL for a transparent key.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001424 *
1425 * \retval #PSA_SUCCESS
1426 * The key slot is ready to receive key material.
1427 * \return If this function fails, the key slot is an invalid state.
1428 * You must call psa_fail_key_creation() to wipe and free the slot.
Gilles Peskine4747d192019-04-17 15:05:45 +02001429 */
1430static psa_status_t psa_start_key_creation(
Gilles Peskinedf179142019-07-15 22:02:14 +02001431 psa_key_creation_method_t method,
Gilles Peskine4747d192019-04-17 15:05:45 +02001432 const psa_key_attributes_t *attributes,
Gilles Peskine011e4282019-06-26 18:34:38 +02001433 psa_key_slot_t **p_slot,
Gilles Peskine8abe6a22019-07-12 23:40:35 +02001434 psa_se_drv_table_entry_t **p_drv )
Gilles Peskine4747d192019-04-17 15:05:45 +02001435{
1436 psa_status_t status;
Ronald Cron2a993152020-07-17 14:13:26 +02001437 psa_key_id_t volatile_key_id;
Gilles Peskine4747d192019-04-17 15:05:45 +02001438 psa_key_slot_t *slot;
1439
Gilles Peskinedf179142019-07-15 22:02:14 +02001440 (void) method;
Gilles Peskine011e4282019-06-26 18:34:38 +02001441 *p_drv = NULL;
1442
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001443 status = psa_validate_key_attributes( attributes, p_drv );
1444 if( status != PSA_SUCCESS )
1445 return( status );
1446
Ronald Cronc4d1b512020-07-31 11:26:37 +02001447 status = psa_get_empty_key_slot( &volatile_key_id, p_slot );
Gilles Peskine4747d192019-04-17 15:05:45 +02001448 if( status != PSA_SUCCESS )
1449 return( status );
1450 slot = *p_slot;
1451
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001452 /* We're storing the declared bit-size of the key. It's up to each
1453 * creation mechanism to verify that this information is correct.
1454 * It's automatically correct for mechanisms that use the bit-size as
Gilles Peskineb46bef22019-07-30 21:32:04 +02001455 * an input (generate, device) but not for those where the bit-size
Ronald Cronc4d1b512020-07-31 11:26:37 +02001456 * is optional (import, copy). In case of a volatile key, assign it the
1457 * volatile key identifier associated to the slot returned to contain its
1458 * definition. */
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001459
1460 slot->attr = attributes->core;
Ronald Cronc4d1b512020-07-31 11:26:37 +02001461 if( PSA_KEY_LIFETIME_IS_VOLATILE( slot->attr.lifetime ) )
1462 {
1463#if !defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER)
1464 slot->attr.id = volatile_key_id;
1465#else
1466 slot->attr.id.key_id = volatile_key_id;
1467#endif
1468 }
Gilles Peskinec744d992019-07-30 17:26:54 +02001469
Gilles Peskine91e8c332019-08-02 19:19:39 +02001470 /* Erase external-only flags from the internal copy. To access
Gilles Peskine013f5472019-08-07 15:42:14 +02001471 * external-only flags, query `attributes`. Thanks to the check
1472 * in psa_validate_key_attributes(), this leaves the dual-use
Gilles Peskineedbed562019-08-07 18:19:59 +02001473 * flags and any internal flag that psa_get_empty_key_slot()
Gilles Peskine013f5472019-08-07 15:42:14 +02001474 * may have set. */
1475 slot->attr.flags &= ~MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY;
Gilles Peskine91e8c332019-08-02 19:19:39 +02001476
Gilles Peskinecbaff462019-07-12 23:46:04 +02001477#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined7729582019-08-05 15:55:54 +02001478 /* For a key in a secure element, we need to do three things
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001479 * when creating or registering a persistent key:
Gilles Peskine60450a42019-07-25 11:32:45 +02001480 * create the key file in internal storage, create the
1481 * key inside the secure element, and update the driver's
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001482 * persistent data. This is done by starting a transaction that will
1483 * encompass these three actions.
1484 * For registering a volatile key, we just need to find an appropriate
1485 * slot number inside the SE. Since the key is designated volatile, creating
1486 * a transaction is not required. */
Gilles Peskine60450a42019-07-25 11:32:45 +02001487 /* The first thing to do is to find a slot number for the new key.
1488 * We save the slot number in persistent storage as part of the
1489 * transaction data. It will be needed to recover if the power
1490 * fails during the key creation process, to clean up on the secure
1491 * element side after restarting. Obtaining a slot number from the
1492 * secure element driver updates its persistent state, but we do not yet
1493 * save the driver's persistent state, so that if the power fails,
Gilles Peskinefc762652019-07-22 19:30:34 +02001494 * we can roll back to a state where the key doesn't exist. */
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001495 if( *p_drv != NULL )
Darryl Green0c6575a2018-11-07 16:05:30 +00001496 {
Ronald Cronea0f8a62020-11-25 17:52:23 +01001497 psa_key_slot_number_t slot_number;
Gilles Peskinee88c2c12019-08-05 16:44:14 +02001498 status = psa_find_se_slot_for_key( attributes, method, *p_drv,
Ronald Cronea0f8a62020-11-25 17:52:23 +01001499 &slot_number );
Gilles Peskinecbaff462019-07-12 23:46:04 +02001500 if( status != PSA_SUCCESS )
1501 return( status );
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001502
1503 if( ! PSA_KEY_LIFETIME_IS_VOLATILE( attributes->core.lifetime ) )
Gilles Peskine66be51c2019-07-25 18:02:52 +02001504 {
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001505 psa_crypto_prepare_transaction( PSA_CRYPTO_TRANSACTION_CREATE_KEY );
1506 psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
Ronald Cronea0f8a62020-11-25 17:52:23 +01001507 psa_crypto_transaction.key.slot = slot_number;
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001508 psa_crypto_transaction.key.id = slot->attr.id;
1509 status = psa_crypto_save_transaction( );
1510 if( status != PSA_SUCCESS )
1511 {
1512 (void) psa_crypto_stop_transaction( );
1513 return( status );
1514 }
Gilles Peskine66be51c2019-07-25 18:02:52 +02001515 }
Ronald Cronea0f8a62020-11-25 17:52:23 +01001516
1517 status = psa_copy_key_material_into_slot(
1518 slot, (uint8_t *)( &slot_number ), sizeof( slot_number ) );
Darryl Green0c6575a2018-11-07 16:05:30 +00001519 }
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001520
1521 if( *p_drv == NULL && method == PSA_KEY_CREATION_REGISTER )
1522 {
1523 /* Key registration only makes sense with a secure element. */
1524 return( PSA_ERROR_INVALID_ARGUMENT );
1525 }
Gilles Peskinecbaff462019-07-12 23:46:04 +02001526#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1527
Ronald Cronc4d1b512020-07-31 11:26:37 +02001528 return( PSA_SUCCESS );
Darryl Green0c6575a2018-11-07 16:05:30 +00001529}
Gilles Peskine4747d192019-04-17 15:05:45 +02001530
1531/** Finalize the creation of a key once its key material has been set.
1532 *
1533 * This entails writing the key to persistent storage.
1534 *
1535 * If this function fails, call psa_fail_key_creation().
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001536 * See the documentation of psa_start_key_creation() for the intended use
1537 * of this function.
Gilles Peskine4747d192019-04-17 15:05:45 +02001538 *
Ronald Cron5c522922020-11-14 16:35:34 +01001539 * If the finalization succeeds, the function unlocks the key slot (it was
1540 * locked by psa_start_key_creation()) and the key slot cannot be accessed
1541 * anymore as part of the key creation process.
Ronald Cron50972942020-11-14 11:28:25 +01001542 *
Gilles Peskine011e4282019-06-26 18:34:38 +02001543 * \param[in,out] slot Pointer to the slot with key material.
1544 * \param[in] driver The secure element driver for the key,
1545 * or NULL for a transparent key.
Ronald Cron81709fc2020-11-14 12:10:32 +01001546 * \param[out] key On success, identifier of the key. Note that the
1547 * key identifier is also stored in the key slot.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001548 *
1549 * \retval #PSA_SUCCESS
Ronald Croncf56a0a2020-08-04 09:51:30 +02001550 * The key was successfully created.
gabor-mezei-arm452b0a32020-11-09 17:42:55 +01001551 * \retval #PSA_ERROR_INSUFFICIENT_MEMORY
1552 * \retval #PSA_ERROR_INSUFFICIENT_STORAGE
1553 * \retval #PSA_ERROR_ALREADY_EXISTS
1554 * \retval #PSA_ERROR_DATA_INVALID
1555 * \retval #PSA_ERROR_DATA_CORRUPT
gabor-mezei-arm86326a92020-11-30 16:50:34 +01001556 * \retval #PSA_ERROR_STORAGE_FAILURE
gabor-mezei-arm452b0a32020-11-09 17:42:55 +01001557 *
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001558 * \return If this function fails, the key slot is an invalid state.
1559 * You must call psa_fail_key_creation() to wipe and free the slot.
Gilles Peskine4747d192019-04-17 15:05:45 +02001560 */
Gilles Peskine011e4282019-06-26 18:34:38 +02001561static psa_status_t psa_finish_key_creation(
1562 psa_key_slot_t *slot,
Ronald Cron81709fc2020-11-14 12:10:32 +01001563 psa_se_drv_table_entry_t *driver,
1564 mbedtls_svc_key_id_t *key)
Gilles Peskine4747d192019-04-17 15:05:45 +02001565{
1566 psa_status_t status = PSA_SUCCESS;
Gilles Peskine30afafd2019-04-25 13:47:40 +02001567 (void) slot;
Gilles Peskine011e4282019-06-26 18:34:38 +02001568 (void) driver;
Gilles Peskine4747d192019-04-17 15:05:45 +02001569
1570#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Steven Cooremanc59de6a2020-06-08 18:28:25 +02001571 if( ! PSA_KEY_LIFETIME_IS_VOLATILE( slot->attr.lifetime ) )
Gilles Peskine4747d192019-04-17 15:05:45 +02001572 {
Gilles Peskine1df83d42019-07-23 16:13:14 +02001573#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1574 if( driver != NULL )
1575 {
Gilles Peskineb46bef22019-07-30 21:32:04 +02001576 psa_se_key_data_storage_t data;
Ronald Cronea0f8a62020-11-25 17:52:23 +01001577 psa_key_slot_number_t slot_number =
1578 psa_key_slot_get_slot_number( slot ) ;
1579
Gilles Peskineb46bef22019-07-30 21:32:04 +02001580#if defined(static_assert)
Ronald Cronea0f8a62020-11-25 17:52:23 +01001581 static_assert( sizeof( slot_number ) ==
Gilles Peskineb46bef22019-07-30 21:32:04 +02001582 sizeof( data.slot_number ),
1583 "Slot number size does not match psa_se_key_data_storage_t" );
Gilles Peskineb46bef22019-07-30 21:32:04 +02001584#endif
Ronald Cronea0f8a62020-11-25 17:52:23 +01001585 memcpy( &data.slot_number, &slot_number, sizeof( slot_number ) );
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001586 status = psa_save_persistent_key( &slot->attr,
Gilles Peskineb46bef22019-07-30 21:32:04 +02001587 (uint8_t*) &data,
1588 sizeof( data ) );
Gilles Peskine1df83d42019-07-23 16:13:14 +02001589 }
1590 else
1591#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1592 {
Steven Cooreman40120f62020-10-29 11:42:22 +01001593 /* Key material is saved in export representation in the slot, so
1594 * just pass the slot buffer for storage. */
1595 status = psa_save_persistent_key( &slot->attr,
Ronald Cronea0f8a62020-11-25 17:52:23 +01001596 slot->key.data,
1597 slot->key.bytes );
Gilles Peskine1df83d42019-07-23 16:13:14 +02001598 }
Gilles Peskine4747d192019-04-17 15:05:45 +02001599 }
Darryl Green0c6575a2018-11-07 16:05:30 +00001600#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
1601
Gilles Peskinecbaff462019-07-12 23:46:04 +02001602#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined7729582019-08-05 15:55:54 +02001603 /* Finish the transaction for a key creation. This does not
1604 * happen when registering an existing key. Detect this case
1605 * by checking whether a transaction is in progress (actual
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001606 * creation of a persistent key in a secure element requires a transaction,
1607 * but registration or volatile key creation doesn't use one). */
Gilles Peskined7729582019-08-05 15:55:54 +02001608 if( driver != NULL &&
1609 psa_crypto_transaction.unknown.type == PSA_CRYPTO_TRANSACTION_CREATE_KEY )
Gilles Peskinecbaff462019-07-12 23:46:04 +02001610 {
1611 status = psa_save_se_persistent_data( driver );
1612 if( status != PSA_SUCCESS )
1613 {
Gilles Peskine8e338702019-07-30 20:06:31 +02001614 psa_destroy_persistent_key( slot->attr.id );
Gilles Peskinecbaff462019-07-12 23:46:04 +02001615 return( status );
1616 }
Gilles Peskinefc762652019-07-22 19:30:34 +02001617 status = psa_crypto_stop_transaction( );
Gilles Peskinecbaff462019-07-12 23:46:04 +02001618 }
1619#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1620
Ronald Cron50972942020-11-14 11:28:25 +01001621 if( status == PSA_SUCCESS )
Ronald Cron81709fc2020-11-14 12:10:32 +01001622 {
1623 *key = slot->attr.id;
Ronald Cron5c522922020-11-14 16:35:34 +01001624 status = psa_unlock_key_slot( slot );
Ronald Cron81709fc2020-11-14 12:10:32 +01001625 if( status != PSA_SUCCESS )
1626 *key = MBEDTLS_SVC_KEY_ID_INIT;
1627 }
Ronald Cron50972942020-11-14 11:28:25 +01001628
Gilles Peskine4747d192019-04-17 15:05:45 +02001629 return( status );
1630}
1631
1632/** Abort the creation of a key.
1633 *
1634 * You may call this function after calling psa_start_key_creation(),
1635 * or after psa_finish_key_creation() fails. In other circumstances, this
1636 * function may not clean up persistent storage.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001637 * See the documentation of psa_start_key_creation() for the intended use
1638 * of this function.
Gilles Peskine4747d192019-04-17 15:05:45 +02001639 *
Gilles Peskine011e4282019-06-26 18:34:38 +02001640 * \param[in,out] slot Pointer to the slot with key material.
1641 * \param[in] driver The secure element driver for the key,
1642 * or NULL for a transparent key.
Gilles Peskine4747d192019-04-17 15:05:45 +02001643 */
Gilles Peskine011e4282019-06-26 18:34:38 +02001644static void psa_fail_key_creation( psa_key_slot_t *slot,
Gilles Peskine8abe6a22019-07-12 23:40:35 +02001645 psa_se_drv_table_entry_t *driver )
Gilles Peskine4747d192019-04-17 15:05:45 +02001646{
Gilles Peskine011e4282019-06-26 18:34:38 +02001647 (void) driver;
1648
Gilles Peskine4747d192019-04-17 15:05:45 +02001649 if( slot == NULL )
1650 return;
Gilles Peskine011e4282019-06-26 18:34:38 +02001651
1652#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Janos Follath1d57a202019-08-13 12:15:34 +01001653 /* TODO: If the key has already been created in the secure
Gilles Peskine011e4282019-06-26 18:34:38 +02001654 * element, and the failure happened later (when saving metadata
1655 * to internal storage), we need to destroy the key in the secure
Gilles Peskinec9d7f942019-08-13 16:17:16 +02001656 * element.
1657 * https://github.com/ARMmbed/mbed-crypto/issues/217
1658 */
Gilles Peskinefc762652019-07-22 19:30:34 +02001659
Gilles Peskined7729582019-08-05 15:55:54 +02001660 /* Abort the ongoing transaction if any (there may not be one if
1661 * the creation process failed before starting one, or if the
1662 * key creation is a registration of a key in a secure element).
1663 * Earlier functions must already have done what it takes to undo any
1664 * partial creation. All that's left is to update the transaction data
1665 * itself. */
Gilles Peskinefc762652019-07-22 19:30:34 +02001666 (void) psa_crypto_stop_transaction( );
Gilles Peskine011e4282019-06-26 18:34:38 +02001667#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1668
Gilles Peskine4747d192019-04-17 15:05:45 +02001669 psa_wipe_key_slot( slot );
1670}
1671
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001672/** Validate optional attributes during key creation.
1673 *
1674 * Some key attributes are optional during key creation. If they are
1675 * specified in the attributes structure, check that they are consistent
1676 * with the data in the slot.
1677 *
1678 * This function should be called near the end of key creation, after
1679 * the slot in memory is fully populated but before saving persistent data.
1680 */
1681static psa_status_t psa_validate_optional_attributes(
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001682 const psa_key_slot_t *slot,
1683 const psa_key_attributes_t *attributes )
1684{
Gilles Peskine7e0cff92019-07-30 13:48:52 +02001685 if( attributes->core.type != 0 )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001686 {
Gilles Peskine8e338702019-07-30 20:06:31 +02001687 if( attributes->core.type != slot->attr.type )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001688 return( PSA_ERROR_INVALID_ARGUMENT );
1689 }
1690
1691 if( attributes->domain_parameters_size != 0 )
1692 {
John Durkop0e005192020-10-31 22:06:54 -07001693#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
1694 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Gilles Peskine8e338702019-07-30 20:06:31 +02001695 if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001696 {
Steven Cooremana2371e52020-07-28 14:30:39 +02001697 mbedtls_rsa_context *rsa = NULL;
Steven Cooreman75b74362020-07-28 14:30:13 +02001698 mbedtls_mpi actual, required;
Steven Cooreman6d839f02020-07-30 11:36:45 +02001699 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Steven Cooremana01795d2020-07-24 22:48:15 +02001700
Ronald Cron90857082020-11-25 14:58:33 +01001701 psa_status_t status = mbedtls_psa_rsa_load_representation(
1702 slot->attr.type,
1703 slot->key.data,
1704 slot->key.bytes,
1705 &rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02001706 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02001707 return( status );
Steven Cooreman75b74362020-07-28 14:30:13 +02001708
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001709 mbedtls_mpi_init( &actual );
1710 mbedtls_mpi_init( &required );
Steven Cooremana2371e52020-07-28 14:30:39 +02001711 ret = mbedtls_rsa_export( rsa,
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001712 NULL, NULL, NULL, NULL, &actual );
Steven Cooremana2371e52020-07-28 14:30:39 +02001713 mbedtls_rsa_free( rsa );
1714 mbedtls_free( rsa );
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001715 if( ret != 0 )
1716 goto rsa_exit;
1717 ret = mbedtls_mpi_read_binary( &required,
1718 attributes->domain_parameters,
1719 attributes->domain_parameters_size );
1720 if( ret != 0 )
1721 goto rsa_exit;
1722 if( mbedtls_mpi_cmp_mpi( &actual, &required ) != 0 )
1723 ret = MBEDTLS_ERR_RSA_BAD_INPUT_DATA;
1724 rsa_exit:
1725 mbedtls_mpi_free( &actual );
1726 mbedtls_mpi_free( &required );
1727 if( ret != 0)
1728 return( mbedtls_to_psa_error( ret ) );
1729 }
1730 else
John Durkop9814fa22020-11-04 12:28:15 -08001731#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
1732 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001733 {
1734 return( PSA_ERROR_INVALID_ARGUMENT );
1735 }
1736 }
1737
Gilles Peskine7e0cff92019-07-30 13:48:52 +02001738 if( attributes->core.bits != 0 )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001739 {
Gilles Peskineb46bef22019-07-30 21:32:04 +02001740 if( attributes->core.bits != slot->attr.bits )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001741 return( PSA_ERROR_INVALID_ARGUMENT );
1742 }
1743
1744 return( PSA_SUCCESS );
1745}
1746
Gilles Peskine4747d192019-04-17 15:05:45 +02001747psa_status_t psa_import_key( const psa_key_attributes_t *attributes,
Gilles Peskine4747d192019-04-17 15:05:45 +02001748 const uint8_t *data,
Gilles Peskine73676cb2019-05-15 20:15:10 +02001749 size_t data_length,
Ronald Croncf56a0a2020-08-04 09:51:30 +02001750 mbedtls_svc_key_id_t *key )
Gilles Peskine4747d192019-04-17 15:05:45 +02001751{
1752 psa_status_t status;
1753 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02001754 psa_se_drv_table_entry_t *driver = NULL;
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01001755 size_t bits;
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001756
Ronald Cron81709fc2020-11-14 12:10:32 +01001757 *key = MBEDTLS_SVC_KEY_ID_INIT;
1758
Gilles Peskine0f84d622019-09-12 19:03:13 +02001759 /* Reject zero-length symmetric keys (including raw data key objects).
1760 * This also rejects any key which might be encoded as an empty string,
1761 * which is never valid. */
1762 if( data_length == 0 )
1763 return( PSA_ERROR_INVALID_ARGUMENT );
1764
Gilles Peskinedf179142019-07-15 22:02:14 +02001765 status = psa_start_key_creation( PSA_KEY_CREATION_IMPORT, attributes,
Ronald Cron81709fc2020-11-14 12:10:32 +01001766 &slot, &driver );
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001767 if( status != PSA_SUCCESS )
1768 goto exit;
1769
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01001770 /* In the case of a transparent key or an opaque key stored in local
1771 * storage (thus not in the case of generating a key in a secure element
1772 * or cryptoprocessor with storage), we have to allocate a buffer to
1773 * hold the generated key material. */
1774 if( slot->key.data == NULL )
Gilles Peskine5d309672019-07-12 23:47:28 +02001775 {
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01001776 status = psa_allocate_buffer_to_slot( slot, data_length );
Gilles Peskineb46bef22019-07-30 21:32:04 +02001777 if( status != PSA_SUCCESS )
1778 goto exit;
Gilles Peskine5d309672019-07-12 23:47:28 +02001779 }
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01001780
1781 bits = slot->attr.bits;
1782 status = psa_driver_wrapper_import_key( attributes,
1783 data, data_length,
1784 slot->key.data,
1785 slot->key.bytes,
1786 &slot->key.bytes, &bits );
1787 if( status != PSA_SUCCESS )
1788 goto exit;
1789
1790 if( slot->attr.bits == 0 )
1791 slot->attr.bits = (psa_key_bits_t) bits;
1792 else if( bits != slot->attr.bits )
Steven Cooremanac3434f2021-01-15 17:36:02 +01001793 {
Steven Cooremanac3434f2021-01-15 17:36:02 +01001794 status = PSA_ERROR_INVALID_ARGUMENT;
1795 goto exit;
Gilles Peskine5d309672019-07-12 23:47:28 +02001796 }
Ronald Cron2ebfdcc2020-11-28 15:54:54 +01001797
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001798 status = psa_validate_optional_attributes( slot, attributes );
Gilles Peskine18017402019-07-24 20:25:59 +02001799 if( status != PSA_SUCCESS )
1800 goto exit;
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001801
Ronald Cron81709fc2020-11-14 12:10:32 +01001802 status = psa_finish_key_creation( slot, driver, key );
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001803exit:
Gilles Peskine4747d192019-04-17 15:05:45 +02001804 if( status != PSA_SUCCESS )
Gilles Peskine011e4282019-06-26 18:34:38 +02001805 psa_fail_key_creation( slot, driver );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001806
Gilles Peskine4747d192019-04-17 15:05:45 +02001807 return( status );
1808}
1809
Gilles Peskined7729582019-08-05 15:55:54 +02001810#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1811psa_status_t mbedtls_psa_register_se_key(
1812 const psa_key_attributes_t *attributes )
1813{
1814 psa_status_t status;
1815 psa_key_slot_t *slot = NULL;
1816 psa_se_drv_table_entry_t *driver = NULL;
Ronald Croncf56a0a2020-08-04 09:51:30 +02001817 mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT;
Gilles Peskined7729582019-08-05 15:55:54 +02001818
1819 /* Leaving attributes unspecified is not currently supported.
1820 * It could make sense to query the key type and size from the
1821 * secure element, but not all secure elements support this
1822 * and the driver HAL doesn't currently support it. */
1823 if( psa_get_key_type( attributes ) == PSA_KEY_TYPE_NONE )
1824 return( PSA_ERROR_NOT_SUPPORTED );
1825 if( psa_get_key_bits( attributes ) == 0 )
1826 return( PSA_ERROR_NOT_SUPPORTED );
1827
1828 status = psa_start_key_creation( PSA_KEY_CREATION_REGISTER, attributes,
Ronald Cron81709fc2020-11-14 12:10:32 +01001829 &slot, &driver );
Gilles Peskined7729582019-08-05 15:55:54 +02001830 if( status != PSA_SUCCESS )
1831 goto exit;
1832
Ronald Cron81709fc2020-11-14 12:10:32 +01001833 status = psa_finish_key_creation( slot, driver, &key );
Gilles Peskined7729582019-08-05 15:55:54 +02001834
1835exit:
1836 if( status != PSA_SUCCESS )
Gilles Peskined7729582019-08-05 15:55:54 +02001837 psa_fail_key_creation( slot, driver );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001838
Gilles Peskined7729582019-08-05 15:55:54 +02001839 /* Registration doesn't keep the key in RAM. */
Ronald Croncf56a0a2020-08-04 09:51:30 +02001840 psa_close_key( key );
Gilles Peskined7729582019-08-05 15:55:54 +02001841 return( status );
1842}
1843#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1844
Gilles Peskinef603c712019-01-19 13:40:11 +01001845static psa_status_t psa_copy_key_material( const psa_key_slot_t *source,
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001846 psa_key_slot_t *target )
Gilles Peskinef603c712019-01-19 13:40:11 +01001847{
Steven Cooremanf7cebd42020-10-13 20:27:40 +02001848 psa_status_t status = psa_copy_key_material_into_slot( target,
Ronald Cronea0f8a62020-11-25 17:52:23 +01001849 source->key.data,
1850 source->key.bytes );
Gilles Peskinef603c712019-01-19 13:40:11 +01001851 if( status != PSA_SUCCESS )
Steven Cooreman398aee52020-10-13 14:35:45 +02001852 return( status );
Gilles Peskinef603c712019-01-19 13:40:11 +01001853
Steven Cooreman398aee52020-10-13 14:35:45 +02001854 target->attr.type = source->attr.type;
1855 target->attr.bits = source->attr.bits;
1856
1857 return( PSA_SUCCESS );
Gilles Peskinef603c712019-01-19 13:40:11 +01001858}
1859
Ronald Croncf56a0a2020-08-04 09:51:30 +02001860psa_status_t psa_copy_key( mbedtls_svc_key_id_t source_key,
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001861 const psa_key_attributes_t *specified_attributes,
Ronald Croncf56a0a2020-08-04 09:51:30 +02001862 mbedtls_svc_key_id_t *target_key )
Gilles Peskinef603c712019-01-19 13:40:11 +01001863{
Ronald Cronf95a2b12020-10-22 15:24:49 +02001864 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01001865 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinef603c712019-01-19 13:40:11 +01001866 psa_key_slot_t *source_slot = NULL;
1867 psa_key_slot_t *target_slot = NULL;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001868 psa_key_attributes_t actual_attributes = *specified_attributes;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02001869 psa_se_drv_table_entry_t *driver = NULL;
Gilles Peskinef603c712019-01-19 13:40:11 +01001870
Ronald Cron81709fc2020-11-14 12:10:32 +01001871 *target_key = MBEDTLS_SVC_KEY_ID_INIT;
1872
Ronald Cron5c522922020-11-14 16:35:34 +01001873 status = psa_get_and_lock_transparent_key_slot_with_policy(
1874 source_key, &source_slot, PSA_KEY_USAGE_COPY, 0 );
Gilles Peskinef603c712019-01-19 13:40:11 +01001875 if( status != PSA_SUCCESS )
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001876 goto exit;
1877
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001878 status = psa_validate_optional_attributes( source_slot,
1879 specified_attributes );
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001880 if( status != PSA_SUCCESS )
1881 goto exit;
1882
Gilles Peskine7e0cff92019-07-30 13:48:52 +02001883 status = psa_restrict_key_policy( &actual_attributes.core.policy,
Gilles Peskine8e338702019-07-30 20:06:31 +02001884 &source_slot->attr.policy );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001885 if( status != PSA_SUCCESS )
1886 goto exit;
1887
Ronald Cron81709fc2020-11-14 12:10:32 +01001888 status = psa_start_key_creation( PSA_KEY_CREATION_COPY, &actual_attributes,
1889 &target_slot, &driver );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001890 if( status != PSA_SUCCESS )
1891 goto exit;
1892
Gilles Peskinef4ee6622019-07-24 13:44:30 +02001893#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1894 if( driver != NULL )
Gilles Peskinef603c712019-01-19 13:40:11 +01001895 {
Gilles Peskinef4ee6622019-07-24 13:44:30 +02001896 /* Copying to a secure element is not implemented yet. */
1897 status = PSA_ERROR_NOT_SUPPORTED;
1898 goto exit;
Gilles Peskinef603c712019-01-19 13:40:11 +01001899 }
Gilles Peskinef4ee6622019-07-24 13:44:30 +02001900#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskinef603c712019-01-19 13:40:11 +01001901
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001902 status = psa_copy_key_material( source_slot, target_slot );
Gilles Peskinef603c712019-01-19 13:40:11 +01001903 if( status != PSA_SUCCESS )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001904 goto exit;
Gilles Peskinef603c712019-01-19 13:40:11 +01001905
Ronald Cron81709fc2020-11-14 12:10:32 +01001906 status = psa_finish_key_creation( target_slot, driver, target_key );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001907exit:
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001908 if( status != PSA_SUCCESS )
Gilles Peskine011e4282019-06-26 18:34:38 +02001909 psa_fail_key_creation( target_slot, driver );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001910
Ronald Cron5c522922020-11-14 16:35:34 +01001911 unlock_status = psa_unlock_key_slot( source_slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001912
Ronald Cron5c522922020-11-14 16:35:34 +01001913 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskinef603c712019-01-19 13:40:11 +01001914}
1915
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02001916
1917
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001918/****************************************************************/
Gilles Peskine20035e32018-02-03 22:44:14 +01001919/* Message digests */
1920/****************************************************************/
1921
John Durkop07cc04a2020-11-16 22:08:34 -08001922#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
John Durkop0e005192020-10-31 22:06:54 -07001923 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) || \
1924 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) || \
John Durkop9814fa22020-11-04 12:28:15 -08001925 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
Ronald Cron36f641b2021-02-16 17:20:43 +01001926const mbedtls_md_info_t *mbedtls_md_info_from_psa( psa_algorithm_t alg )
Gilles Peskine20035e32018-02-03 22:44:14 +01001927{
1928 switch( alg )
1929 {
John Durkopee4e6602020-11-27 08:48:46 -08001930#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD2)
Gilles Peskine20035e32018-02-03 22:44:14 +01001931 case PSA_ALG_MD2:
1932 return( &mbedtls_md2_info );
1933#endif
John Durkopee4e6602020-11-27 08:48:46 -08001934#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD4)
Gilles Peskine20035e32018-02-03 22:44:14 +01001935 case PSA_ALG_MD4:
1936 return( &mbedtls_md4_info );
1937#endif
John Durkopee4e6602020-11-27 08:48:46 -08001938#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD5)
Gilles Peskine20035e32018-02-03 22:44:14 +01001939 case PSA_ALG_MD5:
1940 return( &mbedtls_md5_info );
1941#endif
John Durkopee4e6602020-11-27 08:48:46 -08001942#if defined(MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160)
Gilles Peskine20035e32018-02-03 22:44:14 +01001943 case PSA_ALG_RIPEMD160:
1944 return( &mbedtls_ripemd160_info );
1945#endif
John Durkopee4e6602020-11-27 08:48:46 -08001946#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_1)
Gilles Peskine20035e32018-02-03 22:44:14 +01001947 case PSA_ALG_SHA_1:
1948 return( &mbedtls_sha1_info );
1949#endif
John Durkopee4e6602020-11-27 08:48:46 -08001950#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_224)
Gilles Peskine20035e32018-02-03 22:44:14 +01001951 case PSA_ALG_SHA_224:
1952 return( &mbedtls_sha224_info );
John Durkopee4e6602020-11-27 08:48:46 -08001953#endif
1954#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256)
Gilles Peskine20035e32018-02-03 22:44:14 +01001955 case PSA_ALG_SHA_256:
1956 return( &mbedtls_sha256_info );
1957#endif
John Durkopee4e6602020-11-27 08:48:46 -08001958#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_384)
Gilles Peskine20035e32018-02-03 22:44:14 +01001959 case PSA_ALG_SHA_384:
1960 return( &mbedtls_sha384_info );
Manuel Pégourié-Gonnardd6020842019-07-17 16:28:21 +02001961#endif
John Durkopee4e6602020-11-27 08:48:46 -08001962#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_512)
Gilles Peskine20035e32018-02-03 22:44:14 +01001963 case PSA_ALG_SHA_512:
1964 return( &mbedtls_sha512_info );
1965#endif
1966 default:
1967 return( NULL );
1968 }
1969}
John Durkop07cc04a2020-11-16 22:08:34 -08001970#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
John Durkop9814fa22020-11-04 12:28:15 -08001971 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) ||
1972 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) ||
1973 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Gilles Peskine20035e32018-02-03 22:44:14 +01001974
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001975psa_status_t psa_hash_abort( psa_hash_operation_t *operation )
1976{
1977 switch( operation->alg )
1978 {
Gilles Peskine81736312018-06-26 15:04:31 +02001979 case 0:
1980 /* The object has (apparently) been initialized but it is not
1981 * in use. It's ok to call abort on such an object, and there's
1982 * nothing to do. */
1983 break;
John Durkopee4e6602020-11-27 08:48:46 -08001984#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD2)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001985 case PSA_ALG_MD2:
1986 mbedtls_md2_free( &operation->ctx.md2 );
1987 break;
1988#endif
John Durkopee4e6602020-11-27 08:48:46 -08001989#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD4)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001990 case PSA_ALG_MD4:
1991 mbedtls_md4_free( &operation->ctx.md4 );
1992 break;
1993#endif
John Durkopee4e6602020-11-27 08:48:46 -08001994#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD5)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001995 case PSA_ALG_MD5:
1996 mbedtls_md5_free( &operation->ctx.md5 );
1997 break;
1998#endif
John Durkopee4e6602020-11-27 08:48:46 -08001999#if defined(MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002000 case PSA_ALG_RIPEMD160:
2001 mbedtls_ripemd160_free( &operation->ctx.ripemd160 );
2002 break;
2003#endif
John Durkopee4e6602020-11-27 08:48:46 -08002004#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_1)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002005 case PSA_ALG_SHA_1:
2006 mbedtls_sha1_free( &operation->ctx.sha1 );
2007 break;
2008#endif
John Durkop6ca23272020-12-03 06:01:32 -08002009#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_224)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002010 case PSA_ALG_SHA_224:
John Durkop6ca23272020-12-03 06:01:32 -08002011 mbedtls_sha256_free( &operation->ctx.sha256 );
2012 break;
2013#endif
2014#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002015 case PSA_ALG_SHA_256:
2016 mbedtls_sha256_free( &operation->ctx.sha256 );
2017 break;
2018#endif
John Durkop6ca23272020-12-03 06:01:32 -08002019#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_384)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002020 case PSA_ALG_SHA_384:
John Durkop6ca23272020-12-03 06:01:32 -08002021 mbedtls_sha512_free( &operation->ctx.sha512 );
2022 break;
2023#endif
2024#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_512)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002025 case PSA_ALG_SHA_512:
2026 mbedtls_sha512_free( &operation->ctx.sha512 );
2027 break;
2028#endif
2029 default:
Gilles Peskinef9c2c092018-06-21 16:57:07 +02002030 return( PSA_ERROR_BAD_STATE );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002031 }
2032 operation->alg = 0;
2033 return( PSA_SUCCESS );
2034}
2035
Gilles Peskineda8191d1c2018-07-08 19:46:38 +02002036psa_status_t psa_hash_setup( psa_hash_operation_t *operation,
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002037 psa_algorithm_t alg )
2038{
Janos Follath24eed8d2019-11-22 13:21:35 +00002039 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jaeden Amero36ee5d02019-02-19 09:25:10 +00002040
2041 /* A context must be freshly initialized before it can be set up. */
2042 if( operation->alg != 0 )
2043 {
2044 return( PSA_ERROR_BAD_STATE );
2045 }
2046
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002047 switch( alg )
2048 {
John Durkopee4e6602020-11-27 08:48:46 -08002049#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD2)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002050 case PSA_ALG_MD2:
2051 mbedtls_md2_init( &operation->ctx.md2 );
2052 ret = mbedtls_md2_starts_ret( &operation->ctx.md2 );
2053 break;
2054#endif
John Durkopee4e6602020-11-27 08:48:46 -08002055#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD4)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002056 case PSA_ALG_MD4:
2057 mbedtls_md4_init( &operation->ctx.md4 );
2058 ret = mbedtls_md4_starts_ret( &operation->ctx.md4 );
2059 break;
2060#endif
John Durkopee4e6602020-11-27 08:48:46 -08002061#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD5)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002062 case PSA_ALG_MD5:
2063 mbedtls_md5_init( &operation->ctx.md5 );
2064 ret = mbedtls_md5_starts_ret( &operation->ctx.md5 );
2065 break;
2066#endif
John Durkopee4e6602020-11-27 08:48:46 -08002067#if defined(MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002068 case PSA_ALG_RIPEMD160:
2069 mbedtls_ripemd160_init( &operation->ctx.ripemd160 );
2070 ret = mbedtls_ripemd160_starts_ret( &operation->ctx.ripemd160 );
2071 break;
2072#endif
John Durkopee4e6602020-11-27 08:48:46 -08002073#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_1)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002074 case PSA_ALG_SHA_1:
2075 mbedtls_sha1_init( &operation->ctx.sha1 );
2076 ret = mbedtls_sha1_starts_ret( &operation->ctx.sha1 );
2077 break;
2078#endif
John Durkopee4e6602020-11-27 08:48:46 -08002079#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_224)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002080 case PSA_ALG_SHA_224:
2081 mbedtls_sha256_init( &operation->ctx.sha256 );
2082 ret = mbedtls_sha256_starts_ret( &operation->ctx.sha256, 1 );
2083 break;
John Durkopee4e6602020-11-27 08:48:46 -08002084#endif
2085#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002086 case PSA_ALG_SHA_256:
2087 mbedtls_sha256_init( &operation->ctx.sha256 );
2088 ret = mbedtls_sha256_starts_ret( &operation->ctx.sha256, 0 );
2089 break;
2090#endif
John Durkopee4e6602020-11-27 08:48:46 -08002091#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_384)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002092 case PSA_ALG_SHA_384:
2093 mbedtls_sha512_init( &operation->ctx.sha512 );
2094 ret = mbedtls_sha512_starts_ret( &operation->ctx.sha512, 1 );
2095 break;
Manuel Pégourié-Gonnard792b16d2020-01-07 10:13:18 +01002096#endif
John Durkopee4e6602020-11-27 08:48:46 -08002097#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_512)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002098 case PSA_ALG_SHA_512:
2099 mbedtls_sha512_init( &operation->ctx.sha512 );
2100 ret = mbedtls_sha512_starts_ret( &operation->ctx.sha512, 0 );
2101 break;
2102#endif
2103 default:
Gilles Peskinec06e0712018-06-20 16:21:04 +02002104 return( PSA_ALG_IS_HASH( alg ) ?
2105 PSA_ERROR_NOT_SUPPORTED :
2106 PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002107 }
2108 if( ret == 0 )
2109 operation->alg = alg;
2110 else
2111 psa_hash_abort( operation );
2112 return( mbedtls_to_psa_error( ret ) );
2113}
2114
2115psa_status_t psa_hash_update( psa_hash_operation_t *operation,
2116 const uint8_t *input,
2117 size_t input_length )
2118{
Janos Follath24eed8d2019-11-22 13:21:35 +00002119 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine94e44542018-07-12 16:58:43 +02002120
2121 /* Don't require hash implementations to behave correctly on a
2122 * zero-length input, which may have an invalid pointer. */
2123 if( input_length == 0 )
2124 return( PSA_SUCCESS );
2125
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002126 switch( operation->alg )
2127 {
John Durkopee4e6602020-11-27 08:48:46 -08002128#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD2)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002129 case PSA_ALG_MD2:
2130 ret = mbedtls_md2_update_ret( &operation->ctx.md2,
2131 input, input_length );
2132 break;
2133#endif
John Durkopee4e6602020-11-27 08:48:46 -08002134#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD4)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002135 case PSA_ALG_MD4:
2136 ret = mbedtls_md4_update_ret( &operation->ctx.md4,
2137 input, input_length );
2138 break;
2139#endif
John Durkopee4e6602020-11-27 08:48:46 -08002140#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD5)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002141 case PSA_ALG_MD5:
2142 ret = mbedtls_md5_update_ret( &operation->ctx.md5,
2143 input, input_length );
2144 break;
2145#endif
John Durkopee4e6602020-11-27 08:48:46 -08002146#if defined(MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002147 case PSA_ALG_RIPEMD160:
2148 ret = mbedtls_ripemd160_update_ret( &operation->ctx.ripemd160,
2149 input, input_length );
2150 break;
2151#endif
John Durkopee4e6602020-11-27 08:48:46 -08002152#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_1)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002153 case PSA_ALG_SHA_1:
2154 ret = mbedtls_sha1_update_ret( &operation->ctx.sha1,
2155 input, input_length );
2156 break;
2157#endif
John Durkop6ca23272020-12-03 06:01:32 -08002158#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_224)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002159 case PSA_ALG_SHA_224:
John Durkop6ca23272020-12-03 06:01:32 -08002160 ret = mbedtls_sha256_update_ret( &operation->ctx.sha256,
2161 input, input_length );
2162 break;
2163#endif
2164#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002165 case PSA_ALG_SHA_256:
2166 ret = mbedtls_sha256_update_ret( &operation->ctx.sha256,
2167 input, input_length );
2168 break;
2169#endif
John Durkop6ca23272020-12-03 06:01:32 -08002170#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_384)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002171 case PSA_ALG_SHA_384:
John Durkop6ca23272020-12-03 06:01:32 -08002172 ret = mbedtls_sha512_update_ret( &operation->ctx.sha512,
2173 input, input_length );
2174 break;
2175#endif
2176#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_512)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002177 case PSA_ALG_SHA_512:
2178 ret = mbedtls_sha512_update_ret( &operation->ctx.sha512,
2179 input, input_length );
2180 break;
2181#endif
2182 default:
John Durkopee4e6602020-11-27 08:48:46 -08002183 (void)input;
Jaeden Ameroa0f625a2019-02-15 13:52:25 +00002184 return( PSA_ERROR_BAD_STATE );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002185 }
Gilles Peskine94e44542018-07-12 16:58:43 +02002186
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002187 if( ret != 0 )
2188 psa_hash_abort( operation );
2189 return( mbedtls_to_psa_error( ret ) );
2190}
2191
2192psa_status_t psa_hash_finish( psa_hash_operation_t *operation,
2193 uint8_t *hash,
2194 size_t hash_size,
2195 size_t *hash_length )
2196{
itayzafrir40835d42018-08-02 13:14:17 +03002197 psa_status_t status;
Janos Follath24eed8d2019-11-22 13:21:35 +00002198 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
gabor-mezei-armcbcec212020-12-18 14:23:51 +01002199 size_t actual_hash_length = PSA_HASH_LENGTH( operation->alg );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002200
2201 /* Fill the output buffer with something that isn't a valid hash
2202 * (barring an attack on the hash and deliberately-crafted input),
2203 * in case the caller doesn't check the return status properly. */
Gilles Peskineaee13332018-07-02 12:15:28 +02002204 *hash_length = hash_size;
Gilles Peskine46f1fd72018-06-28 19:31:31 +02002205 /* If hash_size is 0 then hash may be NULL and then the
2206 * call to memset would have undefined behavior. */
2207 if( hash_size != 0 )
2208 memset( hash, '!', hash_size );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002209
2210 if( hash_size < actual_hash_length )
itayzafrir40835d42018-08-02 13:14:17 +03002211 {
2212 status = PSA_ERROR_BUFFER_TOO_SMALL;
2213 goto exit;
2214 }
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002215
2216 switch( operation->alg )
2217 {
John Durkopee4e6602020-11-27 08:48:46 -08002218#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD2)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002219 case PSA_ALG_MD2:
2220 ret = mbedtls_md2_finish_ret( &operation->ctx.md2, hash );
2221 break;
2222#endif
John Durkopee4e6602020-11-27 08:48:46 -08002223#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD4)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002224 case PSA_ALG_MD4:
2225 ret = mbedtls_md4_finish_ret( &operation->ctx.md4, hash );
2226 break;
2227#endif
John Durkopee4e6602020-11-27 08:48:46 -08002228#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD5)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002229 case PSA_ALG_MD5:
2230 ret = mbedtls_md5_finish_ret( &operation->ctx.md5, hash );
2231 break;
2232#endif
John Durkopee4e6602020-11-27 08:48:46 -08002233#if defined(MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002234 case PSA_ALG_RIPEMD160:
2235 ret = mbedtls_ripemd160_finish_ret( &operation->ctx.ripemd160, hash );
2236 break;
2237#endif
John Durkopee4e6602020-11-27 08:48:46 -08002238#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_1)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002239 case PSA_ALG_SHA_1:
2240 ret = mbedtls_sha1_finish_ret( &operation->ctx.sha1, hash );
2241 break;
2242#endif
John Durkop6ca23272020-12-03 06:01:32 -08002243#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_224)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002244 case PSA_ALG_SHA_224:
John Durkop6ca23272020-12-03 06:01:32 -08002245 ret = mbedtls_sha256_finish_ret( &operation->ctx.sha256, hash );
2246 break;
2247#endif
2248#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002249 case PSA_ALG_SHA_256:
2250 ret = mbedtls_sha256_finish_ret( &operation->ctx.sha256, hash );
2251 break;
2252#endif
John Durkop6ca23272020-12-03 06:01:32 -08002253#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_384)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002254 case PSA_ALG_SHA_384:
John Durkop6ca23272020-12-03 06:01:32 -08002255 ret = mbedtls_sha512_finish_ret( &operation->ctx.sha512, hash );
2256 break;
2257#endif
2258#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_512)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002259 case PSA_ALG_SHA_512:
2260 ret = mbedtls_sha512_finish_ret( &operation->ctx.sha512, hash );
2261 break;
2262#endif
2263 default:
Jaeden Ameroa0f625a2019-02-15 13:52:25 +00002264 return( PSA_ERROR_BAD_STATE );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002265 }
itayzafrir40835d42018-08-02 13:14:17 +03002266 status = mbedtls_to_psa_error( ret );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002267
itayzafrir40835d42018-08-02 13:14:17 +03002268exit:
2269 if( status == PSA_SUCCESS )
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002270 {
Gilles Peskineaee13332018-07-02 12:15:28 +02002271 *hash_length = actual_hash_length;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002272 return( psa_hash_abort( operation ) );
2273 }
2274 else
2275 {
2276 psa_hash_abort( operation );
itayzafrir40835d42018-08-02 13:14:17 +03002277 return( status );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002278 }
2279}
2280
Gilles Peskine2d277862018-06-18 15:41:12 +02002281psa_status_t psa_hash_verify( psa_hash_operation_t *operation,
2282 const uint8_t *hash,
2283 size_t hash_length )
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002284{
2285 uint8_t actual_hash[MBEDTLS_MD_MAX_SIZE];
2286 size_t actual_hash_length;
2287 psa_status_t status = psa_hash_finish( operation,
2288 actual_hash, sizeof( actual_hash ),
2289 &actual_hash_length );
2290 if( status != PSA_SUCCESS )
2291 return( status );
2292 if( actual_hash_length != hash_length )
2293 return( PSA_ERROR_INVALID_SIGNATURE );
2294 if( safer_memcmp( hash, actual_hash, actual_hash_length ) != 0 )
2295 return( PSA_ERROR_INVALID_SIGNATURE );
2296 return( PSA_SUCCESS );
2297}
2298
Gilles Peskine0a749c82019-11-28 19:33:58 +01002299psa_status_t psa_hash_compute( psa_algorithm_t alg,
2300 const uint8_t *input, size_t input_length,
2301 uint8_t *hash, size_t hash_size,
2302 size_t *hash_length )
2303{
2304 psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT;
2305 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2306
2307 *hash_length = hash_size;
2308 status = psa_hash_setup( &operation, alg );
2309 if( status != PSA_SUCCESS )
2310 goto exit;
2311 status = psa_hash_update( &operation, input, input_length );
2312 if( status != PSA_SUCCESS )
2313 goto exit;
2314 status = psa_hash_finish( &operation, hash, hash_size, hash_length );
2315 if( status != PSA_SUCCESS )
2316 goto exit;
2317
2318exit:
2319 if( status == PSA_SUCCESS )
2320 status = psa_hash_abort( &operation );
2321 else
2322 psa_hash_abort( &operation );
2323 return( status );
2324}
2325
2326psa_status_t psa_hash_compare( psa_algorithm_t alg,
2327 const uint8_t *input, size_t input_length,
2328 const uint8_t *hash, size_t hash_length )
2329{
2330 psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT;
2331 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2332
2333 status = psa_hash_setup( &operation, alg );
2334 if( status != PSA_SUCCESS )
2335 goto exit;
2336 status = psa_hash_update( &operation, input, input_length );
2337 if( status != PSA_SUCCESS )
2338 goto exit;
2339 status = psa_hash_verify( &operation, hash, hash_length );
2340 if( status != PSA_SUCCESS )
2341 goto exit;
2342
2343exit:
2344 if( status == PSA_SUCCESS )
2345 status = psa_hash_abort( &operation );
2346 else
2347 psa_hash_abort( &operation );
2348 return( status );
2349}
2350
Gilles Peskineeb35d782019-01-22 17:56:16 +01002351psa_status_t psa_hash_clone( const psa_hash_operation_t *source_operation,
2352 psa_hash_operation_t *target_operation )
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002353{
2354 if( target_operation->alg != 0 )
2355 return( PSA_ERROR_BAD_STATE );
2356
2357 switch( source_operation->alg )
2358 {
2359 case 0:
2360 return( PSA_ERROR_BAD_STATE );
John Durkopee4e6602020-11-27 08:48:46 -08002361#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD2)
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002362 case PSA_ALG_MD2:
2363 mbedtls_md2_clone( &target_operation->ctx.md2,
2364 &source_operation->ctx.md2 );
2365 break;
2366#endif
John Durkopee4e6602020-11-27 08:48:46 -08002367#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD4)
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002368 case PSA_ALG_MD4:
2369 mbedtls_md4_clone( &target_operation->ctx.md4,
2370 &source_operation->ctx.md4 );
2371 break;
2372#endif
John Durkopee4e6602020-11-27 08:48:46 -08002373#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD5)
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002374 case PSA_ALG_MD5:
2375 mbedtls_md5_clone( &target_operation->ctx.md5,
2376 &source_operation->ctx.md5 );
2377 break;
2378#endif
John Durkopee4e6602020-11-27 08:48:46 -08002379#if defined(MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160)
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002380 case PSA_ALG_RIPEMD160:
2381 mbedtls_ripemd160_clone( &target_operation->ctx.ripemd160,
2382 &source_operation->ctx.ripemd160 );
2383 break;
2384#endif
John Durkopee4e6602020-11-27 08:48:46 -08002385#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_1)
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002386 case PSA_ALG_SHA_1:
2387 mbedtls_sha1_clone( &target_operation->ctx.sha1,
2388 &source_operation->ctx.sha1 );
2389 break;
2390#endif
John Durkop6ca23272020-12-03 06:01:32 -08002391#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_224)
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002392 case PSA_ALG_SHA_224:
John Durkop6ca23272020-12-03 06:01:32 -08002393 mbedtls_sha256_clone( &target_operation->ctx.sha256,
2394 &source_operation->ctx.sha256 );
2395 break;
2396#endif
2397#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256)
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002398 case PSA_ALG_SHA_256:
2399 mbedtls_sha256_clone( &target_operation->ctx.sha256,
2400 &source_operation->ctx.sha256 );
2401 break;
2402#endif
John Durkop6ca23272020-12-03 06:01:32 -08002403#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_384)
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002404 case PSA_ALG_SHA_384:
John Durkop6ca23272020-12-03 06:01:32 -08002405 mbedtls_sha512_clone( &target_operation->ctx.sha512,
2406 &source_operation->ctx.sha512 );
2407 break;
2408#endif
2409#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_512)
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002410 case PSA_ALG_SHA_512:
2411 mbedtls_sha512_clone( &target_operation->ctx.sha512,
2412 &source_operation->ctx.sha512 );
2413 break;
2414#endif
2415 default:
2416 return( PSA_ERROR_NOT_SUPPORTED );
2417 }
2418
2419 target_operation->alg = source_operation->alg;
2420 return( PSA_SUCCESS );
2421}
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002422
2423
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002424/****************************************************************/
Gilles Peskine8c9def32018-02-08 10:02:12 +01002425/* MAC */
2426/****************************************************************/
2427
Gilles Peskinedc2fc842018-03-07 16:42:59 +01002428static const mbedtls_cipher_info_t *mbedtls_cipher_info_from_psa(
Gilles Peskine8c9def32018-02-08 10:02:12 +01002429 psa_algorithm_t alg,
2430 psa_key_type_t key_type,
Gilles Peskine2d277862018-06-18 15:41:12 +02002431 size_t key_bits,
mohammad1603f4f0d612018-06-03 15:04:51 +03002432 mbedtls_cipher_id_t* cipher_id )
Gilles Peskine8c9def32018-02-08 10:02:12 +01002433{
Gilles Peskine8c9def32018-02-08 10:02:12 +01002434 mbedtls_cipher_mode_t mode;
mohammad1603f4f0d612018-06-03 15:04:51 +03002435 mbedtls_cipher_id_t cipher_id_tmp;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002436
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02002437 if( PSA_ALG_IS_AEAD( alg ) )
Bence Szépkútia63b20d2020-12-16 11:36:46 +01002438 alg = PSA_ALG_AEAD_WITH_SHORTENED_TAG( alg, 0 );
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02002439
Gilles Peskine8c9def32018-02-08 10:02:12 +01002440 if( PSA_ALG_IS_CIPHER( alg ) || PSA_ALG_IS_AEAD( alg ) )
2441 {
Nir Sonnenscheine9664c32018-06-17 14:41:30 +03002442 switch( alg )
Gilles Peskine8c9def32018-02-08 10:02:12 +01002443 {
Bence Szépkúti1de907d2020-12-07 18:20:28 +01002444 case PSA_ALG_STREAM_CIPHER:
Gilles Peskine8c9def32018-02-08 10:02:12 +01002445 mode = MBEDTLS_MODE_STREAM;
2446 break;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002447 case PSA_ALG_CTR:
2448 mode = MBEDTLS_MODE_CTR;
2449 break;
Gilles Peskinedaea26f2018-08-21 14:02:45 +02002450 case PSA_ALG_CFB:
2451 mode = MBEDTLS_MODE_CFB;
2452 break;
2453 case PSA_ALG_OFB:
2454 mode = MBEDTLS_MODE_OFB;
2455 break;
Steven Cooremaned3c9ec2020-07-06 14:08:59 +02002456 case PSA_ALG_ECB_NO_PADDING:
2457 mode = MBEDTLS_MODE_ECB;
2458 break;
Gilles Peskinedaea26f2018-08-21 14:02:45 +02002459 case PSA_ALG_CBC_NO_PADDING:
2460 mode = MBEDTLS_MODE_CBC;
2461 break;
2462 case PSA_ALG_CBC_PKCS7:
2463 mode = MBEDTLS_MODE_CBC;
2464 break;
Bence Szépkútia63b20d2020-12-16 11:36:46 +01002465 case PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, 0 ):
Gilles Peskine8c9def32018-02-08 10:02:12 +01002466 mode = MBEDTLS_MODE_CCM;
2467 break;
Bence Szépkútia63b20d2020-12-16 11:36:46 +01002468 case PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_GCM, 0 ):
Gilles Peskine8c9def32018-02-08 10:02:12 +01002469 mode = MBEDTLS_MODE_GCM;
2470 break;
Bence Szépkútia63b20d2020-12-16 11:36:46 +01002471 case PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CHACHA20_POLY1305, 0 ):
Gilles Peskine26869f22019-05-06 15:25:00 +02002472 mode = MBEDTLS_MODE_CHACHAPOLY;
2473 break;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002474 default:
2475 return( NULL );
2476 }
2477 }
2478 else if( alg == PSA_ALG_CMAC )
2479 mode = MBEDTLS_MODE_ECB;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002480 else
2481 return( NULL );
2482
2483 switch( key_type )
2484 {
2485 case PSA_KEY_TYPE_AES:
mohammad1603f4f0d612018-06-03 15:04:51 +03002486 cipher_id_tmp = MBEDTLS_CIPHER_ID_AES;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002487 break;
2488 case PSA_KEY_TYPE_DES:
Gilles Peskine9ad29e22018-06-21 09:40:04 +02002489 /* key_bits is 64 for Single-DES, 128 for two-key Triple-DES,
2490 * and 192 for three-key Triple-DES. */
Gilles Peskine8c9def32018-02-08 10:02:12 +01002491 if( key_bits == 64 )
mohammad1603f4f0d612018-06-03 15:04:51 +03002492 cipher_id_tmp = MBEDTLS_CIPHER_ID_DES;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002493 else
mohammad1603f4f0d612018-06-03 15:04:51 +03002494 cipher_id_tmp = MBEDTLS_CIPHER_ID_3DES;
Gilles Peskine9ad29e22018-06-21 09:40:04 +02002495 /* mbedtls doesn't recognize two-key Triple-DES as an algorithm,
2496 * but two-key Triple-DES is functionally three-key Triple-DES
2497 * with K1=K3, so that's how we present it to mbedtls. */
2498 if( key_bits == 128 )
2499 key_bits = 192;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002500 break;
2501 case PSA_KEY_TYPE_CAMELLIA:
mohammad1603f4f0d612018-06-03 15:04:51 +03002502 cipher_id_tmp = MBEDTLS_CIPHER_ID_CAMELLIA;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002503 break;
2504 case PSA_KEY_TYPE_ARC4:
mohammad1603f4f0d612018-06-03 15:04:51 +03002505 cipher_id_tmp = MBEDTLS_CIPHER_ID_ARC4;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002506 break;
Gilles Peskine26869f22019-05-06 15:25:00 +02002507 case PSA_KEY_TYPE_CHACHA20:
2508 cipher_id_tmp = MBEDTLS_CIPHER_ID_CHACHA20;
2509 break;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002510 default:
2511 return( NULL );
2512 }
mohammad1603f4f0d612018-06-03 15:04:51 +03002513 if( cipher_id != NULL )
mohammad160360a64d02018-06-03 17:20:42 +03002514 *cipher_id = cipher_id_tmp;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002515
Jaeden Amero23bbb752018-06-26 14:16:54 +01002516 return( mbedtls_cipher_info_from_values( cipher_id_tmp,
2517 (int) key_bits, mode ) );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002518}
2519
John Durkop6ba40d12020-11-10 08:50:04 -08002520#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002521static size_t psa_get_hash_block_size( psa_algorithm_t alg )
Nir Sonnenschein96272412018-06-17 14:41:10 +03002522{
Gilles Peskine2d277862018-06-18 15:41:12 +02002523 switch( alg )
Nir Sonnenschein96272412018-06-17 14:41:10 +03002524 {
2525 case PSA_ALG_MD2:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002526 return( 16 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002527 case PSA_ALG_MD4:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002528 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002529 case PSA_ALG_MD5:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002530 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002531 case PSA_ALG_RIPEMD160:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002532 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002533 case PSA_ALG_SHA_1:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002534 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002535 case PSA_ALG_SHA_224:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002536 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002537 case PSA_ALG_SHA_256:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002538 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002539 case PSA_ALG_SHA_384:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002540 return( 128 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002541 case PSA_ALG_SHA_512:
Gilles Peskine2d277862018-06-18 15:41:12 +02002542 return( 128 );
2543 default:
2544 return( 0 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002545 }
2546}
John Durkop07cc04a2020-11-16 22:08:34 -08002547#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC) */
Nir Sonnenschein0c9ec532018-06-07 13:27:47 +03002548
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002549/* Initialize the MAC operation structure. Once this function has been
2550 * called, psa_mac_abort can run and will do the right thing. */
2551static psa_status_t psa_mac_init( psa_mac_operation_t *operation,
2552 psa_algorithm_t alg )
2553{
2554 psa_status_t status = PSA_ERROR_NOT_SUPPORTED;
2555
2556 operation->alg = alg;
2557 operation->key_set = 0;
2558 operation->iv_set = 0;
2559 operation->iv_required = 0;
2560 operation->has_input = 0;
Gilles Peskine89167cb2018-07-08 20:12:23 +02002561 operation->is_sign = 0;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002562
2563#if defined(MBEDTLS_CMAC_C)
2564 if( alg == PSA_ALG_CMAC )
2565 {
2566 operation->iv_required = 0;
2567 mbedtls_cipher_init( &operation->ctx.cmac );
2568 status = PSA_SUCCESS;
2569 }
2570 else
2571#endif /* MBEDTLS_CMAC_C */
John Durkopd0321952020-10-29 21:37:36 -07002572#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002573 if( PSA_ALG_IS_HMAC( operation->alg ) )
2574 {
Gilles Peskineff94abd2018-07-12 17:07:52 +02002575 /* We'll set up the hash operation later in psa_hmac_setup_internal. */
2576 operation->ctx.hmac.hash_ctx.alg = 0;
2577 status = PSA_SUCCESS;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002578 }
2579 else
John Durkopd0321952020-10-29 21:37:36 -07002580#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002581 {
Gilles Peskinec06e0712018-06-20 16:21:04 +02002582 if( ! PSA_ALG_IS_MAC( alg ) )
2583 status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002584 }
2585
2586 if( status != PSA_SUCCESS )
2587 memset( operation, 0, sizeof( *operation ) );
2588 return( status );
2589}
2590
John Durkop6ba40d12020-11-10 08:50:04 -08002591#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Gilles Peskine01126fa2018-07-12 17:04:55 +02002592static psa_status_t psa_hmac_abort_internal( psa_hmac_internal_data *hmac )
2593{
Gilles Peskine3f108122018-12-07 18:14:53 +01002594 mbedtls_platform_zeroize( hmac->opad, sizeof( hmac->opad ) );
Gilles Peskine01126fa2018-07-12 17:04:55 +02002595 return( psa_hash_abort( &hmac->hash_ctx ) );
2596}
John Durkop6ba40d12020-11-10 08:50:04 -08002597#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Gilles Peskine01126fa2018-07-12 17:04:55 +02002598
Gilles Peskine8c9def32018-02-08 10:02:12 +01002599psa_status_t psa_mac_abort( psa_mac_operation_t *operation )
2600{
Gilles Peskinefbfac682018-07-08 20:51:54 +02002601 if( operation->alg == 0 )
Gilles Peskine8c9def32018-02-08 10:02:12 +01002602 {
Gilles Peskinefbfac682018-07-08 20:51:54 +02002603 /* The object has (apparently) been initialized but it is not
2604 * in use. It's ok to call abort on such an object, and there's
2605 * nothing to do. */
2606 return( PSA_SUCCESS );
2607 }
2608 else
Gilles Peskine8c9def32018-02-08 10:02:12 +01002609#if defined(MBEDTLS_CMAC_C)
Gilles Peskinefbfac682018-07-08 20:51:54 +02002610 if( operation->alg == PSA_ALG_CMAC )
2611 {
2612 mbedtls_cipher_free( &operation->ctx.cmac );
2613 }
2614 else
Gilles Peskine8c9def32018-02-08 10:02:12 +01002615#endif /* MBEDTLS_CMAC_C */
John Durkopd0321952020-10-29 21:37:36 -07002616#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Gilles Peskinefbfac682018-07-08 20:51:54 +02002617 if( PSA_ALG_IS_HMAC( operation->alg ) )
2618 {
Gilles Peskine01126fa2018-07-12 17:04:55 +02002619 psa_hmac_abort_internal( &operation->ctx.hmac );
Gilles Peskinefbfac682018-07-08 20:51:54 +02002620 }
2621 else
John Durkopd0321952020-10-29 21:37:36 -07002622#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Gilles Peskinefbfac682018-07-08 20:51:54 +02002623 {
2624 /* Sanity check (shouldn't happen: operation->alg should
2625 * always have been initialized to a valid value). */
2626 goto bad_state;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002627 }
Moran Peker41deec42018-04-04 15:43:05 +03002628
Gilles Peskine8c9def32018-02-08 10:02:12 +01002629 operation->alg = 0;
2630 operation->key_set = 0;
2631 operation->iv_set = 0;
2632 operation->iv_required = 0;
2633 operation->has_input = 0;
Gilles Peskine89167cb2018-07-08 20:12:23 +02002634 operation->is_sign = 0;
Moran Peker41deec42018-04-04 15:43:05 +03002635
Gilles Peskine8c9def32018-02-08 10:02:12 +01002636 return( PSA_SUCCESS );
Gilles Peskinefbfac682018-07-08 20:51:54 +02002637
2638bad_state:
2639 /* If abort is called on an uninitialized object, we can't trust
2640 * anything. Wipe the object in case it contains confidential data.
2641 * This may result in a memory leak if a pointer gets overwritten,
2642 * but it's too late to do anything about this. */
2643 memset( operation, 0, sizeof( *operation ) );
2644 return( PSA_ERROR_BAD_STATE );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002645}
2646
Gilles Peskinee3b07d82018-06-19 11:57:35 +02002647#if defined(MBEDTLS_CMAC_C)
Gilles Peskine89167cb2018-07-08 20:12:23 +02002648static int psa_cmac_setup( psa_mac_operation_t *operation,
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002649 size_t key_bits,
Gilles Peskine2f060a82018-12-04 17:12:32 +01002650 psa_key_slot_t *slot,
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002651 const mbedtls_cipher_info_t *cipher_info )
2652{
Janos Follath24eed8d2019-11-22 13:21:35 +00002653 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002654
2655 operation->mac_size = cipher_info->block_size;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002656
2657 ret = mbedtls_cipher_setup( &operation->ctx.cmac, cipher_info );
2658 if( ret != 0 )
2659 return( ret );
2660
2661 ret = mbedtls_cipher_cmac_starts( &operation->ctx.cmac,
Ronald Cronea0f8a62020-11-25 17:52:23 +01002662 slot->key.data,
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002663 key_bits );
2664 return( ret );
2665}
Gilles Peskinee3b07d82018-06-19 11:57:35 +02002666#endif /* MBEDTLS_CMAC_C */
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002667
John Durkop6ba40d12020-11-10 08:50:04 -08002668#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Gilles Peskine01126fa2018-07-12 17:04:55 +02002669static psa_status_t psa_hmac_setup_internal( psa_hmac_internal_data *hmac,
2670 const uint8_t *key,
2671 size_t key_length,
2672 psa_algorithm_t hash_alg )
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002673{
Gilles Peskinec11c4dc2019-07-15 11:06:38 +02002674 uint8_t ipad[PSA_HMAC_MAX_HASH_BLOCK_SIZE];
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002675 size_t i;
gabor-mezei-armcbcec212020-12-18 14:23:51 +01002676 size_t hash_size = PSA_HASH_LENGTH( hash_alg );
Gilles Peskine01126fa2018-07-12 17:04:55 +02002677 size_t block_size = psa_get_hash_block_size( hash_alg );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002678 psa_status_t status;
2679
Gilles Peskine9aa369e2018-07-16 00:36:29 +02002680 /* Sanity checks on block_size, to guarantee that there won't be a buffer
2681 * overflow below. This should never trigger if the hash algorithm
2682 * is implemented correctly. */
2683 /* The size checks against the ipad and opad buffers cannot be written
2684 * `block_size > sizeof( ipad ) || block_size > sizeof( hmac->opad )`
2685 * because that triggers -Wlogical-op on GCC 7.3. */
2686 if( block_size > sizeof( ipad ) )
2687 return( PSA_ERROR_NOT_SUPPORTED );
2688 if( block_size > sizeof( hmac->opad ) )
2689 return( PSA_ERROR_NOT_SUPPORTED );
2690 if( block_size < hash_size )
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002691 return( PSA_ERROR_NOT_SUPPORTED );
2692
Gilles Peskined223b522018-06-11 18:12:58 +02002693 if( key_length > block_size )
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002694 {
Gilles Peskine84b8fc82019-11-28 20:07:20 +01002695 status = psa_hash_compute( hash_alg, key, key_length,
2696 ipad, sizeof( ipad ), &key_length );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002697 if( status != PSA_SUCCESS )
Gilles Peskineb8be2882018-07-17 16:24:34 +02002698 goto cleanup;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002699 }
Gilles Peskine96889972018-07-12 17:07:03 +02002700 /* A 0-length key is not commonly used in HMAC when used as a MAC,
2701 * but it is permitted. It is common when HMAC is used in HKDF, for
2702 * example. Don't call `memcpy` in the 0-length because `key` could be
2703 * an invalid pointer which would make the behavior undefined. */
2704 else if( key_length != 0 )
Gilles Peskine01126fa2018-07-12 17:04:55 +02002705 memcpy( ipad, key, key_length );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002706
Gilles Peskined223b522018-06-11 18:12:58 +02002707 /* ipad contains the key followed by garbage. Xor and fill with 0x36
2708 * to create the ipad value. */
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002709 for( i = 0; i < key_length; i++ )
Gilles Peskined223b522018-06-11 18:12:58 +02002710 ipad[i] ^= 0x36;
2711 memset( ipad + key_length, 0x36, block_size - key_length );
2712
2713 /* Copy the key material from ipad to opad, flipping the requisite bits,
2714 * and filling the rest of opad with the requisite constant. */
2715 for( i = 0; i < key_length; i++ )
Gilles Peskine01126fa2018-07-12 17:04:55 +02002716 hmac->opad[i] = ipad[i] ^ 0x36 ^ 0x5C;
2717 memset( hmac->opad + key_length, 0x5C, block_size - key_length );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002718
Gilles Peskine01126fa2018-07-12 17:04:55 +02002719 status = psa_hash_setup( &hmac->hash_ctx, hash_alg );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002720 if( status != PSA_SUCCESS )
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02002721 goto cleanup;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002722
Gilles Peskine01126fa2018-07-12 17:04:55 +02002723 status = psa_hash_update( &hmac->hash_ctx, ipad, block_size );
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02002724
2725cleanup:
Steven Cooreman29149862020-08-05 15:43:42 +02002726 mbedtls_platform_zeroize( ipad, sizeof( ipad ) );
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02002727
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002728 return( status );
2729}
John Durkop6ba40d12020-11-10 08:50:04 -08002730#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002731
Gilles Peskine89167cb2018-07-08 20:12:23 +02002732static psa_status_t psa_mac_setup( psa_mac_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02002733 mbedtls_svc_key_id_t key,
Gilles Peskine89167cb2018-07-08 20:12:23 +02002734 psa_algorithm_t alg,
2735 int is_sign )
Gilles Peskine8c9def32018-02-08 10:02:12 +01002736{
Ronald Cronf95a2b12020-10-22 15:24:49 +02002737 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01002738 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01002739 psa_key_slot_t *slot;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002740 size_t key_bits;
Gilles Peskine89167cb2018-07-08 20:12:23 +02002741 psa_key_usage_t usage =
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01002742 is_sign ? PSA_KEY_USAGE_SIGN_HASH : PSA_KEY_USAGE_VERIFY_HASH;
Gilles Peskinec11c4dc2019-07-15 11:06:38 +02002743 uint8_t truncated = PSA_MAC_TRUNCATED_LENGTH( alg );
Gilles Peskinee0e9c7c2018-10-17 18:28:05 +02002744 psa_algorithm_t full_length_alg = PSA_ALG_FULL_LENGTH_MAC( alg );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002745
Jaeden Amero36ee5d02019-02-19 09:25:10 +00002746 /* A context must be freshly initialized before it can be set up. */
2747 if( operation->alg != 0 )
2748 {
2749 return( PSA_ERROR_BAD_STATE );
2750 }
2751
Gilles Peskined911eb72018-08-14 15:18:45 +02002752 status = psa_mac_init( operation, full_length_alg );
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002753 if( status != PSA_SUCCESS )
2754 return( status );
Gilles Peskine89167cb2018-07-08 20:12:23 +02002755 if( is_sign )
2756 operation->is_sign = 1;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002757
Ronald Cron5c522922020-11-14 16:35:34 +01002758 status = psa_get_and_lock_transparent_key_slot_with_policy(
2759 key, &slot, usage, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02002760 if( status != PSA_SUCCESS )
Gilles Peskinefbfac682018-07-08 20:51:54 +02002761 goto exit;
Gilles Peskinedb4b3ab2019-04-18 12:53:01 +02002762 key_bits = psa_get_key_slot_bits( slot );
Gilles Peskineab1d7ab2018-07-06 16:07:47 +02002763
Gilles Peskine8c9def32018-02-08 10:02:12 +01002764#if defined(MBEDTLS_CMAC_C)
Gilles Peskined911eb72018-08-14 15:18:45 +02002765 if( full_length_alg == PSA_ALG_CMAC )
Gilles Peskinefbfac682018-07-08 20:51:54 +02002766 {
2767 const mbedtls_cipher_info_t *cipher_info =
Gilles Peskined911eb72018-08-14 15:18:45 +02002768 mbedtls_cipher_info_from_psa( full_length_alg,
Gilles Peskine8e338702019-07-30 20:06:31 +02002769 slot->attr.type, key_bits, NULL );
Janos Follath24eed8d2019-11-22 13:21:35 +00002770 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskinefbfac682018-07-08 20:51:54 +02002771 if( cipher_info == NULL )
2772 {
2773 status = PSA_ERROR_NOT_SUPPORTED;
2774 goto exit;
2775 }
2776 operation->mac_size = cipher_info->block_size;
2777 ret = psa_cmac_setup( operation, key_bits, slot, cipher_info );
2778 status = mbedtls_to_psa_error( ret );
2779 }
2780 else
Gilles Peskine8c9def32018-02-08 10:02:12 +01002781#endif /* MBEDTLS_CMAC_C */
John Durkopd0321952020-10-29 21:37:36 -07002782#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Gilles Peskined911eb72018-08-14 15:18:45 +02002783 if( PSA_ALG_IS_HMAC( full_length_alg ) )
Gilles Peskinefbfac682018-07-08 20:51:54 +02002784 {
Gilles Peskine00709fa2018-08-22 18:25:41 +02002785 psa_algorithm_t hash_alg = PSA_ALG_HMAC_GET_HASH( alg );
Gilles Peskine01126fa2018-07-12 17:04:55 +02002786 if( hash_alg == 0 )
2787 {
2788 status = PSA_ERROR_NOT_SUPPORTED;
2789 goto exit;
2790 }
Gilles Peskine9aa369e2018-07-16 00:36:29 +02002791
gabor-mezei-armcbcec212020-12-18 14:23:51 +01002792 operation->mac_size = PSA_HASH_LENGTH( hash_alg );
Gilles Peskine9aa369e2018-07-16 00:36:29 +02002793 /* Sanity check. This shouldn't fail on a valid configuration. */
2794 if( operation->mac_size == 0 ||
2795 operation->mac_size > sizeof( operation->ctx.hmac.opad ) )
2796 {
2797 status = PSA_ERROR_NOT_SUPPORTED;
2798 goto exit;
2799 }
2800
Gilles Peskine8e338702019-07-30 20:06:31 +02002801 if( slot->attr.type != PSA_KEY_TYPE_HMAC )
Gilles Peskine01126fa2018-07-12 17:04:55 +02002802 {
2803 status = PSA_ERROR_INVALID_ARGUMENT;
2804 goto exit;
2805 }
Gilles Peskine9aa369e2018-07-16 00:36:29 +02002806
Gilles Peskine01126fa2018-07-12 17:04:55 +02002807 status = psa_hmac_setup_internal( &operation->ctx.hmac,
Ronald Cronea0f8a62020-11-25 17:52:23 +01002808 slot->key.data,
2809 slot->key.bytes,
Gilles Peskine01126fa2018-07-12 17:04:55 +02002810 hash_alg );
Gilles Peskinefbfac682018-07-08 20:51:54 +02002811 }
2812 else
John Durkopd0321952020-10-29 21:37:36 -07002813#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Gilles Peskinefbfac682018-07-08 20:51:54 +02002814 {
Jaeden Amero82df32e2018-11-23 15:11:20 +00002815 (void) key_bits;
Gilles Peskinefbfac682018-07-08 20:51:54 +02002816 status = PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002817 }
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002818
Gilles Peskined911eb72018-08-14 15:18:45 +02002819 if( truncated == 0 )
2820 {
2821 /* The "normal" case: untruncated algorithm. Nothing to do. */
2822 }
2823 else if( truncated < 4 )
2824 {
Gilles Peskine6d72ff92018-08-21 14:55:08 +02002825 /* A very short MAC is too short for security since it can be
2826 * brute-forced. Ancient protocols with 32-bit MACs do exist,
2827 * so we make this our minimum, even though 32 bits is still
2828 * too small for security. */
Gilles Peskined911eb72018-08-14 15:18:45 +02002829 status = PSA_ERROR_NOT_SUPPORTED;
2830 }
2831 else if( truncated > operation->mac_size )
2832 {
2833 /* It's impossible to "truncate" to a larger length. */
2834 status = PSA_ERROR_INVALID_ARGUMENT;
2835 }
2836 else
2837 operation->mac_size = truncated;
2838
Gilles Peskinefbfac682018-07-08 20:51:54 +02002839exit:
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002840 if( status != PSA_SUCCESS )
Gilles Peskine8c9def32018-02-08 10:02:12 +01002841 {
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02002842 psa_mac_abort( operation );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002843 }
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002844 else
2845 {
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002846 operation->key_set = 1;
2847 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02002848
Ronald Cron5c522922020-11-14 16:35:34 +01002849 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02002850
Ronald Cron5c522922020-11-14 16:35:34 +01002851 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002852}
2853
Gilles Peskine89167cb2018-07-08 20:12:23 +02002854psa_status_t psa_mac_sign_setup( psa_mac_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02002855 mbedtls_svc_key_id_t key,
Gilles Peskine89167cb2018-07-08 20:12:23 +02002856 psa_algorithm_t alg )
2857{
Ronald Croncf56a0a2020-08-04 09:51:30 +02002858 return( psa_mac_setup( operation, key, alg, 1 ) );
Gilles Peskine89167cb2018-07-08 20:12:23 +02002859}
2860
2861psa_status_t psa_mac_verify_setup( psa_mac_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02002862 mbedtls_svc_key_id_t key,
Gilles Peskine89167cb2018-07-08 20:12:23 +02002863 psa_algorithm_t alg )
2864{
Ronald Croncf56a0a2020-08-04 09:51:30 +02002865 return( psa_mac_setup( operation, key, alg, 0 ) );
Gilles Peskine89167cb2018-07-08 20:12:23 +02002866}
2867
Gilles Peskine8c9def32018-02-08 10:02:12 +01002868psa_status_t psa_mac_update( psa_mac_operation_t *operation,
2869 const uint8_t *input,
2870 size_t input_length )
2871{
Gilles Peskinefbfac682018-07-08 20:51:54 +02002872 psa_status_t status = PSA_ERROR_BAD_STATE;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002873 if( ! operation->key_set )
Jaeden Ameroe236c2a2019-02-20 15:37:15 +00002874 return( PSA_ERROR_BAD_STATE );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002875 if( operation->iv_required && ! operation->iv_set )
Jaeden Ameroe236c2a2019-02-20 15:37:15 +00002876 return( PSA_ERROR_BAD_STATE );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002877 operation->has_input = 1;
2878
Gilles Peskine8c9def32018-02-08 10:02:12 +01002879#if defined(MBEDTLS_CMAC_C)
Gilles Peskinefbfac682018-07-08 20:51:54 +02002880 if( operation->alg == PSA_ALG_CMAC )
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03002881 {
Gilles Peskinefbfac682018-07-08 20:51:54 +02002882 int ret = mbedtls_cipher_cmac_update( &operation->ctx.cmac,
2883 input, input_length );
2884 status = mbedtls_to_psa_error( ret );
2885 }
2886 else
2887#endif /* MBEDTLS_CMAC_C */
John Durkopd0321952020-10-29 21:37:36 -07002888#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Gilles Peskinefbfac682018-07-08 20:51:54 +02002889 if( PSA_ALG_IS_HMAC( operation->alg ) )
2890 {
2891 status = psa_hash_update( &operation->ctx.hmac.hash_ctx, input,
2892 input_length );
2893 }
2894 else
John Durkopd0321952020-10-29 21:37:36 -07002895#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Gilles Peskinefbfac682018-07-08 20:51:54 +02002896 {
2897 /* This shouldn't happen if `operation` was initialized by
2898 * a setup function. */
Jaeden Ameroe236c2a2019-02-20 15:37:15 +00002899 return( PSA_ERROR_BAD_STATE );
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03002900 }
2901
Gilles Peskinefbfac682018-07-08 20:51:54 +02002902 if( status != PSA_SUCCESS )
2903 psa_mac_abort( operation );
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02002904 return( status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002905}
2906
John Durkop6ba40d12020-11-10 08:50:04 -08002907#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Gilles Peskine01126fa2018-07-12 17:04:55 +02002908static psa_status_t psa_hmac_finish_internal( psa_hmac_internal_data *hmac,
2909 uint8_t *mac,
2910 size_t mac_size )
2911{
Gilles Peskinec11c4dc2019-07-15 11:06:38 +02002912 uint8_t tmp[MBEDTLS_MD_MAX_SIZE];
Gilles Peskine01126fa2018-07-12 17:04:55 +02002913 psa_algorithm_t hash_alg = hmac->hash_ctx.alg;
2914 size_t hash_size = 0;
2915 size_t block_size = psa_get_hash_block_size( hash_alg );
2916 psa_status_t status;
2917
Gilles Peskine01126fa2018-07-12 17:04:55 +02002918 status = psa_hash_finish( &hmac->hash_ctx, tmp, sizeof( tmp ), &hash_size );
2919 if( status != PSA_SUCCESS )
2920 return( status );
2921 /* From here on, tmp needs to be wiped. */
2922
2923 status = psa_hash_setup( &hmac->hash_ctx, hash_alg );
2924 if( status != PSA_SUCCESS )
2925 goto exit;
2926
2927 status = psa_hash_update( &hmac->hash_ctx, hmac->opad, block_size );
2928 if( status != PSA_SUCCESS )
2929 goto exit;
2930
2931 status = psa_hash_update( &hmac->hash_ctx, tmp, hash_size );
2932 if( status != PSA_SUCCESS )
2933 goto exit;
2934
Gilles Peskined911eb72018-08-14 15:18:45 +02002935 status = psa_hash_finish( &hmac->hash_ctx, tmp, sizeof( tmp ), &hash_size );
2936 if( status != PSA_SUCCESS )
2937 goto exit;
2938
2939 memcpy( mac, tmp, mac_size );
Gilles Peskine01126fa2018-07-12 17:04:55 +02002940
2941exit:
Gilles Peskine3f108122018-12-07 18:14:53 +01002942 mbedtls_platform_zeroize( tmp, hash_size );
Gilles Peskine01126fa2018-07-12 17:04:55 +02002943 return( status );
2944}
John Durkop6ba40d12020-11-10 08:50:04 -08002945#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Gilles Peskine01126fa2018-07-12 17:04:55 +02002946
mohammad16036df908f2018-04-02 08:34:15 -07002947static psa_status_t psa_mac_finish_internal( psa_mac_operation_t *operation,
Gilles Peskine2d277862018-06-18 15:41:12 +02002948 uint8_t *mac,
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002949 size_t mac_size )
Gilles Peskine8c9def32018-02-08 10:02:12 +01002950{
Gilles Peskine1d96fff2018-07-02 12:15:39 +02002951 if( ! operation->key_set )
2952 return( PSA_ERROR_BAD_STATE );
2953 if( operation->iv_required && ! operation->iv_set )
2954 return( PSA_ERROR_BAD_STATE );
2955
Gilles Peskine8c9def32018-02-08 10:02:12 +01002956 if( mac_size < operation->mac_size )
2957 return( PSA_ERROR_BUFFER_TOO_SMALL );
2958
Gilles Peskine8c9def32018-02-08 10:02:12 +01002959#if defined(MBEDTLS_CMAC_C)
Gilles Peskinefbfac682018-07-08 20:51:54 +02002960 if( operation->alg == PSA_ALG_CMAC )
2961 {
gabor-mezei-armcbcec212020-12-18 14:23:51 +01002962 uint8_t tmp[PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE];
Gilles Peskined911eb72018-08-14 15:18:45 +02002963 int ret = mbedtls_cipher_cmac_finish( &operation->ctx.cmac, tmp );
2964 if( ret == 0 )
Gilles Peskine87b0ac42018-08-21 14:55:49 +02002965 memcpy( mac, tmp, operation->mac_size );
Gilles Peskine3f108122018-12-07 18:14:53 +01002966 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
Gilles Peskinefbfac682018-07-08 20:51:54 +02002967 return( mbedtls_to_psa_error( ret ) );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002968 }
Gilles Peskinefbfac682018-07-08 20:51:54 +02002969 else
2970#endif /* MBEDTLS_CMAC_C */
John Durkopd0321952020-10-29 21:37:36 -07002971#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Gilles Peskinefbfac682018-07-08 20:51:54 +02002972 if( PSA_ALG_IS_HMAC( operation->alg ) )
2973 {
Gilles Peskine01126fa2018-07-12 17:04:55 +02002974 return( psa_hmac_finish_internal( &operation->ctx.hmac,
Gilles Peskined911eb72018-08-14 15:18:45 +02002975 mac, operation->mac_size ) );
Gilles Peskinefbfac682018-07-08 20:51:54 +02002976 }
2977 else
John Durkopd0321952020-10-29 21:37:36 -07002978#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Gilles Peskinefbfac682018-07-08 20:51:54 +02002979 {
2980 /* This shouldn't happen if `operation` was initialized by
2981 * a setup function. */
2982 return( PSA_ERROR_BAD_STATE );
2983 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002984}
2985
Gilles Peskineacd4be32018-07-08 19:56:25 +02002986psa_status_t psa_mac_sign_finish( psa_mac_operation_t *operation,
2987 uint8_t *mac,
2988 size_t mac_size,
2989 size_t *mac_length )
mohammad16036df908f2018-04-02 08:34:15 -07002990{
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002991 psa_status_t status;
2992
Jaeden Amero252ef282019-02-15 14:05:35 +00002993 if( operation->alg == 0 )
2994 {
2995 return( PSA_ERROR_BAD_STATE );
2996 }
2997
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002998 /* Fill the output buffer with something that isn't a valid mac
2999 * (barring an attack on the mac and deliberately-crafted input),
3000 * in case the caller doesn't check the return status properly. */
3001 *mac_length = mac_size;
3002 /* If mac_size is 0 then mac may be NULL and then the
3003 * call to memset would have undefined behavior. */
3004 if( mac_size != 0 )
3005 memset( mac, '!', mac_size );
3006
Gilles Peskine89167cb2018-07-08 20:12:23 +02003007 if( ! operation->is_sign )
3008 {
Jaeden Ameroe236c2a2019-02-20 15:37:15 +00003009 return( PSA_ERROR_BAD_STATE );
Gilles Peskine89167cb2018-07-08 20:12:23 +02003010 }
mohammad16036df908f2018-04-02 08:34:15 -07003011
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003012 status = psa_mac_finish_internal( operation, mac, mac_size );
3013
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003014 if( status == PSA_SUCCESS )
3015 {
3016 status = psa_mac_abort( operation );
3017 if( status == PSA_SUCCESS )
3018 *mac_length = operation->mac_size;
3019 else
3020 memset( mac, '!', mac_size );
3021 }
3022 else
3023 psa_mac_abort( operation );
3024 return( status );
mohammad16036df908f2018-04-02 08:34:15 -07003025}
3026
Gilles Peskineacd4be32018-07-08 19:56:25 +02003027psa_status_t psa_mac_verify_finish( psa_mac_operation_t *operation,
3028 const uint8_t *mac,
3029 size_t mac_length )
Gilles Peskine8c9def32018-02-08 10:02:12 +01003030{
Gilles Peskine828ed142018-06-18 23:25:51 +02003031 uint8_t actual_mac[PSA_MAC_MAX_SIZE];
mohammad16036df908f2018-04-02 08:34:15 -07003032 psa_status_t status;
3033
Jaeden Amero252ef282019-02-15 14:05:35 +00003034 if( operation->alg == 0 )
3035 {
3036 return( PSA_ERROR_BAD_STATE );
3037 }
3038
Gilles Peskine89167cb2018-07-08 20:12:23 +02003039 if( operation->is_sign )
3040 {
Jaeden Ameroe236c2a2019-02-20 15:37:15 +00003041 return( PSA_ERROR_BAD_STATE );
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003042 }
3043 if( operation->mac_size != mac_length )
3044 {
3045 status = PSA_ERROR_INVALID_SIGNATURE;
3046 goto cleanup;
Gilles Peskine89167cb2018-07-08 20:12:23 +02003047 }
mohammad16036df908f2018-04-02 08:34:15 -07003048
3049 status = psa_mac_finish_internal( operation,
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003050 actual_mac, sizeof( actual_mac ) );
Gilles Peskine28cd4162020-01-20 16:31:06 +01003051 if( status != PSA_SUCCESS )
3052 goto cleanup;
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003053
3054 if( safer_memcmp( mac, actual_mac, mac_length ) != 0 )
3055 status = PSA_ERROR_INVALID_SIGNATURE;
3056
3057cleanup:
3058 if( status == PSA_SUCCESS )
3059 status = psa_mac_abort( operation );
3060 else
3061 psa_mac_abort( operation );
3062
Gilles Peskine3f108122018-12-07 18:14:53 +01003063 mbedtls_platform_zeroize( actual_mac, sizeof( actual_mac ) );
Gilles Peskined911eb72018-08-14 15:18:45 +02003064
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003065 return( status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003066}
3067
3068
Gilles Peskine20035e32018-02-03 22:44:14 +01003069
Gilles Peskine20035e32018-02-03 22:44:14 +01003070/****************************************************************/
3071/* Asymmetric cryptography */
3072/****************************************************************/
3073
Ronald Cron67b1eb32020-12-08 17:37:27 +01003074psa_status_t psa_sign_hash_internal(
Ronald Cron18659932020-12-08 16:32:23 +01003075 const psa_key_attributes_t *attributes,
3076 const uint8_t *key_buffer, size_t key_buffer_size,
3077 psa_algorithm_t alg, const uint8_t *hash, size_t hash_length,
3078 uint8_t *signature, size_t signature_size, size_t *signature_length )
Gilles Peskine20035e32018-02-03 22:44:14 +01003079{
John Durkop6ba40d12020-11-10 08:50:04 -08003080#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
3081 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
Ronald Cron99b8ed72021-02-17 10:33:32 +01003082 if( attributes->core.type == PSA_KEY_TYPE_RSA_KEY_PAIR )
Gilles Peskine20035e32018-02-03 22:44:14 +01003083 {
Ronald Cron7bdbca32020-12-09 13:34:54 +01003084 return( mbedtls_psa_rsa_sign_hash(
3085 attributes,
3086 key_buffer, key_buffer_size,
3087 alg, hash, hash_length,
3088 signature, signature_size, signature_length ) );
Gilles Peskine20035e32018-02-03 22:44:14 +01003089 }
3090 else
John Durkop6ba40d12020-11-10 08:50:04 -08003091#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
3092 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
Ronald Cron99b8ed72021-02-17 10:33:32 +01003093 if( PSA_KEY_TYPE_IS_ECC( attributes->core.type ) )
Gilles Peskine20035e32018-02-03 22:44:14 +01003094 {
John Durkop9814fa22020-11-04 12:28:15 -08003095#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3096 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
Gilles Peskinea05219c2018-11-16 16:02:56 +01003097 if(
John Durkop0ea39e02020-10-13 19:58:20 -07003098#if defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
Gilles Peskinea05219c2018-11-16 16:02:56 +01003099 PSA_ALG_IS_ECDSA( alg )
3100#else
3101 PSA_ALG_IS_RANDOMIZED_ECDSA( alg )
3102#endif
3103 )
Steven Cooremanacda8342020-07-24 23:09:52 +02003104 {
Ronald Cron072722c2020-12-09 16:36:19 +01003105 return( mbedtls_psa_ecdsa_sign_hash(
3106 attributes,
3107 key_buffer, key_buffer_size,
3108 alg, hash, hash_length,
3109 signature, signature_size, signature_length ) );
Steven Cooremanacda8342020-07-24 23:09:52 +02003110 }
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003111 else
John Durkop9814fa22020-11-04 12:28:15 -08003112#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3113 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003114 {
Ronald Cron8a494f32021-02-17 09:49:51 +01003115 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003116 }
itayzafrir5c753392018-05-08 11:18:38 +03003117 }
3118 else
itayzafrir5c753392018-05-08 11:18:38 +03003119 {
Ronald Cron8a494f32021-02-17 09:49:51 +01003120 (void)key_buffer;
3121 (void)key_buffer_size;
3122 (void)alg;
3123 (void)hash;
3124 (void)hash_length;
3125 (void)signature;
3126 (void)signature_size;
3127 (void)signature_length;
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003128
Ronald Cron8a494f32021-02-17 09:49:51 +01003129 return( PSA_ERROR_NOT_SUPPORTED );
3130 }
Ronald Cron18659932020-12-08 16:32:23 +01003131}
3132
3133psa_status_t psa_sign_hash( mbedtls_svc_key_id_t key,
3134 psa_algorithm_t alg,
3135 const uint8_t *hash,
3136 size_t hash_length,
3137 uint8_t *signature,
3138 size_t signature_size,
3139 size_t *signature_length )
3140{
3141 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3142 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
3143 psa_key_slot_t *slot;
3144
3145 *signature_length = signature_size;
3146 /* Immediately reject a zero-length signature buffer. This guarantees
3147 * that signature must be a valid pointer. (On the other hand, the hash
3148 * buffer can in principle be empty since it doesn't actually have
3149 * to be a hash.) */
3150 if( signature_size == 0 )
3151 return( PSA_ERROR_BUFFER_TOO_SMALL );
3152
3153 status = psa_get_and_lock_key_slot_with_policy( key, &slot,
3154 PSA_KEY_USAGE_SIGN_HASH,
3155 alg );
3156 if( status != PSA_SUCCESS )
3157 goto exit;
3158 if( ! PSA_KEY_TYPE_IS_KEY_PAIR( slot->attr.type ) )
3159 {
3160 status = PSA_ERROR_INVALID_ARGUMENT;
3161 goto exit;
3162 }
3163
Ronald Cron9f17aa42020-12-08 17:07:25 +01003164 psa_key_attributes_t attributes = {
3165 .core = slot->attr
3166 };
3167
Ronald Cron18659932020-12-08 16:32:23 +01003168 /* Try any of the available accelerators first */
Ronald Cron9f17aa42020-12-08 17:07:25 +01003169 status = psa_driver_wrapper_sign_hash(
3170 &attributes, slot->key.data, slot->key.bytes,
3171 alg, hash, hash_length,
3172 signature, signature_size, signature_length );
3173
Ronald Cron18659932020-12-08 16:32:23 +01003174exit:
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003175 /* Fill the unused part of the output buffer (the whole buffer on error,
3176 * the trailing part on success) with something that isn't a valid mac
3177 * (barring an attack on the mac and deliberately-crafted input),
3178 * in case the caller doesn't check the return status properly. */
3179 if( status == PSA_SUCCESS )
3180 memset( signature + *signature_length, '!',
3181 signature_size - *signature_length );
Gilles Peskine4019f0e2019-09-12 22:05:59 +02003182 else
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003183 memset( signature, '!', signature_size );
Gilles Peskine46f1fd72018-06-28 19:31:31 +02003184 /* If signature_size is 0 then we have nothing to do. We must not call
3185 * memset because signature may be NULL in this case. */
Ronald Cronf95a2b12020-10-22 15:24:49 +02003186
Ronald Cron5c522922020-11-14 16:35:34 +01003187 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02003188
Ronald Cron5c522922020-11-14 16:35:34 +01003189 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
itayzafrir5c753392018-05-08 11:18:38 +03003190}
3191
Ronald Cron67b1eb32020-12-08 17:37:27 +01003192psa_status_t psa_verify_hash_internal(
Ronald Cron18659932020-12-08 16:32:23 +01003193 const psa_key_attributes_t *attributes,
3194 const uint8_t *key_buffer, size_t key_buffer_size,
3195 psa_algorithm_t alg, const uint8_t *hash, size_t hash_length,
3196 const uint8_t *signature, size_t signature_length )
itayzafrir5c753392018-05-08 11:18:38 +03003197{
John Durkop6ba40d12020-11-10 08:50:04 -08003198#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
3199 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
Ronald Cron99b8ed72021-02-17 10:33:32 +01003200 if( PSA_KEY_TYPE_IS_RSA( attributes->core.type ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003201 {
Ronald Cron7bdbca32020-12-09 13:34:54 +01003202 return( mbedtls_psa_rsa_verify_hash(
3203 attributes,
3204 key_buffer, key_buffer_size,
3205 alg, hash, hash_length,
3206 signature, signature_length ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003207 }
3208 else
John Durkop6ba40d12020-11-10 08:50:04 -08003209#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
3210 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
Ronald Cron99b8ed72021-02-17 10:33:32 +01003211 if( PSA_KEY_TYPE_IS_ECC( attributes->core.type ) )
itayzafrir5c753392018-05-08 11:18:38 +03003212 {
John Durkop9814fa22020-11-04 12:28:15 -08003213#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3214 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003215 if( PSA_ALG_IS_ECDSA( alg ) )
Steven Cooremanacda8342020-07-24 23:09:52 +02003216 {
Ronald Cron072722c2020-12-09 16:36:19 +01003217 return( mbedtls_psa_ecdsa_verify_hash(
3218 attributes,
3219 key_buffer, key_buffer_size,
3220 alg, hash, hash_length,
3221 signature, signature_length ) );
Steven Cooremanacda8342020-07-24 23:09:52 +02003222 }
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003223 else
John Durkop9814fa22020-11-04 12:28:15 -08003224#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3225 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003226 {
Ronald Cron8a494f32021-02-17 09:49:51 +01003227 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003228 }
itayzafrir5c753392018-05-08 11:18:38 +03003229 }
Gilles Peskine20035e32018-02-03 22:44:14 +01003230 else
Gilles Peskine20035e32018-02-03 22:44:14 +01003231 {
Ronald Cron8a494f32021-02-17 09:49:51 +01003232 (void)key_buffer;
3233 (void)key_buffer_size;
3234 (void)alg;
3235 (void)hash;
3236 (void)hash_length;
3237 (void)signature;
3238 (void)signature_length;
Ronald Cronf95a2b12020-10-22 15:24:49 +02003239
Ronald Cron8a494f32021-02-17 09:49:51 +01003240 return( PSA_ERROR_NOT_SUPPORTED );
3241 }
Ronald Cron18659932020-12-08 16:32:23 +01003242}
3243
3244psa_status_t psa_verify_hash( mbedtls_svc_key_id_t key,
3245 psa_algorithm_t alg,
3246 const uint8_t *hash,
3247 size_t hash_length,
3248 const uint8_t *signature,
3249 size_t signature_length )
3250{
3251 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3252 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
3253 psa_key_slot_t *slot;
3254
3255 status = psa_get_and_lock_key_slot_with_policy( key, &slot,
3256 PSA_KEY_USAGE_VERIFY_HASH,
3257 alg );
3258 if( status != PSA_SUCCESS )
3259 return( status );
3260
Ronald Cron9f17aa42020-12-08 17:07:25 +01003261 psa_key_attributes_t attributes = {
3262 .core = slot->attr
3263 };
3264
Ronald Cron18659932020-12-08 16:32:23 +01003265 /* Try any of the available accelerators first */
Ronald Cron9f17aa42020-12-08 17:07:25 +01003266 status = psa_driver_wrapper_verify_hash(
3267 &attributes, slot->key.data, slot->key.bytes,
3268 alg, hash, hash_length,
3269 signature, signature_length );
3270
Ronald Cron5c522922020-11-14 16:35:34 +01003271 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02003272
Ronald Cron5c522922020-11-14 16:35:34 +01003273 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskine20035e32018-02-03 22:44:14 +01003274}
3275
John Durkop0e005192020-10-31 22:06:54 -07003276#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
Gilles Peskine072ac562018-06-30 00:21:29 +02003277static void psa_rsa_oaep_set_padding_mode( psa_algorithm_t alg,
3278 mbedtls_rsa_context *rsa )
3279{
3280 psa_algorithm_t hash_alg = PSA_ALG_RSA_OAEP_GET_HASH( alg );
3281 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
3282 mbedtls_md_type_t md_alg = mbedtls_md_get_type( md_info );
3283 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
3284}
John Durkop0e005192020-10-31 22:06:54 -07003285#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */
Gilles Peskine072ac562018-06-30 00:21:29 +02003286
Ronald Croncf56a0a2020-08-04 09:51:30 +02003287psa_status_t psa_asymmetric_encrypt( mbedtls_svc_key_id_t key,
Gilles Peskine61b91d42018-06-08 16:09:36 +02003288 psa_algorithm_t alg,
3289 const uint8_t *input,
3290 size_t input_length,
3291 const uint8_t *salt,
3292 size_t salt_length,
3293 uint8_t *output,
3294 size_t output_size,
3295 size_t *output_length )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003296{
Ronald Cronf95a2b12020-10-22 15:24:49 +02003297 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01003298 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01003299 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003300
Darryl Green5cc689a2018-07-24 15:34:10 +01003301 (void) input;
3302 (void) input_length;
3303 (void) salt;
3304 (void) output;
3305 (void) output_size;
3306
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03003307 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003308
Gilles Peskineb3fc05d2018-06-30 19:04:35 +02003309 if( ! PSA_ALG_IS_RSA_OAEP( alg ) && salt_length != 0 )
3310 return( PSA_ERROR_INVALID_ARGUMENT );
3311
Ronald Cron5c522922020-11-14 16:35:34 +01003312 status = psa_get_and_lock_transparent_key_slot_with_policy(
3313 key, &slot, PSA_KEY_USAGE_ENCRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003314 if( status != PSA_SUCCESS )
3315 return( status );
Gilles Peskine8e338702019-07-30 20:06:31 +02003316 if( ! ( PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->attr.type ) ||
3317 PSA_KEY_TYPE_IS_KEY_PAIR( slot->attr.type ) ) )
Ronald Cronf95a2b12020-10-22 15:24:49 +02003318 {
3319 status = PSA_ERROR_INVALID_ARGUMENT;
3320 goto exit;
3321 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003322
John Durkop6ba40d12020-11-10 08:50:04 -08003323#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \
3324 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
Gilles Peskine8e338702019-07-30 20:06:31 +02003325 if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003326 {
Steven Cooremana2371e52020-07-28 14:30:39 +02003327 mbedtls_rsa_context *rsa = NULL;
Ronald Cron90857082020-11-25 14:58:33 +01003328 status = mbedtls_psa_rsa_load_representation( slot->attr.type,
3329 slot->key.data,
3330 slot->key.bytes,
3331 &rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02003332 if( status != PSA_SUCCESS )
Steven Cooreman4fed4552020-08-03 14:46:03 +02003333 goto rsa_exit;
Steven Cooremana2371e52020-07-28 14:30:39 +02003334
3335 if( output_size < mbedtls_rsa_get_len( rsa ) )
Steven Cooremana01795d2020-07-24 22:48:15 +02003336 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02003337 status = PSA_ERROR_BUFFER_TOO_SMALL;
3338 goto rsa_exit;
Steven Cooremana01795d2020-07-24 22:48:15 +02003339 }
John Durkop0e005192020-10-31 22:06:54 -07003340#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT)
Gilles Peskine6afe7892018-05-31 13:16:08 +02003341 if( alg == PSA_ALG_RSA_PKCS1V15_CRYPT )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003342 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02003343 status = mbedtls_to_psa_error(
3344 mbedtls_rsa_pkcs1_encrypt( rsa,
Gilles Peskine30524eb2020-11-13 17:02:26 +01003345 mbedtls_psa_get_random,
Gilles Peskine5894e8e2020-12-14 14:54:06 +01003346 MBEDTLS_PSA_RANDOM_STATE,
Steven Cooreman4fed4552020-08-03 14:46:03 +02003347 MBEDTLS_RSA_PUBLIC,
3348 input_length,
3349 input,
3350 output ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003351 }
3352 else
John Durkop0e005192020-10-31 22:06:54 -07003353#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT */
3354#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
Gilles Peskine55bf3d12018-06-26 15:53:48 +02003355 if( PSA_ALG_IS_RSA_OAEP( alg ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003356 {
Steven Cooremana2371e52020-07-28 14:30:39 +02003357 psa_rsa_oaep_set_padding_mode( alg, rsa );
Steven Cooreman4fed4552020-08-03 14:46:03 +02003358 status = mbedtls_to_psa_error(
3359 mbedtls_rsa_rsaes_oaep_encrypt( rsa,
Gilles Peskine30524eb2020-11-13 17:02:26 +01003360 mbedtls_psa_get_random,
Gilles Peskine5894e8e2020-12-14 14:54:06 +01003361 MBEDTLS_PSA_RANDOM_STATE,
Steven Cooreman4fed4552020-08-03 14:46:03 +02003362 MBEDTLS_RSA_PUBLIC,
3363 salt, salt_length,
3364 input_length,
3365 input,
3366 output ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003367 }
3368 else
John Durkop0e005192020-10-31 22:06:54 -07003369#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP */
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003370 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02003371 status = PSA_ERROR_INVALID_ARGUMENT;
3372 goto rsa_exit;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003373 }
Steven Cooreman4fed4552020-08-03 14:46:03 +02003374rsa_exit:
3375 if( status == PSA_SUCCESS )
Steven Cooremana2371e52020-07-28 14:30:39 +02003376 *output_length = mbedtls_rsa_get_len( rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02003377
Steven Cooremana2371e52020-07-28 14:30:39 +02003378 mbedtls_rsa_free( rsa );
3379 mbedtls_free( rsa );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003380 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003381 else
John Durkop9814fa22020-11-04 12:28:15 -08003382#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) ||
John Durkop6ba40d12020-11-10 08:50:04 -08003383 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003384 {
Ronald Cronf95a2b12020-10-22 15:24:49 +02003385 status = PSA_ERROR_NOT_SUPPORTED;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003386 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02003387
3388exit:
Ronald Cron5c522922020-11-14 16:35:34 +01003389 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02003390
Ronald Cron5c522922020-11-14 16:35:34 +01003391 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskine5b051bc2018-05-31 13:25:48 +02003392}
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003393
Ronald Croncf56a0a2020-08-04 09:51:30 +02003394psa_status_t psa_asymmetric_decrypt( mbedtls_svc_key_id_t key,
Gilles Peskine61b91d42018-06-08 16:09:36 +02003395 psa_algorithm_t alg,
3396 const uint8_t *input,
3397 size_t input_length,
3398 const uint8_t *salt,
3399 size_t salt_length,
3400 uint8_t *output,
3401 size_t output_size,
3402 size_t *output_length )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003403{
Ronald Cronf95a2b12020-10-22 15:24:49 +02003404 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01003405 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01003406 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003407
Darryl Green5cc689a2018-07-24 15:34:10 +01003408 (void) input;
3409 (void) input_length;
3410 (void) salt;
3411 (void) output;
3412 (void) output_size;
3413
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03003414 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003415
Gilles Peskineb3fc05d2018-06-30 19:04:35 +02003416 if( ! PSA_ALG_IS_RSA_OAEP( alg ) && salt_length != 0 )
3417 return( PSA_ERROR_INVALID_ARGUMENT );
3418
Ronald Cron5c522922020-11-14 16:35:34 +01003419 status = psa_get_and_lock_transparent_key_slot_with_policy(
3420 key, &slot, PSA_KEY_USAGE_DECRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003421 if( status != PSA_SUCCESS )
3422 return( status );
Gilles Peskine8e338702019-07-30 20:06:31 +02003423 if( ! PSA_KEY_TYPE_IS_KEY_PAIR( slot->attr.type ) )
Ronald Cronf95a2b12020-10-22 15:24:49 +02003424 {
3425 status = PSA_ERROR_INVALID_ARGUMENT;
3426 goto exit;
3427 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003428
John Durkop6ba40d12020-11-10 08:50:04 -08003429#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \
3430 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
Gilles Peskine8e338702019-07-30 20:06:31 +02003431 if( slot->attr.type == PSA_KEY_TYPE_RSA_KEY_PAIR )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003432 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02003433 mbedtls_rsa_context *rsa = NULL;
Ronald Cron90857082020-11-25 14:58:33 +01003434 status = mbedtls_psa_rsa_load_representation( slot->attr.type,
3435 slot->key.data,
3436 slot->key.bytes,
3437 &rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02003438 if( status != PSA_SUCCESS )
Ronald Cronf95a2b12020-10-22 15:24:49 +02003439 goto exit;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003440
Steven Cooremana2371e52020-07-28 14:30:39 +02003441 if( input_length != mbedtls_rsa_get_len( rsa ) )
Steven Cooremana01795d2020-07-24 22:48:15 +02003442 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02003443 status = PSA_ERROR_INVALID_ARGUMENT;
3444 goto rsa_exit;
Steven Cooremana01795d2020-07-24 22:48:15 +02003445 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003446
John Durkop0e005192020-10-31 22:06:54 -07003447#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT)
Gilles Peskine6afe7892018-05-31 13:16:08 +02003448 if( alg == PSA_ALG_RSA_PKCS1V15_CRYPT )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003449 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02003450 status = mbedtls_to_psa_error(
3451 mbedtls_rsa_pkcs1_decrypt( rsa,
Gilles Peskine30524eb2020-11-13 17:02:26 +01003452 mbedtls_psa_get_random,
Gilles Peskine5894e8e2020-12-14 14:54:06 +01003453 MBEDTLS_PSA_RANDOM_STATE,
Steven Cooreman4fed4552020-08-03 14:46:03 +02003454 MBEDTLS_RSA_PRIVATE,
3455 output_length,
3456 input,
3457 output,
3458 output_size ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003459 }
3460 else
John Durkop0e005192020-10-31 22:06:54 -07003461#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT */
3462#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
Gilles Peskine55bf3d12018-06-26 15:53:48 +02003463 if( PSA_ALG_IS_RSA_OAEP( alg ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003464 {
Steven Cooremana2371e52020-07-28 14:30:39 +02003465 psa_rsa_oaep_set_padding_mode( alg, rsa );
Steven Cooreman4fed4552020-08-03 14:46:03 +02003466 status = mbedtls_to_psa_error(
3467 mbedtls_rsa_rsaes_oaep_decrypt( rsa,
Gilles Peskine30524eb2020-11-13 17:02:26 +01003468 mbedtls_psa_get_random,
Gilles Peskine5894e8e2020-12-14 14:54:06 +01003469 MBEDTLS_PSA_RANDOM_STATE,
Steven Cooreman4fed4552020-08-03 14:46:03 +02003470 MBEDTLS_RSA_PRIVATE,
3471 salt, salt_length,
3472 output_length,
3473 input,
3474 output,
3475 output_size ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003476 }
3477 else
John Durkop0e005192020-10-31 22:06:54 -07003478#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP */
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003479 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02003480 status = PSA_ERROR_INVALID_ARGUMENT;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003481 }
Nir Sonnenschein717a0402018-06-04 16:36:15 +03003482
Steven Cooreman4fed4552020-08-03 14:46:03 +02003483rsa_exit:
Steven Cooremana2371e52020-07-28 14:30:39 +02003484 mbedtls_rsa_free( rsa );
3485 mbedtls_free( rsa );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003486 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003487 else
John Durkop6ba40d12020-11-10 08:50:04 -08003488#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) ||
3489 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003490 {
Ronald Cronf95a2b12020-10-22 15:24:49 +02003491 status = PSA_ERROR_NOT_SUPPORTED;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003492 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02003493
3494exit:
Ronald Cron5c522922020-11-14 16:35:34 +01003495 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02003496
Ronald Cron5c522922020-11-14 16:35:34 +01003497 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskine5b051bc2018-05-31 13:25:48 +02003498}
Gilles Peskine20035e32018-02-03 22:44:14 +01003499
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02003500
3501
mohammad1603503973b2018-03-12 15:59:30 +02003502/****************************************************************/
3503/* Symmetric cryptography */
3504/****************************************************************/
3505
Gilles Peskinee553c652018-06-04 16:22:46 +02003506static psa_status_t psa_cipher_setup( psa_cipher_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02003507 mbedtls_svc_key_id_t key,
Gilles Peskine7e928852018-06-04 16:23:10 +02003508 psa_algorithm_t alg,
3509 mbedtls_operation_t cipher_operation )
mohammad1603503973b2018-03-12 15:59:30 +02003510{
Ronald Cronf95a2b12020-10-22 15:24:49 +02003511 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01003512 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine9ab61b62019-02-25 17:43:14 +01003513 int ret = 0;
Gilles Peskine2f060a82018-12-04 17:12:32 +01003514 psa_key_slot_t *slot;
mohammad1603503973b2018-03-12 15:59:30 +02003515 size_t key_bits;
3516 const mbedtls_cipher_info_t *cipher_info = NULL;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003517 psa_key_usage_t usage = ( cipher_operation == MBEDTLS_ENCRYPT ?
3518 PSA_KEY_USAGE_ENCRYPT :
3519 PSA_KEY_USAGE_DECRYPT );
mohammad1603503973b2018-03-12 15:59:30 +02003520
Steven Cooremand3feccd2020-09-01 15:56:14 +02003521 /* A context must be freshly initialized before it can be set up. */
3522 if( operation->alg != 0 )
3523 return( PSA_ERROR_BAD_STATE );
3524
Steven Cooremana07b9972020-09-10 14:54:14 +02003525 /* The requested algorithm must be one that can be processed by cipher. */
3526 if( ! PSA_ALG_IS_CIPHER( alg ) )
Steven Cooremana07b9972020-09-10 14:54:14 +02003527 return( PSA_ERROR_INVALID_ARGUMENT );
Steven Cooremand3feccd2020-09-01 15:56:14 +02003528
Steven Cooremanef8575e2020-09-11 11:44:50 +02003529 /* Fetch key material from key storage. */
Ronald Cron5c522922020-11-14 16:35:34 +01003530 status = psa_get_and_lock_key_slot_with_policy( key, &slot, usage, alg );
Steven Cooremanef8575e2020-09-11 11:44:50 +02003531 if( status != PSA_SUCCESS )
3532 goto exit;
3533
3534 /* Initialize the operation struct members, except for alg. The alg member
3535 * is used to indicate to psa_cipher_abort that there are resources to free,
3536 * so we only set it after resources have been allocated/initialized. */
Steven Cooremana07b9972020-09-10 14:54:14 +02003537 operation->key_set = 0;
3538 operation->iv_set = 0;
Steven Cooremanef8575e2020-09-11 11:44:50 +02003539 operation->mbedtls_in_use = 0;
Steven Cooremana07b9972020-09-10 14:54:14 +02003540 operation->iv_size = 0;
3541 operation->block_size = 0;
3542 if( alg == PSA_ALG_ECB_NO_PADDING )
3543 operation->iv_required = 0;
3544 else
3545 operation->iv_required = 1;
3546
Steven Cooremana07b9972020-09-10 14:54:14 +02003547 /* Try doing the operation through a driver before using software fallback. */
Steven Cooreman37941cb2020-07-28 18:49:51 +02003548 if( cipher_operation == MBEDTLS_ENCRYPT )
Steven Cooremanfb81aa52020-09-09 12:01:43 +02003549 status = psa_driver_wrapper_cipher_encrypt_setup( &operation->ctx.driver,
Steven Cooreman37941cb2020-07-28 18:49:51 +02003550 slot,
3551 alg );
3552 else
Steven Cooremanfb81aa52020-09-09 12:01:43 +02003553 status = psa_driver_wrapper_cipher_decrypt_setup( &operation->ctx.driver,
Steven Cooreman37941cb2020-07-28 18:49:51 +02003554 slot,
3555 alg );
3556
Steven Cooremanef8575e2020-09-11 11:44:50 +02003557 if( status == PSA_SUCCESS )
Steven Cooreman6d81f7e2020-09-14 13:14:31 +02003558 {
Steven Cooremanef8575e2020-09-11 11:44:50 +02003559 /* Once the driver context is initialised, it needs to be freed using
3560 * psa_cipher_abort. Indicate this through setting alg. */
3561 operation->alg = alg;
Steven Cooreman6d81f7e2020-09-14 13:14:31 +02003562 }
Steven Cooremanef8575e2020-09-11 11:44:50 +02003563
Steven Cooremand3feccd2020-09-01 15:56:14 +02003564 if( status != PSA_ERROR_NOT_SUPPORTED ||
3565 psa_key_lifetime_is_external( slot->attr.lifetime ) )
3566 goto exit;
3567
Steven Cooremana07b9972020-09-10 14:54:14 +02003568 /* Proceed with initializing an mbed TLS cipher context if no driver is
Steven Cooremand3feccd2020-09-01 15:56:14 +02003569 * available for the given algorithm & key. */
3570 mbedtls_cipher_init( &operation->ctx.cipher );
mohammad1603503973b2018-03-12 15:59:30 +02003571
Steven Cooremana07b9972020-09-10 14:54:14 +02003572 /* Once the cipher context is initialised, it needs to be freed using
Steven Cooremanef8575e2020-09-11 11:44:50 +02003573 * psa_cipher_abort. Indicate there is something to be freed through setting
3574 * alg, and indicate the operation is being done using mbedtls crypto through
3575 * setting mbedtls_in_use. */
Steven Cooremana07b9972020-09-10 14:54:14 +02003576 operation->alg = alg;
Steven Cooremanef8575e2020-09-11 11:44:50 +02003577 operation->mbedtls_in_use = 1;
Steven Cooremana07b9972020-09-10 14:54:14 +02003578
Gilles Peskinedb4b3ab2019-04-18 12:53:01 +02003579 key_bits = psa_get_key_slot_bits( slot );
Gilles Peskine8e338702019-07-30 20:06:31 +02003580 cipher_info = mbedtls_cipher_info_from_psa( alg, slot->attr.type, key_bits, NULL );
mohammad1603503973b2018-03-12 15:59:30 +02003581 if( cipher_info == NULL )
Gilles Peskine9ab61b62019-02-25 17:43:14 +01003582 {
3583 status = PSA_ERROR_NOT_SUPPORTED;
3584 goto exit;
3585 }
mohammad1603503973b2018-03-12 15:59:30 +02003586
mohammad1603503973b2018-03-12 15:59:30 +02003587 ret = mbedtls_cipher_setup( &operation->ctx.cipher, cipher_info );
Moran Peker41deec42018-04-04 15:43:05 +03003588 if( ret != 0 )
Gilles Peskine9ab61b62019-02-25 17:43:14 +01003589 goto exit;
mohammad1603503973b2018-03-12 15:59:30 +02003590
Gilles Peskine9ad29e22018-06-21 09:40:04 +02003591#if defined(MBEDTLS_DES_C)
Gilles Peskine8e338702019-07-30 20:06:31 +02003592 if( slot->attr.type == PSA_KEY_TYPE_DES && key_bits == 128 )
Gilles Peskine9ad29e22018-06-21 09:40:04 +02003593 {
3594 /* Two-key Triple-DES is 3-key Triple-DES with K1=K3 */
Gilles Peskinec11c4dc2019-07-15 11:06:38 +02003595 uint8_t keys[24];
Ronald Cronea0f8a62020-11-25 17:52:23 +01003596 memcpy( keys, slot->key.data, 16 );
3597 memcpy( keys + 16, slot->key.data, 8 );
Gilles Peskine9ad29e22018-06-21 09:40:04 +02003598 ret = mbedtls_cipher_setkey( &operation->ctx.cipher,
3599 keys,
3600 192, cipher_operation );
3601 }
3602 else
3603#endif
3604 {
3605 ret = mbedtls_cipher_setkey( &operation->ctx.cipher,
Ronald Cronea0f8a62020-11-25 17:52:23 +01003606 slot->key.data,
Jaeden Amero23bbb752018-06-26 14:16:54 +01003607 (int) key_bits, cipher_operation );
Gilles Peskine9ad29e22018-06-21 09:40:04 +02003608 }
Moran Peker41deec42018-04-04 15:43:05 +03003609 if( ret != 0 )
Gilles Peskine9ab61b62019-02-25 17:43:14 +01003610 goto exit;
mohammad1603503973b2018-03-12 15:59:30 +02003611
mohammad16038481e742018-03-18 13:57:31 +02003612#if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING)
Gilles Peskinedaea26f2018-08-21 14:02:45 +02003613 switch( alg )
mohammad16038481e742018-03-18 13:57:31 +02003614 {
Gilles Peskinedaea26f2018-08-21 14:02:45 +02003615 case PSA_ALG_CBC_NO_PADDING:
3616 ret = mbedtls_cipher_set_padding_mode( &operation->ctx.cipher,
3617 MBEDTLS_PADDING_NONE );
3618 break;
3619 case PSA_ALG_CBC_PKCS7:
3620 ret = mbedtls_cipher_set_padding_mode( &operation->ctx.cipher,
3621 MBEDTLS_PADDING_PKCS7 );
3622 break;
3623 default:
3624 /* The algorithm doesn't involve padding. */
3625 ret = 0;
3626 break;
3627 }
3628 if( ret != 0 )
Gilles Peskine9ab61b62019-02-25 17:43:14 +01003629 goto exit;
mohammad16038481e742018-03-18 13:57:31 +02003630#endif //MBEDTLS_CIPHER_MODE_WITH_PADDING
3631
Gilles Peskinedaea26f2018-08-21 14:02:45 +02003632 operation->block_size = ( PSA_ALG_IS_STREAM_CIPHER( alg ) ? 1 :
gabor-mezei-armcbcec212020-12-18 14:23:51 +01003633 PSA_BLOCK_CIPHER_BLOCK_LENGTH( slot->attr.type ) );
Steven Cooremana6033e92020-08-25 11:47:50 +02003634 if( ( alg & PSA_ALG_CIPHER_FROM_BLOCK_FLAG ) != 0 &&
3635 alg != PSA_ALG_ECB_NO_PADDING )
mohammad16038481e742018-03-18 13:57:31 +02003636 {
gabor-mezei-armcbcec212020-12-18 14:23:51 +01003637 operation->iv_size = PSA_BLOCK_CIPHER_BLOCK_LENGTH( slot->attr.type );
mohammad16038481e742018-03-18 13:57:31 +02003638 }
Gilles Peskine26869f22019-05-06 15:25:00 +02003639#if defined(MBEDTLS_CHACHA20_C)
3640 else
Bence Szépkúticbe39532020-12-08 00:01:31 +01003641 if( alg == PSA_ALG_STREAM_CIPHER && slot->attr.type == PSA_KEY_TYPE_CHACHA20 )
Gilles Peskine26869f22019-05-06 15:25:00 +02003642 operation->iv_size = 12;
3643#endif
mohammad1603503973b2018-03-12 15:59:30 +02003644
Steven Cooreman7df02922020-09-09 15:28:49 +02003645 status = PSA_SUCCESS;
3646
Gilles Peskine9ab61b62019-02-25 17:43:14 +01003647exit:
Steven Cooreman7df02922020-09-09 15:28:49 +02003648 if( ret != 0 )
Gilles Peskine9ab61b62019-02-25 17:43:14 +01003649 status = mbedtls_to_psa_error( ret );
Steven Cooreman7df02922020-09-09 15:28:49 +02003650 if( status == PSA_SUCCESS )
3651 {
3652 /* Update operation flags for both driver and software implementations */
3653 operation->key_set = 1;
3654 }
3655 else
Gilles Peskine9ab61b62019-02-25 17:43:14 +01003656 psa_cipher_abort( operation );
Ronald Cronf95a2b12020-10-22 15:24:49 +02003657
Ronald Cron5c522922020-11-14 16:35:34 +01003658 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02003659
Ronald Cron5c522922020-11-14 16:35:34 +01003660 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
mohammad1603503973b2018-03-12 15:59:30 +02003661}
3662
Gilles Peskinefe119512018-07-08 21:39:34 +02003663psa_status_t psa_cipher_encrypt_setup( psa_cipher_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02003664 mbedtls_svc_key_id_t key,
Gilles Peskinefe119512018-07-08 21:39:34 +02003665 psa_algorithm_t alg )
mohammad16038481e742018-03-18 13:57:31 +02003666{
Ronald Croncf56a0a2020-08-04 09:51:30 +02003667 return( psa_cipher_setup( operation, key, alg, MBEDTLS_ENCRYPT ) );
mohammad16038481e742018-03-18 13:57:31 +02003668}
3669
Gilles Peskinefe119512018-07-08 21:39:34 +02003670psa_status_t psa_cipher_decrypt_setup( psa_cipher_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02003671 mbedtls_svc_key_id_t key,
Gilles Peskinefe119512018-07-08 21:39:34 +02003672 psa_algorithm_t alg )
mohammad16038481e742018-03-18 13:57:31 +02003673{
Ronald Croncf56a0a2020-08-04 09:51:30 +02003674 return( psa_cipher_setup( operation, key, alg, MBEDTLS_DECRYPT ) );
mohammad16038481e742018-03-18 13:57:31 +02003675}
3676
Gilles Peskinefe119512018-07-08 21:39:34 +02003677psa_status_t psa_cipher_generate_iv( psa_cipher_operation_t *operation,
Andrew Thoelke163639b2019-05-15 12:33:23 +01003678 uint8_t *iv,
Gilles Peskinefe119512018-07-08 21:39:34 +02003679 size_t iv_size,
3680 size_t *iv_length )
mohammad1603503973b2018-03-12 15:59:30 +02003681{
itayzafrir534bd7c2018-08-02 13:56:32 +03003682 psa_status_t status;
Janos Follath24eed8d2019-11-22 13:21:35 +00003683 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Steven Cooreman7df02922020-09-09 15:28:49 +02003684 if( operation->iv_set || ! operation->iv_required )
3685 {
3686 return( PSA_ERROR_BAD_STATE );
3687 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02003688
Steven Cooremanef8575e2020-09-11 11:44:50 +02003689 if( operation->mbedtls_in_use == 0 )
Steven Cooreman8b122252020-09-03 15:30:32 +02003690 {
Steven Cooremanfb81aa52020-09-09 12:01:43 +02003691 status = psa_driver_wrapper_cipher_generate_iv( &operation->ctx.driver,
Steven Cooreman8b122252020-09-03 15:30:32 +02003692 iv,
3693 iv_size,
3694 iv_length );
3695 goto exit;
3696 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02003697
Moran Peker41deec42018-04-04 15:43:05 +03003698 if( iv_size < operation->iv_size )
mohammad1603503973b2018-03-12 15:59:30 +02003699 {
itayzafrir534bd7c2018-08-02 13:56:32 +03003700 status = PSA_ERROR_BUFFER_TOO_SMALL;
Moran Peker41deec42018-04-04 15:43:05 +03003701 goto exit;
3702 }
Gilles Peskine5894e8e2020-12-14 14:54:06 +01003703 ret = mbedtls_psa_get_random( MBEDTLS_PSA_RANDOM_STATE,
Gilles Peskine30524eb2020-11-13 17:02:26 +01003704 iv, operation->iv_size );
Moran Peker41deec42018-04-04 15:43:05 +03003705 if( ret != 0 )
3706 {
itayzafrir534bd7c2018-08-02 13:56:32 +03003707 status = mbedtls_to_psa_error( ret );
Gilles Peskinee553c652018-06-04 16:22:46 +02003708 goto exit;
mohammad1603503973b2018-03-12 15:59:30 +02003709 }
Gilles Peskinee553c652018-06-04 16:22:46 +02003710
mohammad16038481e742018-03-18 13:57:31 +02003711 *iv_length = operation->iv_size;
itayzafrir534bd7c2018-08-02 13:56:32 +03003712 status = psa_cipher_set_iv( operation, iv, *iv_length );
Moran Peker41deec42018-04-04 15:43:05 +03003713
Moran Peker395db872018-05-31 14:07:14 +03003714exit:
Steven Cooreman7df02922020-09-09 15:28:49 +02003715 if( status == PSA_SUCCESS )
3716 operation->iv_set = 1;
3717 else
Moran Peker395db872018-05-31 14:07:14 +03003718 psa_cipher_abort( operation );
itayzafrir534bd7c2018-08-02 13:56:32 +03003719 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02003720}
3721
Gilles Peskinefe119512018-07-08 21:39:34 +02003722psa_status_t psa_cipher_set_iv( psa_cipher_operation_t *operation,
Andrew Thoelke163639b2019-05-15 12:33:23 +01003723 const uint8_t *iv,
Gilles Peskinefe119512018-07-08 21:39:34 +02003724 size_t iv_length )
mohammad1603503973b2018-03-12 15:59:30 +02003725{
itayzafrir534bd7c2018-08-02 13:56:32 +03003726 psa_status_t status;
Janos Follath24eed8d2019-11-22 13:21:35 +00003727 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Steven Cooreman7df02922020-09-09 15:28:49 +02003728 if( operation->iv_set || ! operation->iv_required )
3729 {
3730 return( PSA_ERROR_BAD_STATE );
3731 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02003732
Steven Cooremanef8575e2020-09-11 11:44:50 +02003733 if( operation->mbedtls_in_use == 0 )
Steven Cooreman8b122252020-09-03 15:30:32 +02003734 {
Steven Cooremanfb81aa52020-09-09 12:01:43 +02003735 status = psa_driver_wrapper_cipher_set_iv( &operation->ctx.driver,
Steven Cooreman8b122252020-09-03 15:30:32 +02003736 iv,
3737 iv_length );
3738 goto exit;
3739 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02003740
Moran Pekera28258c2018-05-29 16:25:04 +03003741 if( iv_length != operation->iv_size )
Moran Peker71f19ae2018-04-22 20:23:16 +03003742 {
itayzafrir534bd7c2018-08-02 13:56:32 +03003743 status = PSA_ERROR_INVALID_ARGUMENT;
3744 goto exit;
Moran Peker71f19ae2018-04-22 20:23:16 +03003745 }
itayzafrir534bd7c2018-08-02 13:56:32 +03003746 ret = mbedtls_cipher_set_iv( &operation->ctx.cipher, iv, iv_length );
3747 status = mbedtls_to_psa_error( ret );
3748exit:
3749 if( status == PSA_SUCCESS )
3750 operation->iv_set = 1;
3751 else
mohammad1603503973b2018-03-12 15:59:30 +02003752 psa_cipher_abort( operation );
itayzafrir534bd7c2018-08-02 13:56:32 +03003753 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02003754}
3755
Steven Cooreman177deba2020-09-07 17:14:14 +02003756/* Process input for which the algorithm is set to ECB mode. This requires
3757 * manual processing, since the PSA API is defined as being able to process
3758 * arbitrary-length calls to psa_cipher_update() with ECB mode, but the
3759 * underlying mbedtls_cipher_update only takes full blocks. */
3760static psa_status_t psa_cipher_update_ecb_internal(
3761 mbedtls_cipher_context_t *ctx,
3762 const uint8_t *input,
3763 size_t input_length,
3764 uint8_t *output,
3765 size_t output_size,
3766 size_t *output_length )
3767{
3768 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3769 size_t block_size = ctx->cipher_info->block_size;
3770 size_t internal_output_length = 0;
3771 *output_length = 0;
3772
3773 if( input_length == 0 )
3774 {
3775 status = PSA_SUCCESS;
3776 goto exit;
3777 }
3778
3779 if( ctx->unprocessed_len > 0 )
3780 {
3781 /* Fill up to block size, and run the block if there's a full one. */
3782 size_t bytes_to_copy = block_size - ctx->unprocessed_len;
3783
3784 if( input_length < bytes_to_copy )
3785 bytes_to_copy = input_length;
3786
3787 memcpy( &( ctx->unprocessed_data[ctx->unprocessed_len] ),
3788 input, bytes_to_copy );
3789 input_length -= bytes_to_copy;
3790 input += bytes_to_copy;
3791 ctx->unprocessed_len += bytes_to_copy;
3792
3793 if( ctx->unprocessed_len == block_size )
3794 {
3795 status = mbedtls_to_psa_error(
3796 mbedtls_cipher_update( ctx,
3797 ctx->unprocessed_data,
3798 block_size,
3799 output, &internal_output_length ) );
3800
3801 if( status != PSA_SUCCESS )
3802 goto exit;
3803
3804 output += internal_output_length;
3805 output_size -= internal_output_length;
3806 *output_length += internal_output_length;
3807 ctx->unprocessed_len = 0;
3808 }
3809 }
3810
3811 while( input_length >= block_size )
3812 {
3813 /* Run all full blocks we have, one by one */
3814 status = mbedtls_to_psa_error(
3815 mbedtls_cipher_update( ctx, input,
3816 block_size,
3817 output, &internal_output_length ) );
3818
3819 if( status != PSA_SUCCESS )
3820 goto exit;
3821
3822 input_length -= block_size;
3823 input += block_size;
3824
3825 output += internal_output_length;
3826 output_size -= internal_output_length;
3827 *output_length += internal_output_length;
3828 }
3829
3830 if( input_length > 0 )
3831 {
3832 /* Save unprocessed bytes for later processing */
3833 memcpy( &( ctx->unprocessed_data[ctx->unprocessed_len] ),
3834 input, input_length );
3835 ctx->unprocessed_len += input_length;
3836 }
3837
3838 status = PSA_SUCCESS;
3839
3840exit:
3841 return( status );
3842}
3843
Gilles Peskinee553c652018-06-04 16:22:46 +02003844psa_status_t psa_cipher_update( psa_cipher_operation_t *operation,
3845 const uint8_t *input,
3846 size_t input_length,
Andrew Thoelke163639b2019-05-15 12:33:23 +01003847 uint8_t *output,
Gilles Peskinee553c652018-06-04 16:22:46 +02003848 size_t output_size,
3849 size_t *output_length )
mohammad1603503973b2018-03-12 15:59:30 +02003850{
Steven Cooremanffecb7b2020-08-25 15:13:13 +02003851 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine89d789c2018-06-04 17:17:16 +02003852 size_t expected_output_size;
Steven Cooreman7df02922020-09-09 15:28:49 +02003853 if( operation->alg == 0 )
3854 {
3855 return( PSA_ERROR_BAD_STATE );
3856 }
3857 if( operation->iv_required && ! operation->iv_set )
3858 {
3859 return( PSA_ERROR_BAD_STATE );
3860 }
Jaeden Ameroab439972019-02-15 14:12:05 +00003861
Steven Cooremanef8575e2020-09-11 11:44:50 +02003862 if( operation->mbedtls_in_use == 0 )
Steven Cooreman8b122252020-09-03 15:30:32 +02003863 {
Steven Cooremanfb81aa52020-09-09 12:01:43 +02003864 status = psa_driver_wrapper_cipher_update( &operation->ctx.driver,
Steven Cooreman8b122252020-09-03 15:30:32 +02003865 input,
3866 input_length,
3867 output,
3868 output_size,
3869 output_length );
3870 goto exit;
3871 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02003872
Gilles Peskinedaea26f2018-08-21 14:02:45 +02003873 if( ! PSA_ALG_IS_STREAM_CIPHER( operation->alg ) )
Gilles Peskine89d789c2018-06-04 17:17:16 +02003874 {
3875 /* Take the unprocessed partial block left over from previous
3876 * update calls, if any, plus the input to this call. Remove
3877 * the last partial block, if any. You get the data that will be
3878 * output in this call. */
3879 expected_output_size =
3880 ( operation->ctx.cipher.unprocessed_len + input_length )
3881 / operation->block_size * operation->block_size;
3882 }
3883 else
3884 {
3885 expected_output_size = input_length;
3886 }
itayzafrir534bd7c2018-08-02 13:56:32 +03003887
Gilles Peskine89d789c2018-06-04 17:17:16 +02003888 if( output_size < expected_output_size )
itayzafrir534bd7c2018-08-02 13:56:32 +03003889 {
3890 status = PSA_ERROR_BUFFER_TOO_SMALL;
3891 goto exit;
3892 }
mohammad160382759612018-03-12 18:16:40 +02003893
Steven Cooremanffecb7b2020-08-25 15:13:13 +02003894 if( operation->alg == PSA_ALG_ECB_NO_PADDING )
3895 {
3896 /* mbedtls_cipher_update has an API inconsistency: it will only
3897 * process a single block at a time in ECB mode. Abstract away that
3898 * inconsistency here to match the PSA API behaviour. */
Steven Cooreman177deba2020-09-07 17:14:14 +02003899 status = psa_cipher_update_ecb_internal( &operation->ctx.cipher,
3900 input,
3901 input_length,
3902 output,
3903 output_size,
3904 output_length );
Steven Cooremanffecb7b2020-08-25 15:13:13 +02003905 }
3906 else
3907 {
3908 status = mbedtls_to_psa_error(
3909 mbedtls_cipher_update( &operation->ctx.cipher, input,
3910 input_length, output, output_length ) );
3911 }
itayzafrir534bd7c2018-08-02 13:56:32 +03003912exit:
3913 if( status != PSA_SUCCESS )
mohammad1603503973b2018-03-12 15:59:30 +02003914 psa_cipher_abort( operation );
itayzafrir534bd7c2018-08-02 13:56:32 +03003915 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02003916}
3917
Gilles Peskinee553c652018-06-04 16:22:46 +02003918psa_status_t psa_cipher_finish( psa_cipher_operation_t *operation,
3919 uint8_t *output,
3920 size_t output_size,
3921 size_t *output_length )
mohammad1603503973b2018-03-12 15:59:30 +02003922{
David Saadab4ecc272019-02-14 13:48:10 +02003923 psa_status_t status = PSA_ERROR_GENERIC_ERROR;
Gilles Peskinee553c652018-06-04 16:22:46 +02003924 uint8_t temp_output_buffer[MBEDTLS_MAX_BLOCK_LENGTH];
Steven Cooreman7df02922020-09-09 15:28:49 +02003925 if( operation->alg == 0 )
3926 {
3927 return( PSA_ERROR_BAD_STATE );
3928 }
3929 if( operation->iv_required && ! operation->iv_set )
3930 {
3931 return( PSA_ERROR_BAD_STATE );
3932 }
Moran Pekerbed71a22018-04-22 20:19:20 +03003933
Steven Cooremanef8575e2020-09-11 11:44:50 +02003934 if( operation->mbedtls_in_use == 0 )
Steven Cooreman8b122252020-09-03 15:30:32 +02003935 {
Steven Cooremanfb81aa52020-09-09 12:01:43 +02003936 status = psa_driver_wrapper_cipher_finish( &operation->ctx.driver,
Steven Cooreman8b122252020-09-03 15:30:32 +02003937 output,
3938 output_size,
3939 output_length );
Steven Cooremanef8575e2020-09-11 11:44:50 +02003940 goto exit;
Steven Cooreman8b122252020-09-03 15:30:32 +02003941 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02003942
Steven Cooremaned3c9ec2020-07-06 14:08:59 +02003943 if( operation->ctx.cipher.unprocessed_len != 0 )
Moran Peker7cb22b82018-06-05 11:40:02 +03003944 {
Steven Cooremaned3c9ec2020-07-06 14:08:59 +02003945 if( operation->alg == PSA_ALG_ECB_NO_PADDING ||
Fredrik Strupef90e3012020-09-28 16:11:33 +02003946 operation->alg == PSA_ALG_CBC_NO_PADDING )
Steven Cooremana6033e92020-08-25 11:47:50 +02003947 {
Gilles Peskinedaea26f2018-08-21 14:02:45 +02003948 status = PSA_ERROR_INVALID_ARGUMENT;
Steven Cooremanef8575e2020-09-11 11:44:50 +02003949 goto exit;
Steven Cooremaned3c9ec2020-07-06 14:08:59 +02003950 }
Moran Pekerdc38ebc2018-04-30 15:45:34 +03003951 }
3952
Steven Cooremanef8575e2020-09-11 11:44:50 +02003953 status = mbedtls_to_psa_error(
3954 mbedtls_cipher_finish( &operation->ctx.cipher,
3955 temp_output_buffer,
3956 output_length ) );
3957 if( status != PSA_SUCCESS )
3958 goto exit;
Janos Follath315b51c2018-07-09 16:04:51 +01003959
Gilles Peskine46f1fd72018-06-28 19:31:31 +02003960 if( *output_length == 0 )
Janos Follath315b51c2018-07-09 16:04:51 +01003961 ; /* Nothing to copy. Note that output may be NULL in this case. */
Gilles Peskine46f1fd72018-06-28 19:31:31 +02003962 else if( output_size >= *output_length )
Moran Pekerdc38ebc2018-04-30 15:45:34 +03003963 memcpy( output, temp_output_buffer, *output_length );
3964 else
Janos Follath315b51c2018-07-09 16:04:51 +01003965 status = PSA_ERROR_BUFFER_TOO_SMALL;
mohammad1603503973b2018-03-12 15:59:30 +02003966
Steven Cooremanef8575e2020-09-11 11:44:50 +02003967exit:
3968 if( operation->mbedtls_in_use == 1 )
3969 mbedtls_platform_zeroize( temp_output_buffer, sizeof( temp_output_buffer ) );
Janos Follath315b51c2018-07-09 16:04:51 +01003970
Steven Cooremanef8575e2020-09-11 11:44:50 +02003971 if( status == PSA_SUCCESS )
3972 return( psa_cipher_abort( operation ) );
3973 else
3974 {
3975 *output_length = 0;
Steven Cooremanef8575e2020-09-11 11:44:50 +02003976 (void) psa_cipher_abort( operation );
Janos Follath315b51c2018-07-09 16:04:51 +01003977
Steven Cooremanef8575e2020-09-11 11:44:50 +02003978 return( status );
3979 }
mohammad1603503973b2018-03-12 15:59:30 +02003980}
3981
Gilles Peskinee553c652018-06-04 16:22:46 +02003982psa_status_t psa_cipher_abort( psa_cipher_operation_t *operation )
3983{
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02003984 if( operation->alg == 0 )
Gilles Peskine81736312018-06-26 15:04:31 +02003985 {
Steven Cooremana07b9972020-09-10 14:54:14 +02003986 /* The object has (apparently) been initialized but it is not (yet)
Gilles Peskine81736312018-06-26 15:04:31 +02003987 * in use. It's ok to call abort on such an object, and there's
3988 * nothing to do. */
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02003989 return( PSA_SUCCESS );
Gilles Peskine81736312018-06-26 15:04:31 +02003990 }
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02003991
Gilles Peskinef9c2c092018-06-21 16:57:07 +02003992 /* Sanity check (shouldn't happen: operation->alg should
3993 * always have been initialized to a valid value). */
3994 if( ! PSA_ALG_IS_CIPHER( operation->alg ) )
3995 return( PSA_ERROR_BAD_STATE );
3996
Steven Cooremanef8575e2020-09-11 11:44:50 +02003997 if( operation->mbedtls_in_use == 0 )
Steven Cooremanfb81aa52020-09-09 12:01:43 +02003998 psa_driver_wrapper_cipher_abort( &operation->ctx.driver );
Steven Cooremand3feccd2020-09-01 15:56:14 +02003999 else
4000 mbedtls_cipher_free( &operation->ctx.cipher );
Gilles Peskinee553c652018-06-04 16:22:46 +02004001
Moran Peker41deec42018-04-04 15:43:05 +03004002 operation->alg = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03004003 operation->key_set = 0;
4004 operation->iv_set = 0;
Steven Cooremanef8575e2020-09-11 11:44:50 +02004005 operation->mbedtls_in_use = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03004006 operation->iv_size = 0;
Moran Peker41deec42018-04-04 15:43:05 +03004007 operation->block_size = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03004008 operation->iv_required = 0;
Moran Peker41deec42018-04-04 15:43:05 +03004009
Moran Peker395db872018-05-31 14:07:14 +03004010 return( PSA_SUCCESS );
mohammad1603503973b2018-03-12 15:59:30 +02004011}
4012
Gilles Peskinea0655c32018-04-30 17:06:50 +02004013
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02004014
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02004015
mohammad16035955c982018-04-26 00:53:03 +03004016/****************************************************************/
4017/* AEAD */
4018/****************************************************************/
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02004019
Gilles Peskineedf9a652018-08-17 18:11:56 +02004020typedef struct
4021{
Gilles Peskine2f060a82018-12-04 17:12:32 +01004022 psa_key_slot_t *slot;
Gilles Peskineedf9a652018-08-17 18:11:56 +02004023 const mbedtls_cipher_info_t *cipher_info;
4024 union
4025 {
Ronald Cronf95a2b12020-10-22 15:24:49 +02004026 unsigned dummy; /* Make the union non-empty even with no supported algorithms. */
Gilles Peskineedf9a652018-08-17 18:11:56 +02004027#if defined(MBEDTLS_CCM_C)
4028 mbedtls_ccm_context ccm;
4029#endif /* MBEDTLS_CCM_C */
4030#if defined(MBEDTLS_GCM_C)
4031 mbedtls_gcm_context gcm;
4032#endif /* MBEDTLS_GCM_C */
Gilles Peskine26869f22019-05-06 15:25:00 +02004033#if defined(MBEDTLS_CHACHAPOLY_C)
4034 mbedtls_chachapoly_context chachapoly;
4035#endif /* MBEDTLS_CHACHAPOLY_C */
Gilles Peskineedf9a652018-08-17 18:11:56 +02004036 } ctx;
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02004037 psa_algorithm_t core_alg;
4038 uint8_t full_tag_length;
Gilles Peskineedf9a652018-08-17 18:11:56 +02004039 uint8_t tag_length;
4040} aead_operation_t;
4041
Ronald Cronf95a2b12020-10-22 15:24:49 +02004042#define AEAD_OPERATION_INIT {0, 0, {0}, 0, 0, 0}
4043
Gilles Peskine30a9e412019-01-14 18:36:12 +01004044static void psa_aead_abort_internal( aead_operation_t *operation )
Gilles Peskineedf9a652018-08-17 18:11:56 +02004045{
Gilles Peskinef8a8fe62018-08-21 16:38:05 +02004046 switch( operation->core_alg )
Gilles Peskineedf9a652018-08-17 18:11:56 +02004047 {
4048#if defined(MBEDTLS_CCM_C)
4049 case PSA_ALG_CCM:
4050 mbedtls_ccm_free( &operation->ctx.ccm );
4051 break;
4052#endif /* MBEDTLS_CCM_C */
Gilles Peskineb0b189f2018-11-28 17:30:58 +01004053#if defined(MBEDTLS_GCM_C)
Gilles Peskineedf9a652018-08-17 18:11:56 +02004054 case PSA_ALG_GCM:
4055 mbedtls_gcm_free( &operation->ctx.gcm );
4056 break;
4057#endif /* MBEDTLS_GCM_C */
4058 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02004059
Ronald Cron5c522922020-11-14 16:35:34 +01004060 psa_unlock_key_slot( operation->slot );
Gilles Peskineedf9a652018-08-17 18:11:56 +02004061}
4062
4063static psa_status_t psa_aead_setup( aead_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02004064 mbedtls_svc_key_id_t key,
Gilles Peskineedf9a652018-08-17 18:11:56 +02004065 psa_key_usage_t usage,
4066 psa_algorithm_t alg )
4067{
4068 psa_status_t status;
4069 size_t key_bits;
4070 mbedtls_cipher_id_t cipher_id;
4071
Ronald Cron5c522922020-11-14 16:35:34 +01004072 status = psa_get_and_lock_transparent_key_slot_with_policy(
4073 key, &operation->slot, usage, alg );
Gilles Peskineedf9a652018-08-17 18:11:56 +02004074 if( status != PSA_SUCCESS )
4075 return( status );
4076
Gilles Peskinedb4b3ab2019-04-18 12:53:01 +02004077 key_bits = psa_get_key_slot_bits( operation->slot );
Gilles Peskineedf9a652018-08-17 18:11:56 +02004078
4079 operation->cipher_info =
Gilles Peskine8e338702019-07-30 20:06:31 +02004080 mbedtls_cipher_info_from_psa( alg, operation->slot->attr.type, key_bits,
Gilles Peskineedf9a652018-08-17 18:11:56 +02004081 &cipher_id );
4082 if( operation->cipher_info == NULL )
Ronald Cronf95a2b12020-10-22 15:24:49 +02004083 {
4084 status = PSA_ERROR_NOT_SUPPORTED;
4085 goto cleanup;
4086 }
Gilles Peskineedf9a652018-08-17 18:11:56 +02004087
Bence Szépkútia63b20d2020-12-16 11:36:46 +01004088 switch( PSA_ALG_AEAD_WITH_SHORTENED_TAG( alg, 0 ) )
Gilles Peskineedf9a652018-08-17 18:11:56 +02004089 {
4090#if defined(MBEDTLS_CCM_C)
Bence Szépkútia63b20d2020-12-16 11:36:46 +01004091 case PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, 0 ):
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02004092 operation->core_alg = PSA_ALG_CCM;
4093 operation->full_tag_length = 16;
Gilles Peskinef7e7b012019-05-06 15:27:16 +02004094 /* CCM allows the following tag lengths: 4, 6, 8, 10, 12, 14, 16.
4095 * The call to mbedtls_ccm_encrypt_and_tag or
4096 * mbedtls_ccm_auth_decrypt will validate the tag length. */
gabor-mezei-armcbcec212020-12-18 14:23:51 +01004097 if( PSA_BLOCK_CIPHER_BLOCK_LENGTH( operation->slot->attr.type ) != 16 )
Ronald Cronf95a2b12020-10-22 15:24:49 +02004098 {
4099 status = PSA_ERROR_INVALID_ARGUMENT;
4100 goto cleanup;
4101 }
Gilles Peskineedf9a652018-08-17 18:11:56 +02004102 mbedtls_ccm_init( &operation->ctx.ccm );
4103 status = mbedtls_to_psa_error(
4104 mbedtls_ccm_setkey( &operation->ctx.ccm, cipher_id,
Ronald Cronea0f8a62020-11-25 17:52:23 +01004105 operation->slot->key.data,
Gilles Peskineedf9a652018-08-17 18:11:56 +02004106 (unsigned int) key_bits ) );
4107 if( status != 0 )
4108 goto cleanup;
4109 break;
4110#endif /* MBEDTLS_CCM_C */
4111
4112#if defined(MBEDTLS_GCM_C)
Bence Szépkútia63b20d2020-12-16 11:36:46 +01004113 case PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_GCM, 0 ):
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02004114 operation->core_alg = PSA_ALG_GCM;
4115 operation->full_tag_length = 16;
Gilles Peskinef7e7b012019-05-06 15:27:16 +02004116 /* GCM allows the following tag lengths: 4, 8, 12, 13, 14, 15, 16.
4117 * The call to mbedtls_gcm_crypt_and_tag or
4118 * mbedtls_gcm_auth_decrypt will validate the tag length. */
gabor-mezei-armcbcec212020-12-18 14:23:51 +01004119 if( PSA_BLOCK_CIPHER_BLOCK_LENGTH( operation->slot->attr.type ) != 16 )
Ronald Cronf95a2b12020-10-22 15:24:49 +02004120 {
4121 status = PSA_ERROR_INVALID_ARGUMENT;
4122 goto cleanup;
4123 }
Gilles Peskineedf9a652018-08-17 18:11:56 +02004124 mbedtls_gcm_init( &operation->ctx.gcm );
4125 status = mbedtls_to_psa_error(
4126 mbedtls_gcm_setkey( &operation->ctx.gcm, cipher_id,
Ronald Cronea0f8a62020-11-25 17:52:23 +01004127 operation->slot->key.data,
Gilles Peskineedf9a652018-08-17 18:11:56 +02004128 (unsigned int) key_bits ) );
Gilles Peskinef7e7b012019-05-06 15:27:16 +02004129 if( status != 0 )
4130 goto cleanup;
Gilles Peskineedf9a652018-08-17 18:11:56 +02004131 break;
4132#endif /* MBEDTLS_GCM_C */
4133
Gilles Peskine26869f22019-05-06 15:25:00 +02004134#if defined(MBEDTLS_CHACHAPOLY_C)
Bence Szépkútia63b20d2020-12-16 11:36:46 +01004135 case PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CHACHA20_POLY1305, 0 ):
Gilles Peskine26869f22019-05-06 15:25:00 +02004136 operation->core_alg = PSA_ALG_CHACHA20_POLY1305;
4137 operation->full_tag_length = 16;
4138 /* We only support the default tag length. */
4139 if( alg != PSA_ALG_CHACHA20_POLY1305 )
Ronald Cronf95a2b12020-10-22 15:24:49 +02004140 {
4141 status = PSA_ERROR_NOT_SUPPORTED;
4142 goto cleanup;
4143 }
Gilles Peskine26869f22019-05-06 15:25:00 +02004144 mbedtls_chachapoly_init( &operation->ctx.chachapoly );
4145 status = mbedtls_to_psa_error(
4146 mbedtls_chachapoly_setkey( &operation->ctx.chachapoly,
Ronald Cronea0f8a62020-11-25 17:52:23 +01004147 operation->slot->key.data ) );
Gilles Peskine26869f22019-05-06 15:25:00 +02004148 if( status != 0 )
4149 goto cleanup;
4150 break;
4151#endif /* MBEDTLS_CHACHAPOLY_C */
4152
Gilles Peskineedf9a652018-08-17 18:11:56 +02004153 default:
Ronald Cronf95a2b12020-10-22 15:24:49 +02004154 status = PSA_ERROR_NOT_SUPPORTED;
4155 goto cleanup;
Gilles Peskineedf9a652018-08-17 18:11:56 +02004156 }
4157
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02004158 if( PSA_AEAD_TAG_LENGTH( alg ) > operation->full_tag_length )
4159 {
4160 status = PSA_ERROR_INVALID_ARGUMENT;
4161 goto cleanup;
4162 }
4163 operation->tag_length = PSA_AEAD_TAG_LENGTH( alg );
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02004164
Gilles Peskineedf9a652018-08-17 18:11:56 +02004165 return( PSA_SUCCESS );
4166
4167cleanup:
Gilles Peskine30a9e412019-01-14 18:36:12 +01004168 psa_aead_abort_internal( operation );
Gilles Peskineedf9a652018-08-17 18:11:56 +02004169 return( status );
4170}
4171
Ronald Croncf56a0a2020-08-04 09:51:30 +02004172psa_status_t psa_aead_encrypt( mbedtls_svc_key_id_t key,
mohammad16035955c982018-04-26 00:53:03 +03004173 psa_algorithm_t alg,
4174 const uint8_t *nonce,
4175 size_t nonce_length,
4176 const uint8_t *additional_data,
4177 size_t additional_data_length,
4178 const uint8_t *plaintext,
4179 size_t plaintext_length,
4180 uint8_t *ciphertext,
4181 size_t ciphertext_size,
4182 size_t *ciphertext_length )
4183{
mohammad16035955c982018-04-26 00:53:03 +03004184 psa_status_t status;
Ronald Cronf95a2b12020-10-22 15:24:49 +02004185 aead_operation_t operation = AEAD_OPERATION_INIT;
mohammad160315223a82018-06-03 17:19:55 +03004186 uint8_t *tag;
Gilles Peskine2d277862018-06-18 15:41:12 +02004187
mohammad1603f08a5502018-06-03 15:05:47 +03004188 *ciphertext_length = 0;
mohammad1603e58e6842018-05-09 04:58:32 -07004189
Ronald Croncf56a0a2020-08-04 09:51:30 +02004190 status = psa_aead_setup( &operation, key, PSA_KEY_USAGE_ENCRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02004191 if( status != PSA_SUCCESS )
4192 return( status );
mohammad16035955c982018-04-26 00:53:03 +03004193
Gilles Peskineedf9a652018-08-17 18:11:56 +02004194 /* For all currently supported modes, the tag is at the end of the
4195 * ciphertext. */
4196 if( ciphertext_size < ( plaintext_length + operation.tag_length ) )
4197 {
4198 status = PSA_ERROR_BUFFER_TOO_SMALL;
4199 goto exit;
4200 }
4201 tag = ciphertext + plaintext_length;
mohammad16035955c982018-04-26 00:53:03 +03004202
Gilles Peskineb0b189f2018-11-28 17:30:58 +01004203#if defined(MBEDTLS_GCM_C)
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02004204 if( operation.core_alg == PSA_ALG_GCM )
mohammad16035955c982018-04-26 00:53:03 +03004205 {
Gilles Peskineedf9a652018-08-17 18:11:56 +02004206 status = mbedtls_to_psa_error(
4207 mbedtls_gcm_crypt_and_tag( &operation.ctx.gcm,
4208 MBEDTLS_GCM_ENCRYPT,
4209 plaintext_length,
4210 nonce, nonce_length,
4211 additional_data, additional_data_length,
4212 plaintext, ciphertext,
4213 operation.tag_length, tag ) );
mohammad16035955c982018-04-26 00:53:03 +03004214 }
Gilles Peskineb0b189f2018-11-28 17:30:58 +01004215 else
4216#endif /* MBEDTLS_GCM_C */
4217#if defined(MBEDTLS_CCM_C)
4218 if( operation.core_alg == PSA_ALG_CCM )
mohammad16035955c982018-04-26 00:53:03 +03004219 {
Gilles Peskineedf9a652018-08-17 18:11:56 +02004220 status = mbedtls_to_psa_error(
4221 mbedtls_ccm_encrypt_and_tag( &operation.ctx.ccm,
4222 plaintext_length,
4223 nonce, nonce_length,
4224 additional_data,
4225 additional_data_length,
4226 plaintext, ciphertext,
4227 tag, operation.tag_length ) );
mohammad16035955c982018-04-26 00:53:03 +03004228 }
mohammad16035c8845f2018-05-09 05:40:09 -07004229 else
Gilles Peskineb0b189f2018-11-28 17:30:58 +01004230#endif /* MBEDTLS_CCM_C */
Gilles Peskine26869f22019-05-06 15:25:00 +02004231#if defined(MBEDTLS_CHACHAPOLY_C)
4232 if( operation.core_alg == PSA_ALG_CHACHA20_POLY1305 )
4233 {
4234 if( nonce_length != 12 || operation.tag_length != 16 )
4235 {
4236 status = PSA_ERROR_NOT_SUPPORTED;
4237 goto exit;
4238 }
4239 status = mbedtls_to_psa_error(
4240 mbedtls_chachapoly_encrypt_and_tag( &operation.ctx.chachapoly,
4241 plaintext_length,
4242 nonce,
4243 additional_data,
4244 additional_data_length,
4245 plaintext,
4246 ciphertext,
4247 tag ) );
4248 }
4249 else
4250#endif /* MBEDTLS_CHACHAPOLY_C */
mohammad16035c8845f2018-05-09 05:40:09 -07004251 {
Steven Cooreman7196fef2021-02-10 17:13:28 +01004252 (void) tag;
mohammad1603554faad2018-06-03 15:07:38 +03004253 return( PSA_ERROR_NOT_SUPPORTED );
mohammad16035c8845f2018-05-09 05:40:09 -07004254 }
Gilles Peskine2d277862018-06-18 15:41:12 +02004255
Gilles Peskineedf9a652018-08-17 18:11:56 +02004256 if( status != PSA_SUCCESS && ciphertext_size != 0 )
4257 memset( ciphertext, 0, ciphertext_size );
Gilles Peskine2d277862018-06-18 15:41:12 +02004258
Gilles Peskineedf9a652018-08-17 18:11:56 +02004259exit:
Gilles Peskine30a9e412019-01-14 18:36:12 +01004260 psa_aead_abort_internal( &operation );
Gilles Peskineedf9a652018-08-17 18:11:56 +02004261 if( status == PSA_SUCCESS )
4262 *ciphertext_length = plaintext_length + operation.tag_length;
4263 return( status );
mohammad16035955c982018-04-26 00:53:03 +03004264}
4265
Gilles Peskineee652a32018-06-01 19:23:52 +02004266/* Locate the tag in a ciphertext buffer containing the encrypted data
4267 * followed by the tag. Return the length of the part preceding the tag in
4268 * *plaintext_length. This is the size of the plaintext in modes where
4269 * the encrypted data has the same size as the plaintext, such as
4270 * CCM and GCM. */
4271static psa_status_t psa_aead_unpadded_locate_tag( size_t tag_length,
4272 const uint8_t *ciphertext,
4273 size_t ciphertext_length,
4274 size_t plaintext_size,
Gilles Peskineee652a32018-06-01 19:23:52 +02004275 const uint8_t **p_tag )
4276{
4277 size_t payload_length;
4278 if( tag_length > ciphertext_length )
4279 return( PSA_ERROR_INVALID_ARGUMENT );
4280 payload_length = ciphertext_length - tag_length;
4281 if( payload_length > plaintext_size )
4282 return( PSA_ERROR_BUFFER_TOO_SMALL );
4283 *p_tag = ciphertext + payload_length;
Gilles Peskineee652a32018-06-01 19:23:52 +02004284 return( PSA_SUCCESS );
4285}
4286
Ronald Croncf56a0a2020-08-04 09:51:30 +02004287psa_status_t psa_aead_decrypt( mbedtls_svc_key_id_t key,
mohammad16035955c982018-04-26 00:53:03 +03004288 psa_algorithm_t alg,
4289 const uint8_t *nonce,
4290 size_t nonce_length,
4291 const uint8_t *additional_data,
4292 size_t additional_data_length,
4293 const uint8_t *ciphertext,
4294 size_t ciphertext_length,
4295 uint8_t *plaintext,
4296 size_t plaintext_size,
4297 size_t *plaintext_length )
4298{
mohammad16035955c982018-04-26 00:53:03 +03004299 psa_status_t status;
Ronald Cronf95a2b12020-10-22 15:24:49 +02004300 aead_operation_t operation = AEAD_OPERATION_INIT;
Gilles Peskineedf9a652018-08-17 18:11:56 +02004301 const uint8_t *tag = NULL;
Gilles Peskine2d277862018-06-18 15:41:12 +02004302
Gilles Peskineee652a32018-06-01 19:23:52 +02004303 *plaintext_length = 0;
mohammad16039e5a5152018-04-26 12:07:35 +03004304
Ronald Croncf56a0a2020-08-04 09:51:30 +02004305 status = psa_aead_setup( &operation, key, PSA_KEY_USAGE_DECRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02004306 if( status != PSA_SUCCESS )
4307 return( status );
mohammad16035955c982018-04-26 00:53:03 +03004308
Gilles Peskinef7e7b012019-05-06 15:27:16 +02004309 status = psa_aead_unpadded_locate_tag( operation.tag_length,
4310 ciphertext, ciphertext_length,
4311 plaintext_size, &tag );
4312 if( status != PSA_SUCCESS )
4313 goto exit;
4314
Gilles Peskineb0b189f2018-11-28 17:30:58 +01004315#if defined(MBEDTLS_GCM_C)
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02004316 if( operation.core_alg == PSA_ALG_GCM )
mohammad16035955c982018-04-26 00:53:03 +03004317 {
Gilles Peskineedf9a652018-08-17 18:11:56 +02004318 status = mbedtls_to_psa_error(
4319 mbedtls_gcm_auth_decrypt( &operation.ctx.gcm,
4320 ciphertext_length - operation.tag_length,
4321 nonce, nonce_length,
4322 additional_data,
4323 additional_data_length,
4324 tag, operation.tag_length,
4325 ciphertext, plaintext ) );
mohammad16035955c982018-04-26 00:53:03 +03004326 }
Gilles Peskineb0b189f2018-11-28 17:30:58 +01004327 else
4328#endif /* MBEDTLS_GCM_C */
4329#if defined(MBEDTLS_CCM_C)
4330 if( operation.core_alg == PSA_ALG_CCM )
mohammad16035955c982018-04-26 00:53:03 +03004331 {
Gilles Peskineedf9a652018-08-17 18:11:56 +02004332 status = mbedtls_to_psa_error(
4333 mbedtls_ccm_auth_decrypt( &operation.ctx.ccm,
4334 ciphertext_length - operation.tag_length,
4335 nonce, nonce_length,
4336 additional_data,
4337 additional_data_length,
4338 ciphertext, plaintext,
4339 tag, operation.tag_length ) );
mohammad16035955c982018-04-26 00:53:03 +03004340 }
mohammad160339574652018-06-01 04:39:53 -07004341 else
Gilles Peskineb0b189f2018-11-28 17:30:58 +01004342#endif /* MBEDTLS_CCM_C */
Gilles Peskine26869f22019-05-06 15:25:00 +02004343#if defined(MBEDTLS_CHACHAPOLY_C)
4344 if( operation.core_alg == PSA_ALG_CHACHA20_POLY1305 )
4345 {
4346 if( nonce_length != 12 || operation.tag_length != 16 )
4347 {
4348 status = PSA_ERROR_NOT_SUPPORTED;
4349 goto exit;
4350 }
4351 status = mbedtls_to_psa_error(
4352 mbedtls_chachapoly_auth_decrypt( &operation.ctx.chachapoly,
4353 ciphertext_length - operation.tag_length,
4354 nonce,
4355 additional_data,
4356 additional_data_length,
4357 tag,
4358 ciphertext,
4359 plaintext ) );
4360 }
4361 else
4362#endif /* MBEDTLS_CHACHAPOLY_C */
mohammad160339574652018-06-01 04:39:53 -07004363 {
mohammad1603554faad2018-06-03 15:07:38 +03004364 return( PSA_ERROR_NOT_SUPPORTED );
mohammad160339574652018-06-01 04:39:53 -07004365 }
Gilles Peskinea40d7742018-06-01 16:28:30 +02004366
Gilles Peskineedf9a652018-08-17 18:11:56 +02004367 if( status != PSA_SUCCESS && plaintext_size != 0 )
4368 memset( plaintext, 0, plaintext_size );
mohammad160360a64d02018-06-03 17:20:42 +03004369
Gilles Peskineedf9a652018-08-17 18:11:56 +02004370exit:
Gilles Peskine30a9e412019-01-14 18:36:12 +01004371 psa_aead_abort_internal( &operation );
Gilles Peskineedf9a652018-08-17 18:11:56 +02004372 if( status == PSA_SUCCESS )
4373 *plaintext_length = ciphertext_length - operation.tag_length;
4374 return( status );
mohammad16035955c982018-04-26 00:53:03 +03004375}
4376
Gilles Peskinea0655c32018-04-30 17:06:50 +02004377
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02004378
Gilles Peskine20035e32018-02-03 22:44:14 +01004379/****************************************************************/
Gilles Peskineeab56e42018-07-12 17:12:33 +02004380/* Generators */
4381/****************************************************************/
4382
John Durkop07cc04a2020-11-16 22:08:34 -08004383#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF) || \
4384 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
4385 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
4386#define AT_LEAST_ONE_BUILTIN_KDF
4387#endif
4388
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004389#define HKDF_STATE_INIT 0 /* no input yet */
4390#define HKDF_STATE_STARTED 1 /* got salt */
4391#define HKDF_STATE_KEYED 2 /* got key */
4392#define HKDF_STATE_OUTPUT 3 /* output started */
4393
Gilles Peskinecbe66502019-05-16 16:59:18 +02004394static psa_algorithm_t psa_key_derivation_get_kdf_alg(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004395 const psa_key_derivation_operation_t *operation )
Gilles Peskine969c5d62019-01-16 15:53:06 +01004396{
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004397 if ( PSA_ALG_IS_KEY_AGREEMENT( operation->alg ) )
4398 return( PSA_ALG_KEY_AGREEMENT_GET_KDF( operation->alg ) );
Gilles Peskine969c5d62019-01-16 15:53:06 +01004399 else
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004400 return( operation->alg );
Gilles Peskine969c5d62019-01-16 15:53:06 +01004401}
4402
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004403psa_status_t psa_key_derivation_abort( psa_key_derivation_operation_t *operation )
Gilles Peskineeab56e42018-07-12 17:12:33 +02004404{
4405 psa_status_t status = PSA_SUCCESS;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004406 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg( operation );
Gilles Peskine969c5d62019-01-16 15:53:06 +01004407 if( kdf_alg == 0 )
Gilles Peskineeab56e42018-07-12 17:12:33 +02004408 {
4409 /* The object has (apparently) been initialized but it is not
4410 * in use. It's ok to call abort on such an object, and there's
4411 * nothing to do. */
4412 }
4413 else
John Durkopd0321952020-10-29 21:37:36 -07004414#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Gilles Peskine969c5d62019-01-16 15:53:06 +01004415 if( PSA_ALG_IS_HKDF( kdf_alg ) )
Gilles Peskinebef7f142018-07-12 17:22:21 +02004416 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004417 mbedtls_free( operation->ctx.hkdf.info );
4418 status = psa_hmac_abort_internal( &operation->ctx.hkdf.hmac );
Gilles Peskinebef7f142018-07-12 17:22:21 +02004419 }
John Durkop07cc04a2020-11-16 22:08:34 -08004420 else
4421#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF */
4422#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
4423 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
4424 if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004425 /* TLS-1.2 PSK-to-MS KDF uses the same core as TLS-1.2 PRF */
Gilles Peskine969c5d62019-01-16 15:53:06 +01004426 PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Hanno Beckerc8a41d72018-10-09 17:33:01 +01004427 {
Janos Follath6a1d2622019-06-11 10:37:28 +01004428 if( operation->ctx.tls12_prf.seed != NULL )
4429 {
4430 mbedtls_platform_zeroize( operation->ctx.tls12_prf.seed,
4431 operation->ctx.tls12_prf.seed_length );
4432 mbedtls_free( operation->ctx.tls12_prf.seed );
4433 }
4434
4435 if( operation->ctx.tls12_prf.label != NULL )
4436 {
4437 mbedtls_platform_zeroize( operation->ctx.tls12_prf.label,
4438 operation->ctx.tls12_prf.label_length );
4439 mbedtls_free( operation->ctx.tls12_prf.label );
4440 }
4441
4442 status = psa_hmac_abort_internal( &operation->ctx.tls12_prf.hmac );
4443
4444 /* We leave the fields Ai and output_block to be erased safely by the
4445 * mbedtls_platform_zeroize() in the end of this function. */
Hanno Beckerc8a41d72018-10-09 17:33:01 +01004446 }
Gilles Peskinebef7f142018-07-12 17:22:21 +02004447 else
John Durkop07cc04a2020-11-16 22:08:34 -08004448#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) ||
4449 * defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) */
Gilles Peskineeab56e42018-07-12 17:12:33 +02004450 {
4451 status = PSA_ERROR_BAD_STATE;
4452 }
Janos Follath083036a2019-06-11 10:22:26 +01004453 mbedtls_platform_zeroize( operation, sizeof( *operation ) );
Gilles Peskineeab56e42018-07-12 17:12:33 +02004454 return( status );
4455}
4456
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004457psa_status_t psa_key_derivation_get_capacity(const psa_key_derivation_operation_t *operation,
Gilles Peskineeab56e42018-07-12 17:12:33 +02004458 size_t *capacity)
4459{
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004460 if( operation->alg == 0 )
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004461 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004462 /* This is a blank key derivation operation. */
Steven Cooreman29149862020-08-05 15:43:42 +02004463 return( PSA_ERROR_BAD_STATE );
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004464 }
4465
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004466 *capacity = operation->capacity;
Gilles Peskineeab56e42018-07-12 17:12:33 +02004467 return( PSA_SUCCESS );
4468}
4469
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004470psa_status_t psa_key_derivation_set_capacity( psa_key_derivation_operation_t *operation,
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004471 size_t capacity )
4472{
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004473 if( operation->alg == 0 )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004474 return( PSA_ERROR_BAD_STATE );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004475 if( capacity > operation->capacity )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004476 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004477 operation->capacity = capacity;
Gilles Peskineeab56e42018-07-12 17:12:33 +02004478 return( PSA_SUCCESS );
4479}
4480
John Durkopd0321952020-10-29 21:37:36 -07004481#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004482/* Read some bytes from an HKDF-based operation. This performs a chunk
Gilles Peskinebef7f142018-07-12 17:22:21 +02004483 * of the expand phase of the HKDF algorithm. */
Gilles Peskinecbe66502019-05-16 16:59:18 +02004484static psa_status_t psa_key_derivation_hkdf_read( psa_hkdf_key_derivation_t *hkdf,
Gilles Peskinebef7f142018-07-12 17:22:21 +02004485 psa_algorithm_t hash_alg,
4486 uint8_t *output,
4487 size_t output_length )
4488{
gabor-mezei-armcbcec212020-12-18 14:23:51 +01004489 uint8_t hash_length = PSA_HASH_LENGTH( hash_alg );
Gilles Peskinebef7f142018-07-12 17:22:21 +02004490 psa_status_t status;
4491
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004492 if( hkdf->state < HKDF_STATE_KEYED || ! hkdf->info_set )
4493 return( PSA_ERROR_BAD_STATE );
4494 hkdf->state = HKDF_STATE_OUTPUT;
4495
Gilles Peskinebef7f142018-07-12 17:22:21 +02004496 while( output_length != 0 )
4497 {
4498 /* Copy what remains of the current block */
4499 uint8_t n = hash_length - hkdf->offset_in_block;
4500 if( n > output_length )
4501 n = (uint8_t) output_length;
4502 memcpy( output, hkdf->output_block + hkdf->offset_in_block, n );
4503 output += n;
4504 output_length -= n;
4505 hkdf->offset_in_block += n;
Gilles Peskined54931c2018-07-17 21:06:59 +02004506 if( output_length == 0 )
Gilles Peskinebef7f142018-07-12 17:22:21 +02004507 break;
Gilles Peskined54931c2018-07-17 21:06:59 +02004508 /* We can't be wanting more output after block 0xff, otherwise
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02004509 * the capacity check in psa_key_derivation_output_bytes() would have
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004510 * prevented this call. It could happen only if the operation
Gilles Peskined54931c2018-07-17 21:06:59 +02004511 * object was corrupted or if this function is called directly
4512 * inside the library. */
4513 if( hkdf->block_number == 0xff )
4514 return( PSA_ERROR_BAD_STATE );
Gilles Peskinebef7f142018-07-12 17:22:21 +02004515
4516 /* We need a new block */
4517 ++hkdf->block_number;
4518 hkdf->offset_in_block = 0;
4519 status = psa_hmac_setup_internal( &hkdf->hmac,
4520 hkdf->prk, hash_length,
4521 hash_alg );
4522 if( status != PSA_SUCCESS )
4523 return( status );
4524 if( hkdf->block_number != 1 )
4525 {
4526 status = psa_hash_update( &hkdf->hmac.hash_ctx,
4527 hkdf->output_block,
4528 hash_length );
4529 if( status != PSA_SUCCESS )
4530 return( status );
4531 }
4532 status = psa_hash_update( &hkdf->hmac.hash_ctx,
4533 hkdf->info,
4534 hkdf->info_length );
4535 if( status != PSA_SUCCESS )
4536 return( status );
4537 status = psa_hash_update( &hkdf->hmac.hash_ctx,
4538 &hkdf->block_number, 1 );
4539 if( status != PSA_SUCCESS )
4540 return( status );
4541 status = psa_hmac_finish_internal( &hkdf->hmac,
4542 hkdf->output_block,
4543 sizeof( hkdf->output_block ) );
4544 if( status != PSA_SUCCESS )
4545 return( status );
4546 }
4547
4548 return( PSA_SUCCESS );
4549}
John Durkop07cc04a2020-11-16 22:08:34 -08004550#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */
Hanno Beckerc8a41d72018-10-09 17:33:01 +01004551
John Durkop07cc04a2020-11-16 22:08:34 -08004552#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
4553 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Janos Follath7742fee2019-06-17 12:58:10 +01004554static psa_status_t psa_key_derivation_tls12_prf_generate_next_block(
4555 psa_tls12_prf_key_derivation_t *tls12_prf,
4556 psa_algorithm_t alg )
4557{
4558 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( alg );
gabor-mezei-armcbcec212020-12-18 14:23:51 +01004559 uint8_t hash_length = PSA_HASH_LENGTH( hash_alg );
Janos Follathea29bfb2019-06-19 12:21:20 +01004560 psa_hash_operation_t backup = PSA_HASH_OPERATION_INIT;
4561 psa_status_t status, cleanup_status;
Hanno Beckerc8a41d72018-10-09 17:33:01 +01004562
Janos Follath7742fee2019-06-17 12:58:10 +01004563 /* We can't be wanting more output after block 0xff, otherwise
4564 * the capacity check in psa_key_derivation_output_bytes() would have
4565 * prevented this call. It could happen only if the operation
4566 * object was corrupted or if this function is called directly
4567 * inside the library. */
4568 if( tls12_prf->block_number == 0xff )
Janos Follath30090bc2019-06-25 10:15:04 +01004569 return( PSA_ERROR_CORRUPTION_DETECTED );
Janos Follath7742fee2019-06-17 12:58:10 +01004570
4571 /* We need a new block */
4572 ++tls12_prf->block_number;
Janos Follath844eb0e2019-06-19 12:10:49 +01004573 tls12_prf->left_in_block = hash_length;
Janos Follath7742fee2019-06-17 12:58:10 +01004574
4575 /* Recall the definition of the TLS-1.2-PRF from RFC 5246:
4576 *
4577 * PRF(secret, label, seed) = P_<hash>(secret, label + seed)
4578 *
4579 * P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
4580 * HMAC_hash(secret, A(2) + seed) +
4581 * HMAC_hash(secret, A(3) + seed) + ...
4582 *
4583 * A(0) = seed
Janos Follathea29bfb2019-06-19 12:21:20 +01004584 * A(i) = HMAC_hash(secret, A(i-1))
Janos Follath7742fee2019-06-17 12:58:10 +01004585 *
Janos Follathea29bfb2019-06-19 12:21:20 +01004586 * The `psa_tls12_prf_key_derivation` structure saves the block
Janos Follath7742fee2019-06-17 12:58:10 +01004587 * `HMAC_hash(secret, A(i) + seed)` from which the output
Janos Follath76c39842019-06-26 12:50:36 +01004588 * is currently extracted as `output_block` and where i is
4589 * `block_number`.
Janos Follath7742fee2019-06-17 12:58:10 +01004590 */
4591
Janos Follathea29bfb2019-06-19 12:21:20 +01004592 /* Save the hash context before using it, to preserve the hash state with
4593 * only the inner padding in it. We need this, because inner padding depends
4594 * on the key (secret in the RFC's terminology). */
4595 status = psa_hash_clone( &tls12_prf->hmac.hash_ctx, &backup );
4596 if( status != PSA_SUCCESS )
4597 goto cleanup;
4598
4599 /* Calculate A(i) where i = tls12_prf->block_number. */
4600 if( tls12_prf->block_number == 1 )
4601 {
4602 /* A(1) = HMAC_hash(secret, A(0)), where A(0) = seed. (The RFC overloads
4603 * the variable seed and in this instance means it in the context of the
4604 * P_hash function, where seed = label + seed.) */
4605 status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
4606 tls12_prf->label, tls12_prf->label_length );
4607 if( status != PSA_SUCCESS )
4608 goto cleanup;
4609 status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
4610 tls12_prf->seed, tls12_prf->seed_length );
4611 if( status != PSA_SUCCESS )
4612 goto cleanup;
4613 }
4614 else
4615 {
4616 /* A(i) = HMAC_hash(secret, A(i-1)) */
4617 status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
4618 tls12_prf->Ai, hash_length );
4619 if( status != PSA_SUCCESS )
4620 goto cleanup;
4621 }
4622
4623 status = psa_hmac_finish_internal( &tls12_prf->hmac,
4624 tls12_prf->Ai, hash_length );
4625 if( status != PSA_SUCCESS )
4626 goto cleanup;
4627 status = psa_hash_clone( &backup, &tls12_prf->hmac.hash_ctx );
4628 if( status != PSA_SUCCESS )
4629 goto cleanup;
4630
4631 /* Calculate HMAC_hash(secret, A(i) + label + seed). */
4632 status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
4633 tls12_prf->Ai, hash_length );
4634 if( status != PSA_SUCCESS )
4635 goto cleanup;
4636 status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
4637 tls12_prf->label, tls12_prf->label_length );
4638 if( status != PSA_SUCCESS )
4639 goto cleanup;
4640 status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
4641 tls12_prf->seed, tls12_prf->seed_length );
4642 if( status != PSA_SUCCESS )
4643 goto cleanup;
4644 status = psa_hmac_finish_internal( &tls12_prf->hmac,
4645 tls12_prf->output_block, hash_length );
4646 if( status != PSA_SUCCESS )
4647 goto cleanup;
4648 status = psa_hash_clone( &backup, &tls12_prf->hmac.hash_ctx );
4649 if( status != PSA_SUCCESS )
4650 goto cleanup;
4651
Janos Follath7742fee2019-06-17 12:58:10 +01004652
4653cleanup:
4654
Janos Follathea29bfb2019-06-19 12:21:20 +01004655 cleanup_status = psa_hash_abort( &backup );
4656 if( status == PSA_SUCCESS && cleanup_status != PSA_SUCCESS )
4657 status = cleanup_status;
4658
4659 return( status );
Janos Follath7742fee2019-06-17 12:58:10 +01004660}
Hanno Beckerc8a41d72018-10-09 17:33:01 +01004661
Janos Follath844eb0e2019-06-19 12:10:49 +01004662static psa_status_t psa_key_derivation_tls12_prf_read(
4663 psa_tls12_prf_key_derivation_t *tls12_prf,
4664 psa_algorithm_t alg,
4665 uint8_t *output,
4666 size_t output_length )
4667{
4668 psa_algorithm_t hash_alg = PSA_ALG_TLS12_PRF_GET_HASH( alg );
gabor-mezei-armcbcec212020-12-18 14:23:51 +01004669 uint8_t hash_length = PSA_HASH_LENGTH( hash_alg );
Janos Follath844eb0e2019-06-19 12:10:49 +01004670 psa_status_t status;
4671 uint8_t offset, length;
4672
4673 while( output_length != 0 )
4674 {
4675 /* Check if we have fully processed the current block. */
4676 if( tls12_prf->left_in_block == 0 )
4677 {
4678 status = psa_key_derivation_tls12_prf_generate_next_block( tls12_prf,
4679 alg );
4680 if( status != PSA_SUCCESS )
4681 return( status );
4682
4683 continue;
4684 }
4685
4686 if( tls12_prf->left_in_block > output_length )
4687 length = (uint8_t) output_length;
4688 else
4689 length = tls12_prf->left_in_block;
4690
4691 offset = hash_length - tls12_prf->left_in_block;
4692 memcpy( output, tls12_prf->output_block + offset, length );
4693 output += length;
4694 output_length -= length;
4695 tls12_prf->left_in_block -= length;
4696 }
4697
4698 return( PSA_SUCCESS );
4699}
John Durkop07cc04a2020-11-16 22:08:34 -08004700#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF ||
4701 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Gilles Peskinebef7f142018-07-12 17:22:21 +02004702
Janos Follath6c6c8fc2019-06-17 12:38:20 +01004703psa_status_t psa_key_derivation_output_bytes(
4704 psa_key_derivation_operation_t *operation,
4705 uint8_t *output,
4706 size_t output_length )
Gilles Peskineeab56e42018-07-12 17:12:33 +02004707{
4708 psa_status_t status;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004709 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg( operation );
Gilles Peskineeab56e42018-07-12 17:12:33 +02004710
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004711 if( operation->alg == 0 )
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004712 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004713 /* This is a blank operation. */
Steven Cooreman29149862020-08-05 15:43:42 +02004714 return( PSA_ERROR_BAD_STATE );
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004715 }
4716
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004717 if( output_length > operation->capacity )
Gilles Peskineeab56e42018-07-12 17:12:33 +02004718 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004719 operation->capacity = 0;
Gilles Peskineeab56e42018-07-12 17:12:33 +02004720 /* Go through the error path to wipe all confidential data now
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004721 * that the operation object is useless. */
David Saadab4ecc272019-02-14 13:48:10 +02004722 status = PSA_ERROR_INSUFFICIENT_DATA;
Gilles Peskineeab56e42018-07-12 17:12:33 +02004723 goto exit;
4724 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004725 if( output_length == 0 && operation->capacity == 0 )
Gilles Peskineeab56e42018-07-12 17:12:33 +02004726 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004727 /* Edge case: this is a finished operation, and 0 bytes
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004728 * were requested. The right error in this case could
Gilles Peskineeab56e42018-07-12 17:12:33 +02004729 * be either INSUFFICIENT_CAPACITY or BAD_STATE. Return
4730 * INSUFFICIENT_CAPACITY, which is right for a finished
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004731 * operation, for consistency with the case when
Gilles Peskineeab56e42018-07-12 17:12:33 +02004732 * output_length > 0. */
David Saadab4ecc272019-02-14 13:48:10 +02004733 return( PSA_ERROR_INSUFFICIENT_DATA );
Gilles Peskineeab56e42018-07-12 17:12:33 +02004734 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004735 operation->capacity -= output_length;
Gilles Peskineeab56e42018-07-12 17:12:33 +02004736
John Durkopd0321952020-10-29 21:37:36 -07004737#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Gilles Peskine969c5d62019-01-16 15:53:06 +01004738 if( PSA_ALG_IS_HKDF( kdf_alg ) )
Gilles Peskinebef7f142018-07-12 17:22:21 +02004739 {
Gilles Peskine969c5d62019-01-16 15:53:06 +01004740 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( kdf_alg );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004741 status = psa_key_derivation_hkdf_read( &operation->ctx.hkdf, hash_alg,
Gilles Peskinebef7f142018-07-12 17:22:21 +02004742 output, output_length );
4743 }
Janos Follathadbec812019-06-14 11:05:39 +01004744 else
John Durkop07cc04a2020-11-16 22:08:34 -08004745#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */
4746#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
4747 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Janos Follathadbec812019-06-14 11:05:39 +01004748 if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
John Durkop07cc04a2020-11-16 22:08:34 -08004749 PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Hanno Beckerc8a41d72018-10-09 17:33:01 +01004750 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004751 status = psa_key_derivation_tls12_prf_read( &operation->ctx.tls12_prf,
Gilles Peskine969c5d62019-01-16 15:53:06 +01004752 kdf_alg, output,
Hanno Beckerc8a41d72018-10-09 17:33:01 +01004753 output_length );
4754 }
Gilles Peskinebef7f142018-07-12 17:22:21 +02004755 else
John Durkop07cc04a2020-11-16 22:08:34 -08004756#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF ||
4757 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Gilles Peskineeab56e42018-07-12 17:12:33 +02004758 {
Steven Cooreman74afe472021-02-10 17:19:22 +01004759 (void) kdf_alg;
Gilles Peskineeab56e42018-07-12 17:12:33 +02004760 return( PSA_ERROR_BAD_STATE );
4761 }
4762
4763exit:
4764 if( status != PSA_SUCCESS )
4765 {
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004766 /* Preserve the algorithm upon errors, but clear all sensitive state.
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004767 * This allows us to differentiate between exhausted operations and
4768 * blank operations, so we can return PSA_ERROR_BAD_STATE on blank
4769 * operations. */
4770 psa_algorithm_t alg = operation->alg;
4771 psa_key_derivation_abort( operation );
4772 operation->alg = alg;
Gilles Peskineeab56e42018-07-12 17:12:33 +02004773 memset( output, '!', output_length );
4774 }
4775 return( status );
4776}
4777
Gilles Peskine08542d82018-07-19 17:05:42 +02004778#if defined(MBEDTLS_DES_C)
4779static void psa_des_set_key_parity( uint8_t *data, size_t data_size )
4780{
4781 if( data_size >= 8 )
4782 mbedtls_des_key_set_parity( data );
4783 if( data_size >= 16 )
4784 mbedtls_des_key_set_parity( data + 8 );
4785 if( data_size >= 24 )
4786 mbedtls_des_key_set_parity( data + 16 );
4787}
4788#endif /* MBEDTLS_DES_C */
4789
Adrian L. Shaw5a5a79a2019-05-03 15:44:28 +01004790static psa_status_t psa_generate_derived_key_internal(
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004791 psa_key_slot_t *slot,
4792 size_t bits,
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004793 psa_key_derivation_operation_t *operation )
Gilles Peskineeab56e42018-07-12 17:12:33 +02004794{
4795 uint8_t *data = NULL;
4796 size_t bytes = PSA_BITS_TO_BYTES( bits );
4797 psa_status_t status;
4798
Gilles Peskine8e338702019-07-30 20:06:31 +02004799 if( ! key_type_is_raw_bytes( slot->attr.type ) )
Gilles Peskineeab56e42018-07-12 17:12:33 +02004800 return( PSA_ERROR_INVALID_ARGUMENT );
4801 if( bits % 8 != 0 )
4802 return( PSA_ERROR_INVALID_ARGUMENT );
4803 data = mbedtls_calloc( 1, bytes );
4804 if( data == NULL )
4805 return( PSA_ERROR_INSUFFICIENT_MEMORY );
4806
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004807 status = psa_key_derivation_output_bytes( operation, data, bytes );
Gilles Peskineeab56e42018-07-12 17:12:33 +02004808 if( status != PSA_SUCCESS )
4809 goto exit;
Gilles Peskine08542d82018-07-19 17:05:42 +02004810#if defined(MBEDTLS_DES_C)
Gilles Peskine8e338702019-07-30 20:06:31 +02004811 if( slot->attr.type == PSA_KEY_TYPE_DES )
Gilles Peskine08542d82018-07-19 17:05:42 +02004812 psa_des_set_key_parity( data, bytes );
4813#endif /* MBEDTLS_DES_C */
Ronald Crondd04d422020-11-28 15:14:42 +01004814
4815 status = psa_allocate_buffer_to_slot( slot, bytes );
4816 if( status != PSA_SUCCESS )
Paul Elliottda3e7db2021-02-09 18:58:20 +00004817 goto exit;
Ronald Crondd04d422020-11-28 15:14:42 +01004818
Ronald Cronbf33c932020-11-28 18:06:53 +01004819 slot->attr.bits = (psa_key_bits_t) bits;
Ronald Cron2ebfdcc2020-11-28 15:54:54 +01004820 psa_key_attributes_t attributes = {
4821 .core = slot->attr
4822 };
4823
Ronald Cronbf33c932020-11-28 18:06:53 +01004824 status = psa_driver_wrapper_import_key( &attributes,
4825 data, bytes,
4826 slot->key.data,
4827 slot->key.bytes,
4828 &slot->key.bytes, &bits );
4829 if( bits != slot->attr.bits )
4830 status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskineeab56e42018-07-12 17:12:33 +02004831
4832exit:
4833 mbedtls_free( data );
4834 return( status );
4835}
4836
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02004837psa_status_t psa_key_derivation_output_key( const psa_key_attributes_t *attributes,
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004838 psa_key_derivation_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02004839 mbedtls_svc_key_id_t *key )
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004840{
4841 psa_status_t status;
4842 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02004843 psa_se_drv_table_entry_t *driver = NULL;
Gilles Peskine0f84d622019-09-12 19:03:13 +02004844
Ronald Cron81709fc2020-11-14 12:10:32 +01004845 *key = MBEDTLS_SVC_KEY_ID_INIT;
4846
Gilles Peskine0f84d622019-09-12 19:03:13 +02004847 /* Reject any attempt to create a zero-length key so that we don't
4848 * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
4849 if( psa_get_key_bits( attributes ) == 0 )
4850 return( PSA_ERROR_INVALID_ARGUMENT );
4851
Gilles Peskine178c9aa2019-09-24 18:21:06 +02004852 if( ! operation->can_output_key )
4853 return( PSA_ERROR_NOT_PERMITTED );
4854
Ronald Cron81709fc2020-11-14 12:10:32 +01004855 status = psa_start_key_creation( PSA_KEY_CREATION_DERIVE, attributes,
4856 &slot, &driver );
Gilles Peskinef4ee6622019-07-24 13:44:30 +02004857#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
4858 if( driver != NULL )
4859 {
4860 /* Deriving a key in a secure element is not implemented yet. */
4861 status = PSA_ERROR_NOT_SUPPORTED;
4862 }
4863#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004864 if( status == PSA_SUCCESS )
4865 {
Adrian L. Shaw5a5a79a2019-05-03 15:44:28 +01004866 status = psa_generate_derived_key_internal( slot,
Gilles Peskine7e0cff92019-07-30 13:48:52 +02004867 attributes->core.bits,
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004868 operation );
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004869 }
4870 if( status == PSA_SUCCESS )
Ronald Cron81709fc2020-11-14 12:10:32 +01004871 status = psa_finish_key_creation( slot, driver, key );
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004872 if( status != PSA_SUCCESS )
Gilles Peskine011e4282019-06-26 18:34:38 +02004873 psa_fail_key_creation( slot, driver );
Ronald Cronf95a2b12020-10-22 15:24:49 +02004874
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004875 return( status );
4876}
4877
Gilles Peskineeab56e42018-07-12 17:12:33 +02004878
4879
4880/****************************************************************/
Gilles Peskineea0fb492018-07-12 17:17:20 +02004881/* Key derivation */
4882/****************************************************************/
4883
John Durkop07cc04a2020-11-16 22:08:34 -08004884#ifdef AT_LEAST_ONE_BUILTIN_KDF
Gilles Peskine969c5d62019-01-16 15:53:06 +01004885static psa_status_t psa_key_derivation_setup_kdf(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004886 psa_key_derivation_operation_t *operation,
Gilles Peskine969c5d62019-01-16 15:53:06 +01004887 psa_algorithm_t kdf_alg )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004888{
John Durkop07cc04a2020-11-16 22:08:34 -08004889 int is_kdf_alg_supported;
4890
Janos Follath5fe19732019-06-20 15:09:30 +01004891 /* Make sure that operation->ctx is properly zero-initialised. (Macro
4892 * initialisers for this union leave some bytes unspecified.) */
4893 memset( &operation->ctx, 0, sizeof( operation->ctx ) );
4894
Gilles Peskine969c5d62019-01-16 15:53:06 +01004895 /* Make sure that kdf_alg is a supported key derivation algorithm. */
John Durkopd0321952020-10-29 21:37:36 -07004896#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
John Durkop07cc04a2020-11-16 22:08:34 -08004897 if( PSA_ALG_IS_HKDF( kdf_alg ) )
4898 is_kdf_alg_supported = 1;
4899 else
4900#endif
4901#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF)
4902 if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) )
4903 is_kdf_alg_supported = 1;
4904 else
4905#endif
4906#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
4907 if( PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
4908 is_kdf_alg_supported = 1;
4909 else
4910#endif
4911 is_kdf_alg_supported = 0;
4912
4913 if( is_kdf_alg_supported )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004914 {
Gilles Peskine969c5d62019-01-16 15:53:06 +01004915 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( kdf_alg );
gabor-mezei-armcbcec212020-12-18 14:23:51 +01004916 size_t hash_size = PSA_HASH_LENGTH( hash_alg );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004917 if( hash_size == 0 )
4918 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine969c5d62019-01-16 15:53:06 +01004919 if( ( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
4920 PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) ) &&
Gilles Peskineab4b2012019-04-12 15:06:27 +02004921 ! ( hash_alg == PSA_ALG_SHA_256 || hash_alg == PSA_ALG_SHA_384 ) )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004922 {
4923 return( PSA_ERROR_NOT_SUPPORTED );
4924 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004925 operation->capacity = 255 * hash_size;
Gilles Peskine969c5d62019-01-16 15:53:06 +01004926 return( PSA_SUCCESS );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004927 }
John Durkop07cc04a2020-11-16 22:08:34 -08004928
4929 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine969c5d62019-01-16 15:53:06 +01004930}
John Durkop07cc04a2020-11-16 22:08:34 -08004931#endif /* AT_LEAST_ONE_BUILTIN_KDF */
Gilles Peskine969c5d62019-01-16 15:53:06 +01004932
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004933psa_status_t psa_key_derivation_setup( psa_key_derivation_operation_t *operation,
Gilles Peskine969c5d62019-01-16 15:53:06 +01004934 psa_algorithm_t alg )
4935{
4936 psa_status_t status;
4937
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004938 if( operation->alg != 0 )
Gilles Peskine969c5d62019-01-16 15:53:06 +01004939 return( PSA_ERROR_BAD_STATE );
4940
Gilles Peskine6843c292019-01-18 16:44:49 +01004941 if( PSA_ALG_IS_RAW_KEY_AGREEMENT( alg ) )
4942 return( PSA_ERROR_INVALID_ARGUMENT );
John Durkop07cc04a2020-11-16 22:08:34 -08004943#ifdef AT_LEAST_ONE_BUILTIN_KDF
Gilles Peskine6843c292019-01-18 16:44:49 +01004944 else if( PSA_ALG_IS_KEY_AGREEMENT( alg ) )
Gilles Peskine969c5d62019-01-16 15:53:06 +01004945 {
4946 psa_algorithm_t kdf_alg = PSA_ALG_KEY_AGREEMENT_GET_KDF( alg );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004947 status = psa_key_derivation_setup_kdf( operation, kdf_alg );
Gilles Peskine969c5d62019-01-16 15:53:06 +01004948 }
4949 else if( PSA_ALG_IS_KEY_DERIVATION( alg ) )
4950 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004951 status = psa_key_derivation_setup_kdf( operation, alg );
Gilles Peskine969c5d62019-01-16 15:53:06 +01004952 }
John Durkop07cc04a2020-11-16 22:08:34 -08004953#endif
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004954 else
4955 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine969c5d62019-01-16 15:53:06 +01004956
4957 if( status == PSA_SUCCESS )
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004958 operation->alg = alg;
Gilles Peskine969c5d62019-01-16 15:53:06 +01004959 return( status );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004960}
4961
John Durkopd0321952020-10-29 21:37:36 -07004962#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Gilles Peskinecbe66502019-05-16 16:59:18 +02004963static psa_status_t psa_hkdf_input( psa_hkdf_key_derivation_t *hkdf,
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004964 psa_algorithm_t hash_alg,
4965 psa_key_derivation_step_t step,
4966 const uint8_t *data,
4967 size_t data_length )
4968{
4969 psa_status_t status;
4970 switch( step )
4971 {
Gilles Peskine03410b52019-05-16 16:05:19 +02004972 case PSA_KEY_DERIVATION_INPUT_SALT:
Gilles Peskine2b522db2019-04-12 15:11:49 +02004973 if( hkdf->state != HKDF_STATE_INIT )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004974 return( PSA_ERROR_BAD_STATE );
Gilles Peskine2b522db2019-04-12 15:11:49 +02004975 status = psa_hmac_setup_internal( &hkdf->hmac,
4976 data, data_length,
4977 hash_alg );
4978 if( status != PSA_SUCCESS )
4979 return( status );
4980 hkdf->state = HKDF_STATE_STARTED;
4981 return( PSA_SUCCESS );
Gilles Peskine03410b52019-05-16 16:05:19 +02004982 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004983 /* If no salt was provided, use an empty salt. */
4984 if( hkdf->state == HKDF_STATE_INIT )
4985 {
4986 status = psa_hmac_setup_internal( &hkdf->hmac,
4987 NULL, 0,
Gilles Peskinef9ee6332019-04-11 21:22:52 +02004988 hash_alg );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004989 if( status != PSA_SUCCESS )
4990 return( status );
4991 hkdf->state = HKDF_STATE_STARTED;
4992 }
Gilles Peskine2b522db2019-04-12 15:11:49 +02004993 if( hkdf->state != HKDF_STATE_STARTED )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004994 return( PSA_ERROR_BAD_STATE );
Gilles Peskine2b522db2019-04-12 15:11:49 +02004995 status = psa_hash_update( &hkdf->hmac.hash_ctx,
4996 data, data_length );
4997 if( status != PSA_SUCCESS )
4998 return( status );
4999 status = psa_hmac_finish_internal( &hkdf->hmac,
5000 hkdf->prk,
5001 sizeof( hkdf->prk ) );
5002 if( status != PSA_SUCCESS )
5003 return( status );
gabor-mezei-armcbcec212020-12-18 14:23:51 +01005004 hkdf->offset_in_block = PSA_HASH_LENGTH( hash_alg );
Gilles Peskine2b522db2019-04-12 15:11:49 +02005005 hkdf->block_number = 0;
5006 hkdf->state = HKDF_STATE_KEYED;
5007 return( PSA_SUCCESS );
Gilles Peskine03410b52019-05-16 16:05:19 +02005008 case PSA_KEY_DERIVATION_INPUT_INFO:
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005009 if( hkdf->state == HKDF_STATE_OUTPUT )
5010 return( PSA_ERROR_BAD_STATE );
5011 if( hkdf->info_set )
5012 return( PSA_ERROR_BAD_STATE );
5013 hkdf->info_length = data_length;
5014 if( data_length != 0 )
5015 {
5016 hkdf->info = mbedtls_calloc( 1, data_length );
5017 if( hkdf->info == NULL )
5018 return( PSA_ERROR_INSUFFICIENT_MEMORY );
5019 memcpy( hkdf->info, data, data_length );
5020 }
5021 hkdf->info_set = 1;
5022 return( PSA_SUCCESS );
5023 default:
5024 return( PSA_ERROR_INVALID_ARGUMENT );
5025 }
5026}
John Durkop07cc04a2020-11-16 22:08:34 -08005027#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */
Janos Follathb03233e2019-06-11 15:30:30 +01005028
John Durkop07cc04a2020-11-16 22:08:34 -08005029#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
5030 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Janos Follathf08e2652019-06-13 09:05:41 +01005031static psa_status_t psa_tls12_prf_set_seed( psa_tls12_prf_key_derivation_t *prf,
5032 const uint8_t *data,
5033 size_t data_length )
5034{
Gilles Peskine43f958b2020-12-13 14:55:14 +01005035 if( prf->state != PSA_TLS12_PRF_STATE_INIT )
Janos Follathf08e2652019-06-13 09:05:41 +01005036 return( PSA_ERROR_BAD_STATE );
5037
Janos Follathd6dce9f2019-07-04 09:11:38 +01005038 if( data_length != 0 )
5039 {
5040 prf->seed = mbedtls_calloc( 1, data_length );
5041 if( prf->seed == NULL )
5042 return( PSA_ERROR_INSUFFICIENT_MEMORY );
Janos Follathf08e2652019-06-13 09:05:41 +01005043
Janos Follathd6dce9f2019-07-04 09:11:38 +01005044 memcpy( prf->seed, data, data_length );
5045 prf->seed_length = data_length;
5046 }
Janos Follathf08e2652019-06-13 09:05:41 +01005047
Gilles Peskine43f958b2020-12-13 14:55:14 +01005048 prf->state = PSA_TLS12_PRF_STATE_SEED_SET;
Janos Follathf08e2652019-06-13 09:05:41 +01005049
5050 return( PSA_SUCCESS );
5051}
5052
Janos Follath81550542019-06-13 14:26:34 +01005053static psa_status_t psa_tls12_prf_set_key( psa_tls12_prf_key_derivation_t *prf,
5054 psa_algorithm_t hash_alg,
5055 const uint8_t *data,
5056 size_t data_length )
5057{
5058 psa_status_t status;
Gilles Peskine43f958b2020-12-13 14:55:14 +01005059 if( prf->state != PSA_TLS12_PRF_STATE_SEED_SET )
Janos Follath81550542019-06-13 14:26:34 +01005060 return( PSA_ERROR_BAD_STATE );
5061
5062 status = psa_hmac_setup_internal( &prf->hmac, data, data_length, hash_alg );
5063 if( status != PSA_SUCCESS )
5064 return( status );
5065
Gilles Peskine43f958b2020-12-13 14:55:14 +01005066 prf->state = PSA_TLS12_PRF_STATE_KEY_SET;
Janos Follath81550542019-06-13 14:26:34 +01005067
5068 return( PSA_SUCCESS );
5069}
5070
Janos Follath63028dd2019-06-13 09:15:47 +01005071static psa_status_t psa_tls12_prf_set_label( psa_tls12_prf_key_derivation_t *prf,
5072 const uint8_t *data,
5073 size_t data_length )
5074{
Gilles Peskine43f958b2020-12-13 14:55:14 +01005075 if( prf->state != PSA_TLS12_PRF_STATE_KEY_SET )
Janos Follath63028dd2019-06-13 09:15:47 +01005076 return( PSA_ERROR_BAD_STATE );
5077
Janos Follathd6dce9f2019-07-04 09:11:38 +01005078 if( data_length != 0 )
5079 {
5080 prf->label = mbedtls_calloc( 1, data_length );
5081 if( prf->label == NULL )
5082 return( PSA_ERROR_INSUFFICIENT_MEMORY );
Janos Follath63028dd2019-06-13 09:15:47 +01005083
Janos Follathd6dce9f2019-07-04 09:11:38 +01005084 memcpy( prf->label, data, data_length );
5085 prf->label_length = data_length;
5086 }
Janos Follath63028dd2019-06-13 09:15:47 +01005087
Gilles Peskine43f958b2020-12-13 14:55:14 +01005088 prf->state = PSA_TLS12_PRF_STATE_LABEL_SET;
Janos Follath63028dd2019-06-13 09:15:47 +01005089
5090 return( PSA_SUCCESS );
5091}
5092
Janos Follathb03233e2019-06-11 15:30:30 +01005093static psa_status_t psa_tls12_prf_input( psa_tls12_prf_key_derivation_t *prf,
5094 psa_algorithm_t hash_alg,
5095 psa_key_derivation_step_t step,
5096 const uint8_t *data,
5097 size_t data_length )
5098{
Janos Follathb03233e2019-06-11 15:30:30 +01005099 switch( step )
5100 {
Janos Follathf08e2652019-06-13 09:05:41 +01005101 case PSA_KEY_DERIVATION_INPUT_SEED:
5102 return( psa_tls12_prf_set_seed( prf, data, data_length ) );
Janos Follath81550542019-06-13 14:26:34 +01005103 case PSA_KEY_DERIVATION_INPUT_SECRET:
5104 return( psa_tls12_prf_set_key( prf, hash_alg, data, data_length ) );
Janos Follath63028dd2019-06-13 09:15:47 +01005105 case PSA_KEY_DERIVATION_INPUT_LABEL:
5106 return( psa_tls12_prf_set_label( prf, data, data_length ) );
Janos Follathb03233e2019-06-11 15:30:30 +01005107 default:
5108 return( PSA_ERROR_INVALID_ARGUMENT );
5109 }
5110}
John Durkop07cc04a2020-11-16 22:08:34 -08005111#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) ||
5112 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
5113
5114#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
5115static psa_status_t psa_tls12_prf_psk_to_ms_set_key(
5116 psa_tls12_prf_key_derivation_t *prf,
5117 psa_algorithm_t hash_alg,
5118 const uint8_t *data,
5119 size_t data_length )
5120{
5121 psa_status_t status;
gabor-mezei-armcbcec212020-12-18 14:23:51 +01005122 uint8_t pms[ 4 + 2 * PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE ];
John Durkop07cc04a2020-11-16 22:08:34 -08005123 uint8_t *cur = pms;
5124
gabor-mezei-armcbcec212020-12-18 14:23:51 +01005125 if( data_length > PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE )
John Durkop07cc04a2020-11-16 22:08:34 -08005126 return( PSA_ERROR_INVALID_ARGUMENT );
5127
5128 /* Quoting RFC 4279, Section 2:
5129 *
5130 * The premaster secret is formed as follows: if the PSK is N octets
5131 * long, concatenate a uint16 with the value N, N zero octets, a second
5132 * uint16 with the value N, and the PSK itself.
5133 */
5134
5135 *cur++ = ( data_length >> 8 ) & 0xff;
5136 *cur++ = ( data_length >> 0 ) & 0xff;
5137 memset( cur, 0, data_length );
5138 cur += data_length;
5139 *cur++ = pms[0];
5140 *cur++ = pms[1];
5141 memcpy( cur, data, data_length );
5142 cur += data_length;
5143
5144 status = psa_tls12_prf_set_key( prf, hash_alg, pms, cur - pms );
5145
5146 mbedtls_platform_zeroize( pms, sizeof( pms ) );
5147 return( status );
5148}
Janos Follath6660f0e2019-06-17 08:44:03 +01005149
5150static psa_status_t psa_tls12_prf_psk_to_ms_input(
5151 psa_tls12_prf_key_derivation_t *prf,
5152 psa_algorithm_t hash_alg,
5153 psa_key_derivation_step_t step,
5154 const uint8_t *data,
5155 size_t data_length )
5156{
5157 if( step == PSA_KEY_DERIVATION_INPUT_SECRET )
Janos Follath0c1ed842019-06-28 13:35:36 +01005158 {
Janos Follath6660f0e2019-06-17 08:44:03 +01005159 return( psa_tls12_prf_psk_to_ms_set_key( prf, hash_alg,
5160 data, data_length ) );
Janos Follath0c1ed842019-06-28 13:35:36 +01005161 }
Janos Follath6660f0e2019-06-17 08:44:03 +01005162
5163 return( psa_tls12_prf_input( prf, hash_alg, step, data, data_length ) );
5164}
John Durkop07cc04a2020-11-16 22:08:34 -08005165#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005166
Gilles Peskineb8965192019-09-24 16:21:10 +02005167/** Check whether the given key type is acceptable for the given
5168 * input step of a key derivation.
5169 *
5170 * Secret inputs must have the type #PSA_KEY_TYPE_DERIVE.
5171 * Non-secret inputs must have the type #PSA_KEY_TYPE_RAW_DATA.
5172 * Both secret and non-secret inputs can alternatively have the type
5173 * #PSA_KEY_TYPE_NONE, which is never the type of a key object, meaning
5174 * that the input was passed as a buffer rather than via a key object.
5175 */
Gilles Peskine224b0d62019-09-23 18:13:17 +02005176static int psa_key_derivation_check_input_type(
5177 psa_key_derivation_step_t step,
5178 psa_key_type_t key_type )
5179{
5180 switch( step )
5181 {
5182 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskineb8965192019-09-24 16:21:10 +02005183 if( key_type == PSA_KEY_TYPE_DERIVE )
5184 return( PSA_SUCCESS );
5185 if( key_type == PSA_KEY_TYPE_NONE )
Gilles Peskine224b0d62019-09-23 18:13:17 +02005186 return( PSA_SUCCESS );
5187 break;
5188 case PSA_KEY_DERIVATION_INPUT_LABEL:
5189 case PSA_KEY_DERIVATION_INPUT_SALT:
5190 case PSA_KEY_DERIVATION_INPUT_INFO:
5191 case PSA_KEY_DERIVATION_INPUT_SEED:
Gilles Peskineb8965192019-09-24 16:21:10 +02005192 if( key_type == PSA_KEY_TYPE_RAW_DATA )
5193 return( PSA_SUCCESS );
5194 if( key_type == PSA_KEY_TYPE_NONE )
Gilles Peskine224b0d62019-09-23 18:13:17 +02005195 return( PSA_SUCCESS );
5196 break;
5197 }
5198 return( PSA_ERROR_INVALID_ARGUMENT );
5199}
5200
Janos Follathb80a94e2019-06-12 15:54:46 +01005201static psa_status_t psa_key_derivation_input_internal(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005202 psa_key_derivation_operation_t *operation,
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01005203 psa_key_derivation_step_t step,
Gilles Peskine224b0d62019-09-23 18:13:17 +02005204 psa_key_type_t key_type,
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01005205 const uint8_t *data,
5206 size_t data_length )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005207{
Gilles Peskine46d7faf2019-09-23 19:22:55 +02005208 psa_status_t status;
5209 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg( operation );
5210
5211 status = psa_key_derivation_check_input_type( step, key_type );
Gilles Peskine224b0d62019-09-23 18:13:17 +02005212 if( status != PSA_SUCCESS )
5213 goto exit;
5214
John Durkopd0321952020-10-29 21:37:36 -07005215#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Gilles Peskine969c5d62019-01-16 15:53:06 +01005216 if( PSA_ALG_IS_HKDF( kdf_alg ) )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005217 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005218 status = psa_hkdf_input( &operation->ctx.hkdf,
Gilles Peskine969c5d62019-01-16 15:53:06 +01005219 PSA_ALG_HKDF_GET_HASH( kdf_alg ),
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005220 step, data, data_length );
5221 }
John Durkop07cc04a2020-11-16 22:08:34 -08005222 else
5223#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */
5224#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF)
5225 if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005226 {
Janos Follathb03233e2019-06-11 15:30:30 +01005227 status = psa_tls12_prf_input( &operation->ctx.tls12_prf,
5228 PSA_ALG_HKDF_GET_HASH( kdf_alg ),
5229 step, data, data_length );
Janos Follath6660f0e2019-06-17 08:44:03 +01005230 }
John Durkop07cc04a2020-11-16 22:08:34 -08005231 else
5232#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF */
5233#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
5234 if( PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Janos Follath6660f0e2019-06-17 08:44:03 +01005235 {
5236 status = psa_tls12_prf_psk_to_ms_input( &operation->ctx.tls12_prf,
5237 PSA_ALG_HKDF_GET_HASH( kdf_alg ),
5238 step, data, data_length );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005239 }
5240 else
John Durkop07cc04a2020-11-16 22:08:34 -08005241#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005242 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005243 /* This can't happen unless the operation object was not initialized */
Steven Cooreman74afe472021-02-10 17:19:22 +01005244 (void) data;
5245 (void) data_length;
5246 (void) kdf_alg;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005247 return( PSA_ERROR_BAD_STATE );
5248 }
5249
Gilles Peskine224b0d62019-09-23 18:13:17 +02005250exit:
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005251 if( status != PSA_SUCCESS )
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005252 psa_key_derivation_abort( operation );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005253 return( status );
5254}
5255
Janos Follath51f4a0f2019-06-14 11:35:55 +01005256psa_status_t psa_key_derivation_input_bytes(
5257 psa_key_derivation_operation_t *operation,
5258 psa_key_derivation_step_t step,
5259 const uint8_t *data,
5260 size_t data_length )
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01005261{
Gilles Peskineb8965192019-09-24 16:21:10 +02005262 return( psa_key_derivation_input_internal( operation, step,
5263 PSA_KEY_TYPE_NONE,
Janos Follathc5621512019-06-14 11:27:57 +01005264 data, data_length ) );
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01005265}
5266
Janos Follath51f4a0f2019-06-14 11:35:55 +01005267psa_status_t psa_key_derivation_input_key(
5268 psa_key_derivation_operation_t *operation,
5269 psa_key_derivation_step_t step,
Ronald Croncf56a0a2020-08-04 09:51:30 +02005270 mbedtls_svc_key_id_t key )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005271{
Ronald Cronf95a2b12020-10-22 15:24:49 +02005272 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01005273 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005274 psa_key_slot_t *slot;
Gilles Peskine178c9aa2019-09-24 18:21:06 +02005275
Ronald Cron5c522922020-11-14 16:35:34 +01005276 status = psa_get_and_lock_transparent_key_slot_with_policy(
5277 key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005278 if( status != PSA_SUCCESS )
Gilles Peskine593773d2019-09-23 18:17:40 +02005279 {
5280 psa_key_derivation_abort( operation );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005281 return( status );
Gilles Peskine593773d2019-09-23 18:17:40 +02005282 }
Gilles Peskine178c9aa2019-09-24 18:21:06 +02005283
5284 /* Passing a key object as a SECRET input unlocks the permission
5285 * to output to a key object. */
5286 if( step == PSA_KEY_DERIVATION_INPUT_SECRET )
5287 operation->can_output_key = 1;
5288
Ronald Cronf95a2b12020-10-22 15:24:49 +02005289 status = psa_key_derivation_input_internal( operation,
5290 step, slot->attr.type,
Ronald Cronea0f8a62020-11-25 17:52:23 +01005291 slot->key.data,
5292 slot->key.bytes );
Ronald Cronf95a2b12020-10-22 15:24:49 +02005293
Ronald Cron5c522922020-11-14 16:35:34 +01005294 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02005295
Ronald Cron5c522922020-11-14 16:35:34 +01005296 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005297}
Gilles Peskineea0fb492018-07-12 17:17:20 +02005298
5299
5300
5301/****************************************************************/
Gilles Peskine01d718c2018-09-18 12:01:02 +02005302/* Key agreement */
5303/****************************************************************/
5304
John Durkop6ba40d12020-11-10 08:50:04 -08005305#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005306static psa_status_t psa_key_agreement_ecdh( const uint8_t *peer_key,
5307 size_t peer_key_length,
5308 const mbedtls_ecp_keypair *our_key,
5309 uint8_t *shared_secret,
5310 size_t shared_secret_size,
5311 size_t *shared_secret_length )
5312{
Steven Cooremand4867872020-08-05 16:31:39 +02005313 mbedtls_ecp_keypair *their_key = NULL;
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005314 mbedtls_ecdh_context ecdh;
Jaeden Amero97271b32019-01-10 19:38:51 +00005315 psa_status_t status;
Gilles Peskinec7ef5b32019-12-12 16:58:00 +01005316 size_t bits = 0;
Paul Elliott8ff510a2020-06-02 17:19:28 +01005317 psa_ecc_family_t curve = mbedtls_ecc_group_to_psa( our_key->grp.id, &bits );
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005318 mbedtls_ecdh_init( &ecdh );
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005319
Ronald Cron90857082020-11-25 14:58:33 +01005320 status = mbedtls_psa_ecp_load_representation(
5321 PSA_KEY_TYPE_ECC_PUBLIC_KEY(curve),
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +01005322 bits,
Ronald Cron90857082020-11-25 14:58:33 +01005323 peer_key,
5324 peer_key_length,
5325 &their_key );
Jaeden Amero97271b32019-01-10 19:38:51 +00005326 if( status != PSA_SUCCESS )
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005327 goto exit;
5328
Jaeden Amero97271b32019-01-10 19:38:51 +00005329 status = mbedtls_to_psa_error(
Steven Cooremana2371e52020-07-28 14:30:39 +02005330 mbedtls_ecdh_get_params( &ecdh, their_key, MBEDTLS_ECDH_THEIRS ) );
Jaeden Amero97271b32019-01-10 19:38:51 +00005331 if( status != PSA_SUCCESS )
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005332 goto exit;
Jaeden Amero97271b32019-01-10 19:38:51 +00005333 status = mbedtls_to_psa_error(
5334 mbedtls_ecdh_get_params( &ecdh, our_key, MBEDTLS_ECDH_OURS ) );
5335 if( status != PSA_SUCCESS )
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005336 goto exit;
5337
Jaeden Amero97271b32019-01-10 19:38:51 +00005338 status = mbedtls_to_psa_error(
5339 mbedtls_ecdh_calc_secret( &ecdh,
5340 shared_secret_length,
5341 shared_secret, shared_secret_size,
Gilles Peskine30524eb2020-11-13 17:02:26 +01005342 mbedtls_psa_get_random,
Gilles Peskine5894e8e2020-12-14 14:54:06 +01005343 MBEDTLS_PSA_RANDOM_STATE ) );
Gilles Peskinec7ef5b32019-12-12 16:58:00 +01005344 if( status != PSA_SUCCESS )
5345 goto exit;
5346 if( PSA_BITS_TO_BYTES( bits ) != *shared_secret_length )
5347 status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005348
5349exit:
Gilles Peskine3e819b72019-12-20 14:09:55 +01005350 if( status != PSA_SUCCESS )
5351 mbedtls_platform_zeroize( shared_secret, shared_secret_size );
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005352 mbedtls_ecdh_free( &ecdh );
Steven Cooremana2371e52020-07-28 14:30:39 +02005353 mbedtls_ecp_keypair_free( their_key );
Steven Cooreman6d839f02020-07-30 11:36:45 +02005354 mbedtls_free( their_key );
Steven Cooremana2371e52020-07-28 14:30:39 +02005355
Jaeden Amero97271b32019-01-10 19:38:51 +00005356 return( status );
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005357}
John Durkop6ba40d12020-11-10 08:50:04 -08005358#endif /* MBEDTLS_PSA_BUILTIN_ALG_ECDH */
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005359
Gilles Peskine01d718c2018-09-18 12:01:02 +02005360#define PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE MBEDTLS_ECP_MAX_BYTES
5361
Gilles Peskine0216fe12019-04-11 21:23:21 +02005362static psa_status_t psa_key_agreement_raw_internal( psa_algorithm_t alg,
5363 psa_key_slot_t *private_key,
5364 const uint8_t *peer_key,
5365 size_t peer_key_length,
5366 uint8_t *shared_secret,
5367 size_t shared_secret_size,
5368 size_t *shared_secret_length )
Gilles Peskine01d718c2018-09-18 12:01:02 +02005369{
Gilles Peskine0216fe12019-04-11 21:23:21 +02005370 switch( alg )
Gilles Peskine01d718c2018-09-18 12:01:02 +02005371 {
John Durkop6ba40d12020-11-10 08:50:04 -08005372#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
Gilles Peskine0216fe12019-04-11 21:23:21 +02005373 case PSA_ALG_ECDH:
Gilles Peskine8e338702019-07-30 20:06:31 +02005374 if( ! PSA_KEY_TYPE_IS_ECC_KEY_PAIR( private_key->attr.type ) )
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005375 return( PSA_ERROR_INVALID_ARGUMENT );
Steven Cooremana2371e52020-07-28 14:30:39 +02005376 mbedtls_ecp_keypair *ecp = NULL;
Ronald Cron90857082020-11-25 14:58:33 +01005377 psa_status_t status = mbedtls_psa_ecp_load_representation(
5378 private_key->attr.type,
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +01005379 private_key->attr.bits,
Ronald Cron90857082020-11-25 14:58:33 +01005380 private_key->key.data,
5381 private_key->key.bytes,
5382 &ecp );
Steven Cooremanacda8342020-07-24 23:09:52 +02005383 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02005384 return( status );
Steven Cooremanacda8342020-07-24 23:09:52 +02005385 status = psa_key_agreement_ecdh( peer_key, peer_key_length,
Steven Cooremana2371e52020-07-28 14:30:39 +02005386 ecp,
Steven Cooremanacda8342020-07-24 23:09:52 +02005387 shared_secret, shared_secret_size,
5388 shared_secret_length );
Steven Cooremana2371e52020-07-28 14:30:39 +02005389 mbedtls_ecp_keypair_free( ecp );
5390 mbedtls_free( ecp );
Steven Cooreman29149862020-08-05 15:43:42 +02005391 return( status );
John Durkop6ba40d12020-11-10 08:50:04 -08005392#endif /* MBEDTLS_PSA_BUILTIN_ALG_ECDH */
Gilles Peskine01d718c2018-09-18 12:01:02 +02005393 default:
Gilles Peskine93f85002018-11-16 16:43:31 +01005394 (void) private_key;
5395 (void) peer_key;
5396 (void) peer_key_length;
Gilles Peskine0216fe12019-04-11 21:23:21 +02005397 (void) shared_secret;
5398 (void) shared_secret_size;
5399 (void) shared_secret_length;
Gilles Peskine01d718c2018-09-18 12:01:02 +02005400 return( PSA_ERROR_NOT_SUPPORTED );
5401 }
Gilles Peskine0216fe12019-04-11 21:23:21 +02005402}
5403
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02005404/* Note that if this function fails, you must call psa_key_derivation_abort()
Gilles Peskine01d718c2018-09-18 12:01:02 +02005405 * to potentially free embedded data structures and wipe confidential data.
5406 */
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005407static psa_status_t psa_key_agreement_internal( psa_key_derivation_operation_t *operation,
Gilles Peskine969c5d62019-01-16 15:53:06 +01005408 psa_key_derivation_step_t step,
Gilles Peskine01d718c2018-09-18 12:01:02 +02005409 psa_key_slot_t *private_key,
5410 const uint8_t *peer_key,
Gilles Peskine969c5d62019-01-16 15:53:06 +01005411 size_t peer_key_length )
Gilles Peskine01d718c2018-09-18 12:01:02 +02005412{
5413 psa_status_t status;
5414 uint8_t shared_secret[PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE];
5415 size_t shared_secret_length = 0;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005416 psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE( operation->alg );
Gilles Peskine01d718c2018-09-18 12:01:02 +02005417
5418 /* Step 1: run the secret agreement algorithm to generate the shared
5419 * secret. */
Gilles Peskine0216fe12019-04-11 21:23:21 +02005420 status = psa_key_agreement_raw_internal( ka_alg,
5421 private_key,
5422 peer_key, peer_key_length,
itayzafrir0adf0fc2018-09-06 16:24:41 +03005423 shared_secret,
5424 sizeof( shared_secret ),
Gilles Peskine05d69892018-06-19 22:00:52 +02005425 &shared_secret_length );
Gilles Peskine53d991e2018-07-12 01:14:59 +02005426 if( status != PSA_SUCCESS )
Gilles Peskine12313cd2018-06-20 00:20:32 +02005427 goto exit;
5428
Gilles Peskineb0b255c2018-07-06 17:01:38 +02005429 /* Step 2: set up the key derivation to generate key material from
Gilles Peskine224b0d62019-09-23 18:13:17 +02005430 * the shared secret. A shared secret is permitted wherever a key
5431 * of type DERIVE is permitted. */
Janos Follathb80a94e2019-06-12 15:54:46 +01005432 status = psa_key_derivation_input_internal( operation, step,
Gilles Peskine224b0d62019-09-23 18:13:17 +02005433 PSA_KEY_TYPE_DERIVE,
Janos Follathb80a94e2019-06-12 15:54:46 +01005434 shared_secret,
5435 shared_secret_length );
Gilles Peskine12313cd2018-06-20 00:20:32 +02005436exit:
Gilles Peskine3f108122018-12-07 18:14:53 +01005437 mbedtls_platform_zeroize( shared_secret, shared_secret_length );
Gilles Peskine12313cd2018-06-20 00:20:32 +02005438 return( status );
5439}
5440
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005441psa_status_t psa_key_derivation_key_agreement( psa_key_derivation_operation_t *operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02005442 psa_key_derivation_step_t step,
Ronald Croncf56a0a2020-08-04 09:51:30 +02005443 mbedtls_svc_key_id_t private_key,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02005444 const uint8_t *peer_key,
5445 size_t peer_key_length )
Gilles Peskine12313cd2018-06-20 00:20:32 +02005446{
Ronald Cronf95a2b12020-10-22 15:24:49 +02005447 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01005448 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01005449 psa_key_slot_t *slot;
Ronald Cronf95a2b12020-10-22 15:24:49 +02005450
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005451 if( ! PSA_ALG_IS_KEY_AGREEMENT( operation->alg ) )
Gilles Peskine12313cd2018-06-20 00:20:32 +02005452 return( PSA_ERROR_INVALID_ARGUMENT );
Ronald Cron5c522922020-11-14 16:35:34 +01005453 status = psa_get_and_lock_transparent_key_slot_with_policy(
5454 private_key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg );
Gilles Peskine12313cd2018-06-20 00:20:32 +02005455 if( status != PSA_SUCCESS )
5456 return( status );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005457 status = psa_key_agreement_internal( operation, step,
Gilles Peskine346797d2018-11-16 16:05:06 +01005458 slot,
Gilles Peskine969c5d62019-01-16 15:53:06 +01005459 peer_key, peer_key_length );
Gilles Peskine346797d2018-11-16 16:05:06 +01005460 if( status != PSA_SUCCESS )
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005461 psa_key_derivation_abort( operation );
Steven Cooremanfa5e6312020-10-15 17:07:12 +02005462 else
5463 {
5464 /* If a private key has been added as SECRET, we allow the derived
5465 * key material to be used as a key in PSA Crypto. */
5466 if( step == PSA_KEY_DERIVATION_INPUT_SECRET )
5467 operation->can_output_key = 1;
5468 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02005469
Ronald Cron5c522922020-11-14 16:35:34 +01005470 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02005471
Ronald Cron5c522922020-11-14 16:35:34 +01005472 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskineaf3baab2018-06-27 22:55:52 +02005473}
5474
Gilles Peskinebe697d82019-05-16 18:00:41 +02005475psa_status_t psa_raw_key_agreement( psa_algorithm_t alg,
Ronald Croncf56a0a2020-08-04 09:51:30 +02005476 mbedtls_svc_key_id_t private_key,
Gilles Peskinebe697d82019-05-16 18:00:41 +02005477 const uint8_t *peer_key,
5478 size_t peer_key_length,
5479 uint8_t *output,
5480 size_t output_size,
5481 size_t *output_length )
Gilles Peskine0216fe12019-04-11 21:23:21 +02005482{
Ronald Cronf95a2b12020-10-22 15:24:49 +02005483 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01005484 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cronf95a2b12020-10-22 15:24:49 +02005485 psa_key_slot_t *slot = NULL;
Gilles Peskine0216fe12019-04-11 21:23:21 +02005486
5487 if( ! PSA_ALG_IS_KEY_AGREEMENT( alg ) )
5488 {
5489 status = PSA_ERROR_INVALID_ARGUMENT;
5490 goto exit;
5491 }
Ronald Cron5c522922020-11-14 16:35:34 +01005492 status = psa_get_and_lock_transparent_key_slot_with_policy(
5493 private_key, &slot, PSA_KEY_USAGE_DERIVE, alg );
Gilles Peskine0216fe12019-04-11 21:23:21 +02005494 if( status != PSA_SUCCESS )
5495 goto exit;
5496
5497 status = psa_key_agreement_raw_internal( alg, slot,
5498 peer_key, peer_key_length,
5499 output, output_size,
5500 output_length );
5501
5502exit:
5503 if( status != PSA_SUCCESS )
5504 {
5505 /* If an error happens and is not handled properly, the output
5506 * may be used as a key to protect sensitive data. Arrange for such
5507 * a key to be random, which is likely to result in decryption or
5508 * verification errors. This is better than filling the buffer with
5509 * some constant data such as zeros, which would result in the data
5510 * being protected with a reproducible, easily knowable key.
5511 */
5512 psa_generate_random( output, output_size );
5513 *output_length = output_size;
5514 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02005515
Ronald Cron5c522922020-11-14 16:35:34 +01005516 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02005517
Ronald Cron5c522922020-11-14 16:35:34 +01005518 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskine0216fe12019-04-11 21:23:21 +02005519}
Gilles Peskine86a440b2018-11-12 18:39:40 +01005520
5521
Gilles Peskine30524eb2020-11-13 17:02:26 +01005522
Gilles Peskine86a440b2018-11-12 18:39:40 +01005523/****************************************************************/
5524/* Random generation */
Gilles Peskine53d991e2018-07-12 01:14:59 +02005525/****************************************************************/
Gilles Peskine12313cd2018-06-20 00:20:32 +02005526
Gilles Peskine30524eb2020-11-13 17:02:26 +01005527/** Initialize the PSA random generator.
5528 */
5529static void mbedtls_psa_random_init( mbedtls_psa_random_context_t *rng )
5530{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01005531#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
5532 memset( rng, 0, sizeof( *rng ) );
5533#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
5534
Gilles Peskine30524eb2020-11-13 17:02:26 +01005535 /* Set default configuration if
5536 * mbedtls_psa_crypto_configure_entropy_sources() hasn't been called. */
5537 if( rng->entropy_init == NULL )
5538 rng->entropy_init = mbedtls_entropy_init;
5539 if( rng->entropy_free == NULL )
5540 rng->entropy_free = mbedtls_entropy_free;
5541
5542 rng->entropy_init( &rng->entropy );
5543#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \
5544 defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES)
5545 /* The PSA entropy injection feature depends on using NV seed as an entropy
5546 * source. Add NV seed as an entropy source for PSA entropy injection. */
5547 mbedtls_entropy_add_source( &rng->entropy,
5548 mbedtls_nv_seed_poll, NULL,
5549 MBEDTLS_ENTROPY_BLOCK_SIZE,
5550 MBEDTLS_ENTROPY_SOURCE_STRONG );
5551#endif
5552
Gilles Peskine5894e8e2020-12-14 14:54:06 +01005553 mbedtls_psa_drbg_init( MBEDTLS_PSA_RANDOM_STATE );
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01005554#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01005555}
5556
5557/** Deinitialize the PSA random generator.
5558 */
5559static void mbedtls_psa_random_free( mbedtls_psa_random_context_t *rng )
5560{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01005561#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
5562 memset( rng, 0, sizeof( *rng ) );
5563#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine5894e8e2020-12-14 14:54:06 +01005564 mbedtls_psa_drbg_free( MBEDTLS_PSA_RANDOM_STATE );
Gilles Peskine30524eb2020-11-13 17:02:26 +01005565 rng->entropy_free( &rng->entropy );
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01005566#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01005567}
5568
5569/** Seed the PSA random generator.
5570 */
5571static psa_status_t mbedtls_psa_random_seed( mbedtls_psa_random_context_t *rng )
5572{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01005573#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
5574 /* Do nothing: the external RNG seeds itself. */
5575 (void) rng;
5576 return( PSA_SUCCESS );
5577#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01005578 const unsigned char drbg_seed[] = "PSA";
Gilles Peskine5894e8e2020-12-14 14:54:06 +01005579 int ret = mbedtls_psa_drbg_seed( &rng->entropy,
5580 drbg_seed, sizeof( drbg_seed ) - 1 );
Gilles Peskine30524eb2020-11-13 17:02:26 +01005581 return mbedtls_to_psa_error( ret );
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01005582#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01005583}
5584
Gilles Peskinee59236f2018-01-27 23:32:46 +01005585psa_status_t psa_generate_random( uint8_t *output,
5586 size_t output_size )
5587{
Gilles Peskinee59236f2018-01-27 23:32:46 +01005588 GUARD_MODULE_INITIALIZED;
5589
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01005590#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
5591
5592 size_t output_length = 0;
5593 psa_status_t status = mbedtls_psa_external_get_random( &global_data.rng,
5594 output, output_size,
5595 &output_length );
5596 if( status != PSA_SUCCESS )
5597 return( status );
5598 /* Breaking up a request into smaller chunks is currently not supported
5599 * for the extrernal RNG interface. */
5600 if( output_length != output_size )
5601 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
5602 return( PSA_SUCCESS );
5603
5604#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
5605
Gilles Peskine71ddab92021-01-04 21:01:07 +01005606 while( output_size > 0 )
Gilles Peskinef181eca2019-08-07 13:49:00 +02005607 {
Gilles Peskine71ddab92021-01-04 21:01:07 +01005608 size_t request_size =
5609 ( output_size > MBEDTLS_PSA_RANDOM_MAX_REQUEST ?
5610 MBEDTLS_PSA_RANDOM_MAX_REQUEST :
5611 output_size );
Gilles Peskine0c59ba82021-01-05 14:10:59 +01005612 int ret = mbedtls_psa_get_random( MBEDTLS_PSA_RANDOM_STATE,
5613 output, request_size );
Gilles Peskinef181eca2019-08-07 13:49:00 +02005614 if( ret != 0 )
5615 return( mbedtls_to_psa_error( ret ) );
Gilles Peskine71ddab92021-01-04 21:01:07 +01005616 output_size -= request_size;
5617 output += request_size;
Gilles Peskinef181eca2019-08-07 13:49:00 +02005618 }
Gilles Peskine0c59ba82021-01-05 14:10:59 +01005619 return( PSA_SUCCESS );
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01005620#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskinee59236f2018-01-27 23:32:46 +01005621}
5622
Gilles Peskine8814fc42020-12-14 15:33:44 +01005623/* Wrapper function allowing the classic API to use the PSA RNG.
Gilles Peskine9c3e0602021-01-05 16:03:55 +01005624 *
5625 * `mbedtls_psa_get_random(MBEDTLS_PSA_RANDOM_STATE, ...)` calls
5626 * `psa_generate_random(...)`. The state parameter is ignored since the
5627 * PSA API doesn't support passing an explicit state.
5628 *
5629 * In the non-external case, psa_generate_random() calls an
5630 * `mbedtls_xxx_drbg_random` function which has exactly the same signature
5631 * and semantics as mbedtls_psa_get_random(). As an optimization,
5632 * instead of doing this back-and-forth between the PSA API and the
5633 * classic API, psa_crypto_random_impl.h defines `mbedtls_psa_get_random`
5634 * as a constant function pointer to `mbedtls_xxx_drbg_random`.
Gilles Peskine8814fc42020-12-14 15:33:44 +01005635 */
5636#if defined (MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
5637int mbedtls_psa_get_random( void *p_rng,
5638 unsigned char *output,
5639 size_t output_size )
5640{
Gilles Peskine9c3e0602021-01-05 16:03:55 +01005641 /* This function takes a pointer to the RNG state because that's what
5642 * classic mbedtls functions using an RNG expect. The PSA RNG manages
5643 * its own state internally and doesn't let the caller access that state.
5644 * So we just ignore the state parameter, and in practice we'll pass
5645 * NULL. */
Gilles Peskine8814fc42020-12-14 15:33:44 +01005646 (void) p_rng;
5647 psa_status_t status = psa_generate_random( output, output_size );
5648 if( status == PSA_SUCCESS )
5649 return( 0 );
5650 else
5651 return( MBEDTLS_ERR_ENTROPY_SOURCE_FAILED );
5652}
5653#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
5654
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01005655#if defined(MBEDTLS_PSA_INJECT_ENTROPY)
5656#include "mbedtls/entropy_poll.h"
5657
Gilles Peskine7228da22019-07-15 11:06:15 +02005658psa_status_t mbedtls_psa_inject_entropy( const uint8_t *seed,
Netanel Gonen2bcd3122018-11-19 11:53:02 +02005659 size_t seed_size )
5660{
Netanel Gonen2bcd3122018-11-19 11:53:02 +02005661 if( global_data.initialized )
5662 return( PSA_ERROR_NOT_PERMITTED );
Netanel Gonen21f37cb2018-11-19 11:53:55 +02005663
5664 if( ( ( seed_size < MBEDTLS_ENTROPY_MIN_PLATFORM ) ||
5665 ( seed_size < MBEDTLS_ENTROPY_BLOCK_SIZE ) ) ||
5666 ( seed_size > MBEDTLS_ENTROPY_MAX_SEED_SIZE ) )
5667 return( PSA_ERROR_INVALID_ARGUMENT );
5668
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01005669 return( mbedtls_psa_storage_inject_entropy( seed, seed_size ) );
Netanel Gonen2bcd3122018-11-19 11:53:02 +02005670}
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01005671#endif /* MBEDTLS_PSA_INJECT_ENTROPY */
Netanel Gonen2bcd3122018-11-19 11:53:02 +02005672
Ronald Cron3772afe2021-02-08 16:10:05 +01005673/** Validate the key type and size for key generation
Ronald Cron01b2aba2020-10-05 09:42:02 +02005674 *
Ronald Cron3772afe2021-02-08 16:10:05 +01005675 * \param type The key type
5676 * \param bits The number of bits of the key
Ronald Cron01b2aba2020-10-05 09:42:02 +02005677 *
5678 * \retval #PSA_SUCCESS
Ronald Cron3772afe2021-02-08 16:10:05 +01005679 * The key type and size are valid.
Ronald Cron01b2aba2020-10-05 09:42:02 +02005680 * \retval #PSA_ERROR_INVALID_ARGUMENT
5681 * The size in bits of the key is not valid.
5682 * \retval #PSA_ERROR_NOT_SUPPORTED
5683 * The type and/or the size in bits of the key or the combination of
5684 * the two is not supported.
5685 */
Ronald Cron3772afe2021-02-08 16:10:05 +01005686static psa_status_t psa_validate_key_type_and_size_for_key_generation(
5687 psa_key_type_t type, size_t bits )
Gilles Peskinee59236f2018-01-27 23:32:46 +01005688{
Ronald Cronf3bb7612020-10-02 20:11:59 +02005689 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinee59236f2018-01-27 23:32:46 +01005690
Gilles Peskinee59236f2018-01-27 23:32:46 +01005691 if( key_type_is_raw_bytes( type ) )
5692 {
Ronald Cronf3bb7612020-10-02 20:11:59 +02005693 status = validate_unstructured_key_bit_size( type, bits );
Gilles Peskinee59236f2018-01-27 23:32:46 +01005694 if( status != PSA_SUCCESS )
5695 return( status );
Ronald Cron01b2aba2020-10-05 09:42:02 +02005696 }
5697 else
Ronald Cron5c4d3862020-12-07 11:07:24 +01005698#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR)
Ronald Cron01b2aba2020-10-05 09:42:02 +02005699 if( PSA_KEY_TYPE_IS_RSA( type ) && PSA_KEY_TYPE_IS_KEY_PAIR( type ) )
5700 {
5701 if( bits > PSA_VENDOR_RSA_MAX_KEY_BITS )
5702 return( PSA_ERROR_NOT_SUPPORTED );
Steven Cooreman81be2fa2020-07-24 22:04:59 +02005703
Ronald Cron01b2aba2020-10-05 09:42:02 +02005704 /* Accept only byte-aligned keys, for the same reasons as
5705 * in psa_import_rsa_key(). */
5706 if( bits % 8 != 0 )
5707 return( PSA_ERROR_NOT_SUPPORTED );
Ronald Cron01b2aba2020-10-05 09:42:02 +02005708 }
5709 else
Ronald Cron5c4d3862020-12-07 11:07:24 +01005710#endif /* defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR) */
Ronald Cron01b2aba2020-10-05 09:42:02 +02005711
Ronald Cron5c4d3862020-12-07 11:07:24 +01005712#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR)
Ronald Cron01b2aba2020-10-05 09:42:02 +02005713 if( PSA_KEY_TYPE_IS_ECC( type ) && PSA_KEY_TYPE_IS_KEY_PAIR( type ) )
5714 {
Ronald Crond81ab562021-02-16 09:01:16 +01005715 /* To avoid empty block, return successfully here. */
5716 return( PSA_SUCCESS );
Ronald Cron01b2aba2020-10-05 09:42:02 +02005717 }
5718 else
Ronald Cron5c4d3862020-12-07 11:07:24 +01005719#endif /* defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) */
Ronald Cron01b2aba2020-10-05 09:42:02 +02005720 {
5721 return( PSA_ERROR_NOT_SUPPORTED );
5722 }
5723
5724 return( PSA_SUCCESS );
5725}
5726
Ronald Cron55ed0592020-10-05 10:30:40 +02005727psa_status_t psa_generate_key_internal(
Ronald Cron2a38a6b2020-10-02 20:02:04 +02005728 const psa_key_attributes_t *attributes,
5729 uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length )
Ronald Cron01b2aba2020-10-05 09:42:02 +02005730{
5731 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron2a38a6b2020-10-02 20:02:04 +02005732 psa_key_type_t type = attributes->core.type;
Ronald Cron01b2aba2020-10-05 09:42:02 +02005733
Ronald Cron2a38a6b2020-10-02 20:02:04 +02005734 if( ( attributes->domain_parameters == NULL ) &&
5735 ( attributes->domain_parameters_size != 0 ) )
Ronald Cron01b2aba2020-10-05 09:42:02 +02005736 return( PSA_ERROR_INVALID_ARGUMENT );
5737
Ronald Cron01b2aba2020-10-05 09:42:02 +02005738 if( key_type_is_raw_bytes( type ) )
5739 {
Ronald Cron2a38a6b2020-10-02 20:02:04 +02005740 status = psa_generate_random( key_buffer, key_buffer_size );
Gilles Peskinee59236f2018-01-27 23:32:46 +01005741 if( status != PSA_SUCCESS )
Gilles Peskinee59236f2018-01-27 23:32:46 +01005742 return( status );
Steven Cooreman81be2fa2020-07-24 22:04:59 +02005743
Gilles Peskinee59236f2018-01-27 23:32:46 +01005744#if defined(MBEDTLS_DES_C)
5745 if( type == PSA_KEY_TYPE_DES )
Ronald Cron2a38a6b2020-10-02 20:02:04 +02005746 psa_des_set_key_parity( key_buffer, key_buffer_size );
Gilles Peskinee59236f2018-01-27 23:32:46 +01005747#endif /* MBEDTLS_DES_C */
5748 }
5749 else
5750
John Durkop07cc04a2020-11-16 22:08:34 -08005751#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR)
Gilles Peskinec93b80c2019-05-16 19:39:54 +02005752 if ( type == PSA_KEY_TYPE_RSA_KEY_PAIR )
Gilles Peskinee59236f2018-01-27 23:32:46 +01005753 {
Ronald Cron9e18fc12020-11-05 17:36:40 +01005754 return( mbedtls_psa_rsa_generate_key( attributes,
5755 key_buffer,
5756 key_buffer_size,
5757 key_buffer_length ) );
Gilles Peskinee59236f2018-01-27 23:32:46 +01005758 }
5759 else
John Durkop07cc04a2020-11-16 22:08:34 -08005760#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) */
Gilles Peskinee59236f2018-01-27 23:32:46 +01005761
John Durkop9814fa22020-11-04 12:28:15 -08005762#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR)
Gilles Peskinec93b80c2019-05-16 19:39:54 +02005763 if ( PSA_KEY_TYPE_IS_ECC( type ) && PSA_KEY_TYPE_IS_KEY_PAIR( type ) )
Gilles Peskinee59236f2018-01-27 23:32:46 +01005764 {
Ronald Cron7023db52020-11-20 18:17:42 +01005765 return( mbedtls_psa_ecp_generate_key( attributes,
5766 key_buffer,
5767 key_buffer_size,
5768 key_buffer_length ) );
Gilles Peskinee59236f2018-01-27 23:32:46 +01005769 }
5770 else
John Durkop9814fa22020-11-04 12:28:15 -08005771#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) */
Steven Cooreman29149862020-08-05 15:43:42 +02005772 {
Ronald Cron2a38a6b2020-10-02 20:02:04 +02005773 (void)key_buffer_length;
Gilles Peskinee59236f2018-01-27 23:32:46 +01005774 return( PSA_ERROR_NOT_SUPPORTED );
Steven Cooreman29149862020-08-05 15:43:42 +02005775 }
Gilles Peskinee59236f2018-01-27 23:32:46 +01005776
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005777 return( PSA_SUCCESS );
5778}
Darryl Green0c6575a2018-11-07 16:05:30 +00005779
Gilles Peskine35ef36b2019-05-16 19:42:05 +02005780psa_status_t psa_generate_key( const psa_key_attributes_t *attributes,
Ronald Croncf56a0a2020-08-04 09:51:30 +02005781 mbedtls_svc_key_id_t *key )
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005782{
5783 psa_status_t status;
5784 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02005785 psa_se_drv_table_entry_t *driver = NULL;
Ronald Cron2b56bc82020-10-05 10:02:26 +02005786 size_t key_buffer_size;
Gilles Peskine11792082019-08-06 18:36:36 +02005787
Ronald Cron81709fc2020-11-14 12:10:32 +01005788 *key = MBEDTLS_SVC_KEY_ID_INIT;
5789
Gilles Peskine0f84d622019-09-12 19:03:13 +02005790 /* Reject any attempt to create a zero-length key so that we don't
5791 * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
5792 if( psa_get_key_bits( attributes ) == 0 )
5793 return( PSA_ERROR_INVALID_ARGUMENT );
5794
Ronald Cron81709fc2020-11-14 12:10:32 +01005795 status = psa_start_key_creation( PSA_KEY_CREATION_GENERATE, attributes,
5796 &slot, &driver );
Gilles Peskine11792082019-08-06 18:36:36 +02005797 if( status != PSA_SUCCESS )
5798 goto exit;
5799
Ronald Cron977c2472020-10-13 08:32:21 +02005800 /* In the case of a transparent key or an opaque key stored in local
5801 * storage (thus not in the case of generating a key in a secure element
5802 * or cryptoprocessor with storage), we have to allocate a buffer to
5803 * hold the generated key material. */
5804 if( slot->key.data == NULL )
5805 {
5806 if ( PSA_KEY_LIFETIME_GET_LOCATION( attributes->core.lifetime ) ==
5807 PSA_KEY_LOCATION_LOCAL_STORAGE )
5808 {
Ronald Cron3772afe2021-02-08 16:10:05 +01005809 status = psa_validate_key_type_and_size_for_key_generation(
5810 attributes->core.type, attributes->core.bits );
5811 if( status != PSA_SUCCESS )
5812 goto exit;
5813
5814 key_buffer_size = PSA_EXPORT_KEY_OUTPUT_SIZE(
5815 attributes->core.type,
5816 attributes->core.bits );
Ronald Cron977c2472020-10-13 08:32:21 +02005817 }
5818 else
5819 {
5820 status = psa_driver_wrapper_get_key_buffer_size(
5821 attributes, &key_buffer_size );
Ronald Cron3772afe2021-02-08 16:10:05 +01005822 if( status != PSA_SUCCESS )
5823 goto exit;
Ronald Cron977c2472020-10-13 08:32:21 +02005824 }
Ronald Cron977c2472020-10-13 08:32:21 +02005825
5826 status = psa_allocate_buffer_to_slot( slot, key_buffer_size );
5827 if( status != PSA_SUCCESS )
5828 goto exit;
5829 }
5830
Steven Cooreman2a1664c2020-07-20 15:33:08 +02005831 status = psa_driver_wrapper_generate_key( attributes,
Ronald Cron977c2472020-10-13 08:32:21 +02005832 slot->key.data, slot->key.bytes, &slot->key.bytes );
Gilles Peskine11792082019-08-06 18:36:36 +02005833
Ronald Cron2b56bc82020-10-05 10:02:26 +02005834 if( status != PSA_SUCCESS )
5835 psa_remove_key_data_from_memory( slot );
5836
Gilles Peskine11792082019-08-06 18:36:36 +02005837exit:
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005838 if( status == PSA_SUCCESS )
Ronald Cron81709fc2020-11-14 12:10:32 +01005839 status = psa_finish_key_creation( slot, driver, key );
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005840 if( status != PSA_SUCCESS )
Gilles Peskine011e4282019-06-26 18:34:38 +02005841 psa_fail_key_creation( slot, driver );
Ronald Cronf95a2b12020-10-22 15:24:49 +02005842
Darryl Green0c6575a2018-11-07 16:05:30 +00005843 return( status );
Gilles Peskinee59236f2018-01-27 23:32:46 +01005844}
5845
Gilles Peskinee59236f2018-01-27 23:32:46 +01005846/****************************************************************/
5847/* Module setup */
5848/****************************************************************/
5849
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01005850#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
Gilles Peskine5e769522018-11-20 21:59:56 +01005851psa_status_t mbedtls_psa_crypto_configure_entropy_sources(
5852 void (* entropy_init )( mbedtls_entropy_context *ctx ),
5853 void (* entropy_free )( mbedtls_entropy_context *ctx ) )
5854{
5855 if( global_data.rng_state != RNG_NOT_INITIALIZED )
5856 return( PSA_ERROR_BAD_STATE );
Gilles Peskine30524eb2020-11-13 17:02:26 +01005857 global_data.rng.entropy_init = entropy_init;
5858 global_data.rng.entropy_free = entropy_free;
Gilles Peskine5e769522018-11-20 21:59:56 +01005859 return( PSA_SUCCESS );
5860}
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01005861#endif /* !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) */
Gilles Peskine5e769522018-11-20 21:59:56 +01005862
Gilles Peskinee59236f2018-01-27 23:32:46 +01005863void mbedtls_psa_crypto_free( void )
5864{
Gilles Peskine66fb1262018-12-10 16:29:04 +01005865 psa_wipe_all_key_slots( );
Gilles Peskinec6b69072018-11-20 21:42:52 +01005866 if( global_data.rng_state != RNG_NOT_INITIALIZED )
5867 {
Gilles Peskine30524eb2020-11-13 17:02:26 +01005868 mbedtls_psa_random_free( &global_data.rng );
Gilles Peskinec6b69072018-11-20 21:42:52 +01005869 }
5870 /* Wipe all remaining data, including configuration.
5871 * In particular, this sets all state indicator to the value
5872 * indicating "uninitialized". */
Gilles Peskine3f108122018-12-07 18:14:53 +01005873 mbedtls_platform_zeroize( &global_data, sizeof( global_data ) );
Gilles Peskinea8ade162019-06-26 11:24:49 +02005874#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined0890212019-06-24 14:34:43 +02005875 /* Unregister all secure element drivers, so that we restart from
5876 * a pristine state. */
5877 psa_unregister_all_se_drivers( );
Gilles Peskinea8ade162019-06-26 11:24:49 +02005878#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskinee59236f2018-01-27 23:32:46 +01005879}
5880
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02005881#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
5882/** Recover a transaction that was interrupted by a power failure.
5883 *
5884 * This function is called during initialization, before psa_crypto_init()
5885 * returns. If this function returns a failure status, the initialization
5886 * fails.
5887 */
5888static psa_status_t psa_crypto_recover_transaction(
5889 const psa_crypto_transaction_t *transaction )
5890{
5891 switch( transaction->unknown.type )
5892 {
5893 case PSA_CRYPTO_TRANSACTION_CREATE_KEY:
5894 case PSA_CRYPTO_TRANSACTION_DESTROY_KEY:
Janos Follath1d57a202019-08-13 12:15:34 +01005895 /* TODO - fall through to the failure case until this
Gilles Peskinec9d7f942019-08-13 16:17:16 +02005896 * is implemented.
5897 * https://github.com/ARMmbed/mbed-crypto/issues/218
5898 */
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02005899 default:
5900 /* We found an unsupported transaction in the storage.
5901 * We don't know what state the storage is in. Give up. */
gabor-mezei-armfe309242020-11-09 17:39:56 +01005902 return( PSA_ERROR_DATA_INVALID );
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02005903 }
5904}
5905#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
5906
Gilles Peskinee59236f2018-01-27 23:32:46 +01005907psa_status_t psa_crypto_init( void )
5908{
Gilles Peskine66fb1262018-12-10 16:29:04 +01005909 psa_status_t status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01005910
Gilles Peskinec6b69072018-11-20 21:42:52 +01005911 /* Double initialization is explicitly allowed. */
Gilles Peskinee59236f2018-01-27 23:32:46 +01005912 if( global_data.initialized != 0 )
5913 return( PSA_SUCCESS );
5914
Gilles Peskine30524eb2020-11-13 17:02:26 +01005915 /* Initialize and seed the random generator. */
5916 mbedtls_psa_random_init( &global_data.rng );
Gilles Peskinec6b69072018-11-20 21:42:52 +01005917 global_data.rng_state = RNG_INITIALIZED;
Gilles Peskine30524eb2020-11-13 17:02:26 +01005918 status = mbedtls_psa_random_seed( &global_data.rng );
Gilles Peskine66fb1262018-12-10 16:29:04 +01005919 if( status != PSA_SUCCESS )
Gilles Peskinee59236f2018-01-27 23:32:46 +01005920 goto exit;
Gilles Peskinec6b69072018-11-20 21:42:52 +01005921 global_data.rng_state = RNG_SEEDED;
Gilles Peskinee59236f2018-01-27 23:32:46 +01005922
Gilles Peskine66fb1262018-12-10 16:29:04 +01005923 status = psa_initialize_key_slots( );
5924 if( status != PSA_SUCCESS )
5925 goto exit;
Gilles Peskinec6b69072018-11-20 21:42:52 +01005926
Gilles Peskined9348f22019-10-01 15:22:29 +02005927#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
5928 status = psa_init_all_se_drivers( );
5929 if( status != PSA_SUCCESS )
5930 goto exit;
5931#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
5932
Gilles Peskine4b734222019-07-24 15:56:31 +02005933#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
Gilles Peskinefc762652019-07-22 19:30:34 +02005934 status = psa_crypto_load_transaction( );
5935 if( status == PSA_SUCCESS )
5936 {
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02005937 status = psa_crypto_recover_transaction( &psa_crypto_transaction );
5938 if( status != PSA_SUCCESS )
5939 goto exit;
5940 status = psa_crypto_stop_transaction( );
Gilles Peskinefc762652019-07-22 19:30:34 +02005941 }
5942 else if( status == PSA_ERROR_DOES_NOT_EXIST )
5943 {
5944 /* There's no transaction to complete. It's all good. */
5945 status = PSA_SUCCESS;
5946 }
Gilles Peskine4b734222019-07-24 15:56:31 +02005947#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
Gilles Peskinefc762652019-07-22 19:30:34 +02005948
Gilles Peskinec6b69072018-11-20 21:42:52 +01005949 /* All done. */
Gilles Peskinee59236f2018-01-27 23:32:46 +01005950 global_data.initialized = 1;
5951
5952exit:
Gilles Peskine66fb1262018-12-10 16:29:04 +01005953 if( status != PSA_SUCCESS )
Gilles Peskinee59236f2018-01-27 23:32:46 +01005954 mbedtls_psa_crypto_free( );
Gilles Peskine66fb1262018-12-10 16:29:04 +01005955 return( status );
Gilles Peskinee59236f2018-01-27 23:32:46 +01005956}
5957
5958#endif /* MBEDTLS_PSA_CRYPTO_C */