blob: 6b259030bc34a73baef5f91efe63a2011b296eeb [file] [log] [blame]
Gilles Peskinee59236f2018-01-27 23:32:46 +01001/*
2 * PSA crypto layer on top of Mbed TLS crypto
3 */
Bence Szépkúti86974652020-06-15 11:59:37 +02004/*
Bence Szépkúti1e148272020-08-07 13:07:28 +02005 * Copyright The Mbed TLS Contributors
Gilles Peskinee59236f2018-01-27 23:32:46 +01006 * SPDX-License-Identifier: Apache-2.0
7 *
8 * Licensed under the Apache License, Version 2.0 (the "License"); you may
9 * not use this file except in compliance with the License.
10 * You may obtain a copy of the License at
11 *
12 * http://www.apache.org/licenses/LICENSE-2.0
13 *
14 * Unless required by applicable law or agreed to in writing, software
15 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
16 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17 * See the License for the specific language governing permissions and
18 * limitations under the License.
Gilles Peskinee59236f2018-01-27 23:32:46 +010019 */
20
Gilles Peskinedb09ef62020-06-03 01:43:33 +020021#include "common.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010022
23#if defined(MBEDTLS_PSA_CRYPTO_C)
mohammad160327010052018-07-03 13:16:15 +030024
itayzafrir7723ab12019-02-14 10:28:02 +020025#include "psa_crypto_service_integration.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010026#include "psa/crypto.h"
27
Gilles Peskine039b90c2018-12-07 18:24:41 +010028#include "psa_crypto_core.h"
Gilles Peskine5e769522018-11-20 21:59:56 +010029#include "psa_crypto_invasive.h"
Steven Cooremancd84cb42020-07-16 20:28:36 +020030#include "psa_crypto_driver_wrappers.h"
Gilles Peskinea8ade162019-06-26 11:24:49 +020031#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined0890212019-06-24 14:34:43 +020032#include "psa_crypto_se.h"
Gilles Peskinea8ade162019-06-26 11:24:49 +020033#endif
Gilles Peskine961849f2018-11-30 18:54:54 +010034#include "psa_crypto_slot_management.h"
Darryl Greend49a4992018-06-18 17:27:26 +010035/* Include internal declarations that are useful for implementing persistently
36 * stored keys. */
37#include "psa_crypto_storage.h"
38
Gilles Peskineb46bef22019-07-30 21:32:04 +020039#include <assert.h>
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010040#include <stdlib.h>
41#include <string.h>
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010042#include "mbedtls/platform.h"
Gilles Peskineff2d2002019-05-06 15:26:23 +020043#if !defined(MBEDTLS_PLATFORM_C)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010044#define mbedtls_calloc calloc
45#define mbedtls_free free
46#endif
47
Gilles Peskinea5905292018-02-07 20:59:33 +010048#include "mbedtls/arc4.h"
Gilles Peskine9a944802018-06-21 09:35:35 +020049#include "mbedtls/asn1.h"
Jaeden Amero25384a22019-01-10 10:23:21 +000050#include "mbedtls/asn1write.h"
Gilles Peskinea81d85b2018-06-26 16:10:23 +020051#include "mbedtls/bignum.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010052#include "mbedtls/blowfish.h"
53#include "mbedtls/camellia.h"
Gilles Peskine26869f22019-05-06 15:25:00 +020054#include "mbedtls/chacha20.h"
55#include "mbedtls/chachapoly.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010056#include "mbedtls/cipher.h"
57#include "mbedtls/ccm.h"
58#include "mbedtls/cmac.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010059#include "mbedtls/ctr_drbg.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010060#include "mbedtls/des.h"
Gilles Peskineb7ecdf02018-09-18 12:11:27 +020061#include "mbedtls/ecdh.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010062#include "mbedtls/ecp.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010063#include "mbedtls/entropy.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010064#include "mbedtls/error.h"
65#include "mbedtls/gcm.h"
66#include "mbedtls/md2.h"
67#include "mbedtls/md4.h"
68#include "mbedtls/md5.h"
Gilles Peskine20035e32018-02-03 22:44:14 +010069#include "mbedtls/md.h"
70#include "mbedtls/md_internal.h"
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010071#include "mbedtls/pk.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010072#include "mbedtls/pk_internal.h"
Gilles Peskine3f108122018-12-07 18:14:53 +010073#include "mbedtls/platform_util.h"
Janos Follath24eed8d2019-11-22 13:21:35 +000074#include "mbedtls/error.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010075#include "mbedtls/ripemd160.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010076#include "mbedtls/rsa.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010077#include "mbedtls/sha1.h"
78#include "mbedtls/sha256.h"
79#include "mbedtls/sha512.h"
80#include "mbedtls/xtea.h"
81
Gilles Peskine996deb12018-08-01 15:45:45 +020082#define ARRAY_LENGTH( array ) ( sizeof( array ) / sizeof( *( array ) ) )
83
Gilles Peskine9ef733f2018-02-07 21:05:37 +010084/* constant-time buffer comparison */
85static inline int safer_memcmp( const uint8_t *a, const uint8_t *b, size_t n )
86{
87 size_t i;
88 unsigned char diff = 0;
89
90 for( i = 0; i < n; i++ )
91 diff |= a[i] ^ b[i];
92
93 return( diff );
94}
95
96
97
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010098/****************************************************************/
99/* Global data, support functions and library management */
100/****************************************************************/
101
Gilles Peskine48c0ea12018-06-21 14:15:31 +0200102static int key_type_is_raw_bytes( psa_key_type_t type )
103{
Gilles Peskine78b3bb62018-08-10 16:03:41 +0200104 return( PSA_KEY_TYPE_IS_UNSTRUCTURED( type ) );
Gilles Peskine48c0ea12018-06-21 14:15:31 +0200105}
106
Gilles Peskine5a3c50e2018-12-04 12:27:09 +0100107/* Values for psa_global_data_t::rng_state */
108#define RNG_NOT_INITIALIZED 0
109#define RNG_INITIALIZED 1
110#define RNG_SEEDED 2
Gilles Peskinec6b69072018-11-20 21:42:52 +0100111
Gilles Peskine2d277862018-06-18 15:41:12 +0200112typedef struct
113{
Gilles Peskine5e769522018-11-20 21:59:56 +0100114 void (* entropy_init )( mbedtls_entropy_context *ctx );
115 void (* entropy_free )( mbedtls_entropy_context *ctx );
Gilles Peskinee59236f2018-01-27 23:32:46 +0100116 mbedtls_entropy_context entropy;
117 mbedtls_ctr_drbg_context ctr_drbg;
Gilles Peskinec6b69072018-11-20 21:42:52 +0100118 unsigned initialized : 1;
Gilles Peskine5a3c50e2018-12-04 12:27:09 +0100119 unsigned rng_state : 2;
Gilles Peskinee59236f2018-01-27 23:32:46 +0100120} psa_global_data_t;
121
122static psa_global_data_t global_data;
123
itayzafrir0adf0fc2018-09-06 16:24:41 +0300124#define GUARD_MODULE_INITIALIZED \
125 if( global_data.initialized == 0 ) \
126 return( PSA_ERROR_BAD_STATE );
127
Steven Cooreman01164162020-07-20 15:31:37 +0200128psa_status_t mbedtls_to_psa_error( int ret )
Gilles Peskinee59236f2018-01-27 23:32:46 +0100129{
Gilles Peskinea5905292018-02-07 20:59:33 +0100130 /* If there's both a high-level code and low-level code, dispatch on
131 * the high-level code. */
132 switch( ret < -0x7f ? - ( -ret & 0x7f80 ) : ret )
Gilles Peskinee59236f2018-01-27 23:32:46 +0100133 {
134 case 0:
135 return( PSA_SUCCESS );
Gilles Peskinea5905292018-02-07 20:59:33 +0100136
137 case MBEDTLS_ERR_AES_INVALID_KEY_LENGTH:
138 case MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH:
139 case MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE:
140 return( PSA_ERROR_NOT_SUPPORTED );
141 case MBEDTLS_ERR_AES_HW_ACCEL_FAILED:
142 return( PSA_ERROR_HARDWARE_FAILURE );
143
144 case MBEDTLS_ERR_ARC4_HW_ACCEL_FAILED:
145 return( PSA_ERROR_HARDWARE_FAILURE );
146
Gilles Peskine9a944802018-06-21 09:35:35 +0200147 case MBEDTLS_ERR_ASN1_OUT_OF_DATA:
148 case MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:
149 case MBEDTLS_ERR_ASN1_INVALID_LENGTH:
150 case MBEDTLS_ERR_ASN1_LENGTH_MISMATCH:
151 case MBEDTLS_ERR_ASN1_INVALID_DATA:
152 return( PSA_ERROR_INVALID_ARGUMENT );
153 case MBEDTLS_ERR_ASN1_ALLOC_FAILED:
154 return( PSA_ERROR_INSUFFICIENT_MEMORY );
155 case MBEDTLS_ERR_ASN1_BUF_TOO_SMALL:
156 return( PSA_ERROR_BUFFER_TOO_SMALL );
157
Jaeden Amero93e21112019-02-20 13:57:28 +0000158#if defined(MBEDTLS_ERR_BLOWFISH_BAD_INPUT_DATA)
Jaeden Amero892cd6d2019-02-11 12:21:12 +0000159 case MBEDTLS_ERR_BLOWFISH_BAD_INPUT_DATA:
Jaeden Amero93e21112019-02-20 13:57:28 +0000160#elif defined(MBEDTLS_ERR_BLOWFISH_INVALID_KEY_LENGTH)
161 case MBEDTLS_ERR_BLOWFISH_INVALID_KEY_LENGTH:
162#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100163 case MBEDTLS_ERR_BLOWFISH_INVALID_INPUT_LENGTH:
164 return( PSA_ERROR_NOT_SUPPORTED );
165 case MBEDTLS_ERR_BLOWFISH_HW_ACCEL_FAILED:
166 return( PSA_ERROR_HARDWARE_FAILURE );
167
Jaeden Amero93e21112019-02-20 13:57:28 +0000168#if defined(MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA)
Jaeden Amero892cd6d2019-02-11 12:21:12 +0000169 case MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA:
Jaeden Amero93e21112019-02-20 13:57:28 +0000170#elif defined(MBEDTLS_ERR_CAMELLIA_INVALID_KEY_LENGTH)
171 case MBEDTLS_ERR_CAMELLIA_INVALID_KEY_LENGTH:
172#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100173 case MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH:
174 return( PSA_ERROR_NOT_SUPPORTED );
175 case MBEDTLS_ERR_CAMELLIA_HW_ACCEL_FAILED:
176 return( PSA_ERROR_HARDWARE_FAILURE );
177
178 case MBEDTLS_ERR_CCM_BAD_INPUT:
179 return( PSA_ERROR_INVALID_ARGUMENT );
180 case MBEDTLS_ERR_CCM_AUTH_FAILED:
181 return( PSA_ERROR_INVALID_SIGNATURE );
182 case MBEDTLS_ERR_CCM_HW_ACCEL_FAILED:
183 return( PSA_ERROR_HARDWARE_FAILURE );
184
Gilles Peskine26869f22019-05-06 15:25:00 +0200185 case MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA:
186 return( PSA_ERROR_INVALID_ARGUMENT );
187
188 case MBEDTLS_ERR_CHACHAPOLY_BAD_STATE:
189 return( PSA_ERROR_BAD_STATE );
190 case MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED:
191 return( PSA_ERROR_INVALID_SIGNATURE );
192
Gilles Peskinea5905292018-02-07 20:59:33 +0100193 case MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE:
194 return( PSA_ERROR_NOT_SUPPORTED );
195 case MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA:
196 return( PSA_ERROR_INVALID_ARGUMENT );
197 case MBEDTLS_ERR_CIPHER_ALLOC_FAILED:
198 return( PSA_ERROR_INSUFFICIENT_MEMORY );
199 case MBEDTLS_ERR_CIPHER_INVALID_PADDING:
200 return( PSA_ERROR_INVALID_PADDING );
201 case MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED:
202 return( PSA_ERROR_BAD_STATE );
203 case MBEDTLS_ERR_CIPHER_AUTH_FAILED:
204 return( PSA_ERROR_INVALID_SIGNATURE );
205 case MBEDTLS_ERR_CIPHER_INVALID_CONTEXT:
Gilles Peskine4b3eb692019-05-16 21:35:18 +0200206 return( PSA_ERROR_CORRUPTION_DETECTED );
Gilles Peskinea5905292018-02-07 20:59:33 +0100207 case MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED:
208 return( PSA_ERROR_HARDWARE_FAILURE );
209
210 case MBEDTLS_ERR_CMAC_HW_ACCEL_FAILED:
211 return( PSA_ERROR_HARDWARE_FAILURE );
212
213 case MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED:
214 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
215 case MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG:
216 case MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG:
217 return( PSA_ERROR_NOT_SUPPORTED );
218 case MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR:
219 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
220
221 case MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH:
222 return( PSA_ERROR_NOT_SUPPORTED );
223 case MBEDTLS_ERR_DES_HW_ACCEL_FAILED:
224 return( PSA_ERROR_HARDWARE_FAILURE );
225
Gilles Peskinee59236f2018-01-27 23:32:46 +0100226 case MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED:
227 case MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE:
228 case MBEDTLS_ERR_ENTROPY_SOURCE_FAILED:
229 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
Gilles Peskinea5905292018-02-07 20:59:33 +0100230
231 case MBEDTLS_ERR_GCM_AUTH_FAILED:
232 return( PSA_ERROR_INVALID_SIGNATURE );
233 case MBEDTLS_ERR_GCM_BAD_INPUT:
Gilles Peskine8cac2e62018-08-21 15:07:38 +0200234 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskinea5905292018-02-07 20:59:33 +0100235 case MBEDTLS_ERR_GCM_HW_ACCEL_FAILED:
236 return( PSA_ERROR_HARDWARE_FAILURE );
237
238 case MBEDTLS_ERR_MD2_HW_ACCEL_FAILED:
239 case MBEDTLS_ERR_MD4_HW_ACCEL_FAILED:
240 case MBEDTLS_ERR_MD5_HW_ACCEL_FAILED:
241 return( PSA_ERROR_HARDWARE_FAILURE );
242
243 case MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE:
244 return( PSA_ERROR_NOT_SUPPORTED );
245 case MBEDTLS_ERR_MD_BAD_INPUT_DATA:
246 return( PSA_ERROR_INVALID_ARGUMENT );
247 case MBEDTLS_ERR_MD_ALLOC_FAILED:
248 return( PSA_ERROR_INSUFFICIENT_MEMORY );
249 case MBEDTLS_ERR_MD_FILE_IO_ERROR:
250 return( PSA_ERROR_STORAGE_FAILURE );
251 case MBEDTLS_ERR_MD_HW_ACCEL_FAILED:
252 return( PSA_ERROR_HARDWARE_FAILURE );
253
Gilles Peskinef76aa772018-10-29 19:24:33 +0100254 case MBEDTLS_ERR_MPI_FILE_IO_ERROR:
255 return( PSA_ERROR_STORAGE_FAILURE );
256 case MBEDTLS_ERR_MPI_BAD_INPUT_DATA:
257 return( PSA_ERROR_INVALID_ARGUMENT );
258 case MBEDTLS_ERR_MPI_INVALID_CHARACTER:
259 return( PSA_ERROR_INVALID_ARGUMENT );
260 case MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL:
261 return( PSA_ERROR_BUFFER_TOO_SMALL );
262 case MBEDTLS_ERR_MPI_NEGATIVE_VALUE:
263 return( PSA_ERROR_INVALID_ARGUMENT );
264 case MBEDTLS_ERR_MPI_DIVISION_BY_ZERO:
265 return( PSA_ERROR_INVALID_ARGUMENT );
266 case MBEDTLS_ERR_MPI_NOT_ACCEPTABLE:
267 return( PSA_ERROR_INVALID_ARGUMENT );
268 case MBEDTLS_ERR_MPI_ALLOC_FAILED:
269 return( PSA_ERROR_INSUFFICIENT_MEMORY );
270
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100271 case MBEDTLS_ERR_PK_ALLOC_FAILED:
272 return( PSA_ERROR_INSUFFICIENT_MEMORY );
273 case MBEDTLS_ERR_PK_TYPE_MISMATCH:
274 case MBEDTLS_ERR_PK_BAD_INPUT_DATA:
275 return( PSA_ERROR_INVALID_ARGUMENT );
276 case MBEDTLS_ERR_PK_FILE_IO_ERROR:
Gilles Peskinea5905292018-02-07 20:59:33 +0100277 return( PSA_ERROR_STORAGE_FAILURE );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100278 case MBEDTLS_ERR_PK_KEY_INVALID_VERSION:
279 case MBEDTLS_ERR_PK_KEY_INVALID_FORMAT:
280 return( PSA_ERROR_INVALID_ARGUMENT );
281 case MBEDTLS_ERR_PK_UNKNOWN_PK_ALG:
282 return( PSA_ERROR_NOT_SUPPORTED );
283 case MBEDTLS_ERR_PK_PASSWORD_REQUIRED:
284 case MBEDTLS_ERR_PK_PASSWORD_MISMATCH:
285 return( PSA_ERROR_NOT_PERMITTED );
286 case MBEDTLS_ERR_PK_INVALID_PUBKEY:
287 return( PSA_ERROR_INVALID_ARGUMENT );
288 case MBEDTLS_ERR_PK_INVALID_ALG:
289 case MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE:
290 case MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE:
291 return( PSA_ERROR_NOT_SUPPORTED );
292 case MBEDTLS_ERR_PK_SIG_LEN_MISMATCH:
293 return( PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskinea5905292018-02-07 20:59:33 +0100294 case MBEDTLS_ERR_PK_HW_ACCEL_FAILED:
295 return( PSA_ERROR_HARDWARE_FAILURE );
296
Gilles Peskineff2d2002019-05-06 15:26:23 +0200297 case MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED:
298 return( PSA_ERROR_HARDWARE_FAILURE );
299 case MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
300 return( PSA_ERROR_NOT_SUPPORTED );
301
Gilles Peskinea5905292018-02-07 20:59:33 +0100302 case MBEDTLS_ERR_RIPEMD160_HW_ACCEL_FAILED:
303 return( PSA_ERROR_HARDWARE_FAILURE );
304
305 case MBEDTLS_ERR_RSA_BAD_INPUT_DATA:
306 return( PSA_ERROR_INVALID_ARGUMENT );
307 case MBEDTLS_ERR_RSA_INVALID_PADDING:
308 return( PSA_ERROR_INVALID_PADDING );
309 case MBEDTLS_ERR_RSA_KEY_GEN_FAILED:
310 return( PSA_ERROR_HARDWARE_FAILURE );
311 case MBEDTLS_ERR_RSA_KEY_CHECK_FAILED:
312 return( PSA_ERROR_INVALID_ARGUMENT );
313 case MBEDTLS_ERR_RSA_PUBLIC_FAILED:
314 case MBEDTLS_ERR_RSA_PRIVATE_FAILED:
Gilles Peskine4b3eb692019-05-16 21:35:18 +0200315 return( PSA_ERROR_CORRUPTION_DETECTED );
Gilles Peskinea5905292018-02-07 20:59:33 +0100316 case MBEDTLS_ERR_RSA_VERIFY_FAILED:
317 return( PSA_ERROR_INVALID_SIGNATURE );
318 case MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE:
319 return( PSA_ERROR_BUFFER_TOO_SMALL );
320 case MBEDTLS_ERR_RSA_RNG_FAILED:
321 return( PSA_ERROR_INSUFFICIENT_MEMORY );
322 case MBEDTLS_ERR_RSA_UNSUPPORTED_OPERATION:
323 return( PSA_ERROR_NOT_SUPPORTED );
324 case MBEDTLS_ERR_RSA_HW_ACCEL_FAILED:
325 return( PSA_ERROR_HARDWARE_FAILURE );
326
327 case MBEDTLS_ERR_SHA1_HW_ACCEL_FAILED:
328 case MBEDTLS_ERR_SHA256_HW_ACCEL_FAILED:
329 case MBEDTLS_ERR_SHA512_HW_ACCEL_FAILED:
330 return( PSA_ERROR_HARDWARE_FAILURE );
331
332 case MBEDTLS_ERR_XTEA_INVALID_INPUT_LENGTH:
333 return( PSA_ERROR_INVALID_ARGUMENT );
334 case MBEDTLS_ERR_XTEA_HW_ACCEL_FAILED:
335 return( PSA_ERROR_HARDWARE_FAILURE );
336
itayzafrir5c753392018-05-08 11:18:38 +0300337 case MBEDTLS_ERR_ECP_BAD_INPUT_DATA:
itayzafrir7b30f8b2018-05-09 16:07:36 +0300338 case MBEDTLS_ERR_ECP_INVALID_KEY:
itayzafrir5c753392018-05-08 11:18:38 +0300339 return( PSA_ERROR_INVALID_ARGUMENT );
itayzafrir7b30f8b2018-05-09 16:07:36 +0300340 case MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL:
341 return( PSA_ERROR_BUFFER_TOO_SMALL );
342 case MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE:
343 return( PSA_ERROR_NOT_SUPPORTED );
344 case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH:
345 case MBEDTLS_ERR_ECP_VERIFY_FAILED:
346 return( PSA_ERROR_INVALID_SIGNATURE );
347 case MBEDTLS_ERR_ECP_ALLOC_FAILED:
348 return( PSA_ERROR_INSUFFICIENT_MEMORY );
349 case MBEDTLS_ERR_ECP_HW_ACCEL_FAILED:
350 return( PSA_ERROR_HARDWARE_FAILURE );
Janos Follatha13b9052019-11-22 12:48:59 +0000351 case MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED:
352 return( PSA_ERROR_CORRUPTION_DETECTED );
itayzafrir5c753392018-05-08 11:18:38 +0300353
Gilles Peskinee59236f2018-01-27 23:32:46 +0100354 default:
David Saadab4ecc272019-02-14 13:48:10 +0200355 return( PSA_ERROR_GENERIC_ERROR );
Gilles Peskinee59236f2018-01-27 23:32:46 +0100356 }
357}
358
Gilles Peskineb0b255c2018-07-06 17:01:38 +0200359
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +0200360
361
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100362/****************************************************************/
363/* Key management */
364/****************************************************************/
365
Gilles Peskine73167e12019-07-12 23:44:37 +0200366#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
367static inline int psa_key_slot_is_external( const psa_key_slot_t *slot )
368{
Gilles Peskine8e338702019-07-30 20:06:31 +0200369 return( psa_key_lifetime_is_external( slot->attr.lifetime ) );
Gilles Peskine73167e12019-07-12 23:44:37 +0200370}
371#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
372
Darryl Green8f8aa8f2018-07-24 15:44:51 +0100373#if defined(MBEDTLS_ECP_C)
Paul Elliott8ff510a2020-06-02 17:19:28 +0100374mbedtls_ecp_group_id mbedtls_ecc_group_of_psa( psa_ecc_family_t curve,
Gilles Peskine5055b232019-12-12 17:49:31 +0100375 size_t byte_length )
Gilles Peskine12313cd2018-06-20 00:20:32 +0200376{
377 switch( curve )
378 {
Paul Elliott8ff510a2020-06-02 17:19:28 +0100379 case PSA_ECC_FAMILY_SECP_R1:
Gilles Peskine228abc52019-12-03 17:24:19 +0100380 switch( byte_length )
381 {
382 case PSA_BITS_TO_BYTES( 192 ):
383 return( MBEDTLS_ECP_DP_SECP192R1 );
384 case PSA_BITS_TO_BYTES( 224 ):
385 return( MBEDTLS_ECP_DP_SECP224R1 );
386 case PSA_BITS_TO_BYTES( 256 ):
387 return( MBEDTLS_ECP_DP_SECP256R1 );
388 case PSA_BITS_TO_BYTES( 384 ):
389 return( MBEDTLS_ECP_DP_SECP384R1 );
390 case PSA_BITS_TO_BYTES( 521 ):
391 return( MBEDTLS_ECP_DP_SECP521R1 );
392 default:
393 return( MBEDTLS_ECP_DP_NONE );
394 }
395 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100396
Paul Elliott8ff510a2020-06-02 17:19:28 +0100397 case PSA_ECC_FAMILY_BRAINPOOL_P_R1:
Gilles Peskine228abc52019-12-03 17:24:19 +0100398 switch( byte_length )
399 {
400 case PSA_BITS_TO_BYTES( 256 ):
401 return( MBEDTLS_ECP_DP_BP256R1 );
402 case PSA_BITS_TO_BYTES( 384 ):
403 return( MBEDTLS_ECP_DP_BP384R1 );
404 case PSA_BITS_TO_BYTES( 512 ):
405 return( MBEDTLS_ECP_DP_BP512R1 );
406 default:
407 return( MBEDTLS_ECP_DP_NONE );
408 }
409 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100410
Paul Elliott8ff510a2020-06-02 17:19:28 +0100411 case PSA_ECC_FAMILY_MONTGOMERY:
Gilles Peskine228abc52019-12-03 17:24:19 +0100412 switch( byte_length )
413 {
414 case PSA_BITS_TO_BYTES( 255 ):
415 return( MBEDTLS_ECP_DP_CURVE25519 );
416 case PSA_BITS_TO_BYTES( 448 ):
417 return( MBEDTLS_ECP_DP_CURVE448 );
418 default:
419 return( MBEDTLS_ECP_DP_NONE );
420 }
421 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100422
Paul Elliott8ff510a2020-06-02 17:19:28 +0100423 case PSA_ECC_FAMILY_SECP_K1:
Gilles Peskine228abc52019-12-03 17:24:19 +0100424 switch( byte_length )
425 {
426 case PSA_BITS_TO_BYTES( 192 ):
427 return( MBEDTLS_ECP_DP_SECP192K1 );
428 case PSA_BITS_TO_BYTES( 224 ):
429 return( MBEDTLS_ECP_DP_SECP224K1 );
430 case PSA_BITS_TO_BYTES( 256 ):
431 return( MBEDTLS_ECP_DP_SECP256K1 );
432 default:
433 return( MBEDTLS_ECP_DP_NONE );
434 }
435 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100436
Gilles Peskine12313cd2018-06-20 00:20:32 +0200437 default:
438 return( MBEDTLS_ECP_DP_NONE );
439 }
440}
Darryl Green8f8aa8f2018-07-24 15:44:51 +0100441#endif /* defined(MBEDTLS_ECP_C) */
Gilles Peskine12313cd2018-06-20 00:20:32 +0200442
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200443static psa_status_t validate_unstructured_key_bit_size( psa_key_type_t type,
444 size_t bits )
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200445{
446 /* Check that the bit size is acceptable for the key type */
447 switch( type )
448 {
449 case PSA_KEY_TYPE_RAW_DATA:
450#if defined(MBEDTLS_MD_C)
451 case PSA_KEY_TYPE_HMAC:
Gilles Peskine46f1fd72018-06-28 19:31:31 +0200452#endif
Gilles Peskineea0fb492018-07-12 17:17:20 +0200453 case PSA_KEY_TYPE_DERIVE:
454 break;
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200455#if defined(MBEDTLS_AES_C)
456 case PSA_KEY_TYPE_AES:
457 if( bits != 128 && bits != 192 && bits != 256 )
458 return( PSA_ERROR_INVALID_ARGUMENT );
459 break;
460#endif
461#if defined(MBEDTLS_CAMELLIA_C)
462 case PSA_KEY_TYPE_CAMELLIA:
463 if( bits != 128 && bits != 192 && bits != 256 )
464 return( PSA_ERROR_INVALID_ARGUMENT );
465 break;
466#endif
467#if defined(MBEDTLS_DES_C)
468 case PSA_KEY_TYPE_DES:
469 if( bits != 64 && bits != 128 && bits != 192 )
470 return( PSA_ERROR_INVALID_ARGUMENT );
471 break;
472#endif
473#if defined(MBEDTLS_ARC4_C)
474 case PSA_KEY_TYPE_ARC4:
475 if( bits < 8 || bits > 2048 )
476 return( PSA_ERROR_INVALID_ARGUMENT );
477 break;
478#endif
Gilles Peskine26869f22019-05-06 15:25:00 +0200479#if defined(MBEDTLS_CHACHA20_C)
480 case PSA_KEY_TYPE_CHACHA20:
481 if( bits != 256 )
482 return( PSA_ERROR_INVALID_ARGUMENT );
483 break;
484#endif
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200485 default:
486 return( PSA_ERROR_NOT_SUPPORTED );
487 }
Gilles Peskineb54979a2018-06-21 09:32:47 +0200488 if( bits % 8 != 0 )
489 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200490
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200491 return( PSA_SUCCESS );
492}
493
Steven Cooremana01795d2020-07-24 22:48:15 +0200494#if defined(MBEDTLS_RSA_C)
495
496#if defined(MBEDTLS_PK_PARSE_C)
Gilles Peskine86a440b2018-11-12 18:39:40 +0100497/* Mbed TLS doesn't support non-byte-aligned key sizes (i.e. key sizes
498 * that are not a multiple of 8) well. For example, there is only
499 * mbedtls_rsa_get_len(), which returns a number of bytes, and no
500 * way to return the exact bit size of a key.
501 * To keep things simple, reject non-byte-aligned key sizes. */
502static psa_status_t psa_check_rsa_key_byte_aligned(
503 const mbedtls_rsa_context *rsa )
504{
505 mbedtls_mpi n;
506 psa_status_t status;
507 mbedtls_mpi_init( &n );
508 status = mbedtls_to_psa_error(
509 mbedtls_rsa_export( rsa, &n, NULL, NULL, NULL, NULL ) );
510 if( status == PSA_SUCCESS )
511 {
512 if( mbedtls_mpi_bitlen( &n ) % 8 != 0 )
513 status = PSA_ERROR_NOT_SUPPORTED;
514 }
515 mbedtls_mpi_free( &n );
516 return( status );
517}
Steven Cooremana01795d2020-07-24 22:48:15 +0200518#endif /* MBEDTLS_PK_PARSE_C */
Gilles Peskine86a440b2018-11-12 18:39:40 +0100519
Steven Cooreman7f391872020-07-30 14:57:44 +0200520/** Load the contents of a key buffer into an internal RSA representation
Steven Cooremana01795d2020-07-24 22:48:15 +0200521 *
Steven Cooreman4fed4552020-08-03 14:46:03 +0200522 * \param[in] type The type of key contained in \p data.
523 * \param[in] data The buffer from which to load the representation.
524 * \param[in] data_length The size in bytes of \p data.
525 * \param[out] p_rsa Returns a pointer to an RSA context on success.
526 * The caller is responsible for freeing both the
527 * contents of the context and the context itself
528 * when done.
Steven Cooremana01795d2020-07-24 22:48:15 +0200529 */
Steven Cooreman4fed4552020-08-03 14:46:03 +0200530static psa_status_t psa_load_rsa_representation( psa_key_type_t type,
531 const uint8_t *data,
532 size_t data_length,
Steven Cooremana2371e52020-07-28 14:30:39 +0200533 mbedtls_rsa_context **p_rsa )
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200534{
Steven Cooremana01795d2020-07-24 22:48:15 +0200535#if defined(MBEDTLS_PK_PARSE_C)
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000536 psa_status_t status;
Steven Cooremana01795d2020-07-24 22:48:15 +0200537 mbedtls_pk_context ctx;
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000538 size_t bits;
Steven Cooremana01795d2020-07-24 22:48:15 +0200539 mbedtls_pk_init( &ctx );
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000540
541 /* Parse the data. */
Steven Cooreman7f391872020-07-30 14:57:44 +0200542 if( PSA_KEY_TYPE_IS_KEY_PAIR( type ) )
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000543 status = mbedtls_to_psa_error(
Steven Cooreman4fed4552020-08-03 14:46:03 +0200544 mbedtls_pk_parse_key( &ctx, data, data_length, NULL, 0 ) );
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200545 else
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000546 status = mbedtls_to_psa_error(
Steven Cooreman4fed4552020-08-03 14:46:03 +0200547 mbedtls_pk_parse_public_key( &ctx, data, data_length ) );
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000548 if( status != PSA_SUCCESS )
549 goto exit;
550
551 /* We have something that the pkparse module recognizes. If it is a
552 * valid RSA key, store it. */
Steven Cooremana01795d2020-07-24 22:48:15 +0200553 if( mbedtls_pk_get_type( &ctx ) != MBEDTLS_PK_RSA )
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200554 {
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000555 status = PSA_ERROR_INVALID_ARGUMENT;
556 goto exit;
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200557 }
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000558
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000559 /* The size of an RSA key doesn't have to be a multiple of 8. Mbed TLS
560 * supports non-byte-aligned key sizes, but not well. For example,
561 * mbedtls_rsa_get_len() returns the key size in bytes, not in bits. */
Steven Cooremana01795d2020-07-24 22:48:15 +0200562 bits = PSA_BYTES_TO_BITS( mbedtls_rsa_get_len( mbedtls_pk_rsa( ctx ) ) );
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000563 if( bits > PSA_VENDOR_RSA_MAX_KEY_BITS )
564 {
565 status = PSA_ERROR_NOT_SUPPORTED;
566 goto exit;
567 }
Steven Cooremana01795d2020-07-24 22:48:15 +0200568 status = psa_check_rsa_key_byte_aligned( mbedtls_pk_rsa( ctx ) );
Steven Cooremana01795d2020-07-24 22:48:15 +0200569 if( status != PSA_SUCCESS )
570 goto exit;
571
Steven Cooremana2371e52020-07-28 14:30:39 +0200572 /* Copy out the pointer to the RSA context, and reset the PK context
573 * such that pk_free doesn't free the RSA context we just grabbed. */
574 *p_rsa = mbedtls_pk_rsa( ctx );
575 ctx.pk_info = NULL;
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000576
577exit:
Steven Cooremana01795d2020-07-24 22:48:15 +0200578 mbedtls_pk_free( &ctx );
579 return( status );
580#else
Steven Cooreman4fed4552020-08-03 14:46:03 +0200581 (void) data;
582 (void) data_length;
Steven Cooreman7f391872020-07-30 14:57:44 +0200583 (void) type;
Steven Cooremana01795d2020-07-24 22:48:15 +0200584 (void) rsa;
585 return( PSA_ERROR_NOT_SUPPORTED );
586#endif /* MBEDTLS_PK_PARSE_C */
587}
588
589/** Export an RSA key to export representation
590 *
591 * \param[in] type The type of key (public/private) to export
592 * \param[in] rsa The internal RSA representation from which to export
593 * \param[out] data The buffer to export to
594 * \param[in] data_size The length of the buffer to export to
595 * \param[out] data_length The amount of bytes written to \p data
596 */
597static psa_status_t psa_export_rsa_key( psa_key_type_t type,
598 mbedtls_rsa_context *rsa,
599 uint8_t *data,
600 size_t data_size,
601 size_t *data_length )
602{
603#if defined(MBEDTLS_PK_WRITE_C)
604 int ret;
605 mbedtls_pk_context pk;
606 uint8_t *pos = data + data_size;
607
608 mbedtls_pk_init( &pk );
609 pk.pk_info = &mbedtls_rsa_info;
610 pk.pk_ctx = rsa;
611
612 /* PSA Crypto API defines the format of an RSA key as a DER-encoded
Steven Cooreman75b74362020-07-28 14:30:13 +0200613 * representation of the non-encrypted PKCS#1 RSAPrivateKey for a
614 * private key and of the RFC3279 RSAPublicKey for a public key. */
Steven Cooremana01795d2020-07-24 22:48:15 +0200615 if( PSA_KEY_TYPE_IS_KEY_PAIR( type ) )
616 ret = mbedtls_pk_write_key_der( &pk, data, data_size );
617 else
618 ret = mbedtls_pk_write_pubkey( &pos, data, &pk );
619
620 if( ret < 0 )
Steven Cooreman4fed4552020-08-03 14:46:03 +0200621 {
622 /* Clean up in case pk_write failed halfway through. */
623 memset( data, 0, data_size );
Steven Cooreman29149862020-08-05 15:43:42 +0200624 return( mbedtls_to_psa_error( ret ) );
Steven Cooreman4fed4552020-08-03 14:46:03 +0200625 }
Steven Cooremana01795d2020-07-24 22:48:15 +0200626
627 /* The mbedtls_pk_xxx functions write to the end of the buffer.
628 * Move the data to the beginning and erase remaining data
629 * at the original location. */
630 if( 2 * (size_t) ret <= data_size )
631 {
632 memcpy( data, data + data_size - ret, ret );
633 memset( data + data_size - ret, 0, ret );
634 }
635 else if( (size_t) ret < data_size )
636 {
637 memmove( data, data + data_size - ret, ret );
638 memset( data + ret, 0, data_size - ret );
639 }
640
641 *data_length = ret;
642 return( PSA_SUCCESS );
643#else
644 (void) type;
645 (void) rsa;
646 (void) data;
647 (void) data_size;
648 (void) data_length;
649 return( PSA_ERROR_NOT_SUPPORTED );
650#endif /* MBEDTLS_PK_WRITE_C */
651}
652
653/** Import an RSA key from import representation to a slot
654 *
655 * \param[in,out] slot The slot where to store the export representation to
656 * \param[in] data The buffer containing the import representation
657 * \param[in] data_length The amount of bytes in \p data
658 */
659static psa_status_t psa_import_rsa_key( psa_key_slot_t *slot,
660 const uint8_t *data,
661 size_t data_length )
662{
663 psa_status_t status;
664 uint8_t* output = NULL;
Steven Cooremana2371e52020-07-28 14:30:39 +0200665 mbedtls_rsa_context *rsa = NULL;
Steven Cooremana01795d2020-07-24 22:48:15 +0200666
Steven Cooremana01795d2020-07-24 22:48:15 +0200667 /* Parse input */
Steven Cooreman4fed4552020-08-03 14:46:03 +0200668 status = psa_load_rsa_representation( slot->attr.type,
669 data,
Steven Cooreman7f391872020-07-30 14:57:44 +0200670 data_length,
Steven Cooreman7f391872020-07-30 14:57:44 +0200671 &rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +0200672 if( status != PSA_SUCCESS )
673 goto exit;
674
675 slot->attr.bits = (psa_key_bits_t) PSA_BYTES_TO_BITS(
Steven Cooremana2371e52020-07-28 14:30:39 +0200676 mbedtls_rsa_get_len( rsa ) );
Steven Cooremana01795d2020-07-24 22:48:15 +0200677
Steven Cooreman75b74362020-07-28 14:30:13 +0200678 /* Re-export the data to PSA export format, such that we can store export
679 * representation in the key slot. Export representation in case of RSA is
680 * the smallest representation that's allowed as input, so a straight-up
681 * allocation of the same size as the input buffer will be large enough. */
Steven Cooremana01795d2020-07-24 22:48:15 +0200682 output = mbedtls_calloc( 1, data_length );
Steven Cooremana01795d2020-07-24 22:48:15 +0200683 if( output == NULL )
684 {
685 status = PSA_ERROR_INSUFFICIENT_MEMORY;
686 goto exit;
687 }
688
Steven Cooremana01795d2020-07-24 22:48:15 +0200689 status = psa_export_rsa_key( slot->attr.type,
Steven Cooremana2371e52020-07-28 14:30:39 +0200690 rsa,
Steven Cooremana01795d2020-07-24 22:48:15 +0200691 output,
692 data_length,
693 &data_length);
Steven Cooremana01795d2020-07-24 22:48:15 +0200694exit:
695 /* Always free the RSA object */
Steven Cooremana2371e52020-07-28 14:30:39 +0200696 mbedtls_rsa_free( rsa );
Steven Cooreman6d839f02020-07-30 11:36:45 +0200697 mbedtls_free( rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +0200698
699 /* Free the allocated buffer only on error. */
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000700 if( status != PSA_SUCCESS )
701 {
Steven Cooremana01795d2020-07-24 22:48:15 +0200702 mbedtls_free( output );
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000703 return( status );
704 }
705
Steven Cooremana01795d2020-07-24 22:48:15 +0200706 /* On success, store the allocated export-formatted key. */
707 slot->data.key.data = output;
708 slot->data.key.bytes = data_length;
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000709
710 return( PSA_SUCCESS );
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200711}
Steven Cooremana01795d2020-07-24 22:48:15 +0200712#endif /* defined(MBEDTLS_RSA_C) */
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200713
Jaeden Ameroccdce902019-01-10 11:42:27 +0000714#if defined(MBEDTLS_ECP_C)
Steven Cooreman7f391872020-07-30 14:57:44 +0200715/** Load the contents of a key buffer into an internal ECP representation
Steven Cooremana2371e52020-07-28 14:30:39 +0200716 *
Steven Cooreman4fed4552020-08-03 14:46:03 +0200717 * \param[in] type The type of key contained in \p data.
718 * \param[in] data The buffer from which to load the representation.
719 * \param[in] data_length The size in bytes of \p data.
720 * \param[out] p_ecp Returns a pointer to an ECP context on success.
721 * The caller is responsible for freeing both the
722 * contents of the context and the context itself
723 * when done.
Steven Cooremana2371e52020-07-28 14:30:39 +0200724 */
Steven Cooreman4fed4552020-08-03 14:46:03 +0200725static psa_status_t psa_load_ecp_representation( psa_key_type_t type,
726 const uint8_t *data,
727 size_t data_length,
Steven Cooremana2371e52020-07-28 14:30:39 +0200728 mbedtls_ecp_keypair **p_ecp )
Gilles Peskine4cd32772019-12-02 20:49:42 +0100729{
730 mbedtls_ecp_group_id grp_id = MBEDTLS_ECP_DP_NONE;
Steven Cooremanacda8342020-07-24 23:09:52 +0200731 psa_status_t status;
Steven Cooreman6d839f02020-07-30 11:36:45 +0200732 mbedtls_ecp_keypair *ecp = NULL;
Steven Cooreman4fed4552020-08-03 14:46:03 +0200733 size_t curve_size = data_length;
Gilles Peskine4cd32772019-12-02 20:49:42 +0100734
Steven Cooreman4fed4552020-08-03 14:46:03 +0200735 if( PSA_KEY_TYPE_IS_PUBLIC_KEY( type ) &&
736 PSA_KEY_TYPE_ECC_GET_FAMILY( type ) != PSA_ECC_FAMILY_MONTGOMERY )
Gilles Peskine4295e8b2019-12-02 21:39:10 +0100737 {
Steven Cooreman4fed4552020-08-03 14:46:03 +0200738 /* A Weierstrass public key is represented as:
739 * - The byte 0x04;
740 * - `x_P` as a `ceiling(m/8)`-byte string, big-endian;
741 * - `y_P` as a `ceiling(m/8)`-byte string, big-endian.
742 * So its data length is 2m+1 where n is the key size in bits.
743 */
744 if( ( data_length & 1 ) == 0 )
745 return( PSA_ERROR_INVALID_ARGUMENT );
746 curve_size = data_length / 2;
747
748 /* Montgomery public keys are represented in compressed format, meaning
749 * their curve_size is equal to the amount of input. */
750
751 /* Private keys are represented in uncompressed private random integer
752 * format, meaning their curve_size is equal to the amount of input. */
Gilles Peskine4295e8b2019-12-02 21:39:10 +0100753 }
754
Steven Cooreman6d839f02020-07-30 11:36:45 +0200755 /* Allocate and initialize a key representation. */
Steven Cooreman29149862020-08-05 15:43:42 +0200756 ecp = mbedtls_calloc( 1, sizeof( mbedtls_ecp_keypair ) );
Steven Cooreman6d839f02020-07-30 11:36:45 +0200757 if( ecp == NULL )
Steven Cooreman29149862020-08-05 15:43:42 +0200758 return( PSA_ERROR_INSUFFICIENT_MEMORY );
Steven Cooremana2371e52020-07-28 14:30:39 +0200759 mbedtls_ecp_keypair_init( ecp );
760
Gilles Peskine4cd32772019-12-02 20:49:42 +0100761 /* Load the group. */
Steven Cooreman7f391872020-07-30 14:57:44 +0200762 grp_id = mbedtls_ecc_group_of_psa( PSA_KEY_TYPE_ECC_GET_FAMILY( type ),
763 curve_size );
Gilles Peskine4295e8b2019-12-02 21:39:10 +0100764 if( grp_id == MBEDTLS_ECP_DP_NONE )
Steven Cooreman6d839f02020-07-30 11:36:45 +0200765 {
766 status = PSA_ERROR_INVALID_ARGUMENT;
767 goto exit;
768 }
769
Steven Cooremanacda8342020-07-24 23:09:52 +0200770 status = mbedtls_to_psa_error(
771 mbedtls_ecp_group_load( &ecp->grp, grp_id ) );
772 if( status != PSA_SUCCESS )
Steven Cooreman6d839f02020-07-30 11:36:45 +0200773 goto exit;
Steven Cooremanacda8342020-07-24 23:09:52 +0200774
Steven Cooreman6d839f02020-07-30 11:36:45 +0200775 /* Load the key material. */
Steven Cooreman7f391872020-07-30 14:57:44 +0200776 if( PSA_KEY_TYPE_IS_PUBLIC_KEY( type ) )
Steven Cooremanacda8342020-07-24 23:09:52 +0200777 {
778 /* Load the public value. */
779 status = mbedtls_to_psa_error(
780 mbedtls_ecp_point_read_binary( &ecp->grp, &ecp->Q,
Steven Cooreman4fed4552020-08-03 14:46:03 +0200781 data,
782 data_length ) );
Steven Cooremanacda8342020-07-24 23:09:52 +0200783 if( status != PSA_SUCCESS )
784 goto exit;
785
786 /* Check that the point is on the curve. */
787 status = mbedtls_to_psa_error(
788 mbedtls_ecp_check_pubkey( &ecp->grp, &ecp->Q ) );
789 if( status != PSA_SUCCESS )
790 goto exit;
791 }
792 else
793 {
Steven Cooreman6d839f02020-07-30 11:36:45 +0200794 /* Load and validate the secret value. */
Steven Cooremanacda8342020-07-24 23:09:52 +0200795 status = mbedtls_to_psa_error(
796 mbedtls_ecp_read_key( ecp->grp.id,
797 ecp,
Steven Cooreman4fed4552020-08-03 14:46:03 +0200798 data,
799 data_length ) );
Steven Cooremanacda8342020-07-24 23:09:52 +0200800 if( status != PSA_SUCCESS )
801 goto exit;
Steven Cooremanacda8342020-07-24 23:09:52 +0200802 }
Steven Cooremana2371e52020-07-28 14:30:39 +0200803
804 *p_ecp = ecp;
Steven Cooremanacda8342020-07-24 23:09:52 +0200805exit:
806 if( status != PSA_SUCCESS )
Steven Cooremana2371e52020-07-28 14:30:39 +0200807 {
Steven Cooremanacda8342020-07-24 23:09:52 +0200808 mbedtls_ecp_keypair_free( ecp );
Steven Cooremana2371e52020-07-28 14:30:39 +0200809 mbedtls_free( ecp );
810 }
811
Steven Cooreman29149862020-08-05 15:43:42 +0200812 return( status );
Gilles Peskine4cd32772019-12-02 20:49:42 +0100813}
Jaeden Ameroccdce902019-01-10 11:42:27 +0000814
Steven Cooreman4fed4552020-08-03 14:46:03 +0200815/** Export an ECP key to export representation
816 *
817 * \param[in] type The type of key (public/private) to export
818 * \param[in] ecp The internal ECP representation from which to export
819 * \param[out] data The buffer to export to
820 * \param[in] data_size The length of the buffer to export to
821 * \param[out] data_length The amount of bytes written to \p data
822 */
Steven Cooremanacda8342020-07-24 23:09:52 +0200823static psa_status_t psa_export_ecp_key( psa_key_type_t type,
824 mbedtls_ecp_keypair *ecp,
825 uint8_t *data,
826 size_t data_size,
827 size_t *data_length )
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200828{
Steven Cooremanacda8342020-07-24 23:09:52 +0200829 psa_status_t status;
Jaeden Ameroccdce902019-01-10 11:42:27 +0000830
Steven Cooremanacda8342020-07-24 23:09:52 +0200831 if( PSA_KEY_TYPE_IS_PUBLIC_KEY( type ) )
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200832 {
Steven Cooremanacda8342020-07-24 23:09:52 +0200833 /* Check whether the public part is loaded */
834 if( mbedtls_ecp_is_zero( &ecp->Q ) )
835 {
836 /* Calculate the public key */
837 status = mbedtls_to_psa_error(
838 mbedtls_ecp_mul( &ecp->grp, &ecp->Q, &ecp->d, &ecp->grp.G,
839 mbedtls_ctr_drbg_random, &global_data.ctr_drbg ) );
840 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +0200841 return( status );
Steven Cooremanacda8342020-07-24 23:09:52 +0200842 }
843
Steven Cooreman4fed4552020-08-03 14:46:03 +0200844 status = mbedtls_to_psa_error(
Steven Cooremanacda8342020-07-24 23:09:52 +0200845 mbedtls_ecp_point_write_binary( &ecp->grp, &ecp->Q,
846 MBEDTLS_ECP_PF_UNCOMPRESSED,
847 data_length,
848 data,
Steven Cooreman4fed4552020-08-03 14:46:03 +0200849 data_size ) );
Steven Cooreman4fed4552020-08-03 14:46:03 +0200850 if( status != PSA_SUCCESS )
851 memset( data, 0, data_size );
852
Steven Cooreman29149862020-08-05 15:43:42 +0200853 return( status );
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200854 }
Steven Cooremanacda8342020-07-24 23:09:52 +0200855 else
856 {
Steven Cooreman29149862020-08-05 15:43:42 +0200857 if( data_size < PSA_BITS_TO_BYTES( ecp->grp.nbits ) )
Steven Cooremanacda8342020-07-24 23:09:52 +0200858 return( PSA_ERROR_BUFFER_TOO_SMALL );
859
860 status = mbedtls_to_psa_error(
861 mbedtls_ecp_write_key( ecp,
862 data,
Steven Cooreman29149862020-08-05 15:43:42 +0200863 PSA_BITS_TO_BYTES( ecp->grp.nbits ) ) );
Steven Cooremanacda8342020-07-24 23:09:52 +0200864 if( status == PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +0200865 *data_length = PSA_BITS_TO_BYTES( ecp->grp.nbits );
Steven Cooremanb7f6dea2020-08-05 16:07:20 +0200866 else
867 memset( data, 0, data_size );
Steven Cooremanacda8342020-07-24 23:09:52 +0200868
869 return( status );
870 }
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200871}
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200872
Steven Cooreman4fed4552020-08-03 14:46:03 +0200873/** Import an ECP key from import representation to a slot
874 *
875 * \param[in,out] slot The slot where to store the export representation to
876 * \param[in] data The buffer containing the import representation
877 * \param[in] data_length The amount of bytes in \p data
878 */
Steven Cooremanacda8342020-07-24 23:09:52 +0200879static psa_status_t psa_import_ecp_key( psa_key_slot_t *slot,
880 const uint8_t *data,
881 size_t data_length )
Gilles Peskinef76aa772018-10-29 19:24:33 +0100882{
Steven Cooremanacda8342020-07-24 23:09:52 +0200883 psa_status_t status;
884 uint8_t* output = NULL;
Steven Cooremana2371e52020-07-28 14:30:39 +0200885 mbedtls_ecp_keypair *ecp = NULL;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100886
Steven Cooremanacda8342020-07-24 23:09:52 +0200887 /* Parse input */
Steven Cooreman4fed4552020-08-03 14:46:03 +0200888 status = psa_load_ecp_representation( slot->attr.type,
889 data,
Steven Cooreman7f391872020-07-30 14:57:44 +0200890 data_length,
Steven Cooreman7f391872020-07-30 14:57:44 +0200891 &ecp );
Gilles Peskinef76aa772018-10-29 19:24:33 +0100892 if( status != PSA_SUCCESS )
893 goto exit;
Gilles Peskine4cd32772019-12-02 20:49:42 +0100894
Steven Cooremanacda8342020-07-24 23:09:52 +0200895 if( PSA_KEY_TYPE_ECC_GET_FAMILY( slot->attr.type ) == PSA_ECC_FAMILY_MONTGOMERY)
Steven Cooremana2371e52020-07-28 14:30:39 +0200896 slot->attr.bits = (psa_key_bits_t) ecp->grp.nbits + 1;
Steven Cooremanacda8342020-07-24 23:09:52 +0200897 else
Steven Cooremana2371e52020-07-28 14:30:39 +0200898 slot->attr.bits = (psa_key_bits_t) ecp->grp.nbits;
Steven Cooremane3fd3922020-06-11 16:50:36 +0200899
Steven Cooremanacda8342020-07-24 23:09:52 +0200900 /* Re-export the data to PSA export format. There is currently no support
901 * for other input formats then the export format, so this is a 1-1
902 * copy operation. */
903 output = mbedtls_calloc( 1, data_length );
Steven Cooremanacda8342020-07-24 23:09:52 +0200904 if( output == NULL )
905 {
906 status = PSA_ERROR_INSUFFICIENT_MEMORY;
907 goto exit;
908 }
909
910 status = psa_export_ecp_key( slot->attr.type,
Steven Cooremana2371e52020-07-28 14:30:39 +0200911 ecp,
Steven Cooremanacda8342020-07-24 23:09:52 +0200912 output,
913 data_length,
914 &data_length);
Gilles Peskinef76aa772018-10-29 19:24:33 +0100915exit:
Steven Cooremana2371e52020-07-28 14:30:39 +0200916 /* Always free the PK object (will also free contained ECP context) */
917 mbedtls_ecp_keypair_free( ecp );
Steven Cooreman6d839f02020-07-30 11:36:45 +0200918 mbedtls_free( ecp );
Steven Cooremanacda8342020-07-24 23:09:52 +0200919
920 /* Free the allocated buffer only on error. */
921 if( status != PSA_SUCCESS )
Gilles Peskinef76aa772018-10-29 19:24:33 +0100922 {
Steven Cooremanacda8342020-07-24 23:09:52 +0200923 mbedtls_free( output );
Steven Cooremanacda8342020-07-24 23:09:52 +0200924 return( status );
Gilles Peskinef76aa772018-10-29 19:24:33 +0100925 }
Steven Cooremanacda8342020-07-24 23:09:52 +0200926
927 /* On success, store the allocated export-formatted key. */
928 slot->data.key.data = output;
929 slot->data.key.bytes = data_length;
930
931 return( PSA_SUCCESS );
Gilles Peskinef76aa772018-10-29 19:24:33 +0100932}
933#endif /* defined(MBEDTLS_ECP_C) */
934
Gilles Peskineb46bef22019-07-30 21:32:04 +0200935/** Return the size of the key in the given slot, in bits.
936 *
937 * \param[in] slot A key slot.
938 *
939 * \return The key size in bits, read from the metadata in the slot.
940 */
941static inline size_t psa_get_key_slot_bits( const psa_key_slot_t *slot )
942{
943 return( slot->attr.bits );
944}
945
Steven Cooreman75b74362020-07-28 14:30:13 +0200946/** Try to allocate a buffer to an empty key slot.
947 *
948 * \param[in,out] slot Key slot to attach buffer to.
949 * \param[in] buffer_length Requested size of the buffer.
950 *
951 * \retval #PSA_SUCCESS
952 * The buffer has been successfully allocated.
953 * \retval #PSA_ERROR_INSUFFICIENT_MEMORY
954 * Not enough memory was available for allocation.
955 * \retval #PSA_ERROR_ALREADY_EXISTS
956 * Trying to allocate a buffer to a non-empty key slot.
957 */
958static psa_status_t psa_allocate_buffer_to_slot( psa_key_slot_t *slot,
959 size_t buffer_length )
960{
961 if( slot->data.key.data != NULL )
Steven Cooreman29149862020-08-05 15:43:42 +0200962 return( PSA_ERROR_ALREADY_EXISTS );
Steven Cooreman75b74362020-07-28 14:30:13 +0200963
964 slot->data.key.data = mbedtls_calloc( 1, buffer_length );
965 if( slot->data.key.data == NULL )
Steven Cooreman29149862020-08-05 15:43:42 +0200966 return( PSA_ERROR_INSUFFICIENT_MEMORY );
Steven Cooreman75b74362020-07-28 14:30:13 +0200967
968 slot->data.key.bytes = buffer_length;
Steven Cooreman29149862020-08-05 15:43:42 +0200969 return( PSA_SUCCESS );
Steven Cooreman75b74362020-07-28 14:30:13 +0200970}
971
Gilles Peskine8e338702019-07-30 20:06:31 +0200972/** Import key data into a slot. `slot->attr.type` must have been set
Gilles Peskinef77ed1f2018-12-03 11:58:46 +0100973 * previously. This function assumes that the slot does not contain
974 * any key material yet. On failure, the slot content is unchanged. */
Gilles Peskinefa4135b2018-12-10 16:48:53 +0100975psa_status_t psa_import_key_into_slot( psa_key_slot_t *slot,
976 const uint8_t *data,
977 size_t data_length )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100978{
Gilles Peskineb0b255c2018-07-06 17:01:38 +0200979 psa_status_t status = PSA_SUCCESS;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100980
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200981 /* zero-length keys are never supported. */
982 if( data_length == 0 )
983 return( PSA_ERROR_NOT_SUPPORTED );
984
Gilles Peskine8e338702019-07-30 20:06:31 +0200985 if( key_type_is_raw_bytes( slot->attr.type ) )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100986 {
Gilles Peskinec744d992019-07-30 17:26:54 +0200987 size_t bit_size = PSA_BYTES_TO_BITS( data_length );
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200988
Steven Cooreman75b74362020-07-28 14:30:13 +0200989 /* Ensure that the bytes-to-bits conversion hasn't overflown. */
990 if( data_length > SIZE_MAX / 8 )
991 return( PSA_ERROR_NOT_SUPPORTED );
992
Gilles Peskine1b9505c2019-08-07 10:59:45 +0200993 /* Enforce a size limit, and in particular ensure that the bit
994 * size fits in its representation type. */
Gilles Peskinec744d992019-07-30 17:26:54 +0200995 if( bit_size > PSA_MAX_KEY_BITS )
996 return( PSA_ERROR_NOT_SUPPORTED );
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200997
998 status = validate_unstructured_key_bit_size( slot->attr.type, bit_size );
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200999 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02001000 return( status );
Steven Cooreman81be2fa2020-07-24 22:04:59 +02001001
1002 /* Allocate memory for the key */
Steven Cooreman75b74362020-07-28 14:30:13 +02001003 status = psa_allocate_buffer_to_slot( slot, data_length );
1004 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02001005 return( status );
Steven Cooreman81be2fa2020-07-24 22:04:59 +02001006
1007 /* copy key into allocated buffer */
Steven Cooreman29149862020-08-05 15:43:42 +02001008 memcpy( slot->data.key.data, data, data_length );
Steven Cooreman81be2fa2020-07-24 22:04:59 +02001009
1010 /* Write the actual key size to the slot.
1011 * psa_start_key_creation() wrote the size declared by the
1012 * caller, which may be 0 (meaning unspecified) or wrong. */
1013 slot->attr.bits = (psa_key_bits_t) bit_size;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001014 }
Steven Cooreman19fd5742020-07-24 23:31:01 +02001015 else if( PSA_KEY_TYPE_IS_ECC( slot->attr.type ) )
1016 {
Gilles Peskinef76aa772018-10-29 19:24:33 +01001017#if defined(MBEDTLS_ECP_C)
Steven Cooreman19fd5742020-07-24 23:31:01 +02001018 status = psa_import_ecp_key( slot,
1019 data, data_length );
1020#else
1021 /* No drivers have been implemented yet, so without mbed TLS backing
1022 * there's no way to do ECP with the current library. */
1023 return( PSA_ERROR_NOT_SUPPORTED );
1024#endif /* defined(MBEDTLS_ECP_C) */
1025 }
1026 else if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
Gilles Peskinef76aa772018-10-29 19:24:33 +01001027 {
Steven Cooreman19fd5742020-07-24 23:31:01 +02001028#if defined(MBEDTLS_RSA_C)
1029 status = psa_import_rsa_key( slot,
1030 data, data_length );
1031#else
1032 /* No drivers have been implemented yet, so without mbed TLS backing
1033 * there's no way to do RSA with the current library. */
1034 status = PSA_ERROR_NOT_SUPPORTED;
1035#endif /* defined(MBEDTLS_RSA_C) */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001036 }
1037 else
Gilles Peskinec66ea6a2018-02-03 22:43:28 +01001038 {
Steven Cooreman19fd5742020-07-24 23:31:01 +02001039 /* Unknown key type */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001040 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine969ac722018-01-28 18:16:59 +01001041 }
Darryl Green940d72c2018-07-13 13:18:51 +01001042
Darryl Green06fd18d2018-07-16 11:21:11 +01001043 return( status );
1044}
1045
Gilles Peskinef603c712019-01-19 13:40:11 +01001046/** Calculate the intersection of two algorithm usage policies.
1047 *
1048 * Return 0 (which allows no operation) on incompatibility.
1049 */
1050static psa_algorithm_t psa_key_policy_algorithm_intersection(
1051 psa_algorithm_t alg1,
1052 psa_algorithm_t alg2 )
1053{
Gilles Peskine549ea862019-05-22 11:45:59 +02001054 /* Common case: both sides actually specify the same policy. */
Gilles Peskinef603c712019-01-19 13:40:11 +01001055 if( alg1 == alg2 )
1056 return( alg1 );
1057 /* If the policies are from the same hash-and-sign family, check
1058 * if one is a wildcard. If so the other has the specific algorithm. */
1059 if( PSA_ALG_IS_HASH_AND_SIGN( alg1 ) &&
1060 PSA_ALG_IS_HASH_AND_SIGN( alg2 ) &&
1061 ( alg1 & ~PSA_ALG_HASH_MASK ) == ( alg2 & ~PSA_ALG_HASH_MASK ) )
1062 {
1063 if( PSA_ALG_SIGN_GET_HASH( alg1 ) == PSA_ALG_ANY_HASH )
1064 return( alg2 );
1065 if( PSA_ALG_SIGN_GET_HASH( alg2 ) == PSA_ALG_ANY_HASH )
1066 return( alg1 );
1067 }
1068 /* If the policies are incompatible, allow nothing. */
1069 return( 0 );
1070}
1071
Gilles Peskined6f371b2019-05-10 19:33:38 +02001072static int psa_key_algorithm_permits( psa_algorithm_t policy_alg,
1073 psa_algorithm_t requested_alg )
1074{
Gilles Peskine549ea862019-05-22 11:45:59 +02001075 /* Common case: the policy only allows requested_alg. */
Gilles Peskined6f371b2019-05-10 19:33:38 +02001076 if( requested_alg == policy_alg )
1077 return( 1 );
1078 /* If policy_alg is a hash-and-sign with a wildcard for the hash,
Gilles Peskine549ea862019-05-22 11:45:59 +02001079 * and requested_alg is the same hash-and-sign family with any hash,
1080 * then requested_alg is compliant with policy_alg. */
Gilles Peskined6f371b2019-05-10 19:33:38 +02001081 if( PSA_ALG_IS_HASH_AND_SIGN( requested_alg ) &&
1082 PSA_ALG_SIGN_GET_HASH( policy_alg ) == PSA_ALG_ANY_HASH )
1083 {
1084 return( ( policy_alg & ~PSA_ALG_HASH_MASK ) ==
1085 ( requested_alg & ~PSA_ALG_HASH_MASK ) );
1086 }
1087 /* If it isn't permitted, it's forbidden. */
1088 return( 0 );
1089}
1090
Gilles Peskine30f77cd2019-01-14 16:06:39 +01001091/** Test whether a policy permits an algorithm.
1092 *
1093 * The caller must test usage flags separately.
1094 */
1095static int psa_key_policy_permits( const psa_key_policy_t *policy,
1096 psa_algorithm_t alg )
1097{
Gilles Peskined6f371b2019-05-10 19:33:38 +02001098 return( psa_key_algorithm_permits( policy->alg, alg ) ||
1099 psa_key_algorithm_permits( policy->alg2, alg ) );
Gilles Peskine30f77cd2019-01-14 16:06:39 +01001100}
1101
Gilles Peskinef603c712019-01-19 13:40:11 +01001102/** Restrict a key policy based on a constraint.
1103 *
1104 * \param[in,out] policy The policy to restrict.
1105 * \param[in] constraint The policy constraint to apply.
1106 *
1107 * \retval #PSA_SUCCESS
1108 * \c *policy contains the intersection of the original value of
1109 * \c *policy and \c *constraint.
1110 * \retval #PSA_ERROR_INVALID_ARGUMENT
1111 * \c *policy and \c *constraint are incompatible.
1112 * \c *policy is unchanged.
1113 */
1114static psa_status_t psa_restrict_key_policy(
1115 psa_key_policy_t *policy,
1116 const psa_key_policy_t *constraint )
1117{
1118 psa_algorithm_t intersection_alg =
1119 psa_key_policy_algorithm_intersection( policy->alg, constraint->alg );
Gilles Peskined6f371b2019-05-10 19:33:38 +02001120 psa_algorithm_t intersection_alg2 =
1121 psa_key_policy_algorithm_intersection( policy->alg2, constraint->alg2 );
Gilles Peskinef603c712019-01-19 13:40:11 +01001122 if( intersection_alg == 0 && policy->alg != 0 && constraint->alg != 0 )
1123 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskined6f371b2019-05-10 19:33:38 +02001124 if( intersection_alg2 == 0 && policy->alg2 != 0 && constraint->alg2 != 0 )
1125 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskinef603c712019-01-19 13:40:11 +01001126 policy->usage &= constraint->usage;
1127 policy->alg = intersection_alg;
Gilles Peskined6f371b2019-05-10 19:33:38 +02001128 policy->alg2 = intersection_alg2;
Gilles Peskinef603c712019-01-19 13:40:11 +01001129 return( PSA_SUCCESS );
1130}
1131
Darryl Green06fd18d2018-07-16 11:21:11 +01001132/** Retrieve a slot which must contain a key. The key must have allow all the
1133 * usage flags set in \p usage. If \p alg is nonzero, the key must allow
1134 * operations with this algorithm. */
Gilles Peskinec5487a82018-12-03 18:08:14 +01001135static psa_status_t psa_get_key_from_slot( psa_key_handle_t handle,
Gilles Peskine2f060a82018-12-04 17:12:32 +01001136 psa_key_slot_t **p_slot,
Darryl Green06fd18d2018-07-16 11:21:11 +01001137 psa_key_usage_t usage,
1138 psa_algorithm_t alg )
1139{
1140 psa_status_t status;
Gilles Peskine2f060a82018-12-04 17:12:32 +01001141 psa_key_slot_t *slot = NULL;
Darryl Green06fd18d2018-07-16 11:21:11 +01001142
1143 *p_slot = NULL;
1144
Gilles Peskinec5487a82018-12-03 18:08:14 +01001145 status = psa_get_key_slot( handle, &slot );
Darryl Green06fd18d2018-07-16 11:21:11 +01001146 if( status != PSA_SUCCESS )
1147 return( status );
Darryl Green06fd18d2018-07-16 11:21:11 +01001148
1149 /* Enforce that usage policy for the key slot contains all the flags
1150 * required by the usage parameter. There is one exception: public
1151 * keys can always be exported, so we treat public key objects as
1152 * if they had the export flag. */
Gilles Peskine8e338702019-07-30 20:06:31 +02001153 if( PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->attr.type ) )
Darryl Green06fd18d2018-07-16 11:21:11 +01001154 usage &= ~PSA_KEY_USAGE_EXPORT;
Gilles Peskine8e338702019-07-30 20:06:31 +02001155 if( ( slot->attr.policy.usage & usage ) != usage )
Darryl Green06fd18d2018-07-16 11:21:11 +01001156 return( PSA_ERROR_NOT_PERMITTED );
Gilles Peskine30f77cd2019-01-14 16:06:39 +01001157
1158 /* Enforce that the usage policy permits the requested algortihm. */
Gilles Peskine8e338702019-07-30 20:06:31 +02001159 if( alg != 0 && ! psa_key_policy_permits( &slot->attr.policy, alg ) )
Darryl Green06fd18d2018-07-16 11:21:11 +01001160 return( PSA_ERROR_NOT_PERMITTED );
1161
1162 *p_slot = slot;
1163 return( PSA_SUCCESS );
1164}
Darryl Green940d72c2018-07-13 13:18:51 +01001165
Gilles Peskine28f8f302019-07-24 13:30:31 +02001166/** Retrieve a slot which must contain a transparent key.
1167 *
1168 * A transparent key is a key for which the key material is directly
1169 * available, as opposed to a key in a secure element.
1170 *
Gilles Peskine60450a42019-07-25 11:32:45 +02001171 * This is a temporary function to use instead of psa_get_key_from_slot()
1172 * until secure element support is fully implemented.
Gilles Peskine28f8f302019-07-24 13:30:31 +02001173 */
1174#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1175static psa_status_t psa_get_transparent_key( psa_key_handle_t handle,
1176 psa_key_slot_t **p_slot,
1177 psa_key_usage_t usage,
1178 psa_algorithm_t alg )
1179{
1180 psa_status_t status = psa_get_key_from_slot( handle, p_slot, usage, alg );
1181 if( status != PSA_SUCCESS )
1182 return( status );
Gilles Peskineadad8132019-07-25 11:31:23 +02001183 if( psa_key_slot_is_external( *p_slot ) )
Gilles Peskine28f8f302019-07-24 13:30:31 +02001184 {
1185 *p_slot = NULL;
1186 return( PSA_ERROR_NOT_SUPPORTED );
1187 }
1188 return( PSA_SUCCESS );
1189}
1190#else /* MBEDTLS_PSA_CRYPTO_SE_C */
1191/* With no secure element support, all keys are transparent. */
1192#define psa_get_transparent_key( handle, p_slot, usage, alg ) \
1193 psa_get_key_from_slot( handle, p_slot, usage, alg )
1194#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1195
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001196/** Wipe key data from a slot. Preserve metadata such as the policy. */
Gilles Peskine2f060a82018-12-04 17:12:32 +01001197static psa_status_t psa_remove_key_data_from_memory( psa_key_slot_t *slot )
Darryl Green40225ba2018-11-15 14:48:15 +00001198{
Gilles Peskine73167e12019-07-12 23:44:37 +02001199#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1200 if( psa_key_slot_is_external( slot ) )
Darryl Green40225ba2018-11-15 14:48:15 +00001201 {
1202 /* No key material to clean. */
1203 }
Gilles Peskine73167e12019-07-12 23:44:37 +02001204 else
1205#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Darryl Green40225ba2018-11-15 14:48:15 +00001206 {
Steven Cooremanfd4d69a2020-08-05 15:46:33 +02001207 /* Data pointer will always be either a valid pointer or NULL in an
1208 * initialized slot, so we can just free it. */
1209 if( slot->data.key.data != NULL )
1210 mbedtls_platform_zeroize( slot->data.key.data, slot->data.key.bytes);
Steven Cooremana01795d2020-07-24 22:48:15 +02001211 mbedtls_free( slot->data.key.data );
1212 slot->data.key.data = NULL;
1213 slot->data.key.bytes = 0;
Darryl Green40225ba2018-11-15 14:48:15 +00001214 }
Darryl Green40225ba2018-11-15 14:48:15 +00001215
1216 return( PSA_SUCCESS );
1217}
1218
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001219/** Completely wipe a slot in memory, including its policy.
1220 * Persistent storage is not affected. */
Gilles Peskine66fb1262018-12-10 16:29:04 +01001221psa_status_t psa_wipe_key_slot( psa_key_slot_t *slot )
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001222{
1223 psa_status_t status = psa_remove_key_data_from_memory( slot );
Gilles Peskine3f7cd622019-08-13 15:01:08 +02001224 /* Multipart operations may still be using the key. This is safe
1225 * because all multipart operation objects are independent from
1226 * the key slot: if they need to access the key after the setup
1227 * phase, they have a copy of the key. Note that this means that
1228 * key material can linger until all operations are completed. */
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001229 /* At this point, key material and other type-specific content has
1230 * been wiped. Clear remaining metadata. We can call memset and not
1231 * zeroize because the metadata is not particularly sensitive. */
1232 memset( slot, 0, sizeof( *slot ) );
1233 return( status );
1234}
1235
Gilles Peskinec5487a82018-12-03 18:08:14 +01001236psa_status_t psa_destroy_key( psa_key_handle_t handle )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001237{
Gilles Peskine2f060a82018-12-04 17:12:32 +01001238 psa_key_slot_t *slot;
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001239 psa_status_t status; /* status of the last operation */
1240 psa_status_t overall_status = PSA_SUCCESS;
Gilles Peskine354f7672019-07-12 23:46:38 +02001241#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1242 psa_se_drv_table_entry_t *driver;
1243#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001244
Gilles Peskine1841cf42019-10-08 15:48:25 +02001245 if( handle == 0 )
1246 return( PSA_SUCCESS );
1247
Gilles Peskinec5487a82018-12-03 18:08:14 +01001248 status = psa_get_key_slot( handle, &slot );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02001249 if( status != PSA_SUCCESS )
1250 return( status );
Gilles Peskine354f7672019-07-12 23:46:38 +02001251
1252#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine8e338702019-07-30 20:06:31 +02001253 driver = psa_get_se_driver_entry( slot->attr.lifetime );
Gilles Peskine354f7672019-07-12 23:46:38 +02001254 if( driver != NULL )
Gilles Peskinefc762652019-07-22 19:30:34 +02001255 {
Gilles Peskine60450a42019-07-25 11:32:45 +02001256 /* For a key in a secure element, we need to do three things:
1257 * remove the key file in internal storage, destroy the
1258 * key inside the secure element, and update the driver's
1259 * persistent data. Start a transaction that will encompass these
1260 * three actions. */
Gilles Peskinefc762652019-07-22 19:30:34 +02001261 psa_crypto_prepare_transaction( PSA_CRYPTO_TRANSACTION_DESTROY_KEY );
Gilles Peskine8e338702019-07-30 20:06:31 +02001262 psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
Gilles Peskinefc762652019-07-22 19:30:34 +02001263 psa_crypto_transaction.key.slot = slot->data.se.slot_number;
Gilles Peskine8e338702019-07-30 20:06:31 +02001264 psa_crypto_transaction.key.id = slot->attr.id;
Gilles Peskinefc762652019-07-22 19:30:34 +02001265 status = psa_crypto_save_transaction( );
1266 if( status != PSA_SUCCESS )
1267 {
Gilles Peskine66be51c2019-07-25 18:02:52 +02001268 (void) psa_crypto_stop_transaction( );
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001269 /* We should still try to destroy the key in the secure
1270 * element and the key metadata in storage. This is especially
1271 * important if the error is that the storage is full.
1272 * But how to do it exactly without risking an inconsistent
1273 * state after a reset?
1274 * https://github.com/ARMmbed/mbed-crypto/issues/215
1275 */
1276 overall_status = status;
1277 goto exit;
Gilles Peskinefc762652019-07-22 19:30:34 +02001278 }
1279
Gilles Peskine354f7672019-07-12 23:46:38 +02001280 status = psa_destroy_se_key( driver, slot->data.se.slot_number );
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001281 if( overall_status == PSA_SUCCESS )
1282 overall_status = status;
Gilles Peskinefc762652019-07-22 19:30:34 +02001283 }
Gilles Peskine354f7672019-07-12 23:46:38 +02001284#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1285
Darryl Greend49a4992018-06-18 17:27:26 +01001286#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Gilles Peskinecaec2782019-08-13 15:11:49 +02001287 if( slot->attr.lifetime != PSA_KEY_LIFETIME_VOLATILE )
Darryl Greend49a4992018-06-18 17:27:26 +01001288 {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001289 status = psa_destroy_persistent_key( slot->attr.id );
1290 if( overall_status == PSA_SUCCESS )
1291 overall_status = status;
1292
Gilles Peskine9ce31c42019-08-13 15:14:20 +02001293 /* TODO: other slots may have a copy of the same key. We should
1294 * invalidate them.
1295 * https://github.com/ARMmbed/mbed-crypto/issues/214
1296 */
Darryl Greend49a4992018-06-18 17:27:26 +01001297 }
1298#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
Gilles Peskine354f7672019-07-12 23:46:38 +02001299
Gilles Peskinefc762652019-07-22 19:30:34 +02001300#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1301 if( driver != NULL )
1302 {
Gilles Peskine725f22a2019-07-25 11:31:48 +02001303 status = psa_save_se_persistent_data( driver );
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001304 if( overall_status == PSA_SUCCESS )
1305 overall_status = status;
1306 status = psa_crypto_stop_transaction( );
1307 if( overall_status == PSA_SUCCESS )
1308 overall_status = status;
Gilles Peskinefc762652019-07-22 19:30:34 +02001309 }
1310#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1311
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001312#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1313exit:
1314#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001315 status = psa_wipe_key_slot( slot );
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001316 /* Prioritize CORRUPTION_DETECTED from wiping over a storage error */
1317 if( overall_status == PSA_SUCCESS )
1318 overall_status = status;
1319 return( overall_status );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001320}
1321
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001322void psa_reset_key_attributes( psa_key_attributes_t *attributes )
Gilles Peskineb870b182018-07-06 16:02:09 +02001323{
Gilles Peskineb699f072019-04-26 16:06:02 +02001324 mbedtls_free( attributes->domain_parameters );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001325 memset( attributes, 0, sizeof( *attributes ) );
Gilles Peskineb870b182018-07-06 16:02:09 +02001326}
1327
Gilles Peskineb699f072019-04-26 16:06:02 +02001328psa_status_t psa_set_key_domain_parameters( psa_key_attributes_t *attributes,
1329 psa_key_type_t type,
1330 const uint8_t *data,
1331 size_t data_length )
1332{
1333 uint8_t *copy = NULL;
1334
1335 if( data_length != 0 )
1336 {
1337 copy = mbedtls_calloc( 1, data_length );
1338 if( copy == NULL )
1339 return( PSA_ERROR_INSUFFICIENT_MEMORY );
1340 memcpy( copy, data, data_length );
1341 }
1342 /* After this point, this function is guaranteed to succeed, so it
1343 * can start modifying `*attributes`. */
1344
1345 if( attributes->domain_parameters != NULL )
1346 {
1347 mbedtls_free( attributes->domain_parameters );
1348 attributes->domain_parameters = NULL;
1349 attributes->domain_parameters_size = 0;
1350 }
1351
1352 attributes->domain_parameters = copy;
1353 attributes->domain_parameters_size = data_length;
Gilles Peskine7e0cff92019-07-30 13:48:52 +02001354 attributes->core.type = type;
Gilles Peskineb699f072019-04-26 16:06:02 +02001355 return( PSA_SUCCESS );
1356}
1357
1358psa_status_t psa_get_key_domain_parameters(
1359 const psa_key_attributes_t *attributes,
1360 uint8_t *data, size_t data_size, size_t *data_length )
1361{
1362 if( attributes->domain_parameters_size > data_size )
1363 return( PSA_ERROR_BUFFER_TOO_SMALL );
1364 *data_length = attributes->domain_parameters_size;
1365 if( attributes->domain_parameters_size != 0 )
1366 memcpy( data, attributes->domain_parameters,
1367 attributes->domain_parameters_size );
1368 return( PSA_SUCCESS );
1369}
1370
1371#if defined(MBEDTLS_RSA_C)
1372static psa_status_t psa_get_rsa_public_exponent(
1373 const mbedtls_rsa_context *rsa,
1374 psa_key_attributes_t *attributes )
1375{
1376 mbedtls_mpi mpi;
Janos Follath24eed8d2019-11-22 13:21:35 +00001377 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskineb699f072019-04-26 16:06:02 +02001378 uint8_t *buffer = NULL;
1379 size_t buflen;
1380 mbedtls_mpi_init( &mpi );
1381
1382 ret = mbedtls_rsa_export( rsa, NULL, NULL, NULL, NULL, &mpi );
1383 if( ret != 0 )
1384 goto exit;
Gilles Peskine772c8b12019-04-26 17:37:21 +02001385 if( mbedtls_mpi_cmp_int( &mpi, 65537 ) == 0 )
1386 {
1387 /* It's the default value, which is reported as an empty string,
1388 * so there's nothing to do. */
1389 goto exit;
1390 }
Gilles Peskineb699f072019-04-26 16:06:02 +02001391
1392 buflen = mbedtls_mpi_size( &mpi );
1393 buffer = mbedtls_calloc( 1, buflen );
1394 if( buffer == NULL )
1395 {
1396 ret = MBEDTLS_ERR_MPI_ALLOC_FAILED;
1397 goto exit;
1398 }
1399 ret = mbedtls_mpi_write_binary( &mpi, buffer, buflen );
1400 if( ret != 0 )
1401 goto exit;
1402 attributes->domain_parameters = buffer;
1403 attributes->domain_parameters_size = buflen;
1404
1405exit:
1406 mbedtls_mpi_free( &mpi );
1407 if( ret != 0 )
1408 mbedtls_free( buffer );
1409 return( mbedtls_to_psa_error( ret ) );
1410}
1411#endif /* MBEDTLS_RSA_C */
1412
Gilles Peskinebfd322f2019-07-23 11:58:03 +02001413/** Retrieve all the publicly-accessible attributes of a key.
1414 */
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001415psa_status_t psa_get_key_attributes( psa_key_handle_t handle,
1416 psa_key_attributes_t *attributes )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001417{
Gilles Peskine2f060a82018-12-04 17:12:32 +01001418 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02001419 psa_status_t status;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001420
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001421 psa_reset_key_attributes( attributes );
1422
Gilles Peskinedc5bfe92019-07-24 19:09:30 +02001423 status = psa_get_key_from_slot( handle, &slot, 0, 0 );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02001424 if( status != PSA_SUCCESS )
1425 return( status );
Gilles Peskineb870b182018-07-06 16:02:09 +02001426
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001427 attributes->core = slot->attr;
Gilles Peskinec8000c02019-08-02 20:15:51 +02001428 attributes->core.flags &= ( MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY |
1429 MBEDTLS_PSA_KA_MASK_DUAL_USE );
1430
1431#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1432 if( psa_key_slot_is_external( slot ) )
1433 psa_set_key_slot_number( attributes, slot->data.se.slot_number );
1434#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskineb699f072019-04-26 16:06:02 +02001435
Gilles Peskine8e338702019-07-30 20:06:31 +02001436 switch( slot->attr.type )
Gilles Peskineb699f072019-04-26 16:06:02 +02001437 {
1438#if defined(MBEDTLS_RSA_C)
Gilles Peskinec93b80c2019-05-16 19:39:54 +02001439 case PSA_KEY_TYPE_RSA_KEY_PAIR:
Gilles Peskineb699f072019-04-26 16:06:02 +02001440 case PSA_KEY_TYPE_RSA_PUBLIC_KEY:
Gilles Peskinedc5bfe92019-07-24 19:09:30 +02001441#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Janos Follath1d57a202019-08-13 12:15:34 +01001442 /* TODO: reporting the public exponent for opaque keys
Gilles Peskinec9d7f942019-08-13 16:17:16 +02001443 * is not yet implemented.
1444 * https://github.com/ARMmbed/mbed-crypto/issues/216
1445 */
Gilles Peskinec8000c02019-08-02 20:15:51 +02001446 if( psa_key_slot_is_external( slot ) )
Gilles Peskinedc5bfe92019-07-24 19:09:30 +02001447 break;
1448#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Steven Cooremana01795d2020-07-24 22:48:15 +02001449 {
Steven Cooremana2371e52020-07-28 14:30:39 +02001450 mbedtls_rsa_context *rsa = NULL;
Steven Cooremana01795d2020-07-24 22:48:15 +02001451
Steven Cooreman4fed4552020-08-03 14:46:03 +02001452 status = psa_load_rsa_representation( slot->attr.type,
1453 slot->data.key.data,
Steven Cooreman7f391872020-07-30 14:57:44 +02001454 slot->data.key.bytes,
Steven Cooreman7f391872020-07-30 14:57:44 +02001455 &rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02001456 if( status != PSA_SUCCESS )
1457 break;
1458
Steven Cooremana2371e52020-07-28 14:30:39 +02001459 status = psa_get_rsa_public_exponent( rsa,
Steven Cooremana01795d2020-07-24 22:48:15 +02001460 attributes );
Steven Cooremana2371e52020-07-28 14:30:39 +02001461 mbedtls_rsa_free( rsa );
1462 mbedtls_free( rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02001463 }
Gilles Peskineb699f072019-04-26 16:06:02 +02001464 break;
Gilles Peskinedc5bfe92019-07-24 19:09:30 +02001465#endif /* MBEDTLS_RSA_C */
Gilles Peskineb699f072019-04-26 16:06:02 +02001466 default:
1467 /* Nothing else to do. */
1468 break;
1469 }
1470
1471 if( status != PSA_SUCCESS )
1472 psa_reset_key_attributes( attributes );
1473 return( status );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001474}
1475
Gilles Peskinec8000c02019-08-02 20:15:51 +02001476#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1477psa_status_t psa_get_key_slot_number(
1478 const psa_key_attributes_t *attributes,
1479 psa_key_slot_number_t *slot_number )
1480{
1481 if( attributes->core.flags & MBEDTLS_PSA_KA_FLAG_HAS_SLOT_NUMBER )
1482 {
1483 *slot_number = attributes->slot_number;
1484 return( PSA_SUCCESS );
1485 }
1486 else
1487 return( PSA_ERROR_INVALID_ARGUMENT );
1488}
1489#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1490
Steven Cooremana01795d2020-07-24 22:48:15 +02001491static psa_status_t psa_internal_export_key_buffer( const psa_key_slot_t *slot,
1492 uint8_t *data,
1493 size_t data_size,
1494 size_t *data_length )
1495{
1496 if( slot->data.key.bytes > data_size )
1497 return( PSA_ERROR_BUFFER_TOO_SMALL );
1498 memcpy( data, slot->data.key.data, slot->data.key.bytes );
1499 memset( data + slot->data.key.bytes, 0,
1500 data_size - slot->data.key.bytes );
1501 *data_length = slot->data.key.bytes;
1502 return( PSA_SUCCESS );
1503}
1504
Gilles Peskinef603c712019-01-19 13:40:11 +01001505static psa_status_t psa_internal_export_key( const psa_key_slot_t *slot,
1506 uint8_t *data,
1507 size_t data_size,
1508 size_t *data_length,
1509 int export_public_key )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001510{
Gilles Peskine5d309672019-07-12 23:47:28 +02001511#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1512 const psa_drv_se_t *drv;
1513 psa_drv_se_context_t *drv_context;
1514#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1515
Jaeden Amerof24c7f82018-06-27 17:20:43 +01001516 *data_length = 0;
1517
Gilles Peskine8e338702019-07-30 20:06:31 +02001518 if( export_public_key && ! PSA_KEY_TYPE_IS_ASYMMETRIC( slot->attr.type ) )
Moran Pekera998bc62018-04-16 18:16:20 +03001519 return( PSA_ERROR_INVALID_ARGUMENT );
mohammad160306e79202018-03-28 13:17:44 +03001520
Gilles Peskinef9168942019-09-12 19:20:29 +02001521 /* Reject a zero-length output buffer now, since this can never be a
1522 * valid key representation. This way we know that data must be a valid
1523 * pointer and we can do things like memset(data, ..., data_size). */
1524 if( data_size == 0 )
1525 return( PSA_ERROR_BUFFER_TOO_SMALL );
1526
Gilles Peskine5d309672019-07-12 23:47:28 +02001527#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine8e338702019-07-30 20:06:31 +02001528 if( psa_get_se_driver( slot->attr.lifetime, &drv, &drv_context ) )
Gilles Peskine5d309672019-07-12 23:47:28 +02001529 {
1530 psa_drv_se_export_key_t method;
1531 if( drv->key_management == NULL )
1532 return( PSA_ERROR_NOT_SUPPORTED );
1533 method = ( export_public_key ?
1534 drv->key_management->p_export_public :
1535 drv->key_management->p_export );
1536 if( method == NULL )
1537 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine2e0f3882019-07-25 11:34:33 +02001538 return( method( drv_context,
1539 slot->data.se.slot_number,
1540 data, data_size, data_length ) );
Gilles Peskine5d309672019-07-12 23:47:28 +02001541 }
1542#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1543
Gilles Peskine8e338702019-07-30 20:06:31 +02001544 if( key_type_is_raw_bytes( slot->attr.type ) )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001545 {
Steven Cooremanacda8342020-07-24 23:09:52 +02001546 return( psa_internal_export_key_buffer( slot, data, data_size, data_length ) );
Gilles Peskine188c71e2018-10-29 19:26:02 +01001547 }
Steven Cooreman560c28a2020-07-24 23:20:24 +02001548 else if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) ||
1549 PSA_KEY_TYPE_IS_ECC( slot->attr.type ) )
Moran Peker17e36e12018-05-02 12:55:20 +03001550 {
Steven Cooreman560c28a2020-07-24 23:20:24 +02001551 if( PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->attr.type ) )
Gilles Peskine969ac722018-01-28 18:16:59 +01001552 {
Steven Cooreman560c28a2020-07-24 23:20:24 +02001553 /* Exporting public -> public */
1554 return( psa_internal_export_key_buffer( slot, data, data_size, data_length ) );
1555 }
1556 else if( !export_public_key )
1557 {
1558 /* Exporting private -> private */
1559 return( psa_internal_export_key_buffer( slot, data, data_size, data_length ) );
1560 }
1561 /* Need to export the public part of a private key,
1562 * so conversion is needed */
1563 if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
1564 {
Darryl Green9e2d7a02018-07-24 16:33:30 +01001565#if defined(MBEDTLS_RSA_C)
Steven Cooremana2371e52020-07-28 14:30:39 +02001566 mbedtls_rsa_context *rsa = NULL;
Steven Cooreman7f391872020-07-30 14:57:44 +02001567 psa_status_t status = psa_load_rsa_representation(
Steven Cooreman4fed4552020-08-03 14:46:03 +02001568 slot->attr.type,
Steven Cooreman7f391872020-07-30 14:57:44 +02001569 slot->data.key.data,
1570 slot->data.key.bytes,
Steven Cooreman7f391872020-07-30 14:57:44 +02001571 &rsa );
Steven Cooreman560c28a2020-07-24 23:20:24 +02001572 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02001573 return( status );
Steven Cooremana01795d2020-07-24 22:48:15 +02001574
Steven Cooreman560c28a2020-07-24 23:20:24 +02001575 status = psa_export_rsa_key( PSA_KEY_TYPE_RSA_PUBLIC_KEY,
Steven Cooremana2371e52020-07-28 14:30:39 +02001576 rsa,
Steven Cooreman560c28a2020-07-24 23:20:24 +02001577 data,
1578 data_size,
1579 data_length );
Steven Cooremana01795d2020-07-24 22:48:15 +02001580
Steven Cooremana2371e52020-07-28 14:30:39 +02001581 mbedtls_rsa_free( rsa );
1582 mbedtls_free( rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02001583
Steven Cooreman560c28a2020-07-24 23:20:24 +02001584 return( status );
Darryl Green9e2d7a02018-07-24 16:33:30 +01001585#else
Steven Cooreman560c28a2020-07-24 23:20:24 +02001586 /* We don't know how to convert a private RSA key to public. */
1587 return( PSA_ERROR_NOT_SUPPORTED );
Darryl Green9e2d7a02018-07-24 16:33:30 +01001588#endif
Gilles Peskine969ac722018-01-28 18:16:59 +01001589 }
1590 else
Moran Pekera998bc62018-04-16 18:16:20 +03001591 {
Steven Cooreman560c28a2020-07-24 23:20:24 +02001592#if defined(MBEDTLS_ECP_C)
Steven Cooremana2371e52020-07-28 14:30:39 +02001593 mbedtls_ecp_keypair *ecp = NULL;
Steven Cooreman7f391872020-07-30 14:57:44 +02001594 psa_status_t status = psa_load_ecp_representation(
Steven Cooreman4fed4552020-08-03 14:46:03 +02001595 slot->attr.type,
Steven Cooreman7f391872020-07-30 14:57:44 +02001596 slot->data.key.data,
1597 slot->data.key.bytes,
Steven Cooreman7f391872020-07-30 14:57:44 +02001598 &ecp );
Steven Cooreman560c28a2020-07-24 23:20:24 +02001599 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02001600 return( status );
Steven Cooreman560c28a2020-07-24 23:20:24 +02001601
1602 status = psa_export_ecp_key( PSA_KEY_TYPE_ECC_PUBLIC_KEY(
1603 PSA_KEY_TYPE_ECC_GET_FAMILY(
1604 slot->attr.type ) ),
Steven Cooremana2371e52020-07-28 14:30:39 +02001605 ecp,
Steven Cooreman560c28a2020-07-24 23:20:24 +02001606 data,
1607 data_size,
1608 data_length );
1609
Steven Cooremana2371e52020-07-28 14:30:39 +02001610 mbedtls_ecp_keypair_free( ecp );
1611 mbedtls_free( ecp );
Steven Cooreman560c28a2020-07-24 23:20:24 +02001612 return( status );
1613#else
1614 /* We don't know how to convert a private ECC key to public */
Moran Pekera998bc62018-04-16 18:16:20 +03001615 return( PSA_ERROR_NOT_SUPPORTED );
Steven Cooreman560c28a2020-07-24 23:20:24 +02001616#endif
Moran Pekera998bc62018-04-16 18:16:20 +03001617 }
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001618 }
Steven Cooreman560c28a2020-07-24 23:20:24 +02001619 else
1620 {
1621 /* This shouldn't happen in the reference implementation, but
1622 it is valid for a special-purpose implementation to omit
1623 support for exporting certain key types. */
1624 return( PSA_ERROR_NOT_SUPPORTED );
1625 }
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001626}
1627
Gilles Peskinec5487a82018-12-03 18:08:14 +01001628psa_status_t psa_export_key( psa_key_handle_t handle,
Gilles Peskine2d277862018-06-18 15:41:12 +02001629 uint8_t *data,
1630 size_t data_size,
1631 size_t *data_length )
Moran Pekera998bc62018-04-16 18:16:20 +03001632{
Gilles Peskine2f060a82018-12-04 17:12:32 +01001633 psa_key_slot_t *slot;
Darryl Greendd8fb772018-11-07 16:00:44 +00001634 psa_status_t status;
1635
1636 /* Set the key to empty now, so that even when there are errors, we always
1637 * set data_length to a value between 0 and data_size. On error, setting
1638 * the key to empty is a good choice because an empty key representation is
1639 * unlikely to be accepted anywhere. */
1640 *data_length = 0;
1641
1642 /* Export requires the EXPORT flag. There is an exception for public keys,
1643 * which don't require any flag, but psa_get_key_from_slot takes
1644 * care of this. */
Gilles Peskinec5487a82018-12-03 18:08:14 +01001645 status = psa_get_key_from_slot( handle, &slot, PSA_KEY_USAGE_EXPORT, 0 );
Darryl Greendd8fb772018-11-07 16:00:44 +00001646 if( status != PSA_SUCCESS )
1647 return( status );
1648 return( psa_internal_export_key( slot, data, data_size,
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001649 data_length, 0 ) );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001650}
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001651
Gilles Peskinec5487a82018-12-03 18:08:14 +01001652psa_status_t psa_export_public_key( psa_key_handle_t handle,
Gilles Peskine2d277862018-06-18 15:41:12 +02001653 uint8_t *data,
1654 size_t data_size,
1655 size_t *data_length )
Moran Pekerdd4ea382018-04-03 15:30:03 +03001656{
Gilles Peskine2f060a82018-12-04 17:12:32 +01001657 psa_key_slot_t *slot;
Darryl Greendd8fb772018-11-07 16:00:44 +00001658 psa_status_t status;
1659
1660 /* Set the key to empty now, so that even when there are errors, we always
1661 * set data_length to a value between 0 and data_size. On error, setting
1662 * the key to empty is a good choice because an empty key representation is
1663 * unlikely to be accepted anywhere. */
1664 *data_length = 0;
1665
1666 /* Exporting a public key doesn't require a usage flag. */
Gilles Peskinec5487a82018-12-03 18:08:14 +01001667 status = psa_get_key_from_slot( handle, &slot, 0, 0 );
Darryl Greendd8fb772018-11-07 16:00:44 +00001668 if( status != PSA_SUCCESS )
1669 return( status );
1670 return( psa_internal_export_key( slot, data, data_size,
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001671 data_length, 1 ) );
Moran Pekerdd4ea382018-04-03 15:30:03 +03001672}
1673
Gilles Peskine91e8c332019-08-02 19:19:39 +02001674#if defined(static_assert)
1675static_assert( ( MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE ) == 0,
1676 "One or more key attribute flag is listed as both external-only and dual-use" );
Gilles Peskine5a680562019-08-05 17:32:13 +02001677static_assert( ( PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE ) == 0,
Gilles Peskine094dac12019-08-07 18:19:46 +02001678 "One or more key attribute flag is listed as both internal-only and dual-use" );
Gilles Peskine5a680562019-08-05 17:32:13 +02001679static_assert( ( PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY ) == 0,
Gilles Peskine91e8c332019-08-02 19:19:39 +02001680 "One or more key attribute flag is listed as both internal-only and external-only" );
1681#endif
1682
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001683/** Validate that a key policy is internally well-formed.
1684 *
1685 * This function only rejects invalid policies. It does not validate the
1686 * consistency of the policy with respect to other attributes of the key
1687 * such as the key type.
1688 */
1689static psa_status_t psa_validate_key_policy( const psa_key_policy_t *policy )
Gilles Peskine4747d192019-04-17 15:05:45 +02001690{
1691 if( ( policy->usage & ~( PSA_KEY_USAGE_EXPORT |
Gilles Peskine8e0206a2019-05-14 14:24:28 +02001692 PSA_KEY_USAGE_COPY |
Gilles Peskine4747d192019-04-17 15:05:45 +02001693 PSA_KEY_USAGE_ENCRYPT |
1694 PSA_KEY_USAGE_DECRYPT |
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01001695 PSA_KEY_USAGE_SIGN_HASH |
1696 PSA_KEY_USAGE_VERIFY_HASH |
Gilles Peskine4747d192019-04-17 15:05:45 +02001697 PSA_KEY_USAGE_DERIVE ) ) != 0 )
1698 return( PSA_ERROR_INVALID_ARGUMENT );
1699
Gilles Peskine4747d192019-04-17 15:05:45 +02001700 return( PSA_SUCCESS );
1701}
1702
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001703/** Validate the internal consistency of key attributes.
1704 *
1705 * This function only rejects invalid attribute values. If does not
1706 * validate the consistency of the attributes with any key data that may
1707 * be involved in the creation of the key.
1708 *
1709 * Call this function early in the key creation process.
1710 *
1711 * \param[in] attributes Key attributes for the new key.
1712 * \param[out] p_drv On any return, the driver for the key, if any.
1713 * NULL for a transparent key.
1714 *
1715 */
1716static psa_status_t psa_validate_key_attributes(
1717 const psa_key_attributes_t *attributes,
1718 psa_se_drv_table_entry_t **p_drv )
Darryl Green0c6575a2018-11-07 16:05:30 +00001719{
Steven Cooreman81fe7c32020-06-08 18:37:19 +02001720 psa_status_t status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001721
Steven Cooreman8c1e7592020-06-17 14:52:05 +02001722 status = psa_validate_key_location( psa_get_key_lifetime( attributes ),
1723 p_drv );
Steven Cooreman81fe7c32020-06-08 18:37:19 +02001724 if( status != PSA_SUCCESS )
1725 return( status );
1726
Steven Cooreman8c1e7592020-06-17 14:52:05 +02001727 status = psa_validate_key_persistence( psa_get_key_lifetime( attributes ),
1728 psa_get_key_id( attributes ) );
Steven Cooreman81fe7c32020-06-08 18:37:19 +02001729 if( status != PSA_SUCCESS )
1730 return( status );
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001731
1732 status = psa_validate_key_policy( &attributes->core.policy );
Darryl Green0c6575a2018-11-07 16:05:30 +00001733 if( status != PSA_SUCCESS )
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001734 return( status );
1735
1736 /* Refuse to create overly large keys.
1737 * Note that this doesn't trigger on import if the attributes don't
1738 * explicitly specify a size (so psa_get_key_bits returns 0), so
1739 * psa_import_key() needs its own checks. */
1740 if( psa_get_key_bits( attributes ) > PSA_MAX_KEY_BITS )
1741 return( PSA_ERROR_NOT_SUPPORTED );
1742
Gilles Peskine91e8c332019-08-02 19:19:39 +02001743 /* Reject invalid flags. These should not be reachable through the API. */
1744 if( attributes->core.flags & ~ ( MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY |
1745 MBEDTLS_PSA_KA_MASK_DUAL_USE ) )
1746 return( PSA_ERROR_INVALID_ARGUMENT );
1747
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001748 return( PSA_SUCCESS );
1749}
1750
Gilles Peskine4747d192019-04-17 15:05:45 +02001751/** Prepare a key slot to receive key material.
1752 *
1753 * This function allocates a key slot and sets its metadata.
1754 *
1755 * If this function fails, call psa_fail_key_creation().
1756 *
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001757 * This function is intended to be used as follows:
1758 * -# Call psa_start_key_creation() to allocate a key slot, prepare
1759 * it with the specified attributes, and assign it a handle.
1760 * -# Populate the slot with the key material.
1761 * -# Call psa_finish_key_creation() to finalize the creation of the slot.
1762 * In case of failure at any step, stop the sequence and call
1763 * psa_fail_key_creation().
1764 *
Gilles Peskinedf179142019-07-15 22:02:14 +02001765 * \param method An identification of the calling function.
Gilles Peskine011e4282019-06-26 18:34:38 +02001766 * \param[in] attributes Key attributes for the new key.
1767 * \param[out] handle On success, a handle for the allocated slot.
1768 * \param[out] p_slot On success, a pointer to the prepared slot.
1769 * \param[out] p_drv On any return, the driver for the key, if any.
1770 * NULL for a transparent key.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001771 *
1772 * \retval #PSA_SUCCESS
1773 * The key slot is ready to receive key material.
1774 * \return If this function fails, the key slot is an invalid state.
1775 * You must call psa_fail_key_creation() to wipe and free the slot.
Gilles Peskine4747d192019-04-17 15:05:45 +02001776 */
1777static psa_status_t psa_start_key_creation(
Gilles Peskinedf179142019-07-15 22:02:14 +02001778 psa_key_creation_method_t method,
Gilles Peskine4747d192019-04-17 15:05:45 +02001779 const psa_key_attributes_t *attributes,
1780 psa_key_handle_t *handle,
Gilles Peskine011e4282019-06-26 18:34:38 +02001781 psa_key_slot_t **p_slot,
Gilles Peskine8abe6a22019-07-12 23:40:35 +02001782 psa_se_drv_table_entry_t **p_drv )
Gilles Peskine4747d192019-04-17 15:05:45 +02001783{
1784 psa_status_t status;
1785 psa_key_slot_t *slot;
1786
Gilles Peskinedf179142019-07-15 22:02:14 +02001787 (void) method;
Gilles Peskine011e4282019-06-26 18:34:38 +02001788 *p_drv = NULL;
1789
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001790 status = psa_validate_key_attributes( attributes, p_drv );
1791 if( status != PSA_SUCCESS )
1792 return( status );
1793
Gilles Peskineedbed562019-08-07 18:19:59 +02001794 status = psa_get_empty_key_slot( handle, p_slot );
Gilles Peskine4747d192019-04-17 15:05:45 +02001795 if( status != PSA_SUCCESS )
1796 return( status );
1797 slot = *p_slot;
1798
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001799 /* We're storing the declared bit-size of the key. It's up to each
1800 * creation mechanism to verify that this information is correct.
1801 * It's automatically correct for mechanisms that use the bit-size as
Gilles Peskineb46bef22019-07-30 21:32:04 +02001802 * an input (generate, device) but not for those where the bit-size
1803 * is optional (import, copy). */
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001804
1805 slot->attr = attributes->core;
Gilles Peskinec744d992019-07-30 17:26:54 +02001806
Gilles Peskine91e8c332019-08-02 19:19:39 +02001807 /* Erase external-only flags from the internal copy. To access
Gilles Peskine013f5472019-08-07 15:42:14 +02001808 * external-only flags, query `attributes`. Thanks to the check
1809 * in psa_validate_key_attributes(), this leaves the dual-use
Gilles Peskineedbed562019-08-07 18:19:59 +02001810 * flags and any internal flag that psa_get_empty_key_slot()
Gilles Peskine013f5472019-08-07 15:42:14 +02001811 * may have set. */
1812 slot->attr.flags &= ~MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY;
Gilles Peskine91e8c332019-08-02 19:19:39 +02001813
Gilles Peskinecbaff462019-07-12 23:46:04 +02001814#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined7729582019-08-05 15:55:54 +02001815 /* For a key in a secure element, we need to do three things
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001816 * when creating or registering a persistent key:
Gilles Peskine60450a42019-07-25 11:32:45 +02001817 * create the key file in internal storage, create the
1818 * key inside the secure element, and update the driver's
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001819 * persistent data. This is done by starting a transaction that will
1820 * encompass these three actions.
1821 * For registering a volatile key, we just need to find an appropriate
1822 * slot number inside the SE. Since the key is designated volatile, creating
1823 * a transaction is not required. */
Gilles Peskine60450a42019-07-25 11:32:45 +02001824 /* The first thing to do is to find a slot number for the new key.
1825 * We save the slot number in persistent storage as part of the
1826 * transaction data. It will be needed to recover if the power
1827 * fails during the key creation process, to clean up on the secure
1828 * element side after restarting. Obtaining a slot number from the
1829 * secure element driver updates its persistent state, but we do not yet
1830 * save the driver's persistent state, so that if the power fails,
Gilles Peskinefc762652019-07-22 19:30:34 +02001831 * we can roll back to a state where the key doesn't exist. */
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001832 if( *p_drv != NULL )
Darryl Green0c6575a2018-11-07 16:05:30 +00001833 {
Gilles Peskinee88c2c12019-08-05 16:44:14 +02001834 status = psa_find_se_slot_for_key( attributes, method, *p_drv,
Gilles Peskinecbaff462019-07-12 23:46:04 +02001835 &slot->data.se.slot_number );
1836 if( status != PSA_SUCCESS )
1837 return( status );
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001838
1839 if( ! PSA_KEY_LIFETIME_IS_VOLATILE( attributes->core.lifetime ) )
Gilles Peskine66be51c2019-07-25 18:02:52 +02001840 {
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001841 psa_crypto_prepare_transaction( PSA_CRYPTO_TRANSACTION_CREATE_KEY );
1842 psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
1843 psa_crypto_transaction.key.slot = slot->data.se.slot_number;
1844 psa_crypto_transaction.key.id = slot->attr.id;
1845 status = psa_crypto_save_transaction( );
1846 if( status != PSA_SUCCESS )
1847 {
1848 (void) psa_crypto_stop_transaction( );
1849 return( status );
1850 }
Gilles Peskine66be51c2019-07-25 18:02:52 +02001851 }
Darryl Green0c6575a2018-11-07 16:05:30 +00001852 }
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001853
1854 if( *p_drv == NULL && method == PSA_KEY_CREATION_REGISTER )
1855 {
1856 /* Key registration only makes sense with a secure element. */
1857 return( PSA_ERROR_INVALID_ARGUMENT );
1858 }
Gilles Peskinecbaff462019-07-12 23:46:04 +02001859#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1860
Darryl Green0c6575a2018-11-07 16:05:30 +00001861 return( status );
1862}
Gilles Peskine4747d192019-04-17 15:05:45 +02001863
1864/** Finalize the creation of a key once its key material has been set.
1865 *
1866 * This entails writing the key to persistent storage.
1867 *
1868 * If this function fails, call psa_fail_key_creation().
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001869 * See the documentation of psa_start_key_creation() for the intended use
1870 * of this function.
Gilles Peskine4747d192019-04-17 15:05:45 +02001871 *
Gilles Peskine011e4282019-06-26 18:34:38 +02001872 * \param[in,out] slot Pointer to the slot with key material.
1873 * \param[in] driver The secure element driver for the key,
1874 * or NULL for a transparent key.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001875 *
1876 * \retval #PSA_SUCCESS
1877 * The key was successfully created. The handle is now valid.
1878 * \return If this function fails, the key slot is an invalid state.
1879 * You must call psa_fail_key_creation() to wipe and free the slot.
Gilles Peskine4747d192019-04-17 15:05:45 +02001880 */
Gilles Peskine011e4282019-06-26 18:34:38 +02001881static psa_status_t psa_finish_key_creation(
1882 psa_key_slot_t *slot,
Gilles Peskine8abe6a22019-07-12 23:40:35 +02001883 psa_se_drv_table_entry_t *driver )
Gilles Peskine4747d192019-04-17 15:05:45 +02001884{
1885 psa_status_t status = PSA_SUCCESS;
Gilles Peskine30afafd2019-04-25 13:47:40 +02001886 (void) slot;
Gilles Peskine011e4282019-06-26 18:34:38 +02001887 (void) driver;
Gilles Peskine4747d192019-04-17 15:05:45 +02001888
1889#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Steven Cooremanc59de6a2020-06-08 18:28:25 +02001890 if( ! PSA_KEY_LIFETIME_IS_VOLATILE( slot->attr.lifetime ) )
Gilles Peskine4747d192019-04-17 15:05:45 +02001891 {
Gilles Peskine1df83d42019-07-23 16:13:14 +02001892#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1893 if( driver != NULL )
1894 {
Gilles Peskineb46bef22019-07-30 21:32:04 +02001895 psa_se_key_data_storage_t data;
1896#if defined(static_assert)
1897 static_assert( sizeof( slot->data.se.slot_number ) ==
1898 sizeof( data.slot_number ),
1899 "Slot number size does not match psa_se_key_data_storage_t" );
1900 static_assert( sizeof( slot->attr.bits ) == sizeof( data.bits ),
1901 "Bit-size size does not match psa_se_key_data_storage_t" );
1902#endif
1903 memcpy( &data.slot_number, &slot->data.se.slot_number,
1904 sizeof( slot->data.se.slot_number ) );
1905 memcpy( &data.bits, &slot->attr.bits,
1906 sizeof( slot->attr.bits ) );
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001907 status = psa_save_persistent_key( &slot->attr,
Gilles Peskineb46bef22019-07-30 21:32:04 +02001908 (uint8_t*) &data,
1909 sizeof( data ) );
Gilles Peskine1df83d42019-07-23 16:13:14 +02001910 }
1911 else
1912#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1913 {
Gilles Peskinee60d1d02019-07-24 20:27:59 +02001914 size_t buffer_size =
Gilles Peskine8e338702019-07-30 20:06:31 +02001915 PSA_KEY_EXPORT_MAX_SIZE( slot->attr.type,
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001916 slot->attr.bits );
Gilles Peskinee60d1d02019-07-24 20:27:59 +02001917 uint8_t *buffer = mbedtls_calloc( 1, buffer_size );
1918 size_t length = 0;
Gilles Peskinef9168942019-09-12 19:20:29 +02001919 if( buffer == NULL )
Gilles Peskine1df83d42019-07-23 16:13:14 +02001920 return( PSA_ERROR_INSUFFICIENT_MEMORY );
1921 status = psa_internal_export_key( slot,
1922 buffer, buffer_size, &length,
1923 0 );
Gilles Peskinee60d1d02019-07-24 20:27:59 +02001924 if( status == PSA_SUCCESS )
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001925 status = psa_save_persistent_key( &slot->attr,
Gilles Peskine4ed0e6f2019-07-30 20:22:33 +02001926 buffer, length );
Gilles Peskine4747d192019-04-17 15:05:45 +02001927
Gilles Peskinef9168942019-09-12 19:20:29 +02001928 mbedtls_platform_zeroize( buffer, buffer_size );
Gilles Peskine1df83d42019-07-23 16:13:14 +02001929 mbedtls_free( buffer );
1930 }
Gilles Peskine4747d192019-04-17 15:05:45 +02001931 }
Darryl Green0c6575a2018-11-07 16:05:30 +00001932#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
1933
Gilles Peskinecbaff462019-07-12 23:46:04 +02001934#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined7729582019-08-05 15:55:54 +02001935 /* Finish the transaction for a key creation. This does not
1936 * happen when registering an existing key. Detect this case
1937 * by checking whether a transaction is in progress (actual
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001938 * creation of a persistent key in a secure element requires a transaction,
1939 * but registration or volatile key creation doesn't use one). */
Gilles Peskined7729582019-08-05 15:55:54 +02001940 if( driver != NULL &&
1941 psa_crypto_transaction.unknown.type == PSA_CRYPTO_TRANSACTION_CREATE_KEY )
Gilles Peskinecbaff462019-07-12 23:46:04 +02001942 {
1943 status = psa_save_se_persistent_data( driver );
1944 if( status != PSA_SUCCESS )
1945 {
Gilles Peskine8e338702019-07-30 20:06:31 +02001946 psa_destroy_persistent_key( slot->attr.id );
Gilles Peskinecbaff462019-07-12 23:46:04 +02001947 return( status );
1948 }
Gilles Peskinefc762652019-07-22 19:30:34 +02001949 status = psa_crypto_stop_transaction( );
1950 if( status != PSA_SUCCESS )
1951 return( status );
Gilles Peskinecbaff462019-07-12 23:46:04 +02001952 }
1953#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1954
Gilles Peskine4747d192019-04-17 15:05:45 +02001955 return( status );
1956}
1957
1958/** Abort the creation of a key.
1959 *
1960 * You may call this function after calling psa_start_key_creation(),
1961 * or after psa_finish_key_creation() fails. In other circumstances, this
1962 * function may not clean up persistent storage.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001963 * See the documentation of psa_start_key_creation() for the intended use
1964 * of this function.
Gilles Peskine4747d192019-04-17 15:05:45 +02001965 *
Gilles Peskine011e4282019-06-26 18:34:38 +02001966 * \param[in,out] slot Pointer to the slot with key material.
1967 * \param[in] driver The secure element driver for the key,
1968 * or NULL for a transparent key.
Gilles Peskine4747d192019-04-17 15:05:45 +02001969 */
Gilles Peskine011e4282019-06-26 18:34:38 +02001970static void psa_fail_key_creation( psa_key_slot_t *slot,
Gilles Peskine8abe6a22019-07-12 23:40:35 +02001971 psa_se_drv_table_entry_t *driver )
Gilles Peskine4747d192019-04-17 15:05:45 +02001972{
Gilles Peskine011e4282019-06-26 18:34:38 +02001973 (void) driver;
1974
Gilles Peskine4747d192019-04-17 15:05:45 +02001975 if( slot == NULL )
1976 return;
Gilles Peskine011e4282019-06-26 18:34:38 +02001977
1978#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Janos Follath1d57a202019-08-13 12:15:34 +01001979 /* TODO: If the key has already been created in the secure
Gilles Peskine011e4282019-06-26 18:34:38 +02001980 * element, and the failure happened later (when saving metadata
1981 * to internal storage), we need to destroy the key in the secure
Gilles Peskinec9d7f942019-08-13 16:17:16 +02001982 * element.
1983 * https://github.com/ARMmbed/mbed-crypto/issues/217
1984 */
Gilles Peskinefc762652019-07-22 19:30:34 +02001985
Gilles Peskined7729582019-08-05 15:55:54 +02001986 /* Abort the ongoing transaction if any (there may not be one if
1987 * the creation process failed before starting one, or if the
1988 * key creation is a registration of a key in a secure element).
1989 * Earlier functions must already have done what it takes to undo any
1990 * partial creation. All that's left is to update the transaction data
1991 * itself. */
Gilles Peskinefc762652019-07-22 19:30:34 +02001992 (void) psa_crypto_stop_transaction( );
Gilles Peskine011e4282019-06-26 18:34:38 +02001993#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1994
Gilles Peskine4747d192019-04-17 15:05:45 +02001995 psa_wipe_key_slot( slot );
1996}
1997
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001998/** Validate optional attributes during key creation.
1999 *
2000 * Some key attributes are optional during key creation. If they are
2001 * specified in the attributes structure, check that they are consistent
2002 * with the data in the slot.
2003 *
2004 * This function should be called near the end of key creation, after
2005 * the slot in memory is fully populated but before saving persistent data.
2006 */
2007static psa_status_t psa_validate_optional_attributes(
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002008 const psa_key_slot_t *slot,
2009 const psa_key_attributes_t *attributes )
2010{
Gilles Peskine7e0cff92019-07-30 13:48:52 +02002011 if( attributes->core.type != 0 )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002012 {
Gilles Peskine8e338702019-07-30 20:06:31 +02002013 if( attributes->core.type != slot->attr.type )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002014 return( PSA_ERROR_INVALID_ARGUMENT );
2015 }
2016
2017 if( attributes->domain_parameters_size != 0 )
2018 {
2019#if defined(MBEDTLS_RSA_C)
Gilles Peskine8e338702019-07-30 20:06:31 +02002020 if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002021 {
Steven Cooremana2371e52020-07-28 14:30:39 +02002022 mbedtls_rsa_context *rsa = NULL;
Steven Cooreman75b74362020-07-28 14:30:13 +02002023 mbedtls_mpi actual, required;
Steven Cooreman6d839f02020-07-30 11:36:45 +02002024 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Steven Cooremana01795d2020-07-24 22:48:15 +02002025
Steven Cooreman7f391872020-07-30 14:57:44 +02002026 psa_status_t status = psa_load_rsa_representation(
Steven Cooreman4fed4552020-08-03 14:46:03 +02002027 slot->attr.type,
Steven Cooreman7f391872020-07-30 14:57:44 +02002028 slot->data.key.data,
2029 slot->data.key.bytes,
Steven Cooreman7f391872020-07-30 14:57:44 +02002030 &rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02002031 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02002032 return( status );
Steven Cooreman75b74362020-07-28 14:30:13 +02002033
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002034 mbedtls_mpi_init( &actual );
2035 mbedtls_mpi_init( &required );
Steven Cooremana2371e52020-07-28 14:30:39 +02002036 ret = mbedtls_rsa_export( rsa,
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002037 NULL, NULL, NULL, NULL, &actual );
Steven Cooremana2371e52020-07-28 14:30:39 +02002038 mbedtls_rsa_free( rsa );
2039 mbedtls_free( rsa );
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002040 if( ret != 0 )
2041 goto rsa_exit;
2042 ret = mbedtls_mpi_read_binary( &required,
2043 attributes->domain_parameters,
2044 attributes->domain_parameters_size );
2045 if( ret != 0 )
2046 goto rsa_exit;
2047 if( mbedtls_mpi_cmp_mpi( &actual, &required ) != 0 )
2048 ret = MBEDTLS_ERR_RSA_BAD_INPUT_DATA;
2049 rsa_exit:
2050 mbedtls_mpi_free( &actual );
2051 mbedtls_mpi_free( &required );
2052 if( ret != 0)
2053 return( mbedtls_to_psa_error( ret ) );
2054 }
2055 else
2056#endif
2057 {
2058 return( PSA_ERROR_INVALID_ARGUMENT );
2059 }
2060 }
2061
Gilles Peskine7e0cff92019-07-30 13:48:52 +02002062 if( attributes->core.bits != 0 )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002063 {
Gilles Peskineb46bef22019-07-30 21:32:04 +02002064 if( attributes->core.bits != slot->attr.bits )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002065 return( PSA_ERROR_INVALID_ARGUMENT );
2066 }
2067
2068 return( PSA_SUCCESS );
2069}
2070
Gilles Peskine4747d192019-04-17 15:05:45 +02002071psa_status_t psa_import_key( const psa_key_attributes_t *attributes,
Gilles Peskine4747d192019-04-17 15:05:45 +02002072 const uint8_t *data,
Gilles Peskine73676cb2019-05-15 20:15:10 +02002073 size_t data_length,
2074 psa_key_handle_t *handle )
Gilles Peskine4747d192019-04-17 15:05:45 +02002075{
2076 psa_status_t status;
2077 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02002078 psa_se_drv_table_entry_t *driver = NULL;
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002079
Gilles Peskine0f84d622019-09-12 19:03:13 +02002080 /* Reject zero-length symmetric keys (including raw data key objects).
2081 * This also rejects any key which might be encoded as an empty string,
2082 * which is never valid. */
2083 if( data_length == 0 )
2084 return( PSA_ERROR_INVALID_ARGUMENT );
2085
Gilles Peskinedf179142019-07-15 22:02:14 +02002086 status = psa_start_key_creation( PSA_KEY_CREATION_IMPORT, attributes,
2087 handle, &slot, &driver );
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002088 if( status != PSA_SUCCESS )
2089 goto exit;
2090
Gilles Peskine5d309672019-07-12 23:47:28 +02002091#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
2092 if( driver != NULL )
2093 {
2094 const psa_drv_se_t *drv = psa_get_se_driver_methods( driver );
Darryl Green0892d0f2019-08-20 09:50:14 +01002095 /* The driver should set the number of key bits, however in
2096 * case it doesn't, we initialize bits to an invalid value. */
2097 size_t bits = PSA_MAX_KEY_BITS + 1;
Gilles Peskine5d309672019-07-12 23:47:28 +02002098 if( drv->key_management == NULL ||
2099 drv->key_management->p_import == NULL )
2100 {
2101 status = PSA_ERROR_NOT_SUPPORTED;
2102 goto exit;
2103 }
2104 status = drv->key_management->p_import(
2105 psa_get_se_driver_context( driver ),
Gilles Peskinef3801ff2019-08-06 17:32:04 +02002106 slot->data.se.slot_number, attributes, data, data_length,
Gilles Peskineb46bef22019-07-30 21:32:04 +02002107 &bits );
2108 if( status != PSA_SUCCESS )
2109 goto exit;
2110 if( bits > PSA_MAX_KEY_BITS )
2111 {
2112 status = PSA_ERROR_NOT_SUPPORTED;
2113 goto exit;
2114 }
2115 slot->attr.bits = (psa_key_bits_t) bits;
Gilles Peskine5d309672019-07-12 23:47:28 +02002116 }
2117 else
2118#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
2119 {
2120 status = psa_import_key_into_slot( slot, data, data_length );
2121 if( status != PSA_SUCCESS )
2122 goto exit;
Gilles Peskine5d309672019-07-12 23:47:28 +02002123 }
Gilles Peskine1b8594a2019-07-31 17:21:46 +02002124 status = psa_validate_optional_attributes( slot, attributes );
Gilles Peskine18017402019-07-24 20:25:59 +02002125 if( status != PSA_SUCCESS )
2126 goto exit;
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002127
Gilles Peskine011e4282019-06-26 18:34:38 +02002128 status = psa_finish_key_creation( slot, driver );
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002129exit:
Gilles Peskine4747d192019-04-17 15:05:45 +02002130 if( status != PSA_SUCCESS )
2131 {
Gilles Peskine011e4282019-06-26 18:34:38 +02002132 psa_fail_key_creation( slot, driver );
Gilles Peskine4747d192019-04-17 15:05:45 +02002133 *handle = 0;
2134 }
2135 return( status );
2136}
2137
Gilles Peskined7729582019-08-05 15:55:54 +02002138#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
2139psa_status_t mbedtls_psa_register_se_key(
2140 const psa_key_attributes_t *attributes )
2141{
2142 psa_status_t status;
2143 psa_key_slot_t *slot = NULL;
2144 psa_se_drv_table_entry_t *driver = NULL;
Gilles Peskined7729582019-08-05 15:55:54 +02002145 psa_key_handle_t handle = 0;
2146
2147 /* Leaving attributes unspecified is not currently supported.
2148 * It could make sense to query the key type and size from the
2149 * secure element, but not all secure elements support this
2150 * and the driver HAL doesn't currently support it. */
2151 if( psa_get_key_type( attributes ) == PSA_KEY_TYPE_NONE )
2152 return( PSA_ERROR_NOT_SUPPORTED );
2153 if( psa_get_key_bits( attributes ) == 0 )
2154 return( PSA_ERROR_NOT_SUPPORTED );
2155
2156 status = psa_start_key_creation( PSA_KEY_CREATION_REGISTER, attributes,
2157 &handle, &slot, &driver );
2158 if( status != PSA_SUCCESS )
2159 goto exit;
2160
Gilles Peskined7729582019-08-05 15:55:54 +02002161 status = psa_finish_key_creation( slot, driver );
2162
2163exit:
2164 if( status != PSA_SUCCESS )
2165 {
2166 psa_fail_key_creation( slot, driver );
2167 }
2168 /* Registration doesn't keep the key in RAM. */
2169 psa_close_key( handle );
2170 return( status );
2171}
2172#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
2173
Gilles Peskinef603c712019-01-19 13:40:11 +01002174static psa_status_t psa_copy_key_material( const psa_key_slot_t *source,
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002175 psa_key_slot_t *target )
Gilles Peskinef603c712019-01-19 13:40:11 +01002176{
2177 psa_status_t status;
2178 uint8_t *buffer = NULL;
2179 size_t buffer_size = 0;
2180 size_t length;
2181
Gilles Peskine8e338702019-07-30 20:06:31 +02002182 buffer_size = PSA_KEY_EXPORT_MAX_SIZE( source->attr.type,
Gilles Peskinedb4b3ab2019-04-18 12:53:01 +02002183 psa_get_key_slot_bits( source ) );
Gilles Peskinef603c712019-01-19 13:40:11 +01002184 buffer = mbedtls_calloc( 1, buffer_size );
Gilles Peskinef9168942019-09-12 19:20:29 +02002185 if( buffer == NULL )
Gilles Peskine122d0022019-01-23 10:55:43 +01002186 return( PSA_ERROR_INSUFFICIENT_MEMORY );
Gilles Peskinef603c712019-01-19 13:40:11 +01002187 status = psa_internal_export_key( source, buffer, buffer_size, &length, 0 );
2188 if( status != PSA_SUCCESS )
2189 goto exit;
Gilles Peskine8e338702019-07-30 20:06:31 +02002190 target->attr.type = source->attr.type;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002191 status = psa_import_key_into_slot( target, buffer, length );
Gilles Peskinef603c712019-01-19 13:40:11 +01002192
2193exit:
Gilles Peskinef9168942019-09-12 19:20:29 +02002194 mbedtls_platform_zeroize( buffer, buffer_size );
Gilles Peskine122d0022019-01-23 10:55:43 +01002195 mbedtls_free( buffer );
Gilles Peskinef603c712019-01-19 13:40:11 +01002196 return( status );
2197}
2198
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002199psa_status_t psa_copy_key( psa_key_handle_t source_handle,
2200 const psa_key_attributes_t *specified_attributes,
2201 psa_key_handle_t *target_handle )
Gilles Peskinef603c712019-01-19 13:40:11 +01002202{
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002203 psa_status_t status;
Gilles Peskinef603c712019-01-19 13:40:11 +01002204 psa_key_slot_t *source_slot = NULL;
2205 psa_key_slot_t *target_slot = NULL;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002206 psa_key_attributes_t actual_attributes = *specified_attributes;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02002207 psa_se_drv_table_entry_t *driver = NULL;
Gilles Peskinef603c712019-01-19 13:40:11 +01002208
Gilles Peskine28f8f302019-07-24 13:30:31 +02002209 status = psa_get_transparent_key( source_handle, &source_slot,
Gilles Peskinef77a6ac2019-07-25 10:51:03 +02002210 PSA_KEY_USAGE_COPY, 0 );
Gilles Peskinef603c712019-01-19 13:40:11 +01002211 if( status != PSA_SUCCESS )
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002212 goto exit;
2213
Gilles Peskine1b8594a2019-07-31 17:21:46 +02002214 status = psa_validate_optional_attributes( source_slot,
2215 specified_attributes );
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002216 if( status != PSA_SUCCESS )
2217 goto exit;
2218
Gilles Peskine7e0cff92019-07-30 13:48:52 +02002219 status = psa_restrict_key_policy( &actual_attributes.core.policy,
Gilles Peskine8e338702019-07-30 20:06:31 +02002220 &source_slot->attr.policy );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002221 if( status != PSA_SUCCESS )
2222 goto exit;
2223
Gilles Peskinedf179142019-07-15 22:02:14 +02002224 status = psa_start_key_creation( PSA_KEY_CREATION_COPY,
2225 &actual_attributes,
Gilles Peskine011e4282019-06-26 18:34:38 +02002226 target_handle, &target_slot, &driver );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002227 if( status != PSA_SUCCESS )
2228 goto exit;
2229
Gilles Peskinef4ee6622019-07-24 13:44:30 +02002230#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
2231 if( driver != NULL )
Gilles Peskinef603c712019-01-19 13:40:11 +01002232 {
Gilles Peskinef4ee6622019-07-24 13:44:30 +02002233 /* Copying to a secure element is not implemented yet. */
2234 status = PSA_ERROR_NOT_SUPPORTED;
2235 goto exit;
Gilles Peskinef603c712019-01-19 13:40:11 +01002236 }
Gilles Peskinef4ee6622019-07-24 13:44:30 +02002237#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskinef603c712019-01-19 13:40:11 +01002238
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002239 status = psa_copy_key_material( source_slot, target_slot );
Gilles Peskinef603c712019-01-19 13:40:11 +01002240 if( status != PSA_SUCCESS )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002241 goto exit;
Gilles Peskinef603c712019-01-19 13:40:11 +01002242
Gilles Peskine011e4282019-06-26 18:34:38 +02002243 status = psa_finish_key_creation( target_slot, driver );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002244exit:
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002245 if( status != PSA_SUCCESS )
2246 {
Gilles Peskine011e4282019-06-26 18:34:38 +02002247 psa_fail_key_creation( target_slot, driver );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002248 *target_handle = 0;
2249 }
2250 return( status );
Gilles Peskinef603c712019-01-19 13:40:11 +01002251}
2252
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02002253
2254
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01002255/****************************************************************/
Gilles Peskine20035e32018-02-03 22:44:14 +01002256/* Message digests */
2257/****************************************************************/
2258
Gilles Peskineb16841e2019-10-10 20:36:12 +02002259#if defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_DETERMINISTIC)
Gilles Peskinedc2fc842018-03-07 16:42:59 +01002260static const mbedtls_md_info_t *mbedtls_md_info_from_psa( psa_algorithm_t alg )
Gilles Peskine20035e32018-02-03 22:44:14 +01002261{
2262 switch( alg )
2263 {
2264#if defined(MBEDTLS_MD2_C)
2265 case PSA_ALG_MD2:
2266 return( &mbedtls_md2_info );
2267#endif
2268#if defined(MBEDTLS_MD4_C)
2269 case PSA_ALG_MD4:
2270 return( &mbedtls_md4_info );
2271#endif
2272#if defined(MBEDTLS_MD5_C)
2273 case PSA_ALG_MD5:
2274 return( &mbedtls_md5_info );
2275#endif
2276#if defined(MBEDTLS_RIPEMD160_C)
2277 case PSA_ALG_RIPEMD160:
2278 return( &mbedtls_ripemd160_info );
2279#endif
2280#if defined(MBEDTLS_SHA1_C)
2281 case PSA_ALG_SHA_1:
2282 return( &mbedtls_sha1_info );
2283#endif
2284#if defined(MBEDTLS_SHA256_C)
2285 case PSA_ALG_SHA_224:
2286 return( &mbedtls_sha224_info );
2287 case PSA_ALG_SHA_256:
2288 return( &mbedtls_sha256_info );
2289#endif
2290#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnardd6020842019-07-17 16:28:21 +02002291#if !defined(MBEDTLS_SHA512_NO_SHA384)
Gilles Peskine20035e32018-02-03 22:44:14 +01002292 case PSA_ALG_SHA_384:
2293 return( &mbedtls_sha384_info );
Manuel Pégourié-Gonnardd6020842019-07-17 16:28:21 +02002294#endif
Gilles Peskine20035e32018-02-03 22:44:14 +01002295 case PSA_ALG_SHA_512:
2296 return( &mbedtls_sha512_info );
2297#endif
2298 default:
2299 return( NULL );
2300 }
2301}
Gilles Peskineb16841e2019-10-10 20:36:12 +02002302#endif
Gilles Peskine20035e32018-02-03 22:44:14 +01002303
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002304psa_status_t psa_hash_abort( psa_hash_operation_t *operation )
2305{
2306 switch( operation->alg )
2307 {
Gilles Peskine81736312018-06-26 15:04:31 +02002308 case 0:
2309 /* The object has (apparently) been initialized but it is not
2310 * in use. It's ok to call abort on such an object, and there's
2311 * nothing to do. */
2312 break;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002313#if defined(MBEDTLS_MD2_C)
2314 case PSA_ALG_MD2:
2315 mbedtls_md2_free( &operation->ctx.md2 );
2316 break;
2317#endif
2318#if defined(MBEDTLS_MD4_C)
2319 case PSA_ALG_MD4:
2320 mbedtls_md4_free( &operation->ctx.md4 );
2321 break;
2322#endif
2323#if defined(MBEDTLS_MD5_C)
2324 case PSA_ALG_MD5:
2325 mbedtls_md5_free( &operation->ctx.md5 );
2326 break;
2327#endif
2328#if defined(MBEDTLS_RIPEMD160_C)
2329 case PSA_ALG_RIPEMD160:
2330 mbedtls_ripemd160_free( &operation->ctx.ripemd160 );
2331 break;
2332#endif
2333#if defined(MBEDTLS_SHA1_C)
2334 case PSA_ALG_SHA_1:
2335 mbedtls_sha1_free( &operation->ctx.sha1 );
2336 break;
2337#endif
2338#if defined(MBEDTLS_SHA256_C)
2339 case PSA_ALG_SHA_224:
2340 case PSA_ALG_SHA_256:
2341 mbedtls_sha256_free( &operation->ctx.sha256 );
2342 break;
2343#endif
2344#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnard792b16d2020-01-07 10:13:18 +01002345#if !defined(MBEDTLS_SHA512_NO_SHA384)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002346 case PSA_ALG_SHA_384:
Manuel Pégourié-Gonnard792b16d2020-01-07 10:13:18 +01002347#endif
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002348 case PSA_ALG_SHA_512:
2349 mbedtls_sha512_free( &operation->ctx.sha512 );
2350 break;
2351#endif
2352 default:
Gilles Peskinef9c2c092018-06-21 16:57:07 +02002353 return( PSA_ERROR_BAD_STATE );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002354 }
2355 operation->alg = 0;
2356 return( PSA_SUCCESS );
2357}
2358
Gilles Peskineda8191d1c2018-07-08 19:46:38 +02002359psa_status_t psa_hash_setup( psa_hash_operation_t *operation,
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002360 psa_algorithm_t alg )
2361{
Janos Follath24eed8d2019-11-22 13:21:35 +00002362 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jaeden Amero36ee5d02019-02-19 09:25:10 +00002363
2364 /* A context must be freshly initialized before it can be set up. */
2365 if( operation->alg != 0 )
2366 {
2367 return( PSA_ERROR_BAD_STATE );
2368 }
2369
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002370 switch( alg )
2371 {
2372#if defined(MBEDTLS_MD2_C)
2373 case PSA_ALG_MD2:
2374 mbedtls_md2_init( &operation->ctx.md2 );
2375 ret = mbedtls_md2_starts_ret( &operation->ctx.md2 );
2376 break;
2377#endif
2378#if defined(MBEDTLS_MD4_C)
2379 case PSA_ALG_MD4:
2380 mbedtls_md4_init( &operation->ctx.md4 );
2381 ret = mbedtls_md4_starts_ret( &operation->ctx.md4 );
2382 break;
2383#endif
2384#if defined(MBEDTLS_MD5_C)
2385 case PSA_ALG_MD5:
2386 mbedtls_md5_init( &operation->ctx.md5 );
2387 ret = mbedtls_md5_starts_ret( &operation->ctx.md5 );
2388 break;
2389#endif
2390#if defined(MBEDTLS_RIPEMD160_C)
2391 case PSA_ALG_RIPEMD160:
2392 mbedtls_ripemd160_init( &operation->ctx.ripemd160 );
2393 ret = mbedtls_ripemd160_starts_ret( &operation->ctx.ripemd160 );
2394 break;
2395#endif
2396#if defined(MBEDTLS_SHA1_C)
2397 case PSA_ALG_SHA_1:
2398 mbedtls_sha1_init( &operation->ctx.sha1 );
2399 ret = mbedtls_sha1_starts_ret( &operation->ctx.sha1 );
2400 break;
2401#endif
2402#if defined(MBEDTLS_SHA256_C)
2403 case PSA_ALG_SHA_224:
2404 mbedtls_sha256_init( &operation->ctx.sha256 );
2405 ret = mbedtls_sha256_starts_ret( &operation->ctx.sha256, 1 );
2406 break;
2407 case PSA_ALG_SHA_256:
2408 mbedtls_sha256_init( &operation->ctx.sha256 );
2409 ret = mbedtls_sha256_starts_ret( &operation->ctx.sha256, 0 );
2410 break;
2411#endif
2412#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnard792b16d2020-01-07 10:13:18 +01002413#if !defined(MBEDTLS_SHA512_NO_SHA384)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002414 case PSA_ALG_SHA_384:
2415 mbedtls_sha512_init( &operation->ctx.sha512 );
2416 ret = mbedtls_sha512_starts_ret( &operation->ctx.sha512, 1 );
2417 break;
Manuel Pégourié-Gonnard792b16d2020-01-07 10:13:18 +01002418#endif
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002419 case PSA_ALG_SHA_512:
2420 mbedtls_sha512_init( &operation->ctx.sha512 );
2421 ret = mbedtls_sha512_starts_ret( &operation->ctx.sha512, 0 );
2422 break;
2423#endif
2424 default:
Gilles Peskinec06e0712018-06-20 16:21:04 +02002425 return( PSA_ALG_IS_HASH( alg ) ?
2426 PSA_ERROR_NOT_SUPPORTED :
2427 PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002428 }
2429 if( ret == 0 )
2430 operation->alg = alg;
2431 else
2432 psa_hash_abort( operation );
2433 return( mbedtls_to_psa_error( ret ) );
2434}
2435
2436psa_status_t psa_hash_update( psa_hash_operation_t *operation,
2437 const uint8_t *input,
2438 size_t input_length )
2439{
Janos Follath24eed8d2019-11-22 13:21:35 +00002440 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine94e44542018-07-12 16:58:43 +02002441
2442 /* Don't require hash implementations to behave correctly on a
2443 * zero-length input, which may have an invalid pointer. */
2444 if( input_length == 0 )
2445 return( PSA_SUCCESS );
2446
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002447 switch( operation->alg )
2448 {
2449#if defined(MBEDTLS_MD2_C)
2450 case PSA_ALG_MD2:
2451 ret = mbedtls_md2_update_ret( &operation->ctx.md2,
2452 input, input_length );
2453 break;
2454#endif
2455#if defined(MBEDTLS_MD4_C)
2456 case PSA_ALG_MD4:
2457 ret = mbedtls_md4_update_ret( &operation->ctx.md4,
2458 input, input_length );
2459 break;
2460#endif
2461#if defined(MBEDTLS_MD5_C)
2462 case PSA_ALG_MD5:
2463 ret = mbedtls_md5_update_ret( &operation->ctx.md5,
2464 input, input_length );
2465 break;
2466#endif
2467#if defined(MBEDTLS_RIPEMD160_C)
2468 case PSA_ALG_RIPEMD160:
2469 ret = mbedtls_ripemd160_update_ret( &operation->ctx.ripemd160,
2470 input, input_length );
2471 break;
2472#endif
2473#if defined(MBEDTLS_SHA1_C)
2474 case PSA_ALG_SHA_1:
2475 ret = mbedtls_sha1_update_ret( &operation->ctx.sha1,
2476 input, input_length );
2477 break;
2478#endif
2479#if defined(MBEDTLS_SHA256_C)
2480 case PSA_ALG_SHA_224:
2481 case PSA_ALG_SHA_256:
2482 ret = mbedtls_sha256_update_ret( &operation->ctx.sha256,
2483 input, input_length );
2484 break;
2485#endif
2486#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnard792b16d2020-01-07 10:13:18 +01002487#if !defined(MBEDTLS_SHA512_NO_SHA384)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002488 case PSA_ALG_SHA_384:
Manuel Pégourié-Gonnard792b16d2020-01-07 10:13:18 +01002489#endif
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002490 case PSA_ALG_SHA_512:
2491 ret = mbedtls_sha512_update_ret( &operation->ctx.sha512,
2492 input, input_length );
2493 break;
2494#endif
2495 default:
Jaeden Ameroa0f625a2019-02-15 13:52:25 +00002496 return( PSA_ERROR_BAD_STATE );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002497 }
Gilles Peskine94e44542018-07-12 16:58:43 +02002498
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002499 if( ret != 0 )
2500 psa_hash_abort( operation );
2501 return( mbedtls_to_psa_error( ret ) );
2502}
2503
2504psa_status_t psa_hash_finish( psa_hash_operation_t *operation,
2505 uint8_t *hash,
2506 size_t hash_size,
2507 size_t *hash_length )
2508{
itayzafrir40835d42018-08-02 13:14:17 +03002509 psa_status_t status;
Janos Follath24eed8d2019-11-22 13:21:35 +00002510 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine71bb7b72018-04-19 08:29:59 +02002511 size_t actual_hash_length = PSA_HASH_SIZE( operation->alg );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002512
2513 /* Fill the output buffer with something that isn't a valid hash
2514 * (barring an attack on the hash and deliberately-crafted input),
2515 * in case the caller doesn't check the return status properly. */
Gilles Peskineaee13332018-07-02 12:15:28 +02002516 *hash_length = hash_size;
Gilles Peskine46f1fd72018-06-28 19:31:31 +02002517 /* If hash_size is 0 then hash may be NULL and then the
2518 * call to memset would have undefined behavior. */
2519 if( hash_size != 0 )
2520 memset( hash, '!', hash_size );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002521
2522 if( hash_size < actual_hash_length )
itayzafrir40835d42018-08-02 13:14:17 +03002523 {
2524 status = PSA_ERROR_BUFFER_TOO_SMALL;
2525 goto exit;
2526 }
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002527
2528 switch( operation->alg )
2529 {
2530#if defined(MBEDTLS_MD2_C)
2531 case PSA_ALG_MD2:
2532 ret = mbedtls_md2_finish_ret( &operation->ctx.md2, hash );
2533 break;
2534#endif
2535#if defined(MBEDTLS_MD4_C)
2536 case PSA_ALG_MD4:
2537 ret = mbedtls_md4_finish_ret( &operation->ctx.md4, hash );
2538 break;
2539#endif
2540#if defined(MBEDTLS_MD5_C)
2541 case PSA_ALG_MD5:
2542 ret = mbedtls_md5_finish_ret( &operation->ctx.md5, hash );
2543 break;
2544#endif
2545#if defined(MBEDTLS_RIPEMD160_C)
2546 case PSA_ALG_RIPEMD160:
2547 ret = mbedtls_ripemd160_finish_ret( &operation->ctx.ripemd160, hash );
2548 break;
2549#endif
2550#if defined(MBEDTLS_SHA1_C)
2551 case PSA_ALG_SHA_1:
2552 ret = mbedtls_sha1_finish_ret( &operation->ctx.sha1, hash );
2553 break;
2554#endif
2555#if defined(MBEDTLS_SHA256_C)
2556 case PSA_ALG_SHA_224:
2557 case PSA_ALG_SHA_256:
2558 ret = mbedtls_sha256_finish_ret( &operation->ctx.sha256, hash );
2559 break;
2560#endif
2561#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnard792b16d2020-01-07 10:13:18 +01002562#if !defined(MBEDTLS_SHA512_NO_SHA384)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002563 case PSA_ALG_SHA_384:
Manuel Pégourié-Gonnard792b16d2020-01-07 10:13:18 +01002564#endif
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002565 case PSA_ALG_SHA_512:
2566 ret = mbedtls_sha512_finish_ret( &operation->ctx.sha512, hash );
2567 break;
2568#endif
2569 default:
Jaeden Ameroa0f625a2019-02-15 13:52:25 +00002570 return( PSA_ERROR_BAD_STATE );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002571 }
itayzafrir40835d42018-08-02 13:14:17 +03002572 status = mbedtls_to_psa_error( ret );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002573
itayzafrir40835d42018-08-02 13:14:17 +03002574exit:
2575 if( status == PSA_SUCCESS )
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002576 {
Gilles Peskineaee13332018-07-02 12:15:28 +02002577 *hash_length = actual_hash_length;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002578 return( psa_hash_abort( operation ) );
2579 }
2580 else
2581 {
2582 psa_hash_abort( operation );
itayzafrir40835d42018-08-02 13:14:17 +03002583 return( status );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002584 }
2585}
2586
Gilles Peskine2d277862018-06-18 15:41:12 +02002587psa_status_t psa_hash_verify( psa_hash_operation_t *operation,
2588 const uint8_t *hash,
2589 size_t hash_length )
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002590{
2591 uint8_t actual_hash[MBEDTLS_MD_MAX_SIZE];
2592 size_t actual_hash_length;
2593 psa_status_t status = psa_hash_finish( operation,
2594 actual_hash, sizeof( actual_hash ),
2595 &actual_hash_length );
2596 if( status != PSA_SUCCESS )
2597 return( status );
2598 if( actual_hash_length != hash_length )
2599 return( PSA_ERROR_INVALID_SIGNATURE );
2600 if( safer_memcmp( hash, actual_hash, actual_hash_length ) != 0 )
2601 return( PSA_ERROR_INVALID_SIGNATURE );
2602 return( PSA_SUCCESS );
2603}
2604
Gilles Peskine0a749c82019-11-28 19:33:58 +01002605psa_status_t psa_hash_compute( psa_algorithm_t alg,
2606 const uint8_t *input, size_t input_length,
2607 uint8_t *hash, size_t hash_size,
2608 size_t *hash_length )
2609{
2610 psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT;
2611 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2612
2613 *hash_length = hash_size;
2614 status = psa_hash_setup( &operation, alg );
2615 if( status != PSA_SUCCESS )
2616 goto exit;
2617 status = psa_hash_update( &operation, input, input_length );
2618 if( status != PSA_SUCCESS )
2619 goto exit;
2620 status = psa_hash_finish( &operation, hash, hash_size, hash_length );
2621 if( status != PSA_SUCCESS )
2622 goto exit;
2623
2624exit:
2625 if( status == PSA_SUCCESS )
2626 status = psa_hash_abort( &operation );
2627 else
2628 psa_hash_abort( &operation );
2629 return( status );
2630}
2631
2632psa_status_t psa_hash_compare( psa_algorithm_t alg,
2633 const uint8_t *input, size_t input_length,
2634 const uint8_t *hash, size_t hash_length )
2635{
2636 psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT;
2637 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2638
2639 status = psa_hash_setup( &operation, alg );
2640 if( status != PSA_SUCCESS )
2641 goto exit;
2642 status = psa_hash_update( &operation, input, input_length );
2643 if( status != PSA_SUCCESS )
2644 goto exit;
2645 status = psa_hash_verify( &operation, hash, hash_length );
2646 if( status != PSA_SUCCESS )
2647 goto exit;
2648
2649exit:
2650 if( status == PSA_SUCCESS )
2651 status = psa_hash_abort( &operation );
2652 else
2653 psa_hash_abort( &operation );
2654 return( status );
2655}
2656
Gilles Peskineeb35d782019-01-22 17:56:16 +01002657psa_status_t psa_hash_clone( const psa_hash_operation_t *source_operation,
2658 psa_hash_operation_t *target_operation )
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002659{
2660 if( target_operation->alg != 0 )
2661 return( PSA_ERROR_BAD_STATE );
2662
2663 switch( source_operation->alg )
2664 {
2665 case 0:
2666 return( PSA_ERROR_BAD_STATE );
2667#if defined(MBEDTLS_MD2_C)
2668 case PSA_ALG_MD2:
2669 mbedtls_md2_clone( &target_operation->ctx.md2,
2670 &source_operation->ctx.md2 );
2671 break;
2672#endif
2673#if defined(MBEDTLS_MD4_C)
2674 case PSA_ALG_MD4:
2675 mbedtls_md4_clone( &target_operation->ctx.md4,
2676 &source_operation->ctx.md4 );
2677 break;
2678#endif
2679#if defined(MBEDTLS_MD5_C)
2680 case PSA_ALG_MD5:
2681 mbedtls_md5_clone( &target_operation->ctx.md5,
2682 &source_operation->ctx.md5 );
2683 break;
2684#endif
2685#if defined(MBEDTLS_RIPEMD160_C)
2686 case PSA_ALG_RIPEMD160:
2687 mbedtls_ripemd160_clone( &target_operation->ctx.ripemd160,
2688 &source_operation->ctx.ripemd160 );
2689 break;
2690#endif
2691#if defined(MBEDTLS_SHA1_C)
2692 case PSA_ALG_SHA_1:
2693 mbedtls_sha1_clone( &target_operation->ctx.sha1,
2694 &source_operation->ctx.sha1 );
2695 break;
2696#endif
2697#if defined(MBEDTLS_SHA256_C)
2698 case PSA_ALG_SHA_224:
2699 case PSA_ALG_SHA_256:
2700 mbedtls_sha256_clone( &target_operation->ctx.sha256,
2701 &source_operation->ctx.sha256 );
2702 break;
2703#endif
2704#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnard792b16d2020-01-07 10:13:18 +01002705#if !defined(MBEDTLS_SHA512_NO_SHA384)
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002706 case PSA_ALG_SHA_384:
Manuel Pégourié-Gonnard792b16d2020-01-07 10:13:18 +01002707#endif
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002708 case PSA_ALG_SHA_512:
2709 mbedtls_sha512_clone( &target_operation->ctx.sha512,
2710 &source_operation->ctx.sha512 );
2711 break;
2712#endif
2713 default:
2714 return( PSA_ERROR_NOT_SUPPORTED );
2715 }
2716
2717 target_operation->alg = source_operation->alg;
2718 return( PSA_SUCCESS );
2719}
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002720
2721
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002722/****************************************************************/
Gilles Peskine8c9def32018-02-08 10:02:12 +01002723/* MAC */
2724/****************************************************************/
2725
Gilles Peskinedc2fc842018-03-07 16:42:59 +01002726static const mbedtls_cipher_info_t *mbedtls_cipher_info_from_psa(
Gilles Peskine8c9def32018-02-08 10:02:12 +01002727 psa_algorithm_t alg,
2728 psa_key_type_t key_type,
Gilles Peskine2d277862018-06-18 15:41:12 +02002729 size_t key_bits,
mohammad1603f4f0d612018-06-03 15:04:51 +03002730 mbedtls_cipher_id_t* cipher_id )
Gilles Peskine8c9def32018-02-08 10:02:12 +01002731{
Gilles Peskine8c9def32018-02-08 10:02:12 +01002732 mbedtls_cipher_mode_t mode;
mohammad1603f4f0d612018-06-03 15:04:51 +03002733 mbedtls_cipher_id_t cipher_id_tmp;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002734
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02002735 if( PSA_ALG_IS_AEAD( alg ) )
Gilles Peskine57fbdb12018-10-17 18:29:17 +02002736 alg = PSA_ALG_AEAD_WITH_TAG_LENGTH( alg, 0 );
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02002737
Gilles Peskine8c9def32018-02-08 10:02:12 +01002738 if( PSA_ALG_IS_CIPHER( alg ) || PSA_ALG_IS_AEAD( alg ) )
2739 {
Nir Sonnenscheine9664c32018-06-17 14:41:30 +03002740 switch( alg )
Gilles Peskine8c9def32018-02-08 10:02:12 +01002741 {
Gilles Peskinedaea26f2018-08-21 14:02:45 +02002742 case PSA_ALG_ARC4:
Gilles Peskine26869f22019-05-06 15:25:00 +02002743 case PSA_ALG_CHACHA20:
Gilles Peskine8c9def32018-02-08 10:02:12 +01002744 mode = MBEDTLS_MODE_STREAM;
2745 break;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002746 case PSA_ALG_CTR:
2747 mode = MBEDTLS_MODE_CTR;
2748 break;
Gilles Peskinedaea26f2018-08-21 14:02:45 +02002749 case PSA_ALG_CFB:
2750 mode = MBEDTLS_MODE_CFB;
2751 break;
2752 case PSA_ALG_OFB:
2753 mode = MBEDTLS_MODE_OFB;
2754 break;
Steven Cooremaned3c9ec2020-07-06 14:08:59 +02002755 case PSA_ALG_ECB_NO_PADDING:
2756 mode = MBEDTLS_MODE_ECB;
2757 break;
Gilles Peskinedaea26f2018-08-21 14:02:45 +02002758 case PSA_ALG_CBC_NO_PADDING:
2759 mode = MBEDTLS_MODE_CBC;
2760 break;
2761 case PSA_ALG_CBC_PKCS7:
2762 mode = MBEDTLS_MODE_CBC;
2763 break;
Gilles Peskine57fbdb12018-10-17 18:29:17 +02002764 case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_CCM, 0 ):
Gilles Peskine8c9def32018-02-08 10:02:12 +01002765 mode = MBEDTLS_MODE_CCM;
2766 break;
Gilles Peskine57fbdb12018-10-17 18:29:17 +02002767 case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_GCM, 0 ):
Gilles Peskine8c9def32018-02-08 10:02:12 +01002768 mode = MBEDTLS_MODE_GCM;
2769 break;
Gilles Peskine26869f22019-05-06 15:25:00 +02002770 case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_CHACHA20_POLY1305, 0 ):
2771 mode = MBEDTLS_MODE_CHACHAPOLY;
2772 break;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002773 default:
2774 return( NULL );
2775 }
2776 }
2777 else if( alg == PSA_ALG_CMAC )
2778 mode = MBEDTLS_MODE_ECB;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002779 else
2780 return( NULL );
2781
2782 switch( key_type )
2783 {
2784 case PSA_KEY_TYPE_AES:
mohammad1603f4f0d612018-06-03 15:04:51 +03002785 cipher_id_tmp = MBEDTLS_CIPHER_ID_AES;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002786 break;
2787 case PSA_KEY_TYPE_DES:
Gilles Peskine9ad29e22018-06-21 09:40:04 +02002788 /* key_bits is 64 for Single-DES, 128 for two-key Triple-DES,
2789 * and 192 for three-key Triple-DES. */
Gilles Peskine8c9def32018-02-08 10:02:12 +01002790 if( key_bits == 64 )
mohammad1603f4f0d612018-06-03 15:04:51 +03002791 cipher_id_tmp = MBEDTLS_CIPHER_ID_DES;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002792 else
mohammad1603f4f0d612018-06-03 15:04:51 +03002793 cipher_id_tmp = MBEDTLS_CIPHER_ID_3DES;
Gilles Peskine9ad29e22018-06-21 09:40:04 +02002794 /* mbedtls doesn't recognize two-key Triple-DES as an algorithm,
2795 * but two-key Triple-DES is functionally three-key Triple-DES
2796 * with K1=K3, so that's how we present it to mbedtls. */
2797 if( key_bits == 128 )
2798 key_bits = 192;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002799 break;
2800 case PSA_KEY_TYPE_CAMELLIA:
mohammad1603f4f0d612018-06-03 15:04:51 +03002801 cipher_id_tmp = MBEDTLS_CIPHER_ID_CAMELLIA;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002802 break;
2803 case PSA_KEY_TYPE_ARC4:
mohammad1603f4f0d612018-06-03 15:04:51 +03002804 cipher_id_tmp = MBEDTLS_CIPHER_ID_ARC4;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002805 break;
Gilles Peskine26869f22019-05-06 15:25:00 +02002806 case PSA_KEY_TYPE_CHACHA20:
2807 cipher_id_tmp = MBEDTLS_CIPHER_ID_CHACHA20;
2808 break;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002809 default:
2810 return( NULL );
2811 }
mohammad1603f4f0d612018-06-03 15:04:51 +03002812 if( cipher_id != NULL )
mohammad160360a64d02018-06-03 17:20:42 +03002813 *cipher_id = cipher_id_tmp;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002814
Jaeden Amero23bbb752018-06-26 14:16:54 +01002815 return( mbedtls_cipher_info_from_values( cipher_id_tmp,
2816 (int) key_bits, mode ) );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002817}
2818
Gilles Peskinea05219c2018-11-16 16:02:56 +01002819#if defined(MBEDTLS_MD_C)
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002820static size_t psa_get_hash_block_size( psa_algorithm_t alg )
Nir Sonnenschein96272412018-06-17 14:41:10 +03002821{
Gilles Peskine2d277862018-06-18 15:41:12 +02002822 switch( alg )
Nir Sonnenschein96272412018-06-17 14:41:10 +03002823 {
2824 case PSA_ALG_MD2:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002825 return( 16 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002826 case PSA_ALG_MD4:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002827 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002828 case PSA_ALG_MD5:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002829 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002830 case PSA_ALG_RIPEMD160:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002831 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002832 case PSA_ALG_SHA_1:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002833 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002834 case PSA_ALG_SHA_224:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002835 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002836 case PSA_ALG_SHA_256:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002837 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002838 case PSA_ALG_SHA_384:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002839 return( 128 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002840 case PSA_ALG_SHA_512:
Gilles Peskine2d277862018-06-18 15:41:12 +02002841 return( 128 );
2842 default:
2843 return( 0 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002844 }
2845}
Gilles Peskinea05219c2018-11-16 16:02:56 +01002846#endif /* MBEDTLS_MD_C */
Nir Sonnenschein0c9ec532018-06-07 13:27:47 +03002847
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002848/* Initialize the MAC operation structure. Once this function has been
2849 * called, psa_mac_abort can run and will do the right thing. */
2850static psa_status_t psa_mac_init( psa_mac_operation_t *operation,
2851 psa_algorithm_t alg )
2852{
2853 psa_status_t status = PSA_ERROR_NOT_SUPPORTED;
2854
2855 operation->alg = alg;
2856 operation->key_set = 0;
2857 operation->iv_set = 0;
2858 operation->iv_required = 0;
2859 operation->has_input = 0;
Gilles Peskine89167cb2018-07-08 20:12:23 +02002860 operation->is_sign = 0;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002861
2862#if defined(MBEDTLS_CMAC_C)
2863 if( alg == PSA_ALG_CMAC )
2864 {
2865 operation->iv_required = 0;
2866 mbedtls_cipher_init( &operation->ctx.cmac );
2867 status = PSA_SUCCESS;
2868 }
2869 else
2870#endif /* MBEDTLS_CMAC_C */
2871#if defined(MBEDTLS_MD_C)
2872 if( PSA_ALG_IS_HMAC( operation->alg ) )
2873 {
Gilles Peskineff94abd2018-07-12 17:07:52 +02002874 /* We'll set up the hash operation later in psa_hmac_setup_internal. */
2875 operation->ctx.hmac.hash_ctx.alg = 0;
2876 status = PSA_SUCCESS;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002877 }
2878 else
2879#endif /* MBEDTLS_MD_C */
2880 {
Gilles Peskinec06e0712018-06-20 16:21:04 +02002881 if( ! PSA_ALG_IS_MAC( alg ) )
2882 status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002883 }
2884
2885 if( status != PSA_SUCCESS )
2886 memset( operation, 0, sizeof( *operation ) );
2887 return( status );
2888}
2889
Gilles Peskine01126fa2018-07-12 17:04:55 +02002890#if defined(MBEDTLS_MD_C)
2891static psa_status_t psa_hmac_abort_internal( psa_hmac_internal_data *hmac )
2892{
Gilles Peskine3f108122018-12-07 18:14:53 +01002893 mbedtls_platform_zeroize( hmac->opad, sizeof( hmac->opad ) );
Gilles Peskine01126fa2018-07-12 17:04:55 +02002894 return( psa_hash_abort( &hmac->hash_ctx ) );
2895}
2896#endif /* MBEDTLS_MD_C */
2897
Gilles Peskine8c9def32018-02-08 10:02:12 +01002898psa_status_t psa_mac_abort( psa_mac_operation_t *operation )
2899{
Gilles Peskinefbfac682018-07-08 20:51:54 +02002900 if( operation->alg == 0 )
Gilles Peskine8c9def32018-02-08 10:02:12 +01002901 {
Gilles Peskinefbfac682018-07-08 20:51:54 +02002902 /* The object has (apparently) been initialized but it is not
2903 * in use. It's ok to call abort on such an object, and there's
2904 * nothing to do. */
2905 return( PSA_SUCCESS );
2906 }
2907 else
Gilles Peskine8c9def32018-02-08 10:02:12 +01002908#if defined(MBEDTLS_CMAC_C)
Gilles Peskinefbfac682018-07-08 20:51:54 +02002909 if( operation->alg == PSA_ALG_CMAC )
2910 {
2911 mbedtls_cipher_free( &operation->ctx.cmac );
2912 }
2913 else
Gilles Peskine8c9def32018-02-08 10:02:12 +01002914#endif /* MBEDTLS_CMAC_C */
Gilles Peskine8c9def32018-02-08 10:02:12 +01002915#if defined(MBEDTLS_MD_C)
Gilles Peskinefbfac682018-07-08 20:51:54 +02002916 if( PSA_ALG_IS_HMAC( operation->alg ) )
2917 {
Gilles Peskine01126fa2018-07-12 17:04:55 +02002918 psa_hmac_abort_internal( &operation->ctx.hmac );
Gilles Peskinefbfac682018-07-08 20:51:54 +02002919 }
2920 else
Gilles Peskine8c9def32018-02-08 10:02:12 +01002921#endif /* MBEDTLS_MD_C */
Gilles Peskinefbfac682018-07-08 20:51:54 +02002922 {
2923 /* Sanity check (shouldn't happen: operation->alg should
2924 * always have been initialized to a valid value). */
2925 goto bad_state;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002926 }
Moran Peker41deec42018-04-04 15:43:05 +03002927
Gilles Peskine8c9def32018-02-08 10:02:12 +01002928 operation->alg = 0;
2929 operation->key_set = 0;
2930 operation->iv_set = 0;
2931 operation->iv_required = 0;
2932 operation->has_input = 0;
Gilles Peskine89167cb2018-07-08 20:12:23 +02002933 operation->is_sign = 0;
Moran Peker41deec42018-04-04 15:43:05 +03002934
Gilles Peskine8c9def32018-02-08 10:02:12 +01002935 return( PSA_SUCCESS );
Gilles Peskinefbfac682018-07-08 20:51:54 +02002936
2937bad_state:
2938 /* If abort is called on an uninitialized object, we can't trust
2939 * anything. Wipe the object in case it contains confidential data.
2940 * This may result in a memory leak if a pointer gets overwritten,
2941 * but it's too late to do anything about this. */
2942 memset( operation, 0, sizeof( *operation ) );
2943 return( PSA_ERROR_BAD_STATE );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002944}
2945
Gilles Peskinee3b07d82018-06-19 11:57:35 +02002946#if defined(MBEDTLS_CMAC_C)
Gilles Peskine89167cb2018-07-08 20:12:23 +02002947static int psa_cmac_setup( psa_mac_operation_t *operation,
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002948 size_t key_bits,
Gilles Peskine2f060a82018-12-04 17:12:32 +01002949 psa_key_slot_t *slot,
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002950 const mbedtls_cipher_info_t *cipher_info )
2951{
Janos Follath24eed8d2019-11-22 13:21:35 +00002952 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002953
2954 operation->mac_size = cipher_info->block_size;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002955
2956 ret = mbedtls_cipher_setup( &operation->ctx.cmac, cipher_info );
2957 if( ret != 0 )
2958 return( ret );
2959
2960 ret = mbedtls_cipher_cmac_starts( &operation->ctx.cmac,
Steven Cooreman71fd80d2020-07-07 21:12:27 +02002961 slot->data.key.data,
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002962 key_bits );
2963 return( ret );
2964}
Gilles Peskinee3b07d82018-06-19 11:57:35 +02002965#endif /* MBEDTLS_CMAC_C */
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002966
Gilles Peskine248051a2018-06-20 16:09:38 +02002967#if defined(MBEDTLS_MD_C)
Gilles Peskine01126fa2018-07-12 17:04:55 +02002968static psa_status_t psa_hmac_setup_internal( psa_hmac_internal_data *hmac,
2969 const uint8_t *key,
2970 size_t key_length,
2971 psa_algorithm_t hash_alg )
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002972{
Gilles Peskinec11c4dc2019-07-15 11:06:38 +02002973 uint8_t ipad[PSA_HMAC_MAX_HASH_BLOCK_SIZE];
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002974 size_t i;
Gilles Peskine9aa369e2018-07-16 00:36:29 +02002975 size_t hash_size = PSA_HASH_SIZE( hash_alg );
Gilles Peskine01126fa2018-07-12 17:04:55 +02002976 size_t block_size = psa_get_hash_block_size( hash_alg );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002977 psa_status_t status;
2978
Gilles Peskine9aa369e2018-07-16 00:36:29 +02002979 /* Sanity checks on block_size, to guarantee that there won't be a buffer
2980 * overflow below. This should never trigger if the hash algorithm
2981 * is implemented correctly. */
2982 /* The size checks against the ipad and opad buffers cannot be written
2983 * `block_size > sizeof( ipad ) || block_size > sizeof( hmac->opad )`
2984 * because that triggers -Wlogical-op on GCC 7.3. */
2985 if( block_size > sizeof( ipad ) )
2986 return( PSA_ERROR_NOT_SUPPORTED );
2987 if( block_size > sizeof( hmac->opad ) )
2988 return( PSA_ERROR_NOT_SUPPORTED );
2989 if( block_size < hash_size )
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002990 return( PSA_ERROR_NOT_SUPPORTED );
2991
Gilles Peskined223b522018-06-11 18:12:58 +02002992 if( key_length > block_size )
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002993 {
Gilles Peskine84b8fc82019-11-28 20:07:20 +01002994 status = psa_hash_compute( hash_alg, key, key_length,
2995 ipad, sizeof( ipad ), &key_length );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002996 if( status != PSA_SUCCESS )
Gilles Peskineb8be2882018-07-17 16:24:34 +02002997 goto cleanup;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002998 }
Gilles Peskine96889972018-07-12 17:07:03 +02002999 /* A 0-length key is not commonly used in HMAC when used as a MAC,
3000 * but it is permitted. It is common when HMAC is used in HKDF, for
3001 * example. Don't call `memcpy` in the 0-length because `key` could be
3002 * an invalid pointer which would make the behavior undefined. */
3003 else if( key_length != 0 )
Gilles Peskine01126fa2018-07-12 17:04:55 +02003004 memcpy( ipad, key, key_length );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003005
Gilles Peskined223b522018-06-11 18:12:58 +02003006 /* ipad contains the key followed by garbage. Xor and fill with 0x36
3007 * to create the ipad value. */
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003008 for( i = 0; i < key_length; i++ )
Gilles Peskined223b522018-06-11 18:12:58 +02003009 ipad[i] ^= 0x36;
3010 memset( ipad + key_length, 0x36, block_size - key_length );
3011
3012 /* Copy the key material from ipad to opad, flipping the requisite bits,
3013 * and filling the rest of opad with the requisite constant. */
3014 for( i = 0; i < key_length; i++ )
Gilles Peskine01126fa2018-07-12 17:04:55 +02003015 hmac->opad[i] = ipad[i] ^ 0x36 ^ 0x5C;
3016 memset( hmac->opad + key_length, 0x5C, block_size - key_length );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003017
Gilles Peskine01126fa2018-07-12 17:04:55 +02003018 status = psa_hash_setup( &hmac->hash_ctx, hash_alg );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003019 if( status != PSA_SUCCESS )
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02003020 goto cleanup;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003021
Gilles Peskine01126fa2018-07-12 17:04:55 +02003022 status = psa_hash_update( &hmac->hash_ctx, ipad, block_size );
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02003023
3024cleanup:
Steven Cooreman29149862020-08-05 15:43:42 +02003025 mbedtls_platform_zeroize( ipad, sizeof( ipad ) );
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02003026
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003027 return( status );
3028}
Gilles Peskine248051a2018-06-20 16:09:38 +02003029#endif /* MBEDTLS_MD_C */
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003030
Gilles Peskine89167cb2018-07-08 20:12:23 +02003031static psa_status_t psa_mac_setup( psa_mac_operation_t *operation,
Gilles Peskinec5487a82018-12-03 18:08:14 +01003032 psa_key_handle_t handle,
Gilles Peskine89167cb2018-07-08 20:12:23 +02003033 psa_algorithm_t alg,
3034 int is_sign )
Gilles Peskine8c9def32018-02-08 10:02:12 +01003035{
Gilles Peskine8c9def32018-02-08 10:02:12 +01003036 psa_status_t status;
Gilles Peskine2f060a82018-12-04 17:12:32 +01003037 psa_key_slot_t *slot;
Gilles Peskine8c9def32018-02-08 10:02:12 +01003038 size_t key_bits;
Gilles Peskine89167cb2018-07-08 20:12:23 +02003039 psa_key_usage_t usage =
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01003040 is_sign ? PSA_KEY_USAGE_SIGN_HASH : PSA_KEY_USAGE_VERIFY_HASH;
Gilles Peskinec11c4dc2019-07-15 11:06:38 +02003041 uint8_t truncated = PSA_MAC_TRUNCATED_LENGTH( alg );
Gilles Peskinee0e9c7c2018-10-17 18:28:05 +02003042 psa_algorithm_t full_length_alg = PSA_ALG_FULL_LENGTH_MAC( alg );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003043
Jaeden Amero36ee5d02019-02-19 09:25:10 +00003044 /* A context must be freshly initialized before it can be set up. */
3045 if( operation->alg != 0 )
3046 {
3047 return( PSA_ERROR_BAD_STATE );
3048 }
3049
Gilles Peskined911eb72018-08-14 15:18:45 +02003050 status = psa_mac_init( operation, full_length_alg );
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02003051 if( status != PSA_SUCCESS )
3052 return( status );
Gilles Peskine89167cb2018-07-08 20:12:23 +02003053 if( is_sign )
3054 operation->is_sign = 1;
Gilles Peskine8c9def32018-02-08 10:02:12 +01003055
Gilles Peskine28f8f302019-07-24 13:30:31 +02003056 status = psa_get_transparent_key( handle, &slot, usage, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003057 if( status != PSA_SUCCESS )
Gilles Peskinefbfac682018-07-08 20:51:54 +02003058 goto exit;
Gilles Peskinedb4b3ab2019-04-18 12:53:01 +02003059 key_bits = psa_get_key_slot_bits( slot );
Gilles Peskineab1d7ab2018-07-06 16:07:47 +02003060
Gilles Peskine8c9def32018-02-08 10:02:12 +01003061#if defined(MBEDTLS_CMAC_C)
Gilles Peskined911eb72018-08-14 15:18:45 +02003062 if( full_length_alg == PSA_ALG_CMAC )
Gilles Peskinefbfac682018-07-08 20:51:54 +02003063 {
3064 const mbedtls_cipher_info_t *cipher_info =
Gilles Peskined911eb72018-08-14 15:18:45 +02003065 mbedtls_cipher_info_from_psa( full_length_alg,
Gilles Peskine8e338702019-07-30 20:06:31 +02003066 slot->attr.type, key_bits, NULL );
Janos Follath24eed8d2019-11-22 13:21:35 +00003067 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskinefbfac682018-07-08 20:51:54 +02003068 if( cipher_info == NULL )
3069 {
3070 status = PSA_ERROR_NOT_SUPPORTED;
3071 goto exit;
3072 }
3073 operation->mac_size = cipher_info->block_size;
3074 ret = psa_cmac_setup( operation, key_bits, slot, cipher_info );
3075 status = mbedtls_to_psa_error( ret );
3076 }
3077 else
Gilles Peskine8c9def32018-02-08 10:02:12 +01003078#endif /* MBEDTLS_CMAC_C */
Gilles Peskine8c9def32018-02-08 10:02:12 +01003079#if defined(MBEDTLS_MD_C)
Gilles Peskined911eb72018-08-14 15:18:45 +02003080 if( PSA_ALG_IS_HMAC( full_length_alg ) )
Gilles Peskinefbfac682018-07-08 20:51:54 +02003081 {
Gilles Peskine00709fa2018-08-22 18:25:41 +02003082 psa_algorithm_t hash_alg = PSA_ALG_HMAC_GET_HASH( alg );
Gilles Peskine01126fa2018-07-12 17:04:55 +02003083 if( hash_alg == 0 )
3084 {
3085 status = PSA_ERROR_NOT_SUPPORTED;
3086 goto exit;
3087 }
Gilles Peskine9aa369e2018-07-16 00:36:29 +02003088
3089 operation->mac_size = PSA_HASH_SIZE( hash_alg );
3090 /* Sanity check. This shouldn't fail on a valid configuration. */
3091 if( operation->mac_size == 0 ||
3092 operation->mac_size > sizeof( operation->ctx.hmac.opad ) )
3093 {
3094 status = PSA_ERROR_NOT_SUPPORTED;
3095 goto exit;
3096 }
3097
Gilles Peskine8e338702019-07-30 20:06:31 +02003098 if( slot->attr.type != PSA_KEY_TYPE_HMAC )
Gilles Peskine01126fa2018-07-12 17:04:55 +02003099 {
3100 status = PSA_ERROR_INVALID_ARGUMENT;
3101 goto exit;
3102 }
Gilles Peskine9aa369e2018-07-16 00:36:29 +02003103
Gilles Peskine01126fa2018-07-12 17:04:55 +02003104 status = psa_hmac_setup_internal( &operation->ctx.hmac,
Steven Cooreman71fd80d2020-07-07 21:12:27 +02003105 slot->data.key.data,
3106 slot->data.key.bytes,
Gilles Peskine01126fa2018-07-12 17:04:55 +02003107 hash_alg );
Gilles Peskinefbfac682018-07-08 20:51:54 +02003108 }
3109 else
Gilles Peskine8c9def32018-02-08 10:02:12 +01003110#endif /* MBEDTLS_MD_C */
Gilles Peskinefbfac682018-07-08 20:51:54 +02003111 {
Jaeden Amero82df32e2018-11-23 15:11:20 +00003112 (void) key_bits;
Gilles Peskinefbfac682018-07-08 20:51:54 +02003113 status = PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine8c9def32018-02-08 10:02:12 +01003114 }
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003115
Gilles Peskined911eb72018-08-14 15:18:45 +02003116 if( truncated == 0 )
3117 {
3118 /* The "normal" case: untruncated algorithm. Nothing to do. */
3119 }
3120 else if( truncated < 4 )
3121 {
Gilles Peskine6d72ff92018-08-21 14:55:08 +02003122 /* A very short MAC is too short for security since it can be
3123 * brute-forced. Ancient protocols with 32-bit MACs do exist,
3124 * so we make this our minimum, even though 32 bits is still
3125 * too small for security. */
Gilles Peskined911eb72018-08-14 15:18:45 +02003126 status = PSA_ERROR_NOT_SUPPORTED;
3127 }
3128 else if( truncated > operation->mac_size )
3129 {
3130 /* It's impossible to "truncate" to a larger length. */
3131 status = PSA_ERROR_INVALID_ARGUMENT;
3132 }
3133 else
3134 operation->mac_size = truncated;
3135
Gilles Peskinefbfac682018-07-08 20:51:54 +02003136exit:
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003137 if( status != PSA_SUCCESS )
Gilles Peskine8c9def32018-02-08 10:02:12 +01003138 {
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02003139 psa_mac_abort( operation );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003140 }
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003141 else
3142 {
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003143 operation->key_set = 1;
3144 }
3145 return( status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003146}
3147
Gilles Peskine89167cb2018-07-08 20:12:23 +02003148psa_status_t psa_mac_sign_setup( psa_mac_operation_t *operation,
Gilles Peskinec5487a82018-12-03 18:08:14 +01003149 psa_key_handle_t handle,
Gilles Peskine89167cb2018-07-08 20:12:23 +02003150 psa_algorithm_t alg )
3151{
Gilles Peskinec5487a82018-12-03 18:08:14 +01003152 return( psa_mac_setup( operation, handle, alg, 1 ) );
Gilles Peskine89167cb2018-07-08 20:12:23 +02003153}
3154
3155psa_status_t psa_mac_verify_setup( psa_mac_operation_t *operation,
Gilles Peskinec5487a82018-12-03 18:08:14 +01003156 psa_key_handle_t handle,
Gilles Peskine89167cb2018-07-08 20:12:23 +02003157 psa_algorithm_t alg )
3158{
Gilles Peskinec5487a82018-12-03 18:08:14 +01003159 return( psa_mac_setup( operation, handle, alg, 0 ) );
Gilles Peskine89167cb2018-07-08 20:12:23 +02003160}
3161
Gilles Peskine8c9def32018-02-08 10:02:12 +01003162psa_status_t psa_mac_update( psa_mac_operation_t *operation,
3163 const uint8_t *input,
3164 size_t input_length )
3165{
Gilles Peskinefbfac682018-07-08 20:51:54 +02003166 psa_status_t status = PSA_ERROR_BAD_STATE;
Gilles Peskine8c9def32018-02-08 10:02:12 +01003167 if( ! operation->key_set )
Jaeden Ameroe236c2a2019-02-20 15:37:15 +00003168 return( PSA_ERROR_BAD_STATE );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003169 if( operation->iv_required && ! operation->iv_set )
Jaeden Ameroe236c2a2019-02-20 15:37:15 +00003170 return( PSA_ERROR_BAD_STATE );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003171 operation->has_input = 1;
3172
Gilles Peskine8c9def32018-02-08 10:02:12 +01003173#if defined(MBEDTLS_CMAC_C)
Gilles Peskinefbfac682018-07-08 20:51:54 +02003174 if( operation->alg == PSA_ALG_CMAC )
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03003175 {
Gilles Peskinefbfac682018-07-08 20:51:54 +02003176 int ret = mbedtls_cipher_cmac_update( &operation->ctx.cmac,
3177 input, input_length );
3178 status = mbedtls_to_psa_error( ret );
3179 }
3180 else
3181#endif /* MBEDTLS_CMAC_C */
3182#if defined(MBEDTLS_MD_C)
3183 if( PSA_ALG_IS_HMAC( operation->alg ) )
3184 {
3185 status = psa_hash_update( &operation->ctx.hmac.hash_ctx, input,
3186 input_length );
3187 }
3188 else
3189#endif /* MBEDTLS_MD_C */
3190 {
3191 /* This shouldn't happen if `operation` was initialized by
3192 * a setup function. */
Jaeden Ameroe236c2a2019-02-20 15:37:15 +00003193 return( PSA_ERROR_BAD_STATE );
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03003194 }
3195
Gilles Peskinefbfac682018-07-08 20:51:54 +02003196 if( status != PSA_SUCCESS )
3197 psa_mac_abort( operation );
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02003198 return( status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003199}
3200
Gilles Peskine01126fa2018-07-12 17:04:55 +02003201#if defined(MBEDTLS_MD_C)
3202static psa_status_t psa_hmac_finish_internal( psa_hmac_internal_data *hmac,
3203 uint8_t *mac,
3204 size_t mac_size )
3205{
Gilles Peskinec11c4dc2019-07-15 11:06:38 +02003206 uint8_t tmp[MBEDTLS_MD_MAX_SIZE];
Gilles Peskine01126fa2018-07-12 17:04:55 +02003207 psa_algorithm_t hash_alg = hmac->hash_ctx.alg;
3208 size_t hash_size = 0;
3209 size_t block_size = psa_get_hash_block_size( hash_alg );
3210 psa_status_t status;
3211
Gilles Peskine01126fa2018-07-12 17:04:55 +02003212 status = psa_hash_finish( &hmac->hash_ctx, tmp, sizeof( tmp ), &hash_size );
3213 if( status != PSA_SUCCESS )
3214 return( status );
3215 /* From here on, tmp needs to be wiped. */
3216
3217 status = psa_hash_setup( &hmac->hash_ctx, hash_alg );
3218 if( status != PSA_SUCCESS )
3219 goto exit;
3220
3221 status = psa_hash_update( &hmac->hash_ctx, hmac->opad, block_size );
3222 if( status != PSA_SUCCESS )
3223 goto exit;
3224
3225 status = psa_hash_update( &hmac->hash_ctx, tmp, hash_size );
3226 if( status != PSA_SUCCESS )
3227 goto exit;
3228
Gilles Peskined911eb72018-08-14 15:18:45 +02003229 status = psa_hash_finish( &hmac->hash_ctx, tmp, sizeof( tmp ), &hash_size );
3230 if( status != PSA_SUCCESS )
3231 goto exit;
3232
3233 memcpy( mac, tmp, mac_size );
Gilles Peskine01126fa2018-07-12 17:04:55 +02003234
3235exit:
Gilles Peskine3f108122018-12-07 18:14:53 +01003236 mbedtls_platform_zeroize( tmp, hash_size );
Gilles Peskine01126fa2018-07-12 17:04:55 +02003237 return( status );
3238}
3239#endif /* MBEDTLS_MD_C */
3240
mohammad16036df908f2018-04-02 08:34:15 -07003241static psa_status_t psa_mac_finish_internal( psa_mac_operation_t *operation,
Gilles Peskine2d277862018-06-18 15:41:12 +02003242 uint8_t *mac,
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003243 size_t mac_size )
Gilles Peskine8c9def32018-02-08 10:02:12 +01003244{
Gilles Peskine1d96fff2018-07-02 12:15:39 +02003245 if( ! operation->key_set )
3246 return( PSA_ERROR_BAD_STATE );
3247 if( operation->iv_required && ! operation->iv_set )
3248 return( PSA_ERROR_BAD_STATE );
3249
Gilles Peskine8c9def32018-02-08 10:02:12 +01003250 if( mac_size < operation->mac_size )
3251 return( PSA_ERROR_BUFFER_TOO_SMALL );
3252
Gilles Peskine8c9def32018-02-08 10:02:12 +01003253#if defined(MBEDTLS_CMAC_C)
Gilles Peskinefbfac682018-07-08 20:51:54 +02003254 if( operation->alg == PSA_ALG_CMAC )
3255 {
Gilles Peskined911eb72018-08-14 15:18:45 +02003256 uint8_t tmp[PSA_MAX_BLOCK_CIPHER_BLOCK_SIZE];
3257 int ret = mbedtls_cipher_cmac_finish( &operation->ctx.cmac, tmp );
3258 if( ret == 0 )
Gilles Peskine87b0ac42018-08-21 14:55:49 +02003259 memcpy( mac, tmp, operation->mac_size );
Gilles Peskine3f108122018-12-07 18:14:53 +01003260 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
Gilles Peskinefbfac682018-07-08 20:51:54 +02003261 return( mbedtls_to_psa_error( ret ) );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003262 }
Gilles Peskinefbfac682018-07-08 20:51:54 +02003263 else
3264#endif /* MBEDTLS_CMAC_C */
3265#if defined(MBEDTLS_MD_C)
3266 if( PSA_ALG_IS_HMAC( operation->alg ) )
3267 {
Gilles Peskine01126fa2018-07-12 17:04:55 +02003268 return( psa_hmac_finish_internal( &operation->ctx.hmac,
Gilles Peskined911eb72018-08-14 15:18:45 +02003269 mac, operation->mac_size ) );
Gilles Peskinefbfac682018-07-08 20:51:54 +02003270 }
3271 else
3272#endif /* MBEDTLS_MD_C */
3273 {
3274 /* This shouldn't happen if `operation` was initialized by
3275 * a setup function. */
3276 return( PSA_ERROR_BAD_STATE );
3277 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01003278}
3279
Gilles Peskineacd4be32018-07-08 19:56:25 +02003280psa_status_t psa_mac_sign_finish( psa_mac_operation_t *operation,
3281 uint8_t *mac,
3282 size_t mac_size,
3283 size_t *mac_length )
mohammad16036df908f2018-04-02 08:34:15 -07003284{
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003285 psa_status_t status;
3286
Jaeden Amero252ef282019-02-15 14:05:35 +00003287 if( operation->alg == 0 )
3288 {
3289 return( PSA_ERROR_BAD_STATE );
3290 }
3291
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003292 /* Fill the output buffer with something that isn't a valid mac
3293 * (barring an attack on the mac and deliberately-crafted input),
3294 * in case the caller doesn't check the return status properly. */
3295 *mac_length = mac_size;
3296 /* If mac_size is 0 then mac may be NULL and then the
3297 * call to memset would have undefined behavior. */
3298 if( mac_size != 0 )
3299 memset( mac, '!', mac_size );
3300
Gilles Peskine89167cb2018-07-08 20:12:23 +02003301 if( ! operation->is_sign )
3302 {
Jaeden Ameroe236c2a2019-02-20 15:37:15 +00003303 return( PSA_ERROR_BAD_STATE );
Gilles Peskine89167cb2018-07-08 20:12:23 +02003304 }
mohammad16036df908f2018-04-02 08:34:15 -07003305
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003306 status = psa_mac_finish_internal( operation, mac, mac_size );
3307
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003308 if( status == PSA_SUCCESS )
3309 {
3310 status = psa_mac_abort( operation );
3311 if( status == PSA_SUCCESS )
3312 *mac_length = operation->mac_size;
3313 else
3314 memset( mac, '!', mac_size );
3315 }
3316 else
3317 psa_mac_abort( operation );
3318 return( status );
mohammad16036df908f2018-04-02 08:34:15 -07003319}
3320
Gilles Peskineacd4be32018-07-08 19:56:25 +02003321psa_status_t psa_mac_verify_finish( psa_mac_operation_t *operation,
3322 const uint8_t *mac,
3323 size_t mac_length )
Gilles Peskine8c9def32018-02-08 10:02:12 +01003324{
Gilles Peskine828ed142018-06-18 23:25:51 +02003325 uint8_t actual_mac[PSA_MAC_MAX_SIZE];
mohammad16036df908f2018-04-02 08:34:15 -07003326 psa_status_t status;
3327
Jaeden Amero252ef282019-02-15 14:05:35 +00003328 if( operation->alg == 0 )
3329 {
3330 return( PSA_ERROR_BAD_STATE );
3331 }
3332
Gilles Peskine89167cb2018-07-08 20:12:23 +02003333 if( operation->is_sign )
3334 {
Jaeden Ameroe236c2a2019-02-20 15:37:15 +00003335 return( PSA_ERROR_BAD_STATE );
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003336 }
3337 if( operation->mac_size != mac_length )
3338 {
3339 status = PSA_ERROR_INVALID_SIGNATURE;
3340 goto cleanup;
Gilles Peskine89167cb2018-07-08 20:12:23 +02003341 }
mohammad16036df908f2018-04-02 08:34:15 -07003342
3343 status = psa_mac_finish_internal( operation,
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003344 actual_mac, sizeof( actual_mac ) );
Gilles Peskine28cd4162020-01-20 16:31:06 +01003345 if( status != PSA_SUCCESS )
3346 goto cleanup;
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003347
3348 if( safer_memcmp( mac, actual_mac, mac_length ) != 0 )
3349 status = PSA_ERROR_INVALID_SIGNATURE;
3350
3351cleanup:
3352 if( status == PSA_SUCCESS )
3353 status = psa_mac_abort( operation );
3354 else
3355 psa_mac_abort( operation );
3356
Gilles Peskine3f108122018-12-07 18:14:53 +01003357 mbedtls_platform_zeroize( actual_mac, sizeof( actual_mac ) );
Gilles Peskined911eb72018-08-14 15:18:45 +02003358
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003359 return( status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003360}
3361
3362
Gilles Peskine20035e32018-02-03 22:44:14 +01003363
Gilles Peskine20035e32018-02-03 22:44:14 +01003364/****************************************************************/
3365/* Asymmetric cryptography */
3366/****************************************************************/
3367
Gilles Peskine2b450e32018-06-27 15:42:46 +02003368#if defined(MBEDTLS_RSA_C)
Gilles Peskine8b18a4f2018-06-08 16:34:46 +02003369/* Decode the hash algorithm from alg and store the mbedtls encoding in
Gilles Peskine71ac7b12018-06-29 23:36:35 +02003370 * md_alg. Verify that the hash length is acceptable. */
Gilles Peskine8b18a4f2018-06-08 16:34:46 +02003371static psa_status_t psa_rsa_decode_md_type( psa_algorithm_t alg,
3372 size_t hash_length,
3373 mbedtls_md_type_t *md_alg )
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03003374{
Gilles Peskine7ed29c52018-06-26 15:50:08 +02003375 psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH( alg );
Gilles Peskine61b91d42018-06-08 16:09:36 +02003376 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
Gilles Peskine71ac7b12018-06-29 23:36:35 +02003377 *md_alg = mbedtls_md_get_type( md_info );
3378
3379 /* The Mbed TLS RSA module uses an unsigned int for hash length
3380 * parameters. Validate that it fits so that we don't risk an
3381 * overflow later. */
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03003382#if SIZE_MAX > UINT_MAX
Gilles Peskine71ac7b12018-06-29 23:36:35 +02003383 if( hash_length > UINT_MAX )
3384 return( PSA_ERROR_INVALID_ARGUMENT );
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03003385#endif
Gilles Peskine71ac7b12018-06-29 23:36:35 +02003386
3387#if defined(MBEDTLS_PKCS1_V15)
3388 /* For PKCS#1 v1.5 signature, if using a hash, the hash length
3389 * must be correct. */
3390 if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) &&
3391 alg != PSA_ALG_RSA_PKCS1V15_SIGN_RAW )
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03003392 {
Gilles Peskine71ac7b12018-06-29 23:36:35 +02003393 if( md_info == NULL )
3394 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine61b91d42018-06-08 16:09:36 +02003395 if( mbedtls_md_get_size( md_info ) != hash_length )
3396 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine71ac7b12018-06-29 23:36:35 +02003397 }
3398#endif /* MBEDTLS_PKCS1_V15 */
3399
3400#if defined(MBEDTLS_PKCS1_V21)
3401 /* PSS requires a hash internally. */
3402 if( PSA_ALG_IS_RSA_PSS( alg ) )
3403 {
Gilles Peskine61b91d42018-06-08 16:09:36 +02003404 if( md_info == NULL )
3405 return( PSA_ERROR_NOT_SUPPORTED );
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03003406 }
Gilles Peskine71ac7b12018-06-29 23:36:35 +02003407#endif /* MBEDTLS_PKCS1_V21 */
3408
Gilles Peskine61b91d42018-06-08 16:09:36 +02003409 return( PSA_SUCCESS );
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03003410}
3411
Gilles Peskine2b450e32018-06-27 15:42:46 +02003412static psa_status_t psa_rsa_sign( mbedtls_rsa_context *rsa,
3413 psa_algorithm_t alg,
3414 const uint8_t *hash,
3415 size_t hash_length,
3416 uint8_t *signature,
3417 size_t signature_size,
3418 size_t *signature_length )
3419{
3420 psa_status_t status;
Janos Follath24eed8d2019-11-22 13:21:35 +00003421 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2b450e32018-06-27 15:42:46 +02003422 mbedtls_md_type_t md_alg;
3423
3424 status = psa_rsa_decode_md_type( alg, hash_length, &md_alg );
3425 if( status != PSA_SUCCESS )
3426 return( status );
3427
Gilles Peskine630a18a2018-06-29 17:49:35 +02003428 if( signature_size < mbedtls_rsa_get_len( rsa ) )
Gilles Peskine2b450e32018-06-27 15:42:46 +02003429 return( PSA_ERROR_BUFFER_TOO_SMALL );
3430
3431#if defined(MBEDTLS_PKCS1_V15)
3432 if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) )
3433 {
3434 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V15,
3435 MBEDTLS_MD_NONE );
3436 ret = mbedtls_rsa_pkcs1_sign( rsa,
3437 mbedtls_ctr_drbg_random,
3438 &global_data.ctr_drbg,
3439 MBEDTLS_RSA_PRIVATE,
Jaeden Amerobbf97e32018-06-26 14:20:51 +01003440 md_alg,
3441 (unsigned int) hash_length,
3442 hash,
Gilles Peskine2b450e32018-06-27 15:42:46 +02003443 signature );
3444 }
3445 else
3446#endif /* MBEDTLS_PKCS1_V15 */
3447#if defined(MBEDTLS_PKCS1_V21)
3448 if( PSA_ALG_IS_RSA_PSS( alg ) )
3449 {
3450 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
3451 ret = mbedtls_rsa_rsassa_pss_sign( rsa,
3452 mbedtls_ctr_drbg_random,
3453 &global_data.ctr_drbg,
3454 MBEDTLS_RSA_PRIVATE,
Gilles Peskine71ac7b12018-06-29 23:36:35 +02003455 MBEDTLS_MD_NONE,
Jaeden Amerobbf97e32018-06-26 14:20:51 +01003456 (unsigned int) hash_length,
3457 hash,
Gilles Peskine2b450e32018-06-27 15:42:46 +02003458 signature );
3459 }
3460 else
3461#endif /* MBEDTLS_PKCS1_V21 */
3462 {
3463 return( PSA_ERROR_INVALID_ARGUMENT );
3464 }
3465
3466 if( ret == 0 )
Gilles Peskine630a18a2018-06-29 17:49:35 +02003467 *signature_length = mbedtls_rsa_get_len( rsa );
Gilles Peskine2b450e32018-06-27 15:42:46 +02003468 return( mbedtls_to_psa_error( ret ) );
3469}
3470
3471static psa_status_t psa_rsa_verify( mbedtls_rsa_context *rsa,
3472 psa_algorithm_t alg,
3473 const uint8_t *hash,
3474 size_t hash_length,
3475 const uint8_t *signature,
3476 size_t signature_length )
3477{
3478 psa_status_t status;
Janos Follath24eed8d2019-11-22 13:21:35 +00003479 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2b450e32018-06-27 15:42:46 +02003480 mbedtls_md_type_t md_alg;
3481
3482 status = psa_rsa_decode_md_type( alg, hash_length, &md_alg );
3483 if( status != PSA_SUCCESS )
3484 return( status );
3485
Gilles Peskine89cc74f2019-09-12 22:08:23 +02003486 if( signature_length != mbedtls_rsa_get_len( rsa ) )
3487 return( PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskine2b450e32018-06-27 15:42:46 +02003488
3489#if defined(MBEDTLS_PKCS1_V15)
3490 if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) )
3491 {
3492 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V15,
3493 MBEDTLS_MD_NONE );
3494 ret = mbedtls_rsa_pkcs1_verify( rsa,
3495 mbedtls_ctr_drbg_random,
3496 &global_data.ctr_drbg,
3497 MBEDTLS_RSA_PUBLIC,
3498 md_alg,
Jaeden Amerobbf97e32018-06-26 14:20:51 +01003499 (unsigned int) hash_length,
Gilles Peskine2b450e32018-06-27 15:42:46 +02003500 hash,
3501 signature );
3502 }
3503 else
3504#endif /* MBEDTLS_PKCS1_V15 */
3505#if defined(MBEDTLS_PKCS1_V21)
3506 if( PSA_ALG_IS_RSA_PSS( alg ) )
3507 {
3508 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
3509 ret = mbedtls_rsa_rsassa_pss_verify( rsa,
3510 mbedtls_ctr_drbg_random,
3511 &global_data.ctr_drbg,
3512 MBEDTLS_RSA_PUBLIC,
Gilles Peskine71ac7b12018-06-29 23:36:35 +02003513 MBEDTLS_MD_NONE,
Jaeden Amerobbf97e32018-06-26 14:20:51 +01003514 (unsigned int) hash_length,
3515 hash,
Gilles Peskine2b450e32018-06-27 15:42:46 +02003516 signature );
3517 }
3518 else
3519#endif /* MBEDTLS_PKCS1_V21 */
3520 {
3521 return( PSA_ERROR_INVALID_ARGUMENT );
3522 }
Gilles Peskineef12c632018-09-13 20:37:48 +02003523
3524 /* Mbed TLS distinguishes "invalid padding" from "valid padding but
3525 * the rest of the signature is invalid". This has little use in
3526 * practice and PSA doesn't report this distinction. */
3527 if( ret == MBEDTLS_ERR_RSA_INVALID_PADDING )
3528 return( PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskine2b450e32018-06-27 15:42:46 +02003529 return( mbedtls_to_psa_error( ret ) );
3530}
3531#endif /* MBEDTLS_RSA_C */
3532
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003533#if defined(MBEDTLS_ECDSA_C)
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003534/* `ecp` cannot be const because `ecp->grp` needs to be non-const
3535 * for mbedtls_ecdsa_sign() and mbedtls_ecdsa_sign_det()
3536 * (even though these functions don't modify it). */
3537static psa_status_t psa_ecdsa_sign( mbedtls_ecp_keypair *ecp,
3538 psa_algorithm_t alg,
3539 const uint8_t *hash,
3540 size_t hash_length,
3541 uint8_t *signature,
3542 size_t signature_size,
3543 size_t *signature_length )
3544{
Janos Follath24eed8d2019-11-22 13:21:35 +00003545 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003546 mbedtls_mpi r, s;
Gilles Peskineeae6eee2018-06-28 13:56:01 +02003547 size_t curve_bytes = PSA_BITS_TO_BYTES( ecp->grp.pbits );
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003548 mbedtls_mpi_init( &r );
3549 mbedtls_mpi_init( &s );
3550
Gilles Peskineeae6eee2018-06-28 13:56:01 +02003551 if( signature_size < 2 * curve_bytes )
3552 {
3553 ret = MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL;
3554 goto cleanup;
3555 }
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003556
Gilles Peskinea05219c2018-11-16 16:02:56 +01003557#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003558 if( PSA_ALG_DSA_IS_DETERMINISTIC( alg ) )
3559 {
3560 psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH( alg );
3561 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
3562 mbedtls_md_type_t md_alg = mbedtls_md_get_type( md_info );
Darryl Green5e843fa2019-09-05 14:06:34 +01003563 MBEDTLS_MPI_CHK( mbedtls_ecdsa_sign_det_ext( &ecp->grp, &r, &s,
3564 &ecp->d, hash,
3565 hash_length, md_alg,
3566 mbedtls_ctr_drbg_random,
3567 &global_data.ctr_drbg ) );
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003568 }
3569 else
Gilles Peskinea05219c2018-11-16 16:02:56 +01003570#endif /* MBEDTLS_ECDSA_DETERMINISTIC */
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003571 {
Gilles Peskinea05219c2018-11-16 16:02:56 +01003572 (void) alg;
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003573 MBEDTLS_MPI_CHK( mbedtls_ecdsa_sign( &ecp->grp, &r, &s, &ecp->d,
3574 hash, hash_length,
3575 mbedtls_ctr_drbg_random,
3576 &global_data.ctr_drbg ) );
3577 }
Gilles Peskineeae6eee2018-06-28 13:56:01 +02003578
3579 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &r,
3580 signature,
3581 curve_bytes ) );
3582 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &s,
3583 signature + curve_bytes,
3584 curve_bytes ) );
3585
3586cleanup:
3587 mbedtls_mpi_free( &r );
3588 mbedtls_mpi_free( &s );
3589 if( ret == 0 )
3590 *signature_length = 2 * curve_bytes;
Gilles Peskineeae6eee2018-06-28 13:56:01 +02003591 return( mbedtls_to_psa_error( ret ) );
3592}
3593
3594static psa_status_t psa_ecdsa_verify( mbedtls_ecp_keypair *ecp,
3595 const uint8_t *hash,
3596 size_t hash_length,
3597 const uint8_t *signature,
3598 size_t signature_length )
3599{
Janos Follath24eed8d2019-11-22 13:21:35 +00003600 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskineeae6eee2018-06-28 13:56:01 +02003601 mbedtls_mpi r, s;
3602 size_t curve_bytes = PSA_BITS_TO_BYTES( ecp->grp.pbits );
3603 mbedtls_mpi_init( &r );
3604 mbedtls_mpi_init( &s );
3605
3606 if( signature_length != 2 * curve_bytes )
3607 return( PSA_ERROR_INVALID_SIGNATURE );
3608
3609 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &r,
3610 signature,
3611 curve_bytes ) );
3612 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &s,
3613 signature + curve_bytes,
3614 curve_bytes ) );
3615
Steven Cooremanacda8342020-07-24 23:09:52 +02003616 /* Check whether the public part is loaded. If not, load it. */
3617 if( mbedtls_ecp_is_zero( &ecp->Q ) )
3618 {
3619 MBEDTLS_MPI_CHK(
3620 mbedtls_ecp_mul( &ecp->grp, &ecp->Q, &ecp->d, &ecp->grp.G,
3621 mbedtls_ctr_drbg_random, &global_data.ctr_drbg ) );
3622 }
3623
Gilles Peskineeae6eee2018-06-28 13:56:01 +02003624 ret = mbedtls_ecdsa_verify( &ecp->grp, hash, hash_length,
3625 &ecp->Q, &r, &s );
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003626
3627cleanup:
3628 mbedtls_mpi_free( &r );
3629 mbedtls_mpi_free( &s );
3630 return( mbedtls_to_psa_error( ret ) );
3631}
3632#endif /* MBEDTLS_ECDSA_C */
3633
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01003634psa_status_t psa_sign_hash( psa_key_handle_t handle,
3635 psa_algorithm_t alg,
3636 const uint8_t *hash,
3637 size_t hash_length,
3638 uint8_t *signature,
3639 size_t signature_size,
3640 size_t *signature_length )
Gilles Peskine20035e32018-02-03 22:44:14 +01003641{
Gilles Peskine2f060a82018-12-04 17:12:32 +01003642 psa_key_slot_t *slot;
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003643 psa_status_t status;
3644
3645 *signature_length = signature_size;
Gilles Peskine4019f0e2019-09-12 22:05:59 +02003646 /* Immediately reject a zero-length signature buffer. This guarantees
3647 * that signature must be a valid pointer. (On the other hand, the hash
3648 * buffer can in principle be empty since it doesn't actually have
3649 * to be a hash.) */
3650 if( signature_size == 0 )
3651 return( PSA_ERROR_BUFFER_TOO_SMALL );
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003652
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01003653 status = psa_get_key_from_slot( handle, &slot, PSA_KEY_USAGE_SIGN_HASH, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003654 if( status != PSA_SUCCESS )
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003655 goto exit;
Gilles Peskine8e338702019-07-30 20:06:31 +02003656 if( ! PSA_KEY_TYPE_IS_KEY_PAIR( slot->attr.type ) )
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003657 {
3658 status = PSA_ERROR_INVALID_ARGUMENT;
3659 goto exit;
3660 }
Gilles Peskine20035e32018-02-03 22:44:14 +01003661
Steven Cooremancd84cb42020-07-16 20:28:36 +02003662 /* Try any of the available accelerators first */
3663 status = psa_driver_wrapper_sign_hash( slot,
3664 alg,
3665 hash,
3666 hash_length,
3667 signature,
3668 signature_size,
3669 signature_length );
Steven Cooreman8d2bde72020-09-04 13:06:39 +02003670 if( status != PSA_ERROR_NOT_SUPPORTED ||
3671 psa_key_lifetime_is_external( slot->attr.lifetime ) )
Steven Cooremancd84cb42020-07-16 20:28:36 +02003672 goto exit;
3673
Steven Cooreman7a250572020-07-17 16:43:05 +02003674 /* If the operation was not supported by any accelerator, try fallback. */
Gilles Peskine20035e32018-02-03 22:44:14 +01003675#if defined(MBEDTLS_RSA_C)
Gilles Peskine8e338702019-07-30 20:06:31 +02003676 if( slot->attr.type == PSA_KEY_TYPE_RSA_KEY_PAIR )
Gilles Peskine20035e32018-02-03 22:44:14 +01003677 {
Steven Cooremana2371e52020-07-28 14:30:39 +02003678 mbedtls_rsa_context *rsa = NULL;
Steven Cooremana01795d2020-07-24 22:48:15 +02003679
Steven Cooreman4fed4552020-08-03 14:46:03 +02003680 status = psa_load_rsa_representation( slot->attr.type,
3681 slot->data.key.data,
Steven Cooreman7f391872020-07-30 14:57:44 +02003682 slot->data.key.bytes,
Steven Cooremana01795d2020-07-24 22:48:15 +02003683 &rsa );
3684 if( status != PSA_SUCCESS )
3685 goto exit;
3686
Steven Cooremana2371e52020-07-28 14:30:39 +02003687 status = psa_rsa_sign( rsa,
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003688 alg,
3689 hash, hash_length,
3690 signature, signature_size,
3691 signature_length );
Steven Cooremana01795d2020-07-24 22:48:15 +02003692
Steven Cooremana2371e52020-07-28 14:30:39 +02003693 mbedtls_rsa_free( rsa );
3694 mbedtls_free( rsa );
Gilles Peskine20035e32018-02-03 22:44:14 +01003695 }
3696 else
3697#endif /* defined(MBEDTLS_RSA_C) */
3698#if defined(MBEDTLS_ECP_C)
Gilles Peskine8e338702019-07-30 20:06:31 +02003699 if( PSA_KEY_TYPE_IS_ECC( slot->attr.type ) )
Gilles Peskine20035e32018-02-03 22:44:14 +01003700 {
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003701#if defined(MBEDTLS_ECDSA_C)
Gilles Peskinea05219c2018-11-16 16:02:56 +01003702 if(
3703#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
3704 PSA_ALG_IS_ECDSA( alg )
3705#else
3706 PSA_ALG_IS_RANDOMIZED_ECDSA( alg )
3707#endif
3708 )
Steven Cooremanacda8342020-07-24 23:09:52 +02003709 {
Steven Cooremana2371e52020-07-28 14:30:39 +02003710 mbedtls_ecp_keypair *ecp = NULL;
Steven Cooreman4fed4552020-08-03 14:46:03 +02003711 status = psa_load_ecp_representation( slot->attr.type,
3712 slot->data.key.data,
Steven Cooreman7f391872020-07-30 14:57:44 +02003713 slot->data.key.bytes,
Steven Cooreman7f391872020-07-30 14:57:44 +02003714 &ecp );
Steven Cooremanacda8342020-07-24 23:09:52 +02003715 if( status != PSA_SUCCESS )
3716 goto exit;
Steven Cooremana2371e52020-07-28 14:30:39 +02003717 status = psa_ecdsa_sign( ecp,
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003718 alg,
3719 hash, hash_length,
3720 signature, signature_size,
3721 signature_length );
Steven Cooremana2371e52020-07-28 14:30:39 +02003722 mbedtls_ecp_keypair_free( ecp );
3723 mbedtls_free( ecp );
Steven Cooremanacda8342020-07-24 23:09:52 +02003724 }
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003725 else
3726#endif /* defined(MBEDTLS_ECDSA_C) */
3727 {
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003728 status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003729 }
itayzafrir5c753392018-05-08 11:18:38 +03003730 }
3731 else
3732#endif /* defined(MBEDTLS_ECP_C) */
3733 {
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003734 status = PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine20035e32018-02-03 22:44:14 +01003735 }
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003736
3737exit:
3738 /* Fill the unused part of the output buffer (the whole buffer on error,
3739 * the trailing part on success) with something that isn't a valid mac
3740 * (barring an attack on the mac and deliberately-crafted input),
3741 * in case the caller doesn't check the return status properly. */
3742 if( status == PSA_SUCCESS )
3743 memset( signature + *signature_length, '!',
3744 signature_size - *signature_length );
Gilles Peskine4019f0e2019-09-12 22:05:59 +02003745 else
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003746 memset( signature, '!', signature_size );
Gilles Peskine46f1fd72018-06-28 19:31:31 +02003747 /* If signature_size is 0 then we have nothing to do. We must not call
3748 * memset because signature may be NULL in this case. */
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003749 return( status );
itayzafrir5c753392018-05-08 11:18:38 +03003750}
3751
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01003752psa_status_t psa_verify_hash( psa_key_handle_t handle,
3753 psa_algorithm_t alg,
3754 const uint8_t *hash,
3755 size_t hash_length,
3756 const uint8_t *signature,
3757 size_t signature_length )
itayzafrir5c753392018-05-08 11:18:38 +03003758{
Gilles Peskine2f060a82018-12-04 17:12:32 +01003759 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003760 psa_status_t status;
Gilles Peskine2b450e32018-06-27 15:42:46 +02003761
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01003762 status = psa_get_key_from_slot( handle, &slot, PSA_KEY_USAGE_VERIFY_HASH, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003763 if( status != PSA_SUCCESS )
3764 return( status );
itayzafrir5c753392018-05-08 11:18:38 +03003765
Steven Cooreman55ae2172020-07-17 19:46:15 +02003766 /* Try any of the available accelerators first */
3767 status = psa_driver_wrapper_verify_hash( slot,
3768 alg,
3769 hash,
3770 hash_length,
3771 signature,
3772 signature_length );
Steven Cooreman8d2bde72020-09-04 13:06:39 +02003773 if( status != PSA_ERROR_NOT_SUPPORTED ||
3774 psa_key_lifetime_is_external( slot->attr.lifetime ) )
Steven Cooreman55ae2172020-07-17 19:46:15 +02003775 return status;
3776
Gilles Peskine61b91d42018-06-08 16:09:36 +02003777#if defined(MBEDTLS_RSA_C)
Gilles Peskine8e338702019-07-30 20:06:31 +02003778 if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003779 {
Steven Cooremana2371e52020-07-28 14:30:39 +02003780 mbedtls_rsa_context *rsa = NULL;
Steven Cooremana01795d2020-07-24 22:48:15 +02003781
Steven Cooreman4fed4552020-08-03 14:46:03 +02003782 status = psa_load_rsa_representation( slot->attr.type,
3783 slot->data.key.data,
Steven Cooreman7f391872020-07-30 14:57:44 +02003784 slot->data.key.bytes,
Steven Cooreman7f391872020-07-30 14:57:44 +02003785 &rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02003786 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02003787 return( status );
Steven Cooremana01795d2020-07-24 22:48:15 +02003788
Steven Cooremana2371e52020-07-28 14:30:39 +02003789 status = psa_rsa_verify( rsa,
Steven Cooremana01795d2020-07-24 22:48:15 +02003790 alg,
3791 hash, hash_length,
3792 signature, signature_length );
Steven Cooremana2371e52020-07-28 14:30:39 +02003793 mbedtls_rsa_free( rsa );
3794 mbedtls_free( rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02003795 return( status );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003796 }
3797 else
3798#endif /* defined(MBEDTLS_RSA_C) */
itayzafrir5c753392018-05-08 11:18:38 +03003799#if defined(MBEDTLS_ECP_C)
Gilles Peskine8e338702019-07-30 20:06:31 +02003800 if( PSA_KEY_TYPE_IS_ECC( slot->attr.type ) )
itayzafrir5c753392018-05-08 11:18:38 +03003801 {
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003802#if defined(MBEDTLS_ECDSA_C)
3803 if( PSA_ALG_IS_ECDSA( alg ) )
Steven Cooremanacda8342020-07-24 23:09:52 +02003804 {
Steven Cooremana2371e52020-07-28 14:30:39 +02003805 mbedtls_ecp_keypair *ecp = NULL;
Steven Cooreman4fed4552020-08-03 14:46:03 +02003806 status = psa_load_ecp_representation( slot->attr.type,
3807 slot->data.key.data,
Steven Cooreman7f391872020-07-30 14:57:44 +02003808 slot->data.key.bytes,
Steven Cooreman7f391872020-07-30 14:57:44 +02003809 &ecp );
Steven Cooremanacda8342020-07-24 23:09:52 +02003810 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02003811 return( status );
Steven Cooremana2371e52020-07-28 14:30:39 +02003812 status = psa_ecdsa_verify( ecp,
Steven Cooremanacda8342020-07-24 23:09:52 +02003813 hash, hash_length,
3814 signature, signature_length );
Steven Cooremana2371e52020-07-28 14:30:39 +02003815 mbedtls_ecp_keypair_free( ecp );
3816 mbedtls_free( ecp );
Steven Cooreman29149862020-08-05 15:43:42 +02003817 return( status );
Steven Cooremanacda8342020-07-24 23:09:52 +02003818 }
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003819 else
3820#endif /* defined(MBEDTLS_ECDSA_C) */
3821 {
3822 return( PSA_ERROR_INVALID_ARGUMENT );
3823 }
itayzafrir5c753392018-05-08 11:18:38 +03003824 }
Gilles Peskine20035e32018-02-03 22:44:14 +01003825 else
3826#endif /* defined(MBEDTLS_ECP_C) */
3827 {
3828 return( PSA_ERROR_NOT_SUPPORTED );
3829 }
3830}
3831
Gilles Peskine072ac562018-06-30 00:21:29 +02003832#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PKCS1_V21)
3833static void psa_rsa_oaep_set_padding_mode( psa_algorithm_t alg,
3834 mbedtls_rsa_context *rsa )
3835{
3836 psa_algorithm_t hash_alg = PSA_ALG_RSA_OAEP_GET_HASH( alg );
3837 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
3838 mbedtls_md_type_t md_alg = mbedtls_md_get_type( md_info );
3839 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
3840}
3841#endif /* defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PKCS1_V21) */
3842
Gilles Peskinec5487a82018-12-03 18:08:14 +01003843psa_status_t psa_asymmetric_encrypt( psa_key_handle_t handle,
Gilles Peskine61b91d42018-06-08 16:09:36 +02003844 psa_algorithm_t alg,
3845 const uint8_t *input,
3846 size_t input_length,
3847 const uint8_t *salt,
3848 size_t salt_length,
3849 uint8_t *output,
3850 size_t output_size,
3851 size_t *output_length )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003852{
Gilles Peskine2f060a82018-12-04 17:12:32 +01003853 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003854 psa_status_t status;
3855
Darryl Green5cc689a2018-07-24 15:34:10 +01003856 (void) input;
3857 (void) input_length;
3858 (void) salt;
3859 (void) output;
3860 (void) output_size;
3861
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03003862 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003863
Gilles Peskineb3fc05d2018-06-30 19:04:35 +02003864 if( ! PSA_ALG_IS_RSA_OAEP( alg ) && salt_length != 0 )
3865 return( PSA_ERROR_INVALID_ARGUMENT );
3866
Gilles Peskine28f8f302019-07-24 13:30:31 +02003867 status = psa_get_transparent_key( handle, &slot, PSA_KEY_USAGE_ENCRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003868 if( status != PSA_SUCCESS )
3869 return( status );
Gilles Peskine8e338702019-07-30 20:06:31 +02003870 if( ! ( PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->attr.type ) ||
3871 PSA_KEY_TYPE_IS_KEY_PAIR( slot->attr.type ) ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003872 return( PSA_ERROR_INVALID_ARGUMENT );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003873
3874#if defined(MBEDTLS_RSA_C)
Gilles Peskine8e338702019-07-30 20:06:31 +02003875 if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003876 {
Steven Cooremana2371e52020-07-28 14:30:39 +02003877 mbedtls_rsa_context *rsa = NULL;
Steven Cooreman4fed4552020-08-03 14:46:03 +02003878 status = psa_load_rsa_representation( slot->attr.type,
3879 slot->data.key.data,
Steven Cooreman7f391872020-07-30 14:57:44 +02003880 slot->data.key.bytes,
Steven Cooreman7f391872020-07-30 14:57:44 +02003881 &rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02003882 if( status != PSA_SUCCESS )
Steven Cooreman4fed4552020-08-03 14:46:03 +02003883 goto rsa_exit;
Steven Cooremana2371e52020-07-28 14:30:39 +02003884
3885 if( output_size < mbedtls_rsa_get_len( rsa ) )
Steven Cooremana01795d2020-07-24 22:48:15 +02003886 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02003887 status = PSA_ERROR_BUFFER_TOO_SMALL;
3888 goto rsa_exit;
Steven Cooremana01795d2020-07-24 22:48:15 +02003889 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003890#if defined(MBEDTLS_PKCS1_V15)
Gilles Peskine6afe7892018-05-31 13:16:08 +02003891 if( alg == PSA_ALG_RSA_PKCS1V15_CRYPT )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003892 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02003893 status = mbedtls_to_psa_error(
3894 mbedtls_rsa_pkcs1_encrypt( rsa,
3895 mbedtls_ctr_drbg_random,
3896 &global_data.ctr_drbg,
3897 MBEDTLS_RSA_PUBLIC,
3898 input_length,
3899 input,
3900 output ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003901 }
3902 else
3903#endif /* MBEDTLS_PKCS1_V15 */
3904#if defined(MBEDTLS_PKCS1_V21)
Gilles Peskine55bf3d12018-06-26 15:53:48 +02003905 if( PSA_ALG_IS_RSA_OAEP( alg ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003906 {
Steven Cooremana2371e52020-07-28 14:30:39 +02003907 psa_rsa_oaep_set_padding_mode( alg, rsa );
Steven Cooreman4fed4552020-08-03 14:46:03 +02003908 status = mbedtls_to_psa_error(
3909 mbedtls_rsa_rsaes_oaep_encrypt( rsa,
3910 mbedtls_ctr_drbg_random,
3911 &global_data.ctr_drbg,
3912 MBEDTLS_RSA_PUBLIC,
3913 salt, salt_length,
3914 input_length,
3915 input,
3916 output ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003917 }
3918 else
3919#endif /* MBEDTLS_PKCS1_V21 */
3920 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02003921 status = PSA_ERROR_INVALID_ARGUMENT;
3922 goto rsa_exit;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003923 }
Steven Cooreman4fed4552020-08-03 14:46:03 +02003924rsa_exit:
3925 if( status == PSA_SUCCESS )
Steven Cooremana2371e52020-07-28 14:30:39 +02003926 *output_length = mbedtls_rsa_get_len( rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02003927
Steven Cooremana2371e52020-07-28 14:30:39 +02003928 mbedtls_rsa_free( rsa );
3929 mbedtls_free( rsa );
Steven Cooreman4fed4552020-08-03 14:46:03 +02003930 return( status );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003931 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003932 else
Gilles Peskineb75e4f12018-06-08 17:44:47 +02003933#endif /* defined(MBEDTLS_RSA_C) */
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003934 {
3935 return( PSA_ERROR_NOT_SUPPORTED );
3936 }
Gilles Peskine5b051bc2018-05-31 13:25:48 +02003937}
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003938
Gilles Peskinec5487a82018-12-03 18:08:14 +01003939psa_status_t psa_asymmetric_decrypt( psa_key_handle_t handle,
Gilles Peskine61b91d42018-06-08 16:09:36 +02003940 psa_algorithm_t alg,
3941 const uint8_t *input,
3942 size_t input_length,
3943 const uint8_t *salt,
3944 size_t salt_length,
3945 uint8_t *output,
3946 size_t output_size,
3947 size_t *output_length )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003948{
Gilles Peskine2f060a82018-12-04 17:12:32 +01003949 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003950 psa_status_t status;
3951
Darryl Green5cc689a2018-07-24 15:34:10 +01003952 (void) input;
3953 (void) input_length;
3954 (void) salt;
3955 (void) output;
3956 (void) output_size;
3957
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03003958 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003959
Gilles Peskineb3fc05d2018-06-30 19:04:35 +02003960 if( ! PSA_ALG_IS_RSA_OAEP( alg ) && salt_length != 0 )
3961 return( PSA_ERROR_INVALID_ARGUMENT );
3962
Gilles Peskine28f8f302019-07-24 13:30:31 +02003963 status = psa_get_transparent_key( handle, &slot, PSA_KEY_USAGE_DECRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003964 if( status != PSA_SUCCESS )
3965 return( status );
Gilles Peskine8e338702019-07-30 20:06:31 +02003966 if( ! PSA_KEY_TYPE_IS_KEY_PAIR( slot->attr.type ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003967 return( PSA_ERROR_INVALID_ARGUMENT );
3968
3969#if defined(MBEDTLS_RSA_C)
Gilles Peskine8e338702019-07-30 20:06:31 +02003970 if( slot->attr.type == PSA_KEY_TYPE_RSA_KEY_PAIR )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003971 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02003972 mbedtls_rsa_context *rsa = NULL;
3973 status = psa_load_rsa_representation( slot->attr.type,
3974 slot->data.key.data,
Steven Cooreman7f391872020-07-30 14:57:44 +02003975 slot->data.key.bytes,
Steven Cooreman7f391872020-07-30 14:57:44 +02003976 &rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02003977 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02003978 return( status );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003979
Steven Cooremana2371e52020-07-28 14:30:39 +02003980 if( input_length != mbedtls_rsa_get_len( rsa ) )
Steven Cooremana01795d2020-07-24 22:48:15 +02003981 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02003982 status = PSA_ERROR_INVALID_ARGUMENT;
3983 goto rsa_exit;
Steven Cooremana01795d2020-07-24 22:48:15 +02003984 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003985
3986#if defined(MBEDTLS_PKCS1_V15)
Gilles Peskine6afe7892018-05-31 13:16:08 +02003987 if( alg == PSA_ALG_RSA_PKCS1V15_CRYPT )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003988 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02003989 status = mbedtls_to_psa_error(
3990 mbedtls_rsa_pkcs1_decrypt( rsa,
3991 mbedtls_ctr_drbg_random,
3992 &global_data.ctr_drbg,
3993 MBEDTLS_RSA_PRIVATE,
3994 output_length,
3995 input,
3996 output,
3997 output_size ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003998 }
3999 else
4000#endif /* MBEDTLS_PKCS1_V15 */
4001#if defined(MBEDTLS_PKCS1_V21)
Gilles Peskine55bf3d12018-06-26 15:53:48 +02004002 if( PSA_ALG_IS_RSA_OAEP( alg ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004003 {
Steven Cooremana2371e52020-07-28 14:30:39 +02004004 psa_rsa_oaep_set_padding_mode( alg, rsa );
Steven Cooreman4fed4552020-08-03 14:46:03 +02004005 status = mbedtls_to_psa_error(
4006 mbedtls_rsa_rsaes_oaep_decrypt( rsa,
4007 mbedtls_ctr_drbg_random,
4008 &global_data.ctr_drbg,
4009 MBEDTLS_RSA_PRIVATE,
4010 salt, salt_length,
4011 output_length,
4012 input,
4013 output,
4014 output_size ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004015 }
4016 else
4017#endif /* MBEDTLS_PKCS1_V21 */
4018 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02004019 status = PSA_ERROR_INVALID_ARGUMENT;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004020 }
Nir Sonnenschein717a0402018-06-04 16:36:15 +03004021
Steven Cooreman4fed4552020-08-03 14:46:03 +02004022rsa_exit:
Steven Cooremana2371e52020-07-28 14:30:39 +02004023 mbedtls_rsa_free( rsa );
4024 mbedtls_free( rsa );
Steven Cooreman4fed4552020-08-03 14:46:03 +02004025 return( status );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004026 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004027 else
Gilles Peskineb75e4f12018-06-08 17:44:47 +02004028#endif /* defined(MBEDTLS_RSA_C) */
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004029 {
4030 return( PSA_ERROR_NOT_SUPPORTED );
4031 }
Gilles Peskine5b051bc2018-05-31 13:25:48 +02004032}
Gilles Peskine20035e32018-02-03 22:44:14 +01004033
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02004034
4035
mohammad1603503973b2018-03-12 15:59:30 +02004036/****************************************************************/
4037/* Symmetric cryptography */
4038/****************************************************************/
4039
Gilles Peskinee553c652018-06-04 16:22:46 +02004040static psa_status_t psa_cipher_setup( psa_cipher_operation_t *operation,
Gilles Peskinec5487a82018-12-03 18:08:14 +01004041 psa_key_handle_t handle,
Gilles Peskine7e928852018-06-04 16:23:10 +02004042 psa_algorithm_t alg,
4043 mbedtls_operation_t cipher_operation )
mohammad1603503973b2018-03-12 15:59:30 +02004044{
Gilles Peskine9ab61b62019-02-25 17:43:14 +01004045 int ret = 0;
4046 psa_status_t status = PSA_ERROR_GENERIC_ERROR;
Gilles Peskine2f060a82018-12-04 17:12:32 +01004047 psa_key_slot_t *slot;
mohammad1603503973b2018-03-12 15:59:30 +02004048 size_t key_bits;
4049 const mbedtls_cipher_info_t *cipher_info = NULL;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02004050 psa_key_usage_t usage = ( cipher_operation == MBEDTLS_ENCRYPT ?
4051 PSA_KEY_USAGE_ENCRYPT :
4052 PSA_KEY_USAGE_DECRYPT );
mohammad1603503973b2018-03-12 15:59:30 +02004053
Steven Cooremand3feccd2020-09-01 15:56:14 +02004054 /* A context must be freshly initialized before it can be set up. */
4055 if( operation->alg != 0 )
4056 return( PSA_ERROR_BAD_STATE );
4057
Steven Cooremana07b9972020-09-10 14:54:14 +02004058 /* The requested algorithm must be one that can be processed by cipher. */
4059 if( ! PSA_ALG_IS_CIPHER( alg ) )
4060 {
4061 memset( operation, 0, sizeof( *operation ) );
4062 return( PSA_ERROR_INVALID_ARGUMENT );
4063 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004064
Steven Cooremana07b9972020-09-10 14:54:14 +02004065 /* Reset the operation members to their initial state, except for alg. The
4066 * alg member is used as an indicator that psa_cipher_abort needs to free
4067 * allocated resources, which doesn't happen until later. */
4068 operation->key_set = 0;
4069 operation->iv_set = 0;
4070 operation->driver_in_use = 0;
4071 operation->iv_size = 0;
4072 operation->block_size = 0;
4073 if( alg == PSA_ALG_ECB_NO_PADDING )
4074 operation->iv_required = 0;
4075 else
4076 operation->iv_required = 1;
4077
4078 /* Fetch key material from key storage. */
4079 status = psa_get_key_from_slot( handle, &slot, usage, alg );
4080 if( status != PSA_SUCCESS )
4081 goto exit;
4082
4083 /* Try doing the operation through a driver before using software fallback. */
Steven Cooreman37941cb2020-07-28 18:49:51 +02004084 if( cipher_operation == MBEDTLS_ENCRYPT )
Steven Cooremanfb81aa52020-09-09 12:01:43 +02004085 status = psa_driver_wrapper_cipher_encrypt_setup( &operation->ctx.driver,
Steven Cooreman37941cb2020-07-28 18:49:51 +02004086 slot,
4087 alg );
4088 else
Steven Cooremanfb81aa52020-09-09 12:01:43 +02004089 status = psa_driver_wrapper_cipher_decrypt_setup( &operation->ctx.driver,
Steven Cooreman37941cb2020-07-28 18:49:51 +02004090 slot,
4091 alg );
4092
Steven Cooremand3feccd2020-09-01 15:56:14 +02004093 if( status != PSA_ERROR_NOT_SUPPORTED ||
4094 psa_key_lifetime_is_external( slot->attr.lifetime ) )
Steven Cooremane55f3e82020-09-09 18:41:07 +02004095 {
Steven Cooremana07b9972020-09-10 14:54:14 +02004096 /* Indicate this operation is bound to a driver. When the driver setup
4097 * succeeded, this indicates to the core to not call any mbedtls_
Steven Cooremane55f3e82020-09-09 18:41:07 +02004098 * functions for this operation (contexts are not interoperable).
4099 * In case the drivers couldn't setup and there's no way to fallback,
4100 * indicate to the core to not call mbedtls_cipher_free on an
4101 * uninitialised mbed TLS cipher context. */
Steven Cooremana07b9972020-09-10 14:54:14 +02004102 operation->driver_in_use = 1;
4103
4104 /* If the wrapper call succeeded, it allocated resources that need to be
4105 * freed using psa_cipher_abort. Indicate this through setting alg. */
4106 if( status == PSA_SUCCESS )
4107 operation->alg = alg;
4108
Steven Cooremand3feccd2020-09-01 15:56:14 +02004109 goto exit;
Steven Cooremane55f3e82020-09-09 18:41:07 +02004110 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004111
Steven Cooremana07b9972020-09-10 14:54:14 +02004112 /* Proceed with initializing an mbed TLS cipher context if no driver is
Steven Cooremand3feccd2020-09-01 15:56:14 +02004113 * available for the given algorithm & key. */
4114 mbedtls_cipher_init( &operation->ctx.cipher );
mohammad1603503973b2018-03-12 15:59:30 +02004115
Steven Cooremana07b9972020-09-10 14:54:14 +02004116 /* Once the cipher context is initialised, it needs to be freed using
4117 * psa_cipher_abort. Indicate this through setting alg. */
4118 operation->alg = alg;
4119
Gilles Peskinedb4b3ab2019-04-18 12:53:01 +02004120 key_bits = psa_get_key_slot_bits( slot );
Gilles Peskine8e338702019-07-30 20:06:31 +02004121 cipher_info = mbedtls_cipher_info_from_psa( alg, slot->attr.type, key_bits, NULL );
mohammad1603503973b2018-03-12 15:59:30 +02004122 if( cipher_info == NULL )
Gilles Peskine9ab61b62019-02-25 17:43:14 +01004123 {
4124 status = PSA_ERROR_NOT_SUPPORTED;
4125 goto exit;
4126 }
mohammad1603503973b2018-03-12 15:59:30 +02004127
mohammad1603503973b2018-03-12 15:59:30 +02004128 ret = mbedtls_cipher_setup( &operation->ctx.cipher, cipher_info );
Moran Peker41deec42018-04-04 15:43:05 +03004129 if( ret != 0 )
Gilles Peskine9ab61b62019-02-25 17:43:14 +01004130 goto exit;
mohammad1603503973b2018-03-12 15:59:30 +02004131
Gilles Peskine9ad29e22018-06-21 09:40:04 +02004132#if defined(MBEDTLS_DES_C)
Gilles Peskine8e338702019-07-30 20:06:31 +02004133 if( slot->attr.type == PSA_KEY_TYPE_DES && key_bits == 128 )
Gilles Peskine9ad29e22018-06-21 09:40:04 +02004134 {
4135 /* Two-key Triple-DES is 3-key Triple-DES with K1=K3 */
Gilles Peskinec11c4dc2019-07-15 11:06:38 +02004136 uint8_t keys[24];
Steven Cooreman71fd80d2020-07-07 21:12:27 +02004137 memcpy( keys, slot->data.key.data, 16 );
4138 memcpy( keys + 16, slot->data.key.data, 8 );
Gilles Peskine9ad29e22018-06-21 09:40:04 +02004139 ret = mbedtls_cipher_setkey( &operation->ctx.cipher,
4140 keys,
4141 192, cipher_operation );
4142 }
4143 else
4144#endif
4145 {
4146 ret = mbedtls_cipher_setkey( &operation->ctx.cipher,
Steven Cooreman71fd80d2020-07-07 21:12:27 +02004147 slot->data.key.data,
Jaeden Amero23bbb752018-06-26 14:16:54 +01004148 (int) key_bits, cipher_operation );
Gilles Peskine9ad29e22018-06-21 09:40:04 +02004149 }
Moran Peker41deec42018-04-04 15:43:05 +03004150 if( ret != 0 )
Gilles Peskine9ab61b62019-02-25 17:43:14 +01004151 goto exit;
mohammad1603503973b2018-03-12 15:59:30 +02004152
mohammad16038481e742018-03-18 13:57:31 +02004153#if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING)
Gilles Peskinedaea26f2018-08-21 14:02:45 +02004154 switch( alg )
mohammad16038481e742018-03-18 13:57:31 +02004155 {
Gilles Peskinedaea26f2018-08-21 14:02:45 +02004156 case PSA_ALG_CBC_NO_PADDING:
4157 ret = mbedtls_cipher_set_padding_mode( &operation->ctx.cipher,
4158 MBEDTLS_PADDING_NONE );
4159 break;
4160 case PSA_ALG_CBC_PKCS7:
4161 ret = mbedtls_cipher_set_padding_mode( &operation->ctx.cipher,
4162 MBEDTLS_PADDING_PKCS7 );
4163 break;
4164 default:
4165 /* The algorithm doesn't involve padding. */
4166 ret = 0;
4167 break;
4168 }
4169 if( ret != 0 )
Gilles Peskine9ab61b62019-02-25 17:43:14 +01004170 goto exit;
mohammad16038481e742018-03-18 13:57:31 +02004171#endif //MBEDTLS_CIPHER_MODE_WITH_PADDING
4172
Gilles Peskinedaea26f2018-08-21 14:02:45 +02004173 operation->block_size = ( PSA_ALG_IS_STREAM_CIPHER( alg ) ? 1 :
Gilles Peskine8e338702019-07-30 20:06:31 +02004174 PSA_BLOCK_CIPHER_BLOCK_SIZE( slot->attr.type ) );
Steven Cooremana6033e92020-08-25 11:47:50 +02004175 if( ( alg & PSA_ALG_CIPHER_FROM_BLOCK_FLAG ) != 0 &&
4176 alg != PSA_ALG_ECB_NO_PADDING )
mohammad16038481e742018-03-18 13:57:31 +02004177 {
Gilles Peskine8e338702019-07-30 20:06:31 +02004178 operation->iv_size = PSA_BLOCK_CIPHER_BLOCK_SIZE( slot->attr.type );
mohammad16038481e742018-03-18 13:57:31 +02004179 }
Gilles Peskine26869f22019-05-06 15:25:00 +02004180#if defined(MBEDTLS_CHACHA20_C)
4181 else
4182 if( alg == PSA_ALG_CHACHA20 )
4183 operation->iv_size = 12;
4184#endif
mohammad1603503973b2018-03-12 15:59:30 +02004185
Steven Cooreman7df02922020-09-09 15:28:49 +02004186 status = PSA_SUCCESS;
4187
Gilles Peskine9ab61b62019-02-25 17:43:14 +01004188exit:
Steven Cooreman7df02922020-09-09 15:28:49 +02004189 if( ret != 0 )
Gilles Peskine9ab61b62019-02-25 17:43:14 +01004190 status = mbedtls_to_psa_error( ret );
Steven Cooreman7df02922020-09-09 15:28:49 +02004191 if( status == PSA_SUCCESS )
4192 {
4193 /* Update operation flags for both driver and software implementations */
4194 operation->key_set = 1;
4195 }
4196 else
Gilles Peskine9ab61b62019-02-25 17:43:14 +01004197 psa_cipher_abort( operation );
4198 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02004199}
4200
Gilles Peskinefe119512018-07-08 21:39:34 +02004201psa_status_t psa_cipher_encrypt_setup( psa_cipher_operation_t *operation,
Gilles Peskinec5487a82018-12-03 18:08:14 +01004202 psa_key_handle_t handle,
Gilles Peskinefe119512018-07-08 21:39:34 +02004203 psa_algorithm_t alg )
mohammad16038481e742018-03-18 13:57:31 +02004204{
Gilles Peskinec5487a82018-12-03 18:08:14 +01004205 return( psa_cipher_setup( operation, handle, alg, MBEDTLS_ENCRYPT ) );
mohammad16038481e742018-03-18 13:57:31 +02004206}
4207
Gilles Peskinefe119512018-07-08 21:39:34 +02004208psa_status_t psa_cipher_decrypt_setup( psa_cipher_operation_t *operation,
Gilles Peskinec5487a82018-12-03 18:08:14 +01004209 psa_key_handle_t handle,
Gilles Peskinefe119512018-07-08 21:39:34 +02004210 psa_algorithm_t alg )
mohammad16038481e742018-03-18 13:57:31 +02004211{
Gilles Peskinec5487a82018-12-03 18:08:14 +01004212 return( psa_cipher_setup( operation, handle, alg, MBEDTLS_DECRYPT ) );
mohammad16038481e742018-03-18 13:57:31 +02004213}
4214
Gilles Peskinefe119512018-07-08 21:39:34 +02004215psa_status_t psa_cipher_generate_iv( psa_cipher_operation_t *operation,
Andrew Thoelke163639b2019-05-15 12:33:23 +01004216 uint8_t *iv,
Gilles Peskinefe119512018-07-08 21:39:34 +02004217 size_t iv_size,
4218 size_t *iv_length )
mohammad1603503973b2018-03-12 15:59:30 +02004219{
itayzafrir534bd7c2018-08-02 13:56:32 +03004220 psa_status_t status;
Janos Follath24eed8d2019-11-22 13:21:35 +00004221 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Steven Cooreman7df02922020-09-09 15:28:49 +02004222 if( operation->iv_set || ! operation->iv_required )
4223 {
4224 return( PSA_ERROR_BAD_STATE );
4225 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004226
Steven Cooremana07b9972020-09-10 14:54:14 +02004227 if( operation->driver_in_use == 1 )
Steven Cooreman8b122252020-09-03 15:30:32 +02004228 {
Steven Cooremanfb81aa52020-09-09 12:01:43 +02004229 status = psa_driver_wrapper_cipher_generate_iv( &operation->ctx.driver,
Steven Cooreman8b122252020-09-03 15:30:32 +02004230 iv,
4231 iv_size,
4232 iv_length );
4233 goto exit;
4234 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004235
Moran Peker41deec42018-04-04 15:43:05 +03004236 if( iv_size < operation->iv_size )
mohammad1603503973b2018-03-12 15:59:30 +02004237 {
itayzafrir534bd7c2018-08-02 13:56:32 +03004238 status = PSA_ERROR_BUFFER_TOO_SMALL;
Moran Peker41deec42018-04-04 15:43:05 +03004239 goto exit;
4240 }
Gilles Peskine7e928852018-06-04 16:23:10 +02004241 ret = mbedtls_ctr_drbg_random( &global_data.ctr_drbg,
4242 iv, operation->iv_size );
Moran Peker41deec42018-04-04 15:43:05 +03004243 if( ret != 0 )
4244 {
itayzafrir534bd7c2018-08-02 13:56:32 +03004245 status = mbedtls_to_psa_error( ret );
Gilles Peskinee553c652018-06-04 16:22:46 +02004246 goto exit;
mohammad1603503973b2018-03-12 15:59:30 +02004247 }
Gilles Peskinee553c652018-06-04 16:22:46 +02004248
mohammad16038481e742018-03-18 13:57:31 +02004249 *iv_length = operation->iv_size;
itayzafrir534bd7c2018-08-02 13:56:32 +03004250 status = psa_cipher_set_iv( operation, iv, *iv_length );
Moran Peker41deec42018-04-04 15:43:05 +03004251
Moran Peker395db872018-05-31 14:07:14 +03004252exit:
Steven Cooreman7df02922020-09-09 15:28:49 +02004253 if( status == PSA_SUCCESS )
4254 operation->iv_set = 1;
4255 else
Moran Peker395db872018-05-31 14:07:14 +03004256 psa_cipher_abort( operation );
itayzafrir534bd7c2018-08-02 13:56:32 +03004257 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02004258}
4259
Gilles Peskinefe119512018-07-08 21:39:34 +02004260psa_status_t psa_cipher_set_iv( psa_cipher_operation_t *operation,
Andrew Thoelke163639b2019-05-15 12:33:23 +01004261 const uint8_t *iv,
Gilles Peskinefe119512018-07-08 21:39:34 +02004262 size_t iv_length )
mohammad1603503973b2018-03-12 15:59:30 +02004263{
itayzafrir534bd7c2018-08-02 13:56:32 +03004264 psa_status_t status;
Janos Follath24eed8d2019-11-22 13:21:35 +00004265 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Steven Cooreman7df02922020-09-09 15:28:49 +02004266 if( operation->iv_set || ! operation->iv_required )
4267 {
4268 return( PSA_ERROR_BAD_STATE );
4269 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004270
Steven Cooremana07b9972020-09-10 14:54:14 +02004271 if( operation->driver_in_use == 1 )
Steven Cooreman8b122252020-09-03 15:30:32 +02004272 {
Steven Cooremanfb81aa52020-09-09 12:01:43 +02004273 status = psa_driver_wrapper_cipher_set_iv( &operation->ctx.driver,
Steven Cooreman8b122252020-09-03 15:30:32 +02004274 iv,
4275 iv_length );
4276 goto exit;
4277 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004278
Moran Pekera28258c2018-05-29 16:25:04 +03004279 if( iv_length != operation->iv_size )
Moran Peker71f19ae2018-04-22 20:23:16 +03004280 {
itayzafrir534bd7c2018-08-02 13:56:32 +03004281 status = PSA_ERROR_INVALID_ARGUMENT;
4282 goto exit;
Moran Peker71f19ae2018-04-22 20:23:16 +03004283 }
itayzafrir534bd7c2018-08-02 13:56:32 +03004284 ret = mbedtls_cipher_set_iv( &operation->ctx.cipher, iv, iv_length );
4285 status = mbedtls_to_psa_error( ret );
4286exit:
4287 if( status == PSA_SUCCESS )
4288 operation->iv_set = 1;
4289 else
mohammad1603503973b2018-03-12 15:59:30 +02004290 psa_cipher_abort( operation );
itayzafrir534bd7c2018-08-02 13:56:32 +03004291 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02004292}
4293
Steven Cooreman177deba2020-09-07 17:14:14 +02004294/* Process input for which the algorithm is set to ECB mode. This requires
4295 * manual processing, since the PSA API is defined as being able to process
4296 * arbitrary-length calls to psa_cipher_update() with ECB mode, but the
4297 * underlying mbedtls_cipher_update only takes full blocks. */
4298static psa_status_t psa_cipher_update_ecb_internal(
4299 mbedtls_cipher_context_t *ctx,
4300 const uint8_t *input,
4301 size_t input_length,
4302 uint8_t *output,
4303 size_t output_size,
4304 size_t *output_length )
4305{
4306 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4307 size_t block_size = ctx->cipher_info->block_size;
4308 size_t internal_output_length = 0;
4309 *output_length = 0;
4310
4311 if( input_length == 0 )
4312 {
4313 status = PSA_SUCCESS;
4314 goto exit;
4315 }
4316
4317 if( ctx->unprocessed_len > 0 )
4318 {
4319 /* Fill up to block size, and run the block if there's a full one. */
4320 size_t bytes_to_copy = block_size - ctx->unprocessed_len;
4321
4322 if( input_length < bytes_to_copy )
4323 bytes_to_copy = input_length;
4324
4325 memcpy( &( ctx->unprocessed_data[ctx->unprocessed_len] ),
4326 input, bytes_to_copy );
4327 input_length -= bytes_to_copy;
4328 input += bytes_to_copy;
4329 ctx->unprocessed_len += bytes_to_copy;
4330
4331 if( ctx->unprocessed_len == block_size )
4332 {
4333 status = mbedtls_to_psa_error(
4334 mbedtls_cipher_update( ctx,
4335 ctx->unprocessed_data,
4336 block_size,
4337 output, &internal_output_length ) );
4338
4339 if( status != PSA_SUCCESS )
4340 goto exit;
4341
4342 output += internal_output_length;
4343 output_size -= internal_output_length;
4344 *output_length += internal_output_length;
4345 ctx->unprocessed_len = 0;
4346 }
4347 }
4348
4349 while( input_length >= block_size )
4350 {
4351 /* Run all full blocks we have, one by one */
4352 status = mbedtls_to_psa_error(
4353 mbedtls_cipher_update( ctx, input,
4354 block_size,
4355 output, &internal_output_length ) );
4356
4357 if( status != PSA_SUCCESS )
4358 goto exit;
4359
4360 input_length -= block_size;
4361 input += block_size;
4362
4363 output += internal_output_length;
4364 output_size -= internal_output_length;
4365 *output_length += internal_output_length;
4366 }
4367
4368 if( input_length > 0 )
4369 {
4370 /* Save unprocessed bytes for later processing */
4371 memcpy( &( ctx->unprocessed_data[ctx->unprocessed_len] ),
4372 input, input_length );
4373 ctx->unprocessed_len += input_length;
4374 }
4375
4376 status = PSA_SUCCESS;
4377
4378exit:
4379 return( status );
4380}
4381
Gilles Peskinee553c652018-06-04 16:22:46 +02004382psa_status_t psa_cipher_update( psa_cipher_operation_t *operation,
4383 const uint8_t *input,
4384 size_t input_length,
Andrew Thoelke163639b2019-05-15 12:33:23 +01004385 uint8_t *output,
Gilles Peskinee553c652018-06-04 16:22:46 +02004386 size_t output_size,
4387 size_t *output_length )
mohammad1603503973b2018-03-12 15:59:30 +02004388{
Steven Cooremanffecb7b2020-08-25 15:13:13 +02004389 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine89d789c2018-06-04 17:17:16 +02004390 size_t expected_output_size;
Steven Cooreman7df02922020-09-09 15:28:49 +02004391 if( operation->alg == 0 )
4392 {
4393 return( PSA_ERROR_BAD_STATE );
4394 }
4395 if( operation->iv_required && ! operation->iv_set )
4396 {
4397 return( PSA_ERROR_BAD_STATE );
4398 }
Jaeden Ameroab439972019-02-15 14:12:05 +00004399
Steven Cooremana07b9972020-09-10 14:54:14 +02004400 if( operation->driver_in_use == 1 )
Steven Cooreman8b122252020-09-03 15:30:32 +02004401 {
Steven Cooremanfb81aa52020-09-09 12:01:43 +02004402 status = psa_driver_wrapper_cipher_update( &operation->ctx.driver,
Steven Cooreman8b122252020-09-03 15:30:32 +02004403 input,
4404 input_length,
4405 output,
4406 output_size,
4407 output_length );
4408 goto exit;
4409 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004410
Gilles Peskinedaea26f2018-08-21 14:02:45 +02004411 if( ! PSA_ALG_IS_STREAM_CIPHER( operation->alg ) )
Gilles Peskine89d789c2018-06-04 17:17:16 +02004412 {
4413 /* Take the unprocessed partial block left over from previous
4414 * update calls, if any, plus the input to this call. Remove
4415 * the last partial block, if any. You get the data that will be
4416 * output in this call. */
4417 expected_output_size =
4418 ( operation->ctx.cipher.unprocessed_len + input_length )
4419 / operation->block_size * operation->block_size;
4420 }
4421 else
4422 {
4423 expected_output_size = input_length;
4424 }
itayzafrir534bd7c2018-08-02 13:56:32 +03004425
Gilles Peskine89d789c2018-06-04 17:17:16 +02004426 if( output_size < expected_output_size )
itayzafrir534bd7c2018-08-02 13:56:32 +03004427 {
4428 status = PSA_ERROR_BUFFER_TOO_SMALL;
4429 goto exit;
4430 }
mohammad160382759612018-03-12 18:16:40 +02004431
Steven Cooremanffecb7b2020-08-25 15:13:13 +02004432 if( operation->alg == PSA_ALG_ECB_NO_PADDING )
4433 {
4434 /* mbedtls_cipher_update has an API inconsistency: it will only
4435 * process a single block at a time in ECB mode. Abstract away that
4436 * inconsistency here to match the PSA API behaviour. */
Steven Cooreman177deba2020-09-07 17:14:14 +02004437 status = psa_cipher_update_ecb_internal( &operation->ctx.cipher,
4438 input,
4439 input_length,
4440 output,
4441 output_size,
4442 output_length );
Steven Cooremanffecb7b2020-08-25 15:13:13 +02004443 }
4444 else
4445 {
4446 status = mbedtls_to_psa_error(
4447 mbedtls_cipher_update( &operation->ctx.cipher, input,
4448 input_length, output, output_length ) );
4449 }
itayzafrir534bd7c2018-08-02 13:56:32 +03004450exit:
4451 if( status != PSA_SUCCESS )
mohammad1603503973b2018-03-12 15:59:30 +02004452 psa_cipher_abort( operation );
itayzafrir534bd7c2018-08-02 13:56:32 +03004453 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02004454}
4455
Gilles Peskinee553c652018-06-04 16:22:46 +02004456psa_status_t psa_cipher_finish( psa_cipher_operation_t *operation,
4457 uint8_t *output,
4458 size_t output_size,
4459 size_t *output_length )
mohammad1603503973b2018-03-12 15:59:30 +02004460{
David Saadab4ecc272019-02-14 13:48:10 +02004461 psa_status_t status = PSA_ERROR_GENERIC_ERROR;
Janos Follath315b51c2018-07-09 16:04:51 +01004462 int cipher_ret = MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE;
Gilles Peskinee553c652018-06-04 16:22:46 +02004463 uint8_t temp_output_buffer[MBEDTLS_MAX_BLOCK_LENGTH];
Steven Cooreman7df02922020-09-09 15:28:49 +02004464 if( operation->alg == 0 )
4465 {
4466 return( PSA_ERROR_BAD_STATE );
4467 }
4468 if( operation->iv_required && ! operation->iv_set )
4469 {
4470 return( PSA_ERROR_BAD_STATE );
4471 }
Moran Pekerbed71a22018-04-22 20:19:20 +03004472
Steven Cooremana07b9972020-09-10 14:54:14 +02004473 if( operation->driver_in_use == 1 )
Steven Cooreman8b122252020-09-03 15:30:32 +02004474 {
Steven Cooremanfb81aa52020-09-09 12:01:43 +02004475 status = psa_driver_wrapper_cipher_finish( &operation->ctx.driver,
Steven Cooreman8b122252020-09-03 15:30:32 +02004476 output,
4477 output_size,
4478 output_length );
4479 if( status != PSA_SUCCESS )
4480 goto error;
4481
4482 (void) psa_cipher_abort( operation );
4483 return( status );
4484 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004485
Steven Cooremaned3c9ec2020-07-06 14:08:59 +02004486 if( operation->ctx.cipher.unprocessed_len != 0 )
Moran Peker7cb22b82018-06-05 11:40:02 +03004487 {
Steven Cooremaned3c9ec2020-07-06 14:08:59 +02004488 if( operation->alg == PSA_ALG_ECB_NO_PADDING ||
4489 ( operation->alg == PSA_ALG_CBC_NO_PADDING &&
Steven Cooremana6033e92020-08-25 11:47:50 +02004490 operation->ctx.cipher.operation == MBEDTLS_ENCRYPT ) )
4491 {
Gilles Peskinedaea26f2018-08-21 14:02:45 +02004492 status = PSA_ERROR_INVALID_ARGUMENT;
Janos Follath315b51c2018-07-09 16:04:51 +01004493 goto error;
Steven Cooremaned3c9ec2020-07-06 14:08:59 +02004494 }
Moran Pekerdc38ebc2018-04-30 15:45:34 +03004495 }
4496
Janos Follath315b51c2018-07-09 16:04:51 +01004497 cipher_ret = mbedtls_cipher_finish( &operation->ctx.cipher,
4498 temp_output_buffer,
4499 output_length );
4500 if( cipher_ret != 0 )
mohammad1603503973b2018-03-12 15:59:30 +02004501 {
Janos Follath315b51c2018-07-09 16:04:51 +01004502 status = mbedtls_to_psa_error( cipher_ret );
4503 goto error;
mohammad1603503973b2018-03-12 15:59:30 +02004504 }
Janos Follath315b51c2018-07-09 16:04:51 +01004505
Gilles Peskine46f1fd72018-06-28 19:31:31 +02004506 if( *output_length == 0 )
Janos Follath315b51c2018-07-09 16:04:51 +01004507 ; /* Nothing to copy. Note that output may be NULL in this case. */
Gilles Peskine46f1fd72018-06-28 19:31:31 +02004508 else if( output_size >= *output_length )
Moran Pekerdc38ebc2018-04-30 15:45:34 +03004509 memcpy( output, temp_output_buffer, *output_length );
4510 else
4511 {
Janos Follath315b51c2018-07-09 16:04:51 +01004512 status = PSA_ERROR_BUFFER_TOO_SMALL;
4513 goto error;
Moran Pekerdc38ebc2018-04-30 15:45:34 +03004514 }
mohammad1603503973b2018-03-12 15:59:30 +02004515
Gilles Peskine3f108122018-12-07 18:14:53 +01004516 mbedtls_platform_zeroize( temp_output_buffer, sizeof( temp_output_buffer ) );
Janos Follath315b51c2018-07-09 16:04:51 +01004517 status = psa_cipher_abort( operation );
4518
4519 return( status );
4520
4521error:
4522
4523 *output_length = 0;
4524
Gilles Peskine3f108122018-12-07 18:14:53 +01004525 mbedtls_platform_zeroize( temp_output_buffer, sizeof( temp_output_buffer ) );
Janos Follath315b51c2018-07-09 16:04:51 +01004526 (void) psa_cipher_abort( operation );
4527
4528 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02004529}
4530
Gilles Peskinee553c652018-06-04 16:22:46 +02004531psa_status_t psa_cipher_abort( psa_cipher_operation_t *operation )
4532{
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02004533 if( operation->alg == 0 )
Gilles Peskine81736312018-06-26 15:04:31 +02004534 {
Steven Cooremana07b9972020-09-10 14:54:14 +02004535 /* The object has (apparently) been initialized but it is not (yet)
Gilles Peskine81736312018-06-26 15:04:31 +02004536 * in use. It's ok to call abort on such an object, and there's
4537 * nothing to do. */
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02004538 return( PSA_SUCCESS );
Gilles Peskine81736312018-06-26 15:04:31 +02004539 }
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02004540
Gilles Peskinef9c2c092018-06-21 16:57:07 +02004541 /* Sanity check (shouldn't happen: operation->alg should
4542 * always have been initialized to a valid value). */
4543 if( ! PSA_ALG_IS_CIPHER( operation->alg ) )
4544 return( PSA_ERROR_BAD_STATE );
4545
Steven Cooremana07b9972020-09-10 14:54:14 +02004546 if( operation->driver_in_use == 1 )
Steven Cooremanfb81aa52020-09-09 12:01:43 +02004547 psa_driver_wrapper_cipher_abort( &operation->ctx.driver );
Steven Cooremand3feccd2020-09-01 15:56:14 +02004548 else
4549 mbedtls_cipher_free( &operation->ctx.cipher );
Gilles Peskinee553c652018-06-04 16:22:46 +02004550
Moran Peker41deec42018-04-04 15:43:05 +03004551 operation->alg = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03004552 operation->key_set = 0;
4553 operation->iv_set = 0;
Steven Cooremana07b9972020-09-10 14:54:14 +02004554 operation->driver_in_use = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03004555 operation->iv_size = 0;
Moran Peker41deec42018-04-04 15:43:05 +03004556 operation->block_size = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03004557 operation->iv_required = 0;
Moran Peker41deec42018-04-04 15:43:05 +03004558
Moran Peker395db872018-05-31 14:07:14 +03004559 return( PSA_SUCCESS );
mohammad1603503973b2018-03-12 15:59:30 +02004560}
4561
Gilles Peskinea0655c32018-04-30 17:06:50 +02004562
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02004563
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02004564
mohammad16035955c982018-04-26 00:53:03 +03004565/****************************************************************/
4566/* AEAD */
4567/****************************************************************/
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02004568
Gilles Peskineedf9a652018-08-17 18:11:56 +02004569typedef struct
4570{
Gilles Peskine2f060a82018-12-04 17:12:32 +01004571 psa_key_slot_t *slot;
Gilles Peskineedf9a652018-08-17 18:11:56 +02004572 const mbedtls_cipher_info_t *cipher_info;
4573 union
4574 {
4575#if defined(MBEDTLS_CCM_C)
4576 mbedtls_ccm_context ccm;
4577#endif /* MBEDTLS_CCM_C */
4578#if defined(MBEDTLS_GCM_C)
4579 mbedtls_gcm_context gcm;
4580#endif /* MBEDTLS_GCM_C */
Gilles Peskine26869f22019-05-06 15:25:00 +02004581#if defined(MBEDTLS_CHACHAPOLY_C)
4582 mbedtls_chachapoly_context chachapoly;
4583#endif /* MBEDTLS_CHACHAPOLY_C */
Gilles Peskineedf9a652018-08-17 18:11:56 +02004584 } ctx;
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02004585 psa_algorithm_t core_alg;
4586 uint8_t full_tag_length;
Gilles Peskineedf9a652018-08-17 18:11:56 +02004587 uint8_t tag_length;
4588} aead_operation_t;
4589
Gilles Peskine30a9e412019-01-14 18:36:12 +01004590static void psa_aead_abort_internal( aead_operation_t *operation )
Gilles Peskineedf9a652018-08-17 18:11:56 +02004591{
Gilles Peskinef8a8fe62018-08-21 16:38:05 +02004592 switch( operation->core_alg )
Gilles Peskineedf9a652018-08-17 18:11:56 +02004593 {
4594#if defined(MBEDTLS_CCM_C)
4595 case PSA_ALG_CCM:
4596 mbedtls_ccm_free( &operation->ctx.ccm );
4597 break;
4598#endif /* MBEDTLS_CCM_C */
Gilles Peskineb0b189f2018-11-28 17:30:58 +01004599#if defined(MBEDTLS_GCM_C)
Gilles Peskineedf9a652018-08-17 18:11:56 +02004600 case PSA_ALG_GCM:
4601 mbedtls_gcm_free( &operation->ctx.gcm );
4602 break;
4603#endif /* MBEDTLS_GCM_C */
4604 }
4605}
4606
4607static psa_status_t psa_aead_setup( aead_operation_t *operation,
Gilles Peskinec5487a82018-12-03 18:08:14 +01004608 psa_key_handle_t handle,
Gilles Peskineedf9a652018-08-17 18:11:56 +02004609 psa_key_usage_t usage,
4610 psa_algorithm_t alg )
4611{
4612 psa_status_t status;
4613 size_t key_bits;
4614 mbedtls_cipher_id_t cipher_id;
4615
Gilles Peskine28f8f302019-07-24 13:30:31 +02004616 status = psa_get_transparent_key( handle, &operation->slot, usage, alg );
Gilles Peskineedf9a652018-08-17 18:11:56 +02004617 if( status != PSA_SUCCESS )
4618 return( status );
4619
Gilles Peskinedb4b3ab2019-04-18 12:53:01 +02004620 key_bits = psa_get_key_slot_bits( operation->slot );
Gilles Peskineedf9a652018-08-17 18:11:56 +02004621
4622 operation->cipher_info =
Gilles Peskine8e338702019-07-30 20:06:31 +02004623 mbedtls_cipher_info_from_psa( alg, operation->slot->attr.type, key_bits,
Gilles Peskineedf9a652018-08-17 18:11:56 +02004624 &cipher_id );
4625 if( operation->cipher_info == NULL )
4626 return( PSA_ERROR_NOT_SUPPORTED );
4627
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02004628 switch( PSA_ALG_AEAD_WITH_TAG_LENGTH( alg, 0 ) )
Gilles Peskineedf9a652018-08-17 18:11:56 +02004629 {
4630#if defined(MBEDTLS_CCM_C)
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02004631 case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_CCM, 0 ):
4632 operation->core_alg = PSA_ALG_CCM;
4633 operation->full_tag_length = 16;
Gilles Peskinef7e7b012019-05-06 15:27:16 +02004634 /* CCM allows the following tag lengths: 4, 6, 8, 10, 12, 14, 16.
4635 * The call to mbedtls_ccm_encrypt_and_tag or
4636 * mbedtls_ccm_auth_decrypt will validate the tag length. */
Gilles Peskine8e338702019-07-30 20:06:31 +02004637 if( PSA_BLOCK_CIPHER_BLOCK_SIZE( operation->slot->attr.type ) != 16 )
Gilles Peskineedf9a652018-08-17 18:11:56 +02004638 return( PSA_ERROR_INVALID_ARGUMENT );
4639 mbedtls_ccm_init( &operation->ctx.ccm );
4640 status = mbedtls_to_psa_error(
4641 mbedtls_ccm_setkey( &operation->ctx.ccm, cipher_id,
Steven Cooreman71fd80d2020-07-07 21:12:27 +02004642 operation->slot->data.key.data,
Gilles Peskineedf9a652018-08-17 18:11:56 +02004643 (unsigned int) key_bits ) );
4644 if( status != 0 )
4645 goto cleanup;
4646 break;
4647#endif /* MBEDTLS_CCM_C */
4648
4649#if defined(MBEDTLS_GCM_C)
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02004650 case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_GCM, 0 ):
4651 operation->core_alg = PSA_ALG_GCM;
4652 operation->full_tag_length = 16;
Gilles Peskinef7e7b012019-05-06 15:27:16 +02004653 /* GCM allows the following tag lengths: 4, 8, 12, 13, 14, 15, 16.
4654 * The call to mbedtls_gcm_crypt_and_tag or
4655 * mbedtls_gcm_auth_decrypt will validate the tag length. */
Gilles Peskine8e338702019-07-30 20:06:31 +02004656 if( PSA_BLOCK_CIPHER_BLOCK_SIZE( operation->slot->attr.type ) != 16 )
Gilles Peskineedf9a652018-08-17 18:11:56 +02004657 return( PSA_ERROR_INVALID_ARGUMENT );
4658 mbedtls_gcm_init( &operation->ctx.gcm );
4659 status = mbedtls_to_psa_error(
4660 mbedtls_gcm_setkey( &operation->ctx.gcm, cipher_id,
Steven Cooreman71fd80d2020-07-07 21:12:27 +02004661 operation->slot->data.key.data,
Gilles Peskineedf9a652018-08-17 18:11:56 +02004662 (unsigned int) key_bits ) );
Gilles Peskinef7e7b012019-05-06 15:27:16 +02004663 if( status != 0 )
4664 goto cleanup;
Gilles Peskineedf9a652018-08-17 18:11:56 +02004665 break;
4666#endif /* MBEDTLS_GCM_C */
4667
Gilles Peskine26869f22019-05-06 15:25:00 +02004668#if defined(MBEDTLS_CHACHAPOLY_C)
4669 case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_CHACHA20_POLY1305, 0 ):
4670 operation->core_alg = PSA_ALG_CHACHA20_POLY1305;
4671 operation->full_tag_length = 16;
4672 /* We only support the default tag length. */
4673 if( alg != PSA_ALG_CHACHA20_POLY1305 )
4674 return( PSA_ERROR_NOT_SUPPORTED );
4675 mbedtls_chachapoly_init( &operation->ctx.chachapoly );
4676 status = mbedtls_to_psa_error(
4677 mbedtls_chachapoly_setkey( &operation->ctx.chachapoly,
Steven Cooreman71fd80d2020-07-07 21:12:27 +02004678 operation->slot->data.key.data ) );
Gilles Peskine26869f22019-05-06 15:25:00 +02004679 if( status != 0 )
4680 goto cleanup;
4681 break;
4682#endif /* MBEDTLS_CHACHAPOLY_C */
4683
Gilles Peskineedf9a652018-08-17 18:11:56 +02004684 default:
4685 return( PSA_ERROR_NOT_SUPPORTED );
4686 }
4687
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02004688 if( PSA_AEAD_TAG_LENGTH( alg ) > operation->full_tag_length )
4689 {
4690 status = PSA_ERROR_INVALID_ARGUMENT;
4691 goto cleanup;
4692 }
4693 operation->tag_length = PSA_AEAD_TAG_LENGTH( alg );
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02004694
Gilles Peskineedf9a652018-08-17 18:11:56 +02004695 return( PSA_SUCCESS );
4696
4697cleanup:
Gilles Peskine30a9e412019-01-14 18:36:12 +01004698 psa_aead_abort_internal( operation );
Gilles Peskineedf9a652018-08-17 18:11:56 +02004699 return( status );
4700}
4701
Gilles Peskinec5487a82018-12-03 18:08:14 +01004702psa_status_t psa_aead_encrypt( psa_key_handle_t handle,
mohammad16035955c982018-04-26 00:53:03 +03004703 psa_algorithm_t alg,
4704 const uint8_t *nonce,
4705 size_t nonce_length,
4706 const uint8_t *additional_data,
4707 size_t additional_data_length,
4708 const uint8_t *plaintext,
4709 size_t plaintext_length,
4710 uint8_t *ciphertext,
4711 size_t ciphertext_size,
4712 size_t *ciphertext_length )
4713{
mohammad16035955c982018-04-26 00:53:03 +03004714 psa_status_t status;
Gilles Peskineedf9a652018-08-17 18:11:56 +02004715 aead_operation_t operation;
mohammad160315223a82018-06-03 17:19:55 +03004716 uint8_t *tag;
Gilles Peskine2d277862018-06-18 15:41:12 +02004717
mohammad1603f08a5502018-06-03 15:05:47 +03004718 *ciphertext_length = 0;
mohammad1603e58e6842018-05-09 04:58:32 -07004719
Gilles Peskinec5487a82018-12-03 18:08:14 +01004720 status = psa_aead_setup( &operation, handle, PSA_KEY_USAGE_ENCRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02004721 if( status != PSA_SUCCESS )
4722 return( status );
mohammad16035955c982018-04-26 00:53:03 +03004723
Gilles Peskineedf9a652018-08-17 18:11:56 +02004724 /* For all currently supported modes, the tag is at the end of the
4725 * ciphertext. */
4726 if( ciphertext_size < ( plaintext_length + operation.tag_length ) )
4727 {
4728 status = PSA_ERROR_BUFFER_TOO_SMALL;
4729 goto exit;
4730 }
4731 tag = ciphertext + plaintext_length;
mohammad16035955c982018-04-26 00:53:03 +03004732
Gilles Peskineb0b189f2018-11-28 17:30:58 +01004733#if defined(MBEDTLS_GCM_C)
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02004734 if( operation.core_alg == PSA_ALG_GCM )
mohammad16035955c982018-04-26 00:53:03 +03004735 {
Gilles Peskineedf9a652018-08-17 18:11:56 +02004736 status = mbedtls_to_psa_error(
4737 mbedtls_gcm_crypt_and_tag( &operation.ctx.gcm,
4738 MBEDTLS_GCM_ENCRYPT,
4739 plaintext_length,
4740 nonce, nonce_length,
4741 additional_data, additional_data_length,
4742 plaintext, ciphertext,
4743 operation.tag_length, tag ) );
mohammad16035955c982018-04-26 00:53:03 +03004744 }
Gilles Peskineb0b189f2018-11-28 17:30:58 +01004745 else
4746#endif /* MBEDTLS_GCM_C */
4747#if defined(MBEDTLS_CCM_C)
4748 if( operation.core_alg == PSA_ALG_CCM )
mohammad16035955c982018-04-26 00:53:03 +03004749 {
Gilles Peskineedf9a652018-08-17 18:11:56 +02004750 status = mbedtls_to_psa_error(
4751 mbedtls_ccm_encrypt_and_tag( &operation.ctx.ccm,
4752 plaintext_length,
4753 nonce, nonce_length,
4754 additional_data,
4755 additional_data_length,
4756 plaintext, ciphertext,
4757 tag, operation.tag_length ) );
mohammad16035955c982018-04-26 00:53:03 +03004758 }
mohammad16035c8845f2018-05-09 05:40:09 -07004759 else
Gilles Peskineb0b189f2018-11-28 17:30:58 +01004760#endif /* MBEDTLS_CCM_C */
Gilles Peskine26869f22019-05-06 15:25:00 +02004761#if defined(MBEDTLS_CHACHAPOLY_C)
4762 if( operation.core_alg == PSA_ALG_CHACHA20_POLY1305 )
4763 {
4764 if( nonce_length != 12 || operation.tag_length != 16 )
4765 {
4766 status = PSA_ERROR_NOT_SUPPORTED;
4767 goto exit;
4768 }
4769 status = mbedtls_to_psa_error(
4770 mbedtls_chachapoly_encrypt_and_tag( &operation.ctx.chachapoly,
4771 plaintext_length,
4772 nonce,
4773 additional_data,
4774 additional_data_length,
4775 plaintext,
4776 ciphertext,
4777 tag ) );
4778 }
4779 else
4780#endif /* MBEDTLS_CHACHAPOLY_C */
mohammad16035c8845f2018-05-09 05:40:09 -07004781 {
mohammad1603554faad2018-06-03 15:07:38 +03004782 return( PSA_ERROR_NOT_SUPPORTED );
mohammad16035c8845f2018-05-09 05:40:09 -07004783 }
Gilles Peskine2d277862018-06-18 15:41:12 +02004784
Gilles Peskineedf9a652018-08-17 18:11:56 +02004785 if( status != PSA_SUCCESS && ciphertext_size != 0 )
4786 memset( ciphertext, 0, ciphertext_size );
Gilles Peskine2d277862018-06-18 15:41:12 +02004787
Gilles Peskineedf9a652018-08-17 18:11:56 +02004788exit:
Gilles Peskine30a9e412019-01-14 18:36:12 +01004789 psa_aead_abort_internal( &operation );
Gilles Peskineedf9a652018-08-17 18:11:56 +02004790 if( status == PSA_SUCCESS )
4791 *ciphertext_length = plaintext_length + operation.tag_length;
4792 return( status );
mohammad16035955c982018-04-26 00:53:03 +03004793}
4794
Gilles Peskineee652a32018-06-01 19:23:52 +02004795/* Locate the tag in a ciphertext buffer containing the encrypted data
4796 * followed by the tag. Return the length of the part preceding the tag in
4797 * *plaintext_length. This is the size of the plaintext in modes where
4798 * the encrypted data has the same size as the plaintext, such as
4799 * CCM and GCM. */
4800static psa_status_t psa_aead_unpadded_locate_tag( size_t tag_length,
4801 const uint8_t *ciphertext,
4802 size_t ciphertext_length,
4803 size_t plaintext_size,
Gilles Peskineee652a32018-06-01 19:23:52 +02004804 const uint8_t **p_tag )
4805{
4806 size_t payload_length;
4807 if( tag_length > ciphertext_length )
4808 return( PSA_ERROR_INVALID_ARGUMENT );
4809 payload_length = ciphertext_length - tag_length;
4810 if( payload_length > plaintext_size )
4811 return( PSA_ERROR_BUFFER_TOO_SMALL );
4812 *p_tag = ciphertext + payload_length;
Gilles Peskineee652a32018-06-01 19:23:52 +02004813 return( PSA_SUCCESS );
4814}
4815
Gilles Peskinec5487a82018-12-03 18:08:14 +01004816psa_status_t psa_aead_decrypt( psa_key_handle_t handle,
mohammad16035955c982018-04-26 00:53:03 +03004817 psa_algorithm_t alg,
4818 const uint8_t *nonce,
4819 size_t nonce_length,
4820 const uint8_t *additional_data,
4821 size_t additional_data_length,
4822 const uint8_t *ciphertext,
4823 size_t ciphertext_length,
4824 uint8_t *plaintext,
4825 size_t plaintext_size,
4826 size_t *plaintext_length )
4827{
mohammad16035955c982018-04-26 00:53:03 +03004828 psa_status_t status;
Gilles Peskineedf9a652018-08-17 18:11:56 +02004829 aead_operation_t operation;
4830 const uint8_t *tag = NULL;
Gilles Peskine2d277862018-06-18 15:41:12 +02004831
Gilles Peskineee652a32018-06-01 19:23:52 +02004832 *plaintext_length = 0;
mohammad16039e5a5152018-04-26 12:07:35 +03004833
Gilles Peskinec5487a82018-12-03 18:08:14 +01004834 status = psa_aead_setup( &operation, handle, PSA_KEY_USAGE_DECRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02004835 if( status != PSA_SUCCESS )
4836 return( status );
mohammad16035955c982018-04-26 00:53:03 +03004837
Gilles Peskinef7e7b012019-05-06 15:27:16 +02004838 status = psa_aead_unpadded_locate_tag( operation.tag_length,
4839 ciphertext, ciphertext_length,
4840 plaintext_size, &tag );
4841 if( status != PSA_SUCCESS )
4842 goto exit;
4843
Gilles Peskineb0b189f2018-11-28 17:30:58 +01004844#if defined(MBEDTLS_GCM_C)
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02004845 if( operation.core_alg == PSA_ALG_GCM )
mohammad16035955c982018-04-26 00:53:03 +03004846 {
Gilles Peskineedf9a652018-08-17 18:11:56 +02004847 status = mbedtls_to_psa_error(
4848 mbedtls_gcm_auth_decrypt( &operation.ctx.gcm,
4849 ciphertext_length - operation.tag_length,
4850 nonce, nonce_length,
4851 additional_data,
4852 additional_data_length,
4853 tag, operation.tag_length,
4854 ciphertext, plaintext ) );
mohammad16035955c982018-04-26 00:53:03 +03004855 }
Gilles Peskineb0b189f2018-11-28 17:30:58 +01004856 else
4857#endif /* MBEDTLS_GCM_C */
4858#if defined(MBEDTLS_CCM_C)
4859 if( operation.core_alg == PSA_ALG_CCM )
mohammad16035955c982018-04-26 00:53:03 +03004860 {
Gilles Peskineedf9a652018-08-17 18:11:56 +02004861 status = mbedtls_to_psa_error(
4862 mbedtls_ccm_auth_decrypt( &operation.ctx.ccm,
4863 ciphertext_length - operation.tag_length,
4864 nonce, nonce_length,
4865 additional_data,
4866 additional_data_length,
4867 ciphertext, plaintext,
4868 tag, operation.tag_length ) );
mohammad16035955c982018-04-26 00:53:03 +03004869 }
mohammad160339574652018-06-01 04:39:53 -07004870 else
Gilles Peskineb0b189f2018-11-28 17:30:58 +01004871#endif /* MBEDTLS_CCM_C */
Gilles Peskine26869f22019-05-06 15:25:00 +02004872#if defined(MBEDTLS_CHACHAPOLY_C)
4873 if( operation.core_alg == PSA_ALG_CHACHA20_POLY1305 )
4874 {
4875 if( nonce_length != 12 || operation.tag_length != 16 )
4876 {
4877 status = PSA_ERROR_NOT_SUPPORTED;
4878 goto exit;
4879 }
4880 status = mbedtls_to_psa_error(
4881 mbedtls_chachapoly_auth_decrypt( &operation.ctx.chachapoly,
4882 ciphertext_length - operation.tag_length,
4883 nonce,
4884 additional_data,
4885 additional_data_length,
4886 tag,
4887 ciphertext,
4888 plaintext ) );
4889 }
4890 else
4891#endif /* MBEDTLS_CHACHAPOLY_C */
mohammad160339574652018-06-01 04:39:53 -07004892 {
mohammad1603554faad2018-06-03 15:07:38 +03004893 return( PSA_ERROR_NOT_SUPPORTED );
mohammad160339574652018-06-01 04:39:53 -07004894 }
Gilles Peskinea40d7742018-06-01 16:28:30 +02004895
Gilles Peskineedf9a652018-08-17 18:11:56 +02004896 if( status != PSA_SUCCESS && plaintext_size != 0 )
4897 memset( plaintext, 0, plaintext_size );
mohammad160360a64d02018-06-03 17:20:42 +03004898
Gilles Peskineedf9a652018-08-17 18:11:56 +02004899exit:
Gilles Peskine30a9e412019-01-14 18:36:12 +01004900 psa_aead_abort_internal( &operation );
Gilles Peskineedf9a652018-08-17 18:11:56 +02004901 if( status == PSA_SUCCESS )
4902 *plaintext_length = ciphertext_length - operation.tag_length;
4903 return( status );
mohammad16035955c982018-04-26 00:53:03 +03004904}
4905
Gilles Peskinea0655c32018-04-30 17:06:50 +02004906
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02004907
Gilles Peskine20035e32018-02-03 22:44:14 +01004908/****************************************************************/
Gilles Peskineeab56e42018-07-12 17:12:33 +02004909/* Generators */
4910/****************************************************************/
4911
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004912#define HKDF_STATE_INIT 0 /* no input yet */
4913#define HKDF_STATE_STARTED 1 /* got salt */
4914#define HKDF_STATE_KEYED 2 /* got key */
4915#define HKDF_STATE_OUTPUT 3 /* output started */
4916
Gilles Peskinecbe66502019-05-16 16:59:18 +02004917static psa_algorithm_t psa_key_derivation_get_kdf_alg(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004918 const psa_key_derivation_operation_t *operation )
Gilles Peskine969c5d62019-01-16 15:53:06 +01004919{
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004920 if ( PSA_ALG_IS_KEY_AGREEMENT( operation->alg ) )
4921 return( PSA_ALG_KEY_AGREEMENT_GET_KDF( operation->alg ) );
Gilles Peskine969c5d62019-01-16 15:53:06 +01004922 else
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004923 return( operation->alg );
Gilles Peskine969c5d62019-01-16 15:53:06 +01004924}
4925
4926
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004927psa_status_t psa_key_derivation_abort( psa_key_derivation_operation_t *operation )
Gilles Peskineeab56e42018-07-12 17:12:33 +02004928{
4929 psa_status_t status = PSA_SUCCESS;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004930 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg( operation );
Gilles Peskine969c5d62019-01-16 15:53:06 +01004931 if( kdf_alg == 0 )
Gilles Peskineeab56e42018-07-12 17:12:33 +02004932 {
4933 /* The object has (apparently) been initialized but it is not
4934 * in use. It's ok to call abort on such an object, and there's
4935 * nothing to do. */
4936 }
4937 else
Gilles Peskinebef7f142018-07-12 17:22:21 +02004938#if defined(MBEDTLS_MD_C)
Gilles Peskine969c5d62019-01-16 15:53:06 +01004939 if( PSA_ALG_IS_HKDF( kdf_alg ) )
Gilles Peskinebef7f142018-07-12 17:22:21 +02004940 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004941 mbedtls_free( operation->ctx.hkdf.info );
4942 status = psa_hmac_abort_internal( &operation->ctx.hkdf.hmac );
Gilles Peskinebef7f142018-07-12 17:22:21 +02004943 }
Gilles Peskine969c5d62019-01-16 15:53:06 +01004944 else if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004945 /* TLS-1.2 PSK-to-MS KDF uses the same core as TLS-1.2 PRF */
Gilles Peskine969c5d62019-01-16 15:53:06 +01004946 PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Hanno Beckerc8a41d72018-10-09 17:33:01 +01004947 {
Janos Follath6a1d2622019-06-11 10:37:28 +01004948 if( operation->ctx.tls12_prf.seed != NULL )
4949 {
4950 mbedtls_platform_zeroize( operation->ctx.tls12_prf.seed,
4951 operation->ctx.tls12_prf.seed_length );
4952 mbedtls_free( operation->ctx.tls12_prf.seed );
4953 }
4954
4955 if( operation->ctx.tls12_prf.label != NULL )
4956 {
4957 mbedtls_platform_zeroize( operation->ctx.tls12_prf.label,
4958 operation->ctx.tls12_prf.label_length );
4959 mbedtls_free( operation->ctx.tls12_prf.label );
4960 }
4961
4962 status = psa_hmac_abort_internal( &operation->ctx.tls12_prf.hmac );
4963
4964 /* We leave the fields Ai and output_block to be erased safely by the
4965 * mbedtls_platform_zeroize() in the end of this function. */
Hanno Beckerc8a41d72018-10-09 17:33:01 +01004966 }
Gilles Peskinebef7f142018-07-12 17:22:21 +02004967 else
4968#endif /* MBEDTLS_MD_C */
Gilles Peskineeab56e42018-07-12 17:12:33 +02004969 {
4970 status = PSA_ERROR_BAD_STATE;
4971 }
Janos Follath083036a2019-06-11 10:22:26 +01004972 mbedtls_platform_zeroize( operation, sizeof( *operation ) );
Gilles Peskineeab56e42018-07-12 17:12:33 +02004973 return( status );
4974}
4975
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004976psa_status_t psa_key_derivation_get_capacity(const psa_key_derivation_operation_t *operation,
Gilles Peskineeab56e42018-07-12 17:12:33 +02004977 size_t *capacity)
4978{
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004979 if( operation->alg == 0 )
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004980 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004981 /* This is a blank key derivation operation. */
Steven Cooreman29149862020-08-05 15:43:42 +02004982 return( PSA_ERROR_BAD_STATE );
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004983 }
4984
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004985 *capacity = operation->capacity;
Gilles Peskineeab56e42018-07-12 17:12:33 +02004986 return( PSA_SUCCESS );
4987}
4988
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004989psa_status_t psa_key_derivation_set_capacity( psa_key_derivation_operation_t *operation,
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004990 size_t capacity )
4991{
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004992 if( operation->alg == 0 )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004993 return( PSA_ERROR_BAD_STATE );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004994 if( capacity > operation->capacity )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004995 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004996 operation->capacity = capacity;
Gilles Peskineeab56e42018-07-12 17:12:33 +02004997 return( PSA_SUCCESS );
4998}
4999
Gilles Peskinebef7f142018-07-12 17:22:21 +02005000#if defined(MBEDTLS_MD_C)
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005001/* Read some bytes from an HKDF-based operation. This performs a chunk
Gilles Peskinebef7f142018-07-12 17:22:21 +02005002 * of the expand phase of the HKDF algorithm. */
Gilles Peskinecbe66502019-05-16 16:59:18 +02005003static psa_status_t psa_key_derivation_hkdf_read( psa_hkdf_key_derivation_t *hkdf,
Gilles Peskinebef7f142018-07-12 17:22:21 +02005004 psa_algorithm_t hash_alg,
5005 uint8_t *output,
5006 size_t output_length )
5007{
5008 uint8_t hash_length = PSA_HASH_SIZE( hash_alg );
5009 psa_status_t status;
5010
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005011 if( hkdf->state < HKDF_STATE_KEYED || ! hkdf->info_set )
5012 return( PSA_ERROR_BAD_STATE );
5013 hkdf->state = HKDF_STATE_OUTPUT;
5014
Gilles Peskinebef7f142018-07-12 17:22:21 +02005015 while( output_length != 0 )
5016 {
5017 /* Copy what remains of the current block */
5018 uint8_t n = hash_length - hkdf->offset_in_block;
5019 if( n > output_length )
5020 n = (uint8_t) output_length;
5021 memcpy( output, hkdf->output_block + hkdf->offset_in_block, n );
5022 output += n;
5023 output_length -= n;
5024 hkdf->offset_in_block += n;
Gilles Peskined54931c2018-07-17 21:06:59 +02005025 if( output_length == 0 )
Gilles Peskinebef7f142018-07-12 17:22:21 +02005026 break;
Gilles Peskined54931c2018-07-17 21:06:59 +02005027 /* We can't be wanting more output after block 0xff, otherwise
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02005028 * the capacity check in psa_key_derivation_output_bytes() would have
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005029 * prevented this call. It could happen only if the operation
Gilles Peskined54931c2018-07-17 21:06:59 +02005030 * object was corrupted or if this function is called directly
5031 * inside the library. */
5032 if( hkdf->block_number == 0xff )
5033 return( PSA_ERROR_BAD_STATE );
Gilles Peskinebef7f142018-07-12 17:22:21 +02005034
5035 /* We need a new block */
5036 ++hkdf->block_number;
5037 hkdf->offset_in_block = 0;
5038 status = psa_hmac_setup_internal( &hkdf->hmac,
5039 hkdf->prk, hash_length,
5040 hash_alg );
5041 if( status != PSA_SUCCESS )
5042 return( status );
5043 if( hkdf->block_number != 1 )
5044 {
5045 status = psa_hash_update( &hkdf->hmac.hash_ctx,
5046 hkdf->output_block,
5047 hash_length );
5048 if( status != PSA_SUCCESS )
5049 return( status );
5050 }
5051 status = psa_hash_update( &hkdf->hmac.hash_ctx,
5052 hkdf->info,
5053 hkdf->info_length );
5054 if( status != PSA_SUCCESS )
5055 return( status );
5056 status = psa_hash_update( &hkdf->hmac.hash_ctx,
5057 &hkdf->block_number, 1 );
5058 if( status != PSA_SUCCESS )
5059 return( status );
5060 status = psa_hmac_finish_internal( &hkdf->hmac,
5061 hkdf->output_block,
5062 sizeof( hkdf->output_block ) );
5063 if( status != PSA_SUCCESS )
5064 return( status );
5065 }
5066
5067 return( PSA_SUCCESS );
5068}
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005069
Janos Follath7742fee2019-06-17 12:58:10 +01005070static psa_status_t psa_key_derivation_tls12_prf_generate_next_block(
5071 psa_tls12_prf_key_derivation_t *tls12_prf,
5072 psa_algorithm_t alg )
5073{
5074 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( alg );
5075 uint8_t hash_length = PSA_HASH_SIZE( hash_alg );
Janos Follathea29bfb2019-06-19 12:21:20 +01005076 psa_hash_operation_t backup = PSA_HASH_OPERATION_INIT;
5077 psa_status_t status, cleanup_status;
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005078
Janos Follath7742fee2019-06-17 12:58:10 +01005079 /* We can't be wanting more output after block 0xff, otherwise
5080 * the capacity check in psa_key_derivation_output_bytes() would have
5081 * prevented this call. It could happen only if the operation
5082 * object was corrupted or if this function is called directly
5083 * inside the library. */
5084 if( tls12_prf->block_number == 0xff )
Janos Follath30090bc2019-06-25 10:15:04 +01005085 return( PSA_ERROR_CORRUPTION_DETECTED );
Janos Follath7742fee2019-06-17 12:58:10 +01005086
5087 /* We need a new block */
5088 ++tls12_prf->block_number;
Janos Follath844eb0e2019-06-19 12:10:49 +01005089 tls12_prf->left_in_block = hash_length;
Janos Follath7742fee2019-06-17 12:58:10 +01005090
5091 /* Recall the definition of the TLS-1.2-PRF from RFC 5246:
5092 *
5093 * PRF(secret, label, seed) = P_<hash>(secret, label + seed)
5094 *
5095 * P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
5096 * HMAC_hash(secret, A(2) + seed) +
5097 * HMAC_hash(secret, A(3) + seed) + ...
5098 *
5099 * A(0) = seed
Janos Follathea29bfb2019-06-19 12:21:20 +01005100 * A(i) = HMAC_hash(secret, A(i-1))
Janos Follath7742fee2019-06-17 12:58:10 +01005101 *
Janos Follathea29bfb2019-06-19 12:21:20 +01005102 * The `psa_tls12_prf_key_derivation` structure saves the block
Janos Follath7742fee2019-06-17 12:58:10 +01005103 * `HMAC_hash(secret, A(i) + seed)` from which the output
Janos Follath76c39842019-06-26 12:50:36 +01005104 * is currently extracted as `output_block` and where i is
5105 * `block_number`.
Janos Follath7742fee2019-06-17 12:58:10 +01005106 */
5107
Janos Follathea29bfb2019-06-19 12:21:20 +01005108 /* Save the hash context before using it, to preserve the hash state with
5109 * only the inner padding in it. We need this, because inner padding depends
5110 * on the key (secret in the RFC's terminology). */
5111 status = psa_hash_clone( &tls12_prf->hmac.hash_ctx, &backup );
5112 if( status != PSA_SUCCESS )
5113 goto cleanup;
5114
5115 /* Calculate A(i) where i = tls12_prf->block_number. */
5116 if( tls12_prf->block_number == 1 )
5117 {
5118 /* A(1) = HMAC_hash(secret, A(0)), where A(0) = seed. (The RFC overloads
5119 * the variable seed and in this instance means it in the context of the
5120 * P_hash function, where seed = label + seed.) */
5121 status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
5122 tls12_prf->label, tls12_prf->label_length );
5123 if( status != PSA_SUCCESS )
5124 goto cleanup;
5125 status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
5126 tls12_prf->seed, tls12_prf->seed_length );
5127 if( status != PSA_SUCCESS )
5128 goto cleanup;
5129 }
5130 else
5131 {
5132 /* A(i) = HMAC_hash(secret, A(i-1)) */
5133 status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
5134 tls12_prf->Ai, hash_length );
5135 if( status != PSA_SUCCESS )
5136 goto cleanup;
5137 }
5138
5139 status = psa_hmac_finish_internal( &tls12_prf->hmac,
5140 tls12_prf->Ai, hash_length );
5141 if( status != PSA_SUCCESS )
5142 goto cleanup;
5143 status = psa_hash_clone( &backup, &tls12_prf->hmac.hash_ctx );
5144 if( status != PSA_SUCCESS )
5145 goto cleanup;
5146
5147 /* Calculate HMAC_hash(secret, A(i) + label + seed). */
5148 status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
5149 tls12_prf->Ai, hash_length );
5150 if( status != PSA_SUCCESS )
5151 goto cleanup;
5152 status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
5153 tls12_prf->label, tls12_prf->label_length );
5154 if( status != PSA_SUCCESS )
5155 goto cleanup;
5156 status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
5157 tls12_prf->seed, tls12_prf->seed_length );
5158 if( status != PSA_SUCCESS )
5159 goto cleanup;
5160 status = psa_hmac_finish_internal( &tls12_prf->hmac,
5161 tls12_prf->output_block, hash_length );
5162 if( status != PSA_SUCCESS )
5163 goto cleanup;
5164 status = psa_hash_clone( &backup, &tls12_prf->hmac.hash_ctx );
5165 if( status != PSA_SUCCESS )
5166 goto cleanup;
5167
Janos Follath7742fee2019-06-17 12:58:10 +01005168
5169cleanup:
5170
Janos Follathea29bfb2019-06-19 12:21:20 +01005171 cleanup_status = psa_hash_abort( &backup );
5172 if( status == PSA_SUCCESS && cleanup_status != PSA_SUCCESS )
5173 status = cleanup_status;
5174
5175 return( status );
Janos Follath7742fee2019-06-17 12:58:10 +01005176}
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005177
Janos Follath844eb0e2019-06-19 12:10:49 +01005178static psa_status_t psa_key_derivation_tls12_prf_read(
5179 psa_tls12_prf_key_derivation_t *tls12_prf,
5180 psa_algorithm_t alg,
5181 uint8_t *output,
5182 size_t output_length )
5183{
5184 psa_algorithm_t hash_alg = PSA_ALG_TLS12_PRF_GET_HASH( alg );
5185 uint8_t hash_length = PSA_HASH_SIZE( hash_alg );
5186 psa_status_t status;
5187 uint8_t offset, length;
5188
5189 while( output_length != 0 )
5190 {
5191 /* Check if we have fully processed the current block. */
5192 if( tls12_prf->left_in_block == 0 )
5193 {
5194 status = psa_key_derivation_tls12_prf_generate_next_block( tls12_prf,
5195 alg );
5196 if( status != PSA_SUCCESS )
5197 return( status );
5198
5199 continue;
5200 }
5201
5202 if( tls12_prf->left_in_block > output_length )
5203 length = (uint8_t) output_length;
5204 else
5205 length = tls12_prf->left_in_block;
5206
5207 offset = hash_length - tls12_prf->left_in_block;
5208 memcpy( output, tls12_prf->output_block + offset, length );
5209 output += length;
5210 output_length -= length;
5211 tls12_prf->left_in_block -= length;
5212 }
5213
5214 return( PSA_SUCCESS );
5215}
Gilles Peskinebef7f142018-07-12 17:22:21 +02005216#endif /* MBEDTLS_MD_C */
5217
Janos Follath6c6c8fc2019-06-17 12:38:20 +01005218psa_status_t psa_key_derivation_output_bytes(
5219 psa_key_derivation_operation_t *operation,
5220 uint8_t *output,
5221 size_t output_length )
Gilles Peskineeab56e42018-07-12 17:12:33 +02005222{
5223 psa_status_t status;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005224 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg( operation );
Gilles Peskineeab56e42018-07-12 17:12:33 +02005225
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005226 if( operation->alg == 0 )
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005227 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005228 /* This is a blank operation. */
Steven Cooreman29149862020-08-05 15:43:42 +02005229 return( PSA_ERROR_BAD_STATE );
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005230 }
5231
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005232 if( output_length > operation->capacity )
Gilles Peskineeab56e42018-07-12 17:12:33 +02005233 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005234 operation->capacity = 0;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005235 /* Go through the error path to wipe all confidential data now
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005236 * that the operation object is useless. */
David Saadab4ecc272019-02-14 13:48:10 +02005237 status = PSA_ERROR_INSUFFICIENT_DATA;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005238 goto exit;
5239 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005240 if( output_length == 0 && operation->capacity == 0 )
Gilles Peskineeab56e42018-07-12 17:12:33 +02005241 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005242 /* Edge case: this is a finished operation, and 0 bytes
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005243 * were requested. The right error in this case could
Gilles Peskineeab56e42018-07-12 17:12:33 +02005244 * be either INSUFFICIENT_CAPACITY or BAD_STATE. Return
5245 * INSUFFICIENT_CAPACITY, which is right for a finished
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005246 * operation, for consistency with the case when
Gilles Peskineeab56e42018-07-12 17:12:33 +02005247 * output_length > 0. */
David Saadab4ecc272019-02-14 13:48:10 +02005248 return( PSA_ERROR_INSUFFICIENT_DATA );
Gilles Peskineeab56e42018-07-12 17:12:33 +02005249 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005250 operation->capacity -= output_length;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005251
Gilles Peskinebef7f142018-07-12 17:22:21 +02005252#if defined(MBEDTLS_MD_C)
Gilles Peskine969c5d62019-01-16 15:53:06 +01005253 if( PSA_ALG_IS_HKDF( kdf_alg ) )
Gilles Peskinebef7f142018-07-12 17:22:21 +02005254 {
Gilles Peskine969c5d62019-01-16 15:53:06 +01005255 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( kdf_alg );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005256 status = psa_key_derivation_hkdf_read( &operation->ctx.hkdf, hash_alg,
Gilles Peskinebef7f142018-07-12 17:22:21 +02005257 output, output_length );
5258 }
Janos Follathadbec812019-06-14 11:05:39 +01005259 else
Janos Follathadbec812019-06-14 11:05:39 +01005260 if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
Gilles Peskine969c5d62019-01-16 15:53:06 +01005261 PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005262 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005263 status = psa_key_derivation_tls12_prf_read( &operation->ctx.tls12_prf,
Gilles Peskine969c5d62019-01-16 15:53:06 +01005264 kdf_alg, output,
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005265 output_length );
5266 }
Gilles Peskinebef7f142018-07-12 17:22:21 +02005267 else
5268#endif /* MBEDTLS_MD_C */
Gilles Peskineeab56e42018-07-12 17:12:33 +02005269 {
5270 return( PSA_ERROR_BAD_STATE );
5271 }
5272
5273exit:
5274 if( status != PSA_SUCCESS )
5275 {
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005276 /* Preserve the algorithm upon errors, but clear all sensitive state.
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005277 * This allows us to differentiate between exhausted operations and
5278 * blank operations, so we can return PSA_ERROR_BAD_STATE on blank
5279 * operations. */
5280 psa_algorithm_t alg = operation->alg;
5281 psa_key_derivation_abort( operation );
5282 operation->alg = alg;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005283 memset( output, '!', output_length );
5284 }
5285 return( status );
5286}
5287
Gilles Peskine08542d82018-07-19 17:05:42 +02005288#if defined(MBEDTLS_DES_C)
5289static void psa_des_set_key_parity( uint8_t *data, size_t data_size )
5290{
5291 if( data_size >= 8 )
5292 mbedtls_des_key_set_parity( data );
5293 if( data_size >= 16 )
5294 mbedtls_des_key_set_parity( data + 8 );
5295 if( data_size >= 24 )
5296 mbedtls_des_key_set_parity( data + 16 );
5297}
5298#endif /* MBEDTLS_DES_C */
5299
Adrian L. Shaw5a5a79a2019-05-03 15:44:28 +01005300static psa_status_t psa_generate_derived_key_internal(
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005301 psa_key_slot_t *slot,
5302 size_t bits,
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005303 psa_key_derivation_operation_t *operation )
Gilles Peskineeab56e42018-07-12 17:12:33 +02005304{
5305 uint8_t *data = NULL;
5306 size_t bytes = PSA_BITS_TO_BYTES( bits );
5307 psa_status_t status;
5308
Gilles Peskine8e338702019-07-30 20:06:31 +02005309 if( ! key_type_is_raw_bytes( slot->attr.type ) )
Gilles Peskineeab56e42018-07-12 17:12:33 +02005310 return( PSA_ERROR_INVALID_ARGUMENT );
5311 if( bits % 8 != 0 )
5312 return( PSA_ERROR_INVALID_ARGUMENT );
5313 data = mbedtls_calloc( 1, bytes );
5314 if( data == NULL )
5315 return( PSA_ERROR_INSUFFICIENT_MEMORY );
5316
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005317 status = psa_key_derivation_output_bytes( operation, data, bytes );
Gilles Peskineeab56e42018-07-12 17:12:33 +02005318 if( status != PSA_SUCCESS )
5319 goto exit;
Gilles Peskine08542d82018-07-19 17:05:42 +02005320#if defined(MBEDTLS_DES_C)
Gilles Peskine8e338702019-07-30 20:06:31 +02005321 if( slot->attr.type == PSA_KEY_TYPE_DES )
Gilles Peskine08542d82018-07-19 17:05:42 +02005322 psa_des_set_key_parity( data, bytes );
5323#endif /* MBEDTLS_DES_C */
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005324 status = psa_import_key_into_slot( slot, data, bytes );
Gilles Peskineeab56e42018-07-12 17:12:33 +02005325
5326exit:
5327 mbedtls_free( data );
5328 return( status );
5329}
5330
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02005331psa_status_t psa_key_derivation_output_key( const psa_key_attributes_t *attributes,
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005332 psa_key_derivation_operation_t *operation,
Gilles Peskine98dd7792019-05-15 19:43:49 +02005333 psa_key_handle_t *handle )
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005334{
5335 psa_status_t status;
5336 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02005337 psa_se_drv_table_entry_t *driver = NULL;
Gilles Peskine0f84d622019-09-12 19:03:13 +02005338
5339 /* Reject any attempt to create a zero-length key so that we don't
5340 * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
5341 if( psa_get_key_bits( attributes ) == 0 )
5342 return( PSA_ERROR_INVALID_ARGUMENT );
5343
Gilles Peskine178c9aa2019-09-24 18:21:06 +02005344 if( ! operation->can_output_key )
5345 return( PSA_ERROR_NOT_PERMITTED );
5346
Gilles Peskinedf179142019-07-15 22:02:14 +02005347 status = psa_start_key_creation( PSA_KEY_CREATION_DERIVE,
5348 attributes, handle, &slot, &driver );
Gilles Peskinef4ee6622019-07-24 13:44:30 +02005349#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
5350 if( driver != NULL )
5351 {
5352 /* Deriving a key in a secure element is not implemented yet. */
5353 status = PSA_ERROR_NOT_SUPPORTED;
5354 }
5355#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005356 if( status == PSA_SUCCESS )
5357 {
Adrian L. Shaw5a5a79a2019-05-03 15:44:28 +01005358 status = psa_generate_derived_key_internal( slot,
Gilles Peskine7e0cff92019-07-30 13:48:52 +02005359 attributes->core.bits,
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005360 operation );
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005361 }
5362 if( status == PSA_SUCCESS )
Gilles Peskine011e4282019-06-26 18:34:38 +02005363 status = psa_finish_key_creation( slot, driver );
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005364 if( status != PSA_SUCCESS )
5365 {
Gilles Peskine011e4282019-06-26 18:34:38 +02005366 psa_fail_key_creation( slot, driver );
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005367 *handle = 0;
5368 }
5369 return( status );
5370}
5371
Gilles Peskineeab56e42018-07-12 17:12:33 +02005372
5373
5374/****************************************************************/
Gilles Peskineea0fb492018-07-12 17:17:20 +02005375/* Key derivation */
5376/****************************************************************/
5377
Gilles Peskine969c5d62019-01-16 15:53:06 +01005378static psa_status_t psa_key_derivation_setup_kdf(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005379 psa_key_derivation_operation_t *operation,
Gilles Peskine969c5d62019-01-16 15:53:06 +01005380 psa_algorithm_t kdf_alg )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005381{
Janos Follath5fe19732019-06-20 15:09:30 +01005382 /* Make sure that operation->ctx is properly zero-initialised. (Macro
5383 * initialisers for this union leave some bytes unspecified.) */
5384 memset( &operation->ctx, 0, sizeof( operation->ctx ) );
5385
Gilles Peskine969c5d62019-01-16 15:53:06 +01005386 /* Make sure that kdf_alg is a supported key derivation algorithm. */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005387#if defined(MBEDTLS_MD_C)
Gilles Peskine969c5d62019-01-16 15:53:06 +01005388 if( PSA_ALG_IS_HKDF( kdf_alg ) ||
5389 PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
5390 PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005391 {
Gilles Peskine969c5d62019-01-16 15:53:06 +01005392 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( kdf_alg );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005393 size_t hash_size = PSA_HASH_SIZE( hash_alg );
5394 if( hash_size == 0 )
5395 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine969c5d62019-01-16 15:53:06 +01005396 if( ( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
5397 PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) ) &&
Gilles Peskineab4b2012019-04-12 15:06:27 +02005398 ! ( hash_alg == PSA_ALG_SHA_256 || hash_alg == PSA_ALG_SHA_384 ) )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005399 {
5400 return( PSA_ERROR_NOT_SUPPORTED );
5401 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005402 operation->capacity = 255 * hash_size;
Gilles Peskine969c5d62019-01-16 15:53:06 +01005403 return( PSA_SUCCESS );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005404 }
5405#endif /* MBEDTLS_MD_C */
Gilles Peskine969c5d62019-01-16 15:53:06 +01005406 else
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005407 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine969c5d62019-01-16 15:53:06 +01005408}
5409
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005410psa_status_t psa_key_derivation_setup( psa_key_derivation_operation_t *operation,
Gilles Peskine969c5d62019-01-16 15:53:06 +01005411 psa_algorithm_t alg )
5412{
5413 psa_status_t status;
5414
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005415 if( operation->alg != 0 )
Gilles Peskine969c5d62019-01-16 15:53:06 +01005416 return( PSA_ERROR_BAD_STATE );
5417
Gilles Peskine6843c292019-01-18 16:44:49 +01005418 if( PSA_ALG_IS_RAW_KEY_AGREEMENT( alg ) )
5419 return( PSA_ERROR_INVALID_ARGUMENT );
5420 else if( PSA_ALG_IS_KEY_AGREEMENT( alg ) )
Gilles Peskine969c5d62019-01-16 15:53:06 +01005421 {
5422 psa_algorithm_t kdf_alg = PSA_ALG_KEY_AGREEMENT_GET_KDF( alg );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005423 status = psa_key_derivation_setup_kdf( operation, kdf_alg );
Gilles Peskine969c5d62019-01-16 15:53:06 +01005424 }
5425 else if( PSA_ALG_IS_KEY_DERIVATION( alg ) )
5426 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005427 status = psa_key_derivation_setup_kdf( operation, alg );
Gilles Peskine969c5d62019-01-16 15:53:06 +01005428 }
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005429 else
5430 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine969c5d62019-01-16 15:53:06 +01005431
5432 if( status == PSA_SUCCESS )
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005433 operation->alg = alg;
Gilles Peskine969c5d62019-01-16 15:53:06 +01005434 return( status );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005435}
5436
5437#if defined(MBEDTLS_MD_C)
Gilles Peskinecbe66502019-05-16 16:59:18 +02005438static psa_status_t psa_hkdf_input( psa_hkdf_key_derivation_t *hkdf,
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005439 psa_algorithm_t hash_alg,
5440 psa_key_derivation_step_t step,
5441 const uint8_t *data,
5442 size_t data_length )
5443{
5444 psa_status_t status;
5445 switch( step )
5446 {
Gilles Peskine03410b52019-05-16 16:05:19 +02005447 case PSA_KEY_DERIVATION_INPUT_SALT:
Gilles Peskine2b522db2019-04-12 15:11:49 +02005448 if( hkdf->state != HKDF_STATE_INIT )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005449 return( PSA_ERROR_BAD_STATE );
Gilles Peskine2b522db2019-04-12 15:11:49 +02005450 status = psa_hmac_setup_internal( &hkdf->hmac,
5451 data, data_length,
5452 hash_alg );
5453 if( status != PSA_SUCCESS )
5454 return( status );
5455 hkdf->state = HKDF_STATE_STARTED;
5456 return( PSA_SUCCESS );
Gilles Peskine03410b52019-05-16 16:05:19 +02005457 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005458 /* If no salt was provided, use an empty salt. */
5459 if( hkdf->state == HKDF_STATE_INIT )
5460 {
5461 status = psa_hmac_setup_internal( &hkdf->hmac,
5462 NULL, 0,
Gilles Peskinef9ee6332019-04-11 21:22:52 +02005463 hash_alg );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005464 if( status != PSA_SUCCESS )
5465 return( status );
5466 hkdf->state = HKDF_STATE_STARTED;
5467 }
Gilles Peskine2b522db2019-04-12 15:11:49 +02005468 if( hkdf->state != HKDF_STATE_STARTED )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005469 return( PSA_ERROR_BAD_STATE );
Gilles Peskine2b522db2019-04-12 15:11:49 +02005470 status = psa_hash_update( &hkdf->hmac.hash_ctx,
5471 data, data_length );
5472 if( status != PSA_SUCCESS )
5473 return( status );
5474 status = psa_hmac_finish_internal( &hkdf->hmac,
5475 hkdf->prk,
5476 sizeof( hkdf->prk ) );
5477 if( status != PSA_SUCCESS )
5478 return( status );
5479 hkdf->offset_in_block = PSA_HASH_SIZE( hash_alg );
5480 hkdf->block_number = 0;
5481 hkdf->state = HKDF_STATE_KEYED;
5482 return( PSA_SUCCESS );
Gilles Peskine03410b52019-05-16 16:05:19 +02005483 case PSA_KEY_DERIVATION_INPUT_INFO:
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005484 if( hkdf->state == HKDF_STATE_OUTPUT )
5485 return( PSA_ERROR_BAD_STATE );
5486 if( hkdf->info_set )
5487 return( PSA_ERROR_BAD_STATE );
5488 hkdf->info_length = data_length;
5489 if( data_length != 0 )
5490 {
5491 hkdf->info = mbedtls_calloc( 1, data_length );
5492 if( hkdf->info == NULL )
5493 return( PSA_ERROR_INSUFFICIENT_MEMORY );
5494 memcpy( hkdf->info, data, data_length );
5495 }
5496 hkdf->info_set = 1;
5497 return( PSA_SUCCESS );
5498 default:
5499 return( PSA_ERROR_INVALID_ARGUMENT );
5500 }
5501}
Janos Follathb03233e2019-06-11 15:30:30 +01005502
Janos Follathf08e2652019-06-13 09:05:41 +01005503static psa_status_t psa_tls12_prf_set_seed( psa_tls12_prf_key_derivation_t *prf,
5504 const uint8_t *data,
5505 size_t data_length )
5506{
5507 if( prf->state != TLS12_PRF_STATE_INIT )
5508 return( PSA_ERROR_BAD_STATE );
5509
Janos Follathd6dce9f2019-07-04 09:11:38 +01005510 if( data_length != 0 )
5511 {
5512 prf->seed = mbedtls_calloc( 1, data_length );
5513 if( prf->seed == NULL )
5514 return( PSA_ERROR_INSUFFICIENT_MEMORY );
Janos Follathf08e2652019-06-13 09:05:41 +01005515
Janos Follathd6dce9f2019-07-04 09:11:38 +01005516 memcpy( prf->seed, data, data_length );
5517 prf->seed_length = data_length;
5518 }
Janos Follathf08e2652019-06-13 09:05:41 +01005519
5520 prf->state = TLS12_PRF_STATE_SEED_SET;
5521
5522 return( PSA_SUCCESS );
5523}
5524
Janos Follath81550542019-06-13 14:26:34 +01005525static psa_status_t psa_tls12_prf_set_key( psa_tls12_prf_key_derivation_t *prf,
5526 psa_algorithm_t hash_alg,
5527 const uint8_t *data,
5528 size_t data_length )
5529{
5530 psa_status_t status;
5531 if( prf->state != TLS12_PRF_STATE_SEED_SET )
5532 return( PSA_ERROR_BAD_STATE );
5533
5534 status = psa_hmac_setup_internal( &prf->hmac, data, data_length, hash_alg );
5535 if( status != PSA_SUCCESS )
5536 return( status );
5537
5538 prf->state = TLS12_PRF_STATE_KEY_SET;
5539
5540 return( PSA_SUCCESS );
5541}
5542
Janos Follath6660f0e2019-06-17 08:44:03 +01005543static psa_status_t psa_tls12_prf_psk_to_ms_set_key(
5544 psa_tls12_prf_key_derivation_t *prf,
5545 psa_algorithm_t hash_alg,
5546 const uint8_t *data,
5547 size_t data_length )
5548{
5549 psa_status_t status;
Gilles Peskinec11c4dc2019-07-15 11:06:38 +02005550 uint8_t pms[ 4 + 2 * PSA_ALG_TLS12_PSK_TO_MS_MAX_PSK_LEN ];
5551 uint8_t *cur = pms;
Janos Follath6660f0e2019-06-17 08:44:03 +01005552
5553 if( data_length > PSA_ALG_TLS12_PSK_TO_MS_MAX_PSK_LEN )
5554 return( PSA_ERROR_INVALID_ARGUMENT );
5555
5556 /* Quoting RFC 4279, Section 2:
5557 *
5558 * The premaster secret is formed as follows: if the PSK is N octets
5559 * long, concatenate a uint16 with the value N, N zero octets, a second
5560 * uint16 with the value N, and the PSK itself.
5561 */
5562
Janos Follath40e13932019-06-26 13:22:29 +01005563 *cur++ = ( data_length >> 8 ) & 0xff;
5564 *cur++ = ( data_length >> 0 ) & 0xff;
5565 memset( cur, 0, data_length );
5566 cur += data_length;
5567 *cur++ = pms[0];
5568 *cur++ = pms[1];
5569 memcpy( cur, data, data_length );
5570 cur += data_length;
Janos Follath6660f0e2019-06-17 08:44:03 +01005571
Janos Follath40e13932019-06-26 13:22:29 +01005572 status = psa_tls12_prf_set_key( prf, hash_alg, pms, cur - pms );
Janos Follath6660f0e2019-06-17 08:44:03 +01005573
5574 mbedtls_platform_zeroize( pms, sizeof( pms ) );
5575 return( status );
5576}
5577
Janos Follath63028dd2019-06-13 09:15:47 +01005578static psa_status_t psa_tls12_prf_set_label( psa_tls12_prf_key_derivation_t *prf,
5579 const uint8_t *data,
5580 size_t data_length )
5581{
5582 if( prf->state != TLS12_PRF_STATE_KEY_SET )
5583 return( PSA_ERROR_BAD_STATE );
5584
Janos Follathd6dce9f2019-07-04 09:11:38 +01005585 if( data_length != 0 )
5586 {
5587 prf->label = mbedtls_calloc( 1, data_length );
5588 if( prf->label == NULL )
5589 return( PSA_ERROR_INSUFFICIENT_MEMORY );
Janos Follath63028dd2019-06-13 09:15:47 +01005590
Janos Follathd6dce9f2019-07-04 09:11:38 +01005591 memcpy( prf->label, data, data_length );
5592 prf->label_length = data_length;
5593 }
Janos Follath63028dd2019-06-13 09:15:47 +01005594
5595 prf->state = TLS12_PRF_STATE_LABEL_SET;
5596
5597 return( PSA_SUCCESS );
5598}
5599
Janos Follathb03233e2019-06-11 15:30:30 +01005600static psa_status_t psa_tls12_prf_input( psa_tls12_prf_key_derivation_t *prf,
5601 psa_algorithm_t hash_alg,
5602 psa_key_derivation_step_t step,
5603 const uint8_t *data,
5604 size_t data_length )
5605{
Janos Follathb03233e2019-06-11 15:30:30 +01005606 switch( step )
5607 {
Janos Follathf08e2652019-06-13 09:05:41 +01005608 case PSA_KEY_DERIVATION_INPUT_SEED:
5609 return( psa_tls12_prf_set_seed( prf, data, data_length ) );
Janos Follath81550542019-06-13 14:26:34 +01005610 case PSA_KEY_DERIVATION_INPUT_SECRET:
5611 return( psa_tls12_prf_set_key( prf, hash_alg, data, data_length ) );
Janos Follath63028dd2019-06-13 09:15:47 +01005612 case PSA_KEY_DERIVATION_INPUT_LABEL:
5613 return( psa_tls12_prf_set_label( prf, data, data_length ) );
Janos Follathb03233e2019-06-11 15:30:30 +01005614 default:
5615 return( PSA_ERROR_INVALID_ARGUMENT );
5616 }
5617}
Janos Follath6660f0e2019-06-17 08:44:03 +01005618
5619static psa_status_t psa_tls12_prf_psk_to_ms_input(
5620 psa_tls12_prf_key_derivation_t *prf,
5621 psa_algorithm_t hash_alg,
5622 psa_key_derivation_step_t step,
5623 const uint8_t *data,
5624 size_t data_length )
5625{
5626 if( step == PSA_KEY_DERIVATION_INPUT_SECRET )
Janos Follath0c1ed842019-06-28 13:35:36 +01005627 {
Janos Follath6660f0e2019-06-17 08:44:03 +01005628 return( psa_tls12_prf_psk_to_ms_set_key( prf, hash_alg,
5629 data, data_length ) );
Janos Follath0c1ed842019-06-28 13:35:36 +01005630 }
Janos Follath6660f0e2019-06-17 08:44:03 +01005631
5632 return( psa_tls12_prf_input( prf, hash_alg, step, data, data_length ) );
5633}
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005634#endif /* MBEDTLS_MD_C */
5635
Gilles Peskineb8965192019-09-24 16:21:10 +02005636/** Check whether the given key type is acceptable for the given
5637 * input step of a key derivation.
5638 *
5639 * Secret inputs must have the type #PSA_KEY_TYPE_DERIVE.
5640 * Non-secret inputs must have the type #PSA_KEY_TYPE_RAW_DATA.
5641 * Both secret and non-secret inputs can alternatively have the type
5642 * #PSA_KEY_TYPE_NONE, which is never the type of a key object, meaning
5643 * that the input was passed as a buffer rather than via a key object.
5644 */
Gilles Peskine224b0d62019-09-23 18:13:17 +02005645static int psa_key_derivation_check_input_type(
5646 psa_key_derivation_step_t step,
5647 psa_key_type_t key_type )
5648{
5649 switch( step )
5650 {
5651 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskineb8965192019-09-24 16:21:10 +02005652 if( key_type == PSA_KEY_TYPE_DERIVE )
5653 return( PSA_SUCCESS );
5654 if( key_type == PSA_KEY_TYPE_NONE )
Gilles Peskine224b0d62019-09-23 18:13:17 +02005655 return( PSA_SUCCESS );
5656 break;
5657 case PSA_KEY_DERIVATION_INPUT_LABEL:
5658 case PSA_KEY_DERIVATION_INPUT_SALT:
5659 case PSA_KEY_DERIVATION_INPUT_INFO:
5660 case PSA_KEY_DERIVATION_INPUT_SEED:
Gilles Peskineb8965192019-09-24 16:21:10 +02005661 if( key_type == PSA_KEY_TYPE_RAW_DATA )
5662 return( PSA_SUCCESS );
5663 if( key_type == PSA_KEY_TYPE_NONE )
Gilles Peskine224b0d62019-09-23 18:13:17 +02005664 return( PSA_SUCCESS );
5665 break;
5666 }
5667 return( PSA_ERROR_INVALID_ARGUMENT );
5668}
5669
Janos Follathb80a94e2019-06-12 15:54:46 +01005670static psa_status_t psa_key_derivation_input_internal(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005671 psa_key_derivation_operation_t *operation,
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01005672 psa_key_derivation_step_t step,
Gilles Peskine224b0d62019-09-23 18:13:17 +02005673 psa_key_type_t key_type,
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01005674 const uint8_t *data,
5675 size_t data_length )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005676{
Gilles Peskine46d7faf2019-09-23 19:22:55 +02005677 psa_status_t status;
5678 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg( operation );
5679
5680 status = psa_key_derivation_check_input_type( step, key_type );
Gilles Peskine224b0d62019-09-23 18:13:17 +02005681 if( status != PSA_SUCCESS )
5682 goto exit;
5683
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005684#if defined(MBEDTLS_MD_C)
Gilles Peskine969c5d62019-01-16 15:53:06 +01005685 if( PSA_ALG_IS_HKDF( kdf_alg ) )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005686 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005687 status = psa_hkdf_input( &operation->ctx.hkdf,
Gilles Peskine969c5d62019-01-16 15:53:06 +01005688 PSA_ALG_HKDF_GET_HASH( kdf_alg ),
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005689 step, data, data_length );
5690 }
k-stachowiak012dcc42019-08-13 14:55:03 +02005691 else if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005692 {
Janos Follathb03233e2019-06-11 15:30:30 +01005693 status = psa_tls12_prf_input( &operation->ctx.tls12_prf,
5694 PSA_ALG_HKDF_GET_HASH( kdf_alg ),
5695 step, data, data_length );
Janos Follath6660f0e2019-06-17 08:44:03 +01005696 }
5697 else if( PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
5698 {
5699 status = psa_tls12_prf_psk_to_ms_input( &operation->ctx.tls12_prf,
5700 PSA_ALG_HKDF_GET_HASH( kdf_alg ),
5701 step, data, data_length );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005702 }
5703 else
5704#endif /* MBEDTLS_MD_C */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005705 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005706 /* This can't happen unless the operation object was not initialized */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005707 return( PSA_ERROR_BAD_STATE );
5708 }
5709
Gilles Peskine224b0d62019-09-23 18:13:17 +02005710exit:
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005711 if( status != PSA_SUCCESS )
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005712 psa_key_derivation_abort( operation );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005713 return( status );
5714}
5715
Janos Follath51f4a0f2019-06-14 11:35:55 +01005716psa_status_t psa_key_derivation_input_bytes(
5717 psa_key_derivation_operation_t *operation,
5718 psa_key_derivation_step_t step,
5719 const uint8_t *data,
5720 size_t data_length )
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01005721{
Gilles Peskineb8965192019-09-24 16:21:10 +02005722 return( psa_key_derivation_input_internal( operation, step,
5723 PSA_KEY_TYPE_NONE,
Janos Follathc5621512019-06-14 11:27:57 +01005724 data, data_length ) );
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01005725}
5726
Janos Follath51f4a0f2019-06-14 11:35:55 +01005727psa_status_t psa_key_derivation_input_key(
5728 psa_key_derivation_operation_t *operation,
5729 psa_key_derivation_step_t step,
5730 psa_key_handle_t handle )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005731{
5732 psa_key_slot_t *slot;
5733 psa_status_t status;
Gilles Peskine178c9aa2019-09-24 18:21:06 +02005734
Gilles Peskine28f8f302019-07-24 13:30:31 +02005735 status = psa_get_transparent_key( handle, &slot,
Gilles Peskinef77a6ac2019-07-25 10:51:03 +02005736 PSA_KEY_USAGE_DERIVE,
5737 operation->alg );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005738 if( status != PSA_SUCCESS )
Gilles Peskine593773d2019-09-23 18:17:40 +02005739 {
5740 psa_key_derivation_abort( operation );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005741 return( status );
Gilles Peskine593773d2019-09-23 18:17:40 +02005742 }
Gilles Peskine178c9aa2019-09-24 18:21:06 +02005743
5744 /* Passing a key object as a SECRET input unlocks the permission
5745 * to output to a key object. */
5746 if( step == PSA_KEY_DERIVATION_INPUT_SECRET )
5747 operation->can_output_key = 1;
5748
Janos Follathb80a94e2019-06-12 15:54:46 +01005749 return( psa_key_derivation_input_internal( operation,
Gilles Peskine224b0d62019-09-23 18:13:17 +02005750 step, slot->attr.type,
Steven Cooreman71fd80d2020-07-07 21:12:27 +02005751 slot->data.key.data,
5752 slot->data.key.bytes ) );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005753}
Gilles Peskineea0fb492018-07-12 17:17:20 +02005754
5755
5756
5757/****************************************************************/
Gilles Peskine01d718c2018-09-18 12:01:02 +02005758/* Key agreement */
5759/****************************************************************/
5760
Gilles Peskinea05219c2018-11-16 16:02:56 +01005761#if defined(MBEDTLS_ECDH_C)
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005762static psa_status_t psa_key_agreement_ecdh( const uint8_t *peer_key,
5763 size_t peer_key_length,
5764 const mbedtls_ecp_keypair *our_key,
5765 uint8_t *shared_secret,
5766 size_t shared_secret_size,
5767 size_t *shared_secret_length )
5768{
Steven Cooremand4867872020-08-05 16:31:39 +02005769 mbedtls_ecp_keypair *their_key = NULL;
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005770 mbedtls_ecdh_context ecdh;
Jaeden Amero97271b32019-01-10 19:38:51 +00005771 psa_status_t status;
Gilles Peskinec7ef5b32019-12-12 16:58:00 +01005772 size_t bits = 0;
Paul Elliott8ff510a2020-06-02 17:19:28 +01005773 psa_ecc_family_t curve = mbedtls_ecc_group_to_psa( our_key->grp.id, &bits );
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005774 mbedtls_ecdh_init( &ecdh );
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005775
Steven Cooreman4fed4552020-08-03 14:46:03 +02005776 status = psa_load_ecp_representation( PSA_KEY_TYPE_ECC_PUBLIC_KEY(curve),
5777 peer_key,
Steven Cooreman7f391872020-07-30 14:57:44 +02005778 peer_key_length,
Steven Cooreman7f391872020-07-30 14:57:44 +02005779 &their_key );
Jaeden Amero97271b32019-01-10 19:38:51 +00005780 if( status != PSA_SUCCESS )
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005781 goto exit;
5782
Jaeden Amero97271b32019-01-10 19:38:51 +00005783 status = mbedtls_to_psa_error(
Steven Cooremana2371e52020-07-28 14:30:39 +02005784 mbedtls_ecdh_get_params( &ecdh, their_key, MBEDTLS_ECDH_THEIRS ) );
Jaeden Amero97271b32019-01-10 19:38:51 +00005785 if( status != PSA_SUCCESS )
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005786 goto exit;
Jaeden Amero97271b32019-01-10 19:38:51 +00005787 status = mbedtls_to_psa_error(
5788 mbedtls_ecdh_get_params( &ecdh, our_key, MBEDTLS_ECDH_OURS ) );
5789 if( status != PSA_SUCCESS )
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005790 goto exit;
5791
Jaeden Amero97271b32019-01-10 19:38:51 +00005792 status = mbedtls_to_psa_error(
5793 mbedtls_ecdh_calc_secret( &ecdh,
5794 shared_secret_length,
5795 shared_secret, shared_secret_size,
5796 mbedtls_ctr_drbg_random,
5797 &global_data.ctr_drbg ) );
Gilles Peskinec7ef5b32019-12-12 16:58:00 +01005798 if( status != PSA_SUCCESS )
5799 goto exit;
5800 if( PSA_BITS_TO_BYTES( bits ) != *shared_secret_length )
5801 status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005802
5803exit:
Gilles Peskine3e819b72019-12-20 14:09:55 +01005804 if( status != PSA_SUCCESS )
5805 mbedtls_platform_zeroize( shared_secret, shared_secret_size );
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005806 mbedtls_ecdh_free( &ecdh );
Steven Cooremana2371e52020-07-28 14:30:39 +02005807 mbedtls_ecp_keypair_free( their_key );
Steven Cooreman6d839f02020-07-30 11:36:45 +02005808 mbedtls_free( their_key );
Steven Cooremana2371e52020-07-28 14:30:39 +02005809
Jaeden Amero97271b32019-01-10 19:38:51 +00005810 return( status );
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005811}
Gilles Peskinea05219c2018-11-16 16:02:56 +01005812#endif /* MBEDTLS_ECDH_C */
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005813
Gilles Peskine01d718c2018-09-18 12:01:02 +02005814#define PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE MBEDTLS_ECP_MAX_BYTES
5815
Gilles Peskine0216fe12019-04-11 21:23:21 +02005816static psa_status_t psa_key_agreement_raw_internal( psa_algorithm_t alg,
5817 psa_key_slot_t *private_key,
5818 const uint8_t *peer_key,
5819 size_t peer_key_length,
5820 uint8_t *shared_secret,
5821 size_t shared_secret_size,
5822 size_t *shared_secret_length )
Gilles Peskine01d718c2018-09-18 12:01:02 +02005823{
Gilles Peskine0216fe12019-04-11 21:23:21 +02005824 switch( alg )
Gilles Peskine01d718c2018-09-18 12:01:02 +02005825 {
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005826#if defined(MBEDTLS_ECDH_C)
Gilles Peskine0216fe12019-04-11 21:23:21 +02005827 case PSA_ALG_ECDH:
Gilles Peskine8e338702019-07-30 20:06:31 +02005828 if( ! PSA_KEY_TYPE_IS_ECC_KEY_PAIR( private_key->attr.type ) )
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005829 return( PSA_ERROR_INVALID_ARGUMENT );
Steven Cooremana2371e52020-07-28 14:30:39 +02005830 mbedtls_ecp_keypair *ecp = NULL;
Steven Cooreman7f391872020-07-30 14:57:44 +02005831 psa_status_t status = psa_load_ecp_representation(
Steven Cooreman4fed4552020-08-03 14:46:03 +02005832 private_key->attr.type,
Steven Cooreman7f391872020-07-30 14:57:44 +02005833 private_key->data.key.data,
5834 private_key->data.key.bytes,
Steven Cooreman7f391872020-07-30 14:57:44 +02005835 &ecp );
Steven Cooremanacda8342020-07-24 23:09:52 +02005836 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02005837 return( status );
Steven Cooremanacda8342020-07-24 23:09:52 +02005838 status = psa_key_agreement_ecdh( peer_key, peer_key_length,
Steven Cooremana2371e52020-07-28 14:30:39 +02005839 ecp,
Steven Cooremanacda8342020-07-24 23:09:52 +02005840 shared_secret, shared_secret_size,
5841 shared_secret_length );
Steven Cooremana2371e52020-07-28 14:30:39 +02005842 mbedtls_ecp_keypair_free( ecp );
5843 mbedtls_free( ecp );
Steven Cooreman29149862020-08-05 15:43:42 +02005844 return( status );
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005845#endif /* MBEDTLS_ECDH_C */
Gilles Peskine01d718c2018-09-18 12:01:02 +02005846 default:
Gilles Peskine93f85002018-11-16 16:43:31 +01005847 (void) private_key;
5848 (void) peer_key;
5849 (void) peer_key_length;
Gilles Peskine0216fe12019-04-11 21:23:21 +02005850 (void) shared_secret;
5851 (void) shared_secret_size;
5852 (void) shared_secret_length;
Gilles Peskine01d718c2018-09-18 12:01:02 +02005853 return( PSA_ERROR_NOT_SUPPORTED );
5854 }
Gilles Peskine0216fe12019-04-11 21:23:21 +02005855}
5856
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02005857/* Note that if this function fails, you must call psa_key_derivation_abort()
Gilles Peskine01d718c2018-09-18 12:01:02 +02005858 * to potentially free embedded data structures and wipe confidential data.
5859 */
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005860static psa_status_t psa_key_agreement_internal( psa_key_derivation_operation_t *operation,
Gilles Peskine969c5d62019-01-16 15:53:06 +01005861 psa_key_derivation_step_t step,
Gilles Peskine01d718c2018-09-18 12:01:02 +02005862 psa_key_slot_t *private_key,
5863 const uint8_t *peer_key,
Gilles Peskine969c5d62019-01-16 15:53:06 +01005864 size_t peer_key_length )
Gilles Peskine01d718c2018-09-18 12:01:02 +02005865{
5866 psa_status_t status;
5867 uint8_t shared_secret[PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE];
5868 size_t shared_secret_length = 0;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005869 psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE( operation->alg );
Gilles Peskine01d718c2018-09-18 12:01:02 +02005870
5871 /* Step 1: run the secret agreement algorithm to generate the shared
5872 * secret. */
Gilles Peskine0216fe12019-04-11 21:23:21 +02005873 status = psa_key_agreement_raw_internal( ka_alg,
5874 private_key,
5875 peer_key, peer_key_length,
itayzafrir0adf0fc2018-09-06 16:24:41 +03005876 shared_secret,
5877 sizeof( shared_secret ),
Gilles Peskine05d69892018-06-19 22:00:52 +02005878 &shared_secret_length );
Gilles Peskine53d991e2018-07-12 01:14:59 +02005879 if( status != PSA_SUCCESS )
Gilles Peskine12313cd2018-06-20 00:20:32 +02005880 goto exit;
5881
Gilles Peskineb0b255c2018-07-06 17:01:38 +02005882 /* Step 2: set up the key derivation to generate key material from
Gilles Peskine224b0d62019-09-23 18:13:17 +02005883 * the shared secret. A shared secret is permitted wherever a key
5884 * of type DERIVE is permitted. */
Janos Follathb80a94e2019-06-12 15:54:46 +01005885 status = psa_key_derivation_input_internal( operation, step,
Gilles Peskine224b0d62019-09-23 18:13:17 +02005886 PSA_KEY_TYPE_DERIVE,
Janos Follathb80a94e2019-06-12 15:54:46 +01005887 shared_secret,
5888 shared_secret_length );
Gilles Peskine969c5d62019-01-16 15:53:06 +01005889
Gilles Peskine12313cd2018-06-20 00:20:32 +02005890exit:
Gilles Peskine3f108122018-12-07 18:14:53 +01005891 mbedtls_platform_zeroize( shared_secret, shared_secret_length );
Gilles Peskine12313cd2018-06-20 00:20:32 +02005892 return( status );
5893}
5894
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005895psa_status_t psa_key_derivation_key_agreement( psa_key_derivation_operation_t *operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02005896 psa_key_derivation_step_t step,
5897 psa_key_handle_t private_key,
5898 const uint8_t *peer_key,
5899 size_t peer_key_length )
Gilles Peskine12313cd2018-06-20 00:20:32 +02005900{
Gilles Peskine2f060a82018-12-04 17:12:32 +01005901 psa_key_slot_t *slot;
Gilles Peskine08542d82018-07-19 17:05:42 +02005902 psa_status_t status;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005903 if( ! PSA_ALG_IS_KEY_AGREEMENT( operation->alg ) )
Gilles Peskine12313cd2018-06-20 00:20:32 +02005904 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine28f8f302019-07-24 13:30:31 +02005905 status = psa_get_transparent_key( private_key, &slot,
Gilles Peskinef77a6ac2019-07-25 10:51:03 +02005906 PSA_KEY_USAGE_DERIVE, operation->alg );
Gilles Peskine12313cd2018-06-20 00:20:32 +02005907 if( status != PSA_SUCCESS )
5908 return( status );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005909 status = psa_key_agreement_internal( operation, step,
Gilles Peskine346797d2018-11-16 16:05:06 +01005910 slot,
Gilles Peskine969c5d62019-01-16 15:53:06 +01005911 peer_key, peer_key_length );
Gilles Peskine346797d2018-11-16 16:05:06 +01005912 if( status != PSA_SUCCESS )
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005913 psa_key_derivation_abort( operation );
Gilles Peskine346797d2018-11-16 16:05:06 +01005914 return( status );
Gilles Peskineaf3baab2018-06-27 22:55:52 +02005915}
5916
Gilles Peskinebe697d82019-05-16 18:00:41 +02005917psa_status_t psa_raw_key_agreement( psa_algorithm_t alg,
5918 psa_key_handle_t private_key,
5919 const uint8_t *peer_key,
5920 size_t peer_key_length,
5921 uint8_t *output,
5922 size_t output_size,
5923 size_t *output_length )
Gilles Peskine0216fe12019-04-11 21:23:21 +02005924{
5925 psa_key_slot_t *slot;
5926 psa_status_t status;
5927
5928 if( ! PSA_ALG_IS_KEY_AGREEMENT( alg ) )
5929 {
5930 status = PSA_ERROR_INVALID_ARGUMENT;
5931 goto exit;
5932 }
Gilles Peskine28f8f302019-07-24 13:30:31 +02005933 status = psa_get_transparent_key( private_key, &slot,
Gilles Peskinef77a6ac2019-07-25 10:51:03 +02005934 PSA_KEY_USAGE_DERIVE, alg );
Gilles Peskine0216fe12019-04-11 21:23:21 +02005935 if( status != PSA_SUCCESS )
5936 goto exit;
5937
5938 status = psa_key_agreement_raw_internal( alg, slot,
5939 peer_key, peer_key_length,
5940 output, output_size,
5941 output_length );
5942
5943exit:
5944 if( status != PSA_SUCCESS )
5945 {
5946 /* If an error happens and is not handled properly, the output
5947 * may be used as a key to protect sensitive data. Arrange for such
5948 * a key to be random, which is likely to result in decryption or
5949 * verification errors. This is better than filling the buffer with
5950 * some constant data such as zeros, which would result in the data
5951 * being protected with a reproducible, easily knowable key.
5952 */
5953 psa_generate_random( output, output_size );
5954 *output_length = output_size;
5955 }
5956 return( status );
5957}
Gilles Peskine86a440b2018-11-12 18:39:40 +01005958
5959
5960/****************************************************************/
5961/* Random generation */
Gilles Peskine53d991e2018-07-12 01:14:59 +02005962/****************************************************************/
Gilles Peskine12313cd2018-06-20 00:20:32 +02005963
Gilles Peskine4c317f42018-07-12 01:24:09 +02005964psa_status_t psa_generate_random( uint8_t *output,
Gilles Peskine53d991e2018-07-12 01:14:59 +02005965 size_t output_size )
Gilles Peskine12313cd2018-06-20 00:20:32 +02005966{
Janos Follath24eed8d2019-11-22 13:21:35 +00005967 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskinee59236f2018-01-27 23:32:46 +01005968 GUARD_MODULE_INITIALIZED;
5969
Gilles Peskinef181eca2019-08-07 13:49:00 +02005970 while( output_size > MBEDTLS_CTR_DRBG_MAX_REQUEST )
5971 {
5972 ret = mbedtls_ctr_drbg_random( &global_data.ctr_drbg,
5973 output,
5974 MBEDTLS_CTR_DRBG_MAX_REQUEST );
5975 if( ret != 0 )
5976 return( mbedtls_to_psa_error( ret ) );
5977 output += MBEDTLS_CTR_DRBG_MAX_REQUEST;
5978 output_size -= MBEDTLS_CTR_DRBG_MAX_REQUEST;
5979 }
5980
Gilles Peskinee59236f2018-01-27 23:32:46 +01005981 ret = mbedtls_ctr_drbg_random( &global_data.ctr_drbg, output, output_size );
5982 return( mbedtls_to_psa_error( ret ) );
5983}
5984
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01005985#if defined(MBEDTLS_PSA_INJECT_ENTROPY)
5986#include "mbedtls/entropy_poll.h"
5987
Gilles Peskine7228da22019-07-15 11:06:15 +02005988psa_status_t mbedtls_psa_inject_entropy( const uint8_t *seed,
Netanel Gonen2bcd3122018-11-19 11:53:02 +02005989 size_t seed_size )
5990{
Netanel Gonen2bcd3122018-11-19 11:53:02 +02005991 if( global_data.initialized )
5992 return( PSA_ERROR_NOT_PERMITTED );
Netanel Gonen21f37cb2018-11-19 11:53:55 +02005993
5994 if( ( ( seed_size < MBEDTLS_ENTROPY_MIN_PLATFORM ) ||
5995 ( seed_size < MBEDTLS_ENTROPY_BLOCK_SIZE ) ) ||
5996 ( seed_size > MBEDTLS_ENTROPY_MAX_SEED_SIZE ) )
5997 return( PSA_ERROR_INVALID_ARGUMENT );
5998
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01005999 return( mbedtls_psa_storage_inject_entropy( seed, seed_size ) );
Netanel Gonen2bcd3122018-11-19 11:53:02 +02006000}
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01006001#endif /* MBEDTLS_PSA_INJECT_ENTROPY */
Netanel Gonen2bcd3122018-11-19 11:53:02 +02006002
Gilles Peskinee56e8782019-04-26 17:34:02 +02006003#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_GENPRIME)
6004static psa_status_t psa_read_rsa_exponent( const uint8_t *domain_parameters,
6005 size_t domain_parameters_size,
6006 int *exponent )
Gilles Peskinee59236f2018-01-27 23:32:46 +01006007{
Gilles Peskinee56e8782019-04-26 17:34:02 +02006008 size_t i;
6009 uint32_t acc = 0;
Gilles Peskinee59236f2018-01-27 23:32:46 +01006010
Gilles Peskinee56e8782019-04-26 17:34:02 +02006011 if( domain_parameters_size == 0 )
6012 {
6013 *exponent = 65537;
6014 return( PSA_SUCCESS );
6015 }
6016
6017 /* Mbed TLS encodes the public exponent as an int. For simplicity, only
6018 * support values that fit in a 32-bit integer, which is larger than
6019 * int on just about every platform anyway. */
6020 if( domain_parameters_size > sizeof( acc ) )
6021 return( PSA_ERROR_NOT_SUPPORTED );
6022 for( i = 0; i < domain_parameters_size; i++ )
6023 acc = ( acc << 8 ) | domain_parameters[i];
6024 if( acc > INT_MAX )
6025 return( PSA_ERROR_NOT_SUPPORTED );
6026 *exponent = acc;
6027 return( PSA_SUCCESS );
6028}
6029#endif /* MBEDTLS_RSA_C && MBEDTLS_GENPRIME */
6030
Gilles Peskine35ef36b2019-05-16 19:42:05 +02006031static psa_status_t psa_generate_key_internal(
Gilles Peskinee56e8782019-04-26 17:34:02 +02006032 psa_key_slot_t *slot, size_t bits,
6033 const uint8_t *domain_parameters, size_t domain_parameters_size )
Gilles Peskinee59236f2018-01-27 23:32:46 +01006034{
Gilles Peskine8e338702019-07-30 20:06:31 +02006035 psa_key_type_t type = slot->attr.type;
Gilles Peskinee59236f2018-01-27 23:32:46 +01006036
Gilles Peskinee56e8782019-04-26 17:34:02 +02006037 if( domain_parameters == NULL && domain_parameters_size != 0 )
Gilles Peskinee59236f2018-01-27 23:32:46 +01006038 return( PSA_ERROR_INVALID_ARGUMENT );
6039
Gilles Peskinee59236f2018-01-27 23:32:46 +01006040 if( key_type_is_raw_bytes( type ) )
6041 {
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006042 psa_status_t status;
Steven Cooreman81be2fa2020-07-24 22:04:59 +02006043
6044 status = validate_unstructured_key_bit_size( slot->attr.type, bits );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006045 if( status != PSA_SUCCESS )
6046 return( status );
Steven Cooreman81be2fa2020-07-24 22:04:59 +02006047
6048 /* Allocate memory for the key */
Steven Cooreman75b74362020-07-28 14:30:13 +02006049 status = psa_allocate_buffer_to_slot( slot, PSA_BITS_TO_BYTES( bits ) );
6050 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02006051 return( status );
Steven Cooreman81be2fa2020-07-24 22:04:59 +02006052
Steven Cooreman71fd80d2020-07-07 21:12:27 +02006053 status = psa_generate_random( slot->data.key.data,
6054 slot->data.key.bytes );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006055 if( status != PSA_SUCCESS )
Gilles Peskinee59236f2018-01-27 23:32:46 +01006056 return( status );
Steven Cooreman81be2fa2020-07-24 22:04:59 +02006057
6058 slot->attr.bits = (psa_key_bits_t) bits;
Gilles Peskinee59236f2018-01-27 23:32:46 +01006059#if defined(MBEDTLS_DES_C)
6060 if( type == PSA_KEY_TYPE_DES )
Steven Cooreman71fd80d2020-07-07 21:12:27 +02006061 psa_des_set_key_parity( slot->data.key.data,
6062 slot->data.key.bytes );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006063#endif /* MBEDTLS_DES_C */
6064 }
6065 else
6066
6067#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_GENPRIME)
Gilles Peskinec93b80c2019-05-16 19:39:54 +02006068 if ( type == PSA_KEY_TYPE_RSA_KEY_PAIR )
Gilles Peskinee59236f2018-01-27 23:32:46 +01006069 {
Steven Cooremana01795d2020-07-24 22:48:15 +02006070 mbedtls_rsa_context rsa;
Janos Follath24eed8d2019-11-22 13:21:35 +00006071 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskinee56e8782019-04-26 17:34:02 +02006072 int exponent;
6073 psa_status_t status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01006074 if( bits > PSA_VENDOR_RSA_MAX_KEY_BITS )
6075 return( PSA_ERROR_NOT_SUPPORTED );
6076 /* Accept only byte-aligned keys, for the same reasons as
6077 * in psa_import_rsa_key(). */
6078 if( bits % 8 != 0 )
6079 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskinee56e8782019-04-26 17:34:02 +02006080 status = psa_read_rsa_exponent( domain_parameters,
6081 domain_parameters_size,
6082 &exponent );
6083 if( status != PSA_SUCCESS )
6084 return( status );
Steven Cooremana01795d2020-07-24 22:48:15 +02006085 mbedtls_rsa_init( &rsa, MBEDTLS_RSA_PKCS_V15, MBEDTLS_MD_NONE );
6086 ret = mbedtls_rsa_gen_key( &rsa,
Gilles Peskinee59236f2018-01-27 23:32:46 +01006087 mbedtls_ctr_drbg_random,
6088 &global_data.ctr_drbg,
6089 (unsigned int) bits,
6090 exponent );
6091 if( ret != 0 )
Gilles Peskinee59236f2018-01-27 23:32:46 +01006092 return( mbedtls_to_psa_error( ret ) );
Steven Cooremana01795d2020-07-24 22:48:15 +02006093
6094 /* Make sure to always have an export representation available */
6095 size_t bytes = PSA_KEY_EXPORT_RSA_KEY_PAIR_MAX_SIZE( bits );
6096
Steven Cooreman75b74362020-07-28 14:30:13 +02006097 status = psa_allocate_buffer_to_slot( slot, bytes );
6098 if( status != PSA_SUCCESS )
Steven Cooremana01795d2020-07-24 22:48:15 +02006099 {
6100 mbedtls_rsa_free( &rsa );
Steven Cooreman29149862020-08-05 15:43:42 +02006101 return( status );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006102 }
Steven Cooremana01795d2020-07-24 22:48:15 +02006103
6104 status = psa_export_rsa_key( type,
6105 &rsa,
6106 slot->data.key.data,
6107 bytes,
6108 &slot->data.key.bytes );
6109 mbedtls_rsa_free( &rsa );
6110 if( status != PSA_SUCCESS )
Steven Cooremana01795d2020-07-24 22:48:15 +02006111 psa_remove_key_data_from_memory( slot );
Steven Cooreman560c28a2020-07-24 23:20:24 +02006112 return( status );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006113 }
6114 else
6115#endif /* MBEDTLS_RSA_C && MBEDTLS_GENPRIME */
6116
6117#if defined(MBEDTLS_ECP_C)
Gilles Peskinec93b80c2019-05-16 19:39:54 +02006118 if ( PSA_KEY_TYPE_IS_ECC( type ) && PSA_KEY_TYPE_IS_KEY_PAIR( type ) )
Gilles Peskinee59236f2018-01-27 23:32:46 +01006119 {
Paul Elliott8ff510a2020-06-02 17:19:28 +01006120 psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY( type );
Gilles Peskine4295e8b2019-12-02 21:39:10 +01006121 mbedtls_ecp_group_id grp_id =
6122 mbedtls_ecc_group_of_psa( curve, PSA_BITS_TO_BYTES( bits ) );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006123 const mbedtls_ecp_curve_info *curve_info =
6124 mbedtls_ecp_curve_info_from_grp_id( grp_id );
Steven Cooremanacda8342020-07-24 23:09:52 +02006125 mbedtls_ecp_keypair ecp;
Janos Follath24eed8d2019-11-22 13:21:35 +00006126 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskinee56e8782019-04-26 17:34:02 +02006127 if( domain_parameters_size != 0 )
Gilles Peskinee59236f2018-01-27 23:32:46 +01006128 return( PSA_ERROR_NOT_SUPPORTED );
6129 if( grp_id == MBEDTLS_ECP_DP_NONE || curve_info == NULL )
6130 return( PSA_ERROR_NOT_SUPPORTED );
6131 if( curve_info->bit_size != bits )
6132 return( PSA_ERROR_INVALID_ARGUMENT );
Steven Cooremanacda8342020-07-24 23:09:52 +02006133 mbedtls_ecp_keypair_init( &ecp );
6134 ret = mbedtls_ecp_gen_key( grp_id, &ecp,
Gilles Peskinee59236f2018-01-27 23:32:46 +01006135 mbedtls_ctr_drbg_random,
6136 &global_data.ctr_drbg );
6137 if( ret != 0 )
6138 {
Steven Cooremanacda8342020-07-24 23:09:52 +02006139 mbedtls_ecp_keypair_free( &ecp );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006140 return( mbedtls_to_psa_error( ret ) );
6141 }
Steven Cooremanacda8342020-07-24 23:09:52 +02006142
6143
6144 /* Make sure to always have an export representation available */
6145 size_t bytes = PSA_BITS_TO_BYTES( bits );
Steven Cooreman75b74362020-07-28 14:30:13 +02006146 psa_status_t status = psa_allocate_buffer_to_slot( slot, bytes );
6147 if( status != PSA_SUCCESS )
Steven Cooremanacda8342020-07-24 23:09:52 +02006148 {
6149 mbedtls_ecp_keypair_free( &ecp );
Steven Cooreman29149862020-08-05 15:43:42 +02006150 return( status );
Steven Cooremanacda8342020-07-24 23:09:52 +02006151 }
Steven Cooreman75b74362020-07-28 14:30:13 +02006152
6153 status = mbedtls_to_psa_error(
Steven Cooremanacda8342020-07-24 23:09:52 +02006154 mbedtls_ecp_write_key( &ecp, slot->data.key.data, bytes ) );
6155
6156 mbedtls_ecp_keypair_free( &ecp );
Steven Cooremanb7f6dea2020-08-05 16:07:20 +02006157 if( status != PSA_SUCCESS ) {
6158 memset( slot->data.key.data, 0, bytes );
Steven Cooremanacda8342020-07-24 23:09:52 +02006159 psa_remove_key_data_from_memory( slot );
Steven Cooremanb7f6dea2020-08-05 16:07:20 +02006160 }
Steven Cooreman560c28a2020-07-24 23:20:24 +02006161 return( status );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006162 }
6163 else
6164#endif /* MBEDTLS_ECP_C */
Steven Cooreman29149862020-08-05 15:43:42 +02006165 {
Gilles Peskinee59236f2018-01-27 23:32:46 +01006166 return( PSA_ERROR_NOT_SUPPORTED );
Steven Cooreman29149862020-08-05 15:43:42 +02006167 }
Gilles Peskinee59236f2018-01-27 23:32:46 +01006168
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006169 return( PSA_SUCCESS );
6170}
Darryl Green0c6575a2018-11-07 16:05:30 +00006171
Gilles Peskine35ef36b2019-05-16 19:42:05 +02006172psa_status_t psa_generate_key( const psa_key_attributes_t *attributes,
Gilles Peskinee56e8782019-04-26 17:34:02 +02006173 psa_key_handle_t *handle )
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006174{
6175 psa_status_t status;
6176 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02006177 psa_se_drv_table_entry_t *driver = NULL;
Gilles Peskine11792082019-08-06 18:36:36 +02006178
Gilles Peskine0f84d622019-09-12 19:03:13 +02006179 /* Reject any attempt to create a zero-length key so that we don't
6180 * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
6181 if( psa_get_key_bits( attributes ) == 0 )
6182 return( PSA_ERROR_INVALID_ARGUMENT );
6183
Gilles Peskinedf179142019-07-15 22:02:14 +02006184 status = psa_start_key_creation( PSA_KEY_CREATION_GENERATE,
6185 attributes, handle, &slot, &driver );
Gilles Peskine11792082019-08-06 18:36:36 +02006186 if( status != PSA_SUCCESS )
6187 goto exit;
6188
Steven Cooreman2a1664c2020-07-20 15:33:08 +02006189 status = psa_driver_wrapper_generate_key( attributes,
6190 slot );
6191 if( status != PSA_ERROR_NOT_SUPPORTED ||
6192 psa_key_lifetime_is_external( attributes->core.lifetime ) )
6193 goto exit;
6194
6195 status = psa_generate_key_internal(
6196 slot, attributes->core.bits,
6197 attributes->domain_parameters, attributes->domain_parameters_size );
Gilles Peskine11792082019-08-06 18:36:36 +02006198
6199exit:
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006200 if( status == PSA_SUCCESS )
Gilles Peskine011e4282019-06-26 18:34:38 +02006201 status = psa_finish_key_creation( slot, driver );
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006202 if( status != PSA_SUCCESS )
6203 {
Gilles Peskine011e4282019-06-26 18:34:38 +02006204 psa_fail_key_creation( slot, driver );
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006205 *handle = 0;
6206 }
Darryl Green0c6575a2018-11-07 16:05:30 +00006207 return( status );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006208}
6209
6210
Gilles Peskinee59236f2018-01-27 23:32:46 +01006211
6212/****************************************************************/
6213/* Module setup */
6214/****************************************************************/
6215
Gilles Peskine5e769522018-11-20 21:59:56 +01006216psa_status_t mbedtls_psa_crypto_configure_entropy_sources(
6217 void (* entropy_init )( mbedtls_entropy_context *ctx ),
6218 void (* entropy_free )( mbedtls_entropy_context *ctx ) )
6219{
6220 if( global_data.rng_state != RNG_NOT_INITIALIZED )
6221 return( PSA_ERROR_BAD_STATE );
6222 global_data.entropy_init = entropy_init;
6223 global_data.entropy_free = entropy_free;
6224 return( PSA_SUCCESS );
6225}
6226
Gilles Peskinee59236f2018-01-27 23:32:46 +01006227void mbedtls_psa_crypto_free( void )
6228{
Gilles Peskine66fb1262018-12-10 16:29:04 +01006229 psa_wipe_all_key_slots( );
Gilles Peskinec6b69072018-11-20 21:42:52 +01006230 if( global_data.rng_state != RNG_NOT_INITIALIZED )
6231 {
6232 mbedtls_ctr_drbg_free( &global_data.ctr_drbg );
Gilles Peskine5e769522018-11-20 21:59:56 +01006233 global_data.entropy_free( &global_data.entropy );
Gilles Peskinec6b69072018-11-20 21:42:52 +01006234 }
6235 /* Wipe all remaining data, including configuration.
6236 * In particular, this sets all state indicator to the value
6237 * indicating "uninitialized". */
Gilles Peskine3f108122018-12-07 18:14:53 +01006238 mbedtls_platform_zeroize( &global_data, sizeof( global_data ) );
Gilles Peskinea8ade162019-06-26 11:24:49 +02006239#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined0890212019-06-24 14:34:43 +02006240 /* Unregister all secure element drivers, so that we restart from
6241 * a pristine state. */
6242 psa_unregister_all_se_drivers( );
Gilles Peskinea8ade162019-06-26 11:24:49 +02006243#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskinee59236f2018-01-27 23:32:46 +01006244}
6245
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02006246#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
6247/** Recover a transaction that was interrupted by a power failure.
6248 *
6249 * This function is called during initialization, before psa_crypto_init()
6250 * returns. If this function returns a failure status, the initialization
6251 * fails.
6252 */
6253static psa_status_t psa_crypto_recover_transaction(
6254 const psa_crypto_transaction_t *transaction )
6255{
6256 switch( transaction->unknown.type )
6257 {
6258 case PSA_CRYPTO_TRANSACTION_CREATE_KEY:
6259 case PSA_CRYPTO_TRANSACTION_DESTROY_KEY:
Janos Follath1d57a202019-08-13 12:15:34 +01006260 /* TODO - fall through to the failure case until this
Gilles Peskinec9d7f942019-08-13 16:17:16 +02006261 * is implemented.
6262 * https://github.com/ARMmbed/mbed-crypto/issues/218
6263 */
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02006264 default:
6265 /* We found an unsupported transaction in the storage.
6266 * We don't know what state the storage is in. Give up. */
6267 return( PSA_ERROR_STORAGE_FAILURE );
6268 }
6269}
6270#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
6271
Gilles Peskinee59236f2018-01-27 23:32:46 +01006272psa_status_t psa_crypto_init( void )
6273{
Gilles Peskine66fb1262018-12-10 16:29:04 +01006274 psa_status_t status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01006275 const unsigned char drbg_seed[] = "PSA";
6276
Gilles Peskinec6b69072018-11-20 21:42:52 +01006277 /* Double initialization is explicitly allowed. */
Gilles Peskinee59236f2018-01-27 23:32:46 +01006278 if( global_data.initialized != 0 )
6279 return( PSA_SUCCESS );
6280
Gilles Peskine5e769522018-11-20 21:59:56 +01006281 /* Set default configuration if
6282 * mbedtls_psa_crypto_configure_entropy_sources() hasn't been called. */
6283 if( global_data.entropy_init == NULL )
6284 global_data.entropy_init = mbedtls_entropy_init;
6285 if( global_data.entropy_free == NULL )
6286 global_data.entropy_free = mbedtls_entropy_free;
Gilles Peskinee59236f2018-01-27 23:32:46 +01006287
Gilles Peskinec6b69072018-11-20 21:42:52 +01006288 /* Initialize the random generator. */
Gilles Peskine5e769522018-11-20 21:59:56 +01006289 global_data.entropy_init( &global_data.entropy );
Jaeden Amero76541612019-06-04 17:14:43 +01006290#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \
6291 defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES)
6292 /* The PSA entropy injection feature depends on using NV seed as an entropy
6293 * source. Add NV seed as an entropy source for PSA entropy injection. */
6294 mbedtls_entropy_add_source( &global_data.entropy,
6295 mbedtls_nv_seed_poll, NULL,
6296 MBEDTLS_ENTROPY_BLOCK_SIZE,
6297 MBEDTLS_ENTROPY_SOURCE_STRONG );
6298#endif
Gilles Peskinee59236f2018-01-27 23:32:46 +01006299 mbedtls_ctr_drbg_init( &global_data.ctr_drbg );
Gilles Peskinec6b69072018-11-20 21:42:52 +01006300 global_data.rng_state = RNG_INITIALIZED;
Gilles Peskine66fb1262018-12-10 16:29:04 +01006301 status = mbedtls_to_psa_error(
6302 mbedtls_ctr_drbg_seed( &global_data.ctr_drbg,
6303 mbedtls_entropy_func,
6304 &global_data.entropy,
6305 drbg_seed, sizeof( drbg_seed ) - 1 ) );
6306 if( status != PSA_SUCCESS )
Gilles Peskinee59236f2018-01-27 23:32:46 +01006307 goto exit;
Gilles Peskinec6b69072018-11-20 21:42:52 +01006308 global_data.rng_state = RNG_SEEDED;
Gilles Peskinee59236f2018-01-27 23:32:46 +01006309
Gilles Peskine66fb1262018-12-10 16:29:04 +01006310 status = psa_initialize_key_slots( );
6311 if( status != PSA_SUCCESS )
6312 goto exit;
Gilles Peskinec6b69072018-11-20 21:42:52 +01006313
Gilles Peskined9348f22019-10-01 15:22:29 +02006314#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
6315 status = psa_init_all_se_drivers( );
6316 if( status != PSA_SUCCESS )
6317 goto exit;
6318#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
6319
Gilles Peskine4b734222019-07-24 15:56:31 +02006320#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
Gilles Peskinefc762652019-07-22 19:30:34 +02006321 status = psa_crypto_load_transaction( );
6322 if( status == PSA_SUCCESS )
6323 {
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02006324 status = psa_crypto_recover_transaction( &psa_crypto_transaction );
6325 if( status != PSA_SUCCESS )
6326 goto exit;
6327 status = psa_crypto_stop_transaction( );
Gilles Peskinefc762652019-07-22 19:30:34 +02006328 }
6329 else if( status == PSA_ERROR_DOES_NOT_EXIST )
6330 {
6331 /* There's no transaction to complete. It's all good. */
6332 status = PSA_SUCCESS;
6333 }
Gilles Peskine4b734222019-07-24 15:56:31 +02006334#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
Gilles Peskinefc762652019-07-22 19:30:34 +02006335
Gilles Peskinec6b69072018-11-20 21:42:52 +01006336 /* All done. */
Gilles Peskinee59236f2018-01-27 23:32:46 +01006337 global_data.initialized = 1;
6338
6339exit:
Gilles Peskine66fb1262018-12-10 16:29:04 +01006340 if( status != PSA_SUCCESS )
Gilles Peskinee59236f2018-01-27 23:32:46 +01006341 mbedtls_psa_crypto_free( );
Gilles Peskine66fb1262018-12-10 16:29:04 +01006342 return( status );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006343}
6344
6345#endif /* MBEDTLS_PSA_CRYPTO_C */