Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 1 | /* |
| 2 | * PSA RSA layer on top of Mbed TLS crypto |
| 3 | */ |
| 4 | /* |
| 5 | * Copyright The Mbed TLS Contributors |
Dave Rodgman | 16799db | 2023-11-02 19:47:20 +0000 | [diff] [blame] | 6 | * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 7 | */ |
| 8 | |
| 9 | #include "common.h" |
| 10 | |
| 11 | #if defined(MBEDTLS_PSA_CRYPTO_C) |
| 12 | |
| 13 | #include <psa/crypto.h> |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 14 | #include "psa/crypto_values.h" |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 15 | #include "psa_crypto_core.h" |
Ronald Cron | 9e18fc1 | 2020-11-05 17:36:40 +0100 | [diff] [blame] | 16 | #include "psa_crypto_random_impl.h" |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 17 | #include "psa_crypto_rsa.h" |
Steven Cooreman | 5f88e77 | 2021-03-15 11:07:12 +0100 | [diff] [blame] | 18 | #include "psa_crypto_hash.h" |
Valerio Setti | 384fbde | 2024-01-02 13:26:40 +0100 | [diff] [blame] | 19 | #include "mbedtls/psa_util.h" |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 20 | |
| 21 | #include <stdlib.h> |
| 22 | #include <string.h> |
| 23 | #include "mbedtls/platform.h" |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 24 | |
| 25 | #include <mbedtls/rsa.h> |
| 26 | #include <mbedtls/error.h> |
Valerio Setti | 7b7ffd3 | 2024-01-23 16:14:18 +0100 | [diff] [blame] | 27 | #include "rsa_internal.h" |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 28 | |
| 29 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \ |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 30 | defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) || \ |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 31 | defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \ |
| 32 | defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) || \ |
Valerio Setti | b2bcedb | 2023-07-10 11:24:00 +0200 | [diff] [blame] | 33 | defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT) || \ |
Valerio Setti | fe47890 | 2023-07-25 12:27:19 +0200 | [diff] [blame] | 34 | defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT) || \ |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 35 | defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 36 | |
| 37 | /* Mbed TLS doesn't support non-byte-aligned key sizes (i.e. key sizes |
| 38 | * that are not a multiple of 8) well. For example, there is only |
| 39 | * mbedtls_rsa_get_len(), which returns a number of bytes, and no |
| 40 | * way to return the exact bit size of a key. |
| 41 | * To keep things simple, reject non-byte-aligned key sizes. */ |
| 42 | static psa_status_t psa_check_rsa_key_byte_aligned( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 43 | const mbedtls_rsa_context *rsa) |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 44 | { |
| 45 | mbedtls_mpi n; |
| 46 | psa_status_t status; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 47 | mbedtls_mpi_init(&n); |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 48 | status = mbedtls_to_psa_error( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 49 | mbedtls_rsa_export(rsa, &n, NULL, NULL, NULL, NULL)); |
| 50 | if (status == PSA_SUCCESS) { |
| 51 | if (mbedtls_mpi_bitlen(&n) % 8 != 0) { |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 52 | status = PSA_ERROR_NOT_SUPPORTED; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 53 | } |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 54 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 55 | mbedtls_mpi_free(&n); |
| 56 | return status; |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 57 | } |
| 58 | |
| 59 | psa_status_t mbedtls_psa_rsa_load_representation( |
| 60 | psa_key_type_t type, const uint8_t *data, size_t data_length, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 61 | mbedtls_rsa_context **p_rsa) |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 62 | { |
| 63 | psa_status_t status; |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 64 | size_t bits; |
Valerio Setti | 7b7ffd3 | 2024-01-23 16:14:18 +0100 | [diff] [blame] | 65 | |
| 66 | *p_rsa = mbedtls_calloc(1, sizeof(mbedtls_rsa_context)); |
| 67 | if (*p_rsa == NULL) { |
| 68 | return PSA_ERROR_INSUFFICIENT_MEMORY; |
| 69 | } |
| 70 | mbedtls_rsa_init(*p_rsa); |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 71 | |
| 72 | /* Parse the data. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 73 | if (PSA_KEY_TYPE_IS_KEY_PAIR(type)) { |
Valerio Setti | 135ebde | 2024-02-01 17:00:29 +0100 | [diff] [blame] | 74 | status = mbedtls_to_psa_error(mbedtls_rsa_parse_key(*p_rsa, data, data_length)); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 75 | } else { |
Valerio Setti | 201e643 | 2024-02-01 17:19:37 +0100 | [diff] [blame] | 76 | status = mbedtls_to_psa_error(mbedtls_rsa_parse_pubkey(*p_rsa, data, data_length)); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 77 | } |
| 78 | if (status != PSA_SUCCESS) { |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 79 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 80 | } |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 81 | |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 82 | /* The size of an RSA key doesn't have to be a multiple of 8. Mbed TLS |
| 83 | * supports non-byte-aligned key sizes, but not well. For example, |
| 84 | * mbedtls_rsa_get_len() returns the key size in bytes, not in bits. */ |
Valerio Setti | 7b7ffd3 | 2024-01-23 16:14:18 +0100 | [diff] [blame] | 85 | bits = PSA_BYTES_TO_BITS(mbedtls_rsa_get_len(*p_rsa)); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 86 | if (bits > PSA_VENDOR_RSA_MAX_KEY_BITS) { |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 87 | status = PSA_ERROR_NOT_SUPPORTED; |
| 88 | goto exit; |
| 89 | } |
Valerio Setti | 7b7ffd3 | 2024-01-23 16:14:18 +0100 | [diff] [blame] | 90 | status = psa_check_rsa_key_byte_aligned(*p_rsa); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 91 | if (status != PSA_SUCCESS) { |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 92 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 93 | } |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 94 | |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 95 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 96 | return status; |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 97 | } |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 98 | #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 99 | * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) || |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 100 | * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || |
| 101 | * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) || |
Valerio Setti | b2bcedb | 2023-07-10 11:24:00 +0200 | [diff] [blame] | 102 | * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT) || |
Valerio Setti | fe47890 | 2023-07-25 12:27:19 +0200 | [diff] [blame] | 103 | * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT) || |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 104 | * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */ |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 105 | |
Valerio Setti | fe47890 | 2023-07-25 12:27:19 +0200 | [diff] [blame] | 106 | #if (defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT) && \ |
| 107 | defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT)) || \ |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 108 | defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 109 | psa_status_t mbedtls_psa_rsa_import_key( |
Ronald Cron | abf2aef | 2020-11-27 18:13:44 +0100 | [diff] [blame] | 110 | const psa_key_attributes_t *attributes, |
| 111 | const uint8_t *data, size_t data_length, |
| 112 | uint8_t *key_buffer, size_t key_buffer_size, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 113 | size_t *key_buffer_length, size_t *bits) |
Ronald Cron | abf2aef | 2020-11-27 18:13:44 +0100 | [diff] [blame] | 114 | { |
| 115 | psa_status_t status; |
| 116 | mbedtls_rsa_context *rsa = NULL; |
| 117 | |
| 118 | /* Parse input */ |
Gilles Peskine | 2f107ae | 2024-02-28 01:26:46 +0100 | [diff] [blame] | 119 | status = mbedtls_psa_rsa_load_representation(attributes->type, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 120 | data, |
| 121 | data_length, |
| 122 | &rsa); |
| 123 | if (status != PSA_SUCCESS) { |
Ronald Cron | abf2aef | 2020-11-27 18:13:44 +0100 | [diff] [blame] | 124 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 125 | } |
Ronald Cron | abf2aef | 2020-11-27 18:13:44 +0100 | [diff] [blame] | 126 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 127 | *bits = (psa_key_bits_t) PSA_BYTES_TO_BITS(mbedtls_rsa_get_len(rsa)); |
Ronald Cron | abf2aef | 2020-11-27 18:13:44 +0100 | [diff] [blame] | 128 | |
| 129 | /* Re-export the data to PSA export format, such that we can store export |
| 130 | * representation in the key slot. Export representation in case of RSA is |
| 131 | * the smallest representation that's allowed as input, so a straight-up |
| 132 | * allocation of the same size as the input buffer will be large enough. */ |
Gilles Peskine | 2f107ae | 2024-02-28 01:26:46 +0100 | [diff] [blame] | 133 | status = mbedtls_psa_rsa_export_key(attributes->type, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 134 | rsa, |
| 135 | key_buffer, |
| 136 | key_buffer_size, |
| 137 | key_buffer_length); |
Ronald Cron | abf2aef | 2020-11-27 18:13:44 +0100 | [diff] [blame] | 138 | exit: |
| 139 | /* Always free the RSA object */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 140 | mbedtls_rsa_free(rsa); |
| 141 | mbedtls_free(rsa); |
Ronald Cron | abf2aef | 2020-11-27 18:13:44 +0100 | [diff] [blame] | 142 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 143 | return status; |
Ronald Cron | abf2aef | 2020-11-27 18:13:44 +0100 | [diff] [blame] | 144 | } |
Valerio Setti | fe47890 | 2023-07-25 12:27:19 +0200 | [diff] [blame] | 145 | #endif /* (defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT) && |
| 146 | * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT)) || |
Valerio Setti | b2bcedb | 2023-07-10 11:24:00 +0200 | [diff] [blame] | 147 | * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */ |
Ronald Cron | abf2aef | 2020-11-27 18:13:44 +0100 | [diff] [blame] | 148 | |
Valerio Setti | b2bcedb | 2023-07-10 11:24:00 +0200 | [diff] [blame] | 149 | #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT) || \ |
| 150 | defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 151 | psa_status_t mbedtls_psa_rsa_export_key(psa_key_type_t type, |
| 152 | mbedtls_rsa_context *rsa, |
| 153 | uint8_t *data, |
| 154 | size_t data_size, |
| 155 | size_t *data_length) |
Ronald Cron | e5ca3d8 | 2020-11-26 16:36:16 +0100 | [diff] [blame] | 156 | { |
Ronald Cron | e5ca3d8 | 2020-11-26 16:36:16 +0100 | [diff] [blame] | 157 | int ret; |
Valerio Setti | 7b7ffd3 | 2024-01-23 16:14:18 +0100 | [diff] [blame] | 158 | uint8_t *end = data + data_size; |
Ronald Cron | e5ca3d8 | 2020-11-26 16:36:16 +0100 | [diff] [blame] | 159 | |
| 160 | /* PSA Crypto API defines the format of an RSA key as a DER-encoded |
| 161 | * representation of the non-encrypted PKCS#1 RSAPrivateKey for a |
| 162 | * private key and of the RFC3279 RSAPublicKey for a public key. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 163 | if (PSA_KEY_TYPE_IS_KEY_PAIR(type)) { |
Valerio Setti | 135ebde | 2024-02-01 17:00:29 +0100 | [diff] [blame] | 164 | ret = mbedtls_rsa_write_key(rsa, data, &end); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 165 | } else { |
Valerio Setti | 135ebde | 2024-02-01 17:00:29 +0100 | [diff] [blame] | 166 | ret = mbedtls_rsa_write_pubkey(rsa, data, &end); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 167 | } |
Ronald Cron | e5ca3d8 | 2020-11-26 16:36:16 +0100 | [diff] [blame] | 168 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 169 | if (ret < 0) { |
Ronald Cron | e5ca3d8 | 2020-11-26 16:36:16 +0100 | [diff] [blame] | 170 | /* Clean up in case pk_write failed halfway through. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 171 | memset(data, 0, data_size); |
| 172 | return mbedtls_to_psa_error(ret); |
Ronald Cron | e5ca3d8 | 2020-11-26 16:36:16 +0100 | [diff] [blame] | 173 | } |
| 174 | |
| 175 | /* The mbedtls_pk_xxx functions write to the end of the buffer. |
| 176 | * Move the data to the beginning and erase remaining data |
| 177 | * at the original location. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 178 | if (2 * (size_t) ret <= data_size) { |
| 179 | memcpy(data, data + data_size - ret, ret); |
| 180 | memset(data + data_size - ret, 0, ret); |
| 181 | } else if ((size_t) ret < data_size) { |
| 182 | memmove(data, data + data_size - ret, ret); |
| 183 | memset(data + ret, 0, data_size - ret); |
Ronald Cron | e5ca3d8 | 2020-11-26 16:36:16 +0100 | [diff] [blame] | 184 | } |
| 185 | |
| 186 | *data_length = ret; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 187 | return PSA_SUCCESS; |
Ronald Cron | e5ca3d8 | 2020-11-26 16:36:16 +0100 | [diff] [blame] | 188 | } |
| 189 | |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 190 | psa_status_t mbedtls_psa_rsa_export_public_key( |
Ronald Cron | e5ca3d8 | 2020-11-26 16:36:16 +0100 | [diff] [blame] | 191 | const psa_key_attributes_t *attributes, |
| 192 | const uint8_t *key_buffer, size_t key_buffer_size, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 193 | uint8_t *data, size_t data_size, size_t *data_length) |
Ronald Cron | e5ca3d8 | 2020-11-26 16:36:16 +0100 | [diff] [blame] | 194 | { |
| 195 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 196 | mbedtls_rsa_context *rsa = NULL; |
| 197 | |
| 198 | status = mbedtls_psa_rsa_load_representation( |
Gilles Peskine | 2f107ae | 2024-02-28 01:26:46 +0100 | [diff] [blame] | 199 | attributes->type, key_buffer, key_buffer_size, &rsa); |
Gowtham Suresh Kumar | c2ec6fa | 2024-08-19 11:50:10 +0100 | [diff] [blame^] | 200 | if (status == PSA_SUCCESS) { |
| 201 | status = mbedtls_psa_rsa_export_key(PSA_KEY_TYPE_RSA_PUBLIC_KEY, |
| 202 | rsa, |
| 203 | data, |
| 204 | data_size, |
| 205 | data_length); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 206 | } |
Ronald Cron | e5ca3d8 | 2020-11-26 16:36:16 +0100 | [diff] [blame] | 207 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 208 | mbedtls_rsa_free(rsa); |
| 209 | mbedtls_free(rsa); |
Ronald Cron | e5ca3d8 | 2020-11-26 16:36:16 +0100 | [diff] [blame] | 210 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 211 | return status; |
Ronald Cron | e5ca3d8 | 2020-11-26 16:36:16 +0100 | [diff] [blame] | 212 | } |
Valerio Setti | b2bcedb | 2023-07-10 11:24:00 +0200 | [diff] [blame] | 213 | #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT) || |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 214 | * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */ |
Ronald Cron | f1057d3 | 2020-11-26 19:19:10 +0100 | [diff] [blame] | 215 | |
Valerio Setti | 76df8c1 | 2023-07-11 14:11:28 +0200 | [diff] [blame] | 216 | #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_GENERATE) |
Gilles Peskine | bb6f3ff | 2024-02-16 00:51:07 +0100 | [diff] [blame] | 217 | static psa_status_t psa_rsa_read_exponent(const uint8_t *e_bytes, |
| 218 | size_t e_length, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 219 | int *exponent) |
Ronald Cron | 9e18fc1 | 2020-11-05 17:36:40 +0100 | [diff] [blame] | 220 | { |
| 221 | size_t i; |
| 222 | uint32_t acc = 0; |
| 223 | |
Ronald Cron | 9e18fc1 | 2020-11-05 17:36:40 +0100 | [diff] [blame] | 224 | /* Mbed TLS encodes the public exponent as an int. For simplicity, only |
| 225 | * support values that fit in a 32-bit integer, which is larger than |
| 226 | * int on just about every platform anyway. */ |
Gilles Peskine | bb6f3ff | 2024-02-16 00:51:07 +0100 | [diff] [blame] | 227 | if (e_length > sizeof(acc)) { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 228 | return PSA_ERROR_NOT_SUPPORTED; |
| 229 | } |
Gilles Peskine | bb6f3ff | 2024-02-16 00:51:07 +0100 | [diff] [blame] | 230 | for (i = 0; i < e_length; i++) { |
| 231 | acc = (acc << 8) | e_bytes[i]; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 232 | } |
| 233 | if (acc > INT_MAX) { |
| 234 | return PSA_ERROR_NOT_SUPPORTED; |
| 235 | } |
Ronald Cron | 9e18fc1 | 2020-11-05 17:36:40 +0100 | [diff] [blame] | 236 | *exponent = acc; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 237 | return PSA_SUCCESS; |
Ronald Cron | 9e18fc1 | 2020-11-05 17:36:40 +0100 | [diff] [blame] | 238 | } |
| 239 | |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 240 | psa_status_t mbedtls_psa_rsa_generate_key( |
Ronald Cron | 9e18fc1 | 2020-11-05 17:36:40 +0100 | [diff] [blame] | 241 | const psa_key_attributes_t *attributes, |
Gilles Peskine | f36d785 | 2024-06-06 21:11:44 +0200 | [diff] [blame] | 242 | const uint8_t *custom_data, size_t custom_data_length, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 243 | uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length) |
Ronald Cron | 9e18fc1 | 2020-11-05 17:36:40 +0100 | [diff] [blame] | 244 | { |
| 245 | psa_status_t status; |
| 246 | mbedtls_rsa_context rsa; |
| 247 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Gilles Peskine | 4c32b69 | 2024-02-16 00:11:09 +0100 | [diff] [blame] | 248 | int exponent = 65537; |
Ronald Cron | 9e18fc1 | 2020-11-05 17:36:40 +0100 | [diff] [blame] | 249 | |
Gilles Peskine | f36d785 | 2024-06-06 21:11:44 +0200 | [diff] [blame] | 250 | if (custom_data_length != 0) { |
| 251 | status = psa_rsa_read_exponent(custom_data, custom_data_length, |
Gilles Peskine | 4c32b69 | 2024-02-16 00:11:09 +0100 | [diff] [blame] | 252 | &exponent); |
| 253 | if (status != PSA_SUCCESS) { |
| 254 | return status; |
| 255 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 256 | } |
Ronald Cron | 9e18fc1 | 2020-11-05 17:36:40 +0100 | [diff] [blame] | 257 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 258 | mbedtls_rsa_init(&rsa); |
| 259 | ret = mbedtls_rsa_gen_key(&rsa, |
| 260 | mbedtls_psa_get_random, |
| 261 | MBEDTLS_PSA_RANDOM_STATE, |
Gilles Peskine | 2f107ae | 2024-02-28 01:26:46 +0100 | [diff] [blame] | 262 | (unsigned int) attributes->bits, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 263 | exponent); |
| 264 | if (ret != 0) { |
Gowtham Suresh Kumar | c2ec6fa | 2024-08-19 11:50:10 +0100 | [diff] [blame^] | 265 | mbedtls_rsa_free(&rsa); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 266 | return mbedtls_to_psa_error(ret); |
| 267 | } |
Ronald Cron | 9e18fc1 | 2020-11-05 17:36:40 +0100 | [diff] [blame] | 268 | |
Gilles Peskine | 2f107ae | 2024-02-28 01:26:46 +0100 | [diff] [blame] | 269 | status = mbedtls_psa_rsa_export_key(attributes->type, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 270 | &rsa, key_buffer, key_buffer_size, |
| 271 | key_buffer_length); |
| 272 | mbedtls_rsa_free(&rsa); |
Ronald Cron | 9e18fc1 | 2020-11-05 17:36:40 +0100 | [diff] [blame] | 273 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 274 | return status; |
Ronald Cron | 9e18fc1 | 2020-11-05 17:36:40 +0100 | [diff] [blame] | 275 | } |
Valerio Setti | 76df8c1 | 2023-07-11 14:11:28 +0200 | [diff] [blame] | 276 | #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_GENERATE) */ |
Ronald Cron | 9e18fc1 | 2020-11-05 17:36:40 +0100 | [diff] [blame] | 277 | |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 278 | /****************************************************************/ |
| 279 | /* Sign/verify hashes */ |
| 280 | /****************************************************************/ |
| 281 | |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 282 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \ |
| 283 | defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 284 | |
| 285 | /* Decode the hash algorithm from alg and store the mbedtls encoding in |
| 286 | * md_alg. Verify that the hash length is acceptable. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 287 | static psa_status_t psa_rsa_decode_md_type(psa_algorithm_t alg, |
| 288 | size_t hash_length, |
| 289 | mbedtls_md_type_t *md_alg) |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 290 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 291 | psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH(alg); |
Manuel Pégourié-Gonnard | 2d6d993 | 2023-03-28 11:38:08 +0200 | [diff] [blame] | 292 | *md_alg = mbedtls_md_type_from_psa_alg(hash_alg); |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 293 | |
| 294 | /* The Mbed TLS RSA module uses an unsigned int for hash length |
| 295 | * parameters. Validate that it fits so that we don't risk an |
| 296 | * overflow later. */ |
Dave Rodgman | 02a53d7 | 2023-09-28 17:17:07 +0100 | [diff] [blame] | 297 | #if SIZE_MAX > UINT_MAX |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 298 | if (hash_length > UINT_MAX) { |
| 299 | return PSA_ERROR_INVALID_ARGUMENT; |
| 300 | } |
Dave Rodgman | 02a53d7 | 2023-09-28 17:17:07 +0100 | [diff] [blame] | 301 | #endif |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 302 | |
Janos Follath | 0af093b | 2021-06-07 14:34:10 +0100 | [diff] [blame] | 303 | /* For signatures using a hash, the hash length must be correct. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 304 | if (alg != PSA_ALG_RSA_PKCS1V15_SIGN_RAW) { |
| 305 | if (*md_alg == MBEDTLS_MD_NONE) { |
| 306 | return PSA_ERROR_NOT_SUPPORTED; |
| 307 | } |
Manuel Pégourié-Gonnard | 9b41eb8 | 2023-03-28 11:14:24 +0200 | [diff] [blame] | 308 | if (mbedtls_md_get_size_from_type(*md_alg) != hash_length) { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 309 | return PSA_ERROR_INVALID_ARGUMENT; |
| 310 | } |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 311 | } |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 312 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 313 | return PSA_SUCCESS; |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 314 | } |
| 315 | |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 316 | psa_status_t mbedtls_psa_rsa_sign_hash( |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 317 | const psa_key_attributes_t *attributes, |
| 318 | const uint8_t *key_buffer, size_t key_buffer_size, |
| 319 | psa_algorithm_t alg, const uint8_t *hash, size_t hash_length, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 320 | uint8_t *signature, size_t signature_size, size_t *signature_length) |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 321 | { |
| 322 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 323 | mbedtls_rsa_context *rsa = NULL; |
| 324 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
| 325 | mbedtls_md_type_t md_alg; |
| 326 | |
Gilles Peskine | 2f107ae | 2024-02-28 01:26:46 +0100 | [diff] [blame] | 327 | status = mbedtls_psa_rsa_load_representation(attributes->type, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 328 | key_buffer, |
| 329 | key_buffer_size, |
| 330 | &rsa); |
| 331 | if (status != PSA_SUCCESS) { |
Gowtham Suresh Kumar | c2ec6fa | 2024-08-19 11:50:10 +0100 | [diff] [blame^] | 332 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 333 | } |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 334 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 335 | status = psa_rsa_decode_md_type(alg, hash_length, &md_alg); |
| 336 | if (status != PSA_SUCCESS) { |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 337 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 338 | } |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 339 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 340 | if (signature_size < mbedtls_rsa_get_len(rsa)) { |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 341 | status = PSA_ERROR_BUFFER_TOO_SMALL; |
| 342 | goto exit; |
| 343 | } |
| 344 | |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 345 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 346 | if (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg)) { |
| 347 | ret = mbedtls_rsa_set_padding(rsa, MBEDTLS_RSA_PKCS_V15, |
| 348 | MBEDTLS_MD_NONE); |
| 349 | if (ret == 0) { |
| 350 | ret = mbedtls_rsa_pkcs1_sign(rsa, |
| 351 | mbedtls_psa_get_random, |
| 352 | MBEDTLS_PSA_RANDOM_STATE, |
| 353 | md_alg, |
| 354 | (unsigned int) hash_length, |
| 355 | hash, |
| 356 | signature); |
Ronald Cron | ea7631b | 2021-06-03 18:51:59 +0200 | [diff] [blame] | 357 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 358 | } else |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 359 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN */ |
| 360 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 361 | if (PSA_ALG_IS_RSA_PSS(alg)) { |
| 362 | ret = mbedtls_rsa_set_padding(rsa, MBEDTLS_RSA_PKCS_V21, md_alg); |
Ronald Cron | ea7631b | 2021-06-03 18:51:59 +0200 | [diff] [blame] | 363 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 364 | if (ret == 0) { |
| 365 | ret = mbedtls_rsa_rsassa_pss_sign(rsa, |
| 366 | mbedtls_psa_get_random, |
| 367 | MBEDTLS_PSA_RANDOM_STATE, |
| 368 | MBEDTLS_MD_NONE, |
| 369 | (unsigned int) hash_length, |
| 370 | hash, |
| 371 | signature); |
Ronald Cron | ea7631b | 2021-06-03 18:51:59 +0200 | [diff] [blame] | 372 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 373 | } else |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 374 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS */ |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 375 | { |
| 376 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 377 | goto exit; |
| 378 | } |
| 379 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 380 | if (ret == 0) { |
| 381 | *signature_length = mbedtls_rsa_get_len(rsa); |
| 382 | } |
| 383 | status = mbedtls_to_psa_error(ret); |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 384 | |
| 385 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 386 | mbedtls_rsa_free(rsa); |
| 387 | mbedtls_free(rsa); |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 388 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 389 | return status; |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 390 | } |
| 391 | |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 392 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 393 | static int rsa_pss_expected_salt_len(psa_algorithm_t alg, |
| 394 | const mbedtls_rsa_context *rsa, |
| 395 | size_t hash_length) |
Gilles Peskine | b9b817e | 2021-10-04 22:15:05 +0200 | [diff] [blame] | 396 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 397 | if (PSA_ALG_IS_RSA_PSS_ANY_SALT(alg)) { |
| 398 | return MBEDTLS_RSA_SALT_LEN_ANY; |
| 399 | } |
Gilles Peskine | b9b817e | 2021-10-04 22:15:05 +0200 | [diff] [blame] | 400 | /* Otherwise: standard salt length, i.e. largest possible salt length |
| 401 | * up to the hash length. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 402 | int klen = (int) mbedtls_rsa_get_len(rsa); // known to fit |
Gilles Peskine | b9b817e | 2021-10-04 22:15:05 +0200 | [diff] [blame] | 403 | int hlen = (int) hash_length; // known to fit |
| 404 | int room = klen - 2 - hlen; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 405 | if (room < 0) { |
| 406 | return 0; // there is no valid signature in this case anyway |
| 407 | } else if (room > hlen) { |
| 408 | return hlen; |
| 409 | } else { |
| 410 | return room; |
| 411 | } |
Gilles Peskine | b9b817e | 2021-10-04 22:15:05 +0200 | [diff] [blame] | 412 | } |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 413 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS */ |
Gilles Peskine | b9b817e | 2021-10-04 22:15:05 +0200 | [diff] [blame] | 414 | |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 415 | psa_status_t mbedtls_psa_rsa_verify_hash( |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 416 | const psa_key_attributes_t *attributes, |
| 417 | const uint8_t *key_buffer, size_t key_buffer_size, |
| 418 | psa_algorithm_t alg, const uint8_t *hash, size_t hash_length, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 419 | const uint8_t *signature, size_t signature_length) |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 420 | { |
| 421 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 422 | mbedtls_rsa_context *rsa = NULL; |
| 423 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
| 424 | mbedtls_md_type_t md_alg; |
| 425 | |
Gilles Peskine | 2f107ae | 2024-02-28 01:26:46 +0100 | [diff] [blame] | 426 | status = mbedtls_psa_rsa_load_representation(attributes->type, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 427 | key_buffer, |
| 428 | key_buffer_size, |
| 429 | &rsa); |
| 430 | if (status != PSA_SUCCESS) { |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 431 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 432 | } |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 433 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 434 | status = psa_rsa_decode_md_type(alg, hash_length, &md_alg); |
| 435 | if (status != PSA_SUCCESS) { |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 436 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 437 | } |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 438 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 439 | if (signature_length != mbedtls_rsa_get_len(rsa)) { |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 440 | status = PSA_ERROR_INVALID_SIGNATURE; |
| 441 | goto exit; |
| 442 | } |
| 443 | |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 444 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 445 | if (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg)) { |
| 446 | ret = mbedtls_rsa_set_padding(rsa, MBEDTLS_RSA_PKCS_V15, |
| 447 | MBEDTLS_MD_NONE); |
| 448 | if (ret == 0) { |
| 449 | ret = mbedtls_rsa_pkcs1_verify(rsa, |
| 450 | md_alg, |
| 451 | (unsigned int) hash_length, |
| 452 | hash, |
| 453 | signature); |
Ronald Cron | ea7631b | 2021-06-03 18:51:59 +0200 | [diff] [blame] | 454 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 455 | } else |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 456 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN */ |
| 457 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 458 | if (PSA_ALG_IS_RSA_PSS(alg)) { |
| 459 | ret = mbedtls_rsa_set_padding(rsa, MBEDTLS_RSA_PKCS_V21, md_alg); |
| 460 | if (ret == 0) { |
| 461 | int slen = rsa_pss_expected_salt_len(alg, rsa, hash_length); |
| 462 | ret = mbedtls_rsa_rsassa_pss_verify_ext(rsa, |
| 463 | md_alg, |
| 464 | (unsigned) hash_length, |
| 465 | hash, |
| 466 | md_alg, |
| 467 | slen, |
| 468 | signature); |
Ronald Cron | ea7631b | 2021-06-03 18:51:59 +0200 | [diff] [blame] | 469 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 470 | } else |
Ronald Cron | 0266cfe | 2021-03-13 18:50:11 +0100 | [diff] [blame] | 471 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS */ |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 472 | { |
| 473 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 474 | goto exit; |
| 475 | } |
| 476 | |
| 477 | /* Mbed TLS distinguishes "invalid padding" from "valid padding but |
| 478 | * the rest of the signature is invalid". This has little use in |
| 479 | * practice and PSA doesn't report this distinction. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 480 | status = (ret == MBEDTLS_ERR_RSA_INVALID_PADDING) ? |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 481 | PSA_ERROR_INVALID_SIGNATURE : |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 482 | mbedtls_to_psa_error(ret); |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 483 | |
| 484 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 485 | mbedtls_rsa_free(rsa); |
| 486 | mbedtls_free(rsa); |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 487 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 488 | return status; |
Ronald Cron | 7bdbca3 | 2020-12-09 13:34:54 +0100 | [diff] [blame] | 489 | } |
| 490 | |
Ronald Cron | d2fb854 | 2020-12-09 15:18:01 +0100 | [diff] [blame] | 491 | #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || |
| 492 | * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */ |
| 493 | |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 494 | /****************************************************************/ |
| 495 | /* Asymmetric cryptography */ |
| 496 | /****************************************************************/ |
| 497 | |
| 498 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 499 | static int psa_rsa_oaep_set_padding_mode(psa_algorithm_t alg, |
| 500 | mbedtls_rsa_context *rsa) |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 501 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 502 | psa_algorithm_t hash_alg = PSA_ALG_RSA_OAEP_GET_HASH(alg); |
Manuel Pégourié-Gonnard | 2d6d993 | 2023-03-28 11:38:08 +0200 | [diff] [blame] | 503 | mbedtls_md_type_t md_alg = mbedtls_md_type_from_psa_alg(hash_alg); |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 504 | |
Manuel Pégourié-Gonnard | eb59204 | 2023-05-31 10:48:38 +0200 | [diff] [blame] | 505 | /* Just to get the error status right, as rsa_set_padding() doesn't |
| 506 | * distinguish between "bad RSA algorithm" and "unknown hash". */ |
| 507 | if (mbedtls_md_info_from_type(md_alg) == NULL) { |
| 508 | return PSA_ERROR_NOT_SUPPORTED; |
| 509 | } |
| 510 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 511 | return mbedtls_rsa_set_padding(rsa, MBEDTLS_RSA_PKCS_V21, md_alg); |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 512 | } |
| 513 | #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */ |
| 514 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 515 | psa_status_t mbedtls_psa_asymmetric_encrypt(const psa_key_attributes_t *attributes, |
| 516 | const uint8_t *key_buffer, |
| 517 | size_t key_buffer_size, |
| 518 | psa_algorithm_t alg, |
| 519 | const uint8_t *input, |
| 520 | size_t input_length, |
| 521 | const uint8_t *salt, |
| 522 | size_t salt_length, |
| 523 | uint8_t *output, |
| 524 | size_t output_size, |
| 525 | size_t *output_length) |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 526 | { |
| 527 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 528 | (void) key_buffer; |
| 529 | (void) key_buffer_size; |
| 530 | (void) input; |
| 531 | (void) input_length; |
| 532 | (void) salt; |
| 533 | (void) salt_length; |
| 534 | (void) output; |
| 535 | (void) output_size; |
| 536 | (void) output_length; |
| 537 | |
Gilles Peskine | 2f107ae | 2024-02-28 01:26:46 +0100 | [diff] [blame] | 538 | if (PSA_KEY_TYPE_IS_RSA(attributes->type)) { |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 539 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 540 | defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 541 | mbedtls_rsa_context *rsa = NULL; |
Gilles Peskine | 2f107ae | 2024-02-28 01:26:46 +0100 | [diff] [blame] | 542 | status = mbedtls_psa_rsa_load_representation(attributes->type, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 543 | key_buffer, |
| 544 | key_buffer_size, |
| 545 | &rsa); |
| 546 | if (status != PSA_SUCCESS) { |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 547 | goto rsa_exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 548 | } |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 549 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 550 | if (output_size < mbedtls_rsa_get_len(rsa)) { |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 551 | status = PSA_ERROR_BUFFER_TOO_SMALL; |
| 552 | goto rsa_exit; |
| 553 | } |
| 554 | #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || |
| 555 | * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 556 | if (alg == PSA_ALG_RSA_PKCS1V15_CRYPT) { |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 557 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) |
| 558 | status = mbedtls_to_psa_error( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 559 | mbedtls_rsa_pkcs1_encrypt(rsa, |
| 560 | mbedtls_psa_get_random, |
| 561 | MBEDTLS_PSA_RANDOM_STATE, |
| 562 | input_length, |
| 563 | input, |
| 564 | output)); |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 565 | #else |
| 566 | status = PSA_ERROR_NOT_SUPPORTED; |
| 567 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 568 | } else |
| 569 | if (PSA_ALG_IS_RSA_OAEP(alg)) { |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 570 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) |
| 571 | status = mbedtls_to_psa_error( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 572 | psa_rsa_oaep_set_padding_mode(alg, rsa)); |
| 573 | if (status != PSA_SUCCESS) { |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 574 | goto rsa_exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 575 | } |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 576 | |
| 577 | status = mbedtls_to_psa_error( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 578 | mbedtls_rsa_rsaes_oaep_encrypt(rsa, |
| 579 | mbedtls_psa_get_random, |
| 580 | MBEDTLS_PSA_RANDOM_STATE, |
| 581 | salt, salt_length, |
| 582 | input_length, |
| 583 | input, |
| 584 | output)); |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 585 | #else |
| 586 | status = PSA_ERROR_NOT_SUPPORTED; |
| 587 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 588 | } else { |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 589 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 590 | } |
| 591 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 592 | defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 593 | rsa_exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 594 | if (status == PSA_SUCCESS) { |
| 595 | *output_length = mbedtls_rsa_get_len(rsa); |
| 596 | } |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 597 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 598 | mbedtls_rsa_free(rsa); |
| 599 | mbedtls_free(rsa); |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 600 | #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || |
| 601 | * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 602 | } else { |
Przemyslaw Stekiel | 234f318 | 2021-12-09 11:13:58 +0100 | [diff] [blame] | 603 | status = PSA_ERROR_NOT_SUPPORTED; |
| 604 | } |
| 605 | |
| 606 | return status; |
| 607 | } |
| 608 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 609 | psa_status_t mbedtls_psa_asymmetric_decrypt(const psa_key_attributes_t *attributes, |
| 610 | const uint8_t *key_buffer, |
| 611 | size_t key_buffer_size, |
| 612 | psa_algorithm_t alg, |
| 613 | const uint8_t *input, |
| 614 | size_t input_length, |
| 615 | const uint8_t *salt, |
| 616 | size_t salt_length, |
| 617 | uint8_t *output, |
| 618 | size_t output_size, |
| 619 | size_t *output_length) |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 620 | { |
| 621 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 622 | (void) key_buffer; |
| 623 | (void) key_buffer_size; |
| 624 | (void) input; |
| 625 | (void) input_length; |
| 626 | (void) salt; |
| 627 | (void) salt_length; |
| 628 | (void) output; |
| 629 | (void) output_size; |
| 630 | (void) output_length; |
| 631 | |
| 632 | *output_length = 0; |
| 633 | |
Gilles Peskine | 2f107ae | 2024-02-28 01:26:46 +0100 | [diff] [blame] | 634 | if (attributes->type == PSA_KEY_TYPE_RSA_KEY_PAIR) { |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 635 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 636 | defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 637 | mbedtls_rsa_context *rsa = NULL; |
Gilles Peskine | 2f107ae | 2024-02-28 01:26:46 +0100 | [diff] [blame] | 638 | status = mbedtls_psa_rsa_load_representation(attributes->type, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 639 | key_buffer, |
| 640 | key_buffer_size, |
| 641 | &rsa); |
| 642 | if (status != PSA_SUCCESS) { |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 643 | goto rsa_exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 644 | } |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 645 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 646 | if (input_length != mbedtls_rsa_get_len(rsa)) { |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 647 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 648 | goto rsa_exit; |
| 649 | } |
| 650 | #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || |
| 651 | * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */ |
| 652 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 653 | if (alg == PSA_ALG_RSA_PKCS1V15_CRYPT) { |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 654 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) |
| 655 | status = mbedtls_to_psa_error( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 656 | mbedtls_rsa_pkcs1_decrypt(rsa, |
| 657 | mbedtls_psa_get_random, |
| 658 | MBEDTLS_PSA_RANDOM_STATE, |
| 659 | output_length, |
| 660 | input, |
| 661 | output, |
| 662 | output_size)); |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 663 | #else |
| 664 | status = PSA_ERROR_NOT_SUPPORTED; |
| 665 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 666 | } else |
| 667 | if (PSA_ALG_IS_RSA_OAEP(alg)) { |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 668 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) |
| 669 | status = mbedtls_to_psa_error( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 670 | psa_rsa_oaep_set_padding_mode(alg, rsa)); |
| 671 | if (status != PSA_SUCCESS) { |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 672 | goto rsa_exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 673 | } |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 674 | |
| 675 | status = mbedtls_to_psa_error( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 676 | mbedtls_rsa_rsaes_oaep_decrypt(rsa, |
| 677 | mbedtls_psa_get_random, |
| 678 | MBEDTLS_PSA_RANDOM_STATE, |
| 679 | salt, salt_length, |
| 680 | output_length, |
| 681 | input, |
| 682 | output, |
| 683 | output_size)); |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 684 | #else |
| 685 | status = PSA_ERROR_NOT_SUPPORTED; |
| 686 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 687 | } else { |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 688 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 689 | } |
| 690 | |
| 691 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 692 | defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 693 | rsa_exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 694 | mbedtls_rsa_free(rsa); |
| 695 | mbedtls_free(rsa); |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 696 | #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || |
| 697 | * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 698 | } else { |
Przemyslaw Stekiel | 2ecfd57 | 2021-12-13 09:08:05 +0100 | [diff] [blame] | 699 | status = PSA_ERROR_NOT_SUPPORTED; |
| 700 | } |
| 701 | |
| 702 | return status; |
| 703 | } |
| 704 | |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 705 | #endif /* MBEDTLS_PSA_CRYPTO_C */ |