blob: afeeb3d0c46f15a489020e9c50a084c80f3948be [file] [log] [blame]
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +02001/* BEGIN_HEADER */
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +00002#include "mbedtls/pk.h"
Valerio Setti452d2d22024-02-01 11:31:30 +01003#include "mbedtls/psa_util.h"
Valerio Setti483738e2023-05-17 15:37:29 +02004#include "pk_internal.h"
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +02005
Manuel Pégourié-Gonnard7c13d692014-11-12 00:01:34 +01006/* For error codes */
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05007#include "mbedtls/asn1.h"
8#include "mbedtls/base64.h"
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +00009#include "mbedtls/ecp.h"
Gilles Peskine03aa9bc2024-01-30 11:08:44 +010010#include "mbedtls/error.h"
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000011#include "mbedtls/rsa.h"
Valerio Setti3a815cb2024-02-14 09:54:18 +010012#include "rsa_internal.h"
Valerio Setti77a75682023-05-15 11:18:46 +020013#include "pk_internal.h"
Manuel Pégourié-Gonnard7c13d692014-11-12 00:01:34 +010014
Andres Amaya Garcia7ea67272017-05-08 11:15:49 +010015#include <limits.h>
Andres Amaya Garcia6ff067d2017-06-09 14:26:59 +010016#include <stdint.h>
Andres AG5c79d252017-02-15 10:52:32 +000017
Gilles Peskine33b1c692019-12-19 00:09:47 +010018/* Needed only for test case data under #if defined(MBEDTLS_USE_PSA_CRYPTO),
19 * but the test code generator requires test case data to be valid C code
Dave Rodgman017a1992022-03-31 14:07:01 +010020 * unconditionally (https://github.com/Mbed-TLS/mbedtls/issues/2023). */
Gilles Peskine33b1c692019-12-19 00:09:47 +010021#include "psa/crypto.h"
Valerio Setti384fbde2024-01-02 13:26:40 +010022#include "mbedtls/psa_util.h"
Gilles Peskine33b1c692019-12-19 00:09:47 +010023
Gilles Peskine2ec141a2024-02-15 17:22:37 +010024#include <test/psa_exercise_key.h>
25
Valerio Setti144c27b2024-03-20 17:10:35 +010026/* Needed for the definition of MBEDTLS_PK_WRITE_PUBKEY_MAX_SIZE. */
27#include "pkwrite.h"
28
Waleed Elmelegyd7bdbbe2023-07-20 16:26:58 +000029#define RSA_KEY_SIZE MBEDTLS_RSA_GEN_KEY_MIN_BITS
30#define RSA_KEY_LEN (MBEDTLS_RSA_GEN_KEY_MIN_BITS/8)
Manuel Pégourié-Gonnard01488752014-04-03 22:09:18 +020031
Gilles Peskine74860dd2024-02-12 14:25:18 +010032#if defined(MBEDTLS_RSA_C) || \
33 defined(MBEDTLS_PK_RSA_ALT_SUPPORT) || \
34 defined(MBEDTLS_ECDSA_C) || \
35 defined(MBEDTLS_USE_PSA_CRYPTO)
36#define PK_CAN_SIGN_SOME
37#endif
38
Yanray Wang61f96602023-09-25 14:13:22 +080039/* MBEDTLS_TEST_PK_PSA_SIGN is enabled when:
40 * - The build has PK_[PARSE/WRITE]_C for RSA or ECDSA signature.
41 * - The build has built-in ECC and ECDSA signature.
42 */
43#if (defined(MBEDTLS_PK_PARSE_C) && defined(MBEDTLS_PK_WRITE_C) && \
44 ((defined(MBEDTLS_RSA_C) && defined(MBEDTLS_GENPRIME)) || \
45 defined(MBEDTLS_PK_CAN_ECDSA_SIGN))) || \
46 (defined(MBEDTLS_ECP_C) && defined(MBEDTLS_PK_CAN_ECDSA_SIGN))
47#define MBEDTLS_TEST_PK_PSA_SIGN
48#endif
49
Gilles Peskine735ac3e2024-02-06 11:11:32 +010050#if defined(MBEDTLS_PSA_CRYPTO_C) && defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)
Gilles Peskine48b87eb2024-02-07 18:40:25 +010051/* Pick an elliptic curve that's supported by PSA. Note that the curve is
52 * not guaranteed to be supported by the ECP module.
53 *
54 * This should always find a curve if ECC is enabled in the build, except in
55 * one edge case: in a build with MBEDTLS_PSA_CRYPTO_CONFIG disabled and
56 * where the only legacy curve is secp224k1, which is not supported in PSA,
57 * PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY ends up enabled but PSA does not
58 * support any curve.
59 */
60
61/* First try all the curves that can do both ECDSA and ECDH, then try
62 * the ECDH-only curves. (There are no curves that can do ECDSA but not ECDH.)
63 * This way, if ECDSA is enabled then the curve that's selected here will
64 * be ECDSA-capable, and likewise for ECDH. */
65#if defined(PSA_WANT_ECC_SECP_R1_192)
66#define MBEDTLS_TEST_PSA_ECC_ONE_FAMILY PSA_ECC_FAMILY_SECP_R1
Gilles Peskinecbd2cbb2024-02-15 13:12:44 +010067#define MBEDTLS_TEST_PSA_ECC_ONE_CURVE_BITS 192
Gilles Peskine48b87eb2024-02-07 18:40:25 +010068#define MBEDTLS_TEST_ECP_DP_ONE_CURVE MBEDTLS_ECP_DP_SECP192R1
69#elif defined(PSA_WANT_ECC_SECP_R1_224)
70#define MBEDTLS_TEST_PSA_ECC_ONE_FAMILY PSA_ECC_FAMILY_SECP_R1
Gilles Peskinecbd2cbb2024-02-15 13:12:44 +010071#define MBEDTLS_TEST_PSA_ECC_ONE_CURVE_BITS 224
Gilles Peskine48b87eb2024-02-07 18:40:25 +010072#define MBEDTLS_TEST_ECP_DP_ONE_CURVE MBEDTLS_ECP_DP_SECP224R1
73#elif defined(PSA_WANT_ECC_SECP_R1_256)
74#define MBEDTLS_TEST_PSA_ECC_ONE_FAMILY PSA_ECC_FAMILY_SECP_R1
Gilles Peskinecbd2cbb2024-02-15 13:12:44 +010075#define MBEDTLS_TEST_PSA_ECC_ONE_CURVE_BITS 256
Gilles Peskine48b87eb2024-02-07 18:40:25 +010076#define MBEDTLS_TEST_ECP_DP_ONE_CURVE MBEDTLS_ECP_DP_SECP256R1
77#elif defined(PSA_WANT_ECC_SECP_R1_384)
78#define MBEDTLS_TEST_PSA_ECC_ONE_FAMILY PSA_ECC_FAMILY_SECP_R1
Gilles Peskinecbd2cbb2024-02-15 13:12:44 +010079#define MBEDTLS_TEST_PSA_ECC_ONE_CURVE_BITS 384
Gilles Peskine48b87eb2024-02-07 18:40:25 +010080#define MBEDTLS_TEST_ECP_DP_ONE_CURVE MBEDTLS_ECP_DP_SECP384R1
81#elif defined(PSA_WANT_ECC_SECP_R1_521)
82#define MBEDTLS_TEST_PSA_ECC_ONE_FAMILY PSA_ECC_FAMILY_SECP_R1
Gilles Peskinecbd2cbb2024-02-15 13:12:44 +010083#define MBEDTLS_TEST_PSA_ECC_ONE_CURVE_BITS 521
Gilles Peskine48b87eb2024-02-07 18:40:25 +010084#define MBEDTLS_TEST_ECP_DP_ONE_CURVE MBEDTLS_ECP_DP_SECP521R1
85#elif defined(PSA_WANT_ECC_SECP_K1_192)
86#define MBEDTLS_TEST_PSA_ECC_ONE_FAMILY PSA_ECC_FAMILY_SECP_K1
Gilles Peskinecbd2cbb2024-02-15 13:12:44 +010087#define MBEDTLS_TEST_PSA_ECC_ONE_CURVE_BITS 192
Gilles Peskine48b87eb2024-02-07 18:40:25 +010088#define MBEDTLS_TEST_ECP_DP_ONE_CURVE MBEDTLS_ECP_DP_SECP192K1
89#elif defined(PSA_WANT_ECC_SECP_K1_224)
90#define MBEDTLS_TEST_PSA_ECC_ONE_FAMILY PSA_ECC_FAMILY_SECP_K1
Gilles Peskinecbd2cbb2024-02-15 13:12:44 +010091#define MBEDTLS_TEST_PSA_ECC_ONE_CURVE_BITS 224
Gilles Peskine48b87eb2024-02-07 18:40:25 +010092#define MBEDTLS_TEST_ECP_DP_ONE_CURVE MBEDTLS_ECP_DP_SECP224K1
93#elif defined(PSA_WANT_ECC_SECP_K1_256)
94#define MBEDTLS_TEST_PSA_ECC_ONE_FAMILY PSA_ECC_FAMILY_SECP_K1
Gilles Peskinecbd2cbb2024-02-15 13:12:44 +010095#define MBEDTLS_TEST_PSA_ECC_ONE_CURVE_BITS 256
Gilles Peskine48b87eb2024-02-07 18:40:25 +010096#define MBEDTLS_TEST_ECP_DP_ONE_CURVE MBEDTLS_ECP_DP_SECP256K1
97#elif defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256)
98#define MBEDTLS_TEST_PSA_ECC_ONE_FAMILY PSA_ECC_FAMILY_BRAINPOOL_P_R1
Gilles Peskinecbd2cbb2024-02-15 13:12:44 +010099#define MBEDTLS_TEST_PSA_ECC_ONE_CURVE_BITS 256
Gilles Peskine48b87eb2024-02-07 18:40:25 +0100100#define MBEDTLS_TEST_ECP_DP_ONE_CURVE MBEDTLS_ECP_DP_BP256R1
101#elif defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384)
102#define MBEDTLS_TEST_PSA_ECC_ONE_FAMILY PSA_ECC_FAMILY_BRAINPOOL_P_R1
Gilles Peskinecbd2cbb2024-02-15 13:12:44 +0100103#define MBEDTLS_TEST_PSA_ECC_ONE_CURVE_BITS 384
Gilles Peskine48b87eb2024-02-07 18:40:25 +0100104#define MBEDTLS_TEST_ECP_DP_ONE_CURVE MBEDTLS_ECP_DP_BP384R1
105#elif defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512)
106#define MBEDTLS_TEST_PSA_ECC_ONE_FAMILY PSA_ECC_FAMILY_BRAINPOOL_P_R1
Gilles Peskinecbd2cbb2024-02-15 13:12:44 +0100107#define MBEDTLS_TEST_PSA_ECC_ONE_CURVE_BITS 512
Gilles Peskine48b87eb2024-02-07 18:40:25 +0100108#define MBEDTLS_TEST_ECP_DP_ONE_CURVE MBEDTLS_ECP_DP_BP512R1
109#elif defined(PSA_WANT_ECC_MONTGOMERY_255)
110#define MBEDTLS_TEST_PSA_ECC_ONE_FAMILY PSA_ECC_FAMILY_MONTGOMERY
Gilles Peskinecbd2cbb2024-02-15 13:12:44 +0100111#define MBEDTLS_TEST_PSA_ECC_ONE_CURVE_BITS 255
Gilles Peskine48b87eb2024-02-07 18:40:25 +0100112#define MBEDTLS_TEST_ECP_DP_ONE_CURVE MBEDTLS_ECP_DP_CURVE25519
113#elif defined(PSA_WANT_ECC_MONTGOMERY_448)
114#define MBEDTLS_TEST_PSA_ECC_ONE_FAMILY PSA_ECC_FAMILY_MONTGOMERY
Gilles Peskinecbd2cbb2024-02-15 13:12:44 +0100115#define MBEDTLS_TEST_PSA_ECC_ONE_CURVE_BITS 448
Gilles Peskine48b87eb2024-02-07 18:40:25 +0100116#define MBEDTLS_TEST_ECP_DP_ONE_CURVE MBEDTLS_ECP_DP_CURVE448
117#endif /* curve selection */
118
119#if defined(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY)
Gilles Peskine735ac3e2024-02-06 11:11:32 +0100120#define MBEDTLS_TEST_PSA_ECC_AT_LEAST_ONE_CURVE
121#endif
Gilles Peskine48b87eb2024-02-07 18:40:25 +0100122
Gilles Peskine10e9c412024-02-09 19:29:08 +0100123/* Pick a second curve, for tests that need two supported curves of the
124 * same size. For simplicity, we only handle a subset of configurations,
125 * and both curves will support both ECDH and ECDSA. */
126#if defined(PSA_WANT_ECC_SECP_R1_192) && defined(PSA_WANT_ECC_SECP_K1_192)
127/* Identical redefinition of the ONE macros, to confirm that they have
128 * the values we expect here. */
129#define MBEDTLS_TEST_PSA_ECC_ONE_FAMILY PSA_ECC_FAMILY_SECP_R1
130#define MBEDTLS_TEST_PSA_ECC_ANOTHER_FAMILY PSA_ECC_FAMILY_SECP_K1
Gilles Peskinecbd2cbb2024-02-15 13:12:44 +0100131#define MBEDTLS_TEST_PSA_ECC_ONE_CURVE_BITS 192
Gilles Peskine10e9c412024-02-09 19:29:08 +0100132#define MBEDTLS_TEST_PSA_ECC_HAVE_TWO_FAMILIES
133#elif defined(PSA_WANT_ECC_SECP_R1_256) && defined(PSA_WANT_ECC_SECP_K1_256)
134#define MBEDTLS_TEST_PSA_ECC_ONE_FAMILY PSA_ECC_FAMILY_SECP_R1
135#define MBEDTLS_TEST_PSA_ECC_ANOTHER_FAMILY PSA_ECC_FAMILY_SECP_K1
Gilles Peskinecbd2cbb2024-02-15 13:12:44 +0100136#define MBEDTLS_TEST_PSA_ECC_ONE_CURVE_BITS 256
Gilles Peskine10e9c412024-02-09 19:29:08 +0100137#define MBEDTLS_TEST_PSA_ECC_HAVE_TWO_FAMILIES
Gilles Peskine10e9c412024-02-09 19:29:08 +0100138#endif
139
Gilles Peskined6fc3502024-02-15 13:53:03 +0100140/* Pick a second bit-size, for tests that need two supported curves of the
141 * same family. For simplicity, we only handle a subset of configurations,
142 * and both curves will support both ECDH and ECDSA. */
143#if defined(PSA_WANT_ECC_SECP_R1_192) && defined(PSA_WANT_ECC_SECP_R1_256)
144/* Identical redefinition of the ONE macros, to confirm that they have
145 * the values we expect here. */
146#define MBEDTLS_TEST_PSA_ECC_ONE_FAMILY PSA_ECC_FAMILY_SECP_R1
147#define MBEDTLS_TEST_PSA_ECC_ONE_CURVE_BITS 192
148#define MBEDTLS_TEST_PSA_ECC_ANOTHER_CURVE_BITS 256
149#define MBEDTLS_TEST_PSA_ECC_HAVE_TWO_BITS
150#elif defined(PSA_WANT_ECC_SECP_R1_256) && defined(PSA_WANT_ECC_SECP_R1_384)
151#define MBEDTLS_TEST_PSA_ECC_ONE_FAMILY PSA_ECC_FAMILY_SECP_R1
152#define MBEDTLS_TEST_PSA_ECC_ONE_CURVE_BITS 256
153#define MBEDTLS_TEST_PSA_ECC_ANOTHER_CURVE_BITS 384
154#define MBEDTLS_TEST_PSA_ECC_HAVE_TWO_BITS
155#endif
156
Gilles Peskine48b87eb2024-02-07 18:40:25 +0100157#endif /* defined(MBEDTLS_PSA_CRYPTO_C) && defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) */
Gilles Peskine735ac3e2024-02-06 11:11:32 +0100158
Gilles Peskine1d338762024-02-12 14:18:26 +0100159/* Always define the macros so that we can use them in test data. */
160#if !defined(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY)
161#define MBEDTLS_TEST_PSA_ECC_ONE_FAMILY 0
Gilles Peskinecbd2cbb2024-02-15 13:12:44 +0100162#define MBEDTLS_TEST_PSA_ECC_ONE_CURVE_BITS 0
Gilles Peskine1d338762024-02-12 14:18:26 +0100163#define MBEDTLS_TEST_ECP_DP_ONE_CURVE 0
164#endif
165#if !defined(MBEDTLS_TEST_PSA_ECC_ANOTHER_FAMILY)
166#define MBEDTLS_TEST_PSA_ECC_ANOTHER_FAMILY 0
167#endif
Gilles Peskined6fc3502024-02-15 13:53:03 +0100168#if !defined(MBEDTLS_TEST_PSA_ECC_ANOTHER_CURVE_BITS)
169#define MBEDTLS_TEST_PSA_ECC_ANOTHER_CURVE_BITS 0
170#endif
Gilles Peskine1d338762024-02-12 14:18:26 +0100171
Valerio Settiab7ddbc2024-02-29 09:30:05 +0100172/* Get an available MD alg to be used in sign/verify tests. */
173#if defined(MBEDTLS_MD_CAN_SHA1)
174#define MBEDTLS_MD_ALG_FOR_TEST MBEDTLS_MD_SHA1
175#elif defined(MBEDTLS_MD_CAN_SHA224)
176#define MBEDTLS_MD_ALG_FOR_TEST MBEDTLS_MD_SHA224
177#elif defined(MBEDTLS_MD_CAN_SHA256)
178#define MBEDTLS_MD_ALG_FOR_TEST MBEDTLS_MD_SHA256
179#elif defined(MBEDTLS_MD_CAN_SHA384)
180#define MBEDTLS_MD_ALG_FOR_TEST MBEDTLS_MD_SHA384
181#elif defined(MBEDTLS_MD_CAN_SHA512)
182#define MBEDTLS_MD_ALG_FOR_TEST MBEDTLS_MD_SHA512
183#endif
184
Valerio Setti414daf12024-03-21 10:53:44 +0100185const char *curve_names_lut[] = {
186 [MBEDTLS_ECP_DP_SECP192R1] = "secp192r1",
187 [MBEDTLS_ECP_DP_SECP256R1] = "secp256r1",
188 [MBEDTLS_ECP_DP_SECP384R1] = "secp384r1",
189 [MBEDTLS_ECP_DP_SECP521R1] = "secp521r1",
190 [MBEDTLS_ECP_DP_BP256R1] = "brainpoolP256r1",
191 [MBEDTLS_ECP_DP_BP384R1] = "brainpoolP384r1",
192 [MBEDTLS_ECP_DP_BP512R1] = "brainpoolP512r1",
193 [MBEDTLS_ECP_DP_CURVE25519] = "x25519",
194 [MBEDTLS_ECP_DP_SECP192K1] = "secp192k1",
195 [MBEDTLS_ECP_DP_SECP256K1] = "secp256k1",
196 [MBEDTLS_ECP_DP_CURVE448] = "x448",
197};
Valerio Settib6891b12023-04-03 16:01:47 +0200198
Valerio Setti414daf12024-03-21 10:53:44 +0100199/** Fill the provided PK context with a proper key.
200 *
201 * Instead of generating a new key every time, use predefined ones to speed up
202 * testing.
203 * This function assumes that the PK context has already been setup
204 * (mbedtls_pk_setup() has been called on the PK context ) so that it
205 * can determine the key type to be loaded from the PK context itself.
Gilles Peskinee48fe552019-11-05 16:42:13 +0100206 *
Tomi Fontanilles9c693482023-12-14 21:40:54 +0200207 * \param pk The PK object to fill. It must have been initialized
208 * with mbedtls_pk_setup().
209 * \param curve_or_keybits - For RSA keys, the key size in bits.
210 * - For EC keys, the curve (\c MBEDTLS_ECP_DP_xxx).
Gilles Peskinee48fe552019-11-05 16:42:13 +0100211 *
Valerio Setti414daf12024-03-21 10:53:44 +0100212 * \return 0 on success or a negative value otherwise.
Gilles Peskinee48fe552019-11-05 16:42:13 +0100213 */
Tomi Fontanilles9c693482023-12-14 21:40:54 +0200214static int pk_genkey(mbedtls_pk_context *pk, int curve_or_keybits)
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +0200215{
Valerio Setti414daf12024-03-21 10:53:44 +0100216 char file_name[128] = { 0 };
217 int ret;
218 /* Dump pk_info since this is overridden by mbedtls_pk_parse_keyfile(). */
219 const mbedtls_pk_info_t *original_pk_info = pk->pk_info;
Paul Bakkera5320902013-12-19 17:29:52 +0100220
Gilles Peskine449bd832023-01-11 14:50:10 +0100221 if (mbedtls_pk_get_type(pk) == MBEDTLS_PK_RSA) {
Valerio Setti414daf12024-03-21 10:53:44 +0100222 sprintf(file_name, "data_files/rsa_%d.der", curve_or_keybits);
223 } else if (mbedtls_pk_get_type(pk) == MBEDTLS_PK_ECKEY ||
224 mbedtls_pk_get_type(pk) == MBEDTLS_PK_ECKEY_DH ||
225 mbedtls_pk_get_type(pk) == MBEDTLS_PK_ECDSA) {
226 sprintf(file_name, "data_files/ec_%s.der", curve_names_lut[curve_or_keybits]);
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +0200227 }
Valerio Setti483738e2023-05-17 15:37:29 +0200228
Valerio Setti414daf12024-03-21 10:53:44 +0100229 ret = mbedtls_pk_parse_keyfile(pk, file_name, NULL, mbedtls_test_rnd_std_rand, NULL);
230 /* Restore pk_info. */
231 pk->pk_info = original_pk_info;
Gilles Peskinef3dbc982024-01-23 11:05:34 +0100232
Valerio Setti414daf12024-03-21 10:53:44 +0100233 return ret;
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +0200234}
Manuel Pégourié-Gonnard01488752014-04-03 22:09:18 +0200235
Gilles Peskine7e353ba2024-02-01 20:46:19 +0100236#if defined(MBEDTLS_PSA_CRYPTO_C)
237static psa_key_usage_t pk_get_psa_attributes_implied_usage(
238 psa_key_usage_t expected_usage)
239{
240 /* Usage implied universally */
241 if (expected_usage & PSA_KEY_USAGE_SIGN_HASH) {
242 expected_usage |= PSA_KEY_USAGE_SIGN_MESSAGE;
243 }
244 if (expected_usage & PSA_KEY_USAGE_VERIFY_HASH) {
245 expected_usage |= PSA_KEY_USAGE_VERIFY_MESSAGE;
246 }
247 /* Usage implied by mbedtls_pk_get_psa_attributes() */
248 if (expected_usage & PSA_KEY_USAGE_SIGN_HASH) {
249 expected_usage |= PSA_KEY_USAGE_VERIFY_HASH;
250 }
251 if (expected_usage & PSA_KEY_USAGE_SIGN_MESSAGE) {
252 expected_usage |= PSA_KEY_USAGE_VERIFY_MESSAGE;
253 }
254 if (expected_usage & PSA_KEY_USAGE_DECRYPT) {
255 expected_usage |= PSA_KEY_USAGE_ENCRYPT;
256 }
257 expected_usage |= PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_COPY;
258 return expected_usage;
259}
Gilles Peskinebf69f2e2024-03-06 13:39:01 +0100260
261#define RSA_WRITE_PUBKEY_MAX_SIZE \
262 PSA_KEY_EXPORT_RSA_PUBLIC_KEY_MAX_SIZE(PSA_VENDOR_RSA_MAX_KEY_BITS)
263#define ECP_WRITE_PUBKEY_MAX_SIZE \
264 PSA_KEY_EXPORT_ECC_PUBLIC_KEY_MAX_SIZE(PSA_VENDOR_ECC_MAX_CURVE_BITS)
265static int pk_public_same(const mbedtls_pk_context *pk1,
266 const mbedtls_pk_context *pk2)
267{
268 int ok = 0;
269
270 mbedtls_pk_type_t type = mbedtls_pk_get_type(pk1);
271 TEST_EQUAL(type, mbedtls_pk_get_type(pk2));
272
273 switch (type) {
274#if defined(MBEDTLS_RSA_C)
275 case MBEDTLS_PK_RSA:
276 {
277 const mbedtls_rsa_context *rsa1 = mbedtls_pk_rsa(*pk1);
278 const mbedtls_rsa_context *rsa2 = mbedtls_pk_rsa(*pk2);
279 TEST_EQUAL(mbedtls_rsa_get_padding_mode(rsa1),
280 mbedtls_rsa_get_padding_mode(rsa2));
281 TEST_EQUAL(mbedtls_rsa_get_md_alg(rsa1),
282 mbedtls_rsa_get_md_alg(rsa2));
283 unsigned char buf1[RSA_WRITE_PUBKEY_MAX_SIZE];
284 unsigned char *p1 = buf1 + sizeof(buf1);
285 int len1 = mbedtls_rsa_write_pubkey(rsa1, buf1, &p1);
286 TEST_LE_U(0, len1);
287 unsigned char buf2[RSA_WRITE_PUBKEY_MAX_SIZE];
288 unsigned char *p2 = buf2 + sizeof(buf2);
289 int len2 = mbedtls_rsa_write_pubkey(rsa2, buf2, &p2);
290 TEST_LE_U(0, len2);
291 TEST_MEMORY_COMPARE(p1, len1, p2, len2);
292 break;
293 }
294#endif /* MBEDTLS_RSA_C */
295
296#if defined(MBEDTLS_PK_HAVE_ECC_KEYS)
297 case MBEDTLS_PK_ECKEY:
298 case MBEDTLS_PK_ECKEY_DH:
299 case MBEDTLS_PK_ECDSA:
300 {
301#if defined(MBEDTLS_PK_USE_PSA_EC_DATA)
302 TEST_MEMORY_COMPARE(pk1->pub_raw, pk1->pub_raw_len,
303 pk2->pub_raw, pk2->pub_raw_len);
304 TEST_EQUAL(pk1->ec_family, pk2->ec_family);
305 TEST_EQUAL(pk1->ec_bits, pk2->ec_bits);
306
307#else /* MBEDTLS_PK_USE_PSA_EC_DATA */
308 const mbedtls_ecp_keypair *ec1 = mbedtls_pk_ec_ro(*pk1);
309 const mbedtls_ecp_keypair *ec2 = mbedtls_pk_ec_ro(*pk2);
310 TEST_EQUAL(mbedtls_ecp_keypair_get_group_id(ec1),
311 mbedtls_ecp_keypair_get_group_id(ec2));
312 unsigned char buf1[ECP_WRITE_PUBKEY_MAX_SIZE];
313 size_t len1 = 99999991;
314 TEST_EQUAL(mbedtls_ecp_write_public_key(
315 ec1, MBEDTLS_ECP_PF_UNCOMPRESSED,
316 &len1, buf1, sizeof(buf1)), 0);
317 unsigned char buf2[ECP_WRITE_PUBKEY_MAX_SIZE];
318 size_t len2 = 99999992;
319 TEST_EQUAL(mbedtls_ecp_write_public_key(
320 ec2, MBEDTLS_ECP_PF_UNCOMPRESSED,
321 &len2, buf2, sizeof(buf2)), 0);
322 TEST_MEMORY_COMPARE(buf1, len1, buf2, len2);
323#endif /* MBEDTLS_PK_USE_PSA_EC_DATA */
324 }
325 break;
326#endif /* MBEDTLS_PK_HAVE_ECC_KEYS */
327
328 default:
329 TEST_FAIL("Unsupported pk type in pk_public_same");
330 }
331
332 ok = 1;
333
334exit:
335 return ok;
336}
Gilles Peskine7e353ba2024-02-01 20:46:19 +0100337#endif /* MBEDTLS_PSA_CRYPTO_C */
338
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200339#if defined(MBEDTLS_RSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +0100340int mbedtls_rsa_decrypt_func(void *ctx, size_t *olen,
341 const unsigned char *input, unsigned char *output,
342 size_t output_max_len)
Manuel Pégourié-Gonnard01488752014-04-03 22:09:18 +0200343{
Gilles Peskine449bd832023-01-11 14:50:10 +0100344 return mbedtls_rsa_pkcs1_decrypt((mbedtls_rsa_context *) ctx,
345 mbedtls_test_rnd_std_rand, NULL,
346 olen, input, output, output_max_len);
Manuel Pégourié-Gonnard01488752014-04-03 22:09:18 +0200347}
Gilles Peskine449bd832023-01-11 14:50:10 +0100348int mbedtls_rsa_sign_func(void *ctx,
349 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng,
350 mbedtls_md_type_t md_alg, unsigned int hashlen,
351 const unsigned char *hash, unsigned char *sig)
Manuel Pégourié-Gonnard01488752014-04-03 22:09:18 +0200352{
Hanno Beckera5400682017-05-03 16:43:15 +0100353 ((void) f_rng);
354 ((void) p_rng);
Gilles Peskine449bd832023-01-11 14:50:10 +0100355 return mbedtls_rsa_pkcs1_sign((mbedtls_rsa_context *) ctx,
356 mbedtls_test_rnd_std_rand, NULL,
357 md_alg, hashlen, hash, sig);
Manuel Pégourié-Gonnard01488752014-04-03 22:09:18 +0200358}
Gilles Peskine449bd832023-01-11 14:50:10 +0100359size_t mbedtls_rsa_key_len_func(void *ctx)
Manuel Pégourié-Gonnard01488752014-04-03 22:09:18 +0200360{
Gilles Peskine449bd832023-01-11 14:50:10 +0100361 return ((const mbedtls_rsa_context *) ctx)->len;
Manuel Pégourié-Gonnard01488752014-04-03 22:09:18 +0200362}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200363#endif /* MBEDTLS_RSA_C */
Manuel Pégourié-Gonnard01a12c42018-10-31 10:28:01 +0100364
Gilles Peskine68a287d2024-02-15 13:30:55 +0100365typedef enum {
366 /* The values are compatible with thinking of "from pair" as a boolean. */
367 FROM_PUBLIC = 0,
368 FROM_PAIR = 1
369} from_pair_t;
370
Gilles Peskine0b172552024-01-18 14:11:26 +0100371#if defined(MBEDTLS_PSA_CRYPTO_C)
372static int pk_setup_for_type(mbedtls_pk_type_t pk_type, int want_pair,
373 mbedtls_pk_context *pk, psa_key_type_t *psa_type)
374{
Gilles Peskine0b172552024-01-18 14:11:26 +0100375 if (pk_type == MBEDTLS_PK_NONE) {
Gilles Peskine03aa9bc2024-01-30 11:08:44 +0100376 return 0;
Gilles Peskine0b172552024-01-18 14:11:26 +0100377 }
378 TEST_EQUAL(mbedtls_pk_setup(pk, mbedtls_pk_info_from_type(pk_type)), 0);
379
380 switch (pk_type) {
Gilles Peskine6ea18362024-01-18 14:16:27 +0100381#if defined(MBEDTLS_RSA_C)
382 case MBEDTLS_PK_RSA:
383 {
384 *psa_type = PSA_KEY_TYPE_RSA_KEY_PAIR;
385 mbedtls_rsa_context *rsa = mbedtls_pk_rsa(*pk);
386 if (want_pair) {
Gilles Peskine77faddf2024-01-24 10:50:17 +0100387#if defined(MBEDTLS_GENPRIME)
Gilles Peskine6ea18362024-01-18 14:16:27 +0100388 TEST_EQUAL(mbedtls_rsa_gen_key(
389 rsa,
390 mbedtls_test_rnd_std_rand, NULL,
391 MBEDTLS_RSA_GEN_KEY_MIN_BITS, 65537), 0);
Gilles Peskine77faddf2024-01-24 10:50:17 +0100392#else
393 TEST_FAIL("I don't know how to create an RSA key pair in this configuration.");
394#endif
Gilles Peskine6ea18362024-01-18 14:16:27 +0100395 } else {
396 unsigned char N[PSA_BITS_TO_BYTES(MBEDTLS_RSA_GEN_KEY_MIN_BITS)] = { 0xff };
397 N[sizeof(N) - 1] = 0x03;
Gilles Peskineace7c772024-01-18 17:47:54 +0100398 const unsigned char E[1] = { 0x03 };
Gilles Peskine6ea18362024-01-18 14:16:27 +0100399 TEST_EQUAL(mbedtls_rsa_import_raw(rsa,
400 N, sizeof(N),
401 NULL, 0, NULL, 0, NULL, 0,
402 E, sizeof(E)), 0);
403 TEST_EQUAL(mbedtls_rsa_complete(rsa), 0);
404 }
405 break;
406 }
407#endif /* MBEDTLS_RSA_C */
408
Gilles Peskineace7c772024-01-18 17:47:54 +0100409#if defined(MBEDTLS_PK_HAVE_ECC_KEYS)
410 case MBEDTLS_PK_ECKEY:
411 case MBEDTLS_PK_ECKEY_DH:
412 case MBEDTLS_PK_ECDSA:
413 {
Gilles Peskine48b87eb2024-02-07 18:40:25 +0100414 mbedtls_ecp_group_id grp_id = MBEDTLS_TEST_ECP_DP_ONE_CURVE;
Gilles Peskineace7c772024-01-18 17:47:54 +0100415 size_t bits;
416 *psa_type = PSA_KEY_TYPE_ECC_KEY_PAIR(mbedtls_ecc_group_to_psa(grp_id, &bits));
417 TEST_EQUAL(pk_genkey(pk, grp_id), 0);
418 if (!want_pair) {
Gilles Peskinef3dbc982024-01-23 11:05:34 +0100419#if defined(MBEDTLS_PK_USE_PSA_EC_DATA)
420 psa_key_attributes_t pub_attributes = PSA_KEY_ATTRIBUTES_INIT;
421 psa_set_key_type(&pub_attributes,
422 PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(*psa_type));
423 psa_set_key_usage_flags(&pub_attributes,
424 PSA_KEY_USAGE_EXPORT |
425 PSA_KEY_USAGE_COPY |
426 PSA_KEY_USAGE_VERIFY_MESSAGE |
427 PSA_KEY_USAGE_VERIFY_HASH);
428 psa_set_key_algorithm(&pub_attributes, PSA_ALG_ECDSA_ANY);
429 PSA_ASSERT(psa_destroy_key(pk->priv_id));
Gilles Peskinecb3b4ca2024-02-02 13:12:39 +0100430 pk->priv_id = MBEDTLS_SVC_KEY_ID_INIT;
Gilles Peskinef3dbc982024-01-23 11:05:34 +0100431#else
Gilles Peskineae2668b2024-02-01 20:48:04 +0100432 mbedtls_ecp_keypair *ec = mbedtls_pk_ec_rw(*pk);
Gilles Peskineace7c772024-01-18 17:47:54 +0100433 mbedtls_mpi_free(&ec->d);
Gilles Peskinef3dbc982024-01-23 11:05:34 +0100434#endif
Gilles Peskineace7c772024-01-18 17:47:54 +0100435 }
436 break;
437 }
438#endif /* MBEDTLS_PK_HAVE_ECC_KEYS */
439
Gilles Peskine0b172552024-01-18 14:11:26 +0100440 default:
441 TEST_FAIL("Unknown PK type in test data");
442 break;
443 }
444
445 if (!want_pair) {
446 *psa_type = PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(*psa_type);
447 }
Gilles Peskine03aa9bc2024-01-30 11:08:44 +0100448 return 0;
Gilles Peskine0b172552024-01-18 14:11:26 +0100449
450exit:
Gilles Peskine03aa9bc2024-01-30 11:08:44 +0100451 return MBEDTLS_ERR_ERROR_GENERIC_ERROR;
Gilles Peskine0b172552024-01-18 14:11:26 +0100452}
453#endif
454
Valerio Setti01ba66d2024-02-09 11:35:42 +0100455#if defined(MBEDTLS_PSA_CRYPTO_C)
Valerio Setti4114a542024-02-28 16:32:01 +0100456/* Create a new PSA key which will contain only the public part of the private
457 * key which is provided in input. For this new key:
458 * - Type is the public counterpart of the private key.
459 * - Usage is the copied from the original private key, but the PSA_KEY_USAGE_EXPORT
Valerio Setti6f5f9f52024-03-11 10:04:54 +0100460 * flag is removed. This is to prove that mbedtls_pk_copy_from_psa() doesn't
461 * require the key to have the EXPORT flag.
Valerio Setti4114a542024-02-28 16:32:01 +0100462 * - Algorithm is copied from the original key pair.
463 */
Valerio Settid2ccc2f2024-02-23 08:49:45 +0100464static mbedtls_svc_key_id_t psa_pub_key_from_priv(mbedtls_svc_key_id_t priv_id)
Valerio Setti452d2d22024-02-01 11:31:30 +0100465{
466 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Valerio Settid2ccc2f2024-02-23 08:49:45 +0100467 psa_key_type_t type;
468 psa_algorithm_t alg;
469 psa_key_usage_t usage;
Valerio Setti452d2d22024-02-01 11:31:30 +0100470 unsigned char pub_key_buf[PSA_EXPORT_PUBLIC_KEY_MAX_SIZE];
471 size_t pub_key_len;
472 mbedtls_svc_key_id_t pub_key = MBEDTLS_SVC_KEY_ID_INIT;
473
Valerio Settid2ccc2f2024-02-23 08:49:45 +0100474 /* Get attributes from the private key. */
475 PSA_ASSERT(psa_get_key_attributes(priv_id, &attributes));
476 type = psa_get_key_type(&attributes);
477 usage = psa_get_key_usage_flags(&attributes);
478 alg = psa_get_key_algorithm(&attributes);
479 psa_reset_key_attributes(&attributes);
480
481 /* Export the public key and then import it in a new slot. */
Valerio Setti452d2d22024-02-01 11:31:30 +0100482 PSA_ASSERT(psa_export_public_key(priv_id, pub_key_buf, sizeof(pub_key_buf), &pub_key_len));
483
Valerio Settid2ccc2f2024-02-23 08:49:45 +0100484 /* Notes:
485 * - psa_import_key() automatically determines the key's bit length
486 * from the provided key data. That's why psa_set_key_bits() is not used
487 * below.
Valerio Settid2ccc2f2024-02-23 08:49:45 +0100488 */
489 type = PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(type);
490 usage &= ~PSA_KEY_USAGE_EXPORT;
491 psa_set_key_type(&attributes, type);
Valerio Setti452d2d22024-02-01 11:31:30 +0100492 psa_set_key_usage_flags(&attributes, usage);
493 psa_set_key_algorithm(&attributes, alg);
Valerio Setti452d2d22024-02-01 11:31:30 +0100494
495 PSA_ASSERT(psa_import_key(&attributes, pub_key_buf, pub_key_len, &pub_key));
496
497exit:
Valerio Settid2ccc2f2024-02-23 08:49:45 +0100498 psa_reset_key_attributes(&attributes);
Valerio Setti452d2d22024-02-01 11:31:30 +0100499 return pub_key;
500}
501
Valerio Setti039bbba2024-02-29 07:24:26 +0100502/* Create a copy of a PSA key with same usage and algorithm policy and destroy
503 * the original one. */
504mbedtls_svc_key_id_t psa_copy_and_destroy(mbedtls_svc_key_id_t orig_key_id)
505{
506 psa_key_attributes_t orig_attr = PSA_KEY_ATTRIBUTES_INIT;
507 psa_key_attributes_t new_attr = PSA_KEY_ATTRIBUTES_INIT;
508 mbedtls_svc_key_id_t new_key_id = MBEDTLS_SVC_KEY_ID_INIT;
509
510 PSA_ASSERT(psa_get_key_attributes(orig_key_id, &orig_attr));
511 psa_set_key_usage_flags(&new_attr, psa_get_key_usage_flags(&orig_attr));
512 psa_set_key_algorithm(&new_attr, psa_get_key_algorithm(&orig_attr));
513
514 PSA_ASSERT(psa_copy_key(orig_key_id, &new_attr, &new_key_id));
515 psa_destroy_key(orig_key_id);
516
517exit:
518 psa_reset_key_attributes(&orig_attr);
519 psa_reset_key_attributes(&new_attr);
520 return new_key_id;
521}
522
Valerio Setti452d2d22024-02-01 11:31:30 +0100523psa_status_t pk_psa_import_key(unsigned char *key_data, size_t key_len,
524 psa_key_type_t type, psa_key_usage_t usage,
Valerio Settid2ccc2f2024-02-23 08:49:45 +0100525 psa_algorithm_t alg, mbedtls_svc_key_id_t *key)
Valerio Setti452d2d22024-02-01 11:31:30 +0100526{
527 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
528 psa_status_t status;
529
530 *key = MBEDTLS_SVC_KEY_ID_INIT;
531
Valerio Settid2ccc2f2024-02-23 08:49:45 +0100532 /* Note: psa_import_key() automatically determines the key's bit length
533 * from the provided key data. That's why psa_set_key_bits() is not used below. */
Valerio Setti452d2d22024-02-01 11:31:30 +0100534 psa_set_key_usage_flags(&attributes, usage);
535 psa_set_key_algorithm(&attributes, alg);
536 psa_set_key_type(&attributes, type);
Valerio Setti452d2d22024-02-01 11:31:30 +0100537 status = psa_import_key(&attributes, key_data, key_len, key);
538
539 return status;
540}
541
Valerio Settic43a7a52024-03-22 12:06:44 +0100542psa_status_t pk_psa_genkey(psa_key_type_t type, size_t bits,
543 psa_key_usage_t usage, psa_algorithm_t alg,
544 psa_algorithm_t enrollment_alg,
545 mbedtls_svc_key_id_t persistent_key_id,
546 mbedtls_svc_key_id_t *key)
Valerio Setti452d2d22024-02-01 11:31:30 +0100547{
548 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
549 psa_status_t status;
550
551 *key = MBEDTLS_SVC_KEY_ID_INIT;
552
553 psa_set_key_usage_flags(&attributes, usage);
554 psa_set_key_algorithm(&attributes, alg);
Valerio Settic43a7a52024-03-22 12:06:44 +0100555 psa_set_key_enrollment_algorithm(&attributes, enrollment_alg);
Valerio Setti452d2d22024-02-01 11:31:30 +0100556 psa_set_key_type(&attributes, type);
557 psa_set_key_bits(&attributes, bits);
Valerio Settic43a7a52024-03-22 12:06:44 +0100558 if (!mbedtls_svc_key_id_is_null(persistent_key_id)) {
559 psa_set_key_id(&attributes, persistent_key_id);
560 }
Valerio Setti452d2d22024-02-01 11:31:30 +0100561 status = psa_generate_key(&attributes, key);
562
563 return status;
564}
Valerio Setti01ba66d2024-02-09 11:35:42 +0100565#endif /* MBEDTLS_PSA_CRYPTO_C */
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +0200566/* END_HEADER */
567
568/* BEGIN_DEPENDENCIES
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200569 * depends_on:MBEDTLS_PK_C
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +0200570 * END_DEPENDENCIES
571 */
572
Neil Armstrong0cd78dd2022-03-15 14:20:20 +0100573/* BEGIN_CASE depends_on:MBEDTLS_USE_PSA_CRYPTO */
Gilles Peskine449bd832023-01-11 14:50:10 +0100574void pk_psa_utils(int key_is_rsa)
Manuel Pégourié-Gonnard7b5fe042018-10-31 09:57:45 +0100575{
Manuel Pégourié-Gonnardd97390e2018-10-31 11:14:36 +0100576 mbedtls_pk_context pk, pk2;
Valerio Setti23e637a2024-02-27 13:56:57 +0100577 mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT;
Gilles Peskined2d45c12019-05-27 14:53:13 +0200578 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Manuel Pégourié-Gonnard7b5fe042018-10-31 09:57:45 +0100579
Manuel Pégourié-Gonnard69baf702018-11-06 09:34:30 +0100580 const char * const name = "Opaque";
Neil Armstrongcb874032022-04-08 15:14:40 +0200581 size_t bitlen;
Manuel Pégourié-Gonnard0184b3c2018-10-31 10:36:51 +0100582
Manuel Pégourié-Gonnardd97390e2018-10-31 11:14:36 +0100583 mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE;
584 unsigned char b1[1], b2[1];
585 size_t len;
586 mbedtls_pk_debug_item dbg;
587
Gilles Peskine449bd832023-01-11 14:50:10 +0100588 mbedtls_pk_init(&pk);
589 mbedtls_pk_init(&pk2);
valerio32f2ac92023-04-20 11:59:52 +0200590 USE_PSA_INIT();
Manuel Pégourié-Gonnard7b5fe042018-10-31 09:57:45 +0100591
Gilles Peskine449bd832023-01-11 14:50:10 +0100592 TEST_ASSERT(mbedtls_pk_setup_opaque(&pk, MBEDTLS_SVC_KEY_ID_INIT) ==
593 MBEDTLS_ERR_PK_BAD_INPUT_DATA);
Manuel Pégourié-Gonnard920c0632018-10-31 10:57:29 +0100594
Gilles Peskine449bd832023-01-11 14:50:10 +0100595 mbedtls_pk_free(&pk);
596 mbedtls_pk_init(&pk);
Manuel Pégourié-Gonnard920c0632018-10-31 10:57:29 +0100597
Gilles Peskine449bd832023-01-11 14:50:10 +0100598 if (key_is_rsa) {
Valerio Settic43a7a52024-03-22 12:06:44 +0100599 bitlen = 1024;
600 key = pk_psa_genkey(PSA_KEY_TYPE_RSA_KEY_PAIR, 1024, PSA_KEY_USAGE_SIGN_HASH,
601 PSA_ALG_RSA_PKCS1V15_SIGN_RAW, PSA_ALG_NONE,
602 PSA_KEY_ID_NULL, &key);
Gilles Peskine449bd832023-01-11 14:50:10 +0100603 } else {
Valerio Settic43a7a52024-03-22 12:06:44 +0100604 bitlen = 256;
605 key = pk_psa_genkey(PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1), 256,
606 PSA_KEY_USAGE_SIGN_HASH, PSA_ALG_ECDSA(PSA_ALG_SHA_256),
607 PSA_ALG_NONE, PSA_KEY_ID_NULL, &key);
Neil Armstrongcb874032022-04-08 15:14:40 +0200608 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100609 if (mbedtls_svc_key_id_is_null(key)) {
Gilles Peskined2d45c12019-05-27 14:53:13 +0200610 goto exit;
Neil Armstrong0cd78dd2022-03-15 14:20:20 +0100611 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100612
613 TEST_ASSERT(mbedtls_pk_setup_opaque(&pk, key) == 0);
614
615 TEST_ASSERT(mbedtls_pk_get_type(&pk) == MBEDTLS_PK_OPAQUE);
616 TEST_ASSERT(strcmp(mbedtls_pk_get_name(&pk), name) == 0);
617
618 TEST_ASSERT(mbedtls_pk_get_bitlen(&pk) == bitlen);
Gilles Peskine92fb6042024-02-01 22:33:06 +0100619 TEST_ASSERT(mbedtls_pk_get_len(&pk) == (bitlen + 7) / 8);
Gilles Peskine449bd832023-01-11 14:50:10 +0100620
621 if (key_is_rsa) {
622 TEST_ASSERT(mbedtls_pk_can_do(&pk, MBEDTLS_PK_ECKEY) == 0);
623 TEST_ASSERT(mbedtls_pk_can_do(&pk, MBEDTLS_PK_ECDSA) == 0);
624 TEST_ASSERT(mbedtls_pk_can_do(&pk, MBEDTLS_PK_RSA) == 1);
625 } else {
626 TEST_ASSERT(mbedtls_pk_can_do(&pk, MBEDTLS_PK_ECKEY) == 1);
627 TEST_ASSERT(mbedtls_pk_can_do(&pk, MBEDTLS_PK_ECDSA) == 1);
628 TEST_ASSERT(mbedtls_pk_can_do(&pk, MBEDTLS_PK_RSA) == 0);
Neil Armstrong0cd78dd2022-03-15 14:20:20 +0100629 }
Manuel Pégourié-Gonnard920c0632018-10-31 10:57:29 +0100630
Manuel Pégourié-Gonnardd97390e2018-10-31 11:14:36 +0100631 /* unsupported operations: verify, decrypt, encrypt */
Valerio Settie7730772023-06-21 16:58:40 +0200632 if (key_is_rsa == 1) {
633 TEST_ASSERT(mbedtls_pk_verify(&pk, md_alg,
634 b1, sizeof(b1), b2, sizeof(b2))
635 == MBEDTLS_ERR_PK_TYPE_MISMATCH);
636 } else {
Gilles Peskine449bd832023-01-11 14:50:10 +0100637 TEST_ASSERT(mbedtls_pk_decrypt(&pk, b1, sizeof(b1),
638 b2, &len, sizeof(b2),
639 NULL, NULL)
640 == MBEDTLS_ERR_PK_TYPE_MISMATCH);
Neil Armstrongb32ae722022-04-22 15:02:47 +0200641 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100642 TEST_ASSERT(mbedtls_pk_encrypt(&pk, b1, sizeof(b1),
643 b2, &len, sizeof(b2),
644 NULL, NULL)
645 == MBEDTLS_ERR_PK_TYPE_MISMATCH);
Manuel Pégourié-Gonnardd97390e2018-10-31 11:14:36 +0100646
647 /* unsupported functions: check_pair, debug */
Gilles Peskine449bd832023-01-11 14:50:10 +0100648 if (key_is_rsa) {
649 TEST_ASSERT(mbedtls_pk_setup(&pk2,
650 mbedtls_pk_info_from_type(MBEDTLS_PK_RSA)) == 0);
651 } else {
652 TEST_ASSERT(mbedtls_pk_setup(&pk2,
653 mbedtls_pk_info_from_type(MBEDTLS_PK_ECKEY)) == 0);
654 }
655 TEST_ASSERT(mbedtls_pk_check_pair(&pk, &pk2,
656 mbedtls_test_rnd_std_rand, NULL)
657 == MBEDTLS_ERR_PK_TYPE_MISMATCH);
658 TEST_ASSERT(mbedtls_pk_debug(&pk, &dbg)
659 == MBEDTLS_ERR_PK_TYPE_MISMATCH);
Manuel Pégourié-Gonnardd97390e2018-10-31 11:14:36 +0100660
Manuel Pégourié-Gonnard01a12c42018-10-31 10:28:01 +0100661 /* test that freeing the context does not destroy the key */
Gilles Peskine449bd832023-01-11 14:50:10 +0100662 mbedtls_pk_free(&pk);
663 TEST_ASSERT(PSA_SUCCESS == psa_get_key_attributes(key, &attributes));
664 TEST_ASSERT(PSA_SUCCESS == psa_destroy_key(key));
Manuel Pégourié-Gonnard01a12c42018-10-31 10:28:01 +0100665
666exit:
Ronald Cron3a4f0e32020-11-19 17:55:23 +0100667 /*
668 * Key attributes may have been returned by psa_get_key_attributes()
669 * thus reset them as required.
670 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100671 psa_reset_key_attributes(&attributes);
Ronald Cron3a4f0e32020-11-19 17:55:23 +0100672
Gilles Peskine449bd832023-01-11 14:50:10 +0100673 mbedtls_pk_free(&pk); /* redundant except upon error */
674 mbedtls_pk_free(&pk2);
675 USE_PSA_DONE();
Manuel Pégourié-Gonnard7b5fe042018-10-31 09:57:45 +0100676}
677/* END_CASE */
678
Neil Armstrongce1d2392022-05-11 14:11:46 +0200679/* BEGIN_CASE depends_on:MBEDTLS_USE_PSA_CRYPTO */
Gilles Peskine449bd832023-01-11 14:50:10 +0100680void pk_can_do_ext(int opaque_key, int key_type, int key_usage, int key_alg,
Tomi Fontanilles9c693482023-12-14 21:40:54 +0200681 int key_alg2, int curve_or_keybits, int alg_check, int usage_check,
Gilles Peskine449bd832023-01-11 14:50:10 +0100682 int result)
Neil Armstrongce1d2392022-05-11 14:11:46 +0200683{
684 mbedtls_pk_context pk;
685 mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT;
686 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
687
Gilles Peskine449bd832023-01-11 14:50:10 +0100688 mbedtls_pk_init(&pk);
valerio32f2ac92023-04-20 11:59:52 +0200689 USE_PSA_INIT();
Neil Armstrongce1d2392022-05-11 14:11:46 +0200690
Gilles Peskine449bd832023-01-11 14:50:10 +0100691 if (opaque_key == 1) {
Valerio Settic43a7a52024-03-22 12:06:44 +0100692 PSA_ASSERT(pk_psa_genkey(key_type, curve_or_keybits, key_usage,
693 key_alg, key_alg2, PSA_KEY_ID_NULL, &key));
Gilles Peskine449bd832023-01-11 14:50:10 +0100694 if (mbedtls_svc_key_id_is_null(key)) {
Neil Armstrong5c5b1162022-05-19 18:07:53 +0200695 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100696 }
Neil Armstrongce1d2392022-05-11 14:11:46 +0200697
Gilles Peskine449bd832023-01-11 14:50:10 +0100698 TEST_EQUAL(mbedtls_pk_setup_opaque(&pk, key), 0);
Neil Armstrongce1d2392022-05-11 14:11:46 +0200699
Gilles Peskine449bd832023-01-11 14:50:10 +0100700 TEST_EQUAL(mbedtls_pk_get_type(&pk), MBEDTLS_PK_OPAQUE);
701 } else {
702 TEST_EQUAL(mbedtls_pk_setup(&pk,
703 mbedtls_pk_info_from_type(key_type)), 0);
Tomi Fontanilles9c693482023-12-14 21:40:54 +0200704 TEST_EQUAL(pk_genkey(&pk, curve_or_keybits), 0);
Gilles Peskine449bd832023-01-11 14:50:10 +0100705 TEST_EQUAL(mbedtls_pk_get_type(&pk), key_type);
Neil Armstrong5c5b1162022-05-19 18:07:53 +0200706 }
Neil Armstrongce1d2392022-05-11 14:11:46 +0200707
Gilles Peskine449bd832023-01-11 14:50:10 +0100708 TEST_EQUAL(mbedtls_pk_can_do_ext(&pk, alg_check, usage_check), result);
Neil Armstrongce1d2392022-05-11 14:11:46 +0200709
710exit:
Gilles Peskine449bd832023-01-11 14:50:10 +0100711 psa_reset_key_attributes(&attributes);
712 PSA_ASSERT(psa_destroy_key(key));
713 mbedtls_pk_free(&pk);
714 USE_PSA_DONE();
Neil Armstrongce1d2392022-05-11 14:11:46 +0200715}
716/* END_CASE */
Manuel Pégourié-Gonnard7b5fe042018-10-31 09:57:45 +0100717
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +0200718/* BEGIN_CASE */
Tuvshinzaya Erdenekhuu79bf51a2022-07-29 15:06:52 +0100719void pk_invalid_param()
720{
721 mbedtls_pk_context ctx;
Tuvshinzaya Erdenekhuu79bf51a2022-07-29 15:06:52 +0100722 mbedtls_pk_type_t pk_type = 0;
Tuvshinzaya Erdenekhuued99ed32022-08-02 14:02:28 +0100723 unsigned char buf[] = { 0x01, 0x02, 0x03, 0x04, 0x05, 0x06 };
Gilles Peskine449bd832023-01-11 14:50:10 +0100724 size_t buf_size = sizeof(buf);
Tuvshinzaya Erdenekhuu79bf51a2022-07-29 15:06:52 +0100725
Gilles Peskine449bd832023-01-11 14:50:10 +0100726 mbedtls_pk_init(&ctx);
valerio32f2ac92023-04-20 11:59:52 +0200727 USE_PSA_INIT();
Tuvshinzaya Erdenekhuu79bf51a2022-07-29 15:06:52 +0100728
Gilles Peskine449bd832023-01-11 14:50:10 +0100729 TEST_EQUAL(MBEDTLS_ERR_PK_BAD_INPUT_DATA,
730 mbedtls_pk_verify_restartable(&ctx, MBEDTLS_MD_NONE,
Tuvshinzaya Erdenekhuu79bf51a2022-07-29 15:06:52 +0100731 NULL, buf_size,
Gilles Peskine449bd832023-01-11 14:50:10 +0100732 buf, buf_size,
733 NULL));
734 TEST_EQUAL(MBEDTLS_ERR_PK_BAD_INPUT_DATA,
735 mbedtls_pk_verify_restartable(&ctx, MBEDTLS_MD_SHA256,
Tuvshinzaya Erdenekhuu0050b912022-08-30 13:15:55 +0100736 NULL, 0,
Gilles Peskine449bd832023-01-11 14:50:10 +0100737 buf, buf_size,
738 NULL));
739 TEST_EQUAL(MBEDTLS_ERR_PK_BAD_INPUT_DATA,
740 mbedtls_pk_verify_ext(pk_type, NULL,
741 &ctx, MBEDTLS_MD_NONE,
742 NULL, buf_size,
743 buf, buf_size));
744 TEST_EQUAL(MBEDTLS_ERR_PK_BAD_INPUT_DATA,
745 mbedtls_pk_verify_ext(pk_type, NULL,
746 &ctx, MBEDTLS_MD_SHA256,
747 NULL, 0,
748 buf, buf_size));
749 TEST_EQUAL(MBEDTLS_ERR_PK_BAD_INPUT_DATA,
750 mbedtls_pk_sign_restartable(&ctx, MBEDTLS_MD_NONE,
751 NULL, buf_size,
752 buf, buf_size, &buf_size,
753 NULL, NULL,
754 NULL));
755 TEST_EQUAL(MBEDTLS_ERR_PK_BAD_INPUT_DATA,
756 mbedtls_pk_sign_restartable(&ctx, MBEDTLS_MD_SHA256,
757 NULL, 0,
758 buf, buf_size, &buf_size,
759 NULL, NULL,
760 NULL));
Tomi Fontanilles81746622023-07-16 13:06:06 +0300761 TEST_EQUAL(MBEDTLS_ERR_PK_BAD_INPUT_DATA,
762 mbedtls_pk_sign_ext(pk_type, &ctx, MBEDTLS_MD_NONE,
763 NULL, buf_size,
764 buf, buf_size, &buf_size,
765 NULL, NULL));
766 TEST_EQUAL(MBEDTLS_ERR_PK_BAD_INPUT_DATA,
767 mbedtls_pk_sign_ext(pk_type, &ctx, MBEDTLS_MD_SHA256,
768 NULL, 0,
769 buf, buf_size, &buf_size,
770 NULL, NULL));
Tuvshinzaya Erdenekhuu79bf51a2022-07-29 15:06:52 +0100771exit:
Gilles Peskine449bd832023-01-11 14:50:10 +0100772 mbedtls_pk_free(&ctx);
Valerio Settib79f7db2023-04-19 14:25:52 +0200773 USE_PSA_DONE();
Tuvshinzaya Erdenekhuu79bf51a2022-07-29 15:06:52 +0100774}
775/* END_CASE */
776
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +0200777/* BEGIN_CASE */
Gilles Peskine449bd832023-01-11 14:50:10 +0100778void valid_parameters()
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500779{
780 mbedtls_pk_context pk;
781 unsigned char buf[1];
782 size_t len;
783 void *options = NULL;
784
Gilles Peskine449bd832023-01-11 14:50:10 +0100785 mbedtls_pk_init(&pk);
valerio32f2ac92023-04-20 11:59:52 +0200786 USE_PSA_INIT();
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500787
Gilles Peskine449bd832023-01-11 14:50:10 +0100788 TEST_ASSERT(mbedtls_pk_setup(&pk, NULL) ==
789 MBEDTLS_ERR_PK_BAD_INPUT_DATA);
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500790
791 /* In informational functions, we accept NULL where a context pointer
792 * is expected because that's what the library has done forever.
793 * We do not document that NULL is accepted, so we may wish to change
794 * the behavior in a future version. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100795 TEST_ASSERT(mbedtls_pk_get_bitlen(NULL) == 0);
796 TEST_ASSERT(mbedtls_pk_get_len(NULL) == 0);
797 TEST_ASSERT(mbedtls_pk_can_do(NULL, MBEDTLS_PK_NONE) == 0);
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500798
Gilles Peskine449bd832023-01-11 14:50:10 +0100799 TEST_ASSERT(mbedtls_pk_sign_restartable(&pk,
800 MBEDTLS_MD_NONE,
801 NULL, 0,
802 buf, sizeof(buf), &len,
803 mbedtls_test_rnd_std_rand, NULL,
804 NULL) ==
805 MBEDTLS_ERR_PK_BAD_INPUT_DATA);
806
Gilles Peskine449bd832023-01-11 14:50:10 +0100807 TEST_ASSERT(mbedtls_pk_sign(&pk,
808 MBEDTLS_MD_NONE,
809 NULL, 0,
810 buf, sizeof(buf), &len,
811 mbedtls_test_rnd_std_rand, NULL) ==
812 MBEDTLS_ERR_PK_BAD_INPUT_DATA);
813
Tomi Fontanilles81746622023-07-16 13:06:06 +0300814 TEST_ASSERT(mbedtls_pk_sign_ext(MBEDTLS_PK_NONE, &pk,
815 MBEDTLS_MD_NONE,
816 NULL, 0,
817 buf, sizeof(buf), &len,
818 mbedtls_test_rnd_std_rand, NULL) ==
819 MBEDTLS_ERR_PK_BAD_INPUT_DATA);
820
Gilles Peskine449bd832023-01-11 14:50:10 +0100821 TEST_ASSERT(mbedtls_pk_verify_restartable(&pk,
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500822 MBEDTLS_MD_NONE,
823 NULL, 0,
Gilles Peskine449bd832023-01-11 14:50:10 +0100824 buf, sizeof(buf),
825 NULL) ==
826 MBEDTLS_ERR_PK_BAD_INPUT_DATA);
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500827
Gilles Peskine449bd832023-01-11 14:50:10 +0100828 TEST_ASSERT(mbedtls_pk_verify(&pk,
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500829 MBEDTLS_MD_NONE,
830 NULL, 0,
Gilles Peskine449bd832023-01-11 14:50:10 +0100831 buf, sizeof(buf)) ==
832 MBEDTLS_ERR_PK_BAD_INPUT_DATA);
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500833
Gilles Peskine449bd832023-01-11 14:50:10 +0100834 TEST_ASSERT(mbedtls_pk_verify_ext(MBEDTLS_PK_NONE, options,
835 &pk,
836 MBEDTLS_MD_NONE,
837 NULL, 0,
838 buf, sizeof(buf)) ==
839 MBEDTLS_ERR_PK_BAD_INPUT_DATA);
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500840
Gilles Peskine449bd832023-01-11 14:50:10 +0100841 TEST_ASSERT(mbedtls_pk_encrypt(&pk,
842 NULL, 0,
843 NULL, &len, 0,
844 mbedtls_test_rnd_std_rand, NULL) ==
845 MBEDTLS_ERR_PK_BAD_INPUT_DATA);
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500846
Gilles Peskine449bd832023-01-11 14:50:10 +0100847 TEST_ASSERT(mbedtls_pk_decrypt(&pk,
848 NULL, 0,
849 NULL, &len, 0,
850 mbedtls_test_rnd_std_rand, NULL) ==
851 MBEDTLS_ERR_PK_BAD_INPUT_DATA);
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500852
853#if defined(MBEDTLS_PK_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +0100854 TEST_ASSERT(mbedtls_pk_parse_key(&pk, NULL, 0, NULL, 1,
855 mbedtls_test_rnd_std_rand, NULL) ==
856 MBEDTLS_ERR_PK_KEY_INVALID_FORMAT);
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500857
Gilles Peskine449bd832023-01-11 14:50:10 +0100858 TEST_ASSERT(mbedtls_pk_parse_public_key(&pk, NULL, 0) ==
859 MBEDTLS_ERR_PK_KEY_INVALID_FORMAT);
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500860#endif /* MBEDTLS_PK_PARSE_C */
Valerio Settib79f7db2023-04-19 14:25:52 +0200861 USE_PSA_DONE();
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500862}
863/* END_CASE */
864
Yanray Wange9954bb2023-11-30 17:16:33 +0800865/* BEGIN_CASE depends_on:MBEDTLS_PK_WRITE_C:MBEDTLS_PK_PARSE_C */
Gilles Peskine449bd832023-01-11 14:50:10 +0100866void valid_parameters_pkwrite(data_t *key_data)
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500867{
868 mbedtls_pk_context pk;
869
870 /* For the write tests to be effective, we need a valid key pair. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100871 mbedtls_pk_init(&pk);
valerio32f2ac92023-04-20 11:59:52 +0200872 USE_PSA_INIT();
873
Gilles Peskine449bd832023-01-11 14:50:10 +0100874 TEST_ASSERT(mbedtls_pk_parse_key(&pk,
875 key_data->x, key_data->len, NULL, 0,
876 mbedtls_test_rnd_std_rand, NULL) == 0);
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500877
Gilles Peskine449bd832023-01-11 14:50:10 +0100878 TEST_ASSERT(mbedtls_pk_write_key_der(&pk, NULL, 0) ==
879 MBEDTLS_ERR_ASN1_BUF_TOO_SMALL);
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500880
Gilles Peskine449bd832023-01-11 14:50:10 +0100881 TEST_ASSERT(mbedtls_pk_write_pubkey_der(&pk, NULL, 0) ==
882 MBEDTLS_ERR_ASN1_BUF_TOO_SMALL);
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500883
884#if defined(MBEDTLS_PEM_WRITE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +0100885 TEST_ASSERT(mbedtls_pk_write_key_pem(&pk, NULL, 0) ==
886 MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL);
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500887
Gilles Peskine449bd832023-01-11 14:50:10 +0100888 TEST_ASSERT(mbedtls_pk_write_pubkey_pem(&pk, NULL, 0) ==
889 MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL);
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500890#endif /* MBEDTLS_PEM_WRITE_C */
891
892exit:
Gilles Peskine449bd832023-01-11 14:50:10 +0100893 mbedtls_pk_free(&pk);
Valerio Settib79f7db2023-04-19 14:25:52 +0200894 USE_PSA_DONE();
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500895}
896/* END_CASE */
897
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500898/* BEGIN_CASE */
Tomi Fontanilles9c693482023-12-14 21:40:54 +0200899void pk_utils(int type, int curve_or_keybits, int bitlen, int len, char *name)
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +0200900{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200901 mbedtls_pk_context pk;
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +0200902
Gilles Peskine449bd832023-01-11 14:50:10 +0100903 mbedtls_pk_init(&pk);
valerio32f2ac92023-04-20 11:59:52 +0200904 USE_PSA_INIT();
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +0200905
Gilles Peskine449bd832023-01-11 14:50:10 +0100906 TEST_ASSERT(mbedtls_pk_setup(&pk, mbedtls_pk_info_from_type(type)) == 0);
Tomi Fontanilles9c693482023-12-14 21:40:54 +0200907 TEST_ASSERT(pk_genkey(&pk, curve_or_keybits) == 0);
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +0200908
Gilles Peskine449bd832023-01-11 14:50:10 +0100909 TEST_ASSERT((int) mbedtls_pk_get_type(&pk) == type);
910 TEST_ASSERT(mbedtls_pk_can_do(&pk, type));
911 TEST_ASSERT(mbedtls_pk_get_bitlen(&pk) == (unsigned) bitlen);
912 TEST_ASSERT(mbedtls_pk_get_len(&pk) == (unsigned) len);
913 TEST_ASSERT(strcmp(mbedtls_pk_get_name(&pk), name) == 0);
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +0200914
Paul Bakkerbd51b262014-07-10 15:26:12 +0200915exit:
Gilles Peskine449bd832023-01-11 14:50:10 +0100916 mbedtls_pk_free(&pk);
Valerio Setti12a063a2023-04-04 11:13:06 +0200917 USE_PSA_DONE();
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +0200918}
919/* END_CASE */
920
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200921/* BEGIN_CASE depends_on:MBEDTLS_PK_PARSE_C:MBEDTLS_FS_IO */
Gilles Peskine449bd832023-01-11 14:50:10 +0100922void mbedtls_pk_check_pair(char *pub_file, char *prv_file, int ret)
Manuel Pégourié-Gonnard70bdadf2014-11-06 16:51:20 +0100923{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200924 mbedtls_pk_context pub, prv, alt;
valerio6c666c62023-06-01 10:59:42 +0200925#if defined(MBEDTLS_USE_PSA_CRYPTO)
926 mbedtls_svc_key_id_t opaque_key_id = MBEDTLS_SVC_KEY_ID_INIT;
Valerio Setti1fa2f6e2024-02-27 08:11:25 +0100927 psa_key_attributes_t opaque_key_attr = PSA_KEY_ATTRIBUTES_INIT;
valerio6c666c62023-06-01 10:59:42 +0200928#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnard70bdadf2014-11-06 16:51:20 +0100929
Gilles Peskine449bd832023-01-11 14:50:10 +0100930 mbedtls_pk_init(&pub);
931 mbedtls_pk_init(&prv);
932 mbedtls_pk_init(&alt);
valerio32f2ac92023-04-20 11:59:52 +0200933 USE_PSA_INIT();
Manuel Pégourié-Gonnard70bdadf2014-11-06 16:51:20 +0100934
Valerio Setti0fe1ee22023-04-03 14:42:22 +0200935#if defined(MBEDTLS_USE_PSA_CRYPTO)
936 /* mbedtls_pk_check_pair() returns either PK or ECP error codes depending
937 on MBEDTLS_USE_PSA_CRYPTO so here we dynamically translate between the
938 two */
939 if (ret == MBEDTLS_ERR_ECP_BAD_INPUT_DATA) {
940 ret = MBEDTLS_ERR_PK_BAD_INPUT_DATA;
941 }
valerio6c666c62023-06-01 10:59:42 +0200942#endif /* MBEDTLS_USE_PSA_CRYPTO */
Valerio Setti0fe1ee22023-04-03 14:42:22 +0200943
Gilles Peskine449bd832023-01-11 14:50:10 +0100944 TEST_ASSERT(mbedtls_pk_parse_public_keyfile(&pub, pub_file) == 0);
945 TEST_ASSERT(mbedtls_pk_parse_keyfile(&prv, prv_file, NULL,
946 mbedtls_test_rnd_std_rand, NULL)
947 == 0);
Manuel Pégourié-Gonnard70bdadf2014-11-06 16:51:20 +0100948
Gilles Peskine449bd832023-01-11 14:50:10 +0100949 TEST_ASSERT(mbedtls_pk_check_pair(&pub, &prv,
950 mbedtls_test_rnd_std_rand, NULL)
951 == ret);
Manuel Pégourié-Gonnard70bdadf2014-11-06 16:51:20 +0100952
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200953#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PK_RSA_ALT_SUPPORT)
Gilles Peskine449bd832023-01-11 14:50:10 +0100954 if (mbedtls_pk_get_type(&prv) == MBEDTLS_PK_RSA) {
955 TEST_ASSERT(mbedtls_pk_setup_rsa_alt(&alt, mbedtls_pk_rsa(prv),
956 mbedtls_rsa_decrypt_func, mbedtls_rsa_sign_func,
957 mbedtls_rsa_key_len_func) == 0);
958 TEST_ASSERT(mbedtls_pk_check_pair(&pub, &alt,
959 mbedtls_test_rnd_std_rand, NULL)
960 == ret);
Manuel Pégourié-Gonnarda1efcb02014-11-08 17:08:08 +0100961 }
Manuel Pégourié-Gonnard7c13d692014-11-12 00:01:34 +0100962#endif
valerio6c666c62023-06-01 10:59:42 +0200963#if defined(MBEDTLS_USE_PSA_CRYPTO)
964 if (mbedtls_pk_get_type(&prv) == MBEDTLS_PK_ECKEY) {
Valerio Setti1fa2f6e2024-02-27 08:11:25 +0100965 /* Turn the prv PK context into an opaque one.*/
966 TEST_EQUAL(mbedtls_pk_get_psa_attributes(&prv, PSA_KEY_USAGE_SIGN_HASH,
967 &opaque_key_attr), 0);
968 TEST_EQUAL(mbedtls_pk_import_into_psa(&prv, &opaque_key_attr, &opaque_key_id), 0);
969 mbedtls_pk_free(&prv);
970 mbedtls_pk_init(&prv);
971 TEST_EQUAL(mbedtls_pk_setup_opaque(&prv, opaque_key_id), 0);
valerio6c666c62023-06-01 10:59:42 +0200972 TEST_EQUAL(mbedtls_pk_check_pair(&pub, &prv, mbedtls_test_rnd_std_rand,
973 NULL), ret);
974 }
975#endif
Manuel Pégourié-Gonnarda1efcb02014-11-08 17:08:08 +0100976
valerio6c666c62023-06-01 10:59:42 +0200977exit:
978#if defined(MBEDTLS_USE_PSA_CRYPTO)
979 psa_destroy_key(opaque_key_id);
980#endif /* MBEDTLS_USE_PSA_CRYPTO */
Gilles Peskine449bd832023-01-11 14:50:10 +0100981 mbedtls_pk_free(&pub);
982 mbedtls_pk_free(&prv);
983 mbedtls_pk_free(&alt);
Neil Armstrong56d51272022-02-22 15:29:05 +0100984 USE_PSA_DONE();
Manuel Pégourié-Gonnard70bdadf2014-11-06 16:51:20 +0100985}
986/* END_CASE */
987
Manuel Pégourié-Gonnard2d08ea42022-07-08 10:48:18 +0200988/* BEGIN_CASE depends_on:MBEDTLS_RSA_C */
Gilles Peskine46ee81d2024-02-13 20:05:29 +0100989void pk_rsa_verify_test_vec(data_t *message_str, int padding, int digest,
990 int mod, char *input_N, char *input_E,
991 data_t *result_str, int expected_result)
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +0200992{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200993 mbedtls_rsa_context *rsa;
994 mbedtls_pk_context pk;
Manuel Pégourié-Gonnard15d7df22017-08-17 14:33:31 +0200995 mbedtls_pk_restart_ctx *rs_ctx = NULL;
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +0200996#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard15d7df22017-08-17 14:33:31 +0200997 mbedtls_pk_restart_ctx ctx;
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +0200998
999 rs_ctx = &ctx;
Gilles Peskine449bd832023-01-11 14:50:10 +01001000 mbedtls_pk_restart_init(rs_ctx);
Manuel Pégourié-Gonnard4edb9cb2018-07-02 12:23:23 +02001001 // this setting would ensure restart would happen if ECC was used
Gilles Peskine449bd832023-01-11 14:50:10 +01001002 mbedtls_ecp_set_max_ops(1);
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001003#endif
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +02001004
Gilles Peskine449bd832023-01-11 14:50:10 +01001005 mbedtls_pk_init(&pk);
Gilles Peskine46ee81d2024-02-13 20:05:29 +01001006 MD_OR_USE_PSA_INIT();
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +02001007
Gilles Peskine449bd832023-01-11 14:50:10 +01001008 TEST_ASSERT(mbedtls_pk_setup(&pk, mbedtls_pk_info_from_type(MBEDTLS_PK_RSA)) == 0);
1009 rsa = mbedtls_pk_rsa(pk);
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +02001010
Gilles Peskine92fb6042024-02-01 22:33:06 +01001011 rsa->len = (mod + 7) / 8;
Gilles Peskine46ee81d2024-02-13 20:05:29 +01001012 if (padding >= 0) {
1013 TEST_EQUAL(mbedtls_rsa_set_padding(rsa, padding, MBEDTLS_MD_NONE), 0);
1014 }
1015
Gilles Peskine449bd832023-01-11 14:50:10 +01001016 TEST_ASSERT(mbedtls_test_read_mpi(&rsa->N, input_N) == 0);
1017 TEST_ASSERT(mbedtls_test_read_mpi(&rsa->E, input_E) == 0);
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +02001018
Gilles Peskine46ee81d2024-02-13 20:05:29 +01001019 int actual_result;
1020 actual_result = mbedtls_pk_verify(&pk, digest, message_str->x, 0,
1021 result_str->x, mbedtls_pk_get_len(&pk));
1022#if !defined(MBEDTLS_USE_PSA_CRYPTO)
1023 if (actual_result == MBEDTLS_ERR_RSA_INVALID_PADDING &&
1024 expected_result == MBEDTLS_ERR_RSA_VERIFY_FAILED) {
1025 /* Tolerate INVALID_PADDING error for an invalid signature with
1026 * the legacy API (but not with PSA). */
1027 } else
1028#endif
1029 {
1030 TEST_EQUAL(actual_result, expected_result);
1031 }
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +02001032
Gilles Peskine46ee81d2024-02-13 20:05:29 +01001033 actual_result = mbedtls_pk_verify_restartable(&pk, digest, message_str->x, 0,
1034 result_str->x,
1035 mbedtls_pk_get_len(&pk),
1036 rs_ctx);
1037#if !defined(MBEDTLS_USE_PSA_CRYPTO)
1038 if (actual_result == MBEDTLS_ERR_RSA_INVALID_PADDING &&
1039 expected_result == MBEDTLS_ERR_RSA_VERIFY_FAILED) {
1040 /* Tolerate INVALID_PADDING error for an invalid signature with
1041 * the legacy API (but not with PSA). */
1042 } else
1043#endif
1044 {
1045 TEST_EQUAL(actual_result, expected_result);
1046 }
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001047
Paul Bakkerbd51b262014-07-10 15:26:12 +02001048exit:
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001049#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
Gilles Peskine449bd832023-01-11 14:50:10 +01001050 mbedtls_pk_restart_free(rs_ctx);
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001051#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01001052 mbedtls_pk_free(&pk);
Gilles Peskine46ee81d2024-02-13 20:05:29 +01001053 MD_OR_USE_PSA_DONE();
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +02001054}
1055/* END_CASE */
1056
Manuel Pégourié-Gonnard2d08ea42022-07-08 10:48:18 +02001057/* BEGIN_CASE depends_on:MBEDTLS_RSA_C */
Gilles Peskine449bd832023-01-11 14:50:10 +01001058void pk_rsa_verify_ext_test_vec(data_t *message_str, int digest,
1059 int mod, char *input_N,
1060 char *input_E, data_t *result_str,
1061 int pk_type, int mgf1_hash_id,
1062 int salt_len, int sig_len,
1063 int result)
Manuel Pégourié-Gonnard20422e92014-06-05 13:41:44 +02001064{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001065 mbedtls_rsa_context *rsa;
1066 mbedtls_pk_context pk;
1067 mbedtls_pk_rsassa_pss_options pss_opts;
Manuel Pégourié-Gonnard20422e92014-06-05 13:41:44 +02001068 void *options;
Neil Armstrong655725a2022-04-15 12:00:16 +02001069 int ret;
Manuel Pégourié-Gonnard20422e92014-06-05 13:41:44 +02001070
Gilles Peskine449bd832023-01-11 14:50:10 +01001071 mbedtls_pk_init(&pk);
valerio32f2ac92023-04-20 11:59:52 +02001072 MD_OR_USE_PSA_INIT();
Manuel Pégourié-Gonnard20422e92014-06-05 13:41:44 +02001073
Gilles Peskine449bd832023-01-11 14:50:10 +01001074 TEST_ASSERT(mbedtls_pk_setup(&pk, mbedtls_pk_info_from_type(MBEDTLS_PK_RSA)) == 0);
1075 rsa = mbedtls_pk_rsa(pk);
Manuel Pégourié-Gonnard20422e92014-06-05 13:41:44 +02001076
Gilles Peskine92fb6042024-02-01 22:33:06 +01001077 rsa->len = (mod + 7) / 8;
Gilles Peskine449bd832023-01-11 14:50:10 +01001078 TEST_ASSERT(mbedtls_test_read_mpi(&rsa->N, input_N) == 0);
1079 TEST_ASSERT(mbedtls_test_read_mpi(&rsa->E, input_E) == 0);
Manuel Pégourié-Gonnard20422e92014-06-05 13:41:44 +02001080
Manuel Pégourié-Gonnard20422e92014-06-05 13:41:44 +02001081
Gilles Peskine449bd832023-01-11 14:50:10 +01001082 if (mgf1_hash_id < 0) {
Manuel Pégourié-Gonnard20422e92014-06-05 13:41:44 +02001083 options = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01001084 } else {
Manuel Pégourié-Gonnard20422e92014-06-05 13:41:44 +02001085 options = &pss_opts;
1086
1087 pss_opts.mgf1_hash_id = mgf1_hash_id;
1088 pss_opts.expected_salt_len = salt_len;
1089 }
1090
Gilles Peskine449bd832023-01-11 14:50:10 +01001091 ret = mbedtls_pk_verify_ext(pk_type, options, &pk,
1092 digest, message_str->x, message_str->len,
1093 result_str->x, sig_len);
Neil Armstrong655725a2022-04-15 12:00:16 +02001094
Neil Armstrong655725a2022-04-15 12:00:16 +02001095#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01001096 if (result == MBEDTLS_ERR_RSA_INVALID_PADDING) {
Neil Armstrong1c9eb722022-04-25 14:38:18 +02001097 /* Mbed TLS distinguishes "invalid padding" from "valid padding but
Neil Armstrong6e6967f2022-04-22 11:32:18 +02001098 * the rest of the signature is invalid". This has little use in
1099 * practice and PSA doesn't report this distinction.
1100 * In this case, PSA returns PSA_ERROR_INVALID_SIGNATURE translated
Neil Armstrong1c9eb722022-04-25 14:38:18 +02001101 * to MBEDTLS_ERR_RSA_VERIFY_FAILED.
1102 * However, currently `mbedtls_pk_verify_ext()` may use either the
1103 * PSA or the Mbed TLS API, depending on the PSS options used.
1104 * So, it may return either INVALID_PADDING or INVALID_SIGNATURE.
Neil Armstrong6e6967f2022-04-22 11:32:18 +02001105 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001106 TEST_ASSERT(ret == result || ret == MBEDTLS_ERR_RSA_VERIFY_FAILED);
1107 } else
Neil Armstrong655725a2022-04-15 12:00:16 +02001108#endif
Neil Armstrong6e6967f2022-04-22 11:32:18 +02001109 {
Gilles Peskine449bd832023-01-11 14:50:10 +01001110 TEST_EQUAL(ret, result);
Neil Armstrong6e6967f2022-04-22 11:32:18 +02001111 }
Manuel Pégourié-Gonnard20422e92014-06-05 13:41:44 +02001112
Paul Bakkerbd51b262014-07-10 15:26:12 +02001113exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001114 mbedtls_pk_free(&pk);
Manuel Pégourié-Gonnardfa99afa2023-03-17 11:59:12 +01001115 MD_OR_USE_PSA_DONE();
Manuel Pégourié-Gonnard20422e92014-06-05 13:41:44 +02001116}
1117/* END_CASE */
1118
Valerio Setti48363742023-01-26 16:53:01 +01001119/* BEGIN_CASE depends_on:MBEDTLS_PK_CAN_ECDSA_VERIFY */
Gilles Peskine449bd832023-01-11 14:50:10 +01001120void pk_ec_test_vec(int type, int id, data_t *key, data_t *hash,
1121 data_t *sig, int ret)
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +02001122{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001123 mbedtls_pk_context pk;
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +02001124
Valerio Settib79f7db2023-04-19 14:25:52 +02001125 mbedtls_pk_init(&pk);
valerio32f2ac92023-04-20 11:59:52 +02001126 USE_PSA_INIT();
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +02001127
Gilles Peskine449bd832023-01-11 14:50:10 +01001128 TEST_ASSERT(mbedtls_pk_setup(&pk, mbedtls_pk_info_from_type(type)) == 0);
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +02001129
Gilles Peskine449bd832023-01-11 14:50:10 +01001130 TEST_ASSERT(mbedtls_pk_can_do(&pk, MBEDTLS_PK_ECDSA));
Valerio Setti483738e2023-05-17 15:37:29 +02001131#if defined(MBEDTLS_PK_USE_PSA_EC_DATA)
Valerio Setti30fdc032023-06-14 14:57:46 +02001132 TEST_ASSERT(key->len <= MBEDTLS_PK_MAX_EC_PUBKEY_RAW_LEN);
1133 memcpy(pk.pub_raw, key->x, key->len);
1134 pk.ec_family = mbedtls_ecc_group_to_psa(id, &(pk.ec_bits));
1135 pk.pub_raw_len = key->len;
Valerio Setti483738e2023-05-17 15:37:29 +02001136#else
1137 mbedtls_ecp_keypair *eckey = (mbedtls_ecp_keypair *) mbedtls_pk_ec(pk);
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +02001138
Gilles Peskine449bd832023-01-11 14:50:10 +01001139 TEST_ASSERT(mbedtls_ecp_group_load(&eckey->grp, id) == 0);
1140 TEST_ASSERT(mbedtls_ecp_point_read_binary(&eckey->grp, &eckey->Q,
1141 key->x, key->len) == 0);
Valerio Setti483738e2023-05-17 15:37:29 +02001142#endif
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +02001143
John Durkopd4efa8d2020-09-08 05:58:28 -07001144 // MBEDTLS_MD_NONE is used since it will be ignored.
Gilles Peskine449bd832023-01-11 14:50:10 +01001145 TEST_ASSERT(mbedtls_pk_verify(&pk, MBEDTLS_MD_NONE,
1146 hash->x, hash->len, sig->x, sig->len) == ret);
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +02001147
Paul Bakkerbd51b262014-07-10 15:26:12 +02001148exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001149 mbedtls_pk_free(&pk);
1150 USE_PSA_DONE();
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +02001151}
1152/* END_CASE */
1153
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001154/* BEGIN_CASE depends_on:MBEDTLS_ECP_RESTARTABLE:MBEDTLS_ECDSA_C:MBEDTLS_ECDSA_DETERMINISTIC */
Gilles Peskine449bd832023-01-11 14:50:10 +01001155void pk_sign_verify_restart(int pk_type, int grp_id, char *d_str,
1156 char *QX_str, char *QY_str,
1157 int md_alg, data_t *hash, data_t *sig_check,
1158 int max_ops, int min_restart, int max_restart)
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001159{
1160 int ret, cnt_restart;
Manuel Pégourié-Gonnard15d7df22017-08-17 14:33:31 +02001161 mbedtls_pk_restart_ctx rs_ctx;
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001162 mbedtls_pk_context prv, pub;
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001163 unsigned char sig[MBEDTLS_ECDSA_MAX_LEN];
Manuel Pégourié-Gonnard4608c482022-07-18 10:55:56 +02001164 size_t slen;
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001165
Gilles Peskine449bd832023-01-11 14:50:10 +01001166 mbedtls_pk_restart_init(&rs_ctx);
1167 mbedtls_pk_init(&prv);
1168 mbedtls_pk_init(&pub);
valerio32f2ac92023-04-20 11:59:52 +02001169 USE_PSA_INIT();
1170
Gilles Peskine449bd832023-01-11 14:50:10 +01001171 memset(sig, 0, sizeof(sig));
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001172
Gilles Peskine449bd832023-01-11 14:50:10 +01001173 TEST_ASSERT(mbedtls_pk_setup(&prv, mbedtls_pk_info_from_type(pk_type)) == 0);
Valerio Setti77a75682023-05-15 11:18:46 +02001174 TEST_ASSERT(mbedtls_ecp_group_load(&mbedtls_pk_ec_rw(prv)->grp, grp_id) == 0);
1175 TEST_ASSERT(mbedtls_test_read_mpi(&mbedtls_pk_ec_rw(prv)->d, d_str) == 0);
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001176
Gilles Peskine449bd832023-01-11 14:50:10 +01001177 TEST_ASSERT(mbedtls_pk_setup(&pub, mbedtls_pk_info_from_type(pk_type)) == 0);
Valerio Setti77a75682023-05-15 11:18:46 +02001178 TEST_ASSERT(mbedtls_ecp_group_load(&mbedtls_pk_ec_rw(pub)->grp, grp_id) == 0);
1179 TEST_ASSERT(mbedtls_ecp_point_read_string(&mbedtls_pk_ec_rw(pub)->Q, 16, QX_str, QY_str) == 0);
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001180
Gilles Peskine449bd832023-01-11 14:50:10 +01001181 mbedtls_ecp_set_max_ops(max_ops);
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001182
Gilles Peskine449bd832023-01-11 14:50:10 +01001183 slen = sizeof(sig);
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001184 cnt_restart = 0;
1185 do {
Gilles Peskine449bd832023-01-11 14:50:10 +01001186 ret = mbedtls_pk_sign_restartable(&prv, md_alg, hash->x, hash->len,
1187 sig, sizeof(sig), &slen,
1188 mbedtls_test_rnd_std_rand, NULL,
1189 &rs_ctx);
1190 } while (ret == MBEDTLS_ERR_ECP_IN_PROGRESS && ++cnt_restart);
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001191
Gilles Peskine449bd832023-01-11 14:50:10 +01001192 TEST_ASSERT(ret == 0);
1193 TEST_ASSERT(slen == sig_check->len);
1194 TEST_ASSERT(memcmp(sig, sig_check->x, slen) == 0);
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001195
Gilles Peskine449bd832023-01-11 14:50:10 +01001196 TEST_ASSERT(cnt_restart >= min_restart);
1197 TEST_ASSERT(cnt_restart <= max_restart);
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001198
1199 cnt_restart = 0;
1200 do {
Gilles Peskine449bd832023-01-11 14:50:10 +01001201 ret = mbedtls_pk_verify_restartable(&pub, md_alg,
1202 hash->x, hash->len, sig, slen, &rs_ctx);
1203 } while (ret == MBEDTLS_ERR_ECP_IN_PROGRESS && ++cnt_restart);
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001204
Gilles Peskine449bd832023-01-11 14:50:10 +01001205 TEST_ASSERT(ret == 0);
1206 TEST_ASSERT(cnt_restart >= min_restart);
1207 TEST_ASSERT(cnt_restart <= max_restart);
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001208
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001209 sig[0]++;
1210 do {
Gilles Peskine449bd832023-01-11 14:50:10 +01001211 ret = mbedtls_pk_verify_restartable(&pub, md_alg,
1212 hash->x, hash->len, sig, slen, &rs_ctx);
1213 } while (ret == MBEDTLS_ERR_ECP_IN_PROGRESS);
1214 TEST_ASSERT(ret != 0);
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001215 sig[0]--;
1216
Manuel Pégourié-Gonnard46ba7f32017-08-28 12:20:39 +02001217 /* Do we leak memory when aborting? try verify then sign
1218 * This test only makes sense when we actually restart */
Gilles Peskine449bd832023-01-11 14:50:10 +01001219 if (min_restart > 0) {
1220 ret = mbedtls_pk_verify_restartable(&pub, md_alg,
1221 hash->x, hash->len, sig, slen, &rs_ctx);
1222 TEST_ASSERT(ret == MBEDTLS_ERR_ECP_IN_PROGRESS);
1223 mbedtls_pk_restart_free(&rs_ctx);
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001224
Gilles Peskine449bd832023-01-11 14:50:10 +01001225 slen = sizeof(sig);
1226 ret = mbedtls_pk_sign_restartable(&prv, md_alg, hash->x, hash->len,
Dave Rodgman6dd757a2023-02-02 12:40:50 +00001227 sig, sizeof(sig), &slen,
Gilles Peskine449bd832023-01-11 14:50:10 +01001228 mbedtls_test_rnd_std_rand, NULL,
1229 &rs_ctx);
1230 TEST_ASSERT(ret == MBEDTLS_ERR_ECP_IN_PROGRESS);
Manuel Pégourié-Gonnard46ba7f32017-08-28 12:20:39 +02001231 }
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001232
1233exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001234 mbedtls_pk_restart_free(&rs_ctx);
1235 mbedtls_pk_free(&prv);
1236 mbedtls_pk_free(&pub);
Neil Armstrong56d51272022-02-22 15:29:05 +01001237 USE_PSA_DONE();
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001238}
1239/* END_CASE */
1240
Gilles Peskine74860dd2024-02-12 14:25:18 +01001241/* BEGIN_CASE depends_on:MBEDTLS_MD_CAN_SHA256:PK_CAN_SIGN_SOME */
Gilles Peskine46ee81d2024-02-13 20:05:29 +01001242void pk_sign_verify(int type, int curve_or_keybits, int rsa_padding, int rsa_md_alg,
1243 int sign_ret, int verify_ret)
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +02001244{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001245 mbedtls_pk_context pk;
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +02001246 size_t sig_len;
Gilles Peskine6e3187b2021-06-22 18:39:53 +02001247 unsigned char hash[32]; // Hard-coded for SHA256
Gilles Peskine449bd832023-01-11 14:50:10 +01001248 size_t hash_len = sizeof(hash);
Gilles Peskineeba088a2019-11-05 16:32:32 +01001249 unsigned char sig[MBEDTLS_PK_SIGNATURE_MAX_SIZE];
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001250 void *rs_ctx = NULL;
1251#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard15d7df22017-08-17 14:33:31 +02001252 mbedtls_pk_restart_ctx ctx;
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001253
1254 rs_ctx = &ctx;
Gilles Peskine449bd832023-01-11 14:50:10 +01001255 mbedtls_pk_restart_init(rs_ctx);
Manuel Pégourié-Gonnard4edb9cb2018-07-02 12:23:23 +02001256 /* This value is large enough that the operation will complete in one run.
1257 * See comments at the top of ecp_test_vect_restart in
1258 * test_suite_ecp.function for estimates of operation counts. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001259 mbedtls_ecp_set_max_ops(42000);
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001260#endif
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +02001261
Valerio Settib79f7db2023-04-19 14:25:52 +02001262 mbedtls_pk_init(&pk);
valerio32f2ac92023-04-20 11:59:52 +02001263 MD_OR_USE_PSA_INIT();
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +02001264
Dave Rodgman6dd757a2023-02-02 12:40:50 +00001265 memset(hash, 0x2a, sizeof(hash));
1266 memset(sig, 0, sizeof(sig));
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +02001267
Gilles Peskine449bd832023-01-11 14:50:10 +01001268 TEST_ASSERT(mbedtls_pk_setup(&pk, mbedtls_pk_info_from_type(type)) == 0);
Tomi Fontanilles9c693482023-12-14 21:40:54 +02001269 TEST_ASSERT(pk_genkey(&pk, curve_or_keybits) == 0);
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +02001270
Gilles Peskine46ee81d2024-02-13 20:05:29 +01001271#if defined(MBEDTLS_RSA_C)
1272 if (type == MBEDTLS_PK_RSA) {
Gilles Peskine46ee81d2024-02-13 20:05:29 +01001273 TEST_ASSERT(mbedtls_rsa_set_padding(mbedtls_pk_rsa(pk), rsa_padding, rsa_md_alg) == 0);
1274 }
1275#else
1276 (void) rsa_padding;
1277 (void) rsa_md_alg;
1278#endif /* MBEDTLS_RSA_C */
1279
Gilles Peskine449bd832023-01-11 14:50:10 +01001280 TEST_ASSERT(mbedtls_pk_sign_restartable(&pk, MBEDTLS_MD_SHA256,
1281 hash, hash_len,
Dave Rodgman6dd757a2023-02-02 12:40:50 +00001282 sig, sizeof(sig), &sig_len,
Gilles Peskine449bd832023-01-11 14:50:10 +01001283 mbedtls_test_rnd_std_rand, NULL,
1284 rs_ctx) == sign_ret);
1285 if (sign_ret == 0) {
1286 TEST_ASSERT(sig_len <= MBEDTLS_PK_SIGNATURE_MAX_SIZE);
1287 } else {
Gilles Peskinef85e4e62019-11-12 11:08:23 +01001288 sig_len = MBEDTLS_PK_SIGNATURE_MAX_SIZE;
Gilles Peskine449bd832023-01-11 14:50:10 +01001289 }
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +02001290
Gilles Peskine449bd832023-01-11 14:50:10 +01001291 TEST_ASSERT(mbedtls_pk_verify(&pk, MBEDTLS_MD_SHA256,
1292 hash, hash_len, sig, sig_len) == verify_ret);
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +02001293
Gilles Peskine449bd832023-01-11 14:50:10 +01001294 if (verify_ret == 0) {
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001295 hash[0]++;
Gilles Peskine449bd832023-01-11 14:50:10 +01001296 TEST_ASSERT(mbedtls_pk_verify(&pk, MBEDTLS_MD_SHA256,
1297 hash, hash_len, sig, sig_len) != 0);
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001298 hash[0]--;
1299
1300 sig[0]++;
Gilles Peskine449bd832023-01-11 14:50:10 +01001301 TEST_ASSERT(mbedtls_pk_verify(&pk, MBEDTLS_MD_SHA256,
1302 hash, hash_len, sig, sig_len) != 0);
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001303 sig[0]--;
1304 }
1305
Gilles Peskine449bd832023-01-11 14:50:10 +01001306 TEST_ASSERT(mbedtls_pk_sign(&pk, MBEDTLS_MD_SHA256, hash, hash_len,
Dave Rodgman6dd757a2023-02-02 12:40:50 +00001307 sig, sizeof(sig), &sig_len,
Gilles Peskine449bd832023-01-11 14:50:10 +01001308 mbedtls_test_rnd_std_rand,
1309 NULL) == sign_ret);
1310 if (sign_ret == 0) {
1311 TEST_ASSERT(sig_len <= MBEDTLS_PK_SIGNATURE_MAX_SIZE);
1312 } else {
Gilles Peskinef85e4e62019-11-12 11:08:23 +01001313 sig_len = MBEDTLS_PK_SIGNATURE_MAX_SIZE;
Gilles Peskine449bd832023-01-11 14:50:10 +01001314 }
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001315
Gilles Peskine449bd832023-01-11 14:50:10 +01001316 TEST_ASSERT(mbedtls_pk_verify_restartable(&pk, MBEDTLS_MD_SHA256,
1317 hash, hash_len, sig, sig_len, rs_ctx) == verify_ret);
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001318
Gilles Peskine449bd832023-01-11 14:50:10 +01001319 if (verify_ret == 0) {
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001320 hash[0]++;
Gilles Peskine449bd832023-01-11 14:50:10 +01001321 TEST_ASSERT(mbedtls_pk_verify_restartable(&pk, MBEDTLS_MD_SHA256,
Dave Rodgman6dd757a2023-02-02 12:40:50 +00001322 hash, sizeof(hash), sig, sig_len, rs_ctx) != 0);
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001323 hash[0]--;
1324
1325 sig[0]++;
Gilles Peskine449bd832023-01-11 14:50:10 +01001326 TEST_ASSERT(mbedtls_pk_verify_restartable(&pk, MBEDTLS_MD_SHA256,
Dave Rodgman6dd757a2023-02-02 12:40:50 +00001327 hash, sizeof(hash), sig, sig_len, rs_ctx) != 0);
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001328 sig[0]--;
1329 }
1330
Paul Bakkerbd51b262014-07-10 15:26:12 +02001331exit:
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001332#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
Gilles Peskine449bd832023-01-11 14:50:10 +01001333 mbedtls_pk_restart_free(rs_ctx);
Manuel Pégourié-Gonnardc4ee9ac2017-05-08 10:09:36 +02001334#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01001335 mbedtls_pk_free(&pk);
Manuel Pégourié-Gonnardc584c272023-03-22 00:32:04 +01001336 MD_OR_USE_PSA_DONE();
Manuel Pégourié-Gonnardb0a467f2013-09-21 12:31:05 +02001337}
1338/* END_CASE */
Manuel Pégourié-Gonnard67d45832013-10-17 12:34:16 +02001339
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001340/* BEGIN_CASE depends_on:MBEDTLS_RSA_C */
Valerio Settiaeeefef2024-02-22 07:59:37 +01001341void pk_rsa_encrypt_decrypt_test(data_t *message, int mod, int padding,
Gilles Peskine449bd832023-01-11 14:50:10 +01001342 char *input_P, char *input_Q,
1343 char *input_N, char *input_E,
1344 int ret)
Manuel Pégourié-Gonnard67d45832013-10-17 12:34:16 +02001345{
Neil Armstronge0df42c2022-02-22 14:26:49 +01001346 unsigned char output[300], result[300];
Ronald Cron351f0ee2020-06-10 12:12:18 +02001347 mbedtls_test_rnd_pseudo_info rnd_info;
Neil Armstronge0df42c2022-02-22 14:26:49 +01001348 mbedtls_mpi N, P, Q, E;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001349 mbedtls_rsa_context *rsa;
1350 mbedtls_pk_context pk;
Neil Armstronge0df42c2022-02-22 14:26:49 +01001351 size_t olen, rlen;
1352
Gilles Peskine449bd832023-01-11 14:50:10 +01001353 mbedtls_pk_init(&pk);
1354 mbedtls_mpi_init(&N); mbedtls_mpi_init(&P);
1355 mbedtls_mpi_init(&Q); mbedtls_mpi_init(&E);
Valerio Settiaeeefef2024-02-22 07:59:37 +01001356 MD_OR_USE_PSA_INIT();
Manuel Pégourié-Gonnard67d45832013-10-17 12:34:16 +02001357
Gilles Peskine449bd832023-01-11 14:50:10 +01001358 memset(&rnd_info, 0, sizeof(mbedtls_test_rnd_pseudo_info));
1359 memset(output, 0, sizeof(output));
Manuel Pégourié-Gonnard67d45832013-10-17 12:34:16 +02001360
Neil Armstronge0df42c2022-02-22 14:26:49 +01001361 /* encryption test */
1362
1363 /* init pk-rsa context */
Gilles Peskine449bd832023-01-11 14:50:10 +01001364 TEST_ASSERT(mbedtls_pk_setup(&pk, mbedtls_pk_info_from_type(MBEDTLS_PK_RSA)) == 0);
1365 rsa = mbedtls_pk_rsa(pk);
Valerio Settiaeeefef2024-02-22 07:59:37 +01001366 mbedtls_rsa_set_padding(rsa, padding, MBEDTLS_MD_SHA1);
Manuel Pégourié-Gonnard67d45832013-10-17 12:34:16 +02001367
Neil Armstronge0df42c2022-02-22 14:26:49 +01001368 /* load public key */
Gilles Peskine92fb6042024-02-01 22:33:06 +01001369 rsa->len = (mod + 7) / 8;
Gilles Peskine449bd832023-01-11 14:50:10 +01001370 TEST_ASSERT(mbedtls_test_read_mpi(&rsa->N, input_N) == 0);
1371 TEST_ASSERT(mbedtls_test_read_mpi(&rsa->E, input_E) == 0);
Manuel Pégourié-Gonnard67d45832013-10-17 12:34:16 +02001372
Gilles Peskine449bd832023-01-11 14:50:10 +01001373 TEST_ASSERT(mbedtls_pk_encrypt(&pk, message->x, message->len,
1374 output, &olen, sizeof(output),
1375 mbedtls_test_rnd_pseudo_rand, &rnd_info) == ret);
Neil Armstronge0df42c2022-02-22 14:26:49 +01001376
1377 /* decryption test */
Gilles Peskine449bd832023-01-11 14:50:10 +01001378 mbedtls_mpi_init(&N); mbedtls_mpi_init(&P);
1379 mbedtls_mpi_init(&Q); mbedtls_mpi_init(&E);
Neil Armstronge0df42c2022-02-22 14:26:49 +01001380
1381 /* init pk-rsa context */
Gilles Peskine449bd832023-01-11 14:50:10 +01001382 mbedtls_pk_free(&pk);
1383 TEST_ASSERT(mbedtls_pk_setup(&pk,
1384 mbedtls_pk_info_from_type(MBEDTLS_PK_RSA)) == 0);
1385 rsa = mbedtls_pk_rsa(pk);
Valerio Settiaeeefef2024-02-22 07:59:37 +01001386 mbedtls_rsa_set_padding(rsa, padding, MBEDTLS_MD_SHA1);
Neil Armstronge0df42c2022-02-22 14:26:49 +01001387
1388 /* load public key */
Gilles Peskine449bd832023-01-11 14:50:10 +01001389 TEST_ASSERT(mbedtls_test_read_mpi(&N, input_N) == 0);
1390 TEST_ASSERT(mbedtls_test_read_mpi(&E, input_E) == 0);
Neil Armstronge0df42c2022-02-22 14:26:49 +01001391
1392 /* load private key */
Gilles Peskine449bd832023-01-11 14:50:10 +01001393 TEST_ASSERT(mbedtls_test_read_mpi(&P, input_P) == 0);
1394 TEST_ASSERT(mbedtls_test_read_mpi(&Q, input_Q) == 0);
1395 TEST_ASSERT(mbedtls_rsa_import(rsa, &N, &P, &Q, NULL, &E) == 0);
Gilles Peskine92fb6042024-02-01 22:33:06 +01001396 TEST_EQUAL(mbedtls_rsa_get_len(rsa), (mod + 7) / 8);
Gilles Peskine449bd832023-01-11 14:50:10 +01001397 TEST_ASSERT(mbedtls_rsa_complete(rsa) == 0);
Neil Armstronge0df42c2022-02-22 14:26:49 +01001398
Gilles Peskine92fb6042024-02-01 22:33:06 +01001399 TEST_EQUAL(mbedtls_pk_get_len(&pk), (mod + 7) / 8);
1400 TEST_EQUAL(mbedtls_pk_get_bitlen(&pk), mod);
1401
Gilles Peskine449bd832023-01-11 14:50:10 +01001402 memset(result, 0, sizeof(result));
Neil Armstronge0df42c2022-02-22 14:26:49 +01001403 rlen = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01001404 TEST_ASSERT(mbedtls_pk_decrypt(&pk, output, olen,
1405 result, &rlen, sizeof(result),
1406 mbedtls_test_rnd_pseudo_rand, &rnd_info) == ret);
1407 if (ret == 0) {
1408 TEST_ASSERT(rlen == message->len);
1409 TEST_ASSERT(memcmp(result, message->x, rlen) == 0);
Neil Armstronge0df42c2022-02-22 14:26:49 +01001410 }
Manuel Pégourié-Gonnard67d45832013-10-17 12:34:16 +02001411
Paul Bakkerbd51b262014-07-10 15:26:12 +02001412exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001413 mbedtls_mpi_free(&N); mbedtls_mpi_free(&P);
1414 mbedtls_mpi_free(&Q); mbedtls_mpi_free(&E);
1415 mbedtls_pk_free(&pk);
Valerio Settiaeeefef2024-02-22 07:59:37 +01001416 MD_OR_USE_PSA_DONE();
Manuel Pégourié-Gonnard67d45832013-10-17 12:34:16 +02001417}
1418/* END_CASE */
1419
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001420/* BEGIN_CASE depends_on:MBEDTLS_RSA_C */
Gilles Peskine46ee81d2024-02-13 20:05:29 +01001421void pk_rsa_decrypt_test_vec(data_t *cipher, int mod, int padding, int md_alg,
Gilles Peskine449bd832023-01-11 14:50:10 +01001422 char *input_P, char *input_Q,
1423 char *input_N, char *input_E,
1424 data_t *clear, int ret)
Manuel Pégourié-Gonnard67d45832013-10-17 12:34:16 +02001425{
Ron Eldor58e3f692018-11-21 13:44:31 +02001426 unsigned char output[256];
Ronald Cron351f0ee2020-06-10 12:12:18 +02001427 mbedtls_test_rnd_pseudo_info rnd_info;
Hanno Beckerd71dc152017-08-23 06:32:42 +01001428 mbedtls_mpi N, P, Q, E;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001429 mbedtls_rsa_context *rsa;
1430 mbedtls_pk_context pk;
Azim Khanf1aaec92017-05-30 14:23:15 +01001431 size_t olen;
Manuel Pégourié-Gonnard67d45832013-10-17 12:34:16 +02001432
Gilles Peskine449bd832023-01-11 14:50:10 +01001433 mbedtls_pk_init(&pk);
1434 mbedtls_mpi_init(&N); mbedtls_mpi_init(&P);
1435 mbedtls_mpi_init(&Q); mbedtls_mpi_init(&E);
Gilles Peskine46ee81d2024-02-13 20:05:29 +01001436 MD_OR_USE_PSA_INIT();
Manuel Pégourié-Gonnard67d45832013-10-17 12:34:16 +02001437
Gilles Peskine449bd832023-01-11 14:50:10 +01001438 memset(&rnd_info, 0, sizeof(mbedtls_test_rnd_pseudo_info));
Manuel Pégourié-Gonnard67d45832013-10-17 12:34:16 +02001439
Manuel Pégourié-Gonnard67d45832013-10-17 12:34:16 +02001440 /* init pk-rsa context */
Gilles Peskine449bd832023-01-11 14:50:10 +01001441 TEST_ASSERT(mbedtls_pk_setup(&pk, mbedtls_pk_info_from_type(MBEDTLS_PK_RSA)) == 0);
1442 rsa = mbedtls_pk_rsa(pk);
Manuel Pégourié-Gonnard67d45832013-10-17 12:34:16 +02001443
1444 /* load public key */
Gilles Peskine449bd832023-01-11 14:50:10 +01001445 TEST_ASSERT(mbedtls_test_read_mpi(&N, input_N) == 0);
1446 TEST_ASSERT(mbedtls_test_read_mpi(&E, input_E) == 0);
Manuel Pégourié-Gonnard67d45832013-10-17 12:34:16 +02001447
1448 /* load private key */
Gilles Peskine449bd832023-01-11 14:50:10 +01001449 TEST_ASSERT(mbedtls_test_read_mpi(&P, input_P) == 0);
1450 TEST_ASSERT(mbedtls_test_read_mpi(&Q, input_Q) == 0);
1451 TEST_ASSERT(mbedtls_rsa_import(rsa, &N, &P, &Q, NULL, &E) == 0);
Gilles Peskine92fb6042024-02-01 22:33:06 +01001452 TEST_EQUAL(mbedtls_rsa_get_len(rsa), (mod + 7) / 8);
Gilles Peskine449bd832023-01-11 14:50:10 +01001453 TEST_ASSERT(mbedtls_rsa_complete(rsa) == 0);
Manuel Pégourié-Gonnard67d45832013-10-17 12:34:16 +02001454
Gilles Peskine92fb6042024-02-01 22:33:06 +01001455 TEST_EQUAL(mbedtls_pk_get_bitlen(&pk), mod);
1456 TEST_EQUAL(mbedtls_pk_get_len(&pk), (mod + 7) / 8);
1457
Gilles Peskine46ee81d2024-02-13 20:05:29 +01001458 /* set padding mode */
1459 if (padding >= 0) {
1460 TEST_EQUAL(mbedtls_rsa_set_padding(rsa, padding, md_alg), 0);
1461 }
1462
Manuel Pégourié-Gonnard67d45832013-10-17 12:34:16 +02001463 /* decryption test */
Gilles Peskine449bd832023-01-11 14:50:10 +01001464 memset(output, 0, sizeof(output));
Manuel Pégourié-Gonnard67d45832013-10-17 12:34:16 +02001465 olen = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01001466 TEST_ASSERT(mbedtls_pk_decrypt(&pk, cipher->x, cipher->len,
1467 output, &olen, sizeof(output),
1468 mbedtls_test_rnd_pseudo_rand, &rnd_info) == ret);
1469 if (ret == 0) {
1470 TEST_ASSERT(olen == clear->len);
1471 TEST_ASSERT(memcmp(output, clear->x, olen) == 0);
Manuel Pégourié-Gonnard67d45832013-10-17 12:34:16 +02001472 }
1473
Paul Bakkerbd51b262014-07-10 15:26:12 +02001474exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001475 mbedtls_mpi_free(&N); mbedtls_mpi_free(&P);
1476 mbedtls_mpi_free(&Q); mbedtls_mpi_free(&E);
1477 mbedtls_pk_free(&pk);
Gilles Peskine46ee81d2024-02-13 20:05:29 +01001478 MD_OR_USE_PSA_DONE();
Manuel Pégourié-Gonnard67d45832013-10-17 12:34:16 +02001479}
1480/* END_CASE */
Manuel Pégourié-Gonnard75c78822013-10-17 12:46:39 +02001481
Neil Armstrongb32ae722022-04-22 15:02:47 +02001482/* BEGIN_CASE depends_on:MBEDTLS_RSA_C:MBEDTLS_USE_PSA_CRYPTO */
Gilles Peskine449bd832023-01-11 14:50:10 +01001483void pk_wrap_rsa_decrypt_test_vec(data_t *cipher, int mod,
1484 char *input_P, char *input_Q,
1485 char *input_N, char *input_E,
Valerio Setti1b533ab2024-03-20 15:43:33 +01001486 int padding_mode,
Gilles Peskine449bd832023-01-11 14:50:10 +01001487 data_t *clear, int ret)
Neil Armstrongb32ae722022-04-22 15:02:47 +02001488{
1489 unsigned char output[256];
1490 mbedtls_test_rnd_pseudo_info rnd_info;
1491 mbedtls_mpi N, P, Q, E;
1492 mbedtls_rsa_context *rsa;
1493 mbedtls_pk_context pk;
Valerio Setti1fa2f6e2024-02-27 08:11:25 +01001494 mbedtls_svc_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT;
1495 psa_key_attributes_t key_attr = PSA_KEY_ATTRIBUTES_INIT;
Neil Armstrongb32ae722022-04-22 15:02:47 +02001496 size_t olen;
1497
Gilles Peskine449bd832023-01-11 14:50:10 +01001498 mbedtls_pk_init(&pk);
1499 mbedtls_mpi_init(&N); mbedtls_mpi_init(&P);
1500 mbedtls_mpi_init(&Q); mbedtls_mpi_init(&E);
valerio32f2ac92023-04-20 11:59:52 +02001501 USE_PSA_INIT();
Neil Armstrongb32ae722022-04-22 15:02:47 +02001502
Gilles Peskine449bd832023-01-11 14:50:10 +01001503 memset(&rnd_info, 0, sizeof(mbedtls_test_rnd_pseudo_info));
Neil Armstrongb32ae722022-04-22 15:02:47 +02001504
1505 /* init pk-rsa context */
Gilles Peskine449bd832023-01-11 14:50:10 +01001506 TEST_EQUAL(mbedtls_pk_setup(&pk,
1507 mbedtls_pk_info_from_type(MBEDTLS_PK_RSA)), 0);
1508 rsa = mbedtls_pk_rsa(pk);
Neil Armstrongb32ae722022-04-22 15:02:47 +02001509
1510 /* load public key */
Gilles Peskine449bd832023-01-11 14:50:10 +01001511 TEST_EQUAL(mbedtls_test_read_mpi(&N, input_N), 0);
1512 TEST_EQUAL(mbedtls_test_read_mpi(&E, input_E), 0);
Neil Armstrongb32ae722022-04-22 15:02:47 +02001513
1514 /* load private key */
Gilles Peskine449bd832023-01-11 14:50:10 +01001515 TEST_EQUAL(mbedtls_test_read_mpi(&P, input_P), 0);
1516 TEST_EQUAL(mbedtls_test_read_mpi(&Q, input_Q), 0);
1517 TEST_EQUAL(mbedtls_rsa_import(rsa, &N, &P, &Q, NULL, &E), 0);
Gilles Peskine92fb6042024-02-01 22:33:06 +01001518 TEST_EQUAL(mbedtls_rsa_get_len(rsa), (mod + 7) / 8);
Gilles Peskine449bd832023-01-11 14:50:10 +01001519 TEST_EQUAL(mbedtls_rsa_complete(rsa), 0);
Neil Armstrongb32ae722022-04-22 15:02:47 +02001520
Valerio Setti1b533ab2024-03-20 15:43:33 +01001521 /* Set padding mode */
1522 if (padding_mode == MBEDTLS_RSA_PKCS_V21) {
1523 TEST_EQUAL(mbedtls_rsa_set_padding(rsa, padding_mode, MBEDTLS_MD_SHA1), 0);
1524 }
1525
Neil Armstrongb32ae722022-04-22 15:02:47 +02001526 /* Turn PK context into an opaque one. */
Valerio Setti1fa2f6e2024-02-27 08:11:25 +01001527 TEST_EQUAL(mbedtls_pk_get_psa_attributes(&pk, PSA_KEY_USAGE_DECRYPT, &key_attr), 0);
1528 TEST_EQUAL(mbedtls_pk_import_into_psa(&pk, &key_attr, &key_id), 0);
1529 mbedtls_pk_free(&pk);
1530 mbedtls_pk_init(&pk);
1531 TEST_EQUAL(mbedtls_pk_setup_opaque(&pk, key_id), 0);
Neil Armstrongb32ae722022-04-22 15:02:47 +02001532
Gilles Peskine92fb6042024-02-01 22:33:06 +01001533 TEST_EQUAL(mbedtls_pk_get_bitlen(&pk), mod);
1534
Neil Armstrongb32ae722022-04-22 15:02:47 +02001535 /* decryption test */
Gilles Peskine449bd832023-01-11 14:50:10 +01001536 memset(output, 0, sizeof(output));
Neil Armstrongb32ae722022-04-22 15:02:47 +02001537 olen = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01001538 TEST_EQUAL(mbedtls_pk_decrypt(&pk, cipher->x, cipher->len,
1539 output, &olen, sizeof(output),
1540 mbedtls_test_rnd_pseudo_rand, &rnd_info), ret);
1541 if (ret == 0) {
1542 TEST_EQUAL(olen, clear->len);
1543 TEST_EQUAL(memcmp(output, clear->x, olen), 0);
Neil Armstrongb32ae722022-04-22 15:02:47 +02001544 }
1545
Gilles Peskine449bd832023-01-11 14:50:10 +01001546 TEST_EQUAL(PSA_SUCCESS, psa_destroy_key(key_id));
Neil Armstrongb32ae722022-04-22 15:02:47 +02001547
1548exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001549 mbedtls_mpi_free(&N); mbedtls_mpi_free(&P);
1550 mbedtls_mpi_free(&Q); mbedtls_mpi_free(&E);
1551 mbedtls_pk_free(&pk);
1552 USE_PSA_DONE();
Neil Armstrongb32ae722022-04-22 15:02:47 +02001553}
1554/* END_CASE */
1555
Manuel Pégourié-Gonnard75c78822013-10-17 12:46:39 +02001556/* BEGIN_CASE */
Gilles Peskine449bd832023-01-11 14:50:10 +01001557void pk_ec_nocrypt(int type)
Manuel Pégourié-Gonnard75c78822013-10-17 12:46:39 +02001558{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001559 mbedtls_pk_context pk;
Manuel Pégourié-Gonnard75c78822013-10-17 12:46:39 +02001560 unsigned char output[100];
1561 unsigned char input[100];
Ronald Cron351f0ee2020-06-10 12:12:18 +02001562 mbedtls_test_rnd_pseudo_info rnd_info;
Manuel Pégourié-Gonnard75c78822013-10-17 12:46:39 +02001563 size_t olen = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001564 int ret = MBEDTLS_ERR_PK_TYPE_MISMATCH;
Manuel Pégourié-Gonnard75c78822013-10-17 12:46:39 +02001565
Gilles Peskine449bd832023-01-11 14:50:10 +01001566 mbedtls_pk_init(&pk);
valerio32f2ac92023-04-20 11:59:52 +02001567 USE_PSA_INIT();
Manuel Pégourié-Gonnard75c78822013-10-17 12:46:39 +02001568
Gilles Peskine449bd832023-01-11 14:50:10 +01001569 memset(&rnd_info, 0, sizeof(mbedtls_test_rnd_pseudo_info));
1570 memset(output, 0, sizeof(output));
1571 memset(input, 0, sizeof(input));
Manuel Pégourié-Gonnard75c78822013-10-17 12:46:39 +02001572
Gilles Peskine449bd832023-01-11 14:50:10 +01001573 TEST_ASSERT(mbedtls_pk_setup(&pk, mbedtls_pk_info_from_type(type)) == 0);
Manuel Pégourié-Gonnard75c78822013-10-17 12:46:39 +02001574
Gilles Peskine449bd832023-01-11 14:50:10 +01001575 TEST_ASSERT(mbedtls_pk_encrypt(&pk, input, sizeof(input),
1576 output, &olen, sizeof(output),
1577 mbedtls_test_rnd_pseudo_rand, &rnd_info) == ret);
Manuel Pégourié-Gonnard75c78822013-10-17 12:46:39 +02001578
Gilles Peskine449bd832023-01-11 14:50:10 +01001579 TEST_ASSERT(mbedtls_pk_decrypt(&pk, input, sizeof(input),
1580 output, &olen, sizeof(output),
1581 mbedtls_test_rnd_pseudo_rand, &rnd_info) == ret);
Manuel Pégourié-Gonnard75c78822013-10-17 12:46:39 +02001582
Paul Bakkerbd51b262014-07-10 15:26:12 +02001583exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001584 mbedtls_pk_free(&pk);
Valerio Settib79f7db2023-04-19 14:25:52 +02001585 USE_PSA_DONE();
Manuel Pégourié-Gonnard75c78822013-10-17 12:46:39 +02001586}
1587/* END_CASE */
Manuel Pégourié-Gonnard01488752014-04-03 22:09:18 +02001588
Andres Amaya Garcia7ea67272017-05-08 11:15:49 +01001589/* BEGIN_CASE depends_on:MBEDTLS_RSA_C */
Gilles Peskine449bd832023-01-11 14:50:10 +01001590void pk_rsa_overflow()
Andres AG5c79d252017-02-15 10:52:32 +00001591{
1592 mbedtls_pk_context pk;
Valerio Setti8bb93bb2023-04-24 09:19:45 +02001593 size_t hash_len = UINT_MAX + 1, sig_len = UINT_MAX + 1;
itayzafrir693a1d92018-02-26 12:02:10 +02001594 unsigned char hash[50], sig[100];
Andres Amaya Garcia7ea67272017-05-08 11:15:49 +01001595
valerio32f2ac92023-04-20 11:59:52 +02001596 mbedtls_pk_init(&pk);
Valerio Settib79f7db2023-04-19 14:25:52 +02001597 USE_PSA_INIT();
valerio32f2ac92023-04-20 11:59:52 +02001598
Dave Rodgman6dd757a2023-02-02 12:40:50 +00001599 memset(hash, 0x2a, sizeof(hash));
1600 memset(sig, 0, sizeof(sig));
Andres AG5c79d252017-02-15 10:52:32 +00001601
Tomi Fontanilles81746622023-07-16 13:06:06 +03001602 TEST_EQUAL(mbedtls_pk_setup(&pk,
1603 mbedtls_pk_info_from_type(MBEDTLS_PK_RSA)), 0);
Andres AG5c79d252017-02-15 10:52:32 +00001604
1605#if defined(MBEDTLS_PKCS1_V21)
Tomi Fontanilles81746622023-07-16 13:06:06 +03001606 TEST_EQUAL(mbedtls_pk_verify_ext(MBEDTLS_PK_RSASSA_PSS, NULL, &pk,
1607 MBEDTLS_MD_NONE, hash, hash_len, sig, sig_len),
1608 MBEDTLS_ERR_PK_BAD_INPUT_DATA);
Andres AG5c79d252017-02-15 10:52:32 +00001609#endif /* MBEDTLS_PKCS1_V21 */
1610
Tomi Fontanilles81746622023-07-16 13:06:06 +03001611 TEST_EQUAL(mbedtls_pk_verify(&pk, MBEDTLS_MD_NONE, hash, hash_len,
1612 sig, sig_len),
1613 MBEDTLS_ERR_PK_BAD_INPUT_DATA);
Andres AG5c79d252017-02-15 10:52:32 +00001614
Tomi Fontanilles81746622023-07-16 13:06:06 +03001615#if defined(MBEDTLS_PKCS1_V21)
1616 TEST_EQUAL(mbedtls_pk_sign_ext(MBEDTLS_PK_RSASSA_PSS, &pk,
1617 MBEDTLS_MD_NONE, hash, hash_len,
1618 sig, sizeof(sig), &sig_len,
1619 mbedtls_test_rnd_std_rand, NULL),
1620 MBEDTLS_ERR_PK_BAD_INPUT_DATA);
1621#endif /* MBEDTLS_PKCS1_V21 */
1622
1623 TEST_EQUAL(mbedtls_pk_sign(&pk, MBEDTLS_MD_NONE, hash, hash_len,
1624 sig, sizeof(sig), &sig_len,
1625 mbedtls_test_rnd_std_rand, NULL),
1626 MBEDTLS_ERR_PK_BAD_INPUT_DATA);
Andres AG5c79d252017-02-15 10:52:32 +00001627
1628exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001629 mbedtls_pk_free(&pk);
Valerio Settib79f7db2023-04-19 14:25:52 +02001630 USE_PSA_DONE();
Andres AG5c79d252017-02-15 10:52:32 +00001631}
1632/* END_CASE */
1633
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001634/* BEGIN_CASE depends_on:MBEDTLS_RSA_C:MBEDTLS_PK_RSA_ALT_SUPPORT */
Gilles Peskine449bd832023-01-11 14:50:10 +01001635void pk_rsa_alt()
Manuel Pégourié-Gonnard01488752014-04-03 22:09:18 +02001636{
1637 /*
1638 * An rsa_alt context can only do private operations (decrypt, sign).
1639 * Test it against the public operations (encrypt, verify) of a
1640 * corresponding rsa context.
1641 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001642 mbedtls_rsa_context raw;
1643 mbedtls_pk_context rsa, alt;
1644 mbedtls_pk_debug_item dbg_items[10];
Waleed Elmelegy76336c32023-06-30 16:48:19 +01001645 unsigned char hash[50], sig[RSA_KEY_LEN];
1646 unsigned char msg[50], ciph[RSA_KEY_LEN], test[50];
Manuel Pégourié-Gonnard01488752014-04-03 22:09:18 +02001647 size_t sig_len, ciph_len, test_len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001648 int ret = MBEDTLS_ERR_PK_TYPE_MISMATCH;
Manuel Pégourié-Gonnard01488752014-04-03 22:09:18 +02001649
Gilles Peskine449bd832023-01-11 14:50:10 +01001650 mbedtls_rsa_init(&raw);
valerio32f2ac92023-04-20 11:59:52 +02001651 mbedtls_pk_init(&rsa);
1652 mbedtls_pk_init(&alt);
1653 USE_PSA_INIT();
Manuel Pégourié-Gonnard01488752014-04-03 22:09:18 +02001654
Dave Rodgman6dd757a2023-02-02 12:40:50 +00001655 memset(hash, 0x2a, sizeof(hash));
1656 memset(sig, 0, sizeof(sig));
1657 memset(msg, 0x2a, sizeof(msg));
1658 memset(ciph, 0, sizeof(ciph));
1659 memset(test, 0, sizeof(test));
Manuel Pégourié-Gonnard01488752014-04-03 22:09:18 +02001660
Shaun Case8b0ecbc2021-12-20 21:14:10 -08001661 /* Initialize PK RSA context with random key */
Gilles Peskine449bd832023-01-11 14:50:10 +01001662 TEST_ASSERT(mbedtls_pk_setup(&rsa,
1663 mbedtls_pk_info_from_type(MBEDTLS_PK_RSA)) == 0);
1664 TEST_ASSERT(pk_genkey(&rsa, RSA_KEY_SIZE) == 0);
Manuel Pégourié-Gonnard01488752014-04-03 22:09:18 +02001665
1666 /* Extract key to the raw rsa context */
Gilles Peskine449bd832023-01-11 14:50:10 +01001667 TEST_ASSERT(mbedtls_rsa_copy(&raw, mbedtls_pk_rsa(rsa)) == 0);
Manuel Pégourié-Gonnard01488752014-04-03 22:09:18 +02001668
1669 /* Initialize PK RSA_ALT context */
Gilles Peskine449bd832023-01-11 14:50:10 +01001670 TEST_ASSERT(mbedtls_pk_setup_rsa_alt(&alt, (void *) &raw,
1671 mbedtls_rsa_decrypt_func, mbedtls_rsa_sign_func,
1672 mbedtls_rsa_key_len_func) == 0);
Manuel Pégourié-Gonnard01488752014-04-03 22:09:18 +02001673
1674 /* Test administrative functions */
Gilles Peskine449bd832023-01-11 14:50:10 +01001675 TEST_ASSERT(mbedtls_pk_can_do(&alt, MBEDTLS_PK_RSA));
1676 TEST_ASSERT(mbedtls_pk_get_bitlen(&alt) == RSA_KEY_SIZE);
1677 TEST_ASSERT(mbedtls_pk_get_len(&alt) == RSA_KEY_LEN);
1678 TEST_ASSERT(mbedtls_pk_get_type(&alt) == MBEDTLS_PK_RSA_ALT);
1679 TEST_ASSERT(strcmp(mbedtls_pk_get_name(&alt), "RSA-alt") == 0);
Manuel Pégourié-Gonnard01488752014-04-03 22:09:18 +02001680
Gilles Peskine0b172552024-01-18 14:11:26 +01001681#if defined(MBEDTLS_PSA_CRYPTO_C)
1682 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
1683 TEST_EQUAL(mbedtls_pk_get_psa_attributes(&alt,
1684 PSA_KEY_USAGE_ENCRYPT,
1685 &attributes),
1686 MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE);
Gilles Peskinefc3d8662024-02-09 19:26:37 +01001687 mbedtls_svc_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT;
1688 TEST_EQUAL(mbedtls_pk_import_into_psa(&alt, &attributes, &key_id),
1689 MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE);
Gilles Peskine0b172552024-01-18 14:11:26 +01001690#endif /* MBEDTLS_PSA_CRYPTO_C */
1691
Manuel Pégourié-Gonnard01488752014-04-03 22:09:18 +02001692 /* Test signature */
Dave Rodgmand26d7442023-02-11 17:14:54 +00001693#if SIZE_MAX > UINT_MAX
Gilles Peskine449bd832023-01-11 14:50:10 +01001694 TEST_ASSERT(mbedtls_pk_sign(&alt, MBEDTLS_MD_NONE, hash, SIZE_MAX,
Dave Rodgman6dd757a2023-02-02 12:40:50 +00001695 sig, sizeof(sig), &sig_len,
Gilles Peskine449bd832023-01-11 14:50:10 +01001696 mbedtls_test_rnd_std_rand, NULL)
1697 == MBEDTLS_ERR_PK_BAD_INPUT_DATA);
Dave Rodgmand26d7442023-02-11 17:14:54 +00001698#endif /* SIZE_MAX > UINT_MAX */
Dave Rodgman6dd757a2023-02-02 12:40:50 +00001699 TEST_ASSERT(mbedtls_pk_sign(&alt, MBEDTLS_MD_NONE, hash, sizeof(hash),
1700 sig, sizeof(sig), &sig_len,
Gilles Peskine449bd832023-01-11 14:50:10 +01001701 mbedtls_test_rnd_std_rand, NULL)
1702 == 0);
1703 TEST_ASSERT(sig_len == RSA_KEY_LEN);
1704 TEST_ASSERT(mbedtls_pk_verify(&rsa, MBEDTLS_MD_NONE,
Dave Rodgman6dd757a2023-02-02 12:40:50 +00001705 hash, sizeof(hash), sig, sig_len) == 0);
Manuel Pégourié-Gonnard01488752014-04-03 22:09:18 +02001706
1707 /* Test decrypt */
Dave Rodgman6dd757a2023-02-02 12:40:50 +00001708 TEST_ASSERT(mbedtls_pk_encrypt(&rsa, msg, sizeof(msg),
1709 ciph, &ciph_len, sizeof(ciph),
Gilles Peskine449bd832023-01-11 14:50:10 +01001710 mbedtls_test_rnd_std_rand, NULL) == 0);
1711 TEST_ASSERT(mbedtls_pk_decrypt(&alt, ciph, ciph_len,
Dave Rodgman6dd757a2023-02-02 12:40:50 +00001712 test, &test_len, sizeof(test),
Gilles Peskine449bd832023-01-11 14:50:10 +01001713 mbedtls_test_rnd_std_rand, NULL) == 0);
Dave Rodgman6dd757a2023-02-02 12:40:50 +00001714 TEST_ASSERT(test_len == sizeof(msg));
Gilles Peskine449bd832023-01-11 14:50:10 +01001715 TEST_ASSERT(memcmp(test, msg, test_len) == 0);
Manuel Pégourié-Gonnard01488752014-04-03 22:09:18 +02001716
1717 /* Test forbidden operations */
Dave Rodgman6dd757a2023-02-02 12:40:50 +00001718 TEST_ASSERT(mbedtls_pk_encrypt(&alt, msg, sizeof(msg),
1719 ciph, &ciph_len, sizeof(ciph),
Gilles Peskine449bd832023-01-11 14:50:10 +01001720 mbedtls_test_rnd_std_rand, NULL) == ret);
1721 TEST_ASSERT(mbedtls_pk_verify(&alt, MBEDTLS_MD_NONE,
Dave Rodgman6dd757a2023-02-02 12:40:50 +00001722 hash, sizeof(hash), sig, sig_len) == ret);
Gilles Peskine449bd832023-01-11 14:50:10 +01001723 TEST_ASSERT(mbedtls_pk_debug(&alt, dbg_items) == ret);
Manuel Pégourié-Gonnard01488752014-04-03 22:09:18 +02001724
Paul Bakkerbd51b262014-07-10 15:26:12 +02001725exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001726 mbedtls_rsa_free(&raw);
1727 mbedtls_pk_free(&rsa); mbedtls_pk_free(&alt);
1728 USE_PSA_DONE();
Manuel Pégourié-Gonnard01488752014-04-03 22:09:18 +02001729}
1730/* END_CASE */
Manuel Pégourié-Gonnard36867712018-10-31 16:22:49 +01001731
Yanray Wang61f96602023-09-25 14:13:22 +08001732/* BEGIN_CASE depends_on:MBEDTLS_MD_CAN_SHA256:MBEDTLS_USE_PSA_CRYPTO:MBEDTLS_TEST_PK_PSA_SIGN */
Valerio Settiaa9cc492024-03-19 15:43:52 +01001733void pk_psa_sign(int psa_type, int bits, int rsa_padding)
Manuel Pégourié-Gonnard36867712018-10-31 16:22:49 +01001734{
1735 mbedtls_pk_context pk;
Gilles Peskine33b1c692019-12-19 00:09:47 +01001736 unsigned char hash[32];
Neil Armstrong67fc0362022-03-15 14:48:52 +01001737 unsigned char sig[MBEDTLS_PK_SIGNATURE_MAX_SIZE];
Valerio Setti144c27b2024-03-20 17:10:35 +01001738 unsigned char legacy_pub_key[MBEDTLS_PK_WRITE_PUBKEY_MAX_SIZE];
1739 unsigned char opaque_pub_key[MBEDTLS_PK_WRITE_PUBKEY_MAX_SIZE];
Valerio Settic2625612024-03-19 14:37:05 +01001740 size_t sig_len, legacy_pub_key_len, opaque_pub_key_len;
Valerio Setti1fa2f6e2024-02-27 08:11:25 +01001741 mbedtls_svc_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT;
Gilles Peskine85f47c92019-12-18 20:44:15 +01001742 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Valerio Setti480dfc72024-03-20 09:35:54 +01001743#if defined(MBEDTLS_RSA_C) || defined(MBEDTLS_PK_WRITE_C)
1744 int ret;
1745#endif /* MBEDTLS_RSA_C || MBEDTLS_PK_WRITE_C */
Valerio Settic2625612024-03-19 14:37:05 +01001746#if defined(MBEDTLS_PK_CAN_ECDSA_SIGN)
1747 mbedtls_ecp_group_id ecp_grp_id;
1748#endif /* MBEDTLS_PK_CAN_ECDSA_SIGN */
Manuel Pégourié-Gonnard36867712018-10-31 16:22:49 +01001749
1750 /*
Valerio Settid38480b2024-03-19 13:47:27 +01001751 * Following checks are perfomed:
1752 * - create an RSA/EC opaque context;
1753 * - sign with opaque context for both EC and RSA keys;
1754 * - [EC only] verify with opaque context;
1755 * - verify that public keys of opaque and non-opaque contexts match;
1756 * - verify with non-opaque context.
Manuel Pégourié-Gonnard36867712018-10-31 16:22:49 +01001757 */
1758
valerio32f2ac92023-04-20 11:59:52 +02001759 mbedtls_pk_init(&pk);
Valerio Settib79f7db2023-04-19 14:25:52 +02001760 USE_PSA_INIT();
Gilles Peskine5386f6b2019-08-01 12:47:40 +02001761
Valerio Settid38480b2024-03-19 13:47:27 +01001762 /* Create the legacy EC/RSA PK context. */
Neil Armstrong67fc0362022-03-15 14:48:52 +01001763#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_GENPRIME)
Tomi Fontanilles9c693482023-12-14 21:40:54 +02001764 if (PSA_KEY_TYPE_IS_RSA(psa_type)) {
Gilles Peskine449bd832023-01-11 14:50:10 +01001765 TEST_ASSERT(mbedtls_pk_setup(&pk,
1766 mbedtls_pk_info_from_type(MBEDTLS_PK_RSA)) == 0);
Valerio Setti027796c2024-03-20 16:55:35 +01001767 TEST_EQUAL(pk_genkey(&pk, bits), 0);
Valerio Settiaa9cc492024-03-19 15:43:52 +01001768 TEST_EQUAL(mbedtls_rsa_set_padding(mbedtls_pk_rsa(pk), rsa_padding, MBEDTLS_MD_NONE), 0);
Valerio Setti480dfc72024-03-20 09:35:54 +01001769 }
1770#else /* MBEDTLS_RSA_C && MBEDTLS_GENPRIME */
1771 (void) rsa_padding;
Neil Armstrong67fc0362022-03-15 14:48:52 +01001772#endif /* MBEDTLS_RSA_C && MBEDTLS_GENPRIME */
Valerio Setti48363742023-01-26 16:53:01 +01001773#if defined(MBEDTLS_PK_CAN_ECDSA_SIGN)
Tomi Fontanilles9c693482023-12-14 21:40:54 +02001774 if (PSA_KEY_TYPE_IS_ECC_KEY_PAIR(psa_type)) {
Valerio Settic2625612024-03-19 14:37:05 +01001775 ecp_grp_id = mbedtls_ecc_group_from_psa(psa_type, bits);
Valerio Settid38480b2024-03-19 13:47:27 +01001776 TEST_ASSERT(mbedtls_pk_setup(&pk, mbedtls_pk_info_from_type(MBEDTLS_PK_ECKEY)) == 0);
Valerio Settic2625612024-03-19 14:37:05 +01001777 TEST_ASSERT(pk_genkey(&pk, ecp_grp_id) == 0);
Neil Armstrong67fc0362022-03-15 14:48:52 +01001778 }
Valerio Setti480dfc72024-03-20 09:35:54 +01001779#endif /* MBEDTLS_PK_CAN_ECDSA_SIGN */
Hanno Becker56104ea2019-02-01 11:48:19 +00001780
Valerio Settid38480b2024-03-19 13:47:27 +01001781 /* Export public key from the non-opaque PK context we just created. */
Valerio Setti28330502024-03-21 05:24:12 +01001782#if defined(MBEDTLS_PK_PARSE_C) && defined(MBEDTLS_PK_WRITE_C)
Valerio Settic2625612024-03-19 14:37:05 +01001783 ret = mbedtls_pk_write_pubkey_der(&pk, legacy_pub_key, sizeof(legacy_pub_key));
Gilles Peskine449bd832023-01-11 14:50:10 +01001784 TEST_ASSERT(ret >= 0);
Valerio Settic2625612024-03-19 14:37:05 +01001785 legacy_pub_key_len = (size_t) ret;
1786 /* mbedtls_pk_write_pubkey_der() writes backwards in the data buffer so we
1787 * shift data back to the beginning of the buffer. */
1788 memmove(legacy_pub_key,
1789 legacy_pub_key + sizeof(legacy_pub_key) - legacy_pub_key_len,
1790 legacy_pub_key_len);
Valerio Setti28330502024-03-21 05:24:12 +01001791#else /* MBEDTLS_PK_PARSE_C && MBEDTLS_PK_WRITE_C */
Valerio Setti480dfc72024-03-20 09:35:54 +01001792#if defined(MBEDTLS_PK_CAN_ECDSA_SIGN)
Valerio Settid971b782024-03-19 15:08:53 +01001793 if (PSA_KEY_TYPE_IS_ECC_KEY_PAIR(psa_type)) {
1794 TEST_EQUAL(mbedtls_ecp_point_write_binary(&(mbedtls_pk_ec_ro(pk)->grp),
1795 &(mbedtls_pk_ec_ro(pk)->Q),
1796 MBEDTLS_ECP_PF_UNCOMPRESSED,
1797 &legacy_pub_key_len, legacy_pub_key,
1798 sizeof(legacy_pub_key)), 0);
Valerio Setti480dfc72024-03-20 09:35:54 +01001799 }
1800#endif /* MBEDTLS_PK_CAN_ECDSA_SIGN */
1801#if defined(MBEDTLS_RSA_C)
1802 if (PSA_KEY_TYPE_IS_RSA(psa_type)) {
Valerio Settid971b782024-03-19 15:08:53 +01001803 unsigned char *end = legacy_pub_key + sizeof(legacy_pub_key);
1804 ret = mbedtls_rsa_write_pubkey(mbedtls_pk_rsa(pk), legacy_pub_key, &end);
1805 legacy_pub_key_len = (size_t) ret;
1806 TEST_ASSERT(legacy_pub_key_len > 0);
1807 /* mbedtls_rsa_write_pubkey() writes data backward in the buffer so
1808 * we shift that to the origin of the buffer instead. */
1809 memmove(legacy_pub_key, end, legacy_pub_key_len);
1810 }
Valerio Setti480dfc72024-03-20 09:35:54 +01001811#endif /* MBEDTLS_RSA_C */
Valerio Setti28330502024-03-21 05:24:12 +01001812#endif /* MBEDTLS_PK_PARSE_C && MBEDTLS_PK_WRITE_C */
Hanno Becker56104ea2019-02-01 11:48:19 +00001813
Valerio Settid38480b2024-03-19 13:47:27 +01001814 /* Turn the PK context into an opaque one. */
Valerio Setti1fa2f6e2024-02-27 08:11:25 +01001815 TEST_EQUAL(mbedtls_pk_get_psa_attributes(&pk, PSA_KEY_USAGE_SIGN_HASH, &attributes), 0);
1816 TEST_EQUAL(mbedtls_pk_import_into_psa(&pk, &attributes, &key_id), 0);
1817 mbedtls_pk_free(&pk);
1818 mbedtls_pk_init(&pk);
1819 TEST_EQUAL(mbedtls_pk_setup_opaque(&pk, key_id), 0);
Manuel Pégourié-Gonnard36867712018-10-31 16:22:49 +01001820
Gilles Peskine449bd832023-01-11 14:50:10 +01001821 PSA_ASSERT(psa_get_key_attributes(key_id, &attributes));
Tomi Fontanilles9c693482023-12-14 21:40:54 +02001822 TEST_EQUAL(psa_get_key_type(&attributes), (psa_key_type_t) psa_type);
Valerio Settid38480b2024-03-19 13:47:27 +01001823 TEST_EQUAL(psa_get_key_bits(&attributes), (size_t) bits);
1824 TEST_EQUAL(psa_get_key_lifetime(&attributes), PSA_KEY_LIFETIME_VOLATILE);
Gilles Peskine85f47c92019-12-18 20:44:15 +01001825
Valerio Settid38480b2024-03-19 13:47:27 +01001826 /* Sign with the opaque context. */
Dave Rodgman6dd757a2023-02-02 12:40:50 +00001827 memset(hash, 0x2a, sizeof(hash));
1828 memset(sig, 0, sizeof(sig));
Gilles Peskine449bd832023-01-11 14:50:10 +01001829 TEST_ASSERT(mbedtls_pk_sign(&pk, MBEDTLS_MD_SHA256,
Dave Rodgman6dd757a2023-02-02 12:40:50 +00001830 hash, sizeof(hash), sig, sizeof(sig), &sig_len,
Gilles Peskine449bd832023-01-11 14:50:10 +01001831 NULL, NULL) == 0);
Valerio Settie7730772023-06-21 16:58:40 +02001832 /* Only opaque EC keys support verification. */
Tomi Fontanilles9c693482023-12-14 21:40:54 +02001833 if (PSA_KEY_TYPE_IS_ECC_KEY_PAIR(psa_type)) {
Valerio Settie7730772023-06-21 16:58:40 +02001834 TEST_ASSERT(mbedtls_pk_verify(&pk, MBEDTLS_MD_SHA256,
1835 hash, sizeof(hash), sig, sig_len) == 0);
1836 }
Manuel Pégourié-Gonnard36867712018-10-31 16:22:49 +01001837
Valerio Settid38480b2024-03-19 13:47:27 +01001838 /* Export public key from the opaque PK context. */
Valerio Setti28330502024-03-21 05:24:12 +01001839#if defined(MBEDTLS_PK_PARSE_C) && defined(MBEDTLS_PK_WRITE_C)
Valerio Settic2625612024-03-19 14:37:05 +01001840 ret = mbedtls_pk_write_pubkey_der(&pk, opaque_pub_key, sizeof(opaque_pub_key));
Gilles Peskine449bd832023-01-11 14:50:10 +01001841 TEST_ASSERT(ret >= 0);
Valerio Settic2625612024-03-19 14:37:05 +01001842 opaque_pub_key_len = (size_t) ret;
Hanno Becker56104ea2019-02-01 11:48:19 +00001843 /* mbedtls_pk_write_pubkey_der() writes backwards in the data buffer. */
Valerio Settic2625612024-03-19 14:37:05 +01001844 memmove(opaque_pub_key,
1845 opaque_pub_key + sizeof(opaque_pub_key) - opaque_pub_key_len,
1846 opaque_pub_key_len);
Valerio Setti28330502024-03-21 05:24:12 +01001847#else /* MBEDTLS_PK_PARSE_C && MBEDTLS_PK_WRITE_C */
Valerio Settic2625612024-03-19 14:37:05 +01001848 TEST_EQUAL(psa_export_public_key(key_id, opaque_pub_key, sizeof(opaque_pub_key),
1849 &opaque_pub_key_len), PSA_SUCCESS);
Valerio Setti28330502024-03-21 05:24:12 +01001850#endif /* MBEDTLS_PK_PARSE_C && MBEDTLS_PK_WRITE_C */
Manuel Pégourié-Gonnard36867712018-10-31 16:22:49 +01001851
Valerio Settid38480b2024-03-19 13:47:27 +01001852 /* Check that the public keys of opaque and non-opaque PK contexts match. */
Valerio Settic2625612024-03-19 14:37:05 +01001853 TEST_EQUAL(opaque_pub_key_len, legacy_pub_key_len);
1854 TEST_MEMORY_COMPARE(opaque_pub_key, opaque_pub_key_len, legacy_pub_key, legacy_pub_key_len);
Hanno Becker56104ea2019-02-01 11:48:19 +00001855
Valerio Settic2625612024-03-19 14:37:05 +01001856 /* Destroy the opaque PK context and the wrapped PSA key. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001857 mbedtls_pk_free(&pk);
1858 TEST_ASSERT(PSA_SUCCESS == psa_destroy_key(key_id));
Manuel Pégourié-Gonnard36867712018-10-31 16:22:49 +01001859
Valerio Setti6fb25862024-03-20 16:55:14 +01001860 /* Create a new non-opaque PK context to verify the signature. */
Valerio Settid38480b2024-03-19 13:47:27 +01001861 mbedtls_pk_init(&pk);
Valerio Setti28330502024-03-21 05:24:12 +01001862#if defined(MBEDTLS_PK_PARSE_C) && defined(MBEDTLS_PK_WRITE_C)
Valerio Settic2625612024-03-19 14:37:05 +01001863 TEST_EQUAL(mbedtls_pk_parse_public_key(&pk, legacy_pub_key, legacy_pub_key_len), 0);
Valerio Setti28330502024-03-21 05:24:12 +01001864#else /* MBEDTLS_PK_PARSE_C && MBEDTLS_PK_WRITE_C */
Valerio Setti480dfc72024-03-20 09:35:54 +01001865#if defined(MBEDTLS_PK_CAN_ECDSA_SIGN)
Valerio Settid971b782024-03-19 15:08:53 +01001866 if (PSA_KEY_TYPE_IS_ECC_KEY_PAIR(psa_type)) {
1867 TEST_EQUAL(mbedtls_pk_setup(&pk, mbedtls_pk_info_from_type(MBEDTLS_PK_ECKEY)), 0);
1868 TEST_EQUAL(mbedtls_ecp_group_load(&(mbedtls_pk_ec_rw(pk)->grp), ecp_grp_id), 0);
1869 TEST_EQUAL(mbedtls_ecp_point_read_binary(&(mbedtls_pk_ec_ro(pk)->grp),
1870 &(mbedtls_pk_ec_rw(pk)->Q),
1871 legacy_pub_key, legacy_pub_key_len), 0);
Valerio Setti480dfc72024-03-20 09:35:54 +01001872 }
1873#endif /* MBEDTLS_PK_CAN_ECDSA_SIGN */
1874#if defined(MBEDTLS_RSA_C)
1875 if (PSA_KEY_TYPE_IS_RSA(psa_type)) {
Valerio Settid971b782024-03-19 15:08:53 +01001876 TEST_EQUAL(mbedtls_pk_setup(&pk, mbedtls_pk_info_from_type(MBEDTLS_PK_RSA)), 0);
1877 TEST_EQUAL(mbedtls_rsa_parse_pubkey(mbedtls_pk_rsa(pk), legacy_pub_key,
1878 legacy_pub_key_len), 0);
1879 }
Valerio Setti480dfc72024-03-20 09:35:54 +01001880#endif /* MBEDTLS_RSA_C */
Valerio Setti28330502024-03-21 05:24:12 +01001881#endif /* MBEDTLS_PK_PARSE_C && MBEDTLS_PK_WRITE_C */
Valerio Setti480dfc72024-03-20 09:35:54 +01001882
Valerio Settiaa9cc492024-03-19 15:43:52 +01001883#if defined(MBEDTLS_RSA_C)
1884 if (PSA_KEY_TYPE_IS_RSA(psa_type)) {
1885 TEST_EQUAL(mbedtls_rsa_set_padding(mbedtls_pk_rsa(pk), rsa_padding, MBEDTLS_MD_NONE), 0);
1886 }
1887#endif /* MBEDTLS_RSA_C */
Gilles Peskine449bd832023-01-11 14:50:10 +01001888 TEST_ASSERT(mbedtls_pk_verify(&pk, MBEDTLS_MD_SHA256,
Dave Rodgman6dd757a2023-02-02 12:40:50 +00001889 hash, sizeof(hash), sig, sig_len) == 0);
Manuel Pégourié-Gonnard36867712018-10-31 16:22:49 +01001890
1891exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001892 psa_reset_key_attributes(&attributes);
Ronald Cron3a4f0e32020-11-19 17:55:23 +01001893
Gilles Peskine449bd832023-01-11 14:50:10 +01001894 mbedtls_pk_free(&pk);
1895 USE_PSA_DONE();
Manuel Pégourié-Gonnard36867712018-10-31 16:22:49 +01001896}
1897/* END_CASE */
Jerry Yu1f45b672022-03-12 19:24:50 +08001898
Tomi Fontanilles81746622023-07-16 13:06:06 +03001899/* BEGIN_CASE depends_on:MBEDTLS_GENPRIME */
Tomi Fontanilles9c693482023-12-14 21:40:54 +02001900void pk_sign_ext(int pk_type, int curve_or_keybits, int key_pk_type, int md_alg)
Jerry Yu1f45b672022-03-12 19:24:50 +08001901{
1902 mbedtls_pk_context pk;
1903 size_t sig_len;
1904 unsigned char sig[MBEDTLS_PK_SIGNATURE_MAX_SIZE];
Tomi Fontanilles81746622023-07-16 13:06:06 +03001905 unsigned char hash[MBEDTLS_MD_MAX_SIZE];
Manuel Pégourié-Gonnard9b41eb82023-03-28 11:14:24 +02001906 size_t hash_len = mbedtls_md_get_size_from_type(md_alg);
Jerry Yub3bfe9f2022-03-22 13:20:39 +08001907 void const *options = NULL;
Jerry Yub3bfe9f2022-03-22 13:20:39 +08001908 mbedtls_pk_rsassa_pss_options rsassa_pss_options;
Gilles Peskine449bd832023-01-11 14:50:10 +01001909 memset(hash, 0x2a, sizeof(hash));
1910 memset(sig, 0, sizeof(sig));
Jerry Yu1f45b672022-03-12 19:24:50 +08001911
Valerio Settib79f7db2023-04-19 14:25:52 +02001912 mbedtls_pk_init(&pk);
Tomi Fontanilles81746622023-07-16 13:06:06 +03001913 MD_OR_USE_PSA_INIT();
Jerry Yu1f45b672022-03-12 19:24:50 +08001914
Tomi Fontanilles81746622023-07-16 13:06:06 +03001915 TEST_EQUAL(mbedtls_pk_setup(&pk,
1916 mbedtls_pk_info_from_type(pk_type)), 0);
Tomi Fontanilles9c693482023-12-14 21:40:54 +02001917 TEST_EQUAL(pk_genkey(&pk, curve_or_keybits), 0);
Jerry Yu1f45b672022-03-12 19:24:50 +08001918
Tomi Fontanilles81746622023-07-16 13:06:06 +03001919 TEST_EQUAL(mbedtls_pk_sign_ext(key_pk_type, &pk, md_alg, hash, hash_len,
1920 sig, sizeof(sig), &sig_len,
1921 mbedtls_test_rnd_std_rand, NULL), 0);
Jerry Yucef3f332022-03-22 23:00:13 +08001922
Gilles Peskine449bd832023-01-11 14:50:10 +01001923 if (key_pk_type == MBEDTLS_PK_RSASSA_PSS) {
Jerry Yub3bfe9f2022-03-22 13:20:39 +08001924 rsassa_pss_options.mgf1_hash_id = md_alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01001925 TEST_ASSERT(hash_len != 0);
Manuel Pégourié-Gonnard6a0a1602022-07-05 12:09:04 +02001926 rsassa_pss_options.expected_salt_len = hash_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01001927 options = (const void *) &rsassa_pss_options;
Jerry Yub3bfe9f2022-03-22 13:20:39 +08001928 }
Tomi Fontanilles81746622023-07-16 13:06:06 +03001929 TEST_EQUAL(mbedtls_pk_verify_ext(key_pk_type, options, &pk, md_alg,
1930 hash, hash_len, sig, sig_len), 0);
Jerry Yu1f45b672022-03-12 19:24:50 +08001931exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001932 mbedtls_pk_free(&pk);
Tomi Fontanilles81746622023-07-16 13:06:06 +03001933 MD_OR_USE_PSA_DONE();
Jerry Yu1f45b672022-03-12 19:24:50 +08001934}
1935/* END_CASE */
1936
Neil Armstrong999930e2022-04-12 15:12:43 +02001937/* BEGIN_CASE depends_on:MBEDTLS_RSA_C:MBEDTLS_GENPRIME:MBEDTLS_USE_PSA_CRYPTO */
Tomi Fontanilles9c693482023-12-14 21:40:54 +02001938void pk_psa_wrap_sign_ext(int pk_type, int key_bits, int key_pk_type, int md_alg)
Neil Armstrong999930e2022-04-12 15:12:43 +02001939{
Neil Armstrong999930e2022-04-12 15:12:43 +02001940 mbedtls_pk_context pk;
1941 size_t sig_len, pkey_len;
Valerio Setti23e637a2024-02-27 13:56:57 +01001942 mbedtls_svc_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT;
Valerio Setti1fa2f6e2024-02-27 08:11:25 +01001943 psa_key_attributes_t key_attr = PSA_KEY_ATTRIBUTES_INIT;
Neil Armstrong999930e2022-04-12 15:12:43 +02001944 unsigned char sig[MBEDTLS_PK_SIGNATURE_MAX_SIZE];
Neil Armstrong843795a2022-04-21 12:23:28 +02001945 unsigned char pkey[PSA_EXPORT_PUBLIC_KEY_MAX_SIZE];
Neil Armstrong999930e2022-04-12 15:12:43 +02001946 unsigned char *pkey_start;
Manuel Pégourié-Gonnard043c8c52022-07-08 10:33:44 +02001947 unsigned char hash[PSA_HASH_MAX_SIZE];
Manuel Pégourié-Gonnard2d6d9932023-03-28 11:38:08 +02001948 psa_algorithm_t psa_md_alg = mbedtls_md_psa_alg_from_type(md_alg);
Gilles Peskine449bd832023-01-11 14:50:10 +01001949 size_t hash_len = PSA_HASH_LENGTH(psa_md_alg);
Neil Armstrong999930e2022-04-12 15:12:43 +02001950 void const *options = NULL;
1951 mbedtls_pk_rsassa_pss_options rsassa_pss_options;
1952 int ret;
1953
Valerio Settib79f7db2023-04-19 14:25:52 +02001954 mbedtls_pk_init(&pk);
valerio32f2ac92023-04-20 11:59:52 +02001955 PSA_INIT();
Neil Armstrong999930e2022-04-12 15:12:43 +02001956
1957 /* Create legacy RSA public/private key in PK context. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001958 mbedtls_pk_init(&pk);
1959 TEST_EQUAL(mbedtls_pk_setup(&pk,
1960 mbedtls_pk_info_from_type(pk_type)), 0);
1961 TEST_EQUAL(mbedtls_rsa_gen_key(mbedtls_pk_rsa(pk),
1962 mbedtls_test_rnd_std_rand, NULL,
Tomi Fontanilles9c693482023-12-14 21:40:54 +02001963 key_bits, 3), 0);
Neil Armstrong999930e2022-04-12 15:12:43 +02001964
Valerio Settib484e372024-02-27 16:21:12 +01001965 if (key_pk_type == MBEDTLS_PK_RSASSA_PSS) {
1966 mbedtls_rsa_set_padding(mbedtls_pk_rsa(pk), MBEDTLS_RSA_PKCS_V21, MBEDTLS_MD_NONE);
1967 }
1968
Valerio Setti3a815cb2024-02-14 09:54:18 +01001969 /* Export underlying public key for re-importing in a legacy context.
1970 * Note: mbedtls_rsa_write_key() writes backwards in the data buffer. */
1971 pkey_start = pkey + sizeof(pkey);
1972 ret = mbedtls_rsa_write_pubkey(mbedtls_pk_rsa(pk), pkey, &pkey_start);
Gilles Peskine449bd832023-01-11 14:50:10 +01001973 TEST_ASSERT(ret >= 0);
Neil Armstrong999930e2022-04-12 15:12:43 +02001974
1975 pkey_len = (size_t) ret;
1976 /* mbedtls_pk_write_pubkey_der() writes backwards in the data buffer. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001977 pkey_start = pkey + sizeof(pkey) - pkey_len;
Neil Armstrong999930e2022-04-12 15:12:43 +02001978
1979 /* Turn PK context into an opaque one. */
Valerio Setti1fa2f6e2024-02-27 08:11:25 +01001980 TEST_EQUAL(mbedtls_pk_get_psa_attributes(&pk, PSA_KEY_USAGE_SIGN_HASH, &key_attr), 0);
Valerio Setti1fa2f6e2024-02-27 08:11:25 +01001981 TEST_EQUAL(mbedtls_pk_import_into_psa(&pk, &key_attr, &key_id), 0);
1982 mbedtls_pk_free(&pk);
1983 mbedtls_pk_init(&pk);
1984 TEST_EQUAL(mbedtls_pk_setup_opaque(&pk, key_id), 0);
Neil Armstrong999930e2022-04-12 15:12:43 +02001985
Gilles Peskine449bd832023-01-11 14:50:10 +01001986 memset(hash, 0x2a, sizeof(hash));
1987 memset(sig, 0, sizeof(sig));
Neil Armstrong999930e2022-04-12 15:12:43 +02001988
Gilles Peskine449bd832023-01-11 14:50:10 +01001989 TEST_EQUAL(mbedtls_pk_sign_ext(key_pk_type, &pk, md_alg, hash, hash_len,
1990 sig, sizeof(sig), &sig_len,
1991 mbedtls_test_rnd_std_rand, NULL), 0);
Neil Armstrong999930e2022-04-12 15:12:43 +02001992
Valerio Settida475182024-03-19 09:54:46 +01001993 /* verify_ext() is not supported when using an opaque context. */
Valerio Settid59caf42024-03-18 16:20:14 +01001994 if (key_pk_type == MBEDTLS_PK_RSASSA_PSS) {
1995 mbedtls_pk_rsassa_pss_options pss_opts = {
1996 .mgf1_hash_id = md_alg,
1997 .expected_salt_len = MBEDTLS_RSA_SALT_LEN_ANY,
1998 };
1999 TEST_EQUAL(mbedtls_pk_verify_ext(key_pk_type, &pss_opts, &pk, md_alg,
2000 hash, hash_len, sig, sig_len),
2001 MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE);
Valerio Settida475182024-03-19 09:54:46 +01002002 } else {
2003 TEST_EQUAL(mbedtls_pk_verify_ext(key_pk_type, NULL, &pk, md_alg,
2004 hash, hash_len, sig, sig_len),
2005 MBEDTLS_ERR_PK_TYPE_MISMATCH);
Valerio Settid59caf42024-03-18 16:20:14 +01002006 }
2007
Gilles Peskine449bd832023-01-11 14:50:10 +01002008 mbedtls_pk_free(&pk);
2009 TEST_EQUAL(PSA_SUCCESS, psa_destroy_key(key_id));
Neil Armstrong999930e2022-04-12 15:12:43 +02002010
Gilles Peskine449bd832023-01-11 14:50:10 +01002011 mbedtls_pk_init(&pk);
Valerio Setti3a815cb2024-02-14 09:54:18 +01002012 TEST_EQUAL(mbedtls_pk_setup(&pk,
2013 mbedtls_pk_info_from_type(pk_type)), 0);
2014 TEST_EQUAL(mbedtls_rsa_parse_pubkey(mbedtls_pk_rsa(pk), pkey_start, pkey_len), 0);
Neil Armstrong999930e2022-04-12 15:12:43 +02002015
Gilles Peskine449bd832023-01-11 14:50:10 +01002016 if (key_pk_type == MBEDTLS_PK_RSASSA_PSS) {
Neil Armstrong999930e2022-04-12 15:12:43 +02002017 rsassa_pss_options.mgf1_hash_id = md_alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01002018 TEST_ASSERT(hash_len != 0);
Manuel Pégourié-Gonnarde496c622022-07-05 13:11:13 +02002019 rsassa_pss_options.expected_salt_len = hash_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01002020 options = (const void *) &rsassa_pss_options;
Neil Armstrong999930e2022-04-12 15:12:43 +02002021 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002022 TEST_EQUAL(mbedtls_pk_verify_ext(key_pk_type, options, &pk, md_alg,
2023 hash, hash_len, sig, sig_len), 0);
Neil Armstrong999930e2022-04-12 15:12:43 +02002024
2025exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002026 mbedtls_pk_free(&pk);
2027 PSA_DONE();
Neil Armstrong999930e2022-04-12 15:12:43 +02002028}
2029/* END_CASE */
Gilles Peskine0b172552024-01-18 14:11:26 +01002030
2031/* BEGIN_CASE depends_on:MBEDTLS_PSA_CRYPTO_C */
Gilles Peskine6ea18362024-01-18 14:16:27 +01002032void pk_get_psa_attributes(int pk_type, int from_pair,
2033 int usage_arg,
2034 int to_pair, int expected_alg)
2035{
2036 mbedtls_pk_context pk;
2037 mbedtls_pk_init(&pk);
2038 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
2039 psa_key_usage_t usage = usage_arg;
Gilles Peskinefc3d8662024-02-09 19:26:37 +01002040 mbedtls_svc_key_id_t new_key_id = MBEDTLS_SVC_KEY_ID_INIT;
Gilles Peskine6ea18362024-01-18 14:16:27 +01002041
Gilles Peskine3da3c0a2024-01-30 10:22:29 +01002042 PSA_INIT();
Gilles Peskine6ea18362024-01-18 14:16:27 +01002043
2044 psa_key_type_t expected_psa_type = 0;
Gilles Peskine03aa9bc2024-01-30 11:08:44 +01002045 TEST_EQUAL(pk_setup_for_type(pk_type, from_pair,
2046 &pk, &expected_psa_type), 0);
Gilles Peskine6ea18362024-01-18 14:16:27 +01002047 if (!to_pair) {
2048 expected_psa_type = PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(expected_psa_type);
2049 }
2050
2051 psa_key_lifetime_t lifetime = PSA_KEY_LIFETIME_VOLATILE; //TODO: diversity
2052 mbedtls_svc_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT; //TODO: diversity
2053 psa_set_key_id(&attributes, key_id);
2054 psa_set_key_lifetime(&attributes, lifetime);
Gilles Peskine19411632024-02-01 20:42:28 +01002055 psa_set_key_enrollment_algorithm(&attributes, 42);
Gilles Peskine7e353ba2024-02-01 20:46:19 +01002056 psa_key_usage_t expected_usage = pk_get_psa_attributes_implied_usage(usage);
Gilles Peskine6ea18362024-01-18 14:16:27 +01002057
Gilles Peskineace7c772024-01-18 17:47:54 +01002058#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
2059 /* When the resulting algorithm is ECDSA, the compile-time configuration
2060 * can cause it to be either deterministic or randomized ECDSA.
2061 * Rather than have two near-identical sets of test data depending on
2062 * the configuration, always use randomized in the test data and
2063 * tweak the expected result here. */
2064 if (expected_alg == PSA_ALG_ECDSA(PSA_ALG_ANY_HASH)) {
2065 expected_alg = PSA_ALG_DETERMINISTIC_ECDSA(PSA_ALG_ANY_HASH);
2066 }
2067#endif
2068
Gilles Peskine6ea18362024-01-18 14:16:27 +01002069 TEST_EQUAL(mbedtls_pk_get_psa_attributes(&pk, usage, &attributes), 0);
2070
2071 TEST_EQUAL(psa_get_key_lifetime(&attributes), lifetime);
2072 TEST_ASSERT(mbedtls_svc_key_id_equal(psa_get_key_id(&attributes),
2073 key_id));
2074 TEST_EQUAL(psa_get_key_type(&attributes), expected_psa_type);
2075 TEST_EQUAL(psa_get_key_bits(&attributes),
2076 mbedtls_pk_get_bitlen(&pk));
2077 TEST_EQUAL(psa_get_key_usage_flags(&attributes), expected_usage);
2078 TEST_EQUAL(psa_get_key_algorithm(&attributes), expected_alg);
2079 TEST_EQUAL(psa_get_key_enrollment_algorithm(&attributes), PSA_ALG_NONE);
2080
Gilles Peskinefc3d8662024-02-09 19:26:37 +01002081 TEST_EQUAL(mbedtls_pk_import_into_psa(&pk, &attributes, &new_key_id), 0);
Gilles Peskine2ec141a2024-02-15 17:22:37 +01002082 if (!mbedtls_test_key_consistency_psa_pk(new_key_id, &pk)) {
2083 goto exit;
2084 }
Gilles Peskinefc3d8662024-02-09 19:26:37 +01002085
Gilles Peskine6ea18362024-01-18 14:16:27 +01002086exit:
2087 mbedtls_pk_free(&pk);
2088 psa_reset_key_attributes(&attributes);
Gilles Peskinefc3d8662024-02-09 19:26:37 +01002089 psa_destroy_key(new_key_id);
Gilles Peskine3da3c0a2024-01-30 10:22:29 +01002090 PSA_DONE();
Gilles Peskine6ea18362024-01-18 14:16:27 +01002091}
2092/* END_CASE */
2093
Gilles Peskine77faddf2024-01-24 10:50:17 +01002094/* BEGIN_CASE depends_on:MBEDTLS_PSA_CRYPTO_C:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V21:MBEDTLS_GENPRIME */
Gilles Peskine6ea18362024-01-18 14:16:27 +01002095void pk_rsa_v21_get_psa_attributes(int md_type, int from_pair,
2096 int usage_arg,
2097 int to_pair, int expected_alg)
2098{
2099 mbedtls_pk_context pk;
2100 mbedtls_pk_init(&pk);
2101 psa_key_usage_t usage = usage_arg;
2102 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskinefc3d8662024-02-09 19:26:37 +01002103 mbedtls_svc_key_id_t new_key_id = MBEDTLS_SVC_KEY_ID_INIT;
Gilles Peskine6ea18362024-01-18 14:16:27 +01002104
Gilles Peskine3da3c0a2024-01-30 10:22:29 +01002105 PSA_INIT();
Gilles Peskine6ea18362024-01-18 14:16:27 +01002106
2107 psa_key_type_t expected_psa_type = 0;
Gilles Peskine03aa9bc2024-01-30 11:08:44 +01002108 TEST_EQUAL(pk_setup_for_type(MBEDTLS_PK_RSA, from_pair,
2109 &pk, &expected_psa_type), 0);
Gilles Peskine6ea18362024-01-18 14:16:27 +01002110 mbedtls_rsa_context *rsa = mbedtls_pk_rsa(pk);
2111 TEST_EQUAL(mbedtls_rsa_set_padding(rsa, MBEDTLS_RSA_PKCS_V21, md_type), 0);
2112 if (!to_pair) {
2113 expected_psa_type = PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(expected_psa_type);
2114 }
Gilles Peskine7e353ba2024-02-01 20:46:19 +01002115 psa_key_usage_t expected_usage = pk_get_psa_attributes_implied_usage(usage);
Gilles Peskine6ea18362024-01-18 14:16:27 +01002116
2117 TEST_EQUAL(mbedtls_pk_get_psa_attributes(&pk, usage, &attributes), 0);
2118
2119 TEST_EQUAL(psa_get_key_lifetime(&attributes), PSA_KEY_LIFETIME_VOLATILE);
2120 TEST_ASSERT(mbedtls_svc_key_id_equal(psa_get_key_id(&attributes),
2121 MBEDTLS_SVC_KEY_ID_INIT));
2122 TEST_EQUAL(psa_get_key_type(&attributes), expected_psa_type);
2123 TEST_EQUAL(psa_get_key_bits(&attributes),
2124 mbedtls_pk_get_bitlen(&pk));
2125 TEST_EQUAL(psa_get_key_usage_flags(&attributes), expected_usage);
2126 TEST_EQUAL(psa_get_key_algorithm(&attributes), expected_alg);
2127 TEST_EQUAL(psa_get_key_enrollment_algorithm(&attributes), PSA_ALG_NONE);
2128
Gilles Peskinefc3d8662024-02-09 19:26:37 +01002129 TEST_EQUAL(mbedtls_pk_import_into_psa(&pk, &attributes, &new_key_id), 0);
Gilles Peskine2ec141a2024-02-15 17:22:37 +01002130 if (!mbedtls_test_key_consistency_psa_pk(new_key_id, &pk)) {
2131 goto exit;
2132 }
Gilles Peskinefc3d8662024-02-09 19:26:37 +01002133
Gilles Peskine6ea18362024-01-18 14:16:27 +01002134exit:
2135 mbedtls_pk_free(&pk);
2136 psa_reset_key_attributes(&attributes);
Gilles Peskinefc3d8662024-02-09 19:26:37 +01002137 psa_destroy_key(new_key_id);
Gilles Peskine3da3c0a2024-01-30 10:22:29 +01002138 PSA_DONE();
Gilles Peskine6ea18362024-01-18 14:16:27 +01002139}
2140/* END_CASE */
2141
2142/* BEGIN_CASE depends_on:MBEDTLS_PSA_CRYPTO_C */
Gilles Peskine0b172552024-01-18 14:11:26 +01002143void pk_get_psa_attributes_fail(int pk_type, int from_pair,
2144 int usage_arg,
2145 int expected_ret)
2146{
2147 mbedtls_pk_context pk;
2148 mbedtls_pk_init(&pk);
2149 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
2150 psa_key_usage_t usage = usage_arg;
2151
Gilles Peskine3da3c0a2024-01-30 10:22:29 +01002152 PSA_INIT();
Gilles Peskine0b172552024-01-18 14:11:26 +01002153
2154 psa_key_type_t expected_psa_type;
Gilles Peskine03aa9bc2024-01-30 11:08:44 +01002155 TEST_EQUAL(pk_setup_for_type(pk_type, from_pair,
2156 &pk, &expected_psa_type), 0);
Gilles Peskine0b172552024-01-18 14:11:26 +01002157
2158 TEST_EQUAL(mbedtls_pk_get_psa_attributes(&pk, usage, &attributes),
2159 expected_ret);
2160
2161exit:
2162 mbedtls_pk_free(&pk);
2163 psa_reset_key_attributes(&attributes);
Gilles Peskine3da3c0a2024-01-30 10:22:29 +01002164 PSA_DONE();
Gilles Peskine0b172552024-01-18 14:11:26 +01002165}
2166/* END_CASE */
Gilles Peskine758d8c72024-01-22 20:53:21 +01002167
Gilles Peskinea69572b2024-03-12 15:24:34 +01002168/* BEGIN_CASE depends_on:MBEDTLS_PSA_CRYPTO_C:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE:MBEDTLS_TEST_PSA_ECC_AT_LEAST_ONE_CURVE:MBEDTLS_PSA_CRYPTO_STORAGE_C */
2169void pk_import_into_psa_lifetime(int from_opaque,
2170 int from_persistent, /* when from opaque */
2171 int from_exportable, /* when from opaque */
2172 int to_public,
2173 int to_persistent)
2174{
2175 mbedtls_pk_context pk;
2176 mbedtls_pk_init(&pk);
2177 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
2178 mbedtls_svc_key_id_t old_key_id = MBEDTLS_SVC_KEY_ID_INIT;
2179 mbedtls_svc_key_id_t new_key_id = MBEDTLS_SVC_KEY_ID_INIT;
2180 mbedtls_svc_key_id_t expected_key_id = MBEDTLS_SVC_KEY_ID_INIT;
2181 psa_key_lifetime_t expected_lifetime = PSA_KEY_LIFETIME_VOLATILE;
2182
2183 PSA_INIT();
2184
2185 if (from_opaque) {
2186#if defined(MBEDTLS_USE_PSA_CRYPTO)
2187 psa_key_type_t from_psa_type =
2188 PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY);
Valerio Settic43a7a52024-03-22 12:06:44 +01002189 psa_key_usage_t psa_key_usage =
Gilles Peskinea69572b2024-03-12 15:24:34 +01002190 (from_exportable ? PSA_KEY_USAGE_EXPORT : PSA_KEY_USAGE_COPY) |
Valerio Settic43a7a52024-03-22 12:06:44 +01002191 PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_VERIFY_HASH;
2192 mbedtls_svc_key_id_t persistent_key_id = MBEDTLS_SVC_KEY_ID_INIT;
2193
Gilles Peskinea69572b2024-03-12 15:24:34 +01002194 if (from_persistent) {
Valerio Settic43a7a52024-03-22 12:06:44 +01002195 persistent_key_id = mbedtls_svc_key_id_make(0, 1);
Gilles Peskinea69572b2024-03-12 15:24:34 +01002196 }
Valerio Settic43a7a52024-03-22 12:06:44 +01002197
2198 PSA_ASSERT(pk_psa_genkey(from_psa_type, MBEDTLS_TEST_PSA_ECC_ONE_CURVE_BITS,
2199 psa_key_usage, PSA_ALG_ECDH, PSA_ALG_NONE,
2200 persistent_key_id, &old_key_id));
Gilles Peskinea69572b2024-03-12 15:24:34 +01002201 TEST_EQUAL(mbedtls_pk_setup_opaque(&pk, old_key_id), 0);
2202 psa_reset_key_attributes(&attributes);
2203#else
2204 (void) from_persistent;
2205 (void) from_exportable;
2206 TEST_FAIL("Attempted to test opaque key without opaque key support");
2207#endif
2208 } else {
2209 psa_key_type_t psa_type_according_to_setup;
2210 TEST_EQUAL(pk_setup_for_type(MBEDTLS_PK_ECKEY, 1,
2211 &pk, &psa_type_according_to_setup), 0);
2212 }
2213
2214 if (to_persistent) {
2215 expected_key_id = mbedtls_svc_key_id_make(42, 2);
2216 psa_set_key_id(&attributes, expected_key_id);
2217 /* psa_set_key_id() sets the lifetime to PERSISTENT */
2218 expected_lifetime = PSA_KEY_LIFETIME_PERSISTENT;
2219 }
2220
2221 psa_key_usage_t to_usage =
2222 to_public ? PSA_KEY_USAGE_VERIFY_HASH : PSA_KEY_USAGE_SIGN_HASH;
2223 TEST_EQUAL(mbedtls_pk_get_psa_attributes(&pk, to_usage,
2224 &attributes), 0);
2225 /* mbedtls_pk_get_psa_attributes() is specified to not modify
2226 * the persistence attributes. */
2227 TEST_EQUAL(psa_get_key_lifetime(&attributes), expected_lifetime);
2228 TEST_EQUAL(MBEDTLS_SVC_KEY_ID_GET_KEY_ID(psa_get_key_id(&attributes)),
2229 MBEDTLS_SVC_KEY_ID_GET_KEY_ID(expected_key_id));
2230
2231 TEST_EQUAL(mbedtls_pk_import_into_psa(&pk, &attributes, &new_key_id), 0);
2232 if (!mbedtls_test_key_consistency_psa_pk(new_key_id, &pk)) {
2233 goto exit;
2234 }
2235
2236 PSA_ASSERT(psa_get_key_attributes(new_key_id, &attributes));
2237 TEST_EQUAL(psa_get_key_lifetime(&attributes), expected_lifetime);
2238 /* Here expected_key_id=0 for a volatile key, but we expect
2239 * attributes to contain a dynamically assigned key id which we
2240 * can't predict. */
2241 if (to_persistent) {
2242 TEST_ASSERT(mbedtls_svc_key_id_equal(psa_get_key_id(&attributes),
2243 expected_key_id));
2244 }
2245
2246exit:
2247 mbedtls_pk_free(&pk);
2248 psa_reset_key_attributes(&attributes);
2249 psa_destroy_key(old_key_id);
2250 psa_destroy_key(new_key_id);
2251 PSA_DONE();
2252}
2253/* END_CASE */
2254
Gilles Peskine758d8c72024-01-22 20:53:21 +01002255/* BEGIN_CASE depends_on:MBEDTLS_USE_PSA_CRYPTO */
Gilles Peskinee45d51f2024-02-01 20:53:11 +01002256void pk_get_psa_attributes_opaque(int from_type_arg, int from_bits_arg,
2257 int from_usage_arg, int from_alg_arg,
Gilles Peskine758d8c72024-01-22 20:53:21 +01002258 int usage_arg,
2259 int expected_ret,
2260 int to_pair, int expected_usage_arg)
2261{
2262 mbedtls_pk_context pk;
2263 mbedtls_pk_init(&pk);
2264 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskinefc3d8662024-02-09 19:26:37 +01002265 mbedtls_svc_key_id_t old_key_id = MBEDTLS_SVC_KEY_ID_INIT;
Gilles Peskinee45d51f2024-02-01 20:53:11 +01002266 psa_key_type_t from_type = from_type_arg;
2267 size_t bits = from_bits_arg;
2268 psa_key_usage_t from_usage = from_usage_arg;
2269 psa_algorithm_t alg = from_alg_arg;
Gilles Peskine758d8c72024-01-22 20:53:21 +01002270 psa_key_usage_t usage = usage_arg;
2271 psa_key_usage_t expected_usage = expected_usage_arg;
Gilles Peskinefc3d8662024-02-09 19:26:37 +01002272 mbedtls_svc_key_id_t new_key_id = MBEDTLS_SVC_KEY_ID_INIT;
Gilles Peskine758d8c72024-01-22 20:53:21 +01002273
Gilles Peskinee2a77f22024-02-01 20:50:24 +01002274 PSA_INIT();
Gilles Peskine758d8c72024-01-22 20:53:21 +01002275
Valerio Settic43a7a52024-03-22 12:06:44 +01002276 PSA_ASSERT(pk_psa_genkey(from_type, bits, from_usage, alg, 42,
2277 PSA_KEY_ID_NULL, &old_key_id));
Gilles Peskinefc3d8662024-02-09 19:26:37 +01002278 TEST_EQUAL(mbedtls_pk_setup_opaque(&pk, old_key_id), 0);
Gilles Peskine758d8c72024-01-22 20:53:21 +01002279
2280 psa_key_type_t expected_psa_type =
Gilles Peskinee45d51f2024-02-01 20:53:11 +01002281 to_pair ? from_type : PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(from_type);
Gilles Peskine758d8c72024-01-22 20:53:21 +01002282
2283 TEST_EQUAL(mbedtls_pk_get_psa_attributes(&pk, usage, &attributes),
2284 expected_ret);
2285
2286 if (expected_ret == 0) {
2287 TEST_EQUAL(psa_get_key_lifetime(&attributes), PSA_KEY_LIFETIME_VOLATILE);
2288 TEST_ASSERT(mbedtls_svc_key_id_equal(psa_get_key_id(&attributes),
2289 MBEDTLS_SVC_KEY_ID_INIT));
2290 TEST_EQUAL(psa_get_key_type(&attributes), expected_psa_type);
2291 TEST_EQUAL(psa_get_key_bits(&attributes), bits);
2292 TEST_EQUAL(psa_get_key_usage_flags(&attributes), expected_usage);
2293 TEST_EQUAL(psa_get_key_algorithm(&attributes), alg);
2294 TEST_EQUAL(psa_get_key_enrollment_algorithm(&attributes), PSA_ALG_NONE);
Gilles Peskinefc3d8662024-02-09 19:26:37 +01002295
2296 int expected_import_ret = 0;
2297 if (to_pair &&
2298 !(from_usage & (PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_EXPORT))) {
2299 expected_import_ret = MBEDTLS_ERR_PK_TYPE_MISMATCH;
2300 }
2301 TEST_EQUAL(mbedtls_pk_import_into_psa(&pk, &attributes, &new_key_id),
2302 expected_import_ret);
Gilles Peskine2ec141a2024-02-15 17:22:37 +01002303 if (expected_import_ret == 0) {
2304 if (!mbedtls_test_key_consistency_psa_pk(new_key_id, &pk)) {
2305 goto exit;
2306 }
2307 }
Gilles Peskine758d8c72024-01-22 20:53:21 +01002308 }
2309
2310exit:
2311 mbedtls_pk_free(&pk);
Gilles Peskinefc3d8662024-02-09 19:26:37 +01002312 psa_destroy_key(old_key_id);
2313 psa_destroy_key(new_key_id);
Gilles Peskine758d8c72024-01-22 20:53:21 +01002314 psa_reset_key_attributes(&attributes);
Gilles Peskinee2a77f22024-02-01 20:50:24 +01002315 PSA_DONE();
Gilles Peskine758d8c72024-01-22 20:53:21 +01002316}
2317/* END_CASE */
Gilles Peskinefc3d8662024-02-09 19:26:37 +01002318
2319/* BEGIN_CASE depends_on:MBEDTLS_PSA_CRYPTO_C */
2320void pk_import_into_psa_fail(int pk_type, int from_pair,
Gilles Peskined6fc3502024-02-15 13:53:03 +01002321 int type_arg, int bits_arg,
Gilles Peskinefc3d8662024-02-09 19:26:37 +01002322 int expected_ret)
2323{
2324 mbedtls_pk_context pk;
2325 mbedtls_pk_init(&pk);
2326 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
2327 psa_key_type_t type = type_arg;
Gilles Peskined6fc3502024-02-15 13:53:03 +01002328 size_t bits = bits_arg;
Gilles Peskinefc3d8662024-02-09 19:26:37 +01002329 mbedtls_svc_key_id_t key_id = mbedtls_svc_key_id_make(0, 42);
2330
2331 PSA_INIT();
2332
2333 psa_key_type_t expected_psa_type;
2334 TEST_EQUAL(pk_setup_for_type(pk_type, from_pair,
2335 &pk, &expected_psa_type), 0);
2336
2337 psa_set_key_type(&attributes, type);
Gilles Peskined6fc3502024-02-15 13:53:03 +01002338 psa_set_key_bits(&attributes, bits);
Gilles Peskinefc3d8662024-02-09 19:26:37 +01002339
2340 TEST_EQUAL(mbedtls_pk_import_into_psa(&pk, &attributes, &key_id),
2341 expected_ret);
2342 TEST_ASSERT(mbedtls_svc_key_id_equal(key_id, MBEDTLS_SVC_KEY_ID_INIT));
2343
2344exit:
2345 psa_destroy_key(key_id);
2346 mbedtls_pk_free(&pk);
2347 psa_reset_key_attributes(&attributes);
2348 PSA_DONE();
2349}
2350/* END_CASE */
2351
2352/* BEGIN_CASE depends_on:MBEDTLS_USE_PSA_CRYPTO */
2353void pk_import_into_psa_opaque(int from_type, int from_bits,
2354 int from_usage, int from_alg,
2355 int to_type, int to_bits,
2356 int to_usage, int to_alg,
2357 int expected_ret)
2358{
2359 mbedtls_pk_context pk;
2360 mbedtls_pk_init(&pk);
2361 psa_key_attributes_t from_attributes = PSA_KEY_ATTRIBUTES_INIT;
2362 mbedtls_svc_key_id_t from_key_id = MBEDTLS_SVC_KEY_ID_INIT;
2363 psa_key_attributes_t to_attributes = PSA_KEY_ATTRIBUTES_INIT;
2364 mbedtls_svc_key_id_t to_key_id = MBEDTLS_SVC_KEY_ID_INIT;
2365 psa_key_attributes_t actual_attributes = PSA_KEY_ATTRIBUTES_INIT;
2366
2367 PSA_INIT();
2368
Valerio Settic43a7a52024-03-22 12:06:44 +01002369 PSA_ASSERT(pk_psa_genkey(from_type, from_bits, from_usage, from_alg, PSA_ALG_NONE,
2370 PSA_KEY_ID_NULL, &from_key_id));
Gilles Peskinefc3d8662024-02-09 19:26:37 +01002371 TEST_EQUAL(mbedtls_pk_setup_opaque(&pk, from_key_id), 0);
2372
2373 psa_set_key_type(&to_attributes, to_type);
2374 psa_set_key_bits(&to_attributes, to_bits);
2375 psa_set_key_usage_flags(&to_attributes, to_usage);
2376 psa_set_key_algorithm(&to_attributes, to_alg);
2377
2378 TEST_EQUAL(mbedtls_pk_import_into_psa(&pk, &to_attributes, &to_key_id),
2379 expected_ret);
2380
2381 if (expected_ret == 0) {
2382 PSA_ASSERT(psa_get_key_attributes(to_key_id, &actual_attributes));
2383 TEST_EQUAL(to_type, psa_get_key_type(&actual_attributes));
2384 if (to_bits != 0) {
2385 TEST_EQUAL(to_bits, psa_get_key_bits(&actual_attributes));
2386 }
2387 TEST_EQUAL(to_alg, psa_get_key_algorithm(&actual_attributes));
2388 psa_key_usage_t expected_usage = to_usage;
2389 if (expected_usage & PSA_KEY_USAGE_SIGN_HASH) {
2390 expected_usage |= PSA_KEY_USAGE_SIGN_MESSAGE;
2391 }
2392 if (expected_usage & PSA_KEY_USAGE_VERIFY_HASH) {
2393 expected_usage |= PSA_KEY_USAGE_VERIFY_MESSAGE;
2394 }
2395 TEST_EQUAL(expected_usage, psa_get_key_usage_flags(&actual_attributes));
Gilles Peskine2ec141a2024-02-15 17:22:37 +01002396 if (!mbedtls_test_key_consistency_psa_pk(to_key_id, &pk)) {
2397 goto exit;
2398 }
Gilles Peskinefc3d8662024-02-09 19:26:37 +01002399 } else {
2400 TEST_ASSERT(mbedtls_svc_key_id_equal(to_key_id, MBEDTLS_SVC_KEY_ID_INIT));
2401 }
2402
2403exit:
2404 mbedtls_pk_free(&pk);
2405 psa_destroy_key(from_key_id);
2406 psa_destroy_key(to_key_id);
2407 psa_reset_key_attributes(&from_attributes);
2408 psa_reset_key_attributes(&to_attributes);
2409 psa_reset_key_attributes(&actual_attributes);
2410 PSA_DONE();
2411}
2412/* END_CASE */
Valerio Setti452d2d22024-02-01 11:31:30 +01002413
Valerio Setti01ba66d2024-02-09 11:35:42 +01002414/* BEGIN_CASE depends_on:MBEDTLS_PSA_CRYPTO_C*/
Valerio Setti452d2d22024-02-01 11:31:30 +01002415void pk_copy_from_psa_fail(void)
2416{
2417 mbedtls_pk_context pk_ctx;
2418 mbedtls_svc_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT;
Valerio Setti452d2d22024-02-01 11:31:30 +01002419
2420 mbedtls_pk_init(&pk_ctx);
2421 PSA_INIT();
2422
2423 /* Null pk pointer. */
2424 TEST_EQUAL(mbedtls_pk_copy_from_psa(key_id, NULL),
2425 MBEDTLS_ERR_PK_BAD_INPUT_DATA);
Gilles Peskinebf69f2e2024-03-06 13:39:01 +01002426 TEST_EQUAL(mbedtls_pk_copy_public_from_psa(key_id, NULL),
2427 MBEDTLS_ERR_PK_BAD_INPUT_DATA);
Valerio Setti452d2d22024-02-01 11:31:30 +01002428
2429 /* Invalid key ID. */
2430 TEST_EQUAL(mbedtls_pk_copy_from_psa(mbedtls_svc_key_id_make(0, 0), &pk_ctx),
2431 MBEDTLS_ERR_PK_BAD_INPUT_DATA);
Gilles Peskinebf69f2e2024-03-06 13:39:01 +01002432 TEST_EQUAL(mbedtls_pk_copy_public_from_psa(mbedtls_svc_key_id_make(0, 0), &pk_ctx),
2433 MBEDTLS_ERR_PK_BAD_INPUT_DATA);
Valerio Setti452d2d22024-02-01 11:31:30 +01002434
2435#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE)
2436 /* Generate a key type that is not handled by the PK module. */
Valerio Settic43a7a52024-03-22 12:06:44 +01002437 PSA_ASSERT(pk_psa_genkey(PSA_KEY_TYPE_DH_KEY_PAIR(PSA_DH_FAMILY_RFC7919), 2048,
2438 PSA_KEY_USAGE_EXPORT, PSA_ALG_NONE, PSA_ALG_NONE,
2439 PSA_KEY_ID_NULL, &key_id));
Valerio Setti452d2d22024-02-01 11:31:30 +01002440 TEST_EQUAL(mbedtls_pk_copy_from_psa(key_id, &pk_ctx), MBEDTLS_ERR_PK_BAD_INPUT_DATA);
Gilles Peskinebf69f2e2024-03-06 13:39:01 +01002441 TEST_EQUAL(mbedtls_pk_copy_public_from_psa(key_id, &pk_ctx), MBEDTLS_ERR_PK_BAD_INPUT_DATA);
Valerio Setti452d2d22024-02-01 11:31:30 +01002442 psa_destroy_key(key_id);
2443#endif /* PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE */
2444
2445#if defined(MBEDTLS_PK_HAVE_ECC_KEYS) && defined(PSA_WANT_ECC_SECP_R1_256) && \
2446 defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE)
2447 /* Generate an EC key which cannot be exported. */
Valerio Settic43a7a52024-03-22 12:06:44 +01002448 PSA_ASSERT(pk_psa_genkey(PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1), 256,
2449 0, PSA_ALG_NONE, PSA_ALG_NONE, PSA_KEY_ID_NULL, &key_id));
Valerio Settie095a672024-03-11 10:09:32 +01002450 TEST_EQUAL(mbedtls_pk_copy_from_psa(key_id, &pk_ctx), MBEDTLS_ERR_PK_TYPE_MISMATCH);
Valerio Setti452d2d22024-02-01 11:31:30 +01002451 psa_destroy_key(key_id);
2452#endif /* MBEDTLS_PK_HAVE_ECC_KEYS && PSA_WANT_ECC_SECP_R1_256 &&
2453 PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE */
2454
Valerio Setti452d2d22024-02-01 11:31:30 +01002455exit:
2456 mbedtls_pk_free(&pk_ctx);
2457 psa_destroy_key(key_id);
2458 PSA_DONE();
2459}
2460/* END_CASE */
2461
Valerio Setti42a58a52024-02-27 13:38:57 +01002462/* BEGIN_CASE depends_on:MBEDTLS_PSA_CRYPTO_C:MBEDTLS_PSA_ACCEL_ALG_RSA_PKCS1V15_SIGN:MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_BASIC:!MBEDTLS_RSA_C */
Valerio Settif22eff92024-02-23 18:26:07 +01002463void pk_copy_from_psa_builtin_fail()
2464{
2465 mbedtls_pk_context pk_ctx;
2466 mbedtls_svc_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT;
2467
2468 mbedtls_pk_init(&pk_ctx);
2469 PSA_INIT();
2470
Valerio Settic43a7a52024-03-22 12:06:44 +01002471 PSA_ASSERT(pk_psa_genkey(PSA_KEY_TYPE_RSA_KEY_PAIR,
2472 PSA_VENDOR_RSA_GENERATE_MIN_KEY_BITS,
2473 PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_EXPORT,
2474 PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_SHA_256),
2475 PSA_KEY_ID_NULL, &key_id));
Valerio Settif22eff92024-02-23 18:26:07 +01002476 TEST_EQUAL(mbedtls_pk_copy_from_psa(key_id, &pk_ctx), MBEDTLS_ERR_PK_BAD_INPUT_DATA);
2477exit:
2478 mbedtls_pk_free(&pk_ctx);
2479 psa_destroy_key(key_id);
2480 PSA_DONE();
2481}
2482/* END_CASE */
2483
Valerio Setti01ba66d2024-02-09 11:35:42 +01002484/* BEGIN_CASE depends_on:MBEDTLS_PSA_CRYPTO_C*/
Valerio Setti452d2d22024-02-01 11:31:30 +01002485void pk_copy_from_psa_success(data_t *priv_key_data, int key_type_arg,
Valerio Setti452d2d22024-02-01 11:31:30 +01002486 int key_alg_arg)
2487{
2488 psa_key_type_t key_type = key_type_arg;
Valerio Setti452d2d22024-02-01 11:31:30 +01002489 psa_algorithm_t key_alg = key_alg_arg;
Valerio Settid2ccc2f2024-02-23 08:49:45 +01002490 psa_key_usage_t key_usage = PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_VERIFY_HASH |
Valerio Setti039bbba2024-02-29 07:24:26 +01002491 PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_COPY;
Gilles Peskinebf69f2e2024-03-06 13:39:01 +01002492 mbedtls_pk_context pk_priv, pk_priv_copy_public, pk_pub, pk_pub_copy_public;
Valerio Setti452d2d22024-02-01 11:31:30 +01002493 mbedtls_svc_key_id_t priv_key_id = MBEDTLS_SVC_KEY_ID_INIT;
2494 mbedtls_svc_key_id_t pub_key_id = MBEDTLS_SVC_KEY_ID_INIT;
Valerio Setti452d2d22024-02-01 11:31:30 +01002495
Valerio Settid2ccc2f2024-02-23 08:49:45 +01002496 mbedtls_pk_init(&pk_priv);
Gilles Peskinebf69f2e2024-03-06 13:39:01 +01002497 mbedtls_pk_init(&pk_priv_copy_public);
Valerio Settid2ccc2f2024-02-23 08:49:45 +01002498 mbedtls_pk_init(&pk_pub);
Gilles Peskinebf69f2e2024-03-06 13:39:01 +01002499 mbedtls_pk_init(&pk_pub_copy_public);
Valerio Settid2ccc2f2024-02-23 08:49:45 +01002500 PSA_INIT();
2501
Valerio Settid2ccc2f2024-02-23 08:49:45 +01002502 if (key_type == PSA_KEY_TYPE_RSA_KEY_PAIR) {
2503 key_usage |= PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT;
Valerio Setti452d2d22024-02-01 11:31:30 +01002504 }
2505
Valerio Setti039bbba2024-02-29 07:24:26 +01002506 /* Create both a private key and its public counterpart in PSA. */
Valerio Settid2ccc2f2024-02-23 08:49:45 +01002507 PSA_ASSERT(pk_psa_import_key(priv_key_data->x, priv_key_data->len,
2508 key_type, key_usage, key_alg, &priv_key_id));
Valerio Settid2ccc2f2024-02-23 08:49:45 +01002509 pub_key_id = psa_pub_key_from_priv(priv_key_id);
Valerio Setti039bbba2024-02-29 07:24:26 +01002510
Gilles Peskinebf69f2e2024-03-06 13:39:01 +01002511 /* Create 4 PK contexts starting from the PSA keys we just created. */
Valerio Setti039bbba2024-02-29 07:24:26 +01002512 TEST_EQUAL(mbedtls_pk_copy_from_psa(priv_key_id, &pk_priv), 0);
Gilles Peskined6a710a2024-03-12 12:39:28 +01002513 TEST_EQUAL(mbedtls_pk_copy_public_from_psa(priv_key_id, &pk_priv_copy_public), 0);
Valerio Setti88e2dac2024-02-19 14:48:00 +01002514 TEST_EQUAL(mbedtls_pk_copy_from_psa(pub_key_id, &pk_pub), 0);
Gilles Peskinebf69f2e2024-03-06 13:39:01 +01002515 TEST_EQUAL(mbedtls_pk_copy_public_from_psa(pub_key_id, &pk_pub_copy_public), 0);
Valerio Setti452d2d22024-02-01 11:31:30 +01002516
Valerio Setti237424b2024-03-20 12:10:38 +01002517 /* Destroy both PSA keys to prove that generated PK contexts are independent
Valerio Setti039bbba2024-02-29 07:24:26 +01002518 * from them. */
2519 priv_key_id = psa_copy_and_destroy(priv_key_id);
2520 pub_key_id = psa_copy_and_destroy(pub_key_id);
2521
Valerio Setti237424b2024-03-20 12:10:38 +01002522 /* - Check that the generated PK contexts are of the correct type.
2523 * - [Only for RSA] check that the padding mode is correct.
Valerio Settia657ae32024-02-23 17:55:28 +01002524 */
Valerio Settid2ccc2f2024-02-23 08:49:45 +01002525 if (PSA_KEY_TYPE_IS_ECC_KEY_PAIR(key_type)) {
2526 TEST_EQUAL(mbedtls_pk_get_type(&pk_priv), MBEDTLS_PK_ECKEY);
2527 TEST_EQUAL(mbedtls_pk_get_type(&pk_pub), MBEDTLS_PK_ECKEY);
2528 } else {
2529 TEST_EQUAL(mbedtls_pk_get_type(&pk_priv), MBEDTLS_PK_RSA);
2530 TEST_EQUAL(mbedtls_pk_get_type(&pk_pub), MBEDTLS_PK_RSA);
Valerio Settia657ae32024-02-23 17:55:28 +01002531#if defined(MBEDTLS_RSA_C)
2532 mbedtls_rsa_context *rsa_priv = mbedtls_pk_rsa(pk_priv);
2533 mbedtls_rsa_context *rsa_pub = mbedtls_pk_rsa(pk_pub);
2534 if (PSA_ALG_IS_RSA_OAEP(key_alg) || PSA_ALG_IS_RSA_PSS(key_alg)) {
2535 TEST_EQUAL(mbedtls_rsa_get_padding_mode(rsa_priv), MBEDTLS_RSA_PKCS_V21);
2536 TEST_EQUAL(mbedtls_rsa_get_padding_mode(rsa_pub), MBEDTLS_RSA_PKCS_V21);
2537 } else {
2538 TEST_EQUAL(mbedtls_rsa_get_padding_mode(rsa_priv), MBEDTLS_RSA_PKCS_V15);
2539 TEST_EQUAL(mbedtls_rsa_get_padding_mode(rsa_pub), MBEDTLS_RSA_PKCS_V15);
2540 }
2541#endif /* MBEDTLS_RSA_C */
Valerio Settid2ccc2f2024-02-23 08:49:45 +01002542 }
2543
Valerio Setti237424b2024-03-20 12:10:38 +01002544 /* Check that generated private/public PK contexts form a valid private/public key pair. */
Valerio Setti88e2dac2024-02-19 14:48:00 +01002545 TEST_EQUAL(mbedtls_pk_check_pair(&pk_pub, &pk_priv, mbedtls_test_rnd_std_rand, NULL), 0);
Valerio Settie8fe3e72024-02-19 08:00:50 +01002546
Valerio Setti237424b2024-03-20 12:10:38 +01002547 /* Check consistency between copied PSA keys and generated PK contexts. */
2548 TEST_EQUAL(mbedtls_test_key_consistency_psa_pk(priv_key_id, &pk_priv), 1);
2549 TEST_EQUAL(mbedtls_test_key_consistency_psa_pk(priv_key_id, &pk_pub), 1);
2550 TEST_EQUAL(mbedtls_test_key_consistency_psa_pk(pub_key_id, &pk_priv), 1);
2551 TEST_EQUAL(mbedtls_test_key_consistency_psa_pk(pub_key_id, &pk_pub), 1);
Valerio Setti452d2d22024-02-01 11:31:30 +01002552
Gilles Peskinebf69f2e2024-03-06 13:39:01 +01002553 /* Test that the keys from mbedtls_pk_copy_public_from_psa() are identical
Valerio Setti237424b2024-03-20 12:10:38 +01002554 * to the public keys from mbedtls_pk_copy_from_psa(). */
Gilles Peskinebf69f2e2024-03-06 13:39:01 +01002555 mbedtls_test_set_step(1);
2556 TEST_ASSERT(pk_public_same(&pk_pub, &pk_priv_copy_public));
2557 mbedtls_test_set_step(2);
2558 TEST_ASSERT(pk_public_same(&pk_pub, &pk_pub_copy_public));
2559
Valerio Setti452d2d22024-02-01 11:31:30 +01002560exit:
Valerio Setti88e2dac2024-02-19 14:48:00 +01002561 mbedtls_pk_free(&pk_priv);
Gilles Peskinebf69f2e2024-03-06 13:39:01 +01002562 mbedtls_pk_free(&pk_priv_copy_public);
Valerio Setti88e2dac2024-02-19 14:48:00 +01002563 mbedtls_pk_free(&pk_pub);
Gilles Peskinebf69f2e2024-03-06 13:39:01 +01002564 mbedtls_pk_free(&pk_pub_copy_public);
Valerio Setti452d2d22024-02-01 11:31:30 +01002565 psa_destroy_key(priv_key_id);
2566 psa_destroy_key(pub_key_id);
2567 PSA_DONE();
2568}
2569/* END_CASE */
Gilles Peskine17d5b6b2024-03-06 13:40:01 +01002570
2571/* BEGIN_CASE depends_on:MBEDTLS_PSA_CRYPTO_C*/
2572void pk_copy_public_from_psa(data_t *priv_key_data, int key_type_arg)
2573{
2574 psa_key_type_t key_type = key_type_arg;
2575 mbedtls_pk_context pk_from_exportable;
2576 mbedtls_pk_init(&pk_from_exportable);
2577 mbedtls_pk_context pk_from_non_exportable;
2578 mbedtls_pk_init(&pk_from_non_exportable);
2579 mbedtls_pk_context pk_private;
2580 mbedtls_pk_init(&pk_private);
2581 mbedtls_svc_key_id_t non_exportable_key_id = MBEDTLS_SVC_KEY_ID_INIT;
2582 mbedtls_svc_key_id_t exportable_key_id = MBEDTLS_SVC_KEY_ID_INIT;
2583
2584 PSA_INIT();
2585
2586 PSA_ASSERT(pk_psa_import_key(priv_key_data->x, priv_key_data->len,
2587 key_type,
2588 PSA_KEY_USAGE_EXPORT,
2589 PSA_ALG_NONE,
2590 &exportable_key_id));
2591 PSA_ASSERT(pk_psa_import_key(priv_key_data->x, priv_key_data->len,
2592 key_type,
2593 0,
2594 PSA_ALG_NONE,
2595 &non_exportable_key_id));
2596
2597 TEST_EQUAL(mbedtls_pk_copy_public_from_psa(exportable_key_id,
2598 &pk_from_exportable), 0);
2599 TEST_EQUAL(mbedtls_pk_copy_public_from_psa(non_exportable_key_id,
2600 &pk_from_non_exportable), 0);
2601
2602 /* Check that the non-exportable key really is non-exportable */
2603 TEST_EQUAL(mbedtls_pk_copy_from_psa(non_exportable_key_id, &pk_private),
2604 MBEDTLS_ERR_PK_TYPE_MISMATCH);
2605
2606 psa_destroy_key(exportable_key_id);
2607 psa_destroy_key(non_exportable_key_id);
2608
2609 /* The goal of this test function is mostly to check that
2610 * mbedtls_pk_copy_public_from_psa works with a non-exportable key pair.
2611 * We check that the resulting key is the same as for an exportable
2612 * key pair. We rely on pk_copy_from_psa_success tests to validate that
2613 * the result is correct. */
2614 TEST_ASSERT(pk_public_same(&pk_from_non_exportable, &pk_from_exportable));
2615
2616exit:
2617 mbedtls_pk_free(&pk_from_non_exportable);
2618 mbedtls_pk_free(&pk_from_exportable);
2619 mbedtls_pk_free(&pk_private);
2620 psa_destroy_key(exportable_key_id);
2621 psa_destroy_key(non_exportable_key_id);
2622 PSA_DONE();
2623}
2624/* END_CASE */