blob: d4a8307574030bc63f3d557b6a2816660ea939ec [file] [log] [blame]
Gilles Peskinee59236f2018-01-27 23:32:46 +01001/*
2 * PSA crypto layer on top of Mbed TLS crypto
3 */
Bence Szépkúti86974652020-06-15 11:59:37 +02004/*
Bence Szépkúti1e148272020-08-07 13:07:28 +02005 * Copyright The Mbed TLS Contributors
Dave Rodgman16799db2023-11-02 19:47:20 +00006 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
Gilles Peskinee59236f2018-01-27 23:32:46 +01007 */
8
Gilles Peskinedb09ef62020-06-03 01:43:33 +02009#include "common.h"
Ronald Cronafbc7ed2023-01-24 16:02:04 +010010#include "psa_crypto_core_common.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010011
12#if defined(MBEDTLS_PSA_CRYPTO_C)
mohammad160327010052018-07-03 13:16:15 +030013
John Durkop07cc04a2020-11-16 22:08:34 -080014#if defined(MBEDTLS_PSA_CRYPTO_CONFIG)
15#include "check_crypto_config.h"
16#endif
17
Gilles Peskinee59236f2018-01-27 23:32:46 +010018#include "psa/crypto.h"
Przemyslaw Stekiel705fb0f2021-11-24 08:47:29 +010019#include "psa/crypto_values.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010020
Ronald Crond6d28882020-12-14 14:56:02 +010021#include "psa_crypto_cipher.h"
Gilles Peskine039b90c2018-12-07 18:24:41 +010022#include "psa_crypto_core.h"
Gilles Peskine5e769522018-11-20 21:59:56 +010023#include "psa_crypto_invasive.h"
Xiaokang Qiane9c39c42023-08-09 08:50:19 +000024#include "psa_crypto_driver_wrappers.h"
Xiaokang Qianfe9666b2023-09-11 10:36:20 +000025#include "psa_crypto_driver_wrappers_no_static.h"
Ronald Cron00b7bfc2020-11-25 15:25:26 +010026#include "psa_crypto_ecp.h"
Przemek Stekiel359f4622022-12-05 14:11:55 +010027#include "psa_crypto_ffdh.h"
Steven Cooreman5f88e772021-03-15 11:07:12 +010028#include "psa_crypto_hash.h"
Steven Cooreman82c66b62021-03-19 17:39:17 +010029#include "psa_crypto_mac.h"
Ronald Cron00b7bfc2020-11-25 15:25:26 +010030#include "psa_crypto_rsa.h"
Ronald Cron7023db52020-11-20 18:17:42 +010031#include "psa_crypto_ecp.h"
Gilles Peskinea8ade162019-06-26 11:24:49 +020032#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined0890212019-06-24 14:34:43 +020033#include "psa_crypto_se.h"
Gilles Peskinea8ade162019-06-26 11:24:49 +020034#endif
Gilles Peskine961849f2018-11-30 18:54:54 +010035#include "psa_crypto_slot_management.h"
Darryl Greend49a4992018-06-18 17:27:26 +010036/* Include internal declarations that are useful for implementing persistently
37 * stored keys. */
38#include "psa_crypto_storage.h"
39
Gilles Peskineb2b64d32020-12-14 16:43:58 +010040#include "psa_crypto_random_impl.h"
Gilles Peskine90edc992020-11-13 15:39:19 +010041
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010042#include <stdlib.h>
43#include <string.h>
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010044#include "mbedtls/platform.h"
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010045
Gilles Peskine1c49f1a2020-11-13 18:46:25 +010046#include "mbedtls/aes.h"
Gilles Peskine9a944802018-06-21 09:35:35 +020047#include "mbedtls/asn1.h"
Jaeden Amero25384a22019-01-10 10:23:21 +000048#include "mbedtls/asn1write.h"
Gilles Peskinea81d85b2018-06-26 16:10:23 +020049#include "mbedtls/bignum.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010050#include "mbedtls/camellia.h"
Gilles Peskine26869f22019-05-06 15:25:00 +020051#include "mbedtls/chacha20.h"
52#include "mbedtls/chachapoly.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010053#include "mbedtls/cipher.h"
54#include "mbedtls/ccm.h"
55#include "mbedtls/cmac.h"
Dave Rodgman78701152023-08-29 14:20:18 +010056#include "mbedtls/constant_time.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010057#include "mbedtls/des.h"
Gilles Peskineb7ecdf02018-09-18 12:11:27 +020058#include "mbedtls/ecdh.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010059#include "mbedtls/ecp.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010060#include "mbedtls/entropy.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010061#include "mbedtls/error.h"
62#include "mbedtls/gcm.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010063#include "mbedtls/md5.h"
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010064#include "mbedtls/pk.h"
Chris Jonesdaacb592021-03-09 17:03:29 +000065#include "pk_wrap.h"
Gilles Peskine3f108122018-12-07 18:14:53 +010066#include "mbedtls/platform_util.h"
Janos Follath24eed8d2019-11-22 13:21:35 +000067#include "mbedtls/error.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010068#include "mbedtls/ripemd160.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010069#include "mbedtls/rsa.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010070#include "mbedtls/sha1.h"
71#include "mbedtls/sha256.h"
72#include "mbedtls/sha512.h"
Valerio Setti384fbde2024-01-02 13:26:40 +010073#include "mbedtls/psa_util.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010074
Przemek Stekiel75fe3fb2022-06-09 14:44:55 +020075#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF) || \
76 defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) || \
77 defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Przemek Stekiel69c46792022-06-10 12:59:51 +020078#define BUILTIN_ALG_ANY_HKDF 1
Przemek Stekiel75fe3fb2022-06-09 14:44:55 +020079#endif
80
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010081/****************************************************************/
82/* Global data, support functions and library management */
83/****************************************************************/
84
Gilles Peskine449bd832023-01-11 14:50:10 +010085static int key_type_is_raw_bytes(psa_key_type_t type)
Gilles Peskine48c0ea12018-06-21 14:15:31 +020086{
Gilles Peskine449bd832023-01-11 14:50:10 +010087 return PSA_KEY_TYPE_IS_UNSTRUCTURED(type);
Gilles Peskine48c0ea12018-06-21 14:15:31 +020088}
89
Gilles Peskine5a3c50e2018-12-04 12:27:09 +010090/* Values for psa_global_data_t::rng_state */
91#define RNG_NOT_INITIALIZED 0
92#define RNG_INITIALIZED 1
93#define RNG_SEEDED 2
Gilles Peskinec6b69072018-11-20 21:42:52 +010094
Gilles Peskine449bd832023-01-11 14:50:10 +010095typedef struct {
Dave Rodgman864f5942023-08-16 18:04:44 +010096 uint8_t initialized;
97 uint8_t rng_state;
98 uint8_t drivers_initialized;
Gilles Peskine2d8a1822021-11-08 22:20:03 +010099 mbedtls_psa_random_context_t rng;
Gilles Peskinee59236f2018-01-27 23:32:46 +0100100} psa_global_data_t;
101
102static psa_global_data_t global_data;
103
Gilles Peskine5894e8e2020-12-14 14:54:06 +0100104#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
105mbedtls_psa_drbg_context_t *const mbedtls_psa_random_state =
106 &global_data.rng.drbg;
107#endif
108
itayzafrir0adf0fc2018-09-06 16:24:41 +0300109#define GUARD_MODULE_INITIALIZED \
Gilles Peskine449bd832023-01-11 14:50:10 +0100110 if (global_data.initialized == 0) \
111 return PSA_ERROR_BAD_STATE;
itayzafrir0adf0fc2018-09-06 16:24:41 +0300112
Manuel Pégourié-Gonnard7abdf7e2023-03-09 11:17:43 +0100113int psa_can_do_hash(psa_algorithm_t hash_alg)
114{
115 (void) hash_alg;
116 return global_data.drivers_initialized;
117}
Valerio Settic6f004f2023-12-12 11:27:36 +0100118
Valerio Setti1fff4f22023-12-28 14:19:34 +0100119int psa_can_do_cipher(psa_key_type_t key_type, psa_algorithm_t cipher_alg)
Valerio Settic6f004f2023-12-12 11:27:36 +0100120{
Valerio Setti1fff4f22023-12-28 14:19:34 +0100121 (void) key_type;
Valerio Settic6f004f2023-12-12 11:27:36 +0100122 (void) cipher_alg;
123 return global_data.drivers_initialized;
124}
125
126
Valerio Settia55f0422023-07-10 15:34:41 +0200127#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT) || \
Przemek Stekiel53410502023-04-28 13:18:43 +0200128 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) || \
Valerio Settia55f0422023-07-10 15:34:41 +0200129 defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE)
Przemek Stekiel134cc2e2023-05-05 10:13:37 +0200130static int psa_is_dh_key_size_valid(size_t bits)
131{
Valerio Setti504a1022024-01-17 15:19:30 +0100132 switch (bits) {
133#if defined(PSA_WANT_DH_RFC7919_2048)
134 case 2048:
135 return 1;
136#endif /* PSA_WANT_DH_RFC7919_2048 */
137#if defined(PSA_WANT_DH_RFC7919_3072)
138 case 3072:
139 return 1;
140#endif /* PSA_WANT_DH_RFC7919_3072 */
141#if defined(PSA_WANT_DH_RFC7919_4096)
142 case 4096:
143 return 1;
144#endif /* PSA_WANT_DH_RFC7919_4096 */
145#if defined(PSA_WANT_DH_RFC7919_6144)
146 case 6144:
147 return 1;
148#endif /* PSA_WANT_DH_RFC7919_6144 */
149#if defined(PSA_WANT_DH_RFC7919_8192)
150 case 8192:
151 return 1;
152#endif /* PSA_WANT_DH_RFC7919_8192 */
153 default:
154 return 0;
Przemek Stekield1cf1ba2023-04-27 12:04:21 +0200155 }
Przemek Stekield1cf1ba2023-04-27 12:04:21 +0200156}
Valerio Settia55f0422023-07-10 15:34:41 +0200157#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT ||
Przemek Stekiel53410502023-04-28 13:18:43 +0200158 MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY ||
Valerio Settia55f0422023-07-10 15:34:41 +0200159 PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE */
Manuel Pégourié-Gonnard7abdf7e2023-03-09 11:17:43 +0100160
Gilles Peskine449bd832023-01-11 14:50:10 +0100161psa_status_t mbedtls_to_psa_error(int ret)
Gilles Peskinee59236f2018-01-27 23:32:46 +0100162{
Gilles Peskinedbf68962021-01-06 20:04:23 +0100163 /* Mbed TLS error codes can combine a high-level error code and a
164 * low-level error code. The low-level error usually reflects the
165 * root cause better, so dispatch on that preferably. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100166 int low_level_ret = -(-ret & 0x007f);
167 switch (low_level_ret != 0 ? low_level_ret : ret) {
Gilles Peskinee59236f2018-01-27 23:32:46 +0100168 case 0:
Gilles Peskine449bd832023-01-11 14:50:10 +0100169 return PSA_SUCCESS;
Gilles Peskinea5905292018-02-07 20:59:33 +0100170
Dave Rodgman4f47f3d2023-08-31 12:10:00 +0100171#if defined(MBEDTLS_AES_C)
Gilles Peskinea5905292018-02-07 20:59:33 +0100172 case MBEDTLS_ERR_AES_INVALID_KEY_LENGTH:
173 case MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100174 return PSA_ERROR_NOT_SUPPORTED;
Dave Rodgman09a9e582023-08-31 11:05:22 +0100175 case MBEDTLS_ERR_AES_BAD_INPUT_DATA:
176 return PSA_ERROR_INVALID_ARGUMENT;
Dave Rodgman509b5672023-08-16 19:26:23 +0100177#endif
178
179#if defined(MBEDTLS_ASN1_PARSE_C) || defined(MBEDTLS_ASN1_WRITE_C)
Gilles Peskine9a944802018-06-21 09:35:35 +0200180 case MBEDTLS_ERR_ASN1_OUT_OF_DATA:
181 case MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:
182 case MBEDTLS_ERR_ASN1_INVALID_LENGTH:
183 case MBEDTLS_ERR_ASN1_LENGTH_MISMATCH:
184 case MBEDTLS_ERR_ASN1_INVALID_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100185 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine9a944802018-06-21 09:35:35 +0200186 case MBEDTLS_ERR_ASN1_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100187 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskine9a944802018-06-21 09:35:35 +0200188 case MBEDTLS_ERR_ASN1_BUF_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100189 return PSA_ERROR_BUFFER_TOO_SMALL;
Dave Rodgman509b5672023-08-16 19:26:23 +0100190#endif
Gilles Peskine9a944802018-06-21 09:35:35 +0200191
Dave Rodgman4f47f3d2023-08-31 12:10:00 +0100192#if defined(MBEDTLS_CAMELLIA_C)
Jaeden Amero892cd6d2019-02-11 12:21:12 +0000193 case MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA:
Gilles Peskinea5905292018-02-07 20:59:33 +0100194 case MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100195 return PSA_ERROR_NOT_SUPPORTED;
Dave Rodgman509b5672023-08-16 19:26:23 +0100196#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100197
Dave Rodgman4f47f3d2023-08-31 12:10:00 +0100198#if defined(MBEDTLS_CCM_C)
Gilles Peskinea5905292018-02-07 20:59:33 +0100199 case MBEDTLS_ERR_CCM_BAD_INPUT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100200 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100201 case MBEDTLS_ERR_CCM_AUTH_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100202 return PSA_ERROR_INVALID_SIGNATURE;
Dave Rodgman509b5672023-08-16 19:26:23 +0100203#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100204
Dave Rodgman4f47f3d2023-08-31 12:10:00 +0100205#if defined(MBEDTLS_CHACHA20_C)
Gilles Peskine26869f22019-05-06 15:25:00 +0200206 case MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100207 return PSA_ERROR_INVALID_ARGUMENT;
Dave Rodgman509b5672023-08-16 19:26:23 +0100208#endif
Gilles Peskine26869f22019-05-06 15:25:00 +0200209
Dave Rodgman4f47f3d2023-08-31 12:10:00 +0100210#if defined(MBEDTLS_CHACHAPOLY_C)
Gilles Peskine26869f22019-05-06 15:25:00 +0200211 case MBEDTLS_ERR_CHACHAPOLY_BAD_STATE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100212 return PSA_ERROR_BAD_STATE;
Gilles Peskine26869f22019-05-06 15:25:00 +0200213 case MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100214 return PSA_ERROR_INVALID_SIGNATURE;
Dave Rodgman509b5672023-08-16 19:26:23 +0100215#endif
Gilles Peskine26869f22019-05-06 15:25:00 +0200216
Dave Rodgman509b5672023-08-16 19:26:23 +0100217#if defined(MBEDTLS_CIPHER_C)
Gilles Peskinea5905292018-02-07 20:59:33 +0100218 case MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100219 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100220 case MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100221 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100222 case MBEDTLS_ERR_CIPHER_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100223 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskinea5905292018-02-07 20:59:33 +0100224 case MBEDTLS_ERR_CIPHER_INVALID_PADDING:
Gilles Peskine449bd832023-01-11 14:50:10 +0100225 return PSA_ERROR_INVALID_PADDING;
Gilles Peskinea5905292018-02-07 20:59:33 +0100226 case MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100227 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100228 case MBEDTLS_ERR_CIPHER_AUTH_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100229 return PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskinea5905292018-02-07 20:59:33 +0100230 case MBEDTLS_ERR_CIPHER_INVALID_CONTEXT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100231 return PSA_ERROR_CORRUPTION_DETECTED;
Dave Rodgman509b5672023-08-16 19:26:23 +0100232#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100233
Gilles Peskine449bd832023-01-11 14:50:10 +0100234#if !(defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) || \
235 defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE))
Gilles Peskinebee96c82020-11-23 21:00:09 +0100236 /* Only check CTR_DRBG error codes if underlying mbedtls_xxx
237 * functions are passed a CTR_DRBG instance. */
Gilles Peskinea5905292018-02-07 20:59:33 +0100238 case MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100239 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskinea5905292018-02-07 20:59:33 +0100240 case MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG:
241 case MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG:
Gilles Peskine449bd832023-01-11 14:50:10 +0100242 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100243 case MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100244 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskine82e57d12020-11-13 21:31:17 +0100245#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100246
Dave Rodgman4f47f3d2023-08-31 12:10:00 +0100247#if defined(MBEDTLS_DES_C)
Gilles Peskinea5905292018-02-07 20:59:33 +0100248 case MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100249 return PSA_ERROR_NOT_SUPPORTED;
Dave Rodgman509b5672023-08-16 19:26:23 +0100250#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100251
Gilles Peskinee59236f2018-01-27 23:32:46 +0100252 case MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED:
253 case MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE:
254 case MBEDTLS_ERR_ENTROPY_SOURCE_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100255 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskinea5905292018-02-07 20:59:33 +0100256
Dave Rodgman4f47f3d2023-08-31 12:10:00 +0100257#if defined(MBEDTLS_GCM_C)
Gilles Peskinea5905292018-02-07 20:59:33 +0100258 case MBEDTLS_ERR_GCM_AUTH_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100259 return PSA_ERROR_INVALID_SIGNATURE;
Mateusz Starzykf28261f2021-09-30 16:39:07 +0200260 case MBEDTLS_ERR_GCM_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100261 return PSA_ERROR_BUFFER_TOO_SMALL;
Gilles Peskinea5905292018-02-07 20:59:33 +0100262 case MBEDTLS_ERR_GCM_BAD_INPUT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100263 return PSA_ERROR_INVALID_ARGUMENT;
Dave Rodgman509b5672023-08-16 19:26:23 +0100264#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100265
Gilles Peskine82e57d12020-11-13 21:31:17 +0100266#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) && \
Gilles Peskine449bd832023-01-11 14:50:10 +0100267 defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE)
Gilles Peskinebee96c82020-11-23 21:00:09 +0100268 /* Only check HMAC_DRBG error codes if underlying mbedtls_xxx
269 * functions are passed a HMAC_DRBG instance. */
Gilles Peskine82e57d12020-11-13 21:31:17 +0100270 case MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100271 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskine82e57d12020-11-13 21:31:17 +0100272 case MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG:
273 case MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG:
Gilles Peskine449bd832023-01-11 14:50:10 +0100274 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine82e57d12020-11-13 21:31:17 +0100275 case MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100276 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskine82e57d12020-11-13 21:31:17 +0100277#endif
278
Dave Rodgmandea266f2023-08-31 11:52:43 +0100279#if defined(MBEDTLS_MD_LIGHT)
Gilles Peskinea5905292018-02-07 20:59:33 +0100280 case MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100281 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100282 case MBEDTLS_ERR_MD_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100283 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100284 case MBEDTLS_ERR_MD_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100285 return PSA_ERROR_INSUFFICIENT_MEMORY;
Dave Rodgman509b5672023-08-16 19:26:23 +0100286#if defined(MBEDTLS_FS_IO)
Gilles Peskinea5905292018-02-07 20:59:33 +0100287 case MBEDTLS_ERR_MD_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100288 return PSA_ERROR_STORAGE_FAILURE;
Dave Rodgman509b5672023-08-16 19:26:23 +0100289#endif
290#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100291
Dave Rodgman509b5672023-08-16 19:26:23 +0100292#if defined(MBEDTLS_BIGNUM_C)
293#if defined(MBEDTLS_FS_IO)
Gilles Peskinef76aa772018-10-29 19:24:33 +0100294 case MBEDTLS_ERR_MPI_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100295 return PSA_ERROR_STORAGE_FAILURE;
Dave Rodgman509b5672023-08-16 19:26:23 +0100296#endif
Gilles Peskinef76aa772018-10-29 19:24:33 +0100297 case MBEDTLS_ERR_MPI_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100298 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100299 case MBEDTLS_ERR_MPI_INVALID_CHARACTER:
Gilles Peskine449bd832023-01-11 14:50:10 +0100300 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100301 case MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100302 return PSA_ERROR_BUFFER_TOO_SMALL;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100303 case MBEDTLS_ERR_MPI_NEGATIVE_VALUE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100304 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100305 case MBEDTLS_ERR_MPI_DIVISION_BY_ZERO:
Gilles Peskine449bd832023-01-11 14:50:10 +0100306 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100307 case MBEDTLS_ERR_MPI_NOT_ACCEPTABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100308 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100309 case MBEDTLS_ERR_MPI_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100310 return PSA_ERROR_INSUFFICIENT_MEMORY;
Dave Rodgman509b5672023-08-16 19:26:23 +0100311#endif
Gilles Peskinef76aa772018-10-29 19:24:33 +0100312
Dave Rodgman509b5672023-08-16 19:26:23 +0100313#if defined(MBEDTLS_PK_C)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100314 case MBEDTLS_ERR_PK_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100315 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100316 case MBEDTLS_ERR_PK_TYPE_MISMATCH:
317 case MBEDTLS_ERR_PK_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100318 return PSA_ERROR_INVALID_ARGUMENT;
Dave Rodgman509b5672023-08-16 19:26:23 +0100319#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) || defined(MBEDTLS_FS_IO) || \
320 defined(MBEDTLS_PSA_ITS_FILE_C)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100321 case MBEDTLS_ERR_PK_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100322 return PSA_ERROR_STORAGE_FAILURE;
Dave Rodgman509b5672023-08-16 19:26:23 +0100323#endif
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100324 case MBEDTLS_ERR_PK_KEY_INVALID_VERSION:
325 case MBEDTLS_ERR_PK_KEY_INVALID_FORMAT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100326 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100327 case MBEDTLS_ERR_PK_UNKNOWN_PK_ALG:
Gilles Peskine449bd832023-01-11 14:50:10 +0100328 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100329 case MBEDTLS_ERR_PK_PASSWORD_REQUIRED:
330 case MBEDTLS_ERR_PK_PASSWORD_MISMATCH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100331 return PSA_ERROR_NOT_PERMITTED;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100332 case MBEDTLS_ERR_PK_INVALID_PUBKEY:
Gilles Peskine449bd832023-01-11 14:50:10 +0100333 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100334 case MBEDTLS_ERR_PK_INVALID_ALG:
335 case MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE:
336 case MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100337 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100338 case MBEDTLS_ERR_PK_SIG_LEN_MISMATCH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100339 return PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskinef9f1bdf2021-06-23 20:32:27 +0200340 case MBEDTLS_ERR_PK_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100341 return PSA_ERROR_BUFFER_TOO_SMALL;
Dave Rodgman509b5672023-08-16 19:26:23 +0100342#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100343
Gilles Peskineff2d2002019-05-06 15:26:23 +0200344 case MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100345 return PSA_ERROR_HARDWARE_FAILURE;
Gilles Peskineff2d2002019-05-06 15:26:23 +0200346 case MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100347 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskineff2d2002019-05-06 15:26:23 +0200348
Dave Rodgman509b5672023-08-16 19:26:23 +0100349#if defined(MBEDTLS_RSA_C)
Gilles Peskinea5905292018-02-07 20:59:33 +0100350 case MBEDTLS_ERR_RSA_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100351 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100352 case MBEDTLS_ERR_RSA_INVALID_PADDING:
Gilles Peskine449bd832023-01-11 14:50:10 +0100353 return PSA_ERROR_INVALID_PADDING;
Gilles Peskinea5905292018-02-07 20:59:33 +0100354 case MBEDTLS_ERR_RSA_KEY_GEN_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100355 return PSA_ERROR_HARDWARE_FAILURE;
Gilles Peskinea5905292018-02-07 20:59:33 +0100356 case MBEDTLS_ERR_RSA_KEY_CHECK_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100357 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100358 case MBEDTLS_ERR_RSA_PUBLIC_FAILED:
359 case MBEDTLS_ERR_RSA_PRIVATE_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100360 return PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100361 case MBEDTLS_ERR_RSA_VERIFY_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100362 return PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskinea5905292018-02-07 20:59:33 +0100363 case MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100364 return PSA_ERROR_BUFFER_TOO_SMALL;
Gilles Peskinea5905292018-02-07 20:59:33 +0100365 case MBEDTLS_ERR_RSA_RNG_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100366 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Dave Rodgman509b5672023-08-16 19:26:23 +0100367#endif
Manuel Pégourié-Gonnard93c08472021-04-15 12:23:55 +0200368
Dave Rodgman1dab4452023-09-01 09:59:51 +0100369#if defined(MBEDTLS_ECP_LIGHT)
itayzafrir5c753392018-05-08 11:18:38 +0300370 case MBEDTLS_ERR_ECP_BAD_INPUT_DATA:
itayzafrir7b30f8b2018-05-09 16:07:36 +0300371 case MBEDTLS_ERR_ECP_INVALID_KEY:
Gilles Peskine449bd832023-01-11 14:50:10 +0100372 return PSA_ERROR_INVALID_ARGUMENT;
itayzafrir7b30f8b2018-05-09 16:07:36 +0300373 case MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100374 return PSA_ERROR_BUFFER_TOO_SMALL;
itayzafrir7b30f8b2018-05-09 16:07:36 +0300375 case MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100376 return PSA_ERROR_NOT_SUPPORTED;
itayzafrir7b30f8b2018-05-09 16:07:36 +0300377 case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH:
378 case MBEDTLS_ERR_ECP_VERIFY_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100379 return PSA_ERROR_INVALID_SIGNATURE;
itayzafrir7b30f8b2018-05-09 16:07:36 +0300380 case MBEDTLS_ERR_ECP_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100381 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskine40d81602020-11-25 00:09:47 +0100382 case MBEDTLS_ERR_ECP_RANDOM_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100383 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskine40d81602020-11-25 00:09:47 +0100384
Dave Rodgman509b5672023-08-16 19:26:23 +0100385#if defined(MBEDTLS_ECP_RESTARTABLE)
Paul Elliott588f8ed2022-12-02 18:10:26 +0000386 case MBEDTLS_ERR_ECP_IN_PROGRESS:
387 return PSA_OPERATION_INCOMPLETE;
Dave Rodgman509b5672023-08-16 19:26:23 +0100388#endif
389#endif
Paul Elliott588f8ed2022-12-02 18:10:26 +0000390
Janos Follatha13b9052019-11-22 12:48:59 +0000391 case MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100392 return PSA_ERROR_CORRUPTION_DETECTED;
itayzafrir5c753392018-05-08 11:18:38 +0300393
Gilles Peskinee59236f2018-01-27 23:32:46 +0100394 default:
Gilles Peskine449bd832023-01-11 14:50:10 +0100395 return PSA_ERROR_GENERIC_ERROR;
Gilles Peskinee59236f2018-01-27 23:32:46 +0100396 }
397}
398
Paul Elliottdc42ca82023-02-24 18:11:59 +0000399/**
400 * \brief For output buffers which contain "tags"
401 * (outputs that may be checked for validity like
402 * hashes, MACs and signatures), fill the unused
403 * part of the output buffer (the whole buffer on
404 * error, the trailing part on success) with
405 * something that isn't a valid tag (barring an
406 * attack on the tag and deliberately-crafted
407 * input), in case the caller doesn't check the
408 * return status properly.
409 *
410 * \param output_buffer Pointer to buffer to wipe. May not be NULL
411 * unless \p output_buffer_size is zero.
412 * \param status Status of function called to generate
413 * output_buffer originally
414 * \param output_buffer_size Size of output buffer. If zero, \p output_buffer
415 * could be NULL.
416 * \param output_buffer_length Length of data written to output_buffer, must be
417 * less than \p output_buffer_size
418 */
419static void psa_wipe_tag_output_buffer(uint8_t *output_buffer, psa_status_t status,
Paul Elliott7118d172023-02-26 16:57:05 +0000420 size_t output_buffer_size, size_t output_buffer_length)
421{
Paul Elliottdc42ca82023-02-24 18:11:59 +0000422 size_t offset = 0;
423
424 if (output_buffer_size == 0) {
425 /* If output_buffer_size is 0 then we have nothing to do. We must not
426 call memset because output_buffer may be NULL in this case */
427 return;
428 }
429
430 if (status == PSA_SUCCESS) {
431 offset = output_buffer_length;
432 }
433
434 memset(output_buffer + offset, '!', output_buffer_size - offset);
435}
436
Gilles Peskineb0b255c2018-07-06 17:01:38 +0200437
Gilles Peskine449bd832023-01-11 14:50:10 +0100438psa_status_t psa_validate_unstructured_key_bit_size(psa_key_type_t type,
439 size_t bits)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200440{
441 /* Check that the bit size is acceptable for the key type */
Gilles Peskine449bd832023-01-11 14:50:10 +0100442 switch (type) {
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200443 case PSA_KEY_TYPE_RAW_DATA:
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200444 case PSA_KEY_TYPE_HMAC:
Gilles Peskineea0fb492018-07-12 17:17:20 +0200445 case PSA_KEY_TYPE_DERIVE:
Neil Armstrong4b5710f2022-05-25 11:30:27 +0200446 case PSA_KEY_TYPE_PASSWORD:
447 case PSA_KEY_TYPE_PASSWORD_HASH:
Gilles Peskineea0fb492018-07-12 17:17:20 +0200448 break;
Ronald Cron1f0db802021-03-12 09:59:30 +0100449#if defined(PSA_WANT_KEY_TYPE_AES)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200450 case PSA_KEY_TYPE_AES:
Gilles Peskine449bd832023-01-11 14:50:10 +0100451 if (bits != 128 && bits != 192 && bits != 256) {
452 return PSA_ERROR_INVALID_ARGUMENT;
453 }
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200454 break;
455#endif
Gilles Peskine6c12a1e2021-09-21 11:59:39 +0200456#if defined(PSA_WANT_KEY_TYPE_ARIA)
457 case PSA_KEY_TYPE_ARIA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100458 if (bits != 128 && bits != 192 && bits != 256) {
459 return PSA_ERROR_INVALID_ARGUMENT;
460 }
Gilles Peskine6c12a1e2021-09-21 11:59:39 +0200461 break;
462#endif
Ronald Cron1f0db802021-03-12 09:59:30 +0100463#if defined(PSA_WANT_KEY_TYPE_CAMELLIA)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200464 case PSA_KEY_TYPE_CAMELLIA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100465 if (bits != 128 && bits != 192 && bits != 256) {
466 return PSA_ERROR_INVALID_ARGUMENT;
467 }
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200468 break;
469#endif
Ronald Cron1f0db802021-03-12 09:59:30 +0100470#if defined(PSA_WANT_KEY_TYPE_DES)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200471 case PSA_KEY_TYPE_DES:
Gilles Peskine449bd832023-01-11 14:50:10 +0100472 if (bits != 64 && bits != 128 && bits != 192) {
473 return PSA_ERROR_INVALID_ARGUMENT;
474 }
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200475 break;
476#endif
Ronald Cron1f0db802021-03-12 09:59:30 +0100477#if defined(PSA_WANT_KEY_TYPE_CHACHA20)
Gilles Peskine26869f22019-05-06 15:25:00 +0200478 case PSA_KEY_TYPE_CHACHA20:
Gilles Peskine449bd832023-01-11 14:50:10 +0100479 if (bits != 256) {
480 return PSA_ERROR_INVALID_ARGUMENT;
481 }
Gilles Peskine26869f22019-05-06 15:25:00 +0200482 break;
483#endif
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200484 default:
Gilles Peskine449bd832023-01-11 14:50:10 +0100485 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200486 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100487 if (bits % 8 != 0) {
488 return PSA_ERROR_INVALID_ARGUMENT;
489 }
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200490
Gilles Peskine449bd832023-01-11 14:50:10 +0100491 return PSA_SUCCESS;
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200492}
493
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100494/** Check whether a given key type is valid for use with a given MAC algorithm
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100495 *
Steven Cooremancd640932021-03-08 12:00:27 +0100496 * Upon successful return of this function, the behavior of #PSA_MAC_LENGTH
497 * when called with the validated \p algorithm and \p key_type is well-defined.
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100498 *
499 * \param[in] algorithm The specific MAC algorithm (can be wildcard).
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100500 * \param[in] key_type The key type of the key to be used with the
501 * \p algorithm.
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100502 *
503 * \retval #PSA_SUCCESS
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100504 * The \p key_type is valid for use with the \p algorithm
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100505 * \retval #PSA_ERROR_INVALID_ARGUMENT
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100506 * The \p key_type is not valid for use with the \p algorithm
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100507 */
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100508MBEDTLS_STATIC_TESTABLE psa_status_t psa_mac_key_can_do(
Steven Cooreman58c94d32021-03-02 21:31:17 +0100509 psa_algorithm_t algorithm,
Gilles Peskine449bd832023-01-11 14:50:10 +0100510 psa_key_type_t key_type)
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100511{
Gilles Peskine449bd832023-01-11 14:50:10 +0100512 if (PSA_ALG_IS_HMAC(algorithm)) {
513 if (key_type == PSA_KEY_TYPE_HMAC) {
514 return PSA_SUCCESS;
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100515 }
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100516 }
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100517
Gilles Peskine449bd832023-01-11 14:50:10 +0100518 if (PSA_ALG_IS_BLOCK_CIPHER_MAC(algorithm)) {
519 /* Check that we're calling PSA_BLOCK_CIPHER_BLOCK_LENGTH with a cipher
520 * key. */
521 if ((key_type & PSA_KEY_TYPE_CATEGORY_MASK) ==
522 PSA_KEY_TYPE_CATEGORY_SYMMETRIC) {
523 /* PSA_BLOCK_CIPHER_BLOCK_LENGTH returns 1 for stream ciphers and
524 * the block length (larger than 1) for block ciphers. */
525 if (PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type) > 1) {
526 return PSA_SUCCESS;
527 }
528 }
529 }
530
531 return PSA_ERROR_INVALID_ARGUMENT;
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100532}
533
Gilles Peskine449bd832023-01-11 14:50:10 +0100534psa_status_t psa_allocate_buffer_to_slot(psa_key_slot_t *slot,
535 size_t buffer_length)
Steven Cooreman75b74362020-07-28 14:30:13 +0200536{
Gilles Peskine449bd832023-01-11 14:50:10 +0100537 if (slot->key.data != NULL) {
538 return PSA_ERROR_ALREADY_EXISTS;
539 }
Steven Cooreman75b74362020-07-28 14:30:13 +0200540
Gilles Peskine449bd832023-01-11 14:50:10 +0100541 slot->key.data = mbedtls_calloc(1, buffer_length);
542 if (slot->key.data == NULL) {
543 return PSA_ERROR_INSUFFICIENT_MEMORY;
544 }
Steven Cooreman75b74362020-07-28 14:30:13 +0200545
Ronald Cronea0f8a62020-11-25 17:52:23 +0100546 slot->key.bytes = buffer_length;
Gilles Peskine449bd832023-01-11 14:50:10 +0100547 return PSA_SUCCESS;
Steven Cooreman75b74362020-07-28 14:30:13 +0200548}
549
Gilles Peskine449bd832023-01-11 14:50:10 +0100550psa_status_t psa_copy_key_material_into_slot(psa_key_slot_t *slot,
551 const uint8_t *data,
552 size_t data_length)
Steven Cooremanf7cebd42020-10-13 20:27:40 +0200553{
Gilles Peskine449bd832023-01-11 14:50:10 +0100554 psa_status_t status = psa_allocate_buffer_to_slot(slot,
555 data_length);
556 if (status != PSA_SUCCESS) {
557 return status;
558 }
Steven Cooremanf7cebd42020-10-13 20:27:40 +0200559
Gilles Peskine449bd832023-01-11 14:50:10 +0100560 memcpy(slot->key.data, data, data_length);
561 return PSA_SUCCESS;
Steven Cooremanf7cebd42020-10-13 20:27:40 +0200562}
563
Ronald Crona0fe59f2020-11-29 11:14:53 +0100564psa_status_t psa_import_key_into_slot(
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100565 const psa_key_attributes_t *attributes,
566 const uint8_t *data, size_t data_length,
567 uint8_t *key_buffer, size_t key_buffer_size,
Gilles Peskine449bd832023-01-11 14:50:10 +0100568 size_t *key_buffer_length, size_t *bits)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100569{
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100570 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f107ae2024-02-28 01:26:46 +0100571 psa_key_type_t type = attributes->type;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100572
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200573 /* zero-length keys are never supported. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100574 if (data_length == 0) {
575 return PSA_ERROR_NOT_SUPPORTED;
576 }
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200577
Gilles Peskine449bd832023-01-11 14:50:10 +0100578 if (key_type_is_raw_bytes(type)) {
579 *bits = PSA_BYTES_TO_BITS(data_length);
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200580
Gilles Peskine2f107ae2024-02-28 01:26:46 +0100581 status = psa_validate_unstructured_key_bit_size(attributes->type,
Gilles Peskine449bd832023-01-11 14:50:10 +0100582 *bits);
583 if (status != PSA_SUCCESS) {
584 return status;
585 }
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200586
Ronald Crondd04d422020-11-28 15:14:42 +0100587 /* Copy the key material. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100588 memcpy(key_buffer, data, data_length);
Ronald Crondd04d422020-11-28 15:14:42 +0100589 *key_buffer_length = data_length;
Gilles Peskine449bd832023-01-11 14:50:10 +0100590 (void) key_buffer_size;
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200591
Gilles Peskine449bd832023-01-11 14:50:10 +0100592 return PSA_SUCCESS;
593 } else if (PSA_KEY_TYPE_IS_ASYMMETRIC(type)) {
Valerio Settia55f0422023-07-10 15:34:41 +0200594#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT) || \
Przemek Stekiel6d85afa2023-04-28 11:42:17 +0200595 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY)
Przemek Stekiel472b3f32022-12-01 14:38:49 +0100596 if (PSA_KEY_TYPE_IS_DH(type)) {
Przemek Stekield1cf1ba2023-04-27 12:04:21 +0200597 if (psa_is_dh_key_size_valid(PSA_BYTES_TO_BITS(data_length)) == 0) {
Valerio Setti504a1022024-01-17 15:19:30 +0100598 return PSA_ERROR_NOT_SUPPORTED;
Przemek Stekiel472b3f32022-12-01 14:38:49 +0100599 }
Przemek Stekiel33c91eb2023-05-30 15:16:35 +0200600 return mbedtls_psa_ffdh_import_key(attributes,
601 data, data_length,
602 key_buffer, key_buffer_size,
603 key_buffer_length,
604 bits);
Przemek Stekiel472b3f32022-12-01 14:38:49 +0100605 }
Valerio Settia55f0422023-07-10 15:34:41 +0200606#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT) ||
Przemek Stekiel6d85afa2023-04-28 11:42:17 +0200607 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) */
Valerio Setti27c501a2023-06-27 16:58:52 +0200608#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT) || \
Gilles Peskine449bd832023-01-11 14:50:10 +0100609 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
610 if (PSA_KEY_TYPE_IS_ECC(type)) {
611 return mbedtls_psa_ecp_import_key(attributes,
612 data, data_length,
613 key_buffer, key_buffer_size,
614 key_buffer_length,
615 bits);
Steven Cooreman40120f62020-10-29 11:42:22 +0100616 }
Valerio Setti27c501a2023-06-27 16:58:52 +0200617#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT) ||
John Durkop9814fa22020-11-04 12:28:15 -0800618 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
Valerio Settife478902023-07-25 12:27:19 +0200619#if (defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT) && \
620 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT)) || \
Gilles Peskine449bd832023-01-11 14:50:10 +0100621 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
622 if (PSA_KEY_TYPE_IS_RSA(type)) {
623 return mbedtls_psa_rsa_import_key(attributes,
624 data, data_length,
625 key_buffer, key_buffer_size,
626 key_buffer_length,
627 bits);
Steven Cooreman3ea0ce42020-10-23 11:37:05 +0200628 }
Valerio Settife478902023-07-25 12:27:19 +0200629#endif /* (defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT) &&
630 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT)) ||
John Durkop9814fa22020-11-04 12:28:15 -0800631 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100632 }
Steven Cooreman40120f62020-10-29 11:42:22 +0100633
Gilles Peskine449bd832023-01-11 14:50:10 +0100634 return PSA_ERROR_NOT_SUPPORTED;
Darryl Green06fd18d2018-07-16 11:21:11 +0100635}
636
Gilles Peskinef603c712019-01-19 13:40:11 +0100637/** Calculate the intersection of two algorithm usage policies.
638 *
639 * Return 0 (which allows no operation) on incompatibility.
640 */
641static psa_algorithm_t psa_key_policy_algorithm_intersection(
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100642 psa_key_type_t key_type,
Gilles Peskinef603c712019-01-19 13:40:11 +0100643 psa_algorithm_t alg1,
Gilles Peskine449bd832023-01-11 14:50:10 +0100644 psa_algorithm_t alg2)
Gilles Peskinef603c712019-01-19 13:40:11 +0100645{
Gilles Peskine549ea862019-05-22 11:45:59 +0200646 /* Common case: both sides actually specify the same policy. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100647 if (alg1 == alg2) {
648 return alg1;
649 }
Steven Cooreman03488022021-02-18 12:07:20 +0100650 /* If the policies are from the same hash-and-sign family, check
651 * if one is a wildcard. If so the other has the specific algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100652 if (PSA_ALG_IS_SIGN_HASH(alg1) &&
653 PSA_ALG_IS_SIGN_HASH(alg2) &&
654 (alg1 & ~PSA_ALG_HASH_MASK) == (alg2 & ~PSA_ALG_HASH_MASK)) {
655 if (PSA_ALG_SIGN_GET_HASH(alg1) == PSA_ALG_ANY_HASH) {
656 return alg2;
657 }
658 if (PSA_ALG_SIGN_GET_HASH(alg2) == PSA_ALG_ANY_HASH) {
659 return alg1;
660 }
Steven Cooreman03488022021-02-18 12:07:20 +0100661 }
662 /* If the policies are from the same AEAD family, check whether
Steven Cooreman7de9e2d2021-02-22 17:05:56 +0100663 * one of them is a minimum-tag-length wildcard. Calculate the most
Steven Cooreman03488022021-02-18 12:07:20 +0100664 * restrictive tag length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100665 if (PSA_ALG_IS_AEAD(alg1) && PSA_ALG_IS_AEAD(alg2) &&
666 (PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg1, 0) ==
667 PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg2, 0))) {
668 size_t alg1_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg1);
669 size_t alg2_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg2);
Steven Cooremancd640932021-03-08 12:00:27 +0100670 size_t restricted_len = alg1_len > alg2_len ? alg1_len : alg2_len;
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100671
Steven Cooreman7de9e2d2021-02-22 17:05:56 +0100672 /* If both are wildcards, return most restrictive wildcard */
Gilles Peskine449bd832023-01-11 14:50:10 +0100673 if (((alg1 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
674 ((alg2 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0)) {
675 return PSA_ALG_AEAD_WITH_AT_LEAST_THIS_LENGTH_TAG(
676 alg1, restricted_len);
Steven Cooreman03488022021-02-18 12:07:20 +0100677 }
678 /* If only one is a wildcard, return specific algorithm if compatible. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100679 if (((alg1 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
680 (alg1_len <= alg2_len)) {
681 return alg2;
Steven Cooreman03488022021-02-18 12:07:20 +0100682 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100683 if (((alg2 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
684 (alg2_len <= alg1_len)) {
685 return alg1;
Steven Cooreman03488022021-02-18 12:07:20 +0100686 }
687 }
688 /* If the policies are from the same MAC family, check whether one
689 * of them is a minimum-MAC-length policy. Calculate the most
690 * restrictive tag length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100691 if (PSA_ALG_IS_MAC(alg1) && PSA_ALG_IS_MAC(alg2) &&
692 (PSA_ALG_FULL_LENGTH_MAC(alg1) ==
693 PSA_ALG_FULL_LENGTH_MAC(alg2))) {
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100694 /* Validate the combination of key type and algorithm. Since the base
695 * algorithm of alg1 and alg2 are the same, we only need this once. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100696 if (PSA_SUCCESS != psa_mac_key_can_do(alg1, key_type)) {
697 return 0;
698 }
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100699
Steven Cooreman31a876d2021-03-03 20:47:40 +0100700 /* Get the (exact or at-least) output lengths for both sides of the
701 * requested intersection. None of the currently supported algorithms
702 * have an output length dependent on the actual key size, so setting it
703 * to a bogus value of 0 is currently OK.
704 *
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100705 * Note that for at-least-this-length wildcard algorithms, the output
706 * length is set to the shortest allowed length, which allows us to
707 * calculate the most restrictive tag length for the intersection. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100708 size_t alg1_len = PSA_MAC_LENGTH(key_type, 0, alg1);
709 size_t alg2_len = PSA_MAC_LENGTH(key_type, 0, alg2);
Steven Cooremancd640932021-03-08 12:00:27 +0100710 size_t restricted_len = alg1_len > alg2_len ? alg1_len : alg2_len;
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100711
Steven Cooremana1d83222021-02-25 10:20:29 +0100712 /* If both are wildcards, return most restrictive wildcard */
Gilles Peskine449bd832023-01-11 14:50:10 +0100713 if (((alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
714 ((alg2 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0)) {
715 return PSA_ALG_AT_LEAST_THIS_LENGTH_MAC(alg1, restricted_len);
Steven Cooreman03488022021-02-18 12:07:20 +0100716 }
Steven Cooreman31a876d2021-03-03 20:47:40 +0100717
718 /* If only one is an at-least-this-length policy, the intersection would
719 * be the other (fixed-length) policy as long as said fixed length is
720 * equal to or larger than the shortest allowed length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100721 if ((alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) {
722 return (alg1_len <= alg2_len) ? alg2 : 0;
Steven Cooreman03488022021-02-18 12:07:20 +0100723 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100724 if ((alg2 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) {
725 return (alg2_len <= alg1_len) ? alg1 : 0;
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100726 }
Steven Cooreman31a876d2021-03-03 20:47:40 +0100727
Steven Cooremancd640932021-03-08 12:00:27 +0100728 /* If none of them are wildcards, check whether they define the same tag
729 * length. This is still possible here when one is default-length and
730 * the other specific-length. Ensure to always return the
731 * specific-length version for the intersection. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100732 if (alg1_len == alg2_len) {
733 return PSA_ALG_TRUNCATED_MAC(alg1, alg1_len);
734 }
Gilles Peskinef603c712019-01-19 13:40:11 +0100735 }
736 /* If the policies are incompatible, allow nothing. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100737 return 0;
Gilles Peskinef603c712019-01-19 13:40:11 +0100738}
739
Gilles Peskine449bd832023-01-11 14:50:10 +0100740static int psa_key_algorithm_permits(psa_key_type_t key_type,
741 psa_algorithm_t policy_alg,
742 psa_algorithm_t requested_alg)
Gilles Peskined6f371b2019-05-10 19:33:38 +0200743{
Gilles Peskine549ea862019-05-22 11:45:59 +0200744 /* Common case: the policy only allows requested_alg. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100745 if (requested_alg == policy_alg) {
746 return 1;
747 }
Steven Cooreman03488022021-02-18 12:07:20 +0100748 /* If policy_alg is a hash-and-sign with a wildcard for the hash,
749 * and requested_alg is the same hash-and-sign family with any hash,
750 * then requested_alg is compliant with policy_alg. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100751 if (PSA_ALG_IS_SIGN_HASH(requested_alg) &&
752 PSA_ALG_SIGN_GET_HASH(policy_alg) == PSA_ALG_ANY_HASH) {
753 return (policy_alg & ~PSA_ALG_HASH_MASK) ==
754 (requested_alg & ~PSA_ALG_HASH_MASK);
Steven Cooreman03488022021-02-18 12:07:20 +0100755 }
756 /* If policy_alg is a wildcard AEAD algorithm of the same base as
757 * the requested algorithm, check the requested tag length to be
758 * equal-length or longer than the wildcard-specified length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100759 if (PSA_ALG_IS_AEAD(policy_alg) &&
760 PSA_ALG_IS_AEAD(requested_alg) &&
761 (PSA_ALG_AEAD_WITH_SHORTENED_TAG(policy_alg, 0) ==
762 PSA_ALG_AEAD_WITH_SHORTENED_TAG(requested_alg, 0)) &&
763 ((policy_alg & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0)) {
764 return PSA_ALG_AEAD_GET_TAG_LENGTH(policy_alg) <=
765 PSA_ALG_AEAD_GET_TAG_LENGTH(requested_alg);
Steven Cooreman03488022021-02-18 12:07:20 +0100766 }
Steven Cooremancd640932021-03-08 12:00:27 +0100767 /* If policy_alg is a MAC algorithm of the same base as the requested
768 * algorithm, check whether their MAC lengths are compatible. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100769 if (PSA_ALG_IS_MAC(policy_alg) &&
770 PSA_ALG_IS_MAC(requested_alg) &&
771 (PSA_ALG_FULL_LENGTH_MAC(policy_alg) ==
772 PSA_ALG_FULL_LENGTH_MAC(requested_alg))) {
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100773 /* Validate the combination of key type and algorithm. Since the policy
774 * and requested algorithms are the same, we only need this once. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100775 if (PSA_SUCCESS != psa_mac_key_can_do(policy_alg, key_type)) {
776 return 0;
777 }
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100778
Steven Cooreman31a876d2021-03-03 20:47:40 +0100779 /* Get both the requested output length for the algorithm which is to be
780 * verified, and the default output length for the base algorithm.
781 * Note that none of the currently supported algorithms have an output
782 * length dependent on actual key size, so setting it to a bogus value
783 * of 0 is currently OK. */
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100784 size_t requested_output_length = PSA_MAC_LENGTH(
Gilles Peskine449bd832023-01-11 14:50:10 +0100785 key_type, 0, requested_alg);
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100786 size_t default_output_length = PSA_MAC_LENGTH(
Gilles Peskine449bd832023-01-11 14:50:10 +0100787 key_type, 0,
788 PSA_ALG_FULL_LENGTH_MAC(requested_alg));
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100789
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100790 /* If the policy is default-length, only allow an algorithm with
791 * a declared exact-length matching the default. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100792 if (PSA_MAC_TRUNCATED_LENGTH(policy_alg) == 0) {
793 return requested_output_length == default_output_length;
794 }
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100795
796 /* If the requested algorithm is default-length, allow it if the policy
Steven Cooremancd640932021-03-08 12:00:27 +0100797 * length exactly matches the default length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100798 if (PSA_MAC_TRUNCATED_LENGTH(requested_alg) == 0 &&
799 PSA_MAC_TRUNCATED_LENGTH(policy_alg) == default_output_length) {
800 return 1;
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100801 }
802
Steven Cooremancd640932021-03-08 12:00:27 +0100803 /* If policy_alg is an at-least-this-length wildcard MAC algorithm,
804 * check for the requested MAC length to be equal to or longer than the
805 * minimum allowed length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100806 if ((policy_alg & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) {
807 return PSA_MAC_TRUNCATED_LENGTH(policy_alg) <=
808 requested_output_length;
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100809 }
Gilles Peskined6f371b2019-05-10 19:33:38 +0200810 }
Steven Cooremance48e852020-10-05 16:02:45 +0200811 /* If policy_alg is a generic key agreement operation, then using it for
Steven Cooremanfa5e6312020-10-15 17:07:12 +0200812 * a key derivation with that key agreement should also be allowed. This
813 * behaviour is expected to be defined in a future specification version. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100814 if (PSA_ALG_IS_RAW_KEY_AGREEMENT(policy_alg) &&
815 PSA_ALG_IS_KEY_AGREEMENT(requested_alg)) {
816 return PSA_ALG_KEY_AGREEMENT_GET_BASE(requested_alg) ==
817 policy_alg;
Steven Cooremance48e852020-10-05 16:02:45 +0200818 }
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100819 /* If it isn't explicitly permitted, it's forbidden. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100820 return 0;
Gilles Peskined6f371b2019-05-10 19:33:38 +0200821}
822
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100823/** Test whether a policy permits an algorithm.
824 *
825 * The caller must test usage flags separately.
Steven Cooreman7e39f052021-02-23 14:18:32 +0100826 *
Steven Cooreman5a172672021-03-02 21:27:42 +0100827 * \note This function requires providing the key type for which the policy is
828 * being validated, since some algorithm policy definitions (e.g. MAC)
829 * have different properties depending on what kind of cipher it is
830 * combined with.
831 *
Steven Cooreman7e39f052021-02-23 14:18:32 +0100832 * \retval PSA_SUCCESS When \p alg is a specific algorithm
833 * allowed by the \p policy.
834 * \retval PSA_ERROR_INVALID_ARGUMENT When \p alg is not a specific algorithm
835 * \retval PSA_ERROR_NOT_PERMITTED When \p alg is a specific algorithm, but
836 * the \p policy does not allow it.
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100837 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100838static psa_status_t psa_key_policy_permits(const psa_key_policy_t *policy,
839 psa_key_type_t key_type,
840 psa_algorithm_t alg)
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100841{
Steven Cooremand788fab2021-02-25 11:29:17 +0100842 /* '0' is not a valid algorithm */
Gilles Peskine449bd832023-01-11 14:50:10 +0100843 if (alg == 0) {
844 return PSA_ERROR_INVALID_ARGUMENT;
845 }
Steven Cooremand788fab2021-02-25 11:29:17 +0100846
Steven Cooreman7e39f052021-02-23 14:18:32 +0100847 /* A requested algorithm cannot be a wildcard. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100848 if (PSA_ALG_IS_WILDCARD(alg)) {
849 return PSA_ERROR_INVALID_ARGUMENT;
850 }
Steven Cooreman7e39f052021-02-23 14:18:32 +0100851
Gilles Peskine449bd832023-01-11 14:50:10 +0100852 if (psa_key_algorithm_permits(key_type, policy->alg, alg) ||
853 psa_key_algorithm_permits(key_type, policy->alg2, alg)) {
854 return PSA_SUCCESS;
855 } else {
856 return PSA_ERROR_NOT_PERMITTED;
857 }
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100858}
859
Gilles Peskinef603c712019-01-19 13:40:11 +0100860/** Restrict a key policy based on a constraint.
861 *
Steven Cooreman5a172672021-03-02 21:27:42 +0100862 * \note This function requires providing the key type for which the policy is
863 * being restricted, since some algorithm policy definitions (e.g. MAC)
864 * have different properties depending on what kind of cipher it is
865 * combined with.
866 *
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100867 * \param[in] key_type The key type for which to restrict the policy
Gilles Peskinef603c712019-01-19 13:40:11 +0100868 * \param[in,out] policy The policy to restrict.
869 * \param[in] constraint The policy constraint to apply.
870 *
871 * \retval #PSA_SUCCESS
872 * \c *policy contains the intersection of the original value of
873 * \c *policy and \c *constraint.
874 * \retval #PSA_ERROR_INVALID_ARGUMENT
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100875 * \c key_type, \c *policy and \c *constraint are incompatible.
Gilles Peskinef603c712019-01-19 13:40:11 +0100876 * \c *policy is unchanged.
877 */
878static psa_status_t psa_restrict_key_policy(
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100879 psa_key_type_t key_type,
Gilles Peskinef603c712019-01-19 13:40:11 +0100880 psa_key_policy_t *policy,
Gilles Peskine449bd832023-01-11 14:50:10 +0100881 const psa_key_policy_t *constraint)
Gilles Peskinef603c712019-01-19 13:40:11 +0100882{
883 psa_algorithm_t intersection_alg =
Gilles Peskine449bd832023-01-11 14:50:10 +0100884 psa_key_policy_algorithm_intersection(key_type, policy->alg,
885 constraint->alg);
Gilles Peskined6f371b2019-05-10 19:33:38 +0200886 psa_algorithm_t intersection_alg2 =
Gilles Peskine449bd832023-01-11 14:50:10 +0100887 psa_key_policy_algorithm_intersection(key_type, policy->alg2,
888 constraint->alg2);
889 if (intersection_alg == 0 && policy->alg != 0 && constraint->alg != 0) {
890 return PSA_ERROR_INVALID_ARGUMENT;
891 }
892 if (intersection_alg2 == 0 && policy->alg2 != 0 && constraint->alg2 != 0) {
893 return PSA_ERROR_INVALID_ARGUMENT;
894 }
Gilles Peskinef603c712019-01-19 13:40:11 +0100895 policy->usage &= constraint->usage;
896 policy->alg = intersection_alg;
Gilles Peskined6f371b2019-05-10 19:33:38 +0200897 policy->alg2 = intersection_alg2;
Gilles Peskine449bd832023-01-11 14:50:10 +0100898 return PSA_SUCCESS;
Gilles Peskinef603c712019-01-19 13:40:11 +0100899}
900
Przemek Stekiel061f6942022-11-30 10:51:35 +0100901/** Get the description of a key given its identifier and policy constraints
902 * and lock it.
903 *
904 * The key must have allow all the usage flags set in \p usage. If \p alg is
905 * nonzero, the key must allow operations with this algorithm. If \p alg is
906 * zero, the algorithm is not checked.
907 *
908 * In case of a persistent key, the function loads the description of the key
909 * into a key slot if not already done.
910 *
Ryan Everett098c6652024-01-03 13:03:36 +0000911 * On success, the returned key slot has been registered for reading.
Ryan Everett93cea572024-02-20 18:01:29 +0000912 * It is the responsibility of the caller to then unregister
913 * once they have finished reading the contents of the slot.
914 * The caller unregisters by calling psa_unregister_read() or
915 * psa_unregister_read_under_mutex(). psa_unregister_read() must be called
916 * if and only if the caller already holds the global key slot mutex
917 * (when mutexes are enabled). psa_unregister_read_under_mutex() encapsulates
918 * the unregister with mutex lock and unlock operations.
Przemek Stekiel061f6942022-11-30 10:51:35 +0100919 */
920static psa_status_t psa_get_and_lock_key_slot_with_policy(
Ronald Cron5c522922020-11-14 16:35:34 +0100921 mbedtls_svc_key_id_t key,
922 psa_key_slot_t **p_slot,
923 psa_key_usage_t usage,
Gilles Peskine449bd832023-01-11 14:50:10 +0100924 psa_algorithm_t alg)
Darryl Green06fd18d2018-07-16 11:21:11 +0100925{
Ronald Cronf95a2b12020-10-22 15:24:49 +0200926 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel9a5b8122022-12-22 13:34:47 +0100927 psa_key_slot_t *slot = NULL;
Darryl Green06fd18d2018-07-16 11:21:11 +0100928
Gilles Peskine449bd832023-01-11 14:50:10 +0100929 status = psa_get_and_lock_key_slot(key, p_slot);
930 if (status != PSA_SUCCESS) {
931 return status;
932 }
Ronald Cronf95a2b12020-10-22 15:24:49 +0200933 slot = *p_slot;
Darryl Green06fd18d2018-07-16 11:21:11 +0100934
935 /* Enforce that usage policy for the key slot contains all the flags
936 * required by the usage parameter. There is one exception: public
937 * keys can always be exported, so we treat public key objects as
938 * if they had the export flag. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100939 if (PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type)) {
Darryl Green06fd18d2018-07-16 11:21:11 +0100940 usage &= ~PSA_KEY_USAGE_EXPORT;
Gilles Peskine449bd832023-01-11 14:50:10 +0100941 }
Ronald Cronf95a2b12020-10-22 15:24:49 +0200942
Gilles Peskine449bd832023-01-11 14:50:10 +0100943 if ((slot->attr.policy.usage & usage) != usage) {
Steven Cooreman328f11c2021-03-02 11:44:51 +0100944 status = PSA_ERROR_NOT_PERMITTED;
Ronald Cronf95a2b12020-10-22 15:24:49 +0200945 goto error;
Steven Cooreman328f11c2021-03-02 11:44:51 +0100946 }
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100947
Shaun Case8b0ecbc2021-12-20 21:14:10 -0800948 /* Enforce that the usage policy permits the requested algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100949 if (alg != 0) {
950 status = psa_key_policy_permits(&slot->attr.policy,
951 slot->attr.type,
952 alg);
953 if (status != PSA_SUCCESS) {
Steven Cooreman7e39f052021-02-23 14:18:32 +0100954 goto error;
Gilles Peskine449bd832023-01-11 14:50:10 +0100955 }
Steven Cooreman7e39f052021-02-23 14:18:32 +0100956 }
Darryl Green06fd18d2018-07-16 11:21:11 +0100957
Gilles Peskine449bd832023-01-11 14:50:10 +0100958 return PSA_SUCCESS;
Ronald Cronf95a2b12020-10-22 15:24:49 +0200959
960error:
961 *p_slot = NULL;
Ryan Everettfb792ca2024-01-31 13:40:05 +0000962 psa_unregister_read_under_mutex(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +0200963
Gilles Peskine449bd832023-01-11 14:50:10 +0100964 return status;
Darryl Green06fd18d2018-07-16 11:21:11 +0100965}
Darryl Green940d72c2018-07-13 13:18:51 +0100966
Ronald Cron5c522922020-11-14 16:35:34 +0100967/** Get a key slot containing a transparent key and lock it.
Gilles Peskine28f8f302019-07-24 13:30:31 +0200968 *
969 * A transparent key is a key for which the key material is directly
Ronald Cronddae0f52021-08-24 15:39:44 +0200970 * available, as opposed to a key in a secure element and/or to be used
971 * by a secure element.
Gilles Peskine28f8f302019-07-24 13:30:31 +0200972 *
Ronald Cronddae0f52021-08-24 15:39:44 +0200973 * This is a temporary function that may be used instead of
974 * psa_get_and_lock_key_slot_with_policy() when there is no opaque key support
975 * for a cryptographic operation.
Ronald Cronf95a2b12020-10-22 15:24:49 +0200976 *
Ryan Everett098c6652024-01-03 13:03:36 +0000977 * On success, the returned key slot has been registered for reading.
Ryan Everett93cea572024-02-20 18:01:29 +0000978 * It is the responsibility of the caller to then unregister
979 * once they have finished reading the contents of the slot.
980 * The caller unregisters by calling psa_unregister_read() or
981 * psa_unregister_read_under_mutex(). psa_unregister_read() must be called
982 * if and only if the caller already holds the global key slot mutex
983 * (when mutexes are enabled). psa_unregister_read_under_mutex() encapsulates
984 * psa_unregister_read() with mutex lock and unlock operations.
Gilles Peskine28f8f302019-07-24 13:30:31 +0200985 */
Ronald Cron5c522922020-11-14 16:35:34 +0100986static psa_status_t psa_get_and_lock_transparent_key_slot_with_policy(
987 mbedtls_svc_key_id_t key,
988 psa_key_slot_t **p_slot,
989 psa_key_usage_t usage,
Gilles Peskine449bd832023-01-11 14:50:10 +0100990 psa_algorithm_t alg)
Gilles Peskine28f8f302019-07-24 13:30:31 +0200991{
Gilles Peskine449bd832023-01-11 14:50:10 +0100992 psa_status_t status = psa_get_and_lock_key_slot_with_policy(key, p_slot,
993 usage, alg);
994 if (status != PSA_SUCCESS) {
995 return status;
Gilles Peskine28f8f302019-07-24 13:30:31 +0200996 }
Ronald Cronf95a2b12020-10-22 15:24:49 +0200997
Gilles Peskine449bd832023-01-11 14:50:10 +0100998 if (psa_key_lifetime_is_external((*p_slot)->attr.lifetime)) {
Ryan Everettfb792ca2024-01-31 13:40:05 +0000999 psa_unregister_read_under_mutex(*p_slot);
Gilles Peskine449bd832023-01-11 14:50:10 +01001000 *p_slot = NULL;
1001 return PSA_ERROR_NOT_SUPPORTED;
1002 }
1003
1004 return PSA_SUCCESS;
Gilles Peskine28f8f302019-07-24 13:30:31 +02001005}
Gilles Peskine28f8f302019-07-24 13:30:31 +02001006
Gilles Peskine449bd832023-01-11 14:50:10 +01001007psa_status_t psa_remove_key_data_from_memory(psa_key_slot_t *slot)
Darryl Green40225ba2018-11-15 14:48:15 +00001008{
Gilles Peskine449bd832023-01-11 14:50:10 +01001009 if (slot->key.data != NULL) {
Tom Cosgrove52f7e182023-08-01 09:08:48 +01001010 mbedtls_zeroize_and_free(slot->key.data, slot->key.bytes);
Gilles Peskine449bd832023-01-11 14:50:10 +01001011 }
Ronald Cronea0f8a62020-11-25 17:52:23 +01001012
Ronald Cronea0f8a62020-11-25 17:52:23 +01001013 slot->key.data = NULL;
1014 slot->key.bytes = 0;
Darryl Green40225ba2018-11-15 14:48:15 +00001015
Gilles Peskine449bd832023-01-11 14:50:10 +01001016 return PSA_SUCCESS;
Darryl Green40225ba2018-11-15 14:48:15 +00001017}
1018
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001019/** Completely wipe a slot in memory, including its policy.
1020 * Persistent storage is not affected. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001021psa_status_t psa_wipe_key_slot(psa_key_slot_t *slot)
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001022{
Gilles Peskine449bd832023-01-11 14:50:10 +01001023 psa_status_t status = psa_remove_key_data_from_memory(slot);
Ronald Cronddd3d052020-10-30 14:07:07 +01001024
Gilles Peskine449bd832023-01-11 14:50:10 +01001025 /*
1026 * As the return error code may not be handled in case of multiple errors,
Ryan Everett7ed542e2024-01-17 11:39:09 +00001027 * do our best to report an unexpected amount of registered readers or
1028 * an unexpected state.
1029 * Assert with MBEDTLS_TEST_HOOK_TEST_ASSERT that the slot is valid for
1030 * wiping.
Gilles Peskine449bd832023-01-11 14:50:10 +01001031 * if the MBEDTLS_TEST_HOOKS configuration option is enabled and the
1032 * function is called as part of the execution of a test suite, the
1033 * execution of the test suite is stopped in error if the assertion fails.
1034 */
Ryan Everett7ed542e2024-01-17 11:39:09 +00001035 switch (slot->state) {
1036 case PSA_SLOT_FULL:
1037 /* In this state psa_wipe_key_slot() must only be called if the
1038 * caller is the last reader. */
1039 case PSA_SLOT_PENDING_DELETION:
1040 /* In this state psa_wipe_key_slot() must only be called if the
1041 * caller is the last reader. */
1042 if (slot->registered_readers != 1) {
1043 MBEDTLS_TEST_HOOK_TEST_ASSERT(slot->registered_readers == 1);
1044 status = PSA_ERROR_CORRUPTION_DETECTED;
1045 }
1046 break;
1047 case PSA_SLOT_FILLING:
1048 /* In this state registered_readers must be 0. */
1049 if (slot->registered_readers != 0) {
1050 MBEDTLS_TEST_HOOK_TEST_ASSERT(slot->registered_readers == 0);
1051 status = PSA_ERROR_CORRUPTION_DETECTED;
1052 }
1053 break;
1054 case PSA_SLOT_EMPTY:
1055 /* The slot is already empty, it cannot be wiped. */
1056 MBEDTLS_TEST_HOOK_TEST_ASSERT(slot->state != PSA_SLOT_EMPTY);
1057 status = PSA_ERROR_CORRUPTION_DETECTED;
1058 break;
1059 default:
1060 /* The slot's state is invalid. */
1061 status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cronddd3d052020-10-30 14:07:07 +01001062 }
1063
Gilles Peskine3f7cd622019-08-13 15:01:08 +02001064 /* Multipart operations may still be using the key. This is safe
1065 * because all multipart operation objects are independent from
1066 * the key slot: if they need to access the key after the setup
1067 * phase, they have a copy of the key. Note that this means that
1068 * key material can linger until all operations are completed. */
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001069 /* At this point, key material and other type-specific content has
1070 * been wiped. Clear remaining metadata. We can call memset and not
Ryan Everettaa33c512023-12-21 17:32:07 +00001071 * zeroize because the metadata is not particularly sensitive.
1072 * This memset also sets the slot's state to PSA_SLOT_EMPTY. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001073 memset(slot, 0, sizeof(*slot));
1074 return status;
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001075}
1076
Gilles Peskine449bd832023-01-11 14:50:10 +01001077psa_status_t psa_destroy_key(mbedtls_svc_key_id_t key)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001078{
Gilles Peskine2f060a82018-12-04 17:12:32 +01001079 psa_key_slot_t *slot;
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001080 psa_status_t status; /* status of the last operation */
1081 psa_status_t overall_status = PSA_SUCCESS;
Gilles Peskine354f7672019-07-12 23:46:38 +02001082#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1083 psa_se_drv_table_entry_t *driver;
1084#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001085
Gilles Peskine449bd832023-01-11 14:50:10 +01001086 if (mbedtls_svc_key_id_is_null(key)) {
1087 return PSA_SUCCESS;
1088 }
Gilles Peskine1841cf42019-10-08 15:48:25 +02001089
Ronald Cronf2911112020-10-29 17:51:10 +01001090 /*
Ryan Everett7ed542e2024-01-17 11:39:09 +00001091 * Get the description of the key in a key slot, and register to read it.
1092 * In the case of a persistent key, this will load the key description
1093 * from persistent memory if not done yet.
1094 * We cannot avoid this loading as without it we don't know if
Ronald Cronf2911112020-10-29 17:51:10 +01001095 * the key is operated by an SE or not and this information is needed by
Ryan Everett7ed542e2024-01-17 11:39:09 +00001096 * the current implementation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001097 status = psa_get_and_lock_key_slot(key, &slot);
1098 if (status != PSA_SUCCESS) {
1099 return status;
1100 }
Gilles Peskine354f7672019-07-12 23:46:38 +02001101
Ryan Everettc053d962024-01-25 17:56:32 +00001102#if defined(MBEDTLS_THREADING_C)
Ryan Everett763971f2024-01-29 17:13:36 +00001103 /* We cannot unlock between setting the state to PENDING_DELETION
1104 * and destroying the key in storage, as otherwise another thread
1105 * could load the key into a new slot and the key will not be
1106 * fully destroyed. */
Ryan Everettc053d962024-01-25 17:56:32 +00001107 PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_lock(
1108 &mbedtls_threading_key_slot_mutex));
1109#endif
Ryan Everett7ed542e2024-01-17 11:39:09 +00001110 /* Set the key slot containing the key description's state to
1111 * PENDING_DELETION. This stops new operations from registering
1112 * to read the slot. Current readers can safely continue to access
1113 * the key within the slot; the last registered reader will
1114 * automatically wipe the slot when they call psa_unregister_read().
1115 * If the key is persistent, we can now delete the copy of the key
1116 * from memory. If the key is opaque, we require the driver to
1117 * deal with the deletion. */
Ryan Everettc053d962024-01-25 17:56:32 +00001118 status = psa_key_slot_state_transition(slot, PSA_SLOT_FULL,
1119 PSA_SLOT_PENDING_DELETION);
1120
1121 if (status != PSA_SUCCESS) {
1122 goto exit;
1123 }
Ronald Cronf2911112020-10-29 17:51:10 +01001124
Gilles Peskine449bd832023-01-11 14:50:10 +01001125 if (PSA_KEY_LIFETIME_IS_READ_ONLY(slot->attr.lifetime)) {
Gilles Peskine6687cd02021-04-21 22:32:05 +02001126 /* Refuse the destruction of a read-only key (which may or may not work
1127 * if we attempt it, depending on whether the key is merely read-only
1128 * by policy or actually physically read-only).
Gilles Peskinef9a046e2021-06-07 23:27:54 +02001129 * Just do the best we can, which is to wipe the copy in memory
1130 * (done in this function's cleanup code). */
1131 overall_status = PSA_ERROR_NOT_PERMITTED;
1132 goto exit;
Gilles Peskine6687cd02021-04-21 22:32:05 +02001133 }
1134
Gilles Peskine354f7672019-07-12 23:46:38 +02001135#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001136 driver = psa_get_se_driver_entry(slot->attr.lifetime);
1137 if (driver != NULL) {
Gilles Peskine60450a42019-07-25 11:32:45 +02001138 /* For a key in a secure element, we need to do three things:
1139 * remove the key file in internal storage, destroy the
1140 * key inside the secure element, and update the driver's
1141 * persistent data. Start a transaction that will encompass these
1142 * three actions. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001143 psa_crypto_prepare_transaction(PSA_CRYPTO_TRANSACTION_DESTROY_KEY);
Gilles Peskine8e338702019-07-30 20:06:31 +02001144 psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
Gilles Peskine449bd832023-01-11 14:50:10 +01001145 psa_crypto_transaction.key.slot = psa_key_slot_get_slot_number(slot);
Gilles Peskine8e338702019-07-30 20:06:31 +02001146 psa_crypto_transaction.key.id = slot->attr.id;
Gilles Peskine449bd832023-01-11 14:50:10 +01001147 status = psa_crypto_save_transaction();
1148 if (status != PSA_SUCCESS) {
1149 (void) psa_crypto_stop_transaction();
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001150 /* We should still try to destroy the key in the secure
1151 * element and the key metadata in storage. This is especially
1152 * important if the error is that the storage is full.
1153 * But how to do it exactly without risking an inconsistent
1154 * state after a reset?
1155 * https://github.com/ARMmbed/mbed-crypto/issues/215
1156 */
1157 overall_status = status;
1158 goto exit;
Gilles Peskinefc762652019-07-22 19:30:34 +02001159 }
1160
Gilles Peskine449bd832023-01-11 14:50:10 +01001161 status = psa_destroy_se_key(driver,
1162 psa_key_slot_get_slot_number(slot));
1163 if (overall_status == PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001164 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001165 }
Gilles Peskinefc762652019-07-22 19:30:34 +02001166 }
Gilles Peskine354f7672019-07-12 23:46:38 +02001167#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1168
Darryl Greend49a4992018-06-18 17:27:26 +01001169#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001170 if (!PSA_KEY_LIFETIME_IS_VOLATILE(slot->attr.lifetime)) {
Ryan Everett4a0ba802024-01-17 14:12:33 +00001171 /* Destroy the copy of the persistent key from storage.
Ryan Everett7ed542e2024-01-17 11:39:09 +00001172 * The slot will still hold a copy of the key until the last reader
1173 * unregisters. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001174 status = psa_destroy_persistent_key(slot->attr.id);
1175 if (overall_status == PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001176 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001177 }
Darryl Greend49a4992018-06-18 17:27:26 +01001178 }
1179#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
Gilles Peskine354f7672019-07-12 23:46:38 +02001180
Gilles Peskinefc762652019-07-22 19:30:34 +02001181#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001182 if (driver != NULL) {
1183 status = psa_save_se_persistent_data(driver);
1184 if (overall_status == PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001185 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001186 }
1187 status = psa_crypto_stop_transaction();
1188 if (overall_status == PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001189 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001190 }
Gilles Peskinefc762652019-07-22 19:30:34 +02001191 }
1192#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1193
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001194exit:
Ryan Everett7ed542e2024-01-17 11:39:09 +00001195 /* Unregister from reading the slot. If we are the last active reader
1196 * then this will wipe the slot. */
1197 status = psa_unregister_read(slot);
1198 /* Prioritize CORRUPTION_DETECTED from unregistering over
1199 * a storage error. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001200 if (status != PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001201 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001202 }
Ryan Everettc053d962024-01-25 17:56:32 +00001203
1204#if defined(MBEDTLS_THREADING_C)
Ryan Everett7fee4f72024-02-09 14:11:27 +00001205 /* Don't overwrite existing errors if the unlock fails. */
1206 status = overall_status;
Ryan Everettc053d962024-01-25 17:56:32 +00001207 PSA_THREADING_CHK_RET(mbedtls_mutex_unlock(
1208 &mbedtls_threading_key_slot_mutex));
1209#endif
1210
Gilles Peskine449bd832023-01-11 14:50:10 +01001211 return overall_status;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001212}
1213
Gilles Peskinebfd322f2019-07-23 11:58:03 +02001214/** Retrieve all the publicly-accessible attributes of a key.
1215 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001216psa_status_t psa_get_key_attributes(mbedtls_svc_key_id_t key,
1217 psa_key_attributes_t *attributes)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001218{
Ronald Cronf95a2b12020-10-22 15:24:49 +02001219 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01001220 psa_key_slot_t *slot;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001221
Gilles Peskine449bd832023-01-11 14:50:10 +01001222 psa_reset_key_attributes(attributes);
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001223
Gilles Peskine449bd832023-01-11 14:50:10 +01001224 status = psa_get_and_lock_key_slot_with_policy(key, &slot, 0, 0);
1225 if (status != PSA_SUCCESS) {
1226 return status;
1227 }
Gilles Peskineb870b182018-07-06 16:02:09 +02001228
Gilles Peskine7fad3ef2024-02-28 01:08:27 +01001229 *attributes = slot->attr;
Gilles Peskinec8000c02019-08-02 20:15:51 +02001230
1231#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001232 if (psa_get_se_driver_entry(slot->attr.lifetime) != NULL) {
1233 psa_set_key_slot_number(attributes,
1234 psa_key_slot_get_slot_number(slot));
1235 }
Gilles Peskinec8000c02019-08-02 20:15:51 +02001236#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskineb699f072019-04-26 16:06:02 +02001237
Gilles Peskine97c0b2f2024-02-16 00:49:46 +01001238 return psa_unregister_read_under_mutex(slot);
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001239}
1240
Gilles Peskinec8000c02019-08-02 20:15:51 +02001241#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1242psa_status_t psa_get_key_slot_number(
1243 const psa_key_attributes_t *attributes,
Gilles Peskine449bd832023-01-11 14:50:10 +01001244 psa_key_slot_number_t *slot_number)
Gilles Peskinec8000c02019-08-02 20:15:51 +02001245{
Gilles Peskine972539c2024-02-28 01:49:45 +01001246 if (attributes->has_slot_number) {
Gilles Peskine2f107ae2024-02-28 01:26:46 +01001247 *slot_number = attributes->slot_number;
Gilles Peskine449bd832023-01-11 14:50:10 +01001248 return PSA_SUCCESS;
1249 } else {
1250 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinec8000c02019-08-02 20:15:51 +02001251 }
Gilles Peskinec8000c02019-08-02 20:15:51 +02001252}
1253#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1254
Gilles Peskine449bd832023-01-11 14:50:10 +01001255static psa_status_t psa_export_key_buffer_internal(const uint8_t *key_buffer,
1256 size_t key_buffer_size,
1257 uint8_t *data,
1258 size_t data_size,
1259 size_t *data_length)
Steven Cooremana01795d2020-07-24 22:48:15 +02001260{
Gilles Peskine449bd832023-01-11 14:50:10 +01001261 if (key_buffer_size > data_size) {
1262 return PSA_ERROR_BUFFER_TOO_SMALL;
1263 }
1264 memcpy(data, key_buffer, key_buffer_size);
1265 memset(data + key_buffer_size, 0,
1266 data_size - key_buffer_size);
Ronald Crond18b5f82020-11-25 16:46:05 +01001267 *data_length = key_buffer_size;
Gilles Peskine449bd832023-01-11 14:50:10 +01001268 return PSA_SUCCESS;
Steven Cooremana01795d2020-07-24 22:48:15 +02001269}
1270
Ronald Cron7285cda2020-11-26 14:46:37 +01001271psa_status_t psa_export_key_internal(
Ronald Crond18b5f82020-11-25 16:46:05 +01001272 const psa_key_attributes_t *attributes,
1273 const uint8_t *key_buffer, size_t key_buffer_size,
Gilles Peskine449bd832023-01-11 14:50:10 +01001274 uint8_t *data, size_t data_size, size_t *data_length)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001275{
Gilles Peskine2f107ae2024-02-28 01:26:46 +01001276 psa_key_type_t type = attributes->type;
Ronald Crond18b5f82020-11-25 16:46:05 +01001277
Gilles Peskine449bd832023-01-11 14:50:10 +01001278 if (key_type_is_raw_bytes(type) ||
1279 PSA_KEY_TYPE_IS_RSA(type) ||
Przemek Stekiel472b3f32022-12-01 14:38:49 +01001280 PSA_KEY_TYPE_IS_ECC(type) ||
1281 PSA_KEY_TYPE_IS_DH(type)) {
Gilles Peskine449bd832023-01-11 14:50:10 +01001282 return psa_export_key_buffer_internal(
1283 key_buffer, key_buffer_size,
1284 data, data_size, data_length);
1285 } else {
Ronald Cron9486f9d2020-11-26 13:36:23 +01001286 /* This shouldn't happen in the reference implementation, but
1287 it is valid for a special-purpose implementation to omit
1288 support for exporting certain key types. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001289 return PSA_ERROR_NOT_SUPPORTED;
Ronald Cron9486f9d2020-11-26 13:36:23 +01001290 }
1291}
1292
Gilles Peskine449bd832023-01-11 14:50:10 +01001293psa_status_t psa_export_key(mbedtls_svc_key_id_t key,
1294 uint8_t *data,
1295 size_t data_size,
1296 size_t *data_length)
Ronald Cron9486f9d2020-11-26 13:36:23 +01001297{
1298 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
1299 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
1300 psa_key_slot_t *slot;
1301
Ronald Crone907e552021-01-18 13:22:38 +01001302 /* Reject a zero-length output buffer now, since this can never be a
1303 * valid key representation. This way we know that data must be a valid
1304 * pointer and we can do things like memset(data, ..., data_size). */
Gilles Peskine449bd832023-01-11 14:50:10 +01001305 if (data_size == 0) {
1306 return PSA_ERROR_BUFFER_TOO_SMALL;
1307 }
Ronald Crone907e552021-01-18 13:22:38 +01001308
Ronald Cron9486f9d2020-11-26 13:36:23 +01001309 /* Set the key to empty now, so that even when there are errors, we always
1310 * set data_length to a value between 0 and data_size. On error, setting
1311 * the key to empty is a good choice because an empty key representation is
1312 * unlikely to be accepted anywhere. */
Jaeden Amerof24c7f82018-06-27 17:20:43 +01001313 *data_length = 0;
1314
Ronald Cron9486f9d2020-11-26 13:36:23 +01001315 /* Export requires the EXPORT flag. There is an exception for public keys,
1316 * which don't require any flag, but
1317 * psa_get_and_lock_key_slot_with_policy() takes care of this.
1318 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001319 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
1320 PSA_KEY_USAGE_EXPORT, 0);
1321 if (status != PSA_SUCCESS) {
1322 return status;
1323 }
mohammad160306e79202018-03-28 13:17:44 +03001324
Gilles Peskine7a5d9202024-02-28 01:18:23 +01001325 status = psa_driver_wrapper_export_key(&slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01001326 slot->key.data, slot->key.bytes,
1327 data, data_size, data_length);
Ronald Cron9486f9d2020-11-26 13:36:23 +01001328
Ryan Everetta103ec92024-01-31 13:59:57 +00001329 unlock_status = psa_unregister_read_under_mutex(slot);
Ronald Cron9486f9d2020-11-26 13:36:23 +01001330
Gilles Peskine449bd832023-01-11 14:50:10 +01001331 return (status == PSA_SUCCESS) ? unlock_status : status;
Ronald Cron9486f9d2020-11-26 13:36:23 +01001332}
1333
Ronald Cron7285cda2020-11-26 14:46:37 +01001334psa_status_t psa_export_public_key_internal(
Ronald Crond18b5f82020-11-25 16:46:05 +01001335 const psa_key_attributes_t *attributes,
1336 const uint8_t *key_buffer,
1337 size_t key_buffer_size,
1338 uint8_t *data,
1339 size_t data_size,
Gilles Peskine449bd832023-01-11 14:50:10 +01001340 size_t *data_length)
Ronald Cron9486f9d2020-11-26 13:36:23 +01001341{
Gilles Peskine2f107ae2024-02-28 01:26:46 +01001342 psa_key_type_t type = attributes->type;
Ronald Crond18b5f82020-11-25 16:46:05 +01001343
Przemek Stekiel6fd72b62023-04-27 10:20:56 +02001344 if (PSA_KEY_TYPE_IS_PUBLIC_KEY(type) &&
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001345 (PSA_KEY_TYPE_IS_RSA(type) || PSA_KEY_TYPE_IS_ECC(type) ||
1346 PSA_KEY_TYPE_IS_DH(type))) {
Przemek Stekiel6fd72b62023-04-27 10:20:56 +02001347 /* Exporting public -> public */
1348 return psa_export_key_buffer_internal(
1349 key_buffer, key_buffer_size,
1350 data, data_size, data_length);
1351 } else if (PSA_KEY_TYPE_IS_RSA(type)) {
Valerio Settib2bcedb2023-07-10 11:24:00 +02001352#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT) || \
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001353 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
1354 return mbedtls_psa_rsa_export_public_key(attributes,
1355 key_buffer,
1356 key_buffer_size,
1357 data,
1358 data_size,
1359 data_length);
Darryl Green9e2d7a02018-07-24 16:33:30 +01001360#else
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001361 /* We don't know how to convert a private RSA key to public. */
1362 return PSA_ERROR_NOT_SUPPORTED;
Valerio Settib2bcedb2023-07-10 11:24:00 +02001363#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT) ||
John Durkop9814fa22020-11-04 12:28:15 -08001364 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Przemek Stekiel6fd72b62023-04-27 10:20:56 +02001365 } else if (PSA_KEY_TYPE_IS_ECC(type)) {
Valerio Setti27c501a2023-06-27 16:58:52 +02001366#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT) || \
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001367 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
1368 return mbedtls_psa_ecp_export_public_key(attributes,
1369 key_buffer,
1370 key_buffer_size,
1371 data,
1372 data_size,
1373 data_length);
Steven Cooreman560c28a2020-07-24 23:20:24 +02001374#else
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001375 /* We don't know how to convert a private ECC key to public */
1376 return PSA_ERROR_NOT_SUPPORTED;
Valerio Setti27c501a2023-06-27 16:58:52 +02001377#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT) ||
John Durkop9814fa22020-11-04 12:28:15 -08001378 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
Przemek Stekiel6fd72b62023-04-27 10:20:56 +02001379 } else if (PSA_KEY_TYPE_IS_DH(type)) {
Valerio Settia55f0422023-07-10 15:34:41 +02001380#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT) || \
Przemek Stekiel6d85afa2023-04-28 11:42:17 +02001381 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY)
Przemek Stekiel152bb462023-06-01 11:52:39 +02001382 return mbedtls_psa_ffdh_export_public_key(attributes,
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001383 key_buffer,
1384 key_buffer_size,
1385 data, data_size,
1386 data_length);
Przemek Stekiel472b3f32022-12-01 14:38:49 +01001387#else
Przemek Stekiel472b3f32022-12-01 14:38:49 +01001388 return PSA_ERROR_NOT_SUPPORTED;
Valerio Settia55f0422023-07-10 15:34:41 +02001389#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT) ||
Przemek Stekiel6d85afa2023-04-28 11:42:17 +02001390 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) */
Gilles Peskine449bd832023-01-11 14:50:10 +01001391 } else {
Przemek Stekiel0b11ee02023-05-16 13:26:06 +02001392 (void) key_buffer;
1393 (void) key_buffer_size;
1394 (void) data;
1395 (void) data_size;
1396 (void) data_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01001397 return PSA_ERROR_NOT_SUPPORTED;
Steven Cooreman560c28a2020-07-24 23:20:24 +02001398 }
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001399}
Ronald Crond18b5f82020-11-25 16:46:05 +01001400
Gilles Peskine449bd832023-01-11 14:50:10 +01001401psa_status_t psa_export_public_key(mbedtls_svc_key_id_t key,
1402 uint8_t *data,
1403 size_t data_size,
1404 size_t *data_length)
Moran Pekerdd4ea382018-04-03 15:30:03 +03001405{
Ronald Cronf95a2b12020-10-22 15:24:49 +02001406 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01001407 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01001408 psa_key_slot_t *slot;
Darryl Greendd8fb772018-11-07 16:00:44 +00001409
Ronald Crone907e552021-01-18 13:22:38 +01001410 /* Reject a zero-length output buffer now, since this can never be a
1411 * valid key representation. This way we know that data must be a valid
1412 * pointer and we can do things like memset(data, ..., data_size). */
Gilles Peskine449bd832023-01-11 14:50:10 +01001413 if (data_size == 0) {
1414 return PSA_ERROR_BUFFER_TOO_SMALL;
1415 }
Ronald Crone907e552021-01-18 13:22:38 +01001416
Darryl Greendd8fb772018-11-07 16:00:44 +00001417 /* Set the key to empty now, so that even when there are errors, we always
1418 * set data_length to a value between 0 and data_size. On error, setting
1419 * the key to empty is a good choice because an empty key representation is
1420 * unlikely to be accepted anywhere. */
1421 *data_length = 0;
1422
1423 /* Exporting a public key doesn't require a usage flag. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001424 status = psa_get_and_lock_key_slot_with_policy(key, &slot, 0, 0);
1425 if (status != PSA_SUCCESS) {
1426 return status;
1427 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02001428
Gilles Peskine449bd832023-01-11 14:50:10 +01001429 if (!PSA_KEY_TYPE_IS_ASYMMETRIC(slot->attr.type)) {
1430 status = PSA_ERROR_INVALID_ARGUMENT;
1431 goto exit;
Ronald Cron9486f9d2020-11-26 13:36:23 +01001432 }
1433
Ronald Cron67227982020-11-26 15:16:05 +01001434 status = psa_driver_wrapper_export_public_key(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01001435 &slot->attr, slot->key.data, slot->key.bytes,
Gilles Peskine449bd832023-01-11 14:50:10 +01001436 data, data_size, data_length);
Ronald Cron9486f9d2020-11-26 13:36:23 +01001437
1438exit:
Ryan Everetta103ec92024-01-31 13:59:57 +00001439 unlock_status = psa_unregister_read_under_mutex(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02001440
Gilles Peskine449bd832023-01-11 14:50:10 +01001441 return (status == PSA_SUCCESS) ? unlock_status : status;
Moran Pekerdd4ea382018-04-03 15:30:03 +03001442}
1443
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001444/** Validate that a key policy is internally well-formed.
1445 *
1446 * This function only rejects invalid policies. It does not validate the
1447 * consistency of the policy with respect to other attributes of the key
1448 * such as the key type.
1449 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001450static psa_status_t psa_validate_key_policy(const psa_key_policy_t *policy)
Gilles Peskine4747d192019-04-17 15:05:45 +02001451{
Gilles Peskine449bd832023-01-11 14:50:10 +01001452 if ((policy->usage & ~(PSA_KEY_USAGE_EXPORT |
1453 PSA_KEY_USAGE_COPY |
1454 PSA_KEY_USAGE_ENCRYPT |
1455 PSA_KEY_USAGE_DECRYPT |
1456 PSA_KEY_USAGE_SIGN_MESSAGE |
1457 PSA_KEY_USAGE_VERIFY_MESSAGE |
1458 PSA_KEY_USAGE_SIGN_HASH |
1459 PSA_KEY_USAGE_VERIFY_HASH |
1460 PSA_KEY_USAGE_VERIFY_DERIVATION |
1461 PSA_KEY_USAGE_DERIVE)) != 0) {
1462 return PSA_ERROR_INVALID_ARGUMENT;
1463 }
Gilles Peskine4747d192019-04-17 15:05:45 +02001464
Gilles Peskine449bd832023-01-11 14:50:10 +01001465 return PSA_SUCCESS;
Gilles Peskine4747d192019-04-17 15:05:45 +02001466}
1467
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001468/** Validate the internal consistency of key attributes.
1469 *
1470 * This function only rejects invalid attribute values. If does not
1471 * validate the consistency of the attributes with any key data that may
1472 * be involved in the creation of the key.
1473 *
1474 * Call this function early in the key creation process.
1475 *
1476 * \param[in] attributes Key attributes for the new key.
1477 * \param[out] p_drv On any return, the driver for the key, if any.
1478 * NULL for a transparent key.
1479 *
1480 */
1481static psa_status_t psa_validate_key_attributes(
1482 const psa_key_attributes_t *attributes,
Gilles Peskine449bd832023-01-11 14:50:10 +01001483 psa_se_drv_table_entry_t **p_drv)
Darryl Green0c6575a2018-11-07 16:05:30 +00001484{
Steven Cooreman81fe7c32020-06-08 18:37:19 +02001485 psa_status_t status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine449bd832023-01-11 14:50:10 +01001486 psa_key_lifetime_t lifetime = psa_get_key_lifetime(attributes);
1487 mbedtls_svc_key_id_t key = psa_get_key_id(attributes);
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001488
Gilles Peskine449bd832023-01-11 14:50:10 +01001489 status = psa_validate_key_location(lifetime, p_drv);
1490 if (status != PSA_SUCCESS) {
1491 return status;
Ronald Crond2ed4812020-07-17 16:11:30 +02001492 }
1493
Gilles Peskine449bd832023-01-11 14:50:10 +01001494 status = psa_validate_key_persistence(lifetime);
1495 if (status != PSA_SUCCESS) {
1496 return status;
1497 }
1498
1499 if (PSA_KEY_LIFETIME_IS_VOLATILE(lifetime)) {
1500 if (MBEDTLS_SVC_KEY_ID_GET_KEY_ID(key) != 0) {
1501 return PSA_ERROR_INVALID_ARGUMENT;
1502 }
1503 } else {
1504 if (!psa_is_valid_key_id(psa_get_key_id(attributes), 0)) {
1505 return PSA_ERROR_INVALID_ARGUMENT;
1506 }
1507 }
1508
Gilles Peskine2f107ae2024-02-28 01:26:46 +01001509 status = psa_validate_key_policy(&attributes->policy);
Gilles Peskine449bd832023-01-11 14:50:10 +01001510 if (status != PSA_SUCCESS) {
1511 return status;
1512 }
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001513
1514 /* Refuse to create overly large keys.
1515 * Note that this doesn't trigger on import if the attributes don't
1516 * explicitly specify a size (so psa_get_key_bits returns 0), so
1517 * psa_import_key() needs its own checks. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001518 if (psa_get_key_bits(attributes) > PSA_MAX_KEY_BITS) {
1519 return PSA_ERROR_NOT_SUPPORTED;
1520 }
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001521
Gilles Peskine449bd832023-01-11 14:50:10 +01001522 return PSA_SUCCESS;
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001523}
1524
Gilles Peskine4747d192019-04-17 15:05:45 +02001525/** Prepare a key slot to receive key material.
1526 *
1527 * This function allocates a key slot and sets its metadata.
1528 *
1529 * If this function fails, call psa_fail_key_creation().
1530 *
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001531 * This function is intended to be used as follows:
1532 * -# Call psa_start_key_creation() to allocate a key slot, prepare
Ronald Croncf56a0a2020-08-04 09:51:30 +02001533 * it with the specified attributes, and in case of a volatile key assign it
1534 * a volatile key identifier.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001535 * -# Populate the slot with the key material.
1536 * -# Call psa_finish_key_creation() to finalize the creation of the slot.
1537 * In case of failure at any step, stop the sequence and call
1538 * psa_fail_key_creation().
1539 *
Ryan Everettb69118e2024-01-02 15:54:32 +00001540 * On success, the key slot's state is PSA_SLOT_FILLING.
1541 * It is the responsibility of the caller to change the slot's state to
1542 * PSA_SLOT_EMPTY/FULL once key creation has finished.
Ronald Cronf95a2b12020-10-22 15:24:49 +02001543 *
Gilles Peskinedf179142019-07-15 22:02:14 +02001544 * \param method An identification of the calling function.
Gilles Peskine011e4282019-06-26 18:34:38 +02001545 * \param[in] attributes Key attributes for the new key.
Gilles Peskine011e4282019-06-26 18:34:38 +02001546 * \param[out] p_slot On success, a pointer to the prepared slot.
1547 * \param[out] p_drv On any return, the driver for the key, if any.
1548 * NULL for a transparent key.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001549 *
1550 * \retval #PSA_SUCCESS
1551 * The key slot is ready to receive key material.
1552 * \return If this function fails, the key slot is an invalid state.
1553 * You must call psa_fail_key_creation() to wipe and free the slot.
Gilles Peskine4747d192019-04-17 15:05:45 +02001554 */
1555static psa_status_t psa_start_key_creation(
Gilles Peskinedf179142019-07-15 22:02:14 +02001556 psa_key_creation_method_t method,
Gilles Peskine4747d192019-04-17 15:05:45 +02001557 const psa_key_attributes_t *attributes,
Gilles Peskine011e4282019-06-26 18:34:38 +02001558 psa_key_slot_t **p_slot,
Gilles Peskine449bd832023-01-11 14:50:10 +01001559 psa_se_drv_table_entry_t **p_drv)
Gilles Peskine4747d192019-04-17 15:05:45 +02001560{
1561 psa_status_t status;
Ronald Cron2a993152020-07-17 14:13:26 +02001562 psa_key_id_t volatile_key_id;
Gilles Peskine4747d192019-04-17 15:05:45 +02001563 psa_key_slot_t *slot;
1564
Gilles Peskinedf179142019-07-15 22:02:14 +02001565 (void) method;
Gilles Peskine011e4282019-06-26 18:34:38 +02001566 *p_drv = NULL;
1567
Gilles Peskine449bd832023-01-11 14:50:10 +01001568 status = psa_validate_key_attributes(attributes, p_drv);
1569 if (status != PSA_SUCCESS) {
1570 return status;
1571 }
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001572
Ryan Everett3d8118d2024-01-30 16:58:47 +00001573#if defined(MBEDTLS_THREADING_C)
1574 PSA_THREADING_CHK_RET(mbedtls_mutex_lock(
1575 &mbedtls_threading_key_slot_mutex));
1576#endif
Ryan Everettb69118e2024-01-02 15:54:32 +00001577 status = psa_reserve_free_key_slot(&volatile_key_id, p_slot);
Ryan Everett3d8118d2024-01-30 16:58:47 +00001578#if defined(MBEDTLS_THREADING_C)
1579 PSA_THREADING_CHK_RET(mbedtls_mutex_unlock(
1580 &mbedtls_threading_key_slot_mutex));
1581#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01001582 if (status != PSA_SUCCESS) {
1583 return status;
1584 }
Gilles Peskine4747d192019-04-17 15:05:45 +02001585 slot = *p_slot;
1586
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001587 /* We're storing the declared bit-size of the key. It's up to each
1588 * creation mechanism to verify that this information is correct.
1589 * It's automatically correct for mechanisms that use the bit-size as
Gilles Peskineb46bef22019-07-30 21:32:04 +02001590 * an input (generate, device) but not for those where the bit-size
Ronald Cronc4d1b512020-07-31 11:26:37 +02001591 * is optional (import, copy). In case of a volatile key, assign it the
1592 * volatile key identifier associated to the slot returned to contain its
1593 * definition. */
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001594
Gilles Peskine7fad3ef2024-02-28 01:08:27 +01001595 slot->attr = *attributes;
Gilles Peskine449bd832023-01-11 14:50:10 +01001596 if (PSA_KEY_LIFETIME_IS_VOLATILE(slot->attr.lifetime)) {
Ronald Cronc4d1b512020-07-31 11:26:37 +02001597#if !defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER)
1598 slot->attr.id = volatile_key_id;
1599#else
1600 slot->attr.id.key_id = volatile_key_id;
1601#endif
1602 }
Gilles Peskinec744d992019-07-30 17:26:54 +02001603
Gilles Peskinecbaff462019-07-12 23:46:04 +02001604#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined7729582019-08-05 15:55:54 +02001605 /* For a key in a secure element, we need to do three things
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001606 * when creating or registering a persistent key:
Gilles Peskine60450a42019-07-25 11:32:45 +02001607 * create the key file in internal storage, create the
1608 * key inside the secure element, and update the driver's
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001609 * persistent data. This is done by starting a transaction that will
1610 * encompass these three actions.
1611 * For registering a volatile key, we just need to find an appropriate
1612 * slot number inside the SE. Since the key is designated volatile, creating
1613 * a transaction is not required. */
Gilles Peskine60450a42019-07-25 11:32:45 +02001614 /* The first thing to do is to find a slot number for the new key.
1615 * We save the slot number in persistent storage as part of the
1616 * transaction data. It will be needed to recover if the power
1617 * fails during the key creation process, to clean up on the secure
1618 * element side after restarting. Obtaining a slot number from the
1619 * secure element driver updates its persistent state, but we do not yet
1620 * save the driver's persistent state, so that if the power fails,
Gilles Peskinefc762652019-07-22 19:30:34 +02001621 * we can roll back to a state where the key doesn't exist. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001622 if (*p_drv != NULL) {
Ronald Cronea0f8a62020-11-25 17:52:23 +01001623 psa_key_slot_number_t slot_number;
Gilles Peskine449bd832023-01-11 14:50:10 +01001624 status = psa_find_se_slot_for_key(attributes, method, *p_drv,
1625 &slot_number);
1626 if (status != PSA_SUCCESS) {
1627 return status;
1628 }
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001629
Gilles Peskine2f107ae2024-02-28 01:26:46 +01001630 if (!PSA_KEY_LIFETIME_IS_VOLATILE(attributes->lifetime)) {
Gilles Peskine449bd832023-01-11 14:50:10 +01001631 psa_crypto_prepare_transaction(PSA_CRYPTO_TRANSACTION_CREATE_KEY);
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001632 psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
Ronald Cronea0f8a62020-11-25 17:52:23 +01001633 psa_crypto_transaction.key.slot = slot_number;
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001634 psa_crypto_transaction.key.id = slot->attr.id;
Gilles Peskine449bd832023-01-11 14:50:10 +01001635 status = psa_crypto_save_transaction();
1636 if (status != PSA_SUCCESS) {
1637 (void) psa_crypto_stop_transaction();
1638 return status;
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001639 }
Gilles Peskine66be51c2019-07-25 18:02:52 +02001640 }
Ronald Cronea0f8a62020-11-25 17:52:23 +01001641
1642 status = psa_copy_key_material_into_slot(
Gilles Peskine449bd832023-01-11 14:50:10 +01001643 slot, (uint8_t *) (&slot_number), sizeof(slot_number));
Darryl Green0c6575a2018-11-07 16:05:30 +00001644 }
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001645
Gilles Peskine449bd832023-01-11 14:50:10 +01001646 if (*p_drv == NULL && method == PSA_KEY_CREATION_REGISTER) {
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001647 /* Key registration only makes sense with a secure element. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001648 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001649 }
Gilles Peskinecbaff462019-07-12 23:46:04 +02001650#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1651
Gilles Peskine449bd832023-01-11 14:50:10 +01001652 return PSA_SUCCESS;
Darryl Green0c6575a2018-11-07 16:05:30 +00001653}
Gilles Peskine4747d192019-04-17 15:05:45 +02001654
1655/** Finalize the creation of a key once its key material has been set.
1656 *
1657 * This entails writing the key to persistent storage.
1658 *
1659 * If this function fails, call psa_fail_key_creation().
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001660 * See the documentation of psa_start_key_creation() for the intended use
1661 * of this function.
Gilles Peskine4747d192019-04-17 15:05:45 +02001662 *
Ryan Everettb69118e2024-01-02 15:54:32 +00001663 * If the finalization succeeds, the function sets the key slot's state to
1664 * PSA_SLOT_FULL, and the key slot can no longer be accessed as part of the
1665 * key creation process.
Ronald Cron50972942020-11-14 11:28:25 +01001666 *
Gilles Peskine011e4282019-06-26 18:34:38 +02001667 * \param[in,out] slot Pointer to the slot with key material.
1668 * \param[in] driver The secure element driver for the key,
1669 * or NULL for a transparent key.
Ronald Cron81709fc2020-11-14 12:10:32 +01001670 * \param[out] key On success, identifier of the key. Note that the
1671 * key identifier is also stored in the key slot.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001672 *
1673 * \retval #PSA_SUCCESS
Ronald Croncf56a0a2020-08-04 09:51:30 +02001674 * The key was successfully created.
Gilles Peskineed733552023-02-14 19:21:09 +01001675 * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription
1676 * \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription
1677 * \retval #PSA_ERROR_ALREADY_EXISTS \emptydescription
1678 * \retval #PSA_ERROR_DATA_INVALID \emptydescription
1679 * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription
1680 * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription
gabor-mezei-arm452b0a32020-11-09 17:42:55 +01001681 *
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001682 * \return If this function fails, the key slot is an invalid state.
1683 * You must call psa_fail_key_creation() to wipe and free the slot.
Gilles Peskine4747d192019-04-17 15:05:45 +02001684 */
Gilles Peskine011e4282019-06-26 18:34:38 +02001685static psa_status_t psa_finish_key_creation(
1686 psa_key_slot_t *slot,
Ronald Cron81709fc2020-11-14 12:10:32 +01001687 psa_se_drv_table_entry_t *driver,
1688 mbedtls_svc_key_id_t *key)
Gilles Peskine4747d192019-04-17 15:05:45 +02001689{
1690 psa_status_t status = PSA_SUCCESS;
Gilles Peskine30afafd2019-04-25 13:47:40 +02001691 (void) slot;
Gilles Peskine011e4282019-06-26 18:34:38 +02001692 (void) driver;
Gilles Peskine4747d192019-04-17 15:05:45 +02001693
Ryan Everett91ffe5b2024-01-23 20:05:42 +00001694#if defined(MBEDTLS_THREADING_C)
1695 PSA_THREADING_CHK_RET(mbedtls_mutex_lock(
1696 &mbedtls_threading_key_slot_mutex));
1697#endif
1698
Gilles Peskine4747d192019-04-17 15:05:45 +02001699#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001700 if (!PSA_KEY_LIFETIME_IS_VOLATILE(slot->attr.lifetime)) {
Gilles Peskine1df83d42019-07-23 16:13:14 +02001701#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001702 if (driver != NULL) {
Gilles Peskineb46bef22019-07-30 21:32:04 +02001703 psa_se_key_data_storage_t data;
Ronald Cronea0f8a62020-11-25 17:52:23 +01001704 psa_key_slot_number_t slot_number =
Gilles Peskine449bd832023-01-11 14:50:10 +01001705 psa_key_slot_get_slot_number(slot);
Ronald Cronea0f8a62020-11-25 17:52:23 +01001706
Tom Cosgrove6ef9bb32023-03-08 14:19:51 +00001707 MBEDTLS_STATIC_ASSERT(sizeof(slot_number) ==
1708 sizeof(data.slot_number),
1709 "Slot number size does not match psa_se_key_data_storage_t");
1710
Gilles Peskine449bd832023-01-11 14:50:10 +01001711 memcpy(&data.slot_number, &slot_number, sizeof(slot_number));
1712 status = psa_save_persistent_key(&slot->attr,
1713 (uint8_t *) &data,
1714 sizeof(data));
1715 } else
Gilles Peskine1df83d42019-07-23 16:13:14 +02001716#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1717 {
Steven Cooreman40120f62020-10-29 11:42:22 +01001718 /* Key material is saved in export representation in the slot, so
1719 * just pass the slot buffer for storage. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001720 status = psa_save_persistent_key(&slot->attr,
1721 slot->key.data,
1722 slot->key.bytes);
Gilles Peskine1df83d42019-07-23 16:13:14 +02001723 }
Gilles Peskine4747d192019-04-17 15:05:45 +02001724 }
Darryl Green0c6575a2018-11-07 16:05:30 +00001725#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
1726
Gilles Peskinecbaff462019-07-12 23:46:04 +02001727#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined7729582019-08-05 15:55:54 +02001728 /* Finish the transaction for a key creation. This does not
1729 * happen when registering an existing key. Detect this case
1730 * by checking whether a transaction is in progress (actual
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001731 * creation of a persistent key in a secure element requires a transaction,
1732 * but registration or volatile key creation doesn't use one). */
Gilles Peskine449bd832023-01-11 14:50:10 +01001733 if (driver != NULL &&
1734 psa_crypto_transaction.unknown.type == PSA_CRYPTO_TRANSACTION_CREATE_KEY) {
1735 status = psa_save_se_persistent_data(driver);
1736 if (status != PSA_SUCCESS) {
1737 psa_destroy_persistent_key(slot->attr.id);
Ryan Everett91ffe5b2024-01-23 20:05:42 +00001738
1739#if defined(MBEDTLS_THREADING_C)
1740 PSA_THREADING_CHK_RET(mbedtls_mutex_unlock(
1741 &mbedtls_threading_key_slot_mutex));
1742#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01001743 return status;
Gilles Peskinecbaff462019-07-12 23:46:04 +02001744 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001745 status = psa_crypto_stop_transaction();
Gilles Peskinecbaff462019-07-12 23:46:04 +02001746 }
1747#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1748
Gilles Peskine449bd832023-01-11 14:50:10 +01001749 if (status == PSA_SUCCESS) {
Ronald Cron81709fc2020-11-14 12:10:32 +01001750 *key = slot->attr.id;
Ryan Everettb69118e2024-01-02 15:54:32 +00001751 status = psa_key_slot_state_transition(slot, PSA_SLOT_FILLING,
1752 PSA_SLOT_FULL);
Gilles Peskine449bd832023-01-11 14:50:10 +01001753 if (status != PSA_SUCCESS) {
Ronald Cron81709fc2020-11-14 12:10:32 +01001754 *key = MBEDTLS_SVC_KEY_ID_INIT;
Gilles Peskine449bd832023-01-11 14:50:10 +01001755 }
Ronald Cron81709fc2020-11-14 12:10:32 +01001756 }
Ronald Cron50972942020-11-14 11:28:25 +01001757
Ryan Everett91ffe5b2024-01-23 20:05:42 +00001758#if defined(MBEDTLS_THREADING_C)
1759 PSA_THREADING_CHK_RET(mbedtls_mutex_unlock(
1760 &mbedtls_threading_key_slot_mutex));
1761#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01001762 return status;
Gilles Peskine4747d192019-04-17 15:05:45 +02001763}
1764
1765/** Abort the creation of a key.
1766 *
1767 * You may call this function after calling psa_start_key_creation(),
1768 * or after psa_finish_key_creation() fails. In other circumstances, this
1769 * function may not clean up persistent storage.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001770 * See the documentation of psa_start_key_creation() for the intended use
Ryan Everettb69118e2024-01-02 15:54:32 +00001771 * of this function. Sets the slot's state to PSA_SLOT_EMPTY.
Gilles Peskine4747d192019-04-17 15:05:45 +02001772 *
Gilles Peskine011e4282019-06-26 18:34:38 +02001773 * \param[in,out] slot Pointer to the slot with key material.
1774 * \param[in] driver The secure element driver for the key,
1775 * or NULL for a transparent key.
Gilles Peskine4747d192019-04-17 15:05:45 +02001776 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001777static void psa_fail_key_creation(psa_key_slot_t *slot,
1778 psa_se_drv_table_entry_t *driver)
Gilles Peskine4747d192019-04-17 15:05:45 +02001779{
Gilles Peskine011e4282019-06-26 18:34:38 +02001780 (void) driver;
1781
Gilles Peskine449bd832023-01-11 14:50:10 +01001782 if (slot == NULL) {
Gilles Peskine4747d192019-04-17 15:05:45 +02001783 return;
Gilles Peskine449bd832023-01-11 14:50:10 +01001784 }
Gilles Peskine011e4282019-06-26 18:34:38 +02001785
Ryan Everettb7101442024-01-23 20:09:49 +00001786#if defined(MBEDTLS_THREADING_C)
Ryan Everett73feaf22024-02-14 11:36:41 +00001787 /* If the lock operation fails we still wipe the slot.
1788 * Operations will no longer work after a failed lock,
1789 * but we still need to wipe the slot of confidential data. */
Ryan Everettb7101442024-01-23 20:09:49 +00001790 mbedtls_mutex_lock(&mbedtls_threading_key_slot_mutex);
1791#endif
1792
Gilles Peskine011e4282019-06-26 18:34:38 +02001793#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Janos Follath1d57a202019-08-13 12:15:34 +01001794 /* TODO: If the key has already been created in the secure
Gilles Peskine011e4282019-06-26 18:34:38 +02001795 * element, and the failure happened later (when saving metadata
1796 * to internal storage), we need to destroy the key in the secure
Gilles Peskinec9d7f942019-08-13 16:17:16 +02001797 * element.
1798 * https://github.com/ARMmbed/mbed-crypto/issues/217
1799 */
Gilles Peskinefc762652019-07-22 19:30:34 +02001800
Gilles Peskined7729582019-08-05 15:55:54 +02001801 /* Abort the ongoing transaction if any (there may not be one if
1802 * the creation process failed before starting one, or if the
1803 * key creation is a registration of a key in a secure element).
1804 * Earlier functions must already have done what it takes to undo any
1805 * partial creation. All that's left is to update the transaction data
1806 * itself. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001807 (void) psa_crypto_stop_transaction();
Gilles Peskine011e4282019-06-26 18:34:38 +02001808#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1809
Gilles Peskine449bd832023-01-11 14:50:10 +01001810 psa_wipe_key_slot(slot);
Ryan Everettb7101442024-01-23 20:09:49 +00001811
1812#if defined(MBEDTLS_THREADING_C)
1813 mbedtls_mutex_unlock(&mbedtls_threading_key_slot_mutex);
1814#endif
Gilles Peskine4747d192019-04-17 15:05:45 +02001815}
1816
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001817/** Validate optional attributes during key creation.
1818 *
1819 * Some key attributes are optional during key creation. If they are
1820 * specified in the attributes structure, check that they are consistent
1821 * with the data in the slot.
1822 *
1823 * This function should be called near the end of key creation, after
1824 * the slot in memory is fully populated but before saving persistent data.
1825 */
1826static psa_status_t psa_validate_optional_attributes(
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001827 const psa_key_slot_t *slot,
Gilles Peskine449bd832023-01-11 14:50:10 +01001828 const psa_key_attributes_t *attributes)
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001829{
Gilles Peskine2f107ae2024-02-28 01:26:46 +01001830 if (attributes->type != 0) {
1831 if (attributes->type != slot->attr.type) {
Gilles Peskine449bd832023-01-11 14:50:10 +01001832 return PSA_ERROR_INVALID_ARGUMENT;
1833 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001834 }
1835
Gilles Peskine2f107ae2024-02-28 01:26:46 +01001836 if (attributes->bits != 0) {
1837 if (attributes->bits != slot->attr.bits) {
Gilles Peskine449bd832023-01-11 14:50:10 +01001838 return PSA_ERROR_INVALID_ARGUMENT;
1839 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001840 }
1841
Gilles Peskine449bd832023-01-11 14:50:10 +01001842 return PSA_SUCCESS;
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001843}
1844
Gilles Peskine449bd832023-01-11 14:50:10 +01001845psa_status_t psa_import_key(const psa_key_attributes_t *attributes,
1846 const uint8_t *data,
1847 size_t data_length,
1848 mbedtls_svc_key_id_t *key)
Gilles Peskine4747d192019-04-17 15:05:45 +02001849{
1850 psa_status_t status;
1851 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02001852 psa_se_drv_table_entry_t *driver = NULL;
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01001853 size_t bits;
Archanad8a83dc2021-06-14 10:04:16 +05301854 size_t storage_size = data_length;
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001855
Ronald Cron81709fc2020-11-14 12:10:32 +01001856 *key = MBEDTLS_SVC_KEY_ID_INIT;
1857
Gilles Peskine0f84d622019-09-12 19:03:13 +02001858 /* Reject zero-length symmetric keys (including raw data key objects).
1859 * This also rejects any key which might be encoded as an empty string,
1860 * which is never valid. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001861 if (data_length == 0) {
1862 return PSA_ERROR_INVALID_ARGUMENT;
1863 }
Gilles Peskine0f84d622019-09-12 19:03:13 +02001864
Archana449608b2021-09-08 15:36:05 +05301865 /* Ensure that the bytes-to-bits conversion cannot overflow. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001866 if (data_length > SIZE_MAX / 8) {
1867 return PSA_ERROR_NOT_SUPPORTED;
1868 }
Archana6ed4bda2021-08-04 10:47:15 +05301869
Gilles Peskine449bd832023-01-11 14:50:10 +01001870 status = psa_start_key_creation(PSA_KEY_CREATION_IMPORT, attributes,
1871 &slot, &driver);
1872 if (status != PSA_SUCCESS) {
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001873 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001874 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001875
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01001876 /* In the case of a transparent key or an opaque key stored in local
Archana449608b2021-09-08 15:36:05 +05301877 * storage ( thus not in the case of importing a key in a secure element
1878 * with storage ( MBEDTLS_PSA_CRYPTO_SE_C ) ),we have to allocate a
1879 * buffer to hold the imported key material. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001880 if (slot->key.data == NULL) {
Gilles Peskine2f107ae2024-02-28 01:26:46 +01001881 if (psa_key_lifetime_is_external(attributes->lifetime)) {
Archana449608b2021-09-08 15:36:05 +05301882 status = psa_driver_wrapper_get_key_buffer_size_from_key_data(
Gilles Peskine449bd832023-01-11 14:50:10 +01001883 attributes, data, data_length, &storage_size);
1884 if (status != PSA_SUCCESS) {
Archanad8a83dc2021-06-14 10:04:16 +05301885 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001886 }
Archanad8a83dc2021-06-14 10:04:16 +05301887 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001888 status = psa_allocate_buffer_to_slot(slot, storage_size);
1889 if (status != PSA_SUCCESS) {
Gilles Peskineb46bef22019-07-30 21:32:04 +02001890 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001891 }
Gilles Peskine5d309672019-07-12 23:47:28 +02001892 }
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01001893
1894 bits = slot->attr.bits;
Gilles Peskine449bd832023-01-11 14:50:10 +01001895 status = psa_driver_wrapper_import_key(attributes,
1896 data, data_length,
1897 slot->key.data,
1898 slot->key.bytes,
1899 &slot->key.bytes, &bits);
1900 if (status != PSA_SUCCESS) {
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01001901 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001902 }
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01001903
Gilles Peskine449bd832023-01-11 14:50:10 +01001904 if (slot->attr.bits == 0) {
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01001905 slot->attr.bits = (psa_key_bits_t) bits;
Gilles Peskine449bd832023-01-11 14:50:10 +01001906 } else if (bits != slot->attr.bits) {
Steven Cooremanac3434f2021-01-15 17:36:02 +01001907 status = PSA_ERROR_INVALID_ARGUMENT;
1908 goto exit;
Gilles Peskine5d309672019-07-12 23:47:28 +02001909 }
Ronald Cron2ebfdcc2020-11-28 15:54:54 +01001910
Archana6ed4bda2021-08-04 10:47:15 +05301911 /* Enforce a size limit, and in particular ensure that the bit
1912 * size fits in its representation type.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01001913 if (bits > PSA_MAX_KEY_BITS) {
Archana6ed4bda2021-08-04 10:47:15 +05301914 status = PSA_ERROR_NOT_SUPPORTED;
1915 goto exit;
1916 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001917 status = psa_validate_optional_attributes(slot, attributes);
1918 if (status != PSA_SUCCESS) {
Gilles Peskine18017402019-07-24 20:25:59 +02001919 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001920 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001921
Gilles Peskine449bd832023-01-11 14:50:10 +01001922 status = psa_finish_key_creation(slot, driver, key);
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001923exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001924 if (status != PSA_SUCCESS) {
1925 psa_fail_key_creation(slot, driver);
1926 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02001927
Gilles Peskine449bd832023-01-11 14:50:10 +01001928 return status;
Gilles Peskine4747d192019-04-17 15:05:45 +02001929}
1930
Gilles Peskined7729582019-08-05 15:55:54 +02001931#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1932psa_status_t mbedtls_psa_register_se_key(
Gilles Peskine449bd832023-01-11 14:50:10 +01001933 const psa_key_attributes_t *attributes)
Gilles Peskined7729582019-08-05 15:55:54 +02001934{
1935 psa_status_t status;
1936 psa_key_slot_t *slot = NULL;
1937 psa_se_drv_table_entry_t *driver = NULL;
Ronald Croncf56a0a2020-08-04 09:51:30 +02001938 mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT;
Gilles Peskined7729582019-08-05 15:55:54 +02001939
1940 /* Leaving attributes unspecified is not currently supported.
1941 * It could make sense to query the key type and size from the
1942 * secure element, but not all secure elements support this
1943 * and the driver HAL doesn't currently support it. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001944 if (psa_get_key_type(attributes) == PSA_KEY_TYPE_NONE) {
1945 return PSA_ERROR_NOT_SUPPORTED;
1946 }
1947 if (psa_get_key_bits(attributes) == 0) {
1948 return PSA_ERROR_NOT_SUPPORTED;
1949 }
Gilles Peskined7729582019-08-05 15:55:54 +02001950
Gilles Peskine449bd832023-01-11 14:50:10 +01001951 status = psa_start_key_creation(PSA_KEY_CREATION_REGISTER, attributes,
1952 &slot, &driver);
1953 if (status != PSA_SUCCESS) {
Gilles Peskined7729582019-08-05 15:55:54 +02001954 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001955 }
Gilles Peskined7729582019-08-05 15:55:54 +02001956
Gilles Peskine449bd832023-01-11 14:50:10 +01001957 status = psa_finish_key_creation(slot, driver, &key);
Gilles Peskined7729582019-08-05 15:55:54 +02001958
1959exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001960 if (status != PSA_SUCCESS) {
1961 psa_fail_key_creation(slot, driver);
1962 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02001963
Gilles Peskined7729582019-08-05 15:55:54 +02001964 /* Registration doesn't keep the key in RAM. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001965 psa_close_key(key);
1966 return status;
Gilles Peskined7729582019-08-05 15:55:54 +02001967}
1968#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1969
Gilles Peskine449bd832023-01-11 14:50:10 +01001970psa_status_t psa_copy_key(mbedtls_svc_key_id_t source_key,
1971 const psa_key_attributes_t *specified_attributes,
1972 mbedtls_svc_key_id_t *target_key)
Gilles Peskinef603c712019-01-19 13:40:11 +01001973{
Ronald Cronf95a2b12020-10-22 15:24:49 +02001974 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01001975 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinef603c712019-01-19 13:40:11 +01001976 psa_key_slot_t *source_slot = NULL;
1977 psa_key_slot_t *target_slot = NULL;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001978 psa_key_attributes_t actual_attributes = *specified_attributes;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02001979 psa_se_drv_table_entry_t *driver = NULL;
Archana8a180362021-07-05 02:18:48 +05301980 size_t storage_size = 0;
Gilles Peskinef603c712019-01-19 13:40:11 +01001981
Ronald Cron81709fc2020-11-14 12:10:32 +01001982 *target_key = MBEDTLS_SVC_KEY_ID_INIT;
1983
Archana8a180362021-07-05 02:18:48 +05301984 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01001985 source_key, &source_slot, PSA_KEY_USAGE_COPY, 0);
1986 if (status != PSA_SUCCESS) {
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001987 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001988 }
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001989
Gilles Peskine449bd832023-01-11 14:50:10 +01001990 status = psa_validate_optional_attributes(source_slot,
1991 specified_attributes);
1992 if (status != PSA_SUCCESS) {
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001993 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001994 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001995
Archana9d17bf42021-09-10 06:22:44 +05301996 /* The target key type and number of bits have been validated by
1997 * psa_validate_optional_attributes() to be either equal to zero or
1998 * equal to the ones of the source key. So it is safe to inherit
1999 * them from the source key now."
Archana374fe5b2021-09-08 15:50:28 +05302000 * */
Gilles Peskine2f107ae2024-02-28 01:26:46 +01002001 actual_attributes.bits = source_slot->attr.bits;
2002 actual_attributes.type = source_slot->attr.type;
Archana374fe5b2021-09-08 15:50:28 +05302003
2004
Gilles Peskine449bd832023-01-11 14:50:10 +01002005 status = psa_restrict_key_policy(source_slot->attr.type,
Gilles Peskine2f107ae2024-02-28 01:26:46 +01002006 &actual_attributes.policy,
Gilles Peskine449bd832023-01-11 14:50:10 +01002007 &source_slot->attr.policy);
2008 if (status != PSA_SUCCESS) {
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002009 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002010 }
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002011
Gilles Peskine449bd832023-01-11 14:50:10 +01002012 status = psa_start_key_creation(PSA_KEY_CREATION_COPY, &actual_attributes,
2013 &target_slot, &driver);
2014 if (status != PSA_SUCCESS) {
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002015 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002016 }
2017 if (PSA_KEY_LIFETIME_GET_LOCATION(target_slot->attr.lifetime) !=
2018 PSA_KEY_LIFETIME_GET_LOCATION(source_slot->attr.lifetime)) {
Archana8a180362021-07-05 02:18:48 +05302019 /*
Archana9d17bf42021-09-10 06:22:44 +05302020 * If the source and target keys are stored in different locations,
Archana8a180362021-07-05 02:18:48 +05302021 * the source key would need to be exported as plaintext and re-imported
2022 * in the other location. This has security implications which have not
Archana449608b2021-09-08 15:36:05 +05302023 * been fully mapped. For now, this can be achieved through
Archana8a180362021-07-05 02:18:48 +05302024 * appropriate API invocations from the application, if needed.
2025 * */
Gilles Peskinef4ee6622019-07-24 13:44:30 +02002026 status = PSA_ERROR_NOT_SUPPORTED;
2027 goto exit;
Gilles Peskinef603c712019-01-19 13:40:11 +01002028 }
Archana8a180362021-07-05 02:18:48 +05302029 /*
2030 * When the source and target keys are within the same location,
Archana449608b2021-09-08 15:36:05 +05302031 * - For transparent keys it is a blind copy without any driver invocation,
Archana8a180362021-07-05 02:18:48 +05302032 * - For opaque keys this translates to an invocation of the drivers'
2033 * copy_key entry point through the dispatch layer.
2034 * */
Gilles Peskine2f107ae2024-02-28 01:26:46 +01002035 if (psa_key_lifetime_is_external(actual_attributes.lifetime)) {
Gilles Peskine449bd832023-01-11 14:50:10 +01002036 status = psa_driver_wrapper_get_key_buffer_size(&actual_attributes,
2037 &storage_size);
2038 if (status != PSA_SUCCESS) {
Archana8a180362021-07-05 02:18:48 +05302039 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002040 }
Archana374fe5b2021-09-08 15:50:28 +05302041
Gilles Peskine449bd832023-01-11 14:50:10 +01002042 status = psa_allocate_buffer_to_slot(target_slot, storage_size);
2043 if (status != PSA_SUCCESS) {
Archana8a180362021-07-05 02:18:48 +05302044 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002045 }
Archana374fe5b2021-09-08 15:50:28 +05302046
Gilles Peskine449bd832023-01-11 14:50:10 +01002047 status = psa_driver_wrapper_copy_key(&actual_attributes,
2048 source_slot->key.data,
2049 source_slot->key.bytes,
2050 target_slot->key.data,
2051 target_slot->key.bytes,
2052 &target_slot->key.bytes);
2053 if (status != PSA_SUCCESS) {
Archana8a180362021-07-05 02:18:48 +05302054 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002055 }
2056 } else {
2057 status = psa_copy_key_material_into_slot(target_slot,
Archana9d17bf42021-09-10 06:22:44 +05302058 source_slot->key.data,
Gilles Peskine449bd832023-01-11 14:50:10 +01002059 source_slot->key.bytes);
2060 if (status != PSA_SUCCESS) {
Archana8a180362021-07-05 02:18:48 +05302061 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002062 }
Archana8a180362021-07-05 02:18:48 +05302063 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002064 status = psa_finish_key_creation(target_slot, driver, target_key);
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002065exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002066 if (status != PSA_SUCCESS) {
2067 psa_fail_key_creation(target_slot, driver);
2068 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02002069
Ryan Everetta103ec92024-01-31 13:59:57 +00002070 unlock_status = psa_unregister_read_under_mutex(source_slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02002071
Gilles Peskine449bd832023-01-11 14:50:10 +01002072 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskinef603c712019-01-19 13:40:11 +01002073}
2074
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02002075
2076
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01002077/****************************************************************/
Gilles Peskine20035e32018-02-03 22:44:14 +01002078/* Message digests */
2079/****************************************************************/
2080
Gilles Peskine449bd832023-01-11 14:50:10 +01002081psa_status_t psa_hash_abort(psa_hash_operation_t *operation)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002082{
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002083 /* Aborting a non-active operation is allowed */
Gilles Peskine449bd832023-01-11 14:50:10 +01002084 if (operation->id == 0) {
2085 return PSA_SUCCESS;
2086 }
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002087
Gilles Peskine449bd832023-01-11 14:50:10 +01002088 psa_status_t status = psa_driver_wrapper_hash_abort(operation);
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002089 operation->id = 0;
2090
Gilles Peskine449bd832023-01-11 14:50:10 +01002091 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002092}
2093
Gilles Peskine449bd832023-01-11 14:50:10 +01002094psa_status_t psa_hash_setup(psa_hash_operation_t *operation,
2095 psa_algorithm_t alg)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002096{
Dave Rodgman685b6a72021-06-24 11:49:14 +01002097 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002098
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002099 /* A context must be freshly initialized before it can be set up. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002100 if (operation->id != 0) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002101 status = PSA_ERROR_BAD_STATE;
2102 goto exit;
2103 }
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002104
Gilles Peskine449bd832023-01-11 14:50:10 +01002105 if (!PSA_ALG_IS_HASH(alg)) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002106 status = PSA_ERROR_INVALID_ARGUMENT;
2107 goto exit;
2108 }
Jaeden Amero36ee5d02019-02-19 09:25:10 +00002109
Steven Cooremanb6bf4bb2021-03-15 19:00:14 +01002110 /* Ensure all of the context is zeroized, since PSA_HASH_OPERATION_INIT only
2111 * directly zeroes the int-sized dummy member of the context union. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002112 memset(&operation->ctx, 0, sizeof(operation->ctx));
Steven Cooreman893232f2021-03-15 12:23:37 +01002113
Gilles Peskine449bd832023-01-11 14:50:10 +01002114 status = psa_driver_wrapper_hash_setup(operation, alg);
Dave Rodgman685b6a72021-06-24 11:49:14 +01002115
2116exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002117 if (status != PSA_SUCCESS) {
2118 psa_hash_abort(operation);
2119 }
Dave Rodgman685b6a72021-06-24 11:49:14 +01002120
2121 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002122}
2123
Gilles Peskine449bd832023-01-11 14:50:10 +01002124psa_status_t psa_hash_update(psa_hash_operation_t *operation,
2125 const uint8_t *input,
2126 size_t input_length)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002127{
Dave Rodgman685b6a72021-06-24 11:49:14 +01002128 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2129
Gilles Peskine449bd832023-01-11 14:50:10 +01002130 if (operation->id == 0) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002131 status = PSA_ERROR_BAD_STATE;
2132 goto exit;
2133 }
Gilles Peskine94e44542018-07-12 16:58:43 +02002134
Steven Cooremanc8288352021-03-04 14:02:19 +01002135 /* Don't require hash implementations to behave correctly on a
2136 * zero-length input, which may have an invalid pointer. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002137 if (input_length == 0) {
2138 return PSA_SUCCESS;
2139 }
Steven Cooremanc8288352021-03-04 14:02:19 +01002140
Gilles Peskine449bd832023-01-11 14:50:10 +01002141 status = psa_driver_wrapper_hash_update(operation, input, input_length);
Dave Rodgman685b6a72021-06-24 11:49:14 +01002142
2143exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002144 if (status != PSA_SUCCESS) {
2145 psa_hash_abort(operation);
2146 }
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002147
Gilles Peskine449bd832023-01-11 14:50:10 +01002148 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002149}
2150
Gilles Peskine449bd832023-01-11 14:50:10 +01002151psa_status_t psa_hash_finish(psa_hash_operation_t *operation,
2152 uint8_t *hash,
2153 size_t hash_size,
2154 size_t *hash_length)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002155{
Steven Cooremanfbe09282021-03-08 18:41:12 +01002156 *hash_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01002157 if (operation->id == 0) {
2158 return PSA_ERROR_BAD_STATE;
2159 }
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002160
Steven Cooreman1e582352021-02-18 17:24:37 +01002161 psa_status_t status = psa_driver_wrapper_hash_finish(
Gilles Peskine449bd832023-01-11 14:50:10 +01002162 operation, hash, hash_size, hash_length);
2163 psa_hash_abort(operation);
2164 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002165}
2166
Gilles Peskine449bd832023-01-11 14:50:10 +01002167psa_status_t psa_hash_verify(psa_hash_operation_t *operation,
2168 const uint8_t *hash,
2169 size_t hash_length)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002170{
Ronald Cron69a63422021-10-18 09:47:58 +02002171 uint8_t actual_hash[PSA_HASH_MAX_SIZE];
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002172 size_t actual_hash_length;
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002173 psa_status_t status = psa_hash_finish(
Gilles Peskine449bd832023-01-11 14:50:10 +01002174 operation,
2175 actual_hash, sizeof(actual_hash),
2176 &actual_hash_length);
Dave Rodgman685b6a72021-06-24 11:49:14 +01002177
Gilles Peskine449bd832023-01-11 14:50:10 +01002178 if (status != PSA_SUCCESS) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002179 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002180 }
Dave Rodgman685b6a72021-06-24 11:49:14 +01002181
Gilles Peskine449bd832023-01-11 14:50:10 +01002182 if (actual_hash_length != hash_length) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002183 status = PSA_ERROR_INVALID_SIGNATURE;
2184 goto exit;
2185 }
2186
Dave Rodgman78701152023-08-29 14:20:18 +01002187 if (mbedtls_ct_memcmp(hash, actual_hash, actual_hash_length) != 0) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002188 status = PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskine449bd832023-01-11 14:50:10 +01002189 }
Dave Rodgman685b6a72021-06-24 11:49:14 +01002190
2191exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002192 mbedtls_platform_zeroize(actual_hash, sizeof(actual_hash));
2193 if (status != PSA_SUCCESS) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002194 psa_hash_abort(operation);
Gilles Peskine449bd832023-01-11 14:50:10 +01002195 }
Dave Rodgman685b6a72021-06-24 11:49:14 +01002196
Gilles Peskine449bd832023-01-11 14:50:10 +01002197 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002198}
2199
Gilles Peskine449bd832023-01-11 14:50:10 +01002200psa_status_t psa_hash_compute(psa_algorithm_t alg,
2201 const uint8_t *input, size_t input_length,
2202 uint8_t *hash, size_t hash_size,
2203 size_t *hash_length)
Gilles Peskine0a749c82019-11-28 19:33:58 +01002204{
Steven Cooremanfbe09282021-03-08 18:41:12 +01002205 *hash_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01002206 if (!PSA_ALG_IS_HASH(alg)) {
2207 return PSA_ERROR_INVALID_ARGUMENT;
2208 }
Steven Cooremanf66d5fd2021-03-08 18:40:40 +01002209
Gilles Peskine449bd832023-01-11 14:50:10 +01002210 return psa_driver_wrapper_hash_compute(alg, input, input_length,
2211 hash, hash_size, hash_length);
Gilles Peskine0a749c82019-11-28 19:33:58 +01002212}
2213
Gilles Peskine449bd832023-01-11 14:50:10 +01002214psa_status_t psa_hash_compare(psa_algorithm_t alg,
2215 const uint8_t *input, size_t input_length,
2216 const uint8_t *hash, size_t hash_length)
Gilles Peskine0a749c82019-11-28 19:33:58 +01002217{
Ronald Cron69a63422021-10-18 09:47:58 +02002218 uint8_t actual_hash[PSA_HASH_MAX_SIZE];
Steven Cooreman84d670d2021-02-18 16:22:53 +01002219 size_t actual_hash_length;
Steven Cooremanf66d5fd2021-03-08 18:40:40 +01002220
Gilles Peskine449bd832023-01-11 14:50:10 +01002221 if (!PSA_ALG_IS_HASH(alg)) {
2222 return PSA_ERROR_INVALID_ARGUMENT;
2223 }
Steven Cooremanf66d5fd2021-03-08 18:40:40 +01002224
Steven Cooreman1e582352021-02-18 17:24:37 +01002225 psa_status_t status = psa_driver_wrapper_hash_compute(
Gilles Peskine449bd832023-01-11 14:50:10 +01002226 alg, input, input_length,
2227 actual_hash, sizeof(actual_hash),
2228 &actual_hash_length);
2229 if (status != PSA_SUCCESS) {
Gilles Peskine60aebec2021-12-13 12:33:18 +01002230 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002231 }
2232 if (actual_hash_length != hash_length) {
Gilles Peskine60aebec2021-12-13 12:33:18 +01002233 status = PSA_ERROR_INVALID_SIGNATURE;
2234 goto exit;
2235 }
Dave Rodgman78701152023-08-29 14:20:18 +01002236 if (mbedtls_ct_memcmp(hash, actual_hash, actual_hash_length) != 0) {
Gilles Peskine60aebec2021-12-13 12:33:18 +01002237 status = PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskine449bd832023-01-11 14:50:10 +01002238 }
Gilles Peskine60aebec2021-12-13 12:33:18 +01002239
2240exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002241 mbedtls_platform_zeroize(actual_hash, sizeof(actual_hash));
2242 return status;
Gilles Peskine0a749c82019-11-28 19:33:58 +01002243}
2244
Gilles Peskine449bd832023-01-11 14:50:10 +01002245psa_status_t psa_hash_clone(const psa_hash_operation_t *source_operation,
2246 psa_hash_operation_t *target_operation)
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002247{
Gilles Peskine449bd832023-01-11 14:50:10 +01002248 if (source_operation->id == 0 ||
2249 target_operation->id != 0) {
2250 return PSA_ERROR_BAD_STATE;
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002251 }
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002252
Gilles Peskine449bd832023-01-11 14:50:10 +01002253 psa_status_t status = psa_driver_wrapper_hash_clone(source_operation,
2254 target_operation);
2255 if (status != PSA_SUCCESS) {
2256 psa_hash_abort(target_operation);
2257 }
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002258
Gilles Peskine449bd832023-01-11 14:50:10 +01002259 return status;
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002260}
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002261
2262
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002263/****************************************************************/
Gilles Peskine8c9def32018-02-08 10:02:12 +01002264/* MAC */
2265/****************************************************************/
2266
Gilles Peskine449bd832023-01-11 14:50:10 +01002267psa_status_t psa_mac_abort(psa_mac_operation_t *operation)
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002268{
Steven Cooremane6804192021-03-19 18:28:56 +01002269 /* Aborting a non-active operation is allowed */
Gilles Peskine449bd832023-01-11 14:50:10 +01002270 if (operation->id == 0) {
2271 return PSA_SUCCESS;
2272 }
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002273
Gilles Peskine449bd832023-01-11 14:50:10 +01002274 psa_status_t status = psa_driver_wrapper_mac_abort(operation);
Steven Cooreman72f736a2021-05-07 14:14:37 +02002275 operation->mac_size = 0;
2276 operation->is_sign = 0;
Steven Cooremane6804192021-03-19 18:28:56 +01002277 operation->id = 0;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002278
Gilles Peskine449bd832023-01-11 14:50:10 +01002279 return status;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002280}
2281
Ronald Cron2dff3b22021-06-17 16:33:22 +02002282static psa_status_t psa_mac_finalize_alg_and_key_validation(
2283 psa_algorithm_t alg,
Ronald Cron79bdd822021-06-17 16:46:44 +02002284 const psa_key_attributes_t *attributes,
Gilles Peskine449bd832023-01-11 14:50:10 +01002285 uint8_t *mac_size)
Gilles Peskine8c9def32018-02-08 10:02:12 +01002286{
Ronald Cronf95a2b12020-10-22 15:24:49 +02002287 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine449bd832023-01-11 14:50:10 +01002288 psa_key_type_t key_type = psa_get_key_type(attributes);
2289 size_t key_bits = psa_get_key_bits(attributes);
Steven Cooreman77e2cc52021-03-19 17:05:52 +01002290
Gilles Peskine449bd832023-01-11 14:50:10 +01002291 if (!PSA_ALG_IS_MAC(alg)) {
2292 return PSA_ERROR_INVALID_ARGUMENT;
2293 }
Steven Cooremane6804192021-03-19 18:28:56 +01002294
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +01002295 /* Validate the combination of key type and algorithm */
Gilles Peskine449bd832023-01-11 14:50:10 +01002296 status = psa_mac_key_can_do(alg, key_type);
2297 if (status != PSA_SUCCESS) {
2298 return status;
2299 }
Steven Cooreman15472f82021-03-02 16:16:22 +01002300
Steven Cooremand1a68f12021-05-10 11:13:41 +02002301 /* Get the output length for the algorithm and key combination */
Gilles Peskine449bd832023-01-11 14:50:10 +01002302 *mac_size = PSA_MAC_LENGTH(key_type, key_bits, alg);
Steven Cooreman15472f82021-03-02 16:16:22 +01002303
Gilles Peskine449bd832023-01-11 14:50:10 +01002304 if (*mac_size < 4) {
Steven Cooreman15472f82021-03-02 16:16:22 +01002305 /* A very short MAC is too short for security since it can be
2306 * brute-forced. Ancient protocols with 32-bit MACs do exist,
2307 * so we make this our minimum, even though 32 bits is still
2308 * too small for security. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002309 return PSA_ERROR_NOT_SUPPORTED;
Steven Cooreman15472f82021-03-02 16:16:22 +01002310 }
Gilles Peskineab1d7ab2018-07-06 16:07:47 +02002311
Gilles Peskine449bd832023-01-11 14:50:10 +01002312 if (*mac_size > PSA_MAC_LENGTH(key_type, key_bits,
2313 PSA_ALG_FULL_LENGTH_MAC(alg))) {
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +01002314 /* It's impossible to "truncate" to a larger length than the full length
2315 * of the algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002316 return PSA_ERROR_INVALID_ARGUMENT;
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +01002317 }
2318
Gilles Peskine449bd832023-01-11 14:50:10 +01002319 if (*mac_size > PSA_MAC_MAX_SIZE) {
Gilles Peskinea9b6c802022-03-16 13:54:49 +01002320 /* PSA_MAC_LENGTH returns the correct length even for a MAC algorithm
2321 * that is disabled in the compile-time configuration. The result can
2322 * therefore be larger than PSA_MAC_MAX_SIZE, which does take the
2323 * configuration into account. In this case, force a return of
2324 * PSA_ERROR_NOT_SUPPORTED here. Otherwise psa_mac_verify(), or
2325 * psa_mac_compute(mac_size=PSA_MAC_MAX_SIZE), would return
2326 * PSA_ERROR_BUFFER_TOO_SMALL for an unsupported algorithm whose MAC size
2327 * is larger than PSA_MAC_MAX_SIZE, which is misleading and which breaks
2328 * systematically generated tests. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002329 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea9b6c802022-03-16 13:54:49 +01002330 }
2331
Gilles Peskine449bd832023-01-11 14:50:10 +01002332 return PSA_SUCCESS;
Ronald Cron2dff3b22021-06-17 16:33:22 +02002333}
2334
Gilles Peskine449bd832023-01-11 14:50:10 +01002335static psa_status_t psa_mac_setup(psa_mac_operation_t *operation,
2336 mbedtls_svc_key_id_t key,
2337 psa_algorithm_t alg,
2338 int is_sign)
Gilles Peskinee59236f2018-01-27 23:32:46 +01002339{
2340 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2341 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Dave Rodgman54648242021-06-24 11:49:45 +01002342 psa_key_slot_t *slot = NULL;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002343
2344 /* A context must be freshly initialized before it can be set up. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002345 if (operation->id != 0) {
Dave Rodgman54648242021-06-24 11:49:45 +01002346 status = PSA_ERROR_BAD_STATE;
2347 goto exit;
2348 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002349
2350 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002351 key,
2352 &slot,
2353 is_sign ? PSA_KEY_USAGE_SIGN_MESSAGE : PSA_KEY_USAGE_VERIFY_MESSAGE,
2354 alg);
2355 if (status != PSA_SUCCESS) {
Dave Rodgman54648242021-06-24 11:49:45 +01002356 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002357 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002358
Gilles Peskine7a5d9202024-02-28 01:18:23 +01002359 status = psa_mac_finalize_alg_and_key_validation(alg, &slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01002360 &operation->mac_size);
2361 if (status != PSA_SUCCESS) {
Gilles Peskine8c9def32018-02-08 10:02:12 +01002362 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002363 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002364
2365 operation->is_sign = is_sign;
Steven Cooremane6804192021-03-19 18:28:56 +01002366 /* Dispatch the MAC setup call with validated input */
Gilles Peskine449bd832023-01-11 14:50:10 +01002367 if (is_sign) {
2368 status = psa_driver_wrapper_mac_sign_setup(operation,
Gilles Peskine7a5d9202024-02-28 01:18:23 +01002369 &slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01002370 slot->key.data,
2371 slot->key.bytes,
2372 alg);
2373 } else {
2374 status = psa_driver_wrapper_mac_verify_setup(operation,
Gilles Peskine7a5d9202024-02-28 01:18:23 +01002375 &slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01002376 slot->key.data,
2377 slot->key.bytes,
2378 alg);
Gilles Peskine8c9def32018-02-08 10:02:12 +01002379 }
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002380
Gilles Peskinefbfac682018-07-08 20:51:54 +02002381exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002382 if (status != PSA_SUCCESS) {
2383 psa_mac_abort(operation);
2384 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02002385
Ryan Everettfb9857f2024-02-14 12:16:41 +00002386 unlock_status = psa_unregister_read_under_mutex(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02002387
Gilles Peskine449bd832023-01-11 14:50:10 +01002388 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002389}
2390
Gilles Peskine449bd832023-01-11 14:50:10 +01002391psa_status_t psa_mac_sign_setup(psa_mac_operation_t *operation,
2392 mbedtls_svc_key_id_t key,
2393 psa_algorithm_t alg)
Gilles Peskine89167cb2018-07-08 20:12:23 +02002394{
Gilles Peskine449bd832023-01-11 14:50:10 +01002395 return psa_mac_setup(operation, key, alg, 1);
Gilles Peskine89167cb2018-07-08 20:12:23 +02002396}
2397
Gilles Peskine449bd832023-01-11 14:50:10 +01002398psa_status_t psa_mac_verify_setup(psa_mac_operation_t *operation,
2399 mbedtls_svc_key_id_t key,
2400 psa_algorithm_t alg)
Gilles Peskine89167cb2018-07-08 20:12:23 +02002401{
Gilles Peskine449bd832023-01-11 14:50:10 +01002402 return psa_mac_setup(operation, key, alg, 0);
Gilles Peskine89167cb2018-07-08 20:12:23 +02002403}
2404
Gilles Peskine449bd832023-01-11 14:50:10 +01002405psa_status_t psa_mac_update(psa_mac_operation_t *operation,
2406 const uint8_t *input,
2407 size_t input_length)
Gilles Peskine8c9def32018-02-08 10:02:12 +01002408{
Gilles Peskine449bd832023-01-11 14:50:10 +01002409 if (operation->id == 0) {
2410 return PSA_ERROR_BAD_STATE;
2411 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002412
Steven Cooreman6e7f2912021-03-19 18:38:46 +01002413 /* Don't require hash implementations to behave correctly on a
2414 * zero-length input, which may have an invalid pointer. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002415 if (input_length == 0) {
2416 return PSA_SUCCESS;
2417 }
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03002418
Gilles Peskine449bd832023-01-11 14:50:10 +01002419 psa_status_t status = psa_driver_wrapper_mac_update(operation,
2420 input, input_length);
2421 if (status != PSA_SUCCESS) {
2422 psa_mac_abort(operation);
2423 }
Steven Cooreman6e7f2912021-03-19 18:38:46 +01002424
Gilles Peskine449bd832023-01-11 14:50:10 +01002425 return status;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002426}
2427
Gilles Peskine449bd832023-01-11 14:50:10 +01002428psa_status_t psa_mac_sign_finish(psa_mac_operation_t *operation,
2429 uint8_t *mac,
2430 size_t mac_size,
2431 size_t *mac_length)
mohammad16036df908f2018-04-02 08:34:15 -07002432{
Steven Cooremana5b860a2021-03-19 19:04:39 +01002433 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2434 psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED;
Steven Cooreman77e2cc52021-03-19 17:05:52 +01002435
Gilles Peskine449bd832023-01-11 14:50:10 +01002436 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002437 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002438 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002439 }
Jaeden Amero252ef282019-02-15 14:05:35 +00002440
Gilles Peskine449bd832023-01-11 14:50:10 +01002441 if (!operation->is_sign) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002442 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002443 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002444 }
Steven Cooreman72f736a2021-05-07 14:14:37 +02002445
Steven Cooreman8af5c5c2021-05-11 11:09:13 +02002446 /* Sanity check. This will guarantee that mac_size != 0 (and so mac != NULL)
2447 * once all the error checks are done. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002448 if (operation->mac_size == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002449 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002450 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002451 }
Steven Cooreman8af5c5c2021-05-11 11:09:13 +02002452
Gilles Peskine449bd832023-01-11 14:50:10 +01002453 if (mac_size < operation->mac_size) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002454 status = PSA_ERROR_BUFFER_TOO_SMALL;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002455 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002456 }
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002457
Gilles Peskine449bd832023-01-11 14:50:10 +01002458 status = psa_driver_wrapper_mac_sign_finish(operation,
2459 mac, operation->mac_size,
2460 mac_length);
Steven Cooreman72f736a2021-05-07 14:14:37 +02002461
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002462exit:
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002463 /* In case of success, set the potential excess room in the output buffer
2464 * to an invalid value, to avoid potentially leaking a longer MAC.
2465 * In case of error, set the output length and content to a safe default,
2466 * such that in case the caller misses an error check, the output would be
2467 * an unachievable MAC.
2468 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002469 if (status != PSA_SUCCESS) {
Steven Cooreman72f736a2021-05-07 14:14:37 +02002470 *mac_length = mac_size;
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002471 operation->mac_size = 0;
Steven Cooreman72f736a2021-05-07 14:14:37 +02002472 }
mohammad16036df908f2018-04-02 08:34:15 -07002473
Paul Elliottdc42ca82023-02-24 18:11:59 +00002474 psa_wipe_tag_output_buffer(mac, status, mac_size, *mac_length);
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002475
Gilles Peskine449bd832023-01-11 14:50:10 +01002476 abort_status = psa_mac_abort(operation);
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002477
Gilles Peskine449bd832023-01-11 14:50:10 +01002478 return status == PSA_SUCCESS ? abort_status : status;
mohammad16036df908f2018-04-02 08:34:15 -07002479}
2480
Gilles Peskine449bd832023-01-11 14:50:10 +01002481psa_status_t psa_mac_verify_finish(psa_mac_operation_t *operation,
2482 const uint8_t *mac,
2483 size_t mac_length)
Gilles Peskine8c9def32018-02-08 10:02:12 +01002484{
Steven Cooremana5b860a2021-03-19 19:04:39 +01002485 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2486 psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED;
Steven Cooreman77e2cc52021-03-19 17:05:52 +01002487
Gilles Peskine449bd832023-01-11 14:50:10 +01002488 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002489 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002490 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002491 }
Jaeden Amero252ef282019-02-15 14:05:35 +00002492
Gilles Peskine449bd832023-01-11 14:50:10 +01002493 if (operation->is_sign) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002494 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002495 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002496 }
Steven Cooreman72f736a2021-05-07 14:14:37 +02002497
Gilles Peskine449bd832023-01-11 14:50:10 +01002498 if (operation->mac_size != mac_length) {
Steven Cooreman72f736a2021-05-07 14:14:37 +02002499 status = PSA_ERROR_INVALID_SIGNATURE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002500 goto exit;
Steven Cooreman72f736a2021-05-07 14:14:37 +02002501 }
2502
Gilles Peskine449bd832023-01-11 14:50:10 +01002503 status = psa_driver_wrapper_mac_verify_finish(operation,
2504 mac, mac_length);
Steven Cooreman72f736a2021-05-07 14:14:37 +02002505
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002506exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002507 abort_status = psa_mac_abort(operation);
mohammad16036df908f2018-04-02 08:34:15 -07002508
Gilles Peskine449bd832023-01-11 14:50:10 +01002509 return status == PSA_SUCCESS ? abort_status : status;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002510}
2511
Gilles Peskine449bd832023-01-11 14:50:10 +01002512static psa_status_t psa_mac_compute_internal(mbedtls_svc_key_id_t key,
2513 psa_algorithm_t alg,
2514 const uint8_t *input,
2515 size_t input_length,
2516 uint8_t *mac,
2517 size_t mac_size,
2518 size_t *mac_length,
2519 int is_sign)
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002520{
2521 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron51131b52021-06-17 17:17:20 +02002522 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
2523 psa_key_slot_t *slot;
2524 uint8_t operation_mac_size = 0;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002525
Ronald Cron51131b52021-06-17 17:17:20 +02002526 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002527 key,
2528 &slot,
2529 is_sign ? PSA_KEY_USAGE_SIGN_MESSAGE : PSA_KEY_USAGE_VERIFY_MESSAGE,
2530 alg);
2531 if (status != PSA_SUCCESS) {
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002532 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002533 }
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002534
Gilles Peskine7a5d9202024-02-28 01:18:23 +01002535 status = psa_mac_finalize_alg_and_key_validation(alg, &slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01002536 &operation_mac_size);
2537 if (status != PSA_SUCCESS) {
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002538 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002539 }
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002540
Gilles Peskine449bd832023-01-11 14:50:10 +01002541 if (mac_size < operation_mac_size) {
Ronald Cron51131b52021-06-17 17:17:20 +02002542 status = PSA_ERROR_BUFFER_TOO_SMALL;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002543 goto exit;
Ronald Cron51131b52021-06-17 17:17:20 +02002544 }
2545
2546 status = psa_driver_wrapper_mac_compute(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01002547 &slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01002548 slot->key.data, slot->key.bytes,
2549 alg,
2550 input, input_length,
2551 mac, operation_mac_size, mac_length);
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002552
2553exit:
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002554 /* In case of success, set the potential excess room in the output buffer
2555 * to an invalid value, to avoid potentially leaking a longer MAC.
2556 * In case of error, set the output length and content to a safe default,
2557 * such that in case the caller misses an error check, the output would be
2558 * an unachievable MAC.
2559 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002560 if (status != PSA_SUCCESS) {
Ronald Cron51131b52021-06-17 17:17:20 +02002561 *mac_length = mac_size;
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002562 operation_mac_size = 0;
Ronald Cron51131b52021-06-17 17:17:20 +02002563 }
Paul Elliottdc42ca82023-02-24 18:11:59 +00002564
2565 psa_wipe_tag_output_buffer(mac, status, mac_size, *mac_length);
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002566
Ryan Everetta103ec92024-01-31 13:59:57 +00002567 unlock_status = psa_unregister_read_under_mutex(slot);
Ronald Cron51131b52021-06-17 17:17:20 +02002568
Gilles Peskine449bd832023-01-11 14:50:10 +01002569 return (status == PSA_SUCCESS) ? unlock_status : status;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002570}
2571
Gilles Peskine449bd832023-01-11 14:50:10 +01002572psa_status_t psa_mac_compute(mbedtls_svc_key_id_t key,
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002573 psa_algorithm_t alg,
2574 const uint8_t *input,
2575 size_t input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002576 uint8_t *mac,
2577 size_t mac_size,
2578 size_t *mac_length)
2579{
2580 return psa_mac_compute_internal(key, alg,
2581 input, input_length,
2582 mac, mac_size, mac_length, 1);
2583}
2584
2585psa_status_t psa_mac_verify(mbedtls_svc_key_id_t key,
2586 psa_algorithm_t alg,
2587 const uint8_t *input,
2588 size_t input_length,
2589 const uint8_t *mac,
2590 size_t mac_length)
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002591{
2592 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Crona587cbc2021-06-18 14:51:29 +02002593 uint8_t actual_mac[PSA_MAC_MAX_SIZE];
2594 size_t actual_mac_length;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002595
Gilles Peskine449bd832023-01-11 14:50:10 +01002596 status = psa_mac_compute_internal(key, alg,
2597 input, input_length,
2598 actual_mac, sizeof(actual_mac),
2599 &actual_mac_length, 0);
2600 if (status != PSA_SUCCESS) {
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002601 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002602 }
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002603
Gilles Peskine449bd832023-01-11 14:50:10 +01002604 if (mac_length != actual_mac_length) {
Ronald Crona587cbc2021-06-18 14:51:29 +02002605 status = PSA_ERROR_INVALID_SIGNATURE;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002606 goto exit;
Ronald Crona587cbc2021-06-18 14:51:29 +02002607 }
Dave Rodgman78701152023-08-29 14:20:18 +01002608 if (mbedtls_ct_memcmp(mac, actual_mac, actual_mac_length) != 0) {
Ronald Crona587cbc2021-06-18 14:51:29 +02002609 status = PSA_ERROR_INVALID_SIGNATURE;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002610 goto exit;
Ronald Crona587cbc2021-06-18 14:51:29 +02002611 }
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002612
2613exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002614 mbedtls_platform_zeroize(actual_mac, sizeof(actual_mac));
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002615
Gilles Peskine449bd832023-01-11 14:50:10 +01002616 return status;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002617}
Gilles Peskinee59236f2018-01-27 23:32:46 +01002618
Gilles Peskinee59236f2018-01-27 23:32:46 +01002619/****************************************************************/
2620/* Asymmetric cryptography */
2621/****************************************************************/
2622
Gilles Peskine449bd832023-01-11 14:50:10 +01002623static psa_status_t psa_sign_verify_check_alg(int input_is_message,
2624 psa_algorithm_t alg)
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002625{
Gilles Peskine449bd832023-01-11 14:50:10 +01002626 if (input_is_message) {
2627 if (!PSA_ALG_IS_SIGN_MESSAGE(alg)) {
2628 return PSA_ERROR_INVALID_ARGUMENT;
2629 }
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002630
Gilles Peskine449bd832023-01-11 14:50:10 +01002631 if (PSA_ALG_IS_SIGN_HASH(alg)) {
2632 if (!PSA_ALG_IS_HASH(PSA_ALG_SIGN_GET_HASH(alg))) {
2633 return PSA_ERROR_INVALID_ARGUMENT;
2634 }
2635 }
2636 } else {
2637 if (!PSA_ALG_IS_SIGN_HASH(alg)) {
2638 return PSA_ERROR_INVALID_ARGUMENT;
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002639 }
2640 }
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002641
Gilles Peskine449bd832023-01-11 14:50:10 +01002642 return PSA_SUCCESS;
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002643}
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002644
Gilles Peskine449bd832023-01-11 14:50:10 +01002645static psa_status_t psa_sign_internal(mbedtls_svc_key_id_t key,
2646 int input_is_message,
2647 psa_algorithm_t alg,
2648 const uint8_t *input,
2649 size_t input_length,
2650 uint8_t *signature,
2651 size_t signature_size,
2652 size_t *signature_length)
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002653{
2654 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2655 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
2656 psa_key_slot_t *slot;
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002657
2658 *signature_length = 0;
2659
Gilles Peskine449bd832023-01-11 14:50:10 +01002660 status = psa_sign_verify_check_alg(input_is_message, alg);
2661 if (status != PSA_SUCCESS) {
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002662 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01002663 }
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002664
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002665 /* Immediately reject a zero-length signature buffer. This guarantees
gabor-mezei-arm12b4f342021-05-05 13:54:55 +02002666 * that signature must be a valid pointer. (On the other hand, the input
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002667 * buffer can in principle be empty since it doesn't actually have
2668 * to be a hash.) */
Gilles Peskine449bd832023-01-11 14:50:10 +01002669 if (signature_size == 0) {
2670 return PSA_ERROR_BUFFER_TOO_SMALL;
2671 }
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002672
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002673 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002674 key, &slot,
2675 input_is_message ? PSA_KEY_USAGE_SIGN_MESSAGE :
2676 PSA_KEY_USAGE_SIGN_HASH,
2677 alg);
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002678
Gilles Peskine449bd832023-01-11 14:50:10 +01002679 if (status != PSA_SUCCESS) {
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002680 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002681 }
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002682
Gilles Peskine449bd832023-01-11 14:50:10 +01002683 if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) {
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002684 status = PSA_ERROR_INVALID_ARGUMENT;
2685 goto exit;
2686 }
2687
Gilles Peskine449bd832023-01-11 14:50:10 +01002688 if (input_is_message) {
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002689 status = psa_driver_wrapper_sign_message(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01002690 &slot->attr, slot->key.data, slot->key.bytes,
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002691 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002692 signature, signature_size, signature_length);
2693 } else {
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002694
2695 status = psa_driver_wrapper_sign_hash(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01002696 &slot->attr, slot->key.data, slot->key.bytes,
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002697 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002698 signature, signature_size, signature_length);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002699 }
2700
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002701
2702exit:
Paul Elliott59200a22023-02-21 15:07:40 +00002703 psa_wipe_tag_output_buffer(signature, status, signature_size,
2704 *signature_length);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002705
Ryan Everetta103ec92024-01-31 13:59:57 +00002706 unlock_status = psa_unregister_read_under_mutex(slot);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002707
Gilles Peskine449bd832023-01-11 14:50:10 +01002708 return (status == PSA_SUCCESS) ? unlock_status : status;
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002709}
2710
Gilles Peskine449bd832023-01-11 14:50:10 +01002711static psa_status_t psa_verify_internal(mbedtls_svc_key_id_t key,
2712 int input_is_message,
2713 psa_algorithm_t alg,
2714 const uint8_t *input,
2715 size_t input_length,
2716 const uint8_t *signature,
2717 size_t signature_length)
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002718{
2719 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2720 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
2721 psa_key_slot_t *slot;
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002722
Gilles Peskine449bd832023-01-11 14:50:10 +01002723 status = psa_sign_verify_check_alg(input_is_message, alg);
2724 if (status != PSA_SUCCESS) {
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002725 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01002726 }
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002727
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002728 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002729 key, &slot,
2730 input_is_message ? PSA_KEY_USAGE_VERIFY_MESSAGE :
2731 PSA_KEY_USAGE_VERIFY_HASH,
2732 alg);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002733
Gilles Peskine449bd832023-01-11 14:50:10 +01002734 if (status != PSA_SUCCESS) {
2735 return status;
2736 }
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002737
Gilles Peskine449bd832023-01-11 14:50:10 +01002738 if (input_is_message) {
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002739 status = psa_driver_wrapper_verify_message(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01002740 &slot->attr, slot->key.data, slot->key.bytes,
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002741 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002742 signature, signature_length);
2743 } else {
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002744 status = psa_driver_wrapper_verify_hash(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01002745 &slot->attr, slot->key.data, slot->key.bytes,
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002746 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002747 signature, signature_length);
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002748 }
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002749
Ryan Everetta103ec92024-01-31 13:59:57 +00002750 unlock_status = psa_unregister_read_under_mutex(slot);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002751
Gilles Peskine449bd832023-01-11 14:50:10 +01002752 return (status == PSA_SUCCESS) ? unlock_status : status;
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002753
2754}
2755
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02002756psa_status_t psa_sign_message_builtin(
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002757 const psa_key_attributes_t *attributes,
2758 const uint8_t *key_buffer,
2759 size_t key_buffer_size,
2760 psa_algorithm_t alg,
2761 const uint8_t *input,
2762 size_t input_length,
2763 uint8_t *signature,
2764 size_t signature_size,
Gilles Peskine449bd832023-01-11 14:50:10 +01002765 size_t *signature_length)
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002766{
2767 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002768
Gilles Peskine449bd832023-01-11 14:50:10 +01002769 if (PSA_ALG_IS_SIGN_HASH(alg)) {
gabor-mezei-armf9820f92021-05-03 16:26:20 +02002770 size_t hash_length;
2771 uint8_t hash[PSA_HASH_MAX_SIZE];
2772
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002773 status = psa_driver_wrapper_hash_compute(
Gilles Peskine449bd832023-01-11 14:50:10 +01002774 PSA_ALG_SIGN_GET_HASH(alg),
2775 input, input_length,
2776 hash, sizeof(hash), &hash_length);
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002777
Gilles Peskine449bd832023-01-11 14:50:10 +01002778 if (status != PSA_SUCCESS) {
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002779 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01002780 }
gabor-mezei-armf9820f92021-05-03 16:26:20 +02002781
2782 return psa_driver_wrapper_sign_hash(
Gilles Peskine449bd832023-01-11 14:50:10 +01002783 attributes, key_buffer, key_buffer_size,
2784 alg, hash, hash_length,
2785 signature, signature_size, signature_length);
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002786 }
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002787
Gilles Peskine449bd832023-01-11 14:50:10 +01002788 return PSA_ERROR_NOT_SUPPORTED;
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002789}
2790
Gilles Peskine449bd832023-01-11 14:50:10 +01002791psa_status_t psa_sign_message(mbedtls_svc_key_id_t key,
2792 psa_algorithm_t alg,
2793 const uint8_t *input,
2794 size_t input_length,
2795 uint8_t *signature,
2796 size_t signature_size,
2797 size_t *signature_length)
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002798{
2799 return psa_sign_internal(
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002800 key, 1, alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002801 signature, signature_size, signature_length);
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002802}
2803
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02002804psa_status_t psa_verify_message_builtin(
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002805 const psa_key_attributes_t *attributes,
2806 const uint8_t *key_buffer,
2807 size_t key_buffer_size,
2808 psa_algorithm_t alg,
2809 const uint8_t *input,
2810 size_t input_length,
2811 const uint8_t *signature,
Gilles Peskine449bd832023-01-11 14:50:10 +01002812 size_t signature_length)
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002813{
2814 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002815
Gilles Peskine449bd832023-01-11 14:50:10 +01002816 if (PSA_ALG_IS_SIGN_HASH(alg)) {
gabor-mezei-armf9820f92021-05-03 16:26:20 +02002817 size_t hash_length;
2818 uint8_t hash[PSA_HASH_MAX_SIZE];
2819
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002820 status = psa_driver_wrapper_hash_compute(
Gilles Peskine449bd832023-01-11 14:50:10 +01002821 PSA_ALG_SIGN_GET_HASH(alg),
2822 input, input_length,
2823 hash, sizeof(hash), &hash_length);
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002824
Gilles Peskine449bd832023-01-11 14:50:10 +01002825 if (status != PSA_SUCCESS) {
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002826 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01002827 }
gabor-mezei-armf9820f92021-05-03 16:26:20 +02002828
2829 return psa_driver_wrapper_verify_hash(
Gilles Peskine449bd832023-01-11 14:50:10 +01002830 attributes, key_buffer, key_buffer_size,
2831 alg, hash, hash_length,
2832 signature, signature_length);
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002833 }
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002834
Gilles Peskine449bd832023-01-11 14:50:10 +01002835 return PSA_ERROR_NOT_SUPPORTED;
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002836}
2837
Gilles Peskine449bd832023-01-11 14:50:10 +01002838psa_status_t psa_verify_message(mbedtls_svc_key_id_t key,
2839 psa_algorithm_t alg,
2840 const uint8_t *input,
2841 size_t input_length,
2842 const uint8_t *signature,
2843 size_t signature_length)
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002844{
2845 return psa_verify_internal(
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002846 key, 1, alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002847 signature, signature_length);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002848}
2849
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02002850psa_status_t psa_sign_hash_builtin(
Ronald Cron18659932020-12-08 16:32:23 +01002851 const psa_key_attributes_t *attributes,
2852 const uint8_t *key_buffer, size_t key_buffer_size,
2853 psa_algorithm_t alg, const uint8_t *hash, size_t hash_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002854 uint8_t *signature, size_t signature_size, size_t *signature_length)
Gilles Peskinee59236f2018-01-27 23:32:46 +01002855{
Gilles Peskine2f107ae2024-02-28 01:26:46 +01002856 if (attributes->type == PSA_KEY_TYPE_RSA_KEY_PAIR) {
Gilles Peskine449bd832023-01-11 14:50:10 +01002857 if (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) ||
2858 PSA_ALG_IS_RSA_PSS(alg)) {
Ronald Cron4501c982021-03-19 20:09:32 +01002859#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01002860 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
2861 return mbedtls_psa_rsa_sign_hash(
2862 attributes,
2863 key_buffer, key_buffer_size,
2864 alg, hash, hash_length,
2865 signature, signature_size, signature_length);
Ronald Cron4501c982021-03-19 20:09:32 +01002866#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
2867 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
Gilles Peskine449bd832023-01-11 14:50:10 +01002868 } else {
2869 return PSA_ERROR_INVALID_ARGUMENT;
Steven Cooremanacda8342020-07-24 23:09:52 +02002870 }
Gilles Peskine2f107ae2024-02-28 01:26:46 +01002871 } else if (PSA_KEY_TYPE_IS_ECC(attributes->type)) {
Gilles Peskine449bd832023-01-11 14:50:10 +01002872 if (PSA_ALG_IS_ECDSA(alg)) {
Ronald Cron4501c982021-03-19 20:09:32 +01002873#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01002874 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
2875 return mbedtls_psa_ecdsa_sign_hash(
2876 attributes,
2877 key_buffer, key_buffer_size,
2878 alg, hash, hash_length,
2879 signature, signature_size, signature_length);
Gilles Peskinee59236f2018-01-27 23:32:46 +01002880#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
2881 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Gilles Peskine449bd832023-01-11 14:50:10 +01002882 } else {
2883 return PSA_ERROR_INVALID_ARGUMENT;
Ronald Cron4501c982021-03-19 20:09:32 +01002884 }
Ronald Cron8a494f32021-02-17 09:49:51 +01002885 }
Ronald Cron4501c982021-03-19 20:09:32 +01002886
Gilles Peskine449bd832023-01-11 14:50:10 +01002887 (void) key_buffer;
2888 (void) key_buffer_size;
2889 (void) hash;
2890 (void) hash_length;
2891 (void) signature;
2892 (void) signature_size;
2893 (void) signature_length;
Ronald Cron4501c982021-03-19 20:09:32 +01002894
Gilles Peskine449bd832023-01-11 14:50:10 +01002895 return PSA_ERROR_NOT_SUPPORTED;
Ronald Cron18659932020-12-08 16:32:23 +01002896}
Gilles Peskinee59236f2018-01-27 23:32:46 +01002897
Gilles Peskine449bd832023-01-11 14:50:10 +01002898psa_status_t psa_sign_hash(mbedtls_svc_key_id_t key,
2899 psa_algorithm_t alg,
2900 const uint8_t *hash,
2901 size_t hash_length,
2902 uint8_t *signature,
2903 size_t signature_size,
2904 size_t *signature_length)
Gilles Peskinee59236f2018-01-27 23:32:46 +01002905{
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002906 return psa_sign_internal(
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002907 key, 0, alg, hash, hash_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002908 signature, signature_size, signature_length);
itayzafrir5c753392018-05-08 11:18:38 +03002909}
2910
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02002911psa_status_t psa_verify_hash_builtin(
Ronald Cron18659932020-12-08 16:32:23 +01002912 const psa_key_attributes_t *attributes,
2913 const uint8_t *key_buffer, size_t key_buffer_size,
2914 psa_algorithm_t alg, const uint8_t *hash, size_t hash_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002915 const uint8_t *signature, size_t signature_length)
itayzafrir5c753392018-05-08 11:18:38 +03002916{
Gilles Peskine2f107ae2024-02-28 01:26:46 +01002917 if (PSA_KEY_TYPE_IS_RSA(attributes->type)) {
Gilles Peskine449bd832023-01-11 14:50:10 +01002918 if (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) ||
2919 PSA_ALG_IS_RSA_PSS(alg)) {
Ronald Cron4501c982021-03-19 20:09:32 +01002920#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01002921 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
2922 return mbedtls_psa_rsa_verify_hash(
2923 attributes,
2924 key_buffer, key_buffer_size,
2925 alg, hash, hash_length,
2926 signature, signature_length);
Ronald Cron4501c982021-03-19 20:09:32 +01002927#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
2928 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
Gilles Peskine449bd832023-01-11 14:50:10 +01002929 } else {
2930 return PSA_ERROR_INVALID_ARGUMENT;
Steven Cooremanacda8342020-07-24 23:09:52 +02002931 }
Gilles Peskine2f107ae2024-02-28 01:26:46 +01002932 } else if (PSA_KEY_TYPE_IS_ECC(attributes->type)) {
Gilles Peskine449bd832023-01-11 14:50:10 +01002933 if (PSA_ALG_IS_ECDSA(alg)) {
Ronald Cron4501c982021-03-19 20:09:32 +01002934#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01002935 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
2936 return mbedtls_psa_ecdsa_verify_hash(
2937 attributes,
2938 key_buffer, key_buffer_size,
2939 alg, hash, hash_length,
2940 signature, signature_length);
Ronald Cron4501c982021-03-19 20:09:32 +01002941#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
2942 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Gilles Peskine449bd832023-01-11 14:50:10 +01002943 } else {
2944 return PSA_ERROR_INVALID_ARGUMENT;
Ronald Cron4501c982021-03-19 20:09:32 +01002945 }
Ronald Cron8a494f32021-02-17 09:49:51 +01002946 }
Ronald Cron4501c982021-03-19 20:09:32 +01002947
Gilles Peskine449bd832023-01-11 14:50:10 +01002948 (void) key_buffer;
2949 (void) key_buffer_size;
2950 (void) hash;
2951 (void) hash_length;
2952 (void) signature;
2953 (void) signature_length;
Ronald Cron4501c982021-03-19 20:09:32 +01002954
Gilles Peskine449bd832023-01-11 14:50:10 +01002955 return PSA_ERROR_NOT_SUPPORTED;
Ronald Cron18659932020-12-08 16:32:23 +01002956}
2957
Gilles Peskine449bd832023-01-11 14:50:10 +01002958psa_status_t psa_verify_hash(mbedtls_svc_key_id_t key,
2959 psa_algorithm_t alg,
2960 const uint8_t *hash,
2961 size_t hash_length,
2962 const uint8_t *signature,
2963 size_t signature_length)
itayzafrir5c753392018-05-08 11:18:38 +03002964{
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002965 return psa_verify_internal(
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002966 key, 0, alg, hash, hash_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002967 signature, signature_length);
Gilles Peskinee59236f2018-01-27 23:32:46 +01002968}
2969
Gilles Peskine449bd832023-01-11 14:50:10 +01002970psa_status_t psa_asymmetric_encrypt(mbedtls_svc_key_id_t key,
2971 psa_algorithm_t alg,
2972 const uint8_t *input,
2973 size_t input_length,
2974 const uint8_t *salt,
2975 size_t salt_length,
2976 uint8_t *output,
2977 size_t output_size,
2978 size_t *output_length)
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002979{
Ronald Cronf95a2b12020-10-22 15:24:49 +02002980 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01002981 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01002982 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02002983
Darryl Green5cc689a2018-07-24 15:34:10 +01002984 (void) input;
2985 (void) input_length;
2986 (void) salt;
2987 (void) output;
2988 (void) output_size;
2989
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03002990 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002991
Gilles Peskine449bd832023-01-11 14:50:10 +01002992 if (!PSA_ALG_IS_RSA_OAEP(alg) && salt_length != 0) {
2993 return PSA_ERROR_INVALID_ARGUMENT;
2994 }
Gilles Peskineb3fc05d2018-06-30 19:04:35 +02002995
Valerio Setti5bb454a2024-01-15 10:43:16 +01002996 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002997 key, &slot, PSA_KEY_USAGE_ENCRYPT, alg);
2998 if (status != PSA_SUCCESS) {
2999 return status;
3000 }
3001 if (!(PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type) ||
3002 PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type))) {
Ronald Cronf95a2b12020-10-22 15:24:49 +02003003 status = PSA_ERROR_INVALID_ARGUMENT;
3004 goto exit;
3005 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003006
Przemyslaw Stekiel19e61422021-12-09 11:09:11 +01003007 status = psa_driver_wrapper_asymmetric_encrypt(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01003008 &slot->attr, slot->key.data, slot->key.bytes,
Przemyslaw Stekiel19e61422021-12-09 11:09:11 +01003009 alg, input, input_length, salt, salt_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003010 output, output_size, output_length);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003011exit:
Ryan Everetta103ec92024-01-31 13:59:57 +00003012 unlock_status = psa_unregister_read_under_mutex(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003013
Gilles Peskine449bd832023-01-11 14:50:10 +01003014 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine5b051bc2018-05-31 13:25:48 +02003015}
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003016
Gilles Peskine449bd832023-01-11 14:50:10 +01003017psa_status_t psa_asymmetric_decrypt(mbedtls_svc_key_id_t key,
3018 psa_algorithm_t alg,
3019 const uint8_t *input,
3020 size_t input_length,
3021 const uint8_t *salt,
3022 size_t salt_length,
3023 uint8_t *output,
3024 size_t output_size,
3025 size_t *output_length)
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003026{
Ronald Cronf95a2b12020-10-22 15:24:49 +02003027 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01003028 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01003029 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003030
Darryl Green5cc689a2018-07-24 15:34:10 +01003031 (void) input;
3032 (void) input_length;
3033 (void) salt;
3034 (void) output;
3035 (void) output_size;
3036
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03003037 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003038
Gilles Peskine449bd832023-01-11 14:50:10 +01003039 if (!PSA_ALG_IS_RSA_OAEP(alg) && salt_length != 0) {
3040 return PSA_ERROR_INVALID_ARGUMENT;
3041 }
Gilles Peskineb3fc05d2018-06-30 19:04:35 +02003042
Valerio Setti5bb454a2024-01-15 10:43:16 +01003043 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01003044 key, &slot, PSA_KEY_USAGE_DECRYPT, alg);
3045 if (status != PSA_SUCCESS) {
3046 return status;
3047 }
3048 if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) {
Ronald Cronf95a2b12020-10-22 15:24:49 +02003049 status = PSA_ERROR_INVALID_ARGUMENT;
3050 goto exit;
3051 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003052
Przemyslaw Stekiel8d45c002021-12-13 08:58:19 +01003053 status = psa_driver_wrapper_asymmetric_decrypt(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01003054 &slot->attr, slot->key.data, slot->key.bytes,
Przemyslaw Stekiel8d45c002021-12-13 08:58:19 +01003055 alg, input, input_length, salt, salt_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003056 output, output_size, output_length);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003057
3058exit:
Ryan Everetta103ec92024-01-31 13:59:57 +00003059 unlock_status = psa_unregister_read_under_mutex(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003060
Gilles Peskine449bd832023-01-11 14:50:10 +01003061 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine5b051bc2018-05-31 13:25:48 +02003062}
Gilles Peskinee59236f2018-01-27 23:32:46 +01003063
Paul Elliott9fe12f62022-11-30 19:16:02 +00003064/****************************************************************/
3065/* Asymmetric interruptible cryptography */
3066/****************************************************************/
3067
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003068static uint32_t psa_interruptible_max_ops = PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED;
3069
Paul Elliott9fe12f62022-11-30 19:16:02 +00003070void psa_interruptible_set_max_ops(uint32_t max_ops)
3071{
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003072 psa_interruptible_max_ops = max_ops;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003073}
3074
3075uint32_t psa_interruptible_get_max_ops(void)
3076{
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003077 return psa_interruptible_max_ops;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003078}
3079
Paul Elliott9fe12f62022-11-30 19:16:02 +00003080uint32_t psa_sign_hash_get_num_ops(
3081 const psa_sign_hash_interruptible_operation_t *operation)
3082{
Paul Elliott296ede92022-12-15 17:00:30 +00003083 return operation->num_ops;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003084}
3085
3086uint32_t psa_verify_hash_get_num_ops(
3087 const psa_verify_hash_interruptible_operation_t *operation)
3088{
Paul Elliott296ede92022-12-15 17:00:30 +00003089 return operation->num_ops;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003090}
3091
Paul Elliott59ad9452022-12-18 15:09:02 +00003092static psa_status_t psa_sign_hash_abort_internal(
3093 psa_sign_hash_interruptible_operation_t *operation)
3094{
3095 if (operation->id == 0) {
3096 /* The object has (apparently) been initialized but it is not (yet)
3097 * in use. It's ok to call abort on such an object, and there's
3098 * nothing to do. */
3099 return PSA_SUCCESS;
3100 }
3101
3102 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3103
3104 status = psa_driver_wrapper_sign_hash_abort(operation);
3105
3106 operation->id = 0;
3107
Paul Elliotte6145dc2023-02-07 12:51:21 +00003108 /* Do not clear either the error_occurred or num_ops elements here as they
3109 * only want to be cleared by the application calling abort, not by abort
3110 * being called at completion of an operation. */
3111
Paul Elliott59ad9452022-12-18 15:09:02 +00003112 return status;
3113}
3114
Paul Elliott9fe12f62022-11-30 19:16:02 +00003115psa_status_t psa_sign_hash_start(
3116 psa_sign_hash_interruptible_operation_t *operation,
3117 mbedtls_svc_key_id_t key, psa_algorithm_t alg,
3118 const uint8_t *hash, size_t hash_length)
3119{
3120 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3121 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
3122 psa_key_slot_t *slot;
3123
Paul Elliottc9774412023-02-06 15:14:07 +00003124 /* Check that start has not been previously called, or operation has not
3125 * previously errored. */
3126 if (operation->id != 0 || operation->error_occurred) {
Paul Elliott9fe12f62022-11-30 19:16:02 +00003127 return PSA_ERROR_BAD_STATE;
3128 }
3129
Paul Elliott9fe12f62022-11-30 19:16:02 +00003130 status = psa_sign_verify_check_alg(0, alg);
3131 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003132 operation->error_occurred = 1;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003133 return status;
3134 }
3135
3136 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
3137 PSA_KEY_USAGE_SIGN_HASH,
3138 alg);
3139
3140 if (status != PSA_SUCCESS) {
3141 goto exit;
3142 }
3143
3144 if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) {
3145 status = PSA_ERROR_INVALID_ARGUMENT;
3146 goto exit;
3147 }
3148
Paul Elliott296ede92022-12-15 17:00:30 +00003149 /* Ensure ops count gets reset, in case of operation re-use. */
3150 operation->num_ops = 0;
3151
Gilles Peskine7a5d9202024-02-28 01:18:23 +01003152 status = psa_driver_wrapper_sign_hash_start(operation, &slot->attr,
Paul Elliott9fe12f62022-11-30 19:16:02 +00003153 slot->key.data,
3154 slot->key.bytes, alg,
3155 hash, hash_length);
3156exit:
3157
3158 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003159 operation->error_occurred = 1;
Paul Elliott59ad9452022-12-18 15:09:02 +00003160 psa_sign_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003161 }
3162
Ryan Everettdcc03d52024-02-14 15:44:13 +00003163 unlock_status = psa_unregister_read_under_mutex(slot);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003164
Paul Elliottc9774412023-02-06 15:14:07 +00003165 if (unlock_status != PSA_SUCCESS) {
3166 operation->error_occurred = 1;
3167 }
Paul Elliott9fe12f62022-11-30 19:16:02 +00003168
Paul Elliottc9774412023-02-06 15:14:07 +00003169 return (status == PSA_SUCCESS) ? unlock_status : status;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003170}
3171
3172
3173psa_status_t psa_sign_hash_complete(
3174 psa_sign_hash_interruptible_operation_t *operation,
3175 uint8_t *signature, size_t signature_size,
3176 size_t *signature_length)
3177{
3178 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3179
3180 *signature_length = 0;
3181
Paul Elliottc9774412023-02-06 15:14:07 +00003182 /* Check that start has been called first, and that operation has not
3183 * previously errored. */
3184 if (operation->id == 0 || operation->error_occurred) {
Paul Elliott9fe12f62022-11-30 19:16:02 +00003185 status = PSA_ERROR_BAD_STATE;
3186 goto exit;
3187 }
3188
Paul Elliott096abc42023-02-03 18:33:23 +00003189 /* Immediately reject a zero-length signature buffer. This guarantees that
3190 * signature must be a valid pointer. */
Paul Elliott9fe12f62022-11-30 19:16:02 +00003191 if (signature_size == 0) {
3192 status = PSA_ERROR_BUFFER_TOO_SMALL;
3193 goto exit;
3194 }
3195
3196 status = psa_driver_wrapper_sign_hash_complete(operation, signature,
3197 signature_size,
3198 signature_length);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003199
Paul Elliott296ede92022-12-15 17:00:30 +00003200 /* Update ops count with work done. */
Paul Elliottde1114c2023-02-07 12:43:11 +00003201 operation->num_ops = psa_driver_wrapper_sign_hash_get_num_ops(operation);
Paul Elliott296ede92022-12-15 17:00:30 +00003202
Paul Elliottebe225c2023-02-10 14:32:53 +00003203exit:
3204
Paul Elliott59200a22023-02-21 15:07:40 +00003205 psa_wipe_tag_output_buffer(signature, status, signature_size,
3206 *signature_length);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003207
Paul Elliott53bb3122023-02-10 14:22:22 +00003208 if (status != PSA_OPERATION_INCOMPLETE) {
Paul Elliottc9774412023-02-06 15:14:07 +00003209 if (status != PSA_SUCCESS) {
3210 operation->error_occurred = 1;
3211 }
3212
Paul Elliott59ad9452022-12-18 15:09:02 +00003213 psa_sign_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003214 }
3215
3216 return status;
3217}
3218
3219psa_status_t psa_sign_hash_abort(
3220 psa_sign_hash_interruptible_operation_t *operation)
3221{
Paul Elliott59ad9452022-12-18 15:09:02 +00003222 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3223
3224 status = psa_sign_hash_abort_internal(operation);
3225
3226 /* We clear the number of ops done here, so that it is not cleared when
3227 * the operation fails or succeeds, only on manual abort. */
3228 operation->num_ops = 0;
3229
Paul Elliottc9774412023-02-06 15:14:07 +00003230 /* Likewise, failure state. */
3231 operation->error_occurred = 0;
3232
Paul Elliott59ad9452022-12-18 15:09:02 +00003233 return status;
3234}
3235
3236static psa_status_t psa_verify_hash_abort_internal(
3237 psa_verify_hash_interruptible_operation_t *operation)
3238{
Paul Elliott9fe12f62022-11-30 19:16:02 +00003239 if (operation->id == 0) {
3240 /* The object has (apparently) been initialized but it is not (yet)
3241 * in use. It's ok to call abort on such an object, and there's
3242 * nothing to do. */
3243 return PSA_SUCCESS;
3244 }
3245
Paul Elliott59ad9452022-12-18 15:09:02 +00003246 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3247
3248 status = psa_driver_wrapper_verify_hash_abort(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003249
3250 operation->id = 0;
3251
Paul Elliotte6145dc2023-02-07 12:51:21 +00003252 /* Do not clear either the error_occurred or num_ops elements here as they
3253 * only want to be cleared by the application calling abort, not by abort
3254 * being called at completion of an operation. */
3255
Paul Elliott59ad9452022-12-18 15:09:02 +00003256 return status;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003257}
3258
3259psa_status_t psa_verify_hash_start(
3260 psa_verify_hash_interruptible_operation_t *operation,
3261 mbedtls_svc_key_id_t key, psa_algorithm_t alg,
3262 const uint8_t *hash, size_t hash_length,
3263 const uint8_t *signature, size_t signature_length)
3264{
3265 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3266 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
3267 psa_key_slot_t *slot;
3268
Paul Elliottc9774412023-02-06 15:14:07 +00003269 /* Check that start has not been previously called, or operation has not
3270 * previously errored. */
3271 if (operation->id != 0 || operation->error_occurred) {
Paul Elliott9fe12f62022-11-30 19:16:02 +00003272 return PSA_ERROR_BAD_STATE;
3273 }
3274
3275 status = psa_sign_verify_check_alg(0, alg);
3276 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003277 operation->error_occurred = 1;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003278 return status;
3279 }
3280
3281 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
3282 PSA_KEY_USAGE_VERIFY_HASH,
3283 alg);
3284
3285 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003286 operation->error_occurred = 1;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003287 return status;
3288 }
3289
Paul Elliott296ede92022-12-15 17:00:30 +00003290 /* Ensure ops count gets reset, in case of operation re-use. */
3291 operation->num_ops = 0;
3292
Gilles Peskine7a5d9202024-02-28 01:18:23 +01003293 status = psa_driver_wrapper_verify_hash_start(operation, &slot->attr,
Paul Elliott9fe12f62022-11-30 19:16:02 +00003294 slot->key.data,
3295 slot->key.bytes,
3296 alg, hash, hash_length,
3297 signature, signature_length);
3298
3299 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003300 operation->error_occurred = 1;
Paul Elliott59ad9452022-12-18 15:09:02 +00003301 psa_verify_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003302 }
3303
Ryan Everett291267f2024-02-14 15:59:15 +00003304 unlock_status = psa_unregister_read_under_mutex(slot);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003305
Paul Elliottc9774412023-02-06 15:14:07 +00003306 if (unlock_status != PSA_SUCCESS) {
3307 operation->error_occurred = 1;
3308 }
Paul Elliott9fe12f62022-11-30 19:16:02 +00003309
Paul Elliottc9774412023-02-06 15:14:07 +00003310 return (status == PSA_SUCCESS) ? unlock_status : status;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003311}
3312
3313psa_status_t psa_verify_hash_complete(
3314 psa_verify_hash_interruptible_operation_t *operation)
3315{
3316 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3317
Paul Elliottc9774412023-02-06 15:14:07 +00003318 /* Check that start has been called first, and that operation has not
3319 * previously errored. */
3320 if (operation->id == 0 || operation->error_occurred) {
Paul Elliott9fe12f62022-11-30 19:16:02 +00003321 status = PSA_ERROR_BAD_STATE;
3322 goto exit;
3323 }
3324
3325 status = psa_driver_wrapper_verify_hash_complete(operation);
3326
Paul Elliott296ede92022-12-15 17:00:30 +00003327 /* Update ops count with work done. */
Paul Elliottde1114c2023-02-07 12:43:11 +00003328 operation->num_ops = psa_driver_wrapper_verify_hash_get_num_ops(
Paul Elliott296ede92022-12-15 17:00:30 +00003329 operation);
3330
Paul Elliottebe225c2023-02-10 14:32:53 +00003331exit:
3332
Paul Elliott9fe12f62022-11-30 19:16:02 +00003333 if (status != PSA_OPERATION_INCOMPLETE) {
Paul Elliottc9774412023-02-06 15:14:07 +00003334 if (status != PSA_SUCCESS) {
3335 operation->error_occurred = 1;
3336 }
3337
Paul Elliott59ad9452022-12-18 15:09:02 +00003338 psa_verify_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003339 }
3340
3341 return status;
3342}
3343
3344psa_status_t psa_verify_hash_abort(
3345 psa_verify_hash_interruptible_operation_t *operation)
3346{
Paul Elliott59ad9452022-12-18 15:09:02 +00003347 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003348
Paul Elliott59ad9452022-12-18 15:09:02 +00003349 status = psa_verify_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003350
Paul Elliott59ad9452022-12-18 15:09:02 +00003351 /* We clear the number of ops done here, so that it is not cleared when
3352 * the operation fails or succeeds, only on manual abort. */
3353 operation->num_ops = 0;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003354
Paul Elliottc9774412023-02-06 15:14:07 +00003355 /* Likewise, failure state. */
3356 operation->error_occurred = 0;
3357
Paul Elliott59ad9452022-12-18 15:09:02 +00003358 return status;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003359}
3360
Paul Elliott588f8ed2022-12-02 18:10:26 +00003361/****************************************************************/
3362/* Asymmetric interruptible cryptography internal */
3363/* implementations */
3364/****************************************************************/
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02003365
Paul Elliott588f8ed2022-12-02 18:10:26 +00003366void mbedtls_psa_interruptible_set_max_ops(uint32_t max_ops)
3367{
Paul Elliott7cc4e812023-01-10 17:14:11 +00003368
Paul Elliott588f8ed2022-12-02 18:10:26 +00003369#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3370 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3371 defined(MBEDTLS_ECP_RESTARTABLE)
3372
3373 /* Internal implementation uses zero to indicate infinite number max ops,
3374 * therefore avoid this value, and set to minimum possible. */
3375 if (max_ops == 0) {
3376 max_ops = 1;
3377 }
3378
Paul Elliott588f8ed2022-12-02 18:10:26 +00003379 mbedtls_ecp_set_max_ops(max_ops);
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003380#else
3381 (void) max_ops;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003382#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3383 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3384 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3385}
3386
Paul Elliott588f8ed2022-12-02 18:10:26 +00003387uint32_t mbedtls_psa_sign_hash_get_num_ops(
Paul Elliottf8e5b562023-02-19 18:43:45 +00003388 const mbedtls_psa_sign_hash_interruptible_operation_t *operation)
Paul Elliott588f8ed2022-12-02 18:10:26 +00003389{
3390#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3391 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3392 defined(MBEDTLS_ECP_RESTARTABLE)
3393
Paul Elliott93d9ca82023-02-15 18:14:21 +00003394 return operation->num_ops;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003395#else
3396 (void) operation;
3397 return 0;
3398#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3399 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3400 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3401}
3402
3403uint32_t mbedtls_psa_verify_hash_get_num_ops(
Paul Elliottf8e5b562023-02-19 18:43:45 +00003404 const mbedtls_psa_verify_hash_interruptible_operation_t *operation)
Paul Elliott588f8ed2022-12-02 18:10:26 +00003405{
3406 #if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3407 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3408 defined(MBEDTLS_ECP_RESTARTABLE)
3409
Paul Elliott93d9ca82023-02-15 18:14:21 +00003410 return operation->num_ops;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003411#else
3412 (void) operation;
3413 return 0;
3414#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3415 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3416 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3417}
3418
3419psa_status_t mbedtls_psa_sign_hash_start(
3420 mbedtls_psa_sign_hash_interruptible_operation_t *operation,
3421 const psa_key_attributes_t *attributes, const uint8_t *key_buffer,
3422 size_t key_buffer_size, psa_algorithm_t alg,
3423 const uint8_t *hash, size_t hash_length)
3424{
3425 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott0290a762023-02-09 14:30:24 +00003426 size_t required_hash_length;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003427
Gilles Peskine2f107ae2024-02-28 01:26:46 +01003428 if (!PSA_KEY_TYPE_IS_ECC(attributes->type)) {
Paul Elliott068fe072023-01-16 13:59:15 +00003429 return PSA_ERROR_NOT_SUPPORTED;
3430 }
3431
3432 if (!PSA_ALG_IS_ECDSA(alg)) {
Paul Elliott813f9cd2023-02-05 15:28:46 +00003433 return PSA_ERROR_NOT_SUPPORTED;
Paul Elliott068fe072023-01-16 13:59:15 +00003434 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003435
3436#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
Paul Elliott068fe072023-01-16 13:59:15 +00003437 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3438 defined(MBEDTLS_ECP_RESTARTABLE)
Paul Elliott588f8ed2022-12-02 18:10:26 +00003439
Paul Elliotta1c94092023-02-15 16:38:04 +00003440 mbedtls_ecdsa_restart_init(&operation->restart_ctx);
3441
Paul Elliott93d9ca82023-02-15 18:14:21 +00003442 /* Ensure num_ops is zero'ed in case of context re-use. */
3443 operation->num_ops = 0;
3444
Gilles Peskine2f107ae2024-02-28 01:26:46 +01003445 status = mbedtls_psa_ecp_load_representation(attributes->type,
3446 attributes->bits,
Paul Elliott068fe072023-01-16 13:59:15 +00003447 key_buffer,
3448 key_buffer_size,
3449 &operation->ctx);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003450
Paul Elliott068fe072023-01-16 13:59:15 +00003451 if (status != PSA_SUCCESS) {
3452 return status;
3453 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003454
Paul Elliott1bc59df2023-02-05 13:41:57 +00003455 operation->coordinate_bytes = PSA_BITS_TO_BYTES(
Paul Elliottc569fc22023-02-10 13:02:54 +00003456 operation->ctx->grp.nbits);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003457
Paul Elliott068fe072023-01-16 13:59:15 +00003458 psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH(alg);
Manuel Pégourié-Gonnard2d6d9932023-03-28 11:38:08 +02003459 operation->md_alg = mbedtls_md_type_from_psa_alg(hash_alg);
Paul Elliott068fe072023-01-16 13:59:15 +00003460 operation->alg = alg;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003461
Paul Elliott0290a762023-02-09 14:30:24 +00003462 /* We only need to store the same length of hash as the private key size
3463 * here, it would be truncated by the internal implementation anyway. */
3464 required_hash_length = (hash_length < operation->coordinate_bytes ?
3465 hash_length : operation->coordinate_bytes);
3466
Paul Elliottba70ad42023-02-15 18:23:53 +00003467 if (required_hash_length > sizeof(operation->hash)) {
3468 /* Shouldn't happen, but better safe than sorry. */
3469 return PSA_ERROR_CORRUPTION_DETECTED;
3470 }
3471
Paul Elliott0290a762023-02-09 14:30:24 +00003472 memcpy(operation->hash, hash, required_hash_length);
3473 operation->hash_length = required_hash_length;
Paul Elliott068fe072023-01-16 13:59:15 +00003474
3475 return PSA_SUCCESS;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003476
3477#else
Paul Elliott068fe072023-01-16 13:59:15 +00003478 (void) operation;
3479 (void) key_buffer;
3480 (void) key_buffer_size;
3481 (void) alg;
3482 (void) hash;
3483 (void) hash_length;
3484 (void) status;
Paul Elliott0290a762023-02-09 14:30:24 +00003485 (void) required_hash_length;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003486
Paul Elliott068fe072023-01-16 13:59:15 +00003487 return PSA_ERROR_NOT_SUPPORTED;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003488#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3489 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3490 * defined( MBEDTLS_ECP_RESTARTABLE ) */
Paul Elliott588f8ed2022-12-02 18:10:26 +00003491}
3492
3493psa_status_t mbedtls_psa_sign_hash_complete(
3494 mbedtls_psa_sign_hash_interruptible_operation_t *operation,
3495 uint8_t *signature, size_t signature_size,
3496 size_t *signature_length)
3497{
Paul Elliott588f8ed2022-12-02 18:10:26 +00003498#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3499 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3500 defined(MBEDTLS_ECP_RESTARTABLE)
3501
Paul Elliotta1c94092023-02-15 16:38:04 +00003502 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott1243f932023-02-07 11:21:10 +00003503 mbedtls_mpi r;
3504 mbedtls_mpi s;
3505
Paul Elliott46845252023-02-03 14:59:11 +00003506 mbedtls_mpi_init(&r);
3507 mbedtls_mpi_init(&s);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003508
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003509 /* Ensure max_ops is set to the current value (or default). */
3510 mbedtls_psa_interruptible_set_max_ops(psa_interruptible_get_max_ops());
3511
Paul Elliotta1c94092023-02-15 16:38:04 +00003512 if (signature_size < 2 * operation->coordinate_bytes) {
3513 status = PSA_ERROR_BUFFER_TOO_SMALL;
3514 goto exit;
3515 }
3516
Paul Elliott588f8ed2022-12-02 18:10:26 +00003517 if (PSA_ALG_ECDSA_IS_DETERMINISTIC(operation->alg)) {
Paul Elliott46845252023-02-03 14:59:11 +00003518
Paul Elliott588f8ed2022-12-02 18:10:26 +00003519#if defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
3520 status = mbedtls_to_psa_error(
3521 mbedtls_ecdsa_sign_det_restartable(&operation->ctx->grp,
Paul Elliott46845252023-02-03 14:59:11 +00003522 &r,
3523 &s,
Paul Elliott588f8ed2022-12-02 18:10:26 +00003524 &operation->ctx->d,
3525 operation->hash,
3526 operation->hash_length,
3527 operation->md_alg,
3528 mbedtls_psa_get_random,
3529 MBEDTLS_PSA_RANDOM_STATE,
3530 &operation->restart_ctx));
3531#else /* defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Paul Elliott724bd252023-02-08 12:35:08 +00003532 status = PSA_ERROR_NOT_SUPPORTED;
3533 goto exit;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003534#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
3535 } else {
Paul Elliott588f8ed2022-12-02 18:10:26 +00003536 status = mbedtls_to_psa_error(
3537 mbedtls_ecdsa_sign_restartable(&operation->ctx->grp,
Paul Elliott46845252023-02-03 14:59:11 +00003538 &r,
3539 &s,
Paul Elliott588f8ed2022-12-02 18:10:26 +00003540 &operation->ctx->d,
3541 operation->hash,
3542 operation->hash_length,
3543 mbedtls_psa_get_random,
3544 MBEDTLS_PSA_RANDOM_STATE,
3545 mbedtls_psa_get_random,
3546 MBEDTLS_PSA_RANDOM_STATE,
3547 &operation->restart_ctx));
3548 }
3549
Paul Elliottf8e5b562023-02-19 18:43:45 +00003550 /* Hide the fact that the restart context only holds a delta of number of
3551 * ops done during the last operation, not an absolute value. */
3552 operation->num_ops += operation->restart_ctx.ecp.ops_done;
3553
Paul Elliott724bd252023-02-08 12:35:08 +00003554 if (status == PSA_SUCCESS) {
Paul Elliott588f8ed2022-12-02 18:10:26 +00003555 status = mbedtls_to_psa_error(
Paul Elliott46845252023-02-03 14:59:11 +00003556 mbedtls_mpi_write_binary(&r,
Paul Elliott588f8ed2022-12-02 18:10:26 +00003557 signature,
Paul Elliott1bc59df2023-02-05 13:41:57 +00003558 operation->coordinate_bytes)
3559 );
Paul Elliott588f8ed2022-12-02 18:10:26 +00003560
3561 if (status != PSA_SUCCESS) {
Paul Elliott724bd252023-02-08 12:35:08 +00003562 goto exit;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003563 }
3564
3565 status = mbedtls_to_psa_error(
Paul Elliott46845252023-02-03 14:59:11 +00003566 mbedtls_mpi_write_binary(&s,
Paul Elliott588f8ed2022-12-02 18:10:26 +00003567 signature +
Paul Elliott1bc59df2023-02-05 13:41:57 +00003568 operation->coordinate_bytes,
3569 operation->coordinate_bytes)
3570 );
Paul Elliott588f8ed2022-12-02 18:10:26 +00003571
3572 if (status != PSA_SUCCESS) {
Paul Elliott724bd252023-02-08 12:35:08 +00003573 goto exit;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003574 }
3575
Paul Elliott1bc59df2023-02-05 13:41:57 +00003576 *signature_length = operation->coordinate_bytes * 2;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003577
Paul Elliott724bd252023-02-08 12:35:08 +00003578 status = PSA_SUCCESS;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003579 }
Paul Elliott724bd252023-02-08 12:35:08 +00003580
3581exit:
3582
3583 mbedtls_mpi_free(&r);
3584 mbedtls_mpi_free(&s);
3585 return status;
3586
Paul Elliott588f8ed2022-12-02 18:10:26 +00003587 #else
3588
3589 (void) operation;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003590 (void) signature;
3591 (void) signature_size;
3592 (void) signature_length;
3593
3594 return PSA_ERROR_NOT_SUPPORTED;
3595
3596#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3597 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3598 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3599}
3600
3601psa_status_t mbedtls_psa_sign_hash_abort(
3602 mbedtls_psa_sign_hash_interruptible_operation_t *operation)
3603{
3604
3605#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3606 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3607 defined(MBEDTLS_ECP_RESTARTABLE)
3608
3609 if (operation->ctx) {
3610 mbedtls_ecdsa_free(operation->ctx);
3611 mbedtls_free(operation->ctx);
Paul Elliottf9c91a72023-02-05 18:06:38 +00003612 operation->ctx = NULL;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003613 }
3614
3615 mbedtls_ecdsa_restart_free(&operation->restart_ctx);
3616
Paul Elliott93d9ca82023-02-15 18:14:21 +00003617 operation->num_ops = 0;
3618
Paul Elliott588f8ed2022-12-02 18:10:26 +00003619 return PSA_SUCCESS;
3620
3621#else
3622
3623 (void) operation;
3624
3625 return PSA_ERROR_NOT_SUPPORTED;
3626
3627#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3628 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3629 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3630}
3631
3632psa_status_t mbedtls_psa_verify_hash_start(
3633 mbedtls_psa_verify_hash_interruptible_operation_t *operation,
3634 const psa_key_attributes_t *attributes,
3635 const uint8_t *key_buffer, size_t key_buffer_size,
3636 psa_algorithm_t alg,
3637 const uint8_t *hash, size_t hash_length,
3638 const uint8_t *signature, size_t signature_length)
3639{
3640 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott1bc59df2023-02-05 13:41:57 +00003641 size_t coordinate_bytes = 0;
Paul Elliott0290a762023-02-09 14:30:24 +00003642 size_t required_hash_length = 0;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003643
Gilles Peskine2f107ae2024-02-28 01:26:46 +01003644 if (!PSA_KEY_TYPE_IS_ECC(attributes->type)) {
Paul Elliott068fe072023-01-16 13:59:15 +00003645 return PSA_ERROR_NOT_SUPPORTED;
3646 }
3647
3648 if (!PSA_ALG_IS_ECDSA(alg)) {
Paul Elliott813f9cd2023-02-05 15:28:46 +00003649 return PSA_ERROR_NOT_SUPPORTED;
Paul Elliott068fe072023-01-16 13:59:15 +00003650 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003651
3652#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
Paul Elliott068fe072023-01-16 13:59:15 +00003653 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3654 defined(MBEDTLS_ECP_RESTARTABLE)
Paul Elliott588f8ed2022-12-02 18:10:26 +00003655
Paul Elliotta1c94092023-02-15 16:38:04 +00003656 mbedtls_ecdsa_restart_init(&operation->restart_ctx);
3657 mbedtls_mpi_init(&operation->r);
3658 mbedtls_mpi_init(&operation->s);
3659
Paul Elliott93d9ca82023-02-15 18:14:21 +00003660 /* Ensure num_ops is zero'ed in case of context re-use. */
3661 operation->num_ops = 0;
3662
Gilles Peskine2f107ae2024-02-28 01:26:46 +01003663 status = mbedtls_psa_ecp_load_representation(attributes->type,
3664 attributes->bits,
Paul Elliott068fe072023-01-16 13:59:15 +00003665 key_buffer,
3666 key_buffer_size,
3667 &operation->ctx);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003668
Paul Elliott068fe072023-01-16 13:59:15 +00003669 if (status != PSA_SUCCESS) {
3670 return status;
3671 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003672
Paul Elliottc569fc22023-02-10 13:02:54 +00003673 coordinate_bytes = PSA_BITS_TO_BYTES(operation->ctx->grp.nbits);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003674
Paul Elliott1bc59df2023-02-05 13:41:57 +00003675 if (signature_length != 2 * coordinate_bytes) {
Paul Elliott068fe072023-01-16 13:59:15 +00003676 return PSA_ERROR_INVALID_SIGNATURE;
3677 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003678
Paul Elliott068fe072023-01-16 13:59:15 +00003679 status = mbedtls_to_psa_error(
3680 mbedtls_mpi_read_binary(&operation->r,
3681 signature,
Paul Elliott1bc59df2023-02-05 13:41:57 +00003682 coordinate_bytes));
Paul Elliott588f8ed2022-12-02 18:10:26 +00003683
Paul Elliott068fe072023-01-16 13:59:15 +00003684 if (status != PSA_SUCCESS) {
3685 return status;
3686 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003687
Paul Elliott068fe072023-01-16 13:59:15 +00003688 status = mbedtls_to_psa_error(
3689 mbedtls_mpi_read_binary(&operation->s,
3690 signature +
Paul Elliott1bc59df2023-02-05 13:41:57 +00003691 coordinate_bytes,
3692 coordinate_bytes));
Paul Elliott588f8ed2022-12-02 18:10:26 +00003693
Paul Elliott068fe072023-01-16 13:59:15 +00003694 if (status != PSA_SUCCESS) {
3695 return status;
3696 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003697
Paul Elliott2c9843f2023-02-15 17:32:42 +00003698 status = mbedtls_psa_ecp_load_public_part(operation->ctx);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003699
Paul Elliott2c9843f2023-02-15 17:32:42 +00003700 if (status != PSA_SUCCESS) {
3701 return status;
Paul Elliott068fe072023-01-16 13:59:15 +00003702 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003703
Paul Elliott0290a762023-02-09 14:30:24 +00003704 /* We only need to store the same length of hash as the private key size
3705 * here, it would be truncated by the internal implementation anyway. */
3706 required_hash_length = (hash_length < coordinate_bytes ? hash_length :
3707 coordinate_bytes);
3708
Paul Elliottba70ad42023-02-15 18:23:53 +00003709 if (required_hash_length > sizeof(operation->hash)) {
3710 /* Shouldn't happen, but better safe than sorry. */
3711 return PSA_ERROR_CORRUPTION_DETECTED;
3712 }
3713
Paul Elliott0290a762023-02-09 14:30:24 +00003714 memcpy(operation->hash, hash, required_hash_length);
3715 operation->hash_length = required_hash_length;
Paul Elliott068fe072023-01-16 13:59:15 +00003716
3717 return PSA_SUCCESS;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003718#else
Paul Elliott068fe072023-01-16 13:59:15 +00003719 (void) operation;
3720 (void) key_buffer;
3721 (void) key_buffer_size;
3722 (void) alg;
3723 (void) hash;
3724 (void) hash_length;
3725 (void) signature;
3726 (void) signature_length;
3727 (void) status;
Paul Elliott1243f932023-02-07 11:21:10 +00003728 (void) coordinate_bytes;
Paul Elliott0290a762023-02-09 14:30:24 +00003729 (void) required_hash_length;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003730
Paul Elliott068fe072023-01-16 13:59:15 +00003731 return PSA_ERROR_NOT_SUPPORTED;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003732#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3733 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3734 * defined( MBEDTLS_ECP_RESTARTABLE ) */
Paul Elliott588f8ed2022-12-02 18:10:26 +00003735}
3736
3737psa_status_t mbedtls_psa_verify_hash_complete(
3738 mbedtls_psa_verify_hash_interruptible_operation_t *operation)
3739{
3740
3741#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3742 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3743 defined(MBEDTLS_ECP_RESTARTABLE)
3744
Paul Elliottf8e5b562023-02-19 18:43:45 +00003745 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3746
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003747 /* Ensure max_ops is set to the current value (or default). */
3748 mbedtls_psa_interruptible_set_max_ops(psa_interruptible_get_max_ops());
3749
Paul Elliottf8e5b562023-02-19 18:43:45 +00003750 status = mbedtls_to_psa_error(
Paul Elliott588f8ed2022-12-02 18:10:26 +00003751 mbedtls_ecdsa_verify_restartable(&operation->ctx->grp,
3752 operation->hash,
3753 operation->hash_length,
3754 &operation->ctx->Q,
3755 &operation->r,
3756 &operation->s,
3757 &operation->restart_ctx));
3758
Paul Elliottf8e5b562023-02-19 18:43:45 +00003759 /* Hide the fact that the restart context only holds a delta of number of
3760 * ops done during the last operation, not an absolute value. */
3761 operation->num_ops += operation->restart_ctx.ecp.ops_done;
3762
3763 return status;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003764#else
3765 (void) operation;
3766
3767 return PSA_ERROR_NOT_SUPPORTED;
3768
3769#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3770 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3771 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3772}
3773
3774psa_status_t mbedtls_psa_verify_hash_abort(
3775 mbedtls_psa_verify_hash_interruptible_operation_t *operation)
3776{
3777
3778#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3779 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3780 defined(MBEDTLS_ECP_RESTARTABLE)
3781
3782 if (operation->ctx) {
3783 mbedtls_ecdsa_free(operation->ctx);
3784 mbedtls_free(operation->ctx);
Paul Elliottf9c91a72023-02-05 18:06:38 +00003785 operation->ctx = NULL;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003786 }
3787
3788 mbedtls_ecdsa_restart_free(&operation->restart_ctx);
3789
Paul Elliott93d9ca82023-02-15 18:14:21 +00003790 operation->num_ops = 0;
3791
Paul Elliott588f8ed2022-12-02 18:10:26 +00003792 mbedtls_mpi_free(&operation->r);
3793 mbedtls_mpi_free(&operation->s);
3794
3795 return PSA_SUCCESS;
3796
3797#else
3798 (void) operation;
3799
3800 return PSA_ERROR_NOT_SUPPORTED;
3801
3802#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3803 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3804 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3805}
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02003806
mohammad1603503973b2018-03-12 15:59:30 +02003807/****************************************************************/
3808/* Symmetric cryptography */
3809/****************************************************************/
3810
Gilles Peskine449bd832023-01-11 14:50:10 +01003811static psa_status_t psa_cipher_setup(psa_cipher_operation_t *operation,
3812 mbedtls_svc_key_id_t key,
3813 psa_algorithm_t alg,
3814 mbedtls_operation_t cipher_operation)
Ronald Cronab99ac22020-10-01 16:38:28 +02003815{
3816 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3817 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Dave Rodgman54648242021-06-24 11:49:45 +01003818 psa_key_slot_t *slot = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01003819 psa_key_usage_t usage = (cipher_operation == MBEDTLS_ENCRYPT ?
3820 PSA_KEY_USAGE_ENCRYPT :
3821 PSA_KEY_USAGE_DECRYPT);
Ronald Cronab99ac22020-10-01 16:38:28 +02003822
3823 /* A context must be freshly initialized before it can be set up. */
Gilles Peskine449bd832023-01-11 14:50:10 +01003824 if (operation->id != 0) {
Dave Rodgman54648242021-06-24 11:49:45 +01003825 status = PSA_ERROR_BAD_STATE;
3826 goto exit;
3827 }
Ronald Cronab99ac22020-10-01 16:38:28 +02003828
Gilles Peskine449bd832023-01-11 14:50:10 +01003829 if (!PSA_ALG_IS_CIPHER(alg)) {
Dave Rodgman54648242021-06-24 11:49:45 +01003830 status = PSA_ERROR_INVALID_ARGUMENT;
3831 goto exit;
3832 }
Ronald Cronab99ac22020-10-01 16:38:28 +02003833
Gilles Peskine449bd832023-01-11 14:50:10 +01003834 status = psa_get_and_lock_key_slot_with_policy(key, &slot, usage, alg);
3835 if (status != PSA_SUCCESS) {
Ronald Cronab99ac22020-10-01 16:38:28 +02003836 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01003837 }
Ronald Cronab99ac22020-10-01 16:38:28 +02003838
Ronald Cron49fafa92021-03-10 08:34:23 +01003839 /* Initialize the operation struct members, except for id. The id member
Ronald Cronab99ac22020-10-01 16:38:28 +02003840 * is used to indicate to psa_cipher_abort that there are resources to free,
Ronald Cron49fafa92021-03-10 08:34:23 +01003841 * so we only set it (in the driver wrapper) after resources have been
3842 * allocated/initialized. */
Ronald Cronab99ac22020-10-01 16:38:28 +02003843 operation->iv_set = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01003844 if (alg == PSA_ALG_ECB_NO_PADDING) {
Ronald Cronab99ac22020-10-01 16:38:28 +02003845 operation->iv_required = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01003846 } else {
Ronald Cronab99ac22020-10-01 16:38:28 +02003847 operation->iv_required = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01003848 }
3849 operation->default_iv_length = PSA_CIPHER_IV_LENGTH(slot->attr.type, alg);
Ronald Cronab99ac22020-10-01 16:38:28 +02003850
3851 /* Try doing the operation through a driver before using software fallback. */
Gilles Peskine449bd832023-01-11 14:50:10 +01003852 if (cipher_operation == MBEDTLS_ENCRYPT) {
3853 status = psa_driver_wrapper_cipher_encrypt_setup(operation,
Gilles Peskine7a5d9202024-02-28 01:18:23 +01003854 &slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01003855 slot->key.data,
3856 slot->key.bytes,
3857 alg);
3858 } else {
3859 status = psa_driver_wrapper_cipher_decrypt_setup(operation,
Gilles Peskine7a5d9202024-02-28 01:18:23 +01003860 &slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01003861 slot->key.data,
3862 slot->key.bytes,
3863 alg);
3864 }
Ronald Cronab99ac22020-10-01 16:38:28 +02003865
Gilles Peskine9ab61b62019-02-25 17:43:14 +01003866exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01003867 if (status != PSA_SUCCESS) {
3868 psa_cipher_abort(operation);
3869 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02003870
Ryan Everettc0053cc2024-02-14 16:27:13 +00003871 unlock_status = psa_unregister_read_under_mutex(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003872
Gilles Peskine449bd832023-01-11 14:50:10 +01003873 return (status == PSA_SUCCESS) ? unlock_status : status;
mohammad1603503973b2018-03-12 15:59:30 +02003874}
3875
Gilles Peskine449bd832023-01-11 14:50:10 +01003876psa_status_t psa_cipher_encrypt_setup(psa_cipher_operation_t *operation,
3877 mbedtls_svc_key_id_t key,
3878 psa_algorithm_t alg)
mohammad16038481e742018-03-18 13:57:31 +02003879{
Gilles Peskine449bd832023-01-11 14:50:10 +01003880 return psa_cipher_setup(operation, key, alg, MBEDTLS_ENCRYPT);
mohammad16038481e742018-03-18 13:57:31 +02003881}
3882
Gilles Peskine449bd832023-01-11 14:50:10 +01003883psa_status_t psa_cipher_decrypt_setup(psa_cipher_operation_t *operation,
3884 mbedtls_svc_key_id_t key,
3885 psa_algorithm_t alg)
mohammad16038481e742018-03-18 13:57:31 +02003886{
Gilles Peskine449bd832023-01-11 14:50:10 +01003887 return psa_cipher_setup(operation, key, alg, MBEDTLS_DECRYPT);
mohammad16038481e742018-03-18 13:57:31 +02003888}
3889
Gilles Peskine449bd832023-01-11 14:50:10 +01003890psa_status_t psa_cipher_generate_iv(psa_cipher_operation_t *operation,
3891 uint8_t *iv,
3892 size_t iv_size,
3893 size_t *iv_length)
mohammad1603503973b2018-03-12 15:59:30 +02003894{
Ronald Cron6d051732020-10-01 14:10:20 +02003895 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron2fb90522021-07-05 12:31:44 +02003896 uint8_t local_iv[PSA_CIPHER_IV_MAX_SIZE];
Sergeybef1f632023-03-06 15:25:06 -07003897 size_t default_iv_length = 0;
Ronald Cron5618a392021-03-26 09:52:26 +01003898
Gilles Peskine449bd832023-01-11 14:50:10 +01003899 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01003900 status = PSA_ERROR_BAD_STATE;
3901 goto exit;
Ronald Cronc45b4af2020-09-29 16:18:05 +02003902 }
3903
Gilles Peskine449bd832023-01-11 14:50:10 +01003904 if (operation->iv_set || !operation->iv_required) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01003905 status = PSA_ERROR_BAD_STATE;
3906 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02003907 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02003908
Ronald Cron2fb90522021-07-05 12:31:44 +02003909 default_iv_length = operation->default_iv_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01003910 if (iv_size < default_iv_length) {
Ronald Cron5618a392021-03-26 09:52:26 +01003911 status = PSA_ERROR_BUFFER_TOO_SMALL;
3912 goto exit;
3913 }
Gilles Peskinee553c652018-06-04 16:22:46 +02003914
Gilles Peskine449bd832023-01-11 14:50:10 +01003915 if (default_iv_length > PSA_CIPHER_IV_MAX_SIZE) {
Ronald Cron2fb90522021-07-05 12:31:44 +02003916 status = PSA_ERROR_GENERIC_ERROR;
3917 goto exit;
3918 }
3919
Gilles Peskine449bd832023-01-11 14:50:10 +01003920 status = psa_generate_random(local_iv, default_iv_length);
3921 if (status != PSA_SUCCESS) {
Ronald Cron5618a392021-03-26 09:52:26 +01003922 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01003923 }
Ronald Cron5618a392021-03-26 09:52:26 +01003924
Gilles Peskine449bd832023-01-11 14:50:10 +01003925 status = psa_driver_wrapper_cipher_set_iv(operation,
3926 local_iv, default_iv_length);
Ronald Cron5618a392021-03-26 09:52:26 +01003927
3928exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01003929 if (status == PSA_SUCCESS) {
3930 memcpy(iv, local_iv, default_iv_length);
Ronald Cron2fb90522021-07-05 12:31:44 +02003931 *iv_length = default_iv_length;
Steven Cooreman7df02922020-09-09 15:28:49 +02003932 operation->iv_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01003933 } else {
Ronald Cron2fb90522021-07-05 12:31:44 +02003934 *iv_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01003935 psa_cipher_abort(operation);
Ronald Cron2fb90522021-07-05 12:31:44 +02003936 }
Ronald Cron6d051732020-10-01 14:10:20 +02003937
Gilles Peskine449bd832023-01-11 14:50:10 +01003938 return status;
mohammad1603503973b2018-03-12 15:59:30 +02003939}
3940
Gilles Peskine449bd832023-01-11 14:50:10 +01003941psa_status_t psa_cipher_set_iv(psa_cipher_operation_t *operation,
3942 const uint8_t *iv,
3943 size_t iv_length)
mohammad1603503973b2018-03-12 15:59:30 +02003944{
Ronald Cron6d051732020-10-01 14:10:20 +02003945 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cronc45b4af2020-09-29 16:18:05 +02003946
Gilles Peskine449bd832023-01-11 14:50:10 +01003947 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01003948 status = PSA_ERROR_BAD_STATE;
3949 goto exit;
3950 }
Ronald Cronc45b4af2020-09-29 16:18:05 +02003951
Gilles Peskine449bd832023-01-11 14:50:10 +01003952 if (operation->iv_set || !operation->iv_required) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01003953 status = PSA_ERROR_BAD_STATE;
3954 goto exit;
3955 }
Ronald Crona0d68172021-03-26 10:15:08 +01003956
Gilles Peskine449bd832023-01-11 14:50:10 +01003957 if (iv_length > PSA_CIPHER_IV_MAX_SIZE) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01003958 status = PSA_ERROR_INVALID_ARGUMENT;
3959 goto exit;
3960 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02003961
Gilles Peskine449bd832023-01-11 14:50:10 +01003962 status = psa_driver_wrapper_cipher_set_iv(operation,
3963 iv,
3964 iv_length);
Steven Cooremand3feccd2020-09-01 15:56:14 +02003965
Dave Rodgman38e62ae2021-06-23 11:38:39 +01003966exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01003967 if (status == PSA_SUCCESS) {
itayzafrir534bd7c2018-08-02 13:56:32 +03003968 operation->iv_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01003969 } else {
3970 psa_cipher_abort(operation);
3971 }
3972 return status;
mohammad1603503973b2018-03-12 15:59:30 +02003973}
3974
Gilles Peskine449bd832023-01-11 14:50:10 +01003975psa_status_t psa_cipher_update(psa_cipher_operation_t *operation,
3976 const uint8_t *input,
3977 size_t input_length,
3978 uint8_t *output,
3979 size_t output_size,
3980 size_t *output_length)
mohammad1603503973b2018-03-12 15:59:30 +02003981{
Steven Cooremanffecb7b2020-08-25 15:13:13 +02003982 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron6d051732020-10-01 14:10:20 +02003983
Gilles Peskine449bd832023-01-11 14:50:10 +01003984 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01003985 status = PSA_ERROR_BAD_STATE;
3986 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02003987 }
Dave Rodgman38e62ae2021-06-23 11:38:39 +01003988
Gilles Peskine449bd832023-01-11 14:50:10 +01003989 if (operation->iv_required && !operation->iv_set) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01003990 status = PSA_ERROR_BAD_STATE;
3991 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02003992 }
Jaeden Ameroab439972019-02-15 14:12:05 +00003993
Gilles Peskine449bd832023-01-11 14:50:10 +01003994 status = psa_driver_wrapper_cipher_update(operation,
3995 input,
3996 input_length,
3997 output,
3998 output_size,
3999 output_length);
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004000
4001exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004002 if (status != PSA_SUCCESS) {
4003 psa_cipher_abort(operation);
4004 }
Ronald Cron6d051732020-10-01 14:10:20 +02004005
Gilles Peskine449bd832023-01-11 14:50:10 +01004006 return status;
mohammad1603503973b2018-03-12 15:59:30 +02004007}
4008
Gilles Peskine449bd832023-01-11 14:50:10 +01004009psa_status_t psa_cipher_finish(psa_cipher_operation_t *operation,
4010 uint8_t *output,
4011 size_t output_size,
4012 size_t *output_length)
mohammad1603503973b2018-03-12 15:59:30 +02004013{
David Saadab4ecc272019-02-14 13:48:10 +02004014 psa_status_t status = PSA_ERROR_GENERIC_ERROR;
Ronald Cron6d051732020-10-01 14:10:20 +02004015
Gilles Peskine449bd832023-01-11 14:50:10 +01004016 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004017 status = PSA_ERROR_BAD_STATE;
4018 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004019 }
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004020
Gilles Peskine449bd832023-01-11 14:50:10 +01004021 if (operation->iv_required && !operation->iv_set) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004022 status = PSA_ERROR_BAD_STATE;
4023 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004024 }
Moran Pekerbed71a22018-04-22 20:19:20 +03004025
Gilles Peskine449bd832023-01-11 14:50:10 +01004026 status = psa_driver_wrapper_cipher_finish(operation,
4027 output,
4028 output_size,
4029 output_length);
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004030
4031exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004032 if (status == PSA_SUCCESS) {
4033 return psa_cipher_abort(operation);
4034 } else {
Steven Cooremanef8575e2020-09-11 11:44:50 +02004035 *output_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01004036 (void) psa_cipher_abort(operation);
Janos Follath315b51c2018-07-09 16:04:51 +01004037
Gilles Peskine449bd832023-01-11 14:50:10 +01004038 return status;
Steven Cooremanef8575e2020-09-11 11:44:50 +02004039 }
mohammad1603503973b2018-03-12 15:59:30 +02004040}
4041
Gilles Peskine449bd832023-01-11 14:50:10 +01004042psa_status_t psa_cipher_abort(psa_cipher_operation_t *operation)
Gilles Peskinee553c652018-06-04 16:22:46 +02004043{
Gilles Peskine449bd832023-01-11 14:50:10 +01004044 if (operation->id == 0) {
Steven Cooremana07b9972020-09-10 14:54:14 +02004045 /* The object has (apparently) been initialized but it is not (yet)
Gilles Peskine81736312018-06-26 15:04:31 +02004046 * in use. It's ok to call abort on such an object, and there's
4047 * nothing to do. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004048 return PSA_SUCCESS;
Gilles Peskine81736312018-06-26 15:04:31 +02004049 }
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02004050
Gilles Peskine449bd832023-01-11 14:50:10 +01004051 psa_driver_wrapper_cipher_abort(operation);
Gilles Peskinee553c652018-06-04 16:22:46 +02004052
Ronald Cron49fafa92021-03-10 08:34:23 +01004053 operation->id = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03004054 operation->iv_set = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03004055 operation->iv_required = 0;
Moran Peker41deec42018-04-04 15:43:05 +03004056
Gilles Peskine449bd832023-01-11 14:50:10 +01004057 return PSA_SUCCESS;
mohammad1603503973b2018-03-12 15:59:30 +02004058}
4059
Gilles Peskine449bd832023-01-11 14:50:10 +01004060psa_status_t psa_cipher_encrypt(mbedtls_svc_key_id_t key,
4061 psa_algorithm_t alg,
4062 const uint8_t *input,
4063 size_t input_length,
4064 uint8_t *output,
4065 size_t output_size,
4066 size_t *output_length)
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004067{
4068 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004069 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron23919522021-07-08 19:00:07 +02004070 psa_key_slot_t *slot = NULL;
Ronald Cronc6e6f502021-07-09 18:44:58 +02004071 uint8_t local_iv[PSA_CIPHER_IV_MAX_SIZE];
4072 size_t default_iv_length = 0;
gabor-mezei-arm6f4e5bb2021-06-25 15:21:11 +02004073
Gilles Peskine449bd832023-01-11 14:50:10 +01004074 if (!PSA_ALG_IS_CIPHER(alg)) {
Ronald Cron23919522021-07-08 19:00:07 +02004075 status = PSA_ERROR_INVALID_ARGUMENT;
4076 goto exit;
4077 }
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004078
Gilles Peskine449bd832023-01-11 14:50:10 +01004079 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
4080 PSA_KEY_USAGE_ENCRYPT,
4081 alg);
4082 if (status != PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004083 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004084 }
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004085
Gilles Peskine449bd832023-01-11 14:50:10 +01004086 default_iv_length = PSA_CIPHER_IV_LENGTH(slot->attr.type, alg);
4087 if (default_iv_length > PSA_CIPHER_IV_MAX_SIZE) {
Ronald Cronc6e6f502021-07-09 18:44:58 +02004088 status = PSA_ERROR_GENERIC_ERROR;
4089 goto exit;
4090 }
4091
Gilles Peskine449bd832023-01-11 14:50:10 +01004092 if (default_iv_length > 0) {
4093 if (output_size < default_iv_length) {
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004094 status = PSA_ERROR_BUFFER_TOO_SMALL;
4095 goto exit;
4096 }
4097
Gilles Peskine449bd832023-01-11 14:50:10 +01004098 status = psa_generate_random(local_iv, default_iv_length);
4099 if (status != PSA_SUCCESS) {
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004100 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004101 }
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004102 }
4103
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004104 status = psa_driver_wrapper_cipher_encrypt(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01004105 &slot->attr, slot->key.data, slot->key.bytes,
Ronald Cronc6e6f502021-07-09 18:44:58 +02004106 alg, local_iv, default_iv_length, input, input_length,
Ronald Cronafbc7ed2023-01-24 16:02:04 +01004107 psa_crypto_buffer_offset(output, default_iv_length),
Gilles Peskine449bd832023-01-11 14:50:10 +01004108 output_size - default_iv_length, output_length);
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004109
4110exit:
Ryan Everetta103ec92024-01-31 13:59:57 +00004111 unlock_status = psa_unregister_read_under_mutex(slot);
Gilles Peskine449bd832023-01-11 14:50:10 +01004112 if (status == PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004113 status = unlock_status;
Ronald Cronc6e6f502021-07-09 18:44:58 +02004114 }
Ronald Cron23919522021-07-08 19:00:07 +02004115
Gilles Peskine449bd832023-01-11 14:50:10 +01004116 if (status == PSA_SUCCESS) {
4117 if (default_iv_length > 0) {
4118 memcpy(output, local_iv, default_iv_length);
4119 }
4120 *output_length += default_iv_length;
4121 } else {
4122 *output_length = 0;
4123 }
4124
4125 return status;
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004126}
4127
Gilles Peskine449bd832023-01-11 14:50:10 +01004128psa_status_t psa_cipher_decrypt(mbedtls_svc_key_id_t key,
4129 psa_algorithm_t alg,
4130 const uint8_t *input,
4131 size_t input_length,
4132 uint8_t *output,
4133 size_t output_size,
4134 size_t *output_length)
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004135{
4136 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004137 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron23919522021-07-08 19:00:07 +02004138 psa_key_slot_t *slot = NULL;
gabor-mezei-arm6f4e5bb2021-06-25 15:21:11 +02004139
Gilles Peskine449bd832023-01-11 14:50:10 +01004140 if (!PSA_ALG_IS_CIPHER(alg)) {
Ronald Cron23919522021-07-08 19:00:07 +02004141 status = PSA_ERROR_INVALID_ARGUMENT;
4142 goto exit;
4143 }
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004144
Gilles Peskine449bd832023-01-11 14:50:10 +01004145 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
4146 PSA_KEY_USAGE_DECRYPT,
4147 alg);
4148 if (status != PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004149 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004150 }
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004151
Gilles Peskine449bd832023-01-11 14:50:10 +01004152 if (alg == PSA_ALG_CCM_STAR_NO_TAG &&
4153 input_length < PSA_BLOCK_CIPHER_BLOCK_LENGTH(slot->attr.type)) {
Mateusz Starzyk594215b2021-10-14 12:23:06 +02004154 status = PSA_ERROR_INVALID_ARGUMENT;
4155 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004156 } else if (input_length < PSA_CIPHER_IV_LENGTH(slot->attr.type, alg)) {
gabor-mezei-arm258ae072021-06-25 15:25:38 +02004157 status = PSA_ERROR_INVALID_ARGUMENT;
4158 goto exit;
4159 }
4160
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004161 status = psa_driver_wrapper_cipher_decrypt(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01004162 &slot->attr, slot->key.data, slot->key.bytes,
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004163 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01004164 output, output_size, output_length);
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004165
gabor-mezei-arm258ae072021-06-25 15:25:38 +02004166exit:
Ryan Everetta103ec92024-01-31 13:59:57 +00004167 unlock_status = psa_unregister_read_under_mutex(slot);
Gilles Peskine449bd832023-01-11 14:50:10 +01004168 if (status == PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004169 status = unlock_status;
Gilles Peskine449bd832023-01-11 14:50:10 +01004170 }
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004171
Gilles Peskine449bd832023-01-11 14:50:10 +01004172 if (status != PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004173 *output_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01004174 }
Ronald Cron23919522021-07-08 19:00:07 +02004175
Gilles Peskine449bd832023-01-11 14:50:10 +01004176 return status;
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004177}
4178
4179
mohammad16035955c982018-04-26 00:53:03 +03004180/****************************************************************/
4181/* AEAD */
4182/****************************************************************/
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02004183
Paul Elliottbaff51c2021-09-28 17:44:45 +01004184/* Helper function to get the base algorithm from its variants. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004185static psa_algorithm_t psa_aead_get_base_algorithm(psa_algorithm_t alg)
Paul Elliottbaff51c2021-09-28 17:44:45 +01004186{
Gilles Peskine449bd832023-01-11 14:50:10 +01004187 return PSA_ALG_AEAD_WITH_DEFAULT_LENGTH_TAG(alg);
Paul Elliottbaff51c2021-09-28 17:44:45 +01004188}
4189
4190/* Helper function to perform common nonce length checks. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004191static psa_status_t psa_aead_check_nonce_length(psa_algorithm_t alg,
4192 size_t nonce_length)
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004193{
Gilles Peskine449bd832023-01-11 14:50:10 +01004194 psa_algorithm_t base_alg = psa_aead_get_base_algorithm(alg);
Paul Elliottbaff51c2021-09-28 17:44:45 +01004195
Gilles Peskine449bd832023-01-11 14:50:10 +01004196 switch (base_alg) {
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004197#if defined(PSA_WANT_ALG_GCM)
4198 case PSA_ALG_GCM:
4199 /* Not checking max nonce size here as GCM spec allows almost
Gilles Peskine449bd832023-01-11 14:50:10 +01004200 * arbitrarily large nonces. Please note that we do not generally
4201 * recommend the usage of nonces of greater length than
4202 * PSA_AEAD_NONCE_MAX_SIZE, as large nonces are hashed to a shorter
4203 * size, which can then lead to collisions if you encrypt a very
4204 * large number of messages.*/
4205 if (nonce_length != 0) {
4206 return PSA_SUCCESS;
4207 }
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004208 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004209#endif /* PSA_WANT_ALG_GCM */
4210#if defined(PSA_WANT_ALG_CCM)
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004211 case PSA_ALG_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01004212 if (nonce_length >= 7 && nonce_length <= 13) {
4213 return PSA_SUCCESS;
4214 }
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004215 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004216#endif /* PSA_WANT_ALG_CCM */
4217#if defined(PSA_WANT_ALG_CHACHA20_POLY1305)
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004218 case PSA_ALG_CHACHA20_POLY1305:
Gilles Peskine449bd832023-01-11 14:50:10 +01004219 if (nonce_length == 12) {
4220 return PSA_SUCCESS;
4221 } else if (nonce_length == 8) {
4222 return PSA_ERROR_NOT_SUPPORTED;
4223 }
Bence Szépkúti6d48e202021-11-15 20:04:15 +01004224 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004225#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004226 default:
Przemek Stekiel4c499272022-09-27 13:55:37 +02004227 (void) nonce_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01004228 return PSA_ERROR_NOT_SUPPORTED;
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004229 }
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004230
Gilles Peskine449bd832023-01-11 14:50:10 +01004231 return PSA_ERROR_INVALID_ARGUMENT;
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004232}
4233
Gilles Peskine449bd832023-01-11 14:50:10 +01004234static psa_status_t psa_aead_check_algorithm(psa_algorithm_t alg)
Bence Szépkútiaa3a6e42022-01-13 16:26:03 +01004235{
Gilles Peskine449bd832023-01-11 14:50:10 +01004236 if (!PSA_ALG_IS_AEAD(alg) || PSA_ALG_IS_WILDCARD(alg)) {
4237 return PSA_ERROR_INVALID_ARGUMENT;
4238 }
Bence Szépkúti08f34652021-12-08 21:07:13 +01004239
Gilles Peskine449bd832023-01-11 14:50:10 +01004240 return PSA_SUCCESS;
Bence Szépkúti08f34652021-12-08 21:07:13 +01004241}
4242
Gilles Peskine449bd832023-01-11 14:50:10 +01004243psa_status_t psa_aead_encrypt(mbedtls_svc_key_id_t key,
4244 psa_algorithm_t alg,
4245 const uint8_t *nonce,
4246 size_t nonce_length,
4247 const uint8_t *additional_data,
4248 size_t additional_data_length,
4249 const uint8_t *plaintext,
4250 size_t plaintext_length,
4251 uint8_t *ciphertext,
4252 size_t ciphertext_size,
4253 size_t *ciphertext_length)
mohammad16035955c982018-04-26 00:53:03 +03004254{
Ronald Cron215633c2021-03-16 17:15:37 +01004255 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4256 psa_key_slot_t *slot;
Gilles Peskine2d277862018-06-18 15:41:12 +02004257
mohammad1603f08a5502018-06-03 15:05:47 +03004258 *ciphertext_length = 0;
mohammad1603e58e6842018-05-09 04:58:32 -07004259
Gilles Peskine449bd832023-01-11 14:50:10 +01004260 status = psa_aead_check_algorithm(alg);
4261 if (status != PSA_SUCCESS) {
4262 return status;
4263 }
Steven Cooremanea7ab132021-03-17 16:28:00 +01004264
Ronald Cron9a986162021-03-26 12:40:07 +01004265 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01004266 key, &slot, PSA_KEY_USAGE_ENCRYPT, alg);
4267 if (status != PSA_SUCCESS) {
4268 return status;
4269 }
mohammad16035955c982018-04-26 00:53:03 +03004270
Gilles Peskine449bd832023-01-11 14:50:10 +01004271 status = psa_aead_check_nonce_length(alg, nonce_length);
4272 if (status != PSA_SUCCESS) {
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004273 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004274 }
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004275
Ronald Cronde822812021-03-17 16:08:20 +01004276 status = psa_driver_wrapper_aead_encrypt(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01004277 &slot->attr, slot->key.data, slot->key.bytes,
Ronald Cron215633c2021-03-16 17:15:37 +01004278 alg,
4279 nonce, nonce_length,
4280 additional_data, additional_data_length,
4281 plaintext, plaintext_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01004282 ciphertext, ciphertext_size, ciphertext_length);
Gilles Peskine2d277862018-06-18 15:41:12 +02004283
Gilles Peskine449bd832023-01-11 14:50:10 +01004284 if (status != PSA_SUCCESS && ciphertext_size != 0) {
4285 memset(ciphertext, 0, ciphertext_size);
4286 }
Gilles Peskine2d277862018-06-18 15:41:12 +02004287
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004288exit:
Ryan Everetta103ec92024-01-31 13:59:57 +00004289 psa_unregister_read_under_mutex(slot);
mohammad16035955c982018-04-26 00:53:03 +03004290
Gilles Peskine449bd832023-01-11 14:50:10 +01004291 return status;
Gilles Peskineee652a32018-06-01 19:23:52 +02004292}
4293
Gilles Peskine449bd832023-01-11 14:50:10 +01004294psa_status_t psa_aead_decrypt(mbedtls_svc_key_id_t key,
4295 psa_algorithm_t alg,
4296 const uint8_t *nonce,
4297 size_t nonce_length,
4298 const uint8_t *additional_data,
4299 size_t additional_data_length,
4300 const uint8_t *ciphertext,
4301 size_t ciphertext_length,
4302 uint8_t *plaintext,
4303 size_t plaintext_size,
4304 size_t *plaintext_length)
mohammad16035955c982018-04-26 00:53:03 +03004305{
Ronald Cron215633c2021-03-16 17:15:37 +01004306 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4307 psa_key_slot_t *slot;
Gilles Peskine2d277862018-06-18 15:41:12 +02004308
Gilles Peskineee652a32018-06-01 19:23:52 +02004309 *plaintext_length = 0;
mohammad16039e5a5152018-04-26 12:07:35 +03004310
Gilles Peskine449bd832023-01-11 14:50:10 +01004311 status = psa_aead_check_algorithm(alg);
4312 if (status != PSA_SUCCESS) {
4313 return status;
4314 }
Steven Cooremanea7ab132021-03-17 16:28:00 +01004315
Ronald Cron9a986162021-03-26 12:40:07 +01004316 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01004317 key, &slot, PSA_KEY_USAGE_DECRYPT, alg);
4318 if (status != PSA_SUCCESS) {
4319 return status;
4320 }
mohammad16035955c982018-04-26 00:53:03 +03004321
Gilles Peskine449bd832023-01-11 14:50:10 +01004322 status = psa_aead_check_nonce_length(alg, nonce_length);
4323 if (status != PSA_SUCCESS) {
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004324 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004325 }
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004326
Ronald Cronde822812021-03-17 16:08:20 +01004327 status = psa_driver_wrapper_aead_decrypt(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01004328 &slot->attr, slot->key.data, slot->key.bytes,
Ronald Cron215633c2021-03-16 17:15:37 +01004329 alg,
4330 nonce, nonce_length,
4331 additional_data, additional_data_length,
4332 ciphertext, ciphertext_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01004333 plaintext, plaintext_size, plaintext_length);
Gilles Peskinea40d7742018-06-01 16:28:30 +02004334
Gilles Peskine449bd832023-01-11 14:50:10 +01004335 if (status != PSA_SUCCESS && plaintext_size != 0) {
4336 memset(plaintext, 0, plaintext_size);
4337 }
mohammad160360a64d02018-06-03 17:20:42 +03004338
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004339exit:
Ryan Everetta103ec92024-01-31 13:59:57 +00004340 psa_unregister_read_under_mutex(slot);
Ronald Cron215633c2021-03-16 17:15:37 +01004341
Gilles Peskine449bd832023-01-11 14:50:10 +01004342 return status;
mohammad16035955c982018-04-26 00:53:03 +03004343}
4344
Gilles Peskine449bd832023-01-11 14:50:10 +01004345static psa_status_t psa_validate_tag_length(psa_algorithm_t alg)
4346{
4347 const uint8_t tag_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg);
Andrzej Kurekf8816012021-12-19 17:00:12 +01004348
Gilles Peskine449bd832023-01-11 14:50:10 +01004349 switch (PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg, 0)) {
Przemek Stekiel86679c72022-10-06 17:06:56 +02004350#if defined(PSA_WANT_ALG_CCM)
Gilles Peskine449bd832023-01-11 14:50:10 +01004351 case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, 0):
Andrzej Kurekf8816012021-12-19 17:00:12 +01004352 /* CCM allows the following tag lengths: 4, 6, 8, 10, 12, 14, 16.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01004353 if (tag_len < 4 || tag_len > 16 || tag_len % 2) {
4354 return PSA_ERROR_INVALID_ARGUMENT;
4355 }
Andrzej Kurekf8816012021-12-19 17:00:12 +01004356 break;
Przemek Stekiel86679c72022-10-06 17:06:56 +02004357#endif /* PSA_WANT_ALG_CCM */
Andrzej Kurekf8816012021-12-19 17:00:12 +01004358
Przemek Stekiel86679c72022-10-06 17:06:56 +02004359#if defined(PSA_WANT_ALG_GCM)
Gilles Peskine449bd832023-01-11 14:50:10 +01004360 case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_GCM, 0):
Andrzej Kurekf8816012021-12-19 17:00:12 +01004361 /* GCM allows the following tag lengths: 4, 8, 12, 13, 14, 15, 16. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004362 if (tag_len != 4 && tag_len != 8 && (tag_len < 12 || tag_len > 16)) {
4363 return PSA_ERROR_INVALID_ARGUMENT;
4364 }
Andrzej Kurekf8816012021-12-19 17:00:12 +01004365 break;
Przemek Stekiel86679c72022-10-06 17:06:56 +02004366#endif /* PSA_WANT_ALG_GCM */
Andrzej Kurekf8816012021-12-19 17:00:12 +01004367
Przemek Stekiel86679c72022-10-06 17:06:56 +02004368#if defined(PSA_WANT_ALG_CHACHA20_POLY1305)
Gilles Peskine449bd832023-01-11 14:50:10 +01004369 case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CHACHA20_POLY1305, 0):
Andrzej Kurekf8816012021-12-19 17:00:12 +01004370 /* We only support the default tag length. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004371 if (tag_len != 16) {
4372 return PSA_ERROR_INVALID_ARGUMENT;
4373 }
Andrzej Kurekf8816012021-12-19 17:00:12 +01004374 break;
Przemek Stekiel86679c72022-10-06 17:06:56 +02004375#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */
Andrzej Kurekf8816012021-12-19 17:00:12 +01004376
4377 default:
4378 (void) tag_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01004379 return PSA_ERROR_NOT_SUPPORTED;
Andrzej Kurekf8816012021-12-19 17:00:12 +01004380 }
Gilles Peskine449bd832023-01-11 14:50:10 +01004381 return PSA_SUCCESS;
Andrzej Kurekf8816012021-12-19 17:00:12 +01004382}
4383
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004384/* Set the key for a multipart authenticated operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004385static psa_status_t psa_aead_setup(psa_aead_operation_t *operation,
4386 int is_encrypt,
4387 mbedtls_svc_key_id_t key,
4388 psa_algorithm_t alg)
Paul Elliottc2b71442021-06-24 18:17:52 +01004389{
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004390 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4391 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
4392 psa_key_slot_t *slot = NULL;
4393 psa_key_usage_t key_usage = 0;
4394
Gilles Peskine449bd832023-01-11 14:50:10 +01004395 status = psa_aead_check_algorithm(alg);
4396 if (status != PSA_SUCCESS) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004397 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004398 }
Paul Elliottc2b71442021-06-24 18:17:52 +01004399
Gilles Peskine449bd832023-01-11 14:50:10 +01004400 if (operation->id != 0) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004401 status = PSA_ERROR_BAD_STATE;
4402 goto exit;
Paul Elliottc2b71442021-06-24 18:17:52 +01004403 }
4404
Gilles Peskine449bd832023-01-11 14:50:10 +01004405 if (operation->nonce_set || operation->lengths_set ||
4406 operation->ad_started || operation->body_started) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004407 status = PSA_ERROR_BAD_STATE;
4408 goto exit;
Paul Elliottc2b71442021-06-24 18:17:52 +01004409 }
4410
Gilles Peskine449bd832023-01-11 14:50:10 +01004411 if (is_encrypt) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004412 key_usage = PSA_KEY_USAGE_ENCRYPT;
Gilles Peskine449bd832023-01-11 14:50:10 +01004413 } else {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004414 key_usage = PSA_KEY_USAGE_DECRYPT;
Gilles Peskine449bd832023-01-11 14:50:10 +01004415 }
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004416
Gilles Peskine449bd832023-01-11 14:50:10 +01004417 status = psa_get_and_lock_key_slot_with_policy(key, &slot, key_usage,
4418 alg);
4419 if (status != PSA_SUCCESS) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004420 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004421 }
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004422
Gilles Peskine449bd832023-01-11 14:50:10 +01004423 if ((status = psa_validate_tag_length(alg)) != PSA_SUCCESS) {
Przemek Stekiel6ab50762022-10-08 17:54:30 +02004424 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004425 }
Przemek Stekiel6ab50762022-10-08 17:54:30 +02004426
Gilles Peskine449bd832023-01-11 14:50:10 +01004427 if (is_encrypt) {
4428 status = psa_driver_wrapper_aead_encrypt_setup(operation,
Gilles Peskine7a5d9202024-02-28 01:18:23 +01004429 &slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01004430 slot->key.data,
4431 slot->key.bytes,
4432 alg);
4433 } else {
4434 status = psa_driver_wrapper_aead_decrypt_setup(operation,
Gilles Peskine7a5d9202024-02-28 01:18:23 +01004435 &slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01004436 slot->key.data,
4437 slot->key.bytes,
4438 alg);
4439 }
4440 if (status != PSA_SUCCESS) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004441 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004442 }
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004443
Gilles Peskine7a5d9202024-02-28 01:18:23 +01004444 operation->key_type = psa_get_key_type(&slot->attr);
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004445
4446exit:
Ryan Everett9af70e52024-02-14 18:38:56 +00004447 unlock_status = psa_unregister_read_under_mutex(slot);
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004448
Gilles Peskine449bd832023-01-11 14:50:10 +01004449 if (status == PSA_SUCCESS) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004450 status = unlock_status;
Gilles Peskine449bd832023-01-11 14:50:10 +01004451 operation->alg = psa_aead_get_base_algorithm(alg);
Paul Elliottd9343f22021-08-23 18:59:49 +01004452 operation->is_encrypt = is_encrypt;
Gilles Peskine449bd832023-01-11 14:50:10 +01004453 } else {
4454 psa_aead_abort(operation);
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004455 }
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004456
Gilles Peskine449bd832023-01-11 14:50:10 +01004457 return status;
Paul Elliottc2b71442021-06-24 18:17:52 +01004458}
4459
Paul Elliott302ff6b2021-04-20 18:10:30 +01004460/* Set the key for a multipart authenticated encryption operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004461psa_status_t psa_aead_encrypt_setup(psa_aead_operation_t *operation,
4462 mbedtls_svc_key_id_t key,
4463 psa_algorithm_t alg)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004464{
Gilles Peskine449bd832023-01-11 14:50:10 +01004465 return psa_aead_setup(operation, 1, key, alg);
Paul Elliott302ff6b2021-04-20 18:10:30 +01004466}
4467
4468/* Set the key for a multipart authenticated decryption operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004469psa_status_t psa_aead_decrypt_setup(psa_aead_operation_t *operation,
4470 mbedtls_svc_key_id_t key,
4471 psa_algorithm_t alg)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004472{
Gilles Peskine449bd832023-01-11 14:50:10 +01004473 return psa_aead_setup(operation, 0, key, alg);
Paul Elliott302ff6b2021-04-20 18:10:30 +01004474}
4475
4476/* Generate a random nonce / IV for multipart AEAD operation */
Gilles Peskine449bd832023-01-11 14:50:10 +01004477psa_status_t psa_aead_generate_nonce(psa_aead_operation_t *operation,
4478 uint8_t *nonce,
4479 size_t nonce_size,
4480 size_t *nonce_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004481{
4482 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Croncae59092021-11-26 18:53:58 +01004483 uint8_t local_nonce[PSA_AEAD_NONCE_MAX_SIZE];
Sergeybef1f632023-03-06 15:25:06 -07004484 size_t required_nonce_size = 0;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004485
Paul Elliott8eb9daf2021-06-04 16:42:21 +01004486 *nonce_length = 0;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004487
Gilles Peskine449bd832023-01-11 14:50:10 +01004488 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004489 status = PSA_ERROR_BAD_STATE;
4490 goto exit;
4491 }
4492
Gilles Peskine449bd832023-01-11 14:50:10 +01004493 if (operation->nonce_set || !operation->is_encrypt) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004494 status = PSA_ERROR_BAD_STATE;
4495 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004496 }
4497
Paul Elliotte193ea82021-10-01 13:00:16 +01004498 /* For CCM, this size may not be correct according to the PSA
4499 * specification. The PSA Crypto 1.0.1 specification states:
4500 *
4501 * CCM encodes the plaintext length pLen in L octets, with L the smallest
4502 * integer >= 2 where pLen < 2^(8L). The nonce length is then 15 - L bytes.
4503 *
4504 * However this restriction that L has to be the smallest integer is not
4505 * applied in practice, and it is not implementable here since the
4506 * plaintext length may or may not be known at this time. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004507 required_nonce_size = PSA_AEAD_NONCE_LENGTH(operation->key_type,
4508 operation->alg);
4509 if (nonce_size < required_nonce_size) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004510 status = PSA_ERROR_BUFFER_TOO_SMALL;
4511 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004512 }
4513
Gilles Peskine449bd832023-01-11 14:50:10 +01004514 status = psa_generate_random(local_nonce, required_nonce_size);
4515 if (status != PSA_SUCCESS) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004516 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004517 }
Paul Elliott302ff6b2021-04-20 18:10:30 +01004518
Gilles Peskine449bd832023-01-11 14:50:10 +01004519 status = psa_aead_set_nonce(operation, local_nonce, required_nonce_size);
Paul Elliott302ff6b2021-04-20 18:10:30 +01004520
Paul Elliott39dc6b82021-05-11 19:16:09 +01004521exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004522 if (status == PSA_SUCCESS) {
4523 memcpy(nonce, local_nonce, required_nonce_size);
Paul Elliott39dc6b82021-05-11 19:16:09 +01004524 *nonce_length = required_nonce_size;
Gilles Peskine449bd832023-01-11 14:50:10 +01004525 } else {
4526 psa_aead_abort(operation);
Ronald Croncae59092021-11-26 18:53:58 +01004527 }
Paul Elliott39dc6b82021-05-11 19:16:09 +01004528
Gilles Peskine449bd832023-01-11 14:50:10 +01004529 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004530}
4531
4532/* Set the nonce for a multipart authenticated encryption or decryption
4533 operation.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01004534psa_status_t psa_aead_set_nonce(psa_aead_operation_t *operation,
4535 const uint8_t *nonce,
4536 size_t nonce_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004537{
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004538 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4539
Gilles Peskine449bd832023-01-11 14:50:10 +01004540 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004541 status = PSA_ERROR_BAD_STATE;
4542 goto exit;
4543 }
4544
Gilles Peskine449bd832023-01-11 14:50:10 +01004545 if (operation->nonce_set) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004546 status = PSA_ERROR_BAD_STATE;
4547 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004548 }
4549
Gilles Peskine449bd832023-01-11 14:50:10 +01004550 status = psa_aead_check_nonce_length(operation->alg, nonce_length);
4551 if (status != PSA_SUCCESS) {
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004552 status = PSA_ERROR_INVALID_ARGUMENT;
4553 goto exit;
Paul Elliott4ed1ed12021-09-27 18:09:28 +01004554 }
Paul Elliott1a98aca2021-05-20 18:24:07 +01004555
Gilles Peskine449bd832023-01-11 14:50:10 +01004556 status = psa_driver_wrapper_aead_set_nonce(operation, nonce,
4557 nonce_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004558
Paul Elliott39dc6b82021-05-11 19:16:09 +01004559exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004560 if (status == PSA_SUCCESS) {
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004561 operation->nonce_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004562 } else {
4563 psa_aead_abort(operation);
4564 }
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004565
Gilles Peskine449bd832023-01-11 14:50:10 +01004566 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004567}
4568
4569/* Declare the lengths of the message and additional data for multipart AEAD. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004570psa_status_t psa_aead_set_lengths(psa_aead_operation_t *operation,
4571 size_t ad_length,
4572 size_t plaintext_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004573{
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004574 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4575
Gilles Peskine449bd832023-01-11 14:50:10 +01004576 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004577 status = PSA_ERROR_BAD_STATE;
4578 goto exit;
4579 }
4580
Gilles Peskine449bd832023-01-11 14:50:10 +01004581 if (operation->lengths_set || operation->ad_started ||
4582 operation->body_started) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004583 status = PSA_ERROR_BAD_STATE;
4584 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004585 }
4586
Gilles Peskine449bd832023-01-11 14:50:10 +01004587 switch (operation->alg) {
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004588#if defined(PSA_WANT_ALG_GCM)
4589 case PSA_ALG_GCM:
4590 /* Lengths can only be too large for GCM if size_t is bigger than 32
Gilles Peskine449bd832023-01-11 14:50:10 +01004591 * bits. Without the guard this code will generate warnings on 32bit
4592 * builds. */
Paul Elliott325d3742021-09-27 17:56:28 +01004593#if SIZE_MAX > UINT32_MAX
Gilles Peskine449bd832023-01-11 14:50:10 +01004594 if (((uint64_t) ad_length) >> 61 != 0 ||
4595 ((uint64_t) plaintext_length) > 0xFFFFFFFE0ull) {
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004596 status = PSA_ERROR_INVALID_ARGUMENT;
4597 goto exit;
4598 }
Paul Elliott325d3742021-09-27 17:56:28 +01004599#endif
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004600 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004601#endif /* PSA_WANT_ALG_GCM */
4602#if defined(PSA_WANT_ALG_CCM)
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004603 case PSA_ALG_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01004604 if (ad_length > 0xFF00) {
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004605 status = PSA_ERROR_INVALID_ARGUMENT;
4606 goto exit;
4607 }
4608 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004609#endif /* PSA_WANT_ALG_CCM */
4610#if defined(PSA_WANT_ALG_CHACHA20_POLY1305)
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004611 case PSA_ALG_CHACHA20_POLY1305:
4612 /* No length restrictions for ChaChaPoly. */
4613 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004614#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004615 default:
4616 break;
4617 }
Paul Elliott325d3742021-09-27 17:56:28 +01004618
Gilles Peskine449bd832023-01-11 14:50:10 +01004619 status = psa_driver_wrapper_aead_set_lengths(operation, ad_length,
4620 plaintext_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004621
Paul Elliott39dc6b82021-05-11 19:16:09 +01004622exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004623 if (status == PSA_SUCCESS) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01004624 operation->ad_remaining = ad_length;
4625 operation->body_remaining = plaintext_length;
Paul Elliott39dc6b82021-05-11 19:16:09 +01004626 operation->lengths_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004627 } else {
4628 psa_aead_abort(operation);
Paul Elliottee4ffe02021-05-20 17:25:06 +01004629 }
Paul Elliott39dc6b82021-05-11 19:16:09 +01004630
Gilles Peskine449bd832023-01-11 14:50:10 +01004631 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004632}
Paul Elliott3d7d52c2021-09-01 10:33:14 +01004633
4634/* Pass additional data to an active multipart AEAD operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004635psa_status_t psa_aead_update_ad(psa_aead_operation_t *operation,
4636 const uint8_t *input,
4637 size_t input_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004638{
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004639 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4640
Gilles Peskine449bd832023-01-11 14:50:10 +01004641 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004642 status = PSA_ERROR_BAD_STATE;
4643 goto exit;
4644 }
4645
Gilles Peskine449bd832023-01-11 14:50:10 +01004646 if (!operation->nonce_set || operation->body_started) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004647 status = PSA_ERROR_BAD_STATE;
4648 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004649 }
4650
Gilles Peskine449bd832023-01-11 14:50:10 +01004651 if (operation->lengths_set) {
4652 if (operation->ad_remaining < input_length) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01004653 status = PSA_ERROR_INVALID_ARGUMENT;
4654 goto exit;
4655 }
4656
4657 operation->ad_remaining -= input_length;
4658 }
Paul Elliotte193ea82021-10-01 13:00:16 +01004659#if defined(PSA_WANT_ALG_CCM)
Gilles Peskine449bd832023-01-11 14:50:10 +01004660 else if (operation->alg == PSA_ALG_CCM) {
Paul Elliotte193ea82021-10-01 13:00:16 +01004661 status = PSA_ERROR_BAD_STATE;
4662 goto exit;
4663 }
4664#endif /* PSA_WANT_ALG_CCM */
Paul Elliottee4ffe02021-05-20 17:25:06 +01004665
Gilles Peskine449bd832023-01-11 14:50:10 +01004666 status = psa_driver_wrapper_aead_update_ad(operation, input,
4667 input_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004668
Paul Elliott39dc6b82021-05-11 19:16:09 +01004669exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004670 if (status == PSA_SUCCESS) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004671 operation->ad_started = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004672 } else {
4673 psa_aead_abort(operation);
4674 }
Paul Elliott39dc6b82021-05-11 19:16:09 +01004675
Gilles Peskine449bd832023-01-11 14:50:10 +01004676 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004677}
4678
4679/* Encrypt or decrypt a message fragment in an active multipart AEAD
4680 operation.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01004681psa_status_t psa_aead_update(psa_aead_operation_t *operation,
4682 const uint8_t *input,
4683 size_t input_length,
4684 uint8_t *output,
4685 size_t output_size,
4686 size_t *output_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004687{
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004688 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004689
4690 *output_length = 0;
4691
Gilles Peskine449bd832023-01-11 14:50:10 +01004692 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004693 status = PSA_ERROR_BAD_STATE;
4694 goto exit;
4695 }
4696
Gilles Peskine449bd832023-01-11 14:50:10 +01004697 if (!operation->nonce_set) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004698 status = PSA_ERROR_BAD_STATE;
4699 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004700 }
4701
Gilles Peskine449bd832023-01-11 14:50:10 +01004702 if (operation->lengths_set) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01004703 /* Additional data length was supplied, but not all the additional
4704 data was supplied.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01004705 if (operation->ad_remaining != 0) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01004706 status = PSA_ERROR_INVALID_ARGUMENT;
4707 goto exit;
4708 }
4709
4710 /* Too much data provided. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004711 if (operation->body_remaining < input_length) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01004712 status = PSA_ERROR_INVALID_ARGUMENT;
4713 goto exit;
4714 }
4715
4716 operation->body_remaining -= input_length;
4717 }
Paul Elliotte193ea82021-10-01 13:00:16 +01004718#if defined(PSA_WANT_ALG_CCM)
Gilles Peskine449bd832023-01-11 14:50:10 +01004719 else if (operation->alg == PSA_ALG_CCM) {
Paul Elliotte193ea82021-10-01 13:00:16 +01004720 status = PSA_ERROR_BAD_STATE;
4721 goto exit;
4722 }
4723#endif /* PSA_WANT_ALG_CCM */
Paul Elliottee4ffe02021-05-20 17:25:06 +01004724
Gilles Peskine449bd832023-01-11 14:50:10 +01004725 status = psa_driver_wrapper_aead_update(operation, input, input_length,
4726 output, output_size,
4727 output_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004728
Paul Elliott39dc6b82021-05-11 19:16:09 +01004729exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004730 if (status == PSA_SUCCESS) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004731 operation->body_started = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004732 } else {
4733 psa_aead_abort(operation);
4734 }
Paul Elliott39dc6b82021-05-11 19:16:09 +01004735
Gilles Peskine449bd832023-01-11 14:50:10 +01004736 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004737}
4738
Gilles Peskine449bd832023-01-11 14:50:10 +01004739static psa_status_t psa_aead_final_checks(const psa_aead_operation_t *operation)
Paul Elliottad53dcc2021-06-23 08:50:14 +01004740{
Gilles Peskine449bd832023-01-11 14:50:10 +01004741 if (operation->id == 0 || !operation->nonce_set) {
4742 return PSA_ERROR_BAD_STATE;
4743 }
Paul Elliottad53dcc2021-06-23 08:50:14 +01004744
Gilles Peskine449bd832023-01-11 14:50:10 +01004745 if (operation->lengths_set && (operation->ad_remaining != 0 ||
4746 operation->body_remaining != 0)) {
4747 return PSA_ERROR_INVALID_ARGUMENT;
4748 }
Paul Elliottad53dcc2021-06-23 08:50:14 +01004749
Gilles Peskine449bd832023-01-11 14:50:10 +01004750 return PSA_SUCCESS;
Paul Elliottad53dcc2021-06-23 08:50:14 +01004751}
4752
Paul Elliott302ff6b2021-04-20 18:10:30 +01004753/* Finish encrypting a message in a multipart AEAD operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004754psa_status_t psa_aead_finish(psa_aead_operation_t *operation,
4755 uint8_t *ciphertext,
4756 size_t ciphertext_size,
4757 size_t *ciphertext_length,
4758 uint8_t *tag,
4759 size_t tag_size,
4760 size_t *tag_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004761{
Paul Elliott39dc6b82021-05-11 19:16:09 +01004762 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4763
Paul Elliott302ff6b2021-04-20 18:10:30 +01004764 *ciphertext_length = 0;
Paul Elliottf88a5652021-06-22 17:53:45 +01004765 *tag_length = tag_size;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004766
Gilles Peskine449bd832023-01-11 14:50:10 +01004767 status = psa_aead_final_checks(operation);
4768 if (status != PSA_SUCCESS) {
Paul Elliottad53dcc2021-06-23 08:50:14 +01004769 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004770 }
Paul Elliottad53dcc2021-06-23 08:50:14 +01004771
Gilles Peskine449bd832023-01-11 14:50:10 +01004772 if (!operation->is_encrypt) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004773 status = PSA_ERROR_BAD_STATE;
4774 goto exit;
4775 }
4776
Gilles Peskine449bd832023-01-11 14:50:10 +01004777 status = psa_driver_wrapper_aead_finish(operation, ciphertext,
4778 ciphertext_size,
4779 ciphertext_length,
4780 tag, tag_size, tag_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004781
Paul Elliott39dc6b82021-05-11 19:16:09 +01004782exit:
Paul Elliottdc42ca82023-02-24 18:11:59 +00004783
4784
Paul Elliottf47b0952021-05-21 18:02:33 +01004785 /* In case the operation fails and the user fails to check for failure or
Paul Elliott4c916e82021-09-19 18:34:50 +01004786 * the zero tag size, make sure the tag is set to something implausible.
4787 * Even if the operation succeeds, make sure we clear the rest of the
4788 * buffer to prevent potential leakage of anything previously placed in
4789 * the same buffer.*/
Paul Elliottdc42ca82023-02-24 18:11:59 +00004790 psa_wipe_tag_output_buffer(tag, status, tag_size, *tag_length);
Paul Elliottf47b0952021-05-21 18:02:33 +01004791
Gilles Peskine449bd832023-01-11 14:50:10 +01004792 psa_aead_abort(operation);
Paul Elliott39dc6b82021-05-11 19:16:09 +01004793
Gilles Peskine449bd832023-01-11 14:50:10 +01004794 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004795}
4796
4797/* Finish authenticating and decrypting a message in a multipart AEAD
4798 operation.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01004799psa_status_t psa_aead_verify(psa_aead_operation_t *operation,
4800 uint8_t *plaintext,
4801 size_t plaintext_size,
4802 size_t *plaintext_length,
4803 const uint8_t *tag,
4804 size_t tag_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004805{
Paul Elliott39dc6b82021-05-11 19:16:09 +01004806 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4807
Paul Elliott302ff6b2021-04-20 18:10:30 +01004808 *plaintext_length = 0;
4809
Gilles Peskine449bd832023-01-11 14:50:10 +01004810 status = psa_aead_final_checks(operation);
4811 if (status != PSA_SUCCESS) {
Paul Elliottad53dcc2021-06-23 08:50:14 +01004812 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004813 }
Paul Elliottad53dcc2021-06-23 08:50:14 +01004814
Gilles Peskine449bd832023-01-11 14:50:10 +01004815 if (operation->is_encrypt) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004816 status = PSA_ERROR_BAD_STATE;
4817 goto exit;
4818 }
4819
Gilles Peskine449bd832023-01-11 14:50:10 +01004820 status = psa_driver_wrapper_aead_verify(operation, plaintext,
4821 plaintext_size,
4822 plaintext_length,
4823 tag, tag_length);
Paul Elliott39dc6b82021-05-11 19:16:09 +01004824
4825exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004826 psa_aead_abort(operation);
Paul Elliott39dc6b82021-05-11 19:16:09 +01004827
Gilles Peskine449bd832023-01-11 14:50:10 +01004828 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004829}
4830
4831/* Abort an AEAD operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004832psa_status_t psa_aead_abort(psa_aead_operation_t *operation)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004833{
4834 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4835
Gilles Peskine449bd832023-01-11 14:50:10 +01004836 if (operation->id == 0) {
Paul Elliott302ff6b2021-04-20 18:10:30 +01004837 /* The object has (apparently) been initialized but it is not (yet)
4838 * in use. It's ok to call abort on such an object, and there's
4839 * nothing to do. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004840 return PSA_SUCCESS;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004841 }
4842
Gilles Peskine449bd832023-01-11 14:50:10 +01004843 status = psa_driver_wrapper_aead_abort(operation);
Paul Elliott302ff6b2021-04-20 18:10:30 +01004844
Gilles Peskine449bd832023-01-11 14:50:10 +01004845 memset(operation, 0, sizeof(*operation));
Paul Elliott302ff6b2021-04-20 18:10:30 +01004846
Gilles Peskine449bd832023-01-11 14:50:10 +01004847 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004848}
4849
Gilles Peskinee59236f2018-01-27 23:32:46 +01004850/****************************************************************/
Gilles Peskineeab56e42018-07-12 17:12:33 +02004851/* Generators */
4852/****************************************************************/
4853
Przemek Stekiel69c46792022-06-10 12:59:51 +02004854#if defined(BUILTIN_ALG_ANY_HKDF) || \
John Durkop07cc04a2020-11-16 22:08:34 -08004855 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
Andrzej Kurek08d34b82022-07-29 10:00:16 -04004856 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) || \
Kusumit Ghoderaoaf0b5342023-05-03 11:58:46 +05304857 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) || \
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05304858 defined(PSA_HAVE_SOFT_PBKDF2)
John Durkop07cc04a2020-11-16 22:08:34 -08004859#define AT_LEAST_ONE_BUILTIN_KDF
Steven Cooreman094a77e2021-05-06 17:58:36 +02004860#endif /* At least one builtin KDF */
4861
Przemek Stekiel69c46792022-06-10 12:59:51 +02004862#if defined(BUILTIN_ALG_ANY_HKDF) || \
Steven Cooreman094a77e2021-05-06 17:58:36 +02004863 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
4864 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
4865static psa_status_t psa_key_derivation_start_hmac(
4866 psa_mac_operation_t *operation,
4867 psa_algorithm_t hash_alg,
4868 const uint8_t *hmac_key,
Gilles Peskine449bd832023-01-11 14:50:10 +01004869 size_t hmac_key_length)
Steven Cooreman094a77e2021-05-06 17:58:36 +02004870{
4871 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4872 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine449bd832023-01-11 14:50:10 +01004873 psa_set_key_type(&attributes, PSA_KEY_TYPE_HMAC);
4874 psa_set_key_bits(&attributes, PSA_BYTES_TO_BITS(hmac_key_length));
4875 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_HASH);
Steven Cooreman094a77e2021-05-06 17:58:36 +02004876
Steven Cooreman72f736a2021-05-07 14:14:37 +02004877 operation->is_sign = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004878 operation->mac_size = PSA_HASH_LENGTH(hash_alg);
Steven Cooreman72f736a2021-05-07 14:14:37 +02004879
Gilles Peskine449bd832023-01-11 14:50:10 +01004880 status = psa_driver_wrapper_mac_sign_setup(operation,
4881 &attributes,
4882 hmac_key, hmac_key_length,
4883 PSA_ALG_HMAC(hash_alg));
Steven Cooreman094a77e2021-05-06 17:58:36 +02004884
Gilles Peskine449bd832023-01-11 14:50:10 +01004885 psa_reset_key_attributes(&attributes);
4886 return status;
Steven Cooreman094a77e2021-05-06 17:58:36 +02004887}
4888#endif /* KDF algorithms reliant on HMAC */
John Durkop07cc04a2020-11-16 22:08:34 -08004889
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004890#define HKDF_STATE_INIT 0 /* no input yet */
4891#define HKDF_STATE_STARTED 1 /* got salt */
4892#define HKDF_STATE_KEYED 2 /* got key */
4893#define HKDF_STATE_OUTPUT 3 /* output started */
4894
Gilles Peskinecbe66502019-05-16 16:59:18 +02004895static psa_algorithm_t psa_key_derivation_get_kdf_alg(
Gilles Peskine449bd832023-01-11 14:50:10 +01004896 const psa_key_derivation_operation_t *operation)
Gilles Peskine969c5d62019-01-16 15:53:06 +01004897{
Gilles Peskine449bd832023-01-11 14:50:10 +01004898 if (PSA_ALG_IS_KEY_AGREEMENT(operation->alg)) {
4899 return PSA_ALG_KEY_AGREEMENT_GET_KDF(operation->alg);
4900 } else {
4901 return operation->alg;
4902 }
Gilles Peskine969c5d62019-01-16 15:53:06 +01004903}
4904
Gilles Peskine449bd832023-01-11 14:50:10 +01004905psa_status_t psa_key_derivation_abort(psa_key_derivation_operation_t *operation)
Gilles Peskineeab56e42018-07-12 17:12:33 +02004906{
4907 psa_status_t status = PSA_SUCCESS;
Gilles Peskine449bd832023-01-11 14:50:10 +01004908 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation);
4909 if (kdf_alg == 0) {
Gilles Peskineeab56e42018-07-12 17:12:33 +02004910 /* The object has (apparently) been initialized but it is not
4911 * in use. It's ok to call abort on such an object, and there's
4912 * nothing to do. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004913 } else
Przemek Stekiel69c46792022-06-10 12:59:51 +02004914#if defined(BUILTIN_ALG_ANY_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01004915 if (PSA_ALG_IS_ANY_HKDF(kdf_alg)) {
4916 mbedtls_free(operation->ctx.hkdf.info);
4917 status = psa_mac_abort(&operation->ctx.hkdf.hmac);
4918 } else
Przemek Stekiel69c46792022-06-10 12:59:51 +02004919#endif /* BUILTIN_ALG_ANY_HKDF */
John Durkop07cc04a2020-11-16 22:08:34 -08004920#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
4921 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01004922 if (PSA_ALG_IS_TLS12_PRF(kdf_alg) ||
4923 /* TLS-1.2 PSK-to-MS KDF uses the same core as TLS-1.2 PRF */
4924 PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
4925 if (operation->ctx.tls12_prf.secret != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01004926 mbedtls_zeroize_and_free(operation->ctx.tls12_prf.secret,
Gilles Peskine449bd832023-01-11 14:50:10 +01004927 operation->ctx.tls12_prf.secret_length);
Steven Cooremana6df6042021-04-29 19:32:25 +02004928 }
4929
Gilles Peskine449bd832023-01-11 14:50:10 +01004930 if (operation->ctx.tls12_prf.seed != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01004931 mbedtls_zeroize_and_free(operation->ctx.tls12_prf.seed,
Gilles Peskine449bd832023-01-11 14:50:10 +01004932 operation->ctx.tls12_prf.seed_length);
Janos Follath6a1d2622019-06-11 10:37:28 +01004933 }
4934
Gilles Peskine449bd832023-01-11 14:50:10 +01004935 if (operation->ctx.tls12_prf.label != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01004936 mbedtls_zeroize_and_free(operation->ctx.tls12_prf.label,
Gilles Peskine449bd832023-01-11 14:50:10 +01004937 operation->ctx.tls12_prf.label_length);
Janos Follath6a1d2622019-06-11 10:37:28 +01004938 }
Przemek Stekiel6c764412022-11-22 14:05:12 +01004939#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01004940 if (operation->ctx.tls12_prf.other_secret != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01004941 mbedtls_zeroize_and_free(operation->ctx.tls12_prf.other_secret,
Gilles Peskine449bd832023-01-11 14:50:10 +01004942 operation->ctx.tls12_prf.other_secret_length);
Przemek Stekiele3ee2212022-04-07 14:29:56 +02004943 }
Przemek Stekiel6c764412022-11-22 14:05:12 +01004944#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Steven Cooremana6df6042021-04-29 19:32:25 +02004945 status = PSA_SUCCESS;
Janos Follath6a1d2622019-06-11 10:37:28 +01004946
4947 /* We leave the fields Ai and output_block to be erased safely by the
4948 * mbedtls_platform_zeroize() in the end of this function. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004949 } else
John Durkop07cc04a2020-11-16 22:08:34 -08004950#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) ||
4951 * defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) */
Andrzej Kurek08d34b82022-07-29 10:00:16 -04004952#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01004953 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
4954 mbedtls_platform_zeroize(operation->ctx.tls12_ecjpake_to_pms.data,
4955 sizeof(operation->ctx.tls12_ecjpake_to_pms.data));
4956 } else
Andrzej Kurek08d34b82022-07-29 10:00:16 -04004957#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) */
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05304958#if defined(PSA_HAVE_SOFT_PBKDF2)
Kusumit Ghoderao9ab03c32023-07-27 21:14:05 +05304959 if (PSA_ALG_IS_PBKDF2(kdf_alg)) {
Kusumit Ghoderaof5fedf12023-05-03 12:29:48 +05304960 if (operation->ctx.pbkdf2.salt != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01004961 mbedtls_zeroize_and_free(operation->ctx.pbkdf2.salt,
Kusumit Ghoderaof5fedf12023-05-03 12:29:48 +05304962 operation->ctx.pbkdf2.salt_length);
Kusumit Ghoderaof5fedf12023-05-03 12:29:48 +05304963 }
Kusumit Ghoderaof5fedf12023-05-03 12:29:48 +05304964
4965 status = PSA_SUCCESS;
4966 } else
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05304967#endif /* defined(PSA_HAVE_SOFT_PBKDF2) */
Gilles Peskineeab56e42018-07-12 17:12:33 +02004968 {
4969 status = PSA_ERROR_BAD_STATE;
4970 }
Gilles Peskine449bd832023-01-11 14:50:10 +01004971 mbedtls_platform_zeroize(operation, sizeof(*operation));
4972 return status;
Gilles Peskineeab56e42018-07-12 17:12:33 +02004973}
4974
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004975psa_status_t psa_key_derivation_get_capacity(const psa_key_derivation_operation_t *operation,
Gilles Peskine449bd832023-01-11 14:50:10 +01004976 size_t *capacity)
Gilles Peskineeab56e42018-07-12 17:12:33 +02004977{
Gilles Peskine449bd832023-01-11 14:50:10 +01004978 if (operation->alg == 0) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004979 /* This is a blank key derivation operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004980 return PSA_ERROR_BAD_STATE;
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004981 }
4982
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004983 *capacity = operation->capacity;
Gilles Peskine449bd832023-01-11 14:50:10 +01004984 return PSA_SUCCESS;
Gilles Peskineeab56e42018-07-12 17:12:33 +02004985}
4986
Gilles Peskine449bd832023-01-11 14:50:10 +01004987psa_status_t psa_key_derivation_set_capacity(psa_key_derivation_operation_t *operation,
4988 size_t capacity)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004989{
Gilles Peskine449bd832023-01-11 14:50:10 +01004990 if (operation->alg == 0) {
4991 return PSA_ERROR_BAD_STATE;
4992 }
4993 if (capacity > operation->capacity) {
4994 return PSA_ERROR_INVALID_ARGUMENT;
4995 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004996 operation->capacity = capacity;
Gilles Peskine449bd832023-01-11 14:50:10 +01004997 return PSA_SUCCESS;
Gilles Peskineeab56e42018-07-12 17:12:33 +02004998}
4999
Przemek Stekiel69c46792022-06-10 12:59:51 +02005000#if defined(BUILTIN_ALG_ANY_HKDF)
Przemek Stekiel03d948c2022-05-19 11:45:20 +02005001/* Read some bytes from an HKDF-based operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005002static psa_status_t psa_key_derivation_hkdf_read(psa_hkdf_key_derivation_t *hkdf,
5003 psa_algorithm_t kdf_alg,
5004 uint8_t *output,
5005 size_t output_length)
Gilles Peskinebef7f142018-07-12 17:22:21 +02005006{
Gilles Peskine449bd832023-01-11 14:50:10 +01005007 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(kdf_alg);
5008 uint8_t hash_length = PSA_HASH_LENGTH(hash_alg);
Steven Cooremand1ed1d92021-04-29 19:11:25 +02005009 size_t hmac_output_length;
Gilles Peskinebef7f142018-07-12 17:22:21 +02005010 psa_status_t status;
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02005011#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01005012 const uint8_t last_block = PSA_ALG_IS_HKDF_EXTRACT(kdf_alg) ? 0 : 0xff;
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02005013#else
5014 const uint8_t last_block = 0xff;
5015#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Gilles Peskinebef7f142018-07-12 17:22:21 +02005016
Gilles Peskine449bd832023-01-11 14:50:10 +01005017 if (hkdf->state < HKDF_STATE_KEYED ||
5018 (!hkdf->info_set
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02005019#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01005020 && !PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02005021#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Gilles Peskine449bd832023-01-11 14:50:10 +01005022 )) {
5023 return PSA_ERROR_BAD_STATE;
5024 }
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005025 hkdf->state = HKDF_STATE_OUTPUT;
5026
Gilles Peskine449bd832023-01-11 14:50:10 +01005027 while (output_length != 0) {
Gilles Peskinebef7f142018-07-12 17:22:21 +02005028 /* Copy what remains of the current block */
5029 uint8_t n = hash_length - hkdf->offset_in_block;
Gilles Peskine449bd832023-01-11 14:50:10 +01005030 if (n > output_length) {
Gilles Peskinebef7f142018-07-12 17:22:21 +02005031 n = (uint8_t) output_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01005032 }
5033 memcpy(output, hkdf->output_block + hkdf->offset_in_block, n);
Gilles Peskinebef7f142018-07-12 17:22:21 +02005034 output += n;
5035 output_length -= n;
5036 hkdf->offset_in_block += n;
Gilles Peskine449bd832023-01-11 14:50:10 +01005037 if (output_length == 0) {
Gilles Peskinebef7f142018-07-12 17:22:21 +02005038 break;
Gilles Peskine449bd832023-01-11 14:50:10 +01005039 }
Przemek Stekiel03d948c2022-05-19 11:45:20 +02005040 /* We can't be wanting more output after the last block, otherwise
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02005041 * the capacity check in psa_key_derivation_output_bytes() would have
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005042 * prevented this call. It could happen only if the operation
Gilles Peskined54931c2018-07-17 21:06:59 +02005043 * object was corrupted or if this function is called directly
5044 * inside the library. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005045 if (hkdf->block_number == last_block) {
5046 return PSA_ERROR_BAD_STATE;
5047 }
Gilles Peskinebef7f142018-07-12 17:22:21 +02005048
5049 /* We need a new block */
5050 ++hkdf->block_number;
5051 hkdf->offset_in_block = 0;
Steven Cooremand1ed1d92021-04-29 19:11:25 +02005052
Gilles Peskine449bd832023-01-11 14:50:10 +01005053 status = psa_key_derivation_start_hmac(&hkdf->hmac,
5054 hash_alg,
5055 hkdf->prk,
5056 hash_length);
5057 if (status != PSA_SUCCESS) {
5058 return status;
Gilles Peskinebef7f142018-07-12 17:22:21 +02005059 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005060
5061 if (hkdf->block_number != 1) {
5062 status = psa_mac_update(&hkdf->hmac,
5063 hkdf->output_block,
5064 hash_length);
5065 if (status != PSA_SUCCESS) {
5066 return status;
5067 }
5068 }
5069 status = psa_mac_update(&hkdf->hmac,
5070 hkdf->info,
5071 hkdf->info_length);
5072 if (status != PSA_SUCCESS) {
5073 return status;
5074 }
5075 status = psa_mac_update(&hkdf->hmac,
5076 &hkdf->block_number, 1);
5077 if (status != PSA_SUCCESS) {
5078 return status;
5079 }
5080 status = psa_mac_sign_finish(&hkdf->hmac,
5081 hkdf->output_block,
5082 sizeof(hkdf->output_block),
5083 &hmac_output_length);
5084 if (status != PSA_SUCCESS) {
5085 return status;
5086 }
Gilles Peskinebef7f142018-07-12 17:22:21 +02005087 }
5088
Gilles Peskine449bd832023-01-11 14:50:10 +01005089 return PSA_SUCCESS;
Gilles Peskinebef7f142018-07-12 17:22:21 +02005090}
Przemek Stekiel69c46792022-06-10 12:59:51 +02005091#endif /* BUILTIN_ALG_ANY_HKDF */
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005092
John Durkop07cc04a2020-11-16 22:08:34 -08005093#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
5094 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Janos Follath7742fee2019-06-17 12:58:10 +01005095static psa_status_t psa_key_derivation_tls12_prf_generate_next_block(
5096 psa_tls12_prf_key_derivation_t *tls12_prf,
Gilles Peskine449bd832023-01-11 14:50:10 +01005097 psa_algorithm_t alg)
Janos Follath7742fee2019-06-17 12:58:10 +01005098{
Gilles Peskine449bd832023-01-11 14:50:10 +01005099 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(alg);
5100 uint8_t hash_length = PSA_HASH_LENGTH(hash_alg);
Steven Cooremana6df6042021-04-29 19:32:25 +02005101 psa_mac_operation_t hmac = PSA_MAC_OPERATION_INIT;
5102 size_t hmac_output_length;
Janos Follathea29bfb2019-06-19 12:21:20 +01005103 psa_status_t status, cleanup_status;
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005104
Janos Follath7742fee2019-06-17 12:58:10 +01005105 /* We can't be wanting more output after block 0xff, otherwise
5106 * the capacity check in psa_key_derivation_output_bytes() would have
5107 * prevented this call. It could happen only if the operation
5108 * object was corrupted or if this function is called directly
5109 * inside the library. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005110 if (tls12_prf->block_number == 0xff) {
5111 return PSA_ERROR_CORRUPTION_DETECTED;
5112 }
Janos Follath7742fee2019-06-17 12:58:10 +01005113
5114 /* We need a new block */
5115 ++tls12_prf->block_number;
Janos Follath844eb0e2019-06-19 12:10:49 +01005116 tls12_prf->left_in_block = hash_length;
Janos Follath7742fee2019-06-17 12:58:10 +01005117
5118 /* Recall the definition of the TLS-1.2-PRF from RFC 5246:
5119 *
5120 * PRF(secret, label, seed) = P_<hash>(secret, label + seed)
5121 *
5122 * P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
5123 * HMAC_hash(secret, A(2) + seed) +
5124 * HMAC_hash(secret, A(3) + seed) + ...
5125 *
5126 * A(0) = seed
Janos Follathea29bfb2019-06-19 12:21:20 +01005127 * A(i) = HMAC_hash(secret, A(i-1))
Janos Follath7742fee2019-06-17 12:58:10 +01005128 *
Janos Follathea29bfb2019-06-19 12:21:20 +01005129 * The `psa_tls12_prf_key_derivation` structure saves the block
Janos Follath7742fee2019-06-17 12:58:10 +01005130 * `HMAC_hash(secret, A(i) + seed)` from which the output
Janos Follath76c39842019-06-26 12:50:36 +01005131 * is currently extracted as `output_block` and where i is
5132 * `block_number`.
Janos Follath7742fee2019-06-17 12:58:10 +01005133 */
5134
Gilles Peskine449bd832023-01-11 14:50:10 +01005135 status = psa_key_derivation_start_hmac(&hmac,
5136 hash_alg,
5137 tls12_prf->secret,
5138 tls12_prf->secret_length);
5139 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005140 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005141 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005142
5143 /* Calculate A(i) where i = tls12_prf->block_number. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005144 if (tls12_prf->block_number == 1) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005145 /* A(1) = HMAC_hash(secret, A(0)), where A(0) = seed. (The RFC overloads
5146 * the variable seed and in this instance means it in the context of the
5147 * P_hash function, where seed = label + seed.) */
Gilles Peskine449bd832023-01-11 14:50:10 +01005148 status = psa_mac_update(&hmac,
5149 tls12_prf->label,
5150 tls12_prf->label_length);
5151 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005152 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005153 }
5154 status = psa_mac_update(&hmac,
5155 tls12_prf->seed,
5156 tls12_prf->seed_length);
5157 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005158 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005159 }
5160 } else {
Janos Follathea29bfb2019-06-19 12:21:20 +01005161 /* A(i) = HMAC_hash(secret, A(i-1)) */
Gilles Peskine449bd832023-01-11 14:50:10 +01005162 status = psa_mac_update(&hmac, tls12_prf->Ai, hash_length);
5163 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005164 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005165 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005166 }
5167
Gilles Peskine449bd832023-01-11 14:50:10 +01005168 status = psa_mac_sign_finish(&hmac,
5169 tls12_prf->Ai, hash_length,
5170 &hmac_output_length);
5171 if (hmac_output_length != hash_length) {
Steven Cooremana6df6042021-04-29 19:32:25 +02005172 status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine449bd832023-01-11 14:50:10 +01005173 }
5174 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005175 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005176 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005177
5178 /* Calculate HMAC_hash(secret, A(i) + label + seed). */
Gilles Peskine449bd832023-01-11 14:50:10 +01005179 status = psa_key_derivation_start_hmac(&hmac,
5180 hash_alg,
5181 tls12_prf->secret,
5182 tls12_prf->secret_length);
5183 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005184 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005185 }
5186 status = psa_mac_update(&hmac, tls12_prf->Ai, hash_length);
5187 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005188 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005189 }
5190 status = psa_mac_update(&hmac, tls12_prf->label, tls12_prf->label_length);
5191 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005192 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005193 }
5194 status = psa_mac_update(&hmac, tls12_prf->seed, tls12_prf->seed_length);
5195 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005196 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005197 }
5198 status = psa_mac_sign_finish(&hmac,
5199 tls12_prf->output_block, hash_length,
5200 &hmac_output_length);
5201 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005202 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005203 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005204
Janos Follath7742fee2019-06-17 12:58:10 +01005205
5206cleanup:
Gilles Peskine449bd832023-01-11 14:50:10 +01005207 cleanup_status = psa_mac_abort(&hmac);
5208 if (status == PSA_SUCCESS && cleanup_status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005209 status = cleanup_status;
Gilles Peskine449bd832023-01-11 14:50:10 +01005210 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005211
Gilles Peskine449bd832023-01-11 14:50:10 +01005212 return status;
Janos Follath7742fee2019-06-17 12:58:10 +01005213}
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005214
Janos Follath844eb0e2019-06-19 12:10:49 +01005215static psa_status_t psa_key_derivation_tls12_prf_read(
5216 psa_tls12_prf_key_derivation_t *tls12_prf,
5217 psa_algorithm_t alg,
5218 uint8_t *output,
Gilles Peskine449bd832023-01-11 14:50:10 +01005219 size_t output_length)
Janos Follath844eb0e2019-06-19 12:10:49 +01005220{
Gilles Peskine449bd832023-01-11 14:50:10 +01005221 psa_algorithm_t hash_alg = PSA_ALG_TLS12_PRF_GET_HASH(alg);
5222 uint8_t hash_length = PSA_HASH_LENGTH(hash_alg);
Janos Follath844eb0e2019-06-19 12:10:49 +01005223 psa_status_t status;
5224 uint8_t offset, length;
5225
Gilles Peskine449bd832023-01-11 14:50:10 +01005226 switch (tls12_prf->state) {
Gilles Peskineb1edaec2021-06-11 22:41:46 +02005227 case PSA_TLS12_PRF_STATE_LABEL_SET:
5228 tls12_prf->state = PSA_TLS12_PRF_STATE_OUTPUT;
5229 break;
5230 case PSA_TLS12_PRF_STATE_OUTPUT:
5231 break;
5232 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01005233 return PSA_ERROR_BAD_STATE;
Gilles Peskineb1edaec2021-06-11 22:41:46 +02005234 }
5235
Gilles Peskine449bd832023-01-11 14:50:10 +01005236 while (output_length != 0) {
Janos Follath844eb0e2019-06-19 12:10:49 +01005237 /* Check if we have fully processed the current block. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005238 if (tls12_prf->left_in_block == 0) {
5239 status = psa_key_derivation_tls12_prf_generate_next_block(tls12_prf,
5240 alg);
5241 if (status != PSA_SUCCESS) {
5242 return status;
5243 }
Janos Follath844eb0e2019-06-19 12:10:49 +01005244
5245 continue;
5246 }
5247
Gilles Peskine449bd832023-01-11 14:50:10 +01005248 if (tls12_prf->left_in_block > output_length) {
Janos Follath844eb0e2019-06-19 12:10:49 +01005249 length = (uint8_t) output_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01005250 } else {
Janos Follath844eb0e2019-06-19 12:10:49 +01005251 length = tls12_prf->left_in_block;
Gilles Peskine449bd832023-01-11 14:50:10 +01005252 }
Janos Follath844eb0e2019-06-19 12:10:49 +01005253
5254 offset = hash_length - tls12_prf->left_in_block;
Gilles Peskine449bd832023-01-11 14:50:10 +01005255 memcpy(output, tls12_prf->output_block + offset, length);
Janos Follath844eb0e2019-06-19 12:10:49 +01005256 output += length;
5257 output_length -= length;
5258 tls12_prf->left_in_block -= length;
5259 }
5260
Gilles Peskine449bd832023-01-11 14:50:10 +01005261 return PSA_SUCCESS;
Janos Follath844eb0e2019-06-19 12:10:49 +01005262}
John Durkop07cc04a2020-11-16 22:08:34 -08005263#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF ||
5264 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Gilles Peskinebef7f142018-07-12 17:22:21 +02005265
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005266#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
5267static psa_status_t psa_key_derivation_tls12_ecjpake_to_pms_read(
5268 psa_tls12_ecjpake_to_pms_t *ecjpake,
5269 uint8_t *output,
Gilles Peskine449bd832023-01-11 14:50:10 +01005270 size_t output_length)
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005271{
5272 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Andrzej Kurek5603efd2022-09-26 10:49:16 -04005273 size_t output_size = 0;
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005274
Gilles Peskine449bd832023-01-11 14:50:10 +01005275 if (output_length != 32) {
5276 return PSA_ERROR_INVALID_ARGUMENT;
5277 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005278
Gilles Peskine449bd832023-01-11 14:50:10 +01005279 status = psa_hash_compute(PSA_ALG_SHA_256, ecjpake->data,
5280 PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE, output, output_length,
5281 &output_size);
5282 if (status != PSA_SUCCESS) {
5283 return status;
5284 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005285
Gilles Peskine449bd832023-01-11 14:50:10 +01005286 if (output_size != output_length) {
5287 return PSA_ERROR_GENERIC_ERROR;
5288 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005289
Gilles Peskine449bd832023-01-11 14:50:10 +01005290 return PSA_SUCCESS;
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005291}
5292#endif
5293
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05305294#if defined(PSA_HAVE_SOFT_PBKDF2)
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305295static psa_status_t psa_key_derivation_pbkdf2_generate_block(
5296 psa_pbkdf2_key_derivation_t *pbkdf2,
5297 psa_algorithm_t prf_alg,
5298 uint8_t prf_output_length,
5299 psa_key_attributes_t *attributes)
5300{
5301 psa_status_t status;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305302 psa_mac_operation_t mac_operation = PSA_MAC_OPERATION_INIT;
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305303 size_t mac_output_length;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305304 uint8_t U_i[PSA_MAC_MAX_SIZE];
Kusumit Ghoderao257ea002023-06-14 15:55:11 +05305305 uint8_t *U_accumulator = pbkdf2->output_block;
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305306 uint64_t i;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305307 uint8_t block_counter[4];
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305308
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305309 mac_operation.is_sign = 1;
5310 mac_operation.mac_size = prf_output_length;
5311 MBEDTLS_PUT_UINT32_BE(pbkdf2->block_number, block_counter, 0);
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305312
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305313 status = psa_driver_wrapper_mac_sign_setup(&mac_operation,
5314 attributes,
5315 pbkdf2->password,
5316 pbkdf2->password_length,
5317 prf_alg);
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305318 if (status != PSA_SUCCESS) {
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305319 goto cleanup;
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305320 }
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305321 status = psa_mac_update(&mac_operation, pbkdf2->salt, pbkdf2->salt_length);
5322 if (status != PSA_SUCCESS) {
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305323 goto cleanup;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305324 }
Kusumit Ghoderao257ea002023-06-14 15:55:11 +05305325 status = psa_mac_update(&mac_operation, block_counter, sizeof(block_counter));
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305326 if (status != PSA_SUCCESS) {
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305327 goto cleanup;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305328 }
5329 status = psa_mac_sign_finish(&mac_operation, U_i, sizeof(U_i),
5330 &mac_output_length);
5331 if (status != PSA_SUCCESS) {
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305332 goto cleanup;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305333 }
5334
5335 if (mac_output_length != prf_output_length) {
Kusumit Ghoderao257ea002023-06-14 15:55:11 +05305336 status = PSA_ERROR_CORRUPTION_DETECTED;
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305337 goto cleanup;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305338 }
5339
Kusumit Ghoderao257ea002023-06-14 15:55:11 +05305340 memcpy(U_accumulator, U_i, prf_output_length);
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305341
5342 for (i = 1; i < pbkdf2->input_cost; i++) {
Kusumit Ghoderao4536bb62023-06-22 15:42:59 +05305343 /* We are passing prf_output_length as mac_size because the driver
5344 * function directly sets mac_output_length as mac_size upon success.
Kusumit Ghoderao5f3345a2023-07-27 21:21:38 +05305345 * See https://github.com/Mbed-TLS/mbedtls/issues/7801 */
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305346 status = psa_driver_wrapper_mac_compute(attributes,
5347 pbkdf2->password,
5348 pbkdf2->password_length,
5349 prf_alg, U_i, prf_output_length,
Kusumit Ghoderao4536bb62023-06-22 15:42:59 +05305350 U_i, prf_output_length,
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305351 &mac_output_length);
5352 if (status != PSA_SUCCESS) {
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305353 goto cleanup;
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305354 }
5355
Kusumit Ghoderao109ee3d2023-06-08 16:36:45 +05305356 mbedtls_xor(U_accumulator, U_accumulator, U_i, prf_output_length);
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305357 }
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305358
5359cleanup:
5360 /* Zeroise buffers to clear sensitive data from memory. */
5361 mbedtls_platform_zeroize(U_i, PSA_MAC_MAX_SIZE);
5362 return status;
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305363}
Kusumit Ghoderaof6a0d572023-06-05 14:55:56 +05305364
5365static psa_status_t psa_key_derivation_pbkdf2_read(
5366 psa_pbkdf2_key_derivation_t *pbkdf2,
5367 psa_algorithm_t kdf_alg,
5368 uint8_t *output,
5369 size_t output_length)
5370{
5371 psa_status_t status;
5372 psa_algorithm_t prf_alg;
5373 uint8_t prf_output_length;
5374 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
5375 psa_set_key_bits(&attributes, PSA_BYTES_TO_BITS(pbkdf2->password_length));
5376 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_MESSAGE);
5377
5378 if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) {
5379 prf_alg = PSA_ALG_HMAC(PSA_ALG_PBKDF2_HMAC_GET_HASH(kdf_alg));
5380 prf_output_length = PSA_HASH_LENGTH(prf_alg);
5381 psa_set_key_type(&attributes, PSA_KEY_TYPE_HMAC);
Kusumit Ghoderaoa2520a52023-06-22 15:42:19 +05305382 } else if (kdf_alg == PSA_ALG_PBKDF2_AES_CMAC_PRF_128) {
5383 prf_alg = PSA_ALG_CMAC;
Kusumit Ghoderaoa12e2d52023-07-27 21:18:30 +05305384 prf_output_length = PSA_MAC_LENGTH(PSA_KEY_TYPE_AES, 128U, PSA_ALG_CMAC);
Kusumit Ghoderaoa2520a52023-06-22 15:42:19 +05305385 psa_set_key_type(&attributes, PSA_KEY_TYPE_AES);
Kusumit Ghoderaod9ec1af2023-06-08 20:19:51 +05305386 } else {
5387 return PSA_ERROR_INVALID_ARGUMENT;
Kusumit Ghoderaof6a0d572023-06-05 14:55:56 +05305388 }
5389
5390 switch (pbkdf2->state) {
5391 case PSA_PBKDF2_STATE_PASSWORD_SET:
5392 /* Initially we need a new block so bytes_used is equal to block size*/
5393 pbkdf2->bytes_used = prf_output_length;
5394 pbkdf2->state = PSA_PBKDF2_STATE_OUTPUT;
5395 break;
5396 case PSA_PBKDF2_STATE_OUTPUT:
5397 break;
5398 default:
5399 return PSA_ERROR_BAD_STATE;
5400 }
5401
5402 while (output_length != 0) {
5403 uint8_t n = prf_output_length - pbkdf2->bytes_used;
5404 if (n > output_length) {
5405 n = (uint8_t) output_length;
5406 }
5407 memcpy(output, pbkdf2->output_block + pbkdf2->bytes_used, n);
5408 output += n;
5409 output_length -= n;
5410 pbkdf2->bytes_used += n;
5411
5412 if (output_length == 0) {
5413 break;
5414 }
5415
5416 /* We need a new block */
5417 pbkdf2->bytes_used = 0;
5418 pbkdf2->block_number++;
5419
5420 status = psa_key_derivation_pbkdf2_generate_block(pbkdf2, prf_alg,
5421 prf_output_length,
5422 &attributes);
5423 if (status != PSA_SUCCESS) {
5424 return status;
5425 }
5426 }
5427
5428 return PSA_SUCCESS;
5429}
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05305430#endif /* PSA_HAVE_SOFT_PBKDF2 */
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305431
Janos Follath6c6c8fc2019-06-17 12:38:20 +01005432psa_status_t psa_key_derivation_output_bytes(
5433 psa_key_derivation_operation_t *operation,
5434 uint8_t *output,
Gilles Peskine449bd832023-01-11 14:50:10 +01005435 size_t output_length)
Gilles Peskineeab56e42018-07-12 17:12:33 +02005436{
5437 psa_status_t status;
Gilles Peskine449bd832023-01-11 14:50:10 +01005438 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation);
Gilles Peskineeab56e42018-07-12 17:12:33 +02005439
Gilles Peskine449bd832023-01-11 14:50:10 +01005440 if (operation->alg == 0) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005441 /* This is a blank operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005442 return PSA_ERROR_BAD_STATE;
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005443 }
5444
Gilles Peskine449bd832023-01-11 14:50:10 +01005445 if (output_length > operation->capacity) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005446 operation->capacity = 0;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005447 /* Go through the error path to wipe all confidential data now
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005448 * that the operation object is useless. */
David Saadab4ecc272019-02-14 13:48:10 +02005449 status = PSA_ERROR_INSUFFICIENT_DATA;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005450 goto exit;
5451 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005452 if (output_length == 0 && operation->capacity == 0) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005453 /* Edge case: this is a finished operation, and 0 bytes
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005454 * were requested. The right error in this case could
Gilles Peskineeab56e42018-07-12 17:12:33 +02005455 * be either INSUFFICIENT_CAPACITY or BAD_STATE. Return
5456 * INSUFFICIENT_CAPACITY, which is right for a finished
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005457 * operation, for consistency with the case when
Gilles Peskineeab56e42018-07-12 17:12:33 +02005458 * output_length > 0. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005459 return PSA_ERROR_INSUFFICIENT_DATA;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005460 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005461 operation->capacity -= output_length;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005462
Przemek Stekiel69c46792022-06-10 12:59:51 +02005463#if defined(BUILTIN_ALG_ANY_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01005464 if (PSA_ALG_IS_ANY_HKDF(kdf_alg)) {
5465 status = psa_key_derivation_hkdf_read(&operation->ctx.hkdf, kdf_alg,
5466 output, output_length);
5467 } else
Przemek Stekiel69c46792022-06-10 12:59:51 +02005468#endif /* BUILTIN_ALG_ANY_HKDF */
John Durkop07cc04a2020-11-16 22:08:34 -08005469#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
5470 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005471 if (PSA_ALG_IS_TLS12_PRF(kdf_alg) ||
5472 PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
5473 status = psa_key_derivation_tls12_prf_read(&operation->ctx.tls12_prf,
5474 kdf_alg, output,
5475 output_length);
5476 } else
John Durkop07cc04a2020-11-16 22:08:34 -08005477#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF ||
5478 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005479#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005480 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005481 status = psa_key_derivation_tls12_ecjpake_to_pms_read(
Gilles Peskine449bd832023-01-11 14:50:10 +01005482 &operation->ctx.tls12_ecjpake_to_pms, output, output_length);
5483 } else
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005484#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05305485#if defined(PSA_HAVE_SOFT_PBKDF2)
Kusumit Ghoderao9ab03c32023-07-27 21:14:05 +05305486 if (PSA_ALG_IS_PBKDF2(kdf_alg)) {
Kusumit Ghoderaof6a0d572023-06-05 14:55:56 +05305487 status = psa_key_derivation_pbkdf2_read(&operation->ctx.pbkdf2, kdf_alg,
5488 output, output_length);
Kusumit Ghoderao056f0c52023-05-03 15:58:34 +05305489 } else
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05305490#endif /* PSA_HAVE_SOFT_PBKDF2 */
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005491
Gilles Peskineeab56e42018-07-12 17:12:33 +02005492 {
Steven Cooreman74afe472021-02-10 17:19:22 +01005493 (void) kdf_alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01005494 return PSA_ERROR_BAD_STATE;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005495 }
5496
5497exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01005498 if (status != PSA_SUCCESS) {
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005499 /* Preserve the algorithm upon errors, but clear all sensitive state.
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005500 * This allows us to differentiate between exhausted operations and
5501 * blank operations, so we can return PSA_ERROR_BAD_STATE on blank
5502 * operations. */
5503 psa_algorithm_t alg = operation->alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01005504 psa_key_derivation_abort(operation);
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005505 operation->alg = alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01005506 memset(output, '!', output_length);
Gilles Peskineeab56e42018-07-12 17:12:33 +02005507 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005508 return status;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005509}
5510
David Brown7807bf72021-02-09 16:28:23 -07005511#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Gilles Peskine449bd832023-01-11 14:50:10 +01005512static void psa_des_set_key_parity(uint8_t *data, size_t data_size)
Gilles Peskine08542d82018-07-19 17:05:42 +02005513{
Gilles Peskine449bd832023-01-11 14:50:10 +01005514 if (data_size >= 8) {
5515 mbedtls_des_key_set_parity(data);
5516 }
5517 if (data_size >= 16) {
5518 mbedtls_des_key_set_parity(data + 8);
5519 }
5520 if (data_size >= 24) {
5521 mbedtls_des_key_set_parity(data + 16);
5522 }
Gilles Peskine08542d82018-07-19 17:05:42 +02005523}
David Brown7807bf72021-02-09 16:28:23 -07005524#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */
Gilles Peskine08542d82018-07-19 17:05:42 +02005525
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005526/*
Gilles Peskine449bd832023-01-11 14:50:10 +01005527 * ECC keys on a Weierstrass elliptic curve require the generation
5528 * of a private key which is an integer
5529 * in the range [1, N - 1], where N is the boundary of the private key domain:
5530 * N is the prime p for Diffie-Hellman, or the order of the
5531 * curve’s base point for ECC.
5532 *
5533 * Let m be the bit size of N, such that 2^m > N >= 2^(m-1).
5534 * This function generates the private key using the following process:
5535 *
5536 * 1. Draw a byte string of length ceiling(m/8) bytes.
5537 * 2. If m is not a multiple of 8, set the most significant
5538 * (8 * ceiling(m/8) - m) bits of the first byte in the string to zero.
5539 * 3. Convert the string to integer k by decoding it as a big-endian byte string.
5540 * 4. If k > N - 2, discard the result and return to step 1.
5541 * 5. Output k + 1 as the private key.
5542 *
5543 * This method allows compliance to NIST standards, specifically the methods titled
5544 * Key-Pair Generation by Testing Candidates in the following publications:
5545 * - NIST Special Publication 800-56A: Recommendation for Pair-Wise Key-Establishment
5546 * Schemes Using Discrete Logarithm Cryptography [SP800-56A] §5.6.1.1.4 for
5547 * Diffie-Hellman keys.
5548 *
5549 * - [SP800-56A] §5.6.1.2.2 or FIPS Publication 186-4: Digital Signature
5550 * Standard (DSS) [FIPS186-4] §B.4.2 for elliptic curve keys.
5551 *
5552 * Note: Function allocates memory for *data buffer, so given *data should be
5553 * always NULL.
5554 */
Valerio Setti86587ab2023-06-27 13:09:30 +02005555#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE)
5556#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE)
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01005557static psa_status_t psa_generate_derived_ecc_key_weierstrass_helper(
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005558 psa_key_slot_t *slot,
5559 size_t bits,
5560 psa_key_derivation_operation_t *operation,
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005561 uint8_t **data
5562 )
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005563{
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005564 unsigned key_out_of_range = 1;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005565 mbedtls_mpi k;
5566 mbedtls_mpi diff_N_2;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005567 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Przemek Stekiela81aed22022-03-01 15:13:30 +01005568 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01005569 size_t m;
5570 size_t m_bytes;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005571
Gilles Peskine449bd832023-01-11 14:50:10 +01005572 mbedtls_mpi_init(&k);
5573 mbedtls_mpi_init(&diff_N_2);
Przemyslaw Stekiel1dfd1222021-11-18 13:35:00 +01005574
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005575 psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY(
Gilles Peskine449bd832023-01-11 14:50:10 +01005576 slot->attr.type);
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005577 mbedtls_ecp_group_id grp_id =
Valerio Settid36c3132023-12-21 14:03:51 +01005578 mbedtls_ecc_group_from_psa(curve, bits);
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005579
Gilles Peskine449bd832023-01-11 14:50:10 +01005580 if (grp_id == MBEDTLS_ECP_DP_NONE) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005581 ret = MBEDTLS_ERR_ASN1_INVALID_DATA;
Przemyslaw Stekiel871a3362021-12-02 08:46:39 +01005582 goto cleanup;
5583 }
5584
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005585 mbedtls_ecp_group ecp_group;
Gilles Peskine449bd832023-01-11 14:50:10 +01005586 mbedtls_ecp_group_init(&ecp_group);
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005587
Gilles Peskine449bd832023-01-11 14:50:10 +01005588 MBEDTLS_MPI_CHK(mbedtls_ecp_group_load(&ecp_group, grp_id));
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005589
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005590 /* N is the boundary of the private key domain (ecp_group.N). */
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005591 /* Let m be the bit size of N. */
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01005592 m = ecp_group.nbits;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005593
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01005594 m_bytes = PSA_BITS_TO_BYTES(m);
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005595
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005596 /* Calculate N - 2 - it will be needed later. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005597 MBEDTLS_MPI_CHK(mbedtls_mpi_sub_int(&diff_N_2, &ecp_group.N, 2));
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005598
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005599 /* Note: This function is always called with *data == NULL and it
5600 * allocates memory for the data buffer. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005601 *data = mbedtls_calloc(1, m_bytes);
5602 if (*data == NULL) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005603 ret = MBEDTLS_ERR_ASN1_ALLOC_FAILED;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005604 goto cleanup;
5605 }
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005606
Gilles Peskine449bd832023-01-11 14:50:10 +01005607 while (key_out_of_range) {
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005608 /* 1. Draw a byte string of length ceiling(m/8) bytes. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005609 if ((status = psa_key_derivation_output_bytes(operation, *data, m_bytes)) != 0) {
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005610 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005611 }
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005612
5613 /* 2. If m is not a multiple of 8 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005614 if (m % 8 != 0) {
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005615 /* Set the most significant
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005616 * (8 * ceiling(m/8) - m) bits of the first byte in
5617 * the string to zero.
5618 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005619 uint8_t clear_bit_mask = (1 << (m % 8)) - 1;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005620 (*data)[0] &= clear_bit_mask;
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005621 }
5622
5623 /* 3. Convert the string to integer k by decoding it as a
Gilles Peskine449bd832023-01-11 14:50:10 +01005624 * big-endian byte string.
5625 */
5626 MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(&k, *data, m_bytes));
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005627
5628 /* 4. If k > N - 2, discard the result and return to step 1.
Gilles Peskine449bd832023-01-11 14:50:10 +01005629 * Result of comparison is returned. When it indicates error
5630 * then this function is called again.
5631 */
5632 MBEDTLS_MPI_CHK(mbedtls_mpi_lt_mpi_ct(&diff_N_2, &k, &key_out_of_range));
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005633 }
5634
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005635 /* 5. Output k + 1 as the private key. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005636 MBEDTLS_MPI_CHK(mbedtls_mpi_add_int(&k, &k, 1));
5637 MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(&k, *data, m_bytes));
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005638cleanup:
Gilles Peskine449bd832023-01-11 14:50:10 +01005639 if (ret != 0) {
5640 status = mbedtls_to_psa_error(ret);
5641 }
5642 if (status != PSA_SUCCESS) {
5643 mbedtls_free(*data);
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005644 *data = NULL;
5645 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005646 mbedtls_mpi_free(&k);
5647 mbedtls_mpi_free(&diff_N_2);
5648 return status;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005649}
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005650
5651/* ECC keys on a Montgomery elliptic curve draws a byte string whose length
5652 * is determined by the curve, and sets the mandatory bits accordingly. That is:
5653 *
5654 * - Curve25519 (PSA_ECC_FAMILY_MONTGOMERY, 255 bits):
5655 * draw a 32-byte string and process it as specified in
5656 * Elliptic Curves for Security [RFC7748] §5.
5657 *
5658 * - Curve448 (PSA_ECC_FAMILY_MONTGOMERY, 448 bits):
5659 * draw a 56-byte string and process it as specified in [RFC7748] §5.
5660 *
5661 * Note: Function allocates memory for *data buffer, so given *data should be
5662 * always NULL.
5663 */
5664
5665static psa_status_t psa_generate_derived_ecc_key_montgomery_helper(
5666 size_t bits,
5667 psa_key_derivation_operation_t *operation,
5668 uint8_t **data
5669 )
5670{
5671 size_t output_length;
Przemek Stekiela81aed22022-03-01 15:13:30 +01005672 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005673
Gilles Peskine449bd832023-01-11 14:50:10 +01005674 switch (bits) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005675 case 255:
5676 output_length = 32;
5677 break;
5678 case 448:
5679 output_length = 56;
5680 break;
5681 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01005682 return PSA_ERROR_INVALID_ARGUMENT;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005683 break;
5684 }
5685
Gilles Peskine449bd832023-01-11 14:50:10 +01005686 *data = mbedtls_calloc(1, output_length);
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005687
Gilles Peskine449bd832023-01-11 14:50:10 +01005688 if (*data == NULL) {
5689 return PSA_ERROR_INSUFFICIENT_MEMORY;
5690 }
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005691
Gilles Peskine449bd832023-01-11 14:50:10 +01005692 status = psa_key_derivation_output_bytes(operation, *data, output_length);
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005693
Gilles Peskine449bd832023-01-11 14:50:10 +01005694 if (status != PSA_SUCCESS) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005695 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01005696 }
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005697
Gilles Peskine449bd832023-01-11 14:50:10 +01005698 switch (bits) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005699 case 255:
5700 (*data)[0] &= 248;
5701 (*data)[31] &= 127;
5702 (*data)[31] |= 64;
5703 break;
5704 case 448:
5705 (*data)[0] &= 252;
5706 (*data)[55] |= 128;
5707 break;
5708 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01005709 return PSA_ERROR_CORRUPTION_DETECTED;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005710 break;
5711 }
5712
5713 return status;
5714}
Valerio Setti86587ab2023-06-27 13:09:30 +02005715#else /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE */
5716static psa_status_t psa_generate_derived_ecc_key_weierstrass_helper(
5717 psa_key_slot_t *slot, size_t bits,
5718 psa_key_derivation_operation_t *operation, uint8_t **data)
5719{
5720 (void) slot;
5721 (void) bits;
5722 (void) operation;
5723 (void) data;
5724 return PSA_ERROR_NOT_SUPPORTED;
5725}
5726
5727static psa_status_t psa_generate_derived_ecc_key_montgomery_helper(
5728 size_t bits, psa_key_derivation_operation_t *operation, uint8_t **data)
5729{
5730 (void) bits;
5731 (void) operation;
5732 (void) data;
5733 return PSA_ERROR_NOT_SUPPORTED;
5734}
5735#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE */
5736#endif /* PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE */
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005737
Adrian L. Shaw5a5a79a2019-05-03 15:44:28 +01005738static psa_status_t psa_generate_derived_key_internal(
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005739 psa_key_slot_t *slot,
5740 size_t bits,
Gilles Peskine449bd832023-01-11 14:50:10 +01005741 psa_key_derivation_operation_t *operation)
Gilles Peskineeab56e42018-07-12 17:12:33 +02005742{
5743 uint8_t *data = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01005744 size_t bytes = PSA_BITS_TO_BYTES(bits);
Archanad8a83dc2021-06-14 10:04:16 +05305745 size_t storage_size = bytes;
Przemek Stekiela81aed22022-03-01 15:13:30 +01005746 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005747
Gilles Peskine449bd832023-01-11 14:50:10 +01005748 if (PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type)) {
5749 return PSA_ERROR_INVALID_ARGUMENT;
5750 }
Gilles Peskineeab56e42018-07-12 17:12:33 +02005751
Valerio Setti8ffdb5d2023-06-20 13:14:08 +02005752#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE) || \
Valerio Settidd24f292023-06-26 12:21:17 +02005753 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE)
Gilles Peskine449bd832023-01-11 14:50:10 +01005754 if (PSA_KEY_TYPE_IS_ECC(slot->attr.type)) {
5755 psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY(slot->attr.type);
5756 if (PSA_ECC_FAMILY_IS_WEIERSTRASS(curve)) {
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01005757 /* Weierstrass elliptic curve */
Gilles Peskine449bd832023-01-11 14:50:10 +01005758 status = psa_generate_derived_ecc_key_weierstrass_helper(slot, bits, operation, &data);
5759 if (status != PSA_SUCCESS) {
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005760 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005761 }
5762 } else {
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01005763 /* Montgomery elliptic curve */
Gilles Peskine449bd832023-01-11 14:50:10 +01005764 status = psa_generate_derived_ecc_key_montgomery_helper(bits, operation, &data);
5765 if (status != PSA_SUCCESS) {
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01005766 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005767 }
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01005768 }
Przemyslaw Stekiel1dfd1222021-11-18 13:35:00 +01005769 } else
Valerio Setti8ffdb5d2023-06-20 13:14:08 +02005770#endif /* defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE) ||
Valerio Settidd24f292023-06-26 12:21:17 +02005771 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE) */
Gilles Peskine449bd832023-01-11 14:50:10 +01005772 if (key_type_is_raw_bytes(slot->attr.type)) {
5773 if (bits % 8 != 0) {
5774 return PSA_ERROR_INVALID_ARGUMENT;
5775 }
5776 data = mbedtls_calloc(1, bytes);
5777 if (data == NULL) {
5778 return PSA_ERROR_INSUFFICIENT_MEMORY;
5779 }
Przemyslaw Stekiel1608e332021-11-09 10:46:40 +01005780
Gilles Peskine449bd832023-01-11 14:50:10 +01005781 status = psa_key_derivation_output_bytes(operation, data, bytes);
5782 if (status != PSA_SUCCESS) {
Przemyslaw Stekiel1608e332021-11-09 10:46:40 +01005783 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005784 }
David Brown12ca5032021-02-11 11:02:00 -07005785#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Gilles Peskine449bd832023-01-11 14:50:10 +01005786 if (slot->attr.type == PSA_KEY_TYPE_DES) {
5787 psa_des_set_key_parity(data, bytes);
5788 }
Przemek Stekielf110dc02022-03-01 14:48:05 +01005789#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES) */
Gilles Peskine449bd832023-01-11 14:50:10 +01005790 } else {
5791 return PSA_ERROR_NOT_SUPPORTED;
Przemyslaw Stekiel1608e332021-11-09 10:46:40 +01005792 }
Ronald Crondd04d422020-11-28 15:14:42 +01005793
Ronald Cronbf33c932020-11-28 18:06:53 +01005794 slot->attr.bits = (psa_key_bits_t) bits;
Ronald Cron2ebfdcc2020-11-28 15:54:54 +01005795
Gilles Peskine2f107ae2024-02-28 01:26:46 +01005796 if (psa_key_lifetime_is_external(slot->attr.lifetime)) {
Gilles Peskine7a5d9202024-02-28 01:18:23 +01005797 status = psa_driver_wrapper_get_key_buffer_size(&slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01005798 &storage_size);
5799 if (status != PSA_SUCCESS) {
Archanad8a83dc2021-06-14 10:04:16 +05305800 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005801 }
Archanad8a83dc2021-06-14 10:04:16 +05305802 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005803 status = psa_allocate_buffer_to_slot(slot, storage_size);
5804 if (status != PSA_SUCCESS) {
Archanad8a83dc2021-06-14 10:04:16 +05305805 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005806 }
Archanad8a83dc2021-06-14 10:04:16 +05305807
Gilles Peskine7a5d9202024-02-28 01:18:23 +01005808 status = psa_driver_wrapper_import_key(&slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01005809 data, bytes,
5810 slot->key.data,
5811 slot->key.bytes,
5812 &slot->key.bytes, &bits);
5813 if (bits != slot->attr.bits) {
Ronald Cronbf33c932020-11-28 18:06:53 +01005814 status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine449bd832023-01-11 14:50:10 +01005815 }
Gilles Peskineeab56e42018-07-12 17:12:33 +02005816
5817exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01005818 mbedtls_free(data);
5819 return status;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005820}
5821
Gilles Peskine092ce512024-02-20 12:31:24 +01005822static const psa_key_production_parameters_t default_production_parameters =
5823 PSA_KEY_PRODUCTION_PARAMETERS_INIT;
Gilles Peskinef0765fa2024-02-12 16:46:16 +01005824
Gilles Peskine092ce512024-02-20 12:31:24 +01005825int psa_key_production_parameters_are_default(
5826 const psa_key_production_parameters_t *params,
5827 size_t params_data_length)
Gilles Peskinef0765fa2024-02-12 16:46:16 +01005828{
Gilles Peskine092ce512024-02-20 12:31:24 +01005829 if (params->flags != 0) {
Gilles Peskinef0765fa2024-02-12 16:46:16 +01005830 return 0;
5831 }
Gilles Peskine092ce512024-02-20 12:31:24 +01005832 if (params_data_length != 0) {
Gilles Peskinef0765fa2024-02-12 16:46:16 +01005833 return 0;
5834 }
5835 return 1;
5836}
5837
5838psa_status_t psa_key_derivation_output_key_ext(
5839 const psa_key_attributes_t *attributes,
5840 psa_key_derivation_operation_t *operation,
Gilles Peskine092ce512024-02-20 12:31:24 +01005841 const psa_key_production_parameters_t *params,
5842 size_t params_data_length,
Gilles Peskinef0765fa2024-02-12 16:46:16 +01005843 mbedtls_svc_key_id_t *key)
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005844{
5845 psa_status_t status;
5846 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02005847 psa_se_drv_table_entry_t *driver = NULL;
Gilles Peskine0f84d622019-09-12 19:03:13 +02005848
Ronald Cron81709fc2020-11-14 12:10:32 +01005849 *key = MBEDTLS_SVC_KEY_ID_INIT;
5850
Gilles Peskine0f84d622019-09-12 19:03:13 +02005851 /* Reject any attempt to create a zero-length key so that we don't
5852 * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005853 if (psa_get_key_bits(attributes) == 0) {
5854 return PSA_ERROR_INVALID_ARGUMENT;
5855 }
Gilles Peskine0f84d622019-09-12 19:03:13 +02005856
Gilles Peskine092ce512024-02-20 12:31:24 +01005857 if (!psa_key_production_parameters_are_default(params, params_data_length)) {
Gilles Peskinef0765fa2024-02-12 16:46:16 +01005858 return PSA_ERROR_INVALID_ARGUMENT;
5859 }
5860
Gilles Peskine449bd832023-01-11 14:50:10 +01005861 if (operation->alg == PSA_ALG_NONE) {
5862 return PSA_ERROR_BAD_STATE;
5863 }
Dave Rodgmand69da6c2021-11-16 10:32:48 +00005864
Gilles Peskine449bd832023-01-11 14:50:10 +01005865 if (!operation->can_output_key) {
5866 return PSA_ERROR_NOT_PERMITTED;
5867 }
Gilles Peskine178c9aa2019-09-24 18:21:06 +02005868
Gilles Peskine449bd832023-01-11 14:50:10 +01005869 status = psa_start_key_creation(PSA_KEY_CREATION_DERIVE, attributes,
5870 &slot, &driver);
Gilles Peskinef4ee6622019-07-24 13:44:30 +02005871#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005872 if (driver != NULL) {
Gilles Peskinef4ee6622019-07-24 13:44:30 +02005873 /* Deriving a key in a secure element is not implemented yet. */
5874 status = PSA_ERROR_NOT_SUPPORTED;
5875 }
5876#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskine449bd832023-01-11 14:50:10 +01005877 if (status == PSA_SUCCESS) {
5878 status = psa_generate_derived_key_internal(slot,
Gilles Peskine2f107ae2024-02-28 01:26:46 +01005879 attributes->bits,
Gilles Peskine449bd832023-01-11 14:50:10 +01005880 operation);
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005881 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005882 if (status == PSA_SUCCESS) {
5883 status = psa_finish_key_creation(slot, driver, key);
5884 }
5885 if (status != PSA_SUCCESS) {
5886 psa_fail_key_creation(slot, driver);
5887 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02005888
Gilles Peskine449bd832023-01-11 14:50:10 +01005889 return status;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005890}
5891
Gilles Peskinef0765fa2024-02-12 16:46:16 +01005892psa_status_t psa_key_derivation_output_key(
5893 const psa_key_attributes_t *attributes,
5894 psa_key_derivation_operation_t *operation,
5895 mbedtls_svc_key_id_t *key)
5896{
Gilles Peskinec81393b2024-02-14 20:51:28 +01005897 return psa_key_derivation_output_key_ext(attributes, operation,
Gilles Peskine092ce512024-02-20 12:31:24 +01005898 &default_production_parameters, 0,
Gilles Peskinec81393b2024-02-14 20:51:28 +01005899 key);
Gilles Peskinef0765fa2024-02-12 16:46:16 +01005900}
Gilles Peskineeab56e42018-07-12 17:12:33 +02005901
5902
5903/****************************************************************/
Gilles Peskineea0fb492018-07-12 17:17:20 +02005904/* Key derivation */
5905/****************************************************************/
5906
Steven Cooreman932ffb72021-02-15 12:14:32 +01005907#if defined(AT_LEAST_ONE_BUILTIN_KDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01005908static int is_kdf_alg_supported(psa_algorithm_t kdf_alg)
Gilles Peskine9efde4f2021-04-29 21:10:00 +02005909{
5910#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01005911 if (PSA_ALG_IS_HKDF(kdf_alg)) {
5912 return 1;
5913 }
Gilles Peskine9efde4f2021-04-29 21:10:00 +02005914#endif
Przemek Stekielb57a44b2022-06-06 08:33:45 +02005915#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01005916 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
5917 return 1;
5918 }
Przemek Stekielb57a44b2022-06-06 08:33:45 +02005919#endif
5920#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Gilles Peskine449bd832023-01-11 14:50:10 +01005921 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) {
5922 return 1;
5923 }
Gilles Peskine9efde4f2021-04-29 21:10:00 +02005924#endif
5925#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF)
Gilles Peskine449bd832023-01-11 14:50:10 +01005926 if (PSA_ALG_IS_TLS12_PRF(kdf_alg)) {
5927 return 1;
5928 }
Gilles Peskine9efde4f2021-04-29 21:10:00 +02005929#endif
5930#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005931 if (PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
5932 return 1;
5933 }
Gilles Peskine9efde4f2021-04-29 21:10:00 +02005934#endif
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005935#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005936 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
5937 return 1;
5938 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005939#endif
Kusumit Ghoderaod132cac2023-05-03 12:00:27 +05305940#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC)
5941 if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) {
5942 return 1;
5943 }
5944#endif
Kusumit Ghoderao2cd64962023-06-22 15:38:57 +05305945#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_AES_CMAC_PRF_128)
5946 if (kdf_alg == PSA_ALG_PBKDF2_AES_CMAC_PRF_128) {
5947 return 1;
5948 }
5949#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01005950 return 0;
Gilles Peskine9efde4f2021-04-29 21:10:00 +02005951}
5952
Gilles Peskine449bd832023-01-11 14:50:10 +01005953static psa_status_t psa_hash_try_support(psa_algorithm_t alg)
Gilles Peskine0cc417d2021-04-29 21:18:14 +02005954{
5955 psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT;
Gilles Peskine449bd832023-01-11 14:50:10 +01005956 psa_status_t status = psa_hash_setup(&operation, alg);
5957 psa_hash_abort(&operation);
5958 return status;
Gilles Peskine0cc417d2021-04-29 21:18:14 +02005959}
5960
Kusumit Ghoderao86e83dd2023-12-01 16:38:26 +05305961static psa_status_t psa_key_derivation_set_maximum_capacity(
5962 psa_key_derivation_operation_t *operation,
5963 psa_algorithm_t kdf_alg)
5964{
5965#if defined(PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS)
5966 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
5967 operation->capacity = PSA_HASH_LENGTH(PSA_ALG_SHA_256);
5968 return PSA_SUCCESS;
5969 }
5970#endif
5971#if defined(PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128)
5972 if (kdf_alg == PSA_ALG_PBKDF2_AES_CMAC_PRF_128) {
5973#if (SIZE_MAX > UINT32_MAX)
Kusumit Ghoderao7d4db632023-12-07 16:17:46 +05305974 operation->capacity = UINT32_MAX * (size_t) PSA_MAC_LENGTH(
Kusumit Ghoderaod3f70d32023-12-06 16:20:04 +05305975 PSA_KEY_TYPE_AES,
5976 128U,
5977 PSA_ALG_CMAC);
Kusumit Ghoderao86e83dd2023-12-01 16:38:26 +05305978#else
5979 operation->capacity = SIZE_MAX;
5980#endif
5981 return PSA_SUCCESS;
5982 }
5983#endif /* PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128 */
5984
5985 /* After this point, if kdf_alg is not valid then value of hash_alg may be
5986 * invalid or meaningless but it does not affect this function */
5987 psa_algorithm_t hash_alg = PSA_ALG_GET_HASH(kdf_alg);
5988 size_t hash_size = PSA_HASH_LENGTH(hash_alg);
Kusumit Ghoderaod3f70d32023-12-06 16:20:04 +05305989 if (hash_size == 0) {
5990 return PSA_ERROR_NOT_SUPPORTED;
5991 }
Kusumit Ghoderao86e83dd2023-12-01 16:38:26 +05305992
5993 /* Make sure that hash_alg is a supported hash algorithm. Otherwise
5994 * we might fail later, which is somewhat unfriendly and potentially
5995 * risk-prone. */
5996 psa_status_t status = psa_hash_try_support(hash_alg);
5997 if (status != PSA_SUCCESS) {
5998 return status;
5999 }
6000
6001#if defined(PSA_WANT_ALG_HKDF)
6002 if (PSA_ALG_IS_HKDF(kdf_alg)) {
6003 operation->capacity = 255 * hash_size;
6004 } else
6005#endif
6006#if defined(PSA_WANT_ALG_HKDF_EXTRACT)
6007 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
6008 operation->capacity = hash_size;
6009 } else
6010#endif
6011#if defined(PSA_WANT_ALG_HKDF_EXPAND)
6012 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) {
6013 operation->capacity = 255 * hash_size;
6014 } else
6015#endif
6016#if defined(PSA_WANT_ALG_TLS12_PRF)
6017 if (PSA_ALG_IS_TLS12_PRF(kdf_alg) &&
6018 (hash_alg == PSA_ALG_SHA_256 || hash_alg == PSA_ALG_SHA_384)) {
6019 operation->capacity = SIZE_MAX;
6020 } else
6021#endif
6022#if defined(PSA_WANT_ALG_TLS12_PSK_TO_MS)
6023 if (PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg) &&
6024 (hash_alg == PSA_ALG_SHA_256 || hash_alg == PSA_ALG_SHA_384)) {
6025 /* Master Secret is always 48 bytes
6026 * https://datatracker.ietf.org/doc/html/rfc5246.html#section-8.1 */
6027 operation->capacity = 48U;
6028 } else
6029#endif
6030#if defined(PSA_WANT_ALG_PBKDF2_HMAC)
6031 if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) {
6032#if (SIZE_MAX > UINT32_MAX)
6033 operation->capacity = UINT32_MAX * hash_size;
6034#else
6035 operation->capacity = SIZE_MAX;
6036#endif
6037 } else
6038#endif /* PSA_WANT_ALG_PBKDF2_HMAC */
6039 {
Kusumit Ghoderaod3f70d32023-12-06 16:20:04 +05306040 (void) hash_size;
Kusumit Ghoderao86e83dd2023-12-01 16:38:26 +05306041 status = PSA_ERROR_NOT_SUPPORTED;
6042 }
6043 return status;
6044}
6045
Gilles Peskine969c5d62019-01-16 15:53:06 +01006046static psa_status_t psa_key_derivation_setup_kdf(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006047 psa_key_derivation_operation_t *operation,
Gilles Peskine449bd832023-01-11 14:50:10 +01006048 psa_algorithm_t kdf_alg)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006049{
Janos Follath5fe19732019-06-20 15:09:30 +01006050 /* Make sure that operation->ctx is properly zero-initialised. (Macro
6051 * initialisers for this union leave some bytes unspecified.) */
Gilles Peskine449bd832023-01-11 14:50:10 +01006052 memset(&operation->ctx, 0, sizeof(operation->ctx));
Janos Follath5fe19732019-06-20 15:09:30 +01006053
Gilles Peskine969c5d62019-01-16 15:53:06 +01006054 /* Make sure that kdf_alg is a supported key derivation algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006055 if (!is_kdf_alg_supported(kdf_alg)) {
6056 return PSA_ERROR_NOT_SUPPORTED;
6057 }
John Durkop07cc04a2020-11-16 22:08:34 -08006058
Kusumit Ghoderao86e83dd2023-12-01 16:38:26 +05306059 psa_status_t status = psa_key_derivation_set_maximum_capacity(operation,
6060 kdf_alg);
Kusumit Ghoderao5f3a9382023-09-13 16:28:12 +05306061 return status;
Gilles Peskine969c5d62019-01-16 15:53:06 +01006062}
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006063
Gilles Peskine449bd832023-01-11 14:50:10 +01006064static psa_status_t psa_key_agreement_try_support(psa_algorithm_t alg)
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006065{
6066#if defined(PSA_WANT_ALG_ECDH)
Gilles Peskine449bd832023-01-11 14:50:10 +01006067 if (alg == PSA_ALG_ECDH) {
6068 return PSA_SUCCESS;
6069 }
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006070#endif
Przemek Stekielfb3dd542022-12-01 14:59:15 +01006071#if defined(PSA_WANT_ALG_FFDH)
6072 if (alg == PSA_ALG_FFDH) {
6073 return PSA_SUCCESS;
6074 }
6075#endif
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006076 (void) alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01006077 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006078}
Gilles Peskinebb3814c2022-12-16 01:12:12 +01006079
6080static int psa_key_derivation_allows_free_form_secret_input(
6081 psa_algorithm_t kdf_alg)
6082{
6083#if defined(PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS)
6084 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
6085 return 0;
6086 }
6087#endif
6088 (void) kdf_alg;
6089 return 1;
6090}
John Durkop07cc04a2020-11-16 22:08:34 -08006091#endif /* AT_LEAST_ONE_BUILTIN_KDF */
Gilles Peskine969c5d62019-01-16 15:53:06 +01006092
Gilles Peskine449bd832023-01-11 14:50:10 +01006093psa_status_t psa_key_derivation_setup(psa_key_derivation_operation_t *operation,
6094 psa_algorithm_t alg)
Gilles Peskine969c5d62019-01-16 15:53:06 +01006095{
6096 psa_status_t status;
6097
Gilles Peskine449bd832023-01-11 14:50:10 +01006098 if (operation->alg != 0) {
6099 return PSA_ERROR_BAD_STATE;
Gilles Peskine969c5d62019-01-16 15:53:06 +01006100 }
Gilles Peskine969c5d62019-01-16 15:53:06 +01006101
Gilles Peskine449bd832023-01-11 14:50:10 +01006102 if (PSA_ALG_IS_RAW_KEY_AGREEMENT(alg)) {
6103 return PSA_ERROR_INVALID_ARGUMENT;
6104 } else if (PSA_ALG_IS_KEY_AGREEMENT(alg)) {
6105#if defined(AT_LEAST_ONE_BUILTIN_KDF)
6106 psa_algorithm_t kdf_alg = PSA_ALG_KEY_AGREEMENT_GET_KDF(alg);
6107 psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE(alg);
6108 status = psa_key_agreement_try_support(ka_alg);
6109 if (status != PSA_SUCCESS) {
6110 return status;
6111 }
Gilles Peskinebb3814c2022-12-16 01:12:12 +01006112 if (!psa_key_derivation_allows_free_form_secret_input(kdf_alg)) {
6113 return PSA_ERROR_INVALID_ARGUMENT;
6114 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006115 status = psa_key_derivation_setup_kdf(operation, kdf_alg);
6116#else
6117 return PSA_ERROR_NOT_SUPPORTED;
6118#endif /* AT_LEAST_ONE_BUILTIN_KDF */
6119 } else if (PSA_ALG_IS_KEY_DERIVATION(alg)) {
6120#if defined(AT_LEAST_ONE_BUILTIN_KDF)
6121 status = psa_key_derivation_setup_kdf(operation, alg);
6122#else
6123 return PSA_ERROR_NOT_SUPPORTED;
6124#endif /* AT_LEAST_ONE_BUILTIN_KDF */
6125 } else {
6126 return PSA_ERROR_INVALID_ARGUMENT;
6127 }
6128
6129 if (status == PSA_SUCCESS) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006130 operation->alg = alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01006131 }
6132 return status;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006133}
6134
Przemek Stekiel69c46792022-06-10 12:59:51 +02006135#if defined(BUILTIN_ALG_ANY_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006136static psa_status_t psa_hkdf_input(psa_hkdf_key_derivation_t *hkdf,
6137 psa_algorithm_t kdf_alg,
6138 psa_key_derivation_step_t step,
6139 const uint8_t *data,
6140 size_t data_length)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006141{
Gilles Peskine449bd832023-01-11 14:50:10 +01006142 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(kdf_alg);
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006143 psa_status_t status;
Gilles Peskine449bd832023-01-11 14:50:10 +01006144 switch (step) {
Gilles Peskine03410b52019-05-16 16:05:19 +02006145 case PSA_KEY_DERIVATION_INPUT_SALT:
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006146#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Gilles Peskine449bd832023-01-11 14:50:10 +01006147 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) {
6148 return PSA_ERROR_INVALID_ARGUMENT;
6149 }
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006150#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND */
Gilles Peskine449bd832023-01-11 14:50:10 +01006151 if (hkdf->state != HKDF_STATE_INIT) {
6152 return PSA_ERROR_BAD_STATE;
6153 } else {
6154 status = psa_key_derivation_start_hmac(&hkdf->hmac,
6155 hash_alg,
6156 data, data_length);
6157 if (status != PSA_SUCCESS) {
6158 return status;
6159 }
Steven Cooremand1ed1d92021-04-29 19:11:25 +02006160 hkdf->state = HKDF_STATE_STARTED;
Gilles Peskine449bd832023-01-11 14:50:10 +01006161 return PSA_SUCCESS;
Steven Cooremand1ed1d92021-04-29 19:11:25 +02006162 }
Gilles Peskine03410b52019-05-16 16:05:19 +02006163 case PSA_KEY_DERIVATION_INPUT_SECRET:
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006164#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Gilles Peskine449bd832023-01-11 14:50:10 +01006165 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) {
Przemek Stekiel2fb0dcd2022-05-19 10:34:37 +02006166 /* We shouldn't be in different state as HKDF_EXPAND only allows
6167 * two inputs: SECRET (this case) and INFO which does not modify
6168 * the state. It could happen only if the hkdf
6169 * object was corrupted. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006170 if (hkdf->state != HKDF_STATE_INIT) {
6171 return PSA_ERROR_BAD_STATE;
6172 }
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006173
Przemek Stekiel2fb0dcd2022-05-19 10:34:37 +02006174 /* Allow only input that fits expected prk size */
Gilles Peskine449bd832023-01-11 14:50:10 +01006175 if (data_length != PSA_HASH_LENGTH(hash_alg)) {
6176 return PSA_ERROR_INVALID_ARGUMENT;
6177 }
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006178
Gilles Peskine449bd832023-01-11 14:50:10 +01006179 memcpy(hkdf->prk, data, data_length);
6180 } else
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006181#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND */
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006182 {
Przemek Stekiel0586f4c2022-06-03 16:00:25 +02006183 /* HKDF: If no salt was provided, use an empty salt.
6184 * HKDF-EXTRACT: salt is mandatory. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006185 if (hkdf->state == HKDF_STATE_INIT) {
Przemek Stekiel0586f4c2022-06-03 16:00:25 +02006186#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01006187 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
6188 return PSA_ERROR_BAD_STATE;
6189 }
Przemek Stekiel0586f4c2022-06-03 16:00:25 +02006190#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Gilles Peskine449bd832023-01-11 14:50:10 +01006191 status = psa_key_derivation_start_hmac(&hkdf->hmac,
6192 hash_alg,
6193 NULL, 0);
6194 if (status != PSA_SUCCESS) {
6195 return status;
6196 }
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006197 hkdf->state = HKDF_STATE_STARTED;
6198 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006199 if (hkdf->state != HKDF_STATE_STARTED) {
6200 return PSA_ERROR_BAD_STATE;
6201 }
6202 status = psa_mac_update(&hkdf->hmac,
6203 data, data_length);
6204 if (status != PSA_SUCCESS) {
6205 return status;
6206 }
6207 status = psa_mac_sign_finish(&hkdf->hmac,
6208 hkdf->prk,
6209 sizeof(hkdf->prk),
6210 &data_length);
6211 if (status != PSA_SUCCESS) {
6212 return status;
6213 }
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006214 }
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006215
Gilles Peskine2b522db2019-04-12 15:11:49 +02006216 hkdf->state = HKDF_STATE_KEYED;
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006217 hkdf->block_number = 0;
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006218#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01006219 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006220 /* The only block of output is the PRK. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006221 memcpy(hkdf->output_block, hkdf->prk, PSA_HASH_LENGTH(hash_alg));
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006222 hkdf->offset_in_block = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01006223 } else
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006224#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006225 {
6226 /* Block 0 is empty, and the next block will be
6227 * generated by psa_key_derivation_hkdf_read(). */
Gilles Peskine449bd832023-01-11 14:50:10 +01006228 hkdf->offset_in_block = PSA_HASH_LENGTH(hash_alg);
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006229 }
6230
Gilles Peskine449bd832023-01-11 14:50:10 +01006231 return PSA_SUCCESS;
Gilles Peskine03410b52019-05-16 16:05:19 +02006232 case PSA_KEY_DERIVATION_INPUT_INFO:
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006233#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01006234 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
6235 return PSA_ERROR_INVALID_ARGUMENT;
6236 }
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006237#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Przemek Stekielcde3f782022-06-03 16:12:27 +02006238#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Gilles Peskine449bd832023-01-11 14:50:10 +01006239 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg) &&
6240 hkdf->state == HKDF_STATE_INIT) {
6241 return PSA_ERROR_BAD_STATE;
6242 }
Przemek Stekielcde3f782022-06-03 16:12:27 +02006243#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Gilles Peskine449bd832023-01-11 14:50:10 +01006244 if (hkdf->state == HKDF_STATE_OUTPUT) {
6245 return PSA_ERROR_BAD_STATE;
6246 }
6247 if (hkdf->info_set) {
6248 return PSA_ERROR_BAD_STATE;
6249 }
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006250 hkdf->info_length = data_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01006251 if (data_length != 0) {
6252 hkdf->info = mbedtls_calloc(1, data_length);
6253 if (hkdf->info == NULL) {
6254 return PSA_ERROR_INSUFFICIENT_MEMORY;
6255 }
6256 memcpy(hkdf->info, data, data_length);
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006257 }
6258 hkdf->info_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01006259 return PSA_SUCCESS;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006260 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01006261 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006262 }
6263}
Przemek Stekiel69c46792022-06-10 12:59:51 +02006264#endif /* BUILTIN_ALG_ANY_HKDF */
Janos Follathb03233e2019-06-11 15:30:30 +01006265
John Durkop07cc04a2020-11-16 22:08:34 -08006266#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
6267 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006268static psa_status_t psa_tls12_prf_set_seed(psa_tls12_prf_key_derivation_t *prf,
6269 const uint8_t *data,
6270 size_t data_length)
Janos Follathf08e2652019-06-13 09:05:41 +01006271{
Gilles Peskine449bd832023-01-11 14:50:10 +01006272 if (prf->state != PSA_TLS12_PRF_STATE_INIT) {
6273 return PSA_ERROR_BAD_STATE;
6274 }
Janos Follathf08e2652019-06-13 09:05:41 +01006275
Gilles Peskine449bd832023-01-11 14:50:10 +01006276 if (data_length != 0) {
6277 prf->seed = mbedtls_calloc(1, data_length);
6278 if (prf->seed == NULL) {
6279 return PSA_ERROR_INSUFFICIENT_MEMORY;
6280 }
Janos Follathf08e2652019-06-13 09:05:41 +01006281
Gilles Peskine449bd832023-01-11 14:50:10 +01006282 memcpy(prf->seed, data, data_length);
Janos Follathd6dce9f2019-07-04 09:11:38 +01006283 prf->seed_length = data_length;
6284 }
Janos Follathf08e2652019-06-13 09:05:41 +01006285
Gilles Peskine43f958b2020-12-13 14:55:14 +01006286 prf->state = PSA_TLS12_PRF_STATE_SEED_SET;
Janos Follathf08e2652019-06-13 09:05:41 +01006287
Gilles Peskine449bd832023-01-11 14:50:10 +01006288 return PSA_SUCCESS;
Janos Follathf08e2652019-06-13 09:05:41 +01006289}
6290
Gilles Peskine449bd832023-01-11 14:50:10 +01006291static psa_status_t psa_tls12_prf_set_key(psa_tls12_prf_key_derivation_t *prf,
6292 const uint8_t *data,
6293 size_t data_length)
Janos Follath81550542019-06-13 14:26:34 +01006294{
Gilles Peskine449bd832023-01-11 14:50:10 +01006295 if (prf->state != PSA_TLS12_PRF_STATE_SEED_SET &&
6296 prf->state != PSA_TLS12_PRF_STATE_OTHER_KEY_SET) {
6297 return PSA_ERROR_BAD_STATE;
6298 }
Janos Follath81550542019-06-13 14:26:34 +01006299
Gilles Peskine449bd832023-01-11 14:50:10 +01006300 if (data_length != 0) {
6301 prf->secret = mbedtls_calloc(1, data_length);
6302 if (prf->secret == NULL) {
6303 return PSA_ERROR_INSUFFICIENT_MEMORY;
6304 }
Steven Cooremana6df6042021-04-29 19:32:25 +02006305
Gilles Peskine449bd832023-01-11 14:50:10 +01006306 memcpy(prf->secret, data, data_length);
Steven Cooremana6df6042021-04-29 19:32:25 +02006307 prf->secret_length = data_length;
6308 }
Janos Follath81550542019-06-13 14:26:34 +01006309
Gilles Peskine43f958b2020-12-13 14:55:14 +01006310 prf->state = PSA_TLS12_PRF_STATE_KEY_SET;
Janos Follath81550542019-06-13 14:26:34 +01006311
Gilles Peskine449bd832023-01-11 14:50:10 +01006312 return PSA_SUCCESS;
Janos Follath81550542019-06-13 14:26:34 +01006313}
6314
Gilles Peskine449bd832023-01-11 14:50:10 +01006315static psa_status_t psa_tls12_prf_set_label(psa_tls12_prf_key_derivation_t *prf,
6316 const uint8_t *data,
6317 size_t data_length)
Janos Follath63028dd2019-06-13 09:15:47 +01006318{
Gilles Peskine449bd832023-01-11 14:50:10 +01006319 if (prf->state != PSA_TLS12_PRF_STATE_KEY_SET) {
6320 return PSA_ERROR_BAD_STATE;
6321 }
Janos Follath63028dd2019-06-13 09:15:47 +01006322
Gilles Peskine449bd832023-01-11 14:50:10 +01006323 if (data_length != 0) {
6324 prf->label = mbedtls_calloc(1, data_length);
6325 if (prf->label == NULL) {
6326 return PSA_ERROR_INSUFFICIENT_MEMORY;
6327 }
Janos Follath63028dd2019-06-13 09:15:47 +01006328
Gilles Peskine449bd832023-01-11 14:50:10 +01006329 memcpy(prf->label, data, data_length);
Janos Follathd6dce9f2019-07-04 09:11:38 +01006330 prf->label_length = data_length;
6331 }
Janos Follath63028dd2019-06-13 09:15:47 +01006332
Gilles Peskine43f958b2020-12-13 14:55:14 +01006333 prf->state = PSA_TLS12_PRF_STATE_LABEL_SET;
Janos Follath63028dd2019-06-13 09:15:47 +01006334
Gilles Peskine449bd832023-01-11 14:50:10 +01006335 return PSA_SUCCESS;
Janos Follath63028dd2019-06-13 09:15:47 +01006336}
6337
Gilles Peskine449bd832023-01-11 14:50:10 +01006338static psa_status_t psa_tls12_prf_input(psa_tls12_prf_key_derivation_t *prf,
6339 psa_key_derivation_step_t step,
6340 const uint8_t *data,
6341 size_t data_length)
Janos Follathb03233e2019-06-11 15:30:30 +01006342{
Gilles Peskine449bd832023-01-11 14:50:10 +01006343 switch (step) {
Janos Follathf08e2652019-06-13 09:05:41 +01006344 case PSA_KEY_DERIVATION_INPUT_SEED:
Gilles Peskine449bd832023-01-11 14:50:10 +01006345 return psa_tls12_prf_set_seed(prf, data, data_length);
Janos Follath81550542019-06-13 14:26:34 +01006346 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01006347 return psa_tls12_prf_set_key(prf, data, data_length);
Janos Follath63028dd2019-06-13 09:15:47 +01006348 case PSA_KEY_DERIVATION_INPUT_LABEL:
Gilles Peskine449bd832023-01-11 14:50:10 +01006349 return psa_tls12_prf_set_label(prf, data, data_length);
Janos Follathb03233e2019-06-11 15:30:30 +01006350 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01006351 return PSA_ERROR_INVALID_ARGUMENT;
Janos Follathb03233e2019-06-11 15:30:30 +01006352 }
6353}
John Durkop07cc04a2020-11-16 22:08:34 -08006354#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) ||
6355 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
6356
6357#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
6358static psa_status_t psa_tls12_prf_psk_to_ms_set_key(
6359 psa_tls12_prf_key_derivation_t *prf,
John Durkop07cc04a2020-11-16 22:08:34 -08006360 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01006361 size_t data_length)
John Durkop07cc04a2020-11-16 22:08:34 -08006362{
6363 psa_status_t status;
Gilles Peskine449bd832023-01-11 14:50:10 +01006364 const size_t pms_len = (prf->state == PSA_TLS12_PRF_STATE_OTHER_KEY_SET ?
6365 4 + data_length + prf->other_secret_length :
6366 4 + 2 * data_length);
John Durkop07cc04a2020-11-16 22:08:34 -08006367
Gilles Peskine449bd832023-01-11 14:50:10 +01006368 if (data_length > PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE) {
6369 return PSA_ERROR_INVALID_ARGUMENT;
6370 }
John Durkop07cc04a2020-11-16 22:08:34 -08006371
Gilles Peskine449bd832023-01-11 14:50:10 +01006372 uint8_t *pms = mbedtls_calloc(1, pms_len);
6373 if (pms == NULL) {
6374 return PSA_ERROR_INSUFFICIENT_MEMORY;
6375 }
Przemek Stekielc8fa5a12022-04-07 14:17:13 +02006376 uint8_t *cur = pms;
6377
6378 /* pure-PSK:
6379 * Quoting RFC 4279, Section 2:
John Durkop07cc04a2020-11-16 22:08:34 -08006380 *
6381 * The premaster secret is formed as follows: if the PSK is N octets
6382 * long, concatenate a uint16 with the value N, N zero octets, a second
6383 * uint16 with the value N, and the PSK itself.
Przemek Stekielc8fa5a12022-04-07 14:17:13 +02006384 *
6385 * mixed-PSK:
6386 * In a DHE-PSK, RSA-PSK, ECDHE-PSK the premaster secret is formed as
6387 * follows: concatenate a uint16 with the length of the other secret,
6388 * the other secret itself, uint16 with the length of PSK, and the
6389 * PSK itself.
6390 * For details please check:
6391 * - RFC 4279, Section 4 for the definition of RSA-PSK,
6392 * - RFC 4279, Section 3 for the definition of DHE-PSK,
6393 * - RFC 5489 for the definition of ECDHE-PSK.
John Durkop07cc04a2020-11-16 22:08:34 -08006394 */
6395
Gilles Peskine449bd832023-01-11 14:50:10 +01006396 if (prf->state == PSA_TLS12_PRF_STATE_OTHER_KEY_SET) {
6397 *cur++ = MBEDTLS_BYTE_1(prf->other_secret_length);
6398 *cur++ = MBEDTLS_BYTE_0(prf->other_secret_length);
6399 if (prf->other_secret_length != 0) {
6400 memcpy(cur, prf->other_secret, prf->other_secret_length);
6401 mbedtls_platform_zeroize(prf->other_secret, prf->other_secret_length);
Przemek Stekiel2503f7e2022-04-12 12:08:01 +02006402 cur += prf->other_secret_length;
6403 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006404 } else {
6405 *cur++ = MBEDTLS_BYTE_1(data_length);
6406 *cur++ = MBEDTLS_BYTE_0(data_length);
6407 memset(cur, 0, data_length);
Przemek Stekielc8fa5a12022-04-07 14:17:13 +02006408 cur += data_length;
6409 }
6410
Gilles Peskine449bd832023-01-11 14:50:10 +01006411 *cur++ = MBEDTLS_BYTE_1(data_length);
6412 *cur++ = MBEDTLS_BYTE_0(data_length);
6413 memcpy(cur, data, data_length);
John Durkop07cc04a2020-11-16 22:08:34 -08006414 cur += data_length;
6415
Dave Rodgmane4a6f5a2023-11-04 12:20:09 +00006416 status = psa_tls12_prf_set_key(prf, pms, (size_t) (cur - pms));
John Durkop07cc04a2020-11-16 22:08:34 -08006417
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01006418 mbedtls_zeroize_and_free(pms, pms_len);
Gilles Peskine449bd832023-01-11 14:50:10 +01006419 return status;
John Durkop07cc04a2020-11-16 22:08:34 -08006420}
Janos Follath6660f0e2019-06-17 08:44:03 +01006421
Przemek Stekiele47201b2022-04-19 13:53:28 +02006422static psa_status_t psa_tls12_prf_psk_to_ms_set_other_key(
6423 psa_tls12_prf_key_derivation_t *prf,
6424 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01006425 size_t data_length)
Przemek Stekiele47201b2022-04-19 13:53:28 +02006426{
Gilles Peskine449bd832023-01-11 14:50:10 +01006427 if (prf->state != PSA_TLS12_PRF_STATE_SEED_SET) {
6428 return PSA_ERROR_BAD_STATE;
Przemek Stekiele47201b2022-04-19 13:53:28 +02006429 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006430
6431 if (data_length != 0) {
6432 prf->other_secret = mbedtls_calloc(1, data_length);
6433 if (prf->other_secret == NULL) {
6434 return PSA_ERROR_INSUFFICIENT_MEMORY;
6435 }
6436
6437 memcpy(prf->other_secret, data, data_length);
6438 prf->other_secret_length = data_length;
6439 } else {
Przemek Stekiele47201b2022-04-19 13:53:28 +02006440 prf->other_secret_length = 0;
6441 }
6442
6443 prf->state = PSA_TLS12_PRF_STATE_OTHER_KEY_SET;
6444
Gilles Peskine449bd832023-01-11 14:50:10 +01006445 return PSA_SUCCESS;
Przemek Stekiele47201b2022-04-19 13:53:28 +02006446}
6447
Janos Follath6660f0e2019-06-17 08:44:03 +01006448static psa_status_t psa_tls12_prf_psk_to_ms_input(
6449 psa_tls12_prf_key_derivation_t *prf,
Janos Follath6660f0e2019-06-17 08:44:03 +01006450 psa_key_derivation_step_t step,
6451 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01006452 size_t data_length)
Janos Follath6660f0e2019-06-17 08:44:03 +01006453{
Gilles Peskine449bd832023-01-11 14:50:10 +01006454 switch (step) {
Przemek Stekiele47201b2022-04-19 13:53:28 +02006455 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01006456 return psa_tls12_prf_psk_to_ms_set_key(prf,
6457 data, data_length);
Przemek Stekiele47201b2022-04-19 13:53:28 +02006458 break;
6459 case PSA_KEY_DERIVATION_INPUT_OTHER_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01006460 return psa_tls12_prf_psk_to_ms_set_other_key(prf,
6461 data,
6462 data_length);
Przemek Stekiele47201b2022-04-19 13:53:28 +02006463 break;
6464 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01006465 return psa_tls12_prf_input(prf, step, data, data_length);
Przemek Stekiele47201b2022-04-19 13:53:28 +02006466 break;
Janos Follath6660f0e2019-06-17 08:44:03 +01006467
Przemek Stekiele47201b2022-04-19 13:53:28 +02006468 }
Janos Follath6660f0e2019-06-17 08:44:03 +01006469}
John Durkop07cc04a2020-11-16 22:08:34 -08006470#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006471
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006472#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
6473static psa_status_t psa_tls12_ecjpake_to_pms_input(
6474 psa_tls12_ecjpake_to_pms_t *ecjpake,
Andrzej Kurek702776f2022-09-16 06:22:44 -04006475 psa_key_derivation_step_t step,
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006476 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01006477 size_t data_length)
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006478{
Gilles Peskine449bd832023-01-11 14:50:10 +01006479 if (data_length != PSA_TLS12_ECJPAKE_TO_PMS_INPUT_SIZE ||
6480 step != PSA_KEY_DERIVATION_INPUT_SECRET) {
6481 return PSA_ERROR_INVALID_ARGUMENT;
Andrzej Kurek5603efd2022-09-26 10:49:16 -04006482 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006483
6484 /* Check if the passed point is in an uncompressed form */
Gilles Peskine449bd832023-01-11 14:50:10 +01006485 if (data[0] != 0x04) {
6486 return PSA_ERROR_INVALID_ARGUMENT;
6487 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006488
6489 /* Only K.X has to be extracted - bytes 1 to 32 inclusive. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006490 memcpy(ecjpake->data, data + 1, PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE);
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006491
Gilles Peskine449bd832023-01-11 14:50:10 +01006492 return PSA_SUCCESS;
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006493}
6494#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05306495
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05306496#if defined(PSA_HAVE_SOFT_PBKDF2)
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05306497static psa_status_t psa_pbkdf2_set_input_cost(
6498 psa_pbkdf2_key_derivation_t *pbkdf2,
6499 psa_key_derivation_step_t step,
6500 uint64_t data)
6501{
6502 if (step != PSA_KEY_DERIVATION_INPUT_COST) {
6503 return PSA_ERROR_INVALID_ARGUMENT;
6504 }
6505
6506 if (pbkdf2->state != PSA_PBKDF2_STATE_INIT) {
6507 return PSA_ERROR_BAD_STATE;
6508 }
Kusumit Ghoderao3fc4ca72023-05-08 15:57:41 +05306509
Kusumit Ghoderaoe66a8ad2023-05-24 12:30:43 +05306510 if (data > PSA_VENDOR_PBKDF2_MAX_ITERATIONS) {
Kusumit Ghoderao3fc4ca72023-05-08 15:57:41 +05306511 return PSA_ERROR_NOT_SUPPORTED;
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05306512 }
Kusumit Ghoderao3fc4ca72023-05-08 15:57:41 +05306513
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05306514 if (data == 0) {
6515 return PSA_ERROR_INVALID_ARGUMENT;
6516 }
Kusumit Ghoderaoe66a8ad2023-05-24 12:30:43 +05306517
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05306518 pbkdf2->input_cost = data;
6519 pbkdf2->state = PSA_PBKDF2_STATE_INPUT_COST_SET;
6520
6521 return PSA_SUCCESS;
6522}
Kusumit Ghoderao547a6c62023-05-03 12:18:19 +05306523
6524static psa_status_t psa_pbkdf2_set_salt(psa_pbkdf2_key_derivation_t *pbkdf2,
6525 const uint8_t *data,
6526 size_t data_length)
6527{
Gilles Peskineead17662023-08-20 22:02:51 +02006528 if (pbkdf2->state == PSA_PBKDF2_STATE_INPUT_COST_SET) {
6529 pbkdf2->state = PSA_PBKDF2_STATE_SALT_SET;
6530 } else if (pbkdf2->state == PSA_PBKDF2_STATE_SALT_SET) {
6531 /* Appending to existing salt. No state change. */
6532 } else {
Kusumit Ghoderao547a6c62023-05-03 12:18:19 +05306533 return PSA_ERROR_BAD_STATE;
6534 }
6535
Gilles Peskineca57d782023-07-20 19:08:06 +02006536 if (data_length == 0) {
Gilles Peskineead17662023-08-20 22:02:51 +02006537 /* Appending an empty string, nothing to do. */
6538 } else {
Kusumit Ghoderaod7a3f802023-05-24 22:19:47 +05306539 uint8_t *next_salt;
Kusumit Ghoderaob538bb72023-05-24 12:32:14 +05306540
Kusumit Ghoderaod7a3f802023-05-24 22:19:47 +05306541 next_salt = mbedtls_calloc(1, data_length + pbkdf2->salt_length);
6542 if (next_salt == NULL) {
Kusumit Ghoderaod0422f32023-05-08 15:56:19 +05306543 return PSA_ERROR_INSUFFICIENT_MEMORY;
6544 }
6545
Gilles Peskineead17662023-08-20 22:02:51 +02006546 if (pbkdf2->salt_length != 0) {
6547 memcpy(next_salt, pbkdf2->salt, pbkdf2->salt_length);
6548 }
Kusumit Ghoderaod7a3f802023-05-24 22:19:47 +05306549 memcpy(next_salt + pbkdf2->salt_length, data, data_length);
Kusumit Ghoderaod0422f32023-05-08 15:56:19 +05306550 pbkdf2->salt_length += data_length;
Kusumit Ghoderaod7a3f802023-05-24 22:19:47 +05306551 mbedtls_free(pbkdf2->salt);
6552 pbkdf2->salt = next_salt;
Kusumit Ghoderao547a6c62023-05-03 12:18:19 +05306553 }
Kusumit Ghoderao547a6c62023-05-03 12:18:19 +05306554 return PSA_SUCCESS;
6555}
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05306556
Kusumit Ghoderao0bca4c52023-07-27 21:20:14 +05306557#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC)
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306558static psa_status_t psa_pbkdf2_hmac_set_password(psa_algorithm_t hash_alg,
Kusumit Ghoderaoaac9a582023-05-24 14:19:17 +05306559 const uint8_t *input,
6560 size_t input_len,
6561 uint8_t *output,
Kusumit Ghoderao91f99f52023-05-24 22:21:48 +05306562 size_t *output_len)
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306563{
6564 psa_status_t status = PSA_SUCCESS;
6565 if (input_len > PSA_HASH_BLOCK_LENGTH(hash_alg)) {
6566 status = psa_hash_compute(hash_alg, input, input_len, output,
Kusumit Ghoderao91f99f52023-05-24 22:21:48 +05306567 PSA_HMAC_MAX_HASH_BLOCK_SIZE, output_len);
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306568 } else {
6569 memcpy(output, input, input_len);
Kusumit Ghoderao91f99f52023-05-24 22:21:48 +05306570 *output_len = PSA_HASH_BLOCK_LENGTH(hash_alg);
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306571 }
6572 return status;
6573}
Kusumit Ghoderao0bca4c52023-07-27 21:20:14 +05306574#endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC */
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306575
Kusumit Ghoderao0bca4c52023-07-27 21:20:14 +05306576#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_AES_CMAC_PRF_128)
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05306577static psa_status_t psa_pbkdf2_cmac_set_password(const uint8_t *input,
6578 size_t input_len,
6579 uint8_t *output,
6580 size_t *output_len)
6581{
6582 psa_status_t status = PSA_SUCCESS;
Kusumit Ghoderaoa12e2d52023-07-27 21:18:30 +05306583 if (input_len != PSA_MAC_LENGTH(PSA_KEY_TYPE_AES, 128U, PSA_ALG_CMAC)) {
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05306584 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Kusumit Ghoderao3fde8fe2023-06-27 10:41:43 +05306585 uint8_t zeros[16] = { 0 };
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05306586 psa_set_key_type(&attributes, PSA_KEY_TYPE_AES);
6587 psa_set_key_bits(&attributes, PSA_BYTES_TO_BITS(sizeof(zeros)));
6588 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_MESSAGE);
Kusumit Ghoderaoa12e2d52023-07-27 21:18:30 +05306589 /* Passing PSA_MAC_LENGTH(PSA_KEY_TYPE_AES, 128U, PSA_ALG_CMAC) as
Kusumit Ghoderao5f3345a2023-07-27 21:21:38 +05306590 * mac_size as the driver function sets mac_output_length = mac_size
6591 * on success. See https://github.com/Mbed-TLS/mbedtls/issues/7801 */
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05306592 status = psa_driver_wrapper_mac_compute(&attributes,
6593 zeros, sizeof(zeros),
6594 PSA_ALG_CMAC, input, input_len,
6595 output,
Kusumit Ghoderaoa12e2d52023-07-27 21:18:30 +05306596 PSA_MAC_LENGTH(PSA_KEY_TYPE_AES,
6597 128U,
6598 PSA_ALG_CMAC),
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05306599 output_len);
6600 } else {
6601 memcpy(output, input, input_len);
Kusumit Ghoderaoa12e2d52023-07-27 21:18:30 +05306602 *output_len = PSA_MAC_LENGTH(PSA_KEY_TYPE_AES, 128U, PSA_ALG_CMAC);
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05306603 }
6604 return status;
6605}
Kusumit Ghoderao0bca4c52023-07-27 21:20:14 +05306606#endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_AES_CMAC_PRF_128 */
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05306607
6608static psa_status_t psa_pbkdf2_set_password(psa_pbkdf2_key_derivation_t *pbkdf2,
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306609 psa_algorithm_t kdf_alg,
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05306610 const uint8_t *data,
6611 size_t data_length)
6612{
Kusumit Ghoderaoaac9a582023-05-24 14:19:17 +05306613 psa_status_t status = PSA_SUCCESS;
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05306614 if (pbkdf2->state != PSA_PBKDF2_STATE_SALT_SET) {
6615 return PSA_ERROR_BAD_STATE;
6616 }
6617
Kusumit Ghoderaof3e696d2023-07-28 13:30:50 +05306618#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC)
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05306619 if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) {
6620 psa_algorithm_t hash_alg = PSA_ALG_PBKDF2_HMAC_GET_HASH(kdf_alg);
6621 status = psa_pbkdf2_hmac_set_password(hash_alg, data, data_length,
6622 pbkdf2->password,
6623 &pbkdf2->password_length);
Kusumit Ghoderaof3e696d2023-07-28 13:30:50 +05306624 } else
6625#endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC */
6626#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_AES_CMAC_PRF_128)
6627 if (kdf_alg == PSA_ALG_PBKDF2_AES_CMAC_PRF_128) {
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05306628 status = psa_pbkdf2_cmac_set_password(data, data_length,
6629 pbkdf2->password,
6630 &pbkdf2->password_length);
Kusumit Ghoderaof3e696d2023-07-28 13:30:50 +05306631 } else
6632#endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_AES_CMAC_PRF_128 */
6633 {
6634 return PSA_ERROR_INVALID_ARGUMENT;
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05306635 }
6636
6637 pbkdf2->state = PSA_PBKDF2_STATE_PASSWORD_SET;
6638
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306639 return status;
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05306640}
Kusumit Ghoderao24b38952023-05-03 12:25:26 +05306641
6642static psa_status_t psa_pbkdf2_input(psa_pbkdf2_key_derivation_t *pbkdf2,
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306643 psa_algorithm_t kdf_alg,
Kusumit Ghoderao24b38952023-05-03 12:25:26 +05306644 psa_key_derivation_step_t step,
6645 const uint8_t *data,
6646 size_t data_length)
6647{
6648 switch (step) {
6649 case PSA_KEY_DERIVATION_INPUT_SALT:
6650 return psa_pbkdf2_set_salt(pbkdf2, data, data_length);
6651 case PSA_KEY_DERIVATION_INPUT_PASSWORD:
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306652 return psa_pbkdf2_set_password(pbkdf2, kdf_alg, data, data_length);
Kusumit Ghoderao24b38952023-05-03 12:25:26 +05306653 default:
6654 return PSA_ERROR_INVALID_ARGUMENT;
6655 }
6656}
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05306657#endif /* PSA_HAVE_SOFT_PBKDF2 */
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05306658
Gilles Peskineb8965192019-09-24 16:21:10 +02006659/** Check whether the given key type is acceptable for the given
6660 * input step of a key derivation.
6661 *
6662 * Secret inputs must have the type #PSA_KEY_TYPE_DERIVE.
6663 * Non-secret inputs must have the type #PSA_KEY_TYPE_RAW_DATA.
6664 * Both secret and non-secret inputs can alternatively have the type
6665 * #PSA_KEY_TYPE_NONE, which is never the type of a key object, meaning
6666 * that the input was passed as a buffer rather than via a key object.
6667 */
Gilles Peskine224b0d62019-09-23 18:13:17 +02006668static int psa_key_derivation_check_input_type(
6669 psa_key_derivation_step_t step,
Gilles Peskine449bd832023-01-11 14:50:10 +01006670 psa_key_type_t key_type)
Gilles Peskine224b0d62019-09-23 18:13:17 +02006671{
Gilles Peskine449bd832023-01-11 14:50:10 +01006672 switch (step) {
Gilles Peskine224b0d62019-09-23 18:13:17 +02006673 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01006674 if (key_type == PSA_KEY_TYPE_DERIVE) {
6675 return PSA_SUCCESS;
6676 }
6677 if (key_type == PSA_KEY_TYPE_NONE) {
6678 return PSA_SUCCESS;
6679 }
Gilles Peskine224b0d62019-09-23 18:13:17 +02006680 break;
Przemek Stekiela7695a22022-04-07 15:39:01 +02006681 case PSA_KEY_DERIVATION_INPUT_OTHER_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01006682 if (key_type == PSA_KEY_TYPE_DERIVE) {
6683 return PSA_SUCCESS;
6684 }
6685 if (key_type == PSA_KEY_TYPE_NONE) {
6686 return PSA_SUCCESS;
6687 }
Przemek Stekiela7695a22022-04-07 15:39:01 +02006688 break;
Gilles Peskine224b0d62019-09-23 18:13:17 +02006689 case PSA_KEY_DERIVATION_INPUT_LABEL:
6690 case PSA_KEY_DERIVATION_INPUT_SALT:
6691 case PSA_KEY_DERIVATION_INPUT_INFO:
6692 case PSA_KEY_DERIVATION_INPUT_SEED:
Gilles Peskine449bd832023-01-11 14:50:10 +01006693 if (key_type == PSA_KEY_TYPE_RAW_DATA) {
6694 return PSA_SUCCESS;
6695 }
6696 if (key_type == PSA_KEY_TYPE_NONE) {
6697 return PSA_SUCCESS;
6698 }
Gilles Peskine224b0d62019-09-23 18:13:17 +02006699 break;
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05306700 case PSA_KEY_DERIVATION_INPUT_PASSWORD:
6701 if (key_type == PSA_KEY_TYPE_PASSWORD) {
6702 return PSA_SUCCESS;
6703 }
6704 if (key_type == PSA_KEY_TYPE_DERIVE) {
6705 return PSA_SUCCESS;
6706 }
6707 if (key_type == PSA_KEY_TYPE_NONE) {
6708 return PSA_SUCCESS;
6709 }
6710 break;
Gilles Peskine224b0d62019-09-23 18:13:17 +02006711 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006712 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine224b0d62019-09-23 18:13:17 +02006713}
6714
Janos Follathb80a94e2019-06-12 15:54:46 +01006715static psa_status_t psa_key_derivation_input_internal(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006716 psa_key_derivation_operation_t *operation,
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01006717 psa_key_derivation_step_t step,
Gilles Peskine224b0d62019-09-23 18:13:17 +02006718 psa_key_type_t key_type,
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01006719 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01006720 size_t data_length)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006721{
Gilles Peskine46d7faf2019-09-23 19:22:55 +02006722 psa_status_t status;
Gilles Peskine449bd832023-01-11 14:50:10 +01006723 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation);
Gilles Peskine46d7faf2019-09-23 19:22:55 +02006724
Gilles Peskine449bd832023-01-11 14:50:10 +01006725 status = psa_key_derivation_check_input_type(step, key_type);
6726 if (status != PSA_SUCCESS) {
Gilles Peskine224b0d62019-09-23 18:13:17 +02006727 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006728 }
Gilles Peskine224b0d62019-09-23 18:13:17 +02006729
Przemek Stekiel69c46792022-06-10 12:59:51 +02006730#if defined(BUILTIN_ALG_ANY_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006731 if (PSA_ALG_IS_ANY_HKDF(kdf_alg)) {
6732 status = psa_hkdf_input(&operation->ctx.hkdf, kdf_alg,
6733 step, data, data_length);
6734 } else
Przemek Stekiel69c46792022-06-10 12:59:51 +02006735#endif /* BUILTIN_ALG_ANY_HKDF */
John Durkop07cc04a2020-11-16 22:08:34 -08006736#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006737 if (PSA_ALG_IS_TLS12_PRF(kdf_alg)) {
6738 status = psa_tls12_prf_input(&operation->ctx.tls12_prf,
6739 step, data, data_length);
6740 } else
John Durkop07cc04a2020-11-16 22:08:34 -08006741#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF */
6742#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006743 if (PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
6744 status = psa_tls12_prf_psk_to_ms_input(&operation->ctx.tls12_prf,
6745 step, data, data_length);
6746 } else
John Durkop07cc04a2020-11-16 22:08:34 -08006747#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006748#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006749 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006750 status = psa_tls12_ecjpake_to_pms_input(
Gilles Peskine449bd832023-01-11 14:50:10 +01006751 &operation->ctx.tls12_ecjpake_to_pms, step, data, data_length);
6752 } else
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006753#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05306754#if defined(PSA_HAVE_SOFT_PBKDF2)
Kusumit Ghoderao9ab03c32023-07-27 21:14:05 +05306755 if (PSA_ALG_IS_PBKDF2(kdf_alg)) {
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306756 status = psa_pbkdf2_input(&operation->ctx.pbkdf2, kdf_alg,
6757 step, data, data_length);
Kusumit Ghoderao24b38952023-05-03 12:25:26 +05306758 } else
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05306759#endif /* PSA_HAVE_SOFT_PBKDF2 */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006760 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006761 /* This can't happen unless the operation object was not initialized */
Steven Cooreman74afe472021-02-10 17:19:22 +01006762 (void) data;
6763 (void) data_length;
6764 (void) kdf_alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01006765 return PSA_ERROR_BAD_STATE;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006766 }
6767
Gilles Peskine224b0d62019-09-23 18:13:17 +02006768exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01006769 if (status != PSA_SUCCESS) {
6770 psa_key_derivation_abort(operation);
6771 }
6772 return status;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006773}
6774
Kusumit Ghoderao50e0e112023-04-06 17:47:25 +05306775static psa_status_t psa_key_derivation_input_integer_internal(
6776 psa_key_derivation_operation_t *operation,
6777 psa_key_derivation_step_t step,
6778 uint64_t value)
6779{
6780 psa_status_t status;
6781 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation);
6782
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05306783#if defined(PSA_HAVE_SOFT_PBKDF2)
Kusumit Ghoderao9ab03c32023-07-27 21:14:05 +05306784 if (PSA_ALG_IS_PBKDF2(kdf_alg)) {
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05306785 status = psa_pbkdf2_set_input_cost(
6786 &operation->ctx.pbkdf2, step, value);
6787 } else
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05306788#endif /* PSA_HAVE_SOFT_PBKDF2 */
Kusumit Ghoderao50e0e112023-04-06 17:47:25 +05306789 {
Kusumit Ghoderao3a18dee2023-04-07 16:16:27 +05306790 (void) step;
Kusumit Ghoderao50e0e112023-04-06 17:47:25 +05306791 (void) value;
6792 (void) kdf_alg;
Kusumit Ghoderaoa14ae5a2023-04-19 14:16:26 +05306793 status = PSA_ERROR_INVALID_ARGUMENT;
Kusumit Ghoderao50e0e112023-04-06 17:47:25 +05306794 }
6795
6796 if (status != PSA_SUCCESS) {
6797 psa_key_derivation_abort(operation);
6798 }
6799 return status;
6800}
6801
Janos Follath51f4a0f2019-06-14 11:35:55 +01006802psa_status_t psa_key_derivation_input_bytes(
6803 psa_key_derivation_operation_t *operation,
6804 psa_key_derivation_step_t step,
6805 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01006806 size_t data_length)
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01006807{
Gilles Peskine449bd832023-01-11 14:50:10 +01006808 return psa_key_derivation_input_internal(operation, step,
6809 PSA_KEY_TYPE_NONE,
6810 data, data_length);
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01006811}
6812
Kusumit Ghoderao50e0e112023-04-06 17:47:25 +05306813psa_status_t psa_key_derivation_input_integer(
6814 psa_key_derivation_operation_t *operation,
6815 psa_key_derivation_step_t step,
6816 uint64_t value)
6817{
6818 return psa_key_derivation_input_integer_internal(operation, step, value);
6819}
6820
Janos Follath51f4a0f2019-06-14 11:35:55 +01006821psa_status_t psa_key_derivation_input_key(
6822 psa_key_derivation_operation_t *operation,
6823 psa_key_derivation_step_t step,
Gilles Peskine449bd832023-01-11 14:50:10 +01006824 mbedtls_svc_key_id_t key)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006825{
Ronald Cronf95a2b12020-10-22 15:24:49 +02006826 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01006827 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006828 psa_key_slot_t *slot;
Gilles Peskine178c9aa2019-09-24 18:21:06 +02006829
Ronald Cron5c522922020-11-14 16:35:34 +01006830 status = psa_get_and_lock_transparent_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01006831 key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg);
6832 if (status != PSA_SUCCESS) {
6833 psa_key_derivation_abort(operation);
6834 return status;
Gilles Peskine593773d2019-09-23 18:17:40 +02006835 }
Gilles Peskine178c9aa2019-09-24 18:21:06 +02006836
Kusumit Ghoderao3128c5d2023-05-03 12:27:57 +05306837 /* Passing a key object as a SECRET or PASSWORD input unlocks the
6838 * permission to output to a key object. */
6839 if (step == PSA_KEY_DERIVATION_INPUT_SECRET ||
6840 step == PSA_KEY_DERIVATION_INPUT_PASSWORD) {
Gilles Peskine178c9aa2019-09-24 18:21:06 +02006841 operation->can_output_key = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01006842 }
Gilles Peskine178c9aa2019-09-24 18:21:06 +02006843
Gilles Peskine449bd832023-01-11 14:50:10 +01006844 status = psa_key_derivation_input_internal(operation,
6845 step, slot->attr.type,
6846 slot->key.data,
6847 slot->key.bytes);
Ronald Cronf95a2b12020-10-22 15:24:49 +02006848
Ryan Everett5ac6fa72024-02-14 17:11:36 +00006849 unlock_status = psa_unregister_read_under_mutex(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02006850
Gilles Peskine449bd832023-01-11 14:50:10 +01006851 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006852}
Gilles Peskineea0fb492018-07-12 17:17:20 +02006853
6854
6855
6856/****************************************************************/
Gilles Peskine01d718c2018-09-18 12:01:02 +02006857/* Key agreement */
6858/****************************************************************/
6859
Gilles Peskine449bd832023-01-11 14:50:10 +01006860psa_status_t psa_key_agreement_raw_builtin(const psa_key_attributes_t *attributes,
6861 const uint8_t *key_buffer,
6862 size_t key_buffer_size,
6863 psa_algorithm_t alg,
6864 const uint8_t *peer_key,
6865 size_t peer_key_length,
6866 uint8_t *shared_secret,
6867 size_t shared_secret_size,
6868 size_t *shared_secret_length)
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02006869{
Gilles Peskine449bd832023-01-11 14:50:10 +01006870 switch (alg) {
John Durkop6ba40d12020-11-10 08:50:04 -08006871#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
Gilles Peskine0216fe12019-04-11 21:23:21 +02006872 case PSA_ALG_ECDH:
Gilles Peskine449bd832023-01-11 14:50:10 +01006873 return mbedtls_psa_key_agreement_ecdh(attributes, key_buffer,
6874 key_buffer_size, alg,
6875 peer_key, peer_key_length,
6876 shared_secret,
6877 shared_secret_size,
6878 shared_secret_length);
Gilles Peskine01d718c2018-09-18 12:01:02 +02006879#endif /* MBEDTLS_PSA_BUILTIN_ALG_ECDH */
Przemek Stekielfb3dd542022-12-01 14:59:15 +01006880
6881#if defined(MBEDTLS_PSA_BUILTIN_ALG_FFDH)
6882 case PSA_ALG_FFDH:
Przemek Stekiel152bb462023-06-01 11:52:39 +02006883 return mbedtls_psa_ffdh_key_agreement(attributes,
Przemek Stekiel359f4622022-12-05 14:11:55 +01006884 peer_key,
6885 peer_key_length,
6886 key_buffer,
6887 key_buffer_size,
6888 shared_secret,
6889 shared_secret_size,
6890 shared_secret_length);
Przemek Stekielfb3dd542022-12-01 14:59:15 +01006891#endif /* MBEDTLS_PSA_BUILTIN_ALG_FFDH */
6892
Gilles Peskine01d718c2018-09-18 12:01:02 +02006893 default:
Aditya Deshpande17845b82022-10-13 17:21:01 +01006894 (void) attributes;
6895 (void) key_buffer;
6896 (void) key_buffer_size;
Gilles Peskine93f85002018-11-16 16:43:31 +01006897 (void) peer_key;
6898 (void) peer_key_length;
Gilles Peskine0216fe12019-04-11 21:23:21 +02006899 (void) shared_secret;
6900 (void) shared_secret_size;
6901 (void) shared_secret_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01006902 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine01d718c2018-09-18 12:01:02 +02006903 }
Gilles Peskine0216fe12019-04-11 21:23:21 +02006904}
Gilles Peskine01d718c2018-09-18 12:01:02 +02006905
Aditya Deshpande17845b82022-10-13 17:21:01 +01006906/** Internal function for raw key agreement
6907 * Calls the driver wrapper which will hand off key agreement task
Aditya Deshpande40c05cc2022-10-14 16:41:40 +01006908 * to the driver's implementation if a driver is present.
6909 * Fallback specified in the driver wrapper is built-in raw key agreement
Aditya Deshpande17845b82022-10-13 17:21:01 +01006910 * (psa_key_agreement_raw_builtin).
6911 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006912static psa_status_t psa_key_agreement_raw_internal(psa_algorithm_t alg,
6913 psa_key_slot_t *private_key,
6914 const uint8_t *peer_key,
6915 size_t peer_key_length,
6916 uint8_t *shared_secret,
6917 size_t shared_secret_size,
6918 size_t *shared_secret_length)
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006919{
Gilles Peskine449bd832023-01-11 14:50:10 +01006920 if (!PSA_ALG_IS_RAW_KEY_AGREEMENT(alg)) {
6921 return PSA_ERROR_NOT_SUPPORTED;
6922 }
Aditya Deshpande17845b82022-10-13 17:21:01 +01006923
Gilles Peskine7a5d9202024-02-28 01:18:23 +01006924 return psa_driver_wrapper_key_agreement(&private_key->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01006925 private_key->key.data,
6926 private_key->key.bytes, alg,
6927 peer_key, peer_key_length,
6928 shared_secret,
6929 shared_secret_size,
6930 shared_secret_length);
Gilles Peskine0216fe12019-04-11 21:23:21 +02006931}
6932
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02006933/* Note that if this function fails, you must call psa_key_derivation_abort()
Gilles Peskine01d718c2018-09-18 12:01:02 +02006934 * to potentially free embedded data structures and wipe confidential data.
6935 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006936static psa_status_t psa_key_agreement_internal(psa_key_derivation_operation_t *operation,
6937 psa_key_derivation_step_t step,
6938 psa_key_slot_t *private_key,
6939 const uint8_t *peer_key,
6940 size_t peer_key_length)
Gilles Peskine01d718c2018-09-18 12:01:02 +02006941{
6942 psa_status_t status;
Moritz Fischer967f8cd2024-03-02 00:55:06 +00006943 uint8_t shared_secret[PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE] = { 0 };
Gilles Peskine01d718c2018-09-18 12:01:02 +02006944 size_t shared_secret_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01006945 psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE(operation->alg);
Gilles Peskine01d718c2018-09-18 12:01:02 +02006946
6947 /* Step 1: run the secret agreement algorithm to generate the shared
6948 * secret. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006949 status = psa_key_agreement_raw_internal(ka_alg,
6950 private_key,
6951 peer_key, peer_key_length,
6952 shared_secret,
6953 sizeof(shared_secret),
6954 &shared_secret_length);
6955 if (status != PSA_SUCCESS) {
Gilles Peskine12313cd2018-06-20 00:20:32 +02006956 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006957 }
Gilles Peskine12313cd2018-06-20 00:20:32 +02006958
Gilles Peskineb0b255c2018-07-06 17:01:38 +02006959 /* Step 2: set up the key derivation to generate key material from
Gilles Peskine224b0d62019-09-23 18:13:17 +02006960 * the shared secret. A shared secret is permitted wherever a key
6961 * of type DERIVE is permitted. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006962 status = psa_key_derivation_input_internal(operation, step,
6963 PSA_KEY_TYPE_DERIVE,
6964 shared_secret,
6965 shared_secret_length);
Gilles Peskine12313cd2018-06-20 00:20:32 +02006966exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01006967 mbedtls_platform_zeroize(shared_secret, shared_secret_length);
6968 return status;
Gilles Peskine12313cd2018-06-20 00:20:32 +02006969}
6970
Gilles Peskine449bd832023-01-11 14:50:10 +01006971psa_status_t psa_key_derivation_key_agreement(psa_key_derivation_operation_t *operation,
6972 psa_key_derivation_step_t step,
6973 mbedtls_svc_key_id_t private_key,
6974 const uint8_t *peer_key,
6975 size_t peer_key_length)
Gilles Peskine12313cd2018-06-20 00:20:32 +02006976{
Ronald Cronf95a2b12020-10-22 15:24:49 +02006977 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01006978 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01006979 psa_key_slot_t *slot;
Ronald Cronf95a2b12020-10-22 15:24:49 +02006980
Gilles Peskine449bd832023-01-11 14:50:10 +01006981 if (!PSA_ALG_IS_KEY_AGREEMENT(operation->alg)) {
6982 return PSA_ERROR_INVALID_ARGUMENT;
6983 }
Ronald Cron5c522922020-11-14 16:35:34 +01006984 status = psa_get_and_lock_transparent_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01006985 private_key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg);
6986 if (status != PSA_SUCCESS) {
6987 return status;
6988 }
6989 status = psa_key_agreement_internal(operation, step,
6990 slot,
6991 peer_key, peer_key_length);
6992 if (status != PSA_SUCCESS) {
6993 psa_key_derivation_abort(operation);
6994 } else {
Steven Cooremanfa5e6312020-10-15 17:07:12 +02006995 /* If a private key has been added as SECRET, we allow the derived
6996 * key material to be used as a key in PSA Crypto. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006997 if (step == PSA_KEY_DERIVATION_INPUT_SECRET) {
Steven Cooremanfa5e6312020-10-15 17:07:12 +02006998 operation->can_output_key = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01006999 }
Steven Cooremanfa5e6312020-10-15 17:07:12 +02007000 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02007001
Ryan Everett5ac6fa72024-02-14 17:11:36 +00007002 unlock_status = psa_unregister_read_under_mutex(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02007003
Gilles Peskine449bd832023-01-11 14:50:10 +01007004 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskineaf3baab2018-06-27 22:55:52 +02007005}
7006
Gilles Peskine449bd832023-01-11 14:50:10 +01007007psa_status_t psa_raw_key_agreement(psa_algorithm_t alg,
7008 mbedtls_svc_key_id_t private_key,
7009 const uint8_t *peer_key,
7010 size_t peer_key_length,
7011 uint8_t *output,
7012 size_t output_size,
7013 size_t *output_length)
Gilles Peskine0216fe12019-04-11 21:23:21 +02007014{
Ronald Cronf95a2b12020-10-22 15:24:49 +02007015 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01007016 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cronf95a2b12020-10-22 15:24:49 +02007017 psa_key_slot_t *slot = NULL;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01007018 size_t expected_length;
Gilles Peskine0216fe12019-04-11 21:23:21 +02007019
Gilles Peskine449bd832023-01-11 14:50:10 +01007020 if (!PSA_ALG_IS_KEY_AGREEMENT(alg)) {
Gilles Peskine0216fe12019-04-11 21:23:21 +02007021 status = PSA_ERROR_INVALID_ARGUMENT;
7022 goto exit;
7023 }
Ronald Cron5c522922020-11-14 16:35:34 +01007024 status = psa_get_and_lock_transparent_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01007025 private_key, &slot, PSA_KEY_USAGE_DERIVE, alg);
7026 if (status != PSA_SUCCESS) {
Gilles Peskine0216fe12019-04-11 21:23:21 +02007027 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007028 }
Gilles Peskine0216fe12019-04-11 21:23:21 +02007029
Gilles Peskine3e561302022-04-14 00:17:15 +02007030 /* PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() is in general an upper bound
7031 * for the output size. The PSA specification only guarantees that this
7032 * function works if output_size >= PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE(...),
7033 * but it might be nice to allow smaller buffers if the output fits.
7034 * At the time of writing this comment, with only ECDH implemented,
7035 * PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() is exact so the point is moot.
7036 * If FFDH is implemented, PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() can easily
7037 * be exact for it as well. */
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01007038 expected_length =
Gilles Peskine449bd832023-01-11 14:50:10 +01007039 PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE(slot->attr.type, slot->attr.bits);
7040 if (output_size < expected_length) {
Gilles Peskine3e561302022-04-14 00:17:15 +02007041 status = PSA_ERROR_BUFFER_TOO_SMALL;
7042 goto exit;
7043 }
7044
Gilles Peskine449bd832023-01-11 14:50:10 +01007045 status = psa_key_agreement_raw_internal(alg, slot,
7046 peer_key, peer_key_length,
7047 output, output_size,
7048 output_length);
Gilles Peskine0216fe12019-04-11 21:23:21 +02007049
7050exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01007051 if (status != PSA_SUCCESS) {
Gilles Peskine0216fe12019-04-11 21:23:21 +02007052 /* If an error happens and is not handled properly, the output
7053 * may be used as a key to protect sensitive data. Arrange for such
7054 * a key to be random, which is likely to result in decryption or
7055 * verification errors. This is better than filling the buffer with
7056 * some constant data such as zeros, which would result in the data
7057 * being protected with a reproducible, easily knowable key.
7058 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007059 psa_generate_random(output, output_size);
Gilles Peskine0216fe12019-04-11 21:23:21 +02007060 *output_length = output_size;
7061 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02007062
Ryan Everetta103ec92024-01-31 13:59:57 +00007063 unlock_status = psa_unregister_read_under_mutex(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02007064
Gilles Peskine449bd832023-01-11 14:50:10 +01007065 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine0216fe12019-04-11 21:23:21 +02007066}
Gilles Peskine86a440b2018-11-12 18:39:40 +01007067
7068
Gilles Peskine30524eb2020-11-13 17:02:26 +01007069
Gilles Peskine86a440b2018-11-12 18:39:40 +01007070/****************************************************************/
7071/* Random generation */
Gilles Peskine53d991e2018-07-12 01:14:59 +02007072/****************************************************************/
Gilles Peskine12313cd2018-06-20 00:20:32 +02007073
Gilles Peskine672a7712023-04-28 21:00:28 +02007074#if defined(MBEDTLS_PSA_INJECT_ENTROPY)
7075#include "entropy_poll.h"
7076#endif
7077
Gilles Peskine30524eb2020-11-13 17:02:26 +01007078/** Initialize the PSA random generator.
7079 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007080static void mbedtls_psa_random_init(mbedtls_psa_random_context_t *rng)
Gilles Peskine30524eb2020-11-13 17:02:26 +01007081{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007082#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
Gilles Peskine449bd832023-01-11 14:50:10 +01007083 memset(rng, 0, sizeof(*rng));
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007084#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
7085
Gilles Peskine30524eb2020-11-13 17:02:26 +01007086 /* Set default configuration if
7087 * mbedtls_psa_crypto_configure_entropy_sources() hasn't been called. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007088 if (rng->entropy_init == NULL) {
Gilles Peskine30524eb2020-11-13 17:02:26 +01007089 rng->entropy_init = mbedtls_entropy_init;
Gilles Peskine449bd832023-01-11 14:50:10 +01007090 }
7091 if (rng->entropy_free == NULL) {
Gilles Peskine30524eb2020-11-13 17:02:26 +01007092 rng->entropy_free = mbedtls_entropy_free;
Gilles Peskine449bd832023-01-11 14:50:10 +01007093 }
Gilles Peskine30524eb2020-11-13 17:02:26 +01007094
Gilles Peskine449bd832023-01-11 14:50:10 +01007095 rng->entropy_init(&rng->entropy);
Gilles Peskine30524eb2020-11-13 17:02:26 +01007096#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \
7097 defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES)
7098 /* The PSA entropy injection feature depends on using NV seed as an entropy
7099 * source. Add NV seed as an entropy source for PSA entropy injection. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007100 mbedtls_entropy_add_source(&rng->entropy,
7101 mbedtls_nv_seed_poll, NULL,
7102 MBEDTLS_ENTROPY_BLOCK_SIZE,
7103 MBEDTLS_ENTROPY_SOURCE_STRONG);
Gilles Peskine30524eb2020-11-13 17:02:26 +01007104#endif
7105
Gilles Peskine449bd832023-01-11 14:50:10 +01007106 mbedtls_psa_drbg_init(MBEDTLS_PSA_RANDOM_STATE);
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007107#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01007108}
7109
7110/** Deinitialize the PSA random generator.
7111 */
Valerio Setti83e0de82023-11-24 12:13:05 +01007112static void mbedtls_psa_random_free(mbedtls_psa_random_context_t *rng)
Gilles Peskine30524eb2020-11-13 17:02:26 +01007113{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007114#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
Valerio Setti83e0de82023-11-24 12:13:05 +01007115 memset(rng, 0, sizeof(*rng));
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007116#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Valerio Setti83e0de82023-11-24 12:13:05 +01007117 mbedtls_psa_drbg_free(MBEDTLS_PSA_RANDOM_STATE);
7118 rng->entropy_free(&rng->entropy);
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007119#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01007120}
7121
7122/** Seed the PSA random generator.
7123 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007124static psa_status_t mbedtls_psa_random_seed(mbedtls_psa_random_context_t *rng)
Gilles Peskine30524eb2020-11-13 17:02:26 +01007125{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007126#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
7127 /* Do nothing: the external RNG seeds itself. */
7128 (void) rng;
Gilles Peskine449bd832023-01-11 14:50:10 +01007129 return PSA_SUCCESS;
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007130#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01007131 const unsigned char drbg_seed[] = "PSA";
Gilles Peskine449bd832023-01-11 14:50:10 +01007132 int ret = mbedtls_psa_drbg_seed(&rng->entropy,
7133 drbg_seed, sizeof(drbg_seed) - 1);
7134 return mbedtls_to_psa_error(ret);
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007135#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01007136}
7137
Gilles Peskine449bd832023-01-11 14:50:10 +01007138psa_status_t psa_generate_random(uint8_t *output,
7139 size_t output_size)
Gilles Peskinee59236f2018-01-27 23:32:46 +01007140{
Gilles Peskinee59236f2018-01-27 23:32:46 +01007141 GUARD_MODULE_INITIALIZED;
7142
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007143#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
7144
7145 size_t output_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01007146 psa_status_t status = mbedtls_psa_external_get_random(&global_data.rng,
7147 output, output_size,
7148 &output_length);
7149 if (status != PSA_SUCCESS) {
7150 return status;
7151 }
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007152 /* Breaking up a request into smaller chunks is currently not supported
Tom Cosgrove1797b052022-12-04 17:19:59 +00007153 * for the external RNG interface. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007154 if (output_length != output_size) {
7155 return PSA_ERROR_INSUFFICIENT_ENTROPY;
7156 }
7157 return PSA_SUCCESS;
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007158
7159#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
7160
Gilles Peskine449bd832023-01-11 14:50:10 +01007161 while (output_size > 0) {
Gilles Peskine71ddab92021-01-04 21:01:07 +01007162 size_t request_size =
Gilles Peskine449bd832023-01-11 14:50:10 +01007163 (output_size > MBEDTLS_PSA_RANDOM_MAX_REQUEST ?
7164 MBEDTLS_PSA_RANDOM_MAX_REQUEST :
7165 output_size);
7166 int ret = mbedtls_psa_get_random(MBEDTLS_PSA_RANDOM_STATE,
7167 output, request_size);
7168 if (ret != 0) {
7169 return mbedtls_to_psa_error(ret);
7170 }
Gilles Peskine71ddab92021-01-04 21:01:07 +01007171 output_size -= request_size;
7172 output += request_size;
Gilles Peskinef181eca2019-08-07 13:49:00 +02007173 }
Gilles Peskine449bd832023-01-11 14:50:10 +01007174 return PSA_SUCCESS;
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007175#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskinee59236f2018-01-27 23:32:46 +01007176}
7177
Gilles Peskine8814fc42020-12-14 15:33:44 +01007178/* Wrapper function allowing the classic API to use the PSA RNG.
Gilles Peskine9c3e0602021-01-05 16:03:55 +01007179 *
7180 * `mbedtls_psa_get_random(MBEDTLS_PSA_RANDOM_STATE, ...)` calls
7181 * `psa_generate_random(...)`. The state parameter is ignored since the
7182 * PSA API doesn't support passing an explicit state.
7183 *
7184 * In the non-external case, psa_generate_random() calls an
7185 * `mbedtls_xxx_drbg_random` function which has exactly the same signature
7186 * and semantics as mbedtls_psa_get_random(). As an optimization,
7187 * instead of doing this back-and-forth between the PSA API and the
7188 * classic API, psa_crypto_random_impl.h defines `mbedtls_psa_get_random`
7189 * as a constant function pointer to `mbedtls_xxx_drbg_random`.
Gilles Peskine8814fc42020-12-14 15:33:44 +01007190 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007191#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
7192int mbedtls_psa_get_random(void *p_rng,
7193 unsigned char *output,
7194 size_t output_size)
Gilles Peskine8814fc42020-12-14 15:33:44 +01007195{
Gilles Peskine9c3e0602021-01-05 16:03:55 +01007196 /* This function takes a pointer to the RNG state because that's what
7197 * classic mbedtls functions using an RNG expect. The PSA RNG manages
7198 * its own state internally and doesn't let the caller access that state.
7199 * So we just ignore the state parameter, and in practice we'll pass
7200 * NULL. */
Gilles Peskine8814fc42020-12-14 15:33:44 +01007201 (void) p_rng;
Gilles Peskine449bd832023-01-11 14:50:10 +01007202 psa_status_t status = psa_generate_random(output, output_size);
7203 if (status == PSA_SUCCESS) {
7204 return 0;
7205 } else {
7206 return MBEDTLS_ERR_ENTROPY_SOURCE_FAILED;
7207 }
Gilles Peskine8814fc42020-12-14 15:33:44 +01007208}
7209#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
7210
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01007211#if defined(MBEDTLS_PSA_INJECT_ENTROPY)
Gilles Peskine449bd832023-01-11 14:50:10 +01007212psa_status_t mbedtls_psa_inject_entropy(const uint8_t *seed,
7213 size_t seed_size)
Netanel Gonen2bcd3122018-11-19 11:53:02 +02007214{
Gilles Peskine449bd832023-01-11 14:50:10 +01007215 if (global_data.initialized) {
7216 return PSA_ERROR_NOT_PERMITTED;
7217 }
Netanel Gonen21f37cb2018-11-19 11:53:55 +02007218
Gilles Peskine449bd832023-01-11 14:50:10 +01007219 if (((seed_size < MBEDTLS_ENTROPY_MIN_PLATFORM) ||
7220 (seed_size < MBEDTLS_ENTROPY_BLOCK_SIZE)) ||
7221 (seed_size > MBEDTLS_ENTROPY_MAX_SEED_SIZE)) {
7222 return PSA_ERROR_INVALID_ARGUMENT;
7223 }
Netanel Gonen21f37cb2018-11-19 11:53:55 +02007224
Gilles Peskine449bd832023-01-11 14:50:10 +01007225 return mbedtls_psa_storage_inject_entropy(seed, seed_size);
Netanel Gonen2bcd3122018-11-19 11:53:02 +02007226}
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01007227#endif /* MBEDTLS_PSA_INJECT_ENTROPY */
Netanel Gonen2bcd3122018-11-19 11:53:02 +02007228
Ronald Cron3772afe2021-02-08 16:10:05 +01007229/** Validate the key type and size for key generation
Ronald Cron01b2aba2020-10-05 09:42:02 +02007230 *
Ronald Cron3772afe2021-02-08 16:10:05 +01007231 * \param type The key type
7232 * \param bits The number of bits of the key
Ronald Cron01b2aba2020-10-05 09:42:02 +02007233 *
7234 * \retval #PSA_SUCCESS
Ronald Cron3772afe2021-02-08 16:10:05 +01007235 * The key type and size are valid.
Ronald Cron01b2aba2020-10-05 09:42:02 +02007236 * \retval #PSA_ERROR_INVALID_ARGUMENT
7237 * The size in bits of the key is not valid.
7238 * \retval #PSA_ERROR_NOT_SUPPORTED
7239 * The type and/or the size in bits of the key or the combination of
7240 * the two is not supported.
7241 */
Ronald Cron3772afe2021-02-08 16:10:05 +01007242static psa_status_t psa_validate_key_type_and_size_for_key_generation(
Gilles Peskine449bd832023-01-11 14:50:10 +01007243 psa_key_type_t type, size_t bits)
Gilles Peskinee59236f2018-01-27 23:32:46 +01007244{
Ronald Cronf3bb7612020-10-02 20:11:59 +02007245 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinee59236f2018-01-27 23:32:46 +01007246
Gilles Peskine449bd832023-01-11 14:50:10 +01007247 if (key_type_is_raw_bytes(type)) {
7248 status = psa_validate_unstructured_key_bit_size(type, bits);
7249 if (status != PSA_SUCCESS) {
7250 return status;
7251 }
7252 } else
Valerio Settif6d4dfb2023-07-10 10:55:12 +02007253#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01007254 if (PSA_KEY_TYPE_IS_RSA(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
7255 if (bits > PSA_VENDOR_RSA_MAX_KEY_BITS) {
7256 return PSA_ERROR_NOT_SUPPORTED;
7257 }
Waleed Elmelegyd7bdbbe2023-07-20 16:26:58 +00007258 if (bits < PSA_VENDOR_RSA_GENERATE_MIN_KEY_BITS) {
Waleed Elmelegyab570712023-07-05 16:40:58 +00007259 return PSA_ERROR_NOT_SUPPORTED;
7260 }
Steven Cooreman81be2fa2020-07-24 22:04:59 +02007261
Ronald Cron01b2aba2020-10-05 09:42:02 +02007262 /* Accept only byte-aligned keys, for the same reasons as
7263 * in psa_import_rsa_key(). */
Gilles Peskine449bd832023-01-11 14:50:10 +01007264 if (bits % 8 != 0) {
7265 return PSA_ERROR_NOT_SUPPORTED;
7266 }
7267 } else
Valerio Settif6d4dfb2023-07-10 10:55:12 +02007268#endif /* defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE) */
Ronald Cron01b2aba2020-10-05 09:42:02 +02007269
Valerio Setti6a9d0ee2023-06-21 10:07:21 +02007270#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01007271 if (PSA_KEY_TYPE_IS_ECC(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
Ronald Crond81ab562021-02-16 09:01:16 +01007272 /* To avoid empty block, return successfully here. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007273 return PSA_SUCCESS;
7274 } else
Valerio Setti6a9d0ee2023-06-21 10:07:21 +02007275#endif /* defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE) */
Przemek Stekielfedd1342022-12-01 15:00:02 +01007276
Valerio Settia55f0422023-07-10 15:34:41 +02007277#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE)
Przemek Stekielfedd1342022-12-01 15:00:02 +01007278 if (PSA_KEY_TYPE_IS_DH(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
Przemek Stekield1cf1ba2023-04-27 12:04:21 +02007279 if (psa_is_dh_key_size_valid(bits) == 0) {
Przemek Stekielfedd1342022-12-01 15:00:02 +01007280 return PSA_ERROR_NOT_SUPPORTED;
7281 }
7282 } else
Valerio Settia55f0422023-07-10 15:34:41 +02007283#endif /* defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE) */
Ronald Cron01b2aba2020-10-05 09:42:02 +02007284 {
Gilles Peskine449bd832023-01-11 14:50:10 +01007285 return PSA_ERROR_NOT_SUPPORTED;
Ronald Cron01b2aba2020-10-05 09:42:02 +02007286 }
7287
Gilles Peskine449bd832023-01-11 14:50:10 +01007288 return PSA_SUCCESS;
Ronald Cron01b2aba2020-10-05 09:42:02 +02007289}
7290
Ronald Cron55ed0592020-10-05 10:30:40 +02007291psa_status_t psa_generate_key_internal(
Ronald Cron2a38a6b2020-10-02 20:02:04 +02007292 const psa_key_attributes_t *attributes,
Gilles Peskine092ce512024-02-20 12:31:24 +01007293 const psa_key_production_parameters_t *params, size_t params_data_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01007294 uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length)
Ronald Cron01b2aba2020-10-05 09:42:02 +02007295{
7296 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f107ae2024-02-28 01:26:46 +01007297 psa_key_type_t type = attributes->type;
Ronald Cron01b2aba2020-10-05 09:42:02 +02007298
Gilles Peskine7a18f962024-02-12 16:48:11 +01007299 /* Only used for RSA */
Gilles Peskine092ce512024-02-20 12:31:24 +01007300 (void) params;
7301 (void) params_data_length;
Gilles Peskine7a18f962024-02-12 16:48:11 +01007302
Gilles Peskine449bd832023-01-11 14:50:10 +01007303 if (key_type_is_raw_bytes(type)) {
7304 status = psa_generate_random(key_buffer, key_buffer_size);
7305 if (status != PSA_SUCCESS) {
7306 return status;
7307 }
Steven Cooreman81be2fa2020-07-24 22:04:59 +02007308
David Brown12ca5032021-02-11 11:02:00 -07007309#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Gilles Peskine449bd832023-01-11 14:50:10 +01007310 if (type == PSA_KEY_TYPE_DES) {
7311 psa_des_set_key_parity(key_buffer, key_buffer_size);
7312 }
David Brown8107e312021-02-12 08:08:46 -07007313#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */
Gilles Peskine449bd832023-01-11 14:50:10 +01007314 } else
Gilles Peskinee59236f2018-01-27 23:32:46 +01007315
Valerio Setti76df8c12023-07-11 14:11:28 +02007316#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_GENERATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01007317 if (type == PSA_KEY_TYPE_RSA_KEY_PAIR) {
Gilles Peskinee22f6a92024-02-26 15:45:33 +01007318 return mbedtls_psa_rsa_generate_key(attributes,
Gilles Peskine4c32b692024-02-16 00:11:09 +01007319 params, params_data_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01007320 key_buffer,
7321 key_buffer_size,
7322 key_buffer_length);
7323 } else
Valerio Setti76df8c12023-07-11 14:11:28 +02007324#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_GENERATE) */
Gilles Peskinee59236f2018-01-27 23:32:46 +01007325
Valerio Settibfeaf5b2023-06-20 13:27:46 +02007326#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01007327 if (PSA_KEY_TYPE_IS_ECC(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
7328 return mbedtls_psa_ecp_generate_key(attributes,
7329 key_buffer,
7330 key_buffer_size,
7331 key_buffer_length);
7332 } else
Valerio Settibfeaf5b2023-06-20 13:27:46 +02007333#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE) */
Przemek Stekielfedd1342022-12-01 15:00:02 +01007334
Valerio Settia55f0422023-07-10 15:34:41 +02007335#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE)
Przemek Stekielfedd1342022-12-01 15:00:02 +01007336 if (PSA_KEY_TYPE_IS_DH(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
7337 return mbedtls_psa_ffdh_generate_key(attributes,
7338 key_buffer,
7339 key_buffer_size,
7340 key_buffer_length);
7341 } else
Valerio Settia55f0422023-07-10 15:34:41 +02007342#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE) */
Steven Cooreman29149862020-08-05 15:43:42 +02007343 {
Gilles Peskine449bd832023-01-11 14:50:10 +01007344 (void) key_buffer_length;
7345 return PSA_ERROR_NOT_SUPPORTED;
Steven Cooreman29149862020-08-05 15:43:42 +02007346 }
Gilles Peskinee59236f2018-01-27 23:32:46 +01007347
Gilles Peskine449bd832023-01-11 14:50:10 +01007348 return PSA_SUCCESS;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02007349}
Darryl Green0c6575a2018-11-07 16:05:30 +00007350
Gilles Peskinef0765fa2024-02-12 16:46:16 +01007351psa_status_t psa_generate_key_ext(const psa_key_attributes_t *attributes,
Gilles Peskine092ce512024-02-20 12:31:24 +01007352 const psa_key_production_parameters_t *params,
7353 size_t params_data_length,
Gilles Peskinef0765fa2024-02-12 16:46:16 +01007354 mbedtls_svc_key_id_t *key)
Gilles Peskineff5f0e72019-04-18 12:53:30 +02007355{
7356 psa_status_t status;
7357 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02007358 psa_se_drv_table_entry_t *driver = NULL;
Ronald Cron2b56bc82020-10-05 10:02:26 +02007359 size_t key_buffer_size;
Gilles Peskine11792082019-08-06 18:36:36 +02007360
Ronald Cron81709fc2020-11-14 12:10:32 +01007361 *key = MBEDTLS_SVC_KEY_ID_INIT;
7362
Gilles Peskine0f84d622019-09-12 19:03:13 +02007363 /* Reject any attempt to create a zero-length key so that we don't
7364 * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007365 if (psa_get_key_bits(attributes) == 0) {
7366 return PSA_ERROR_INVALID_ARGUMENT;
7367 }
Gilles Peskine0f84d622019-09-12 19:03:13 +02007368
Przemyslaw Stekielc0fe8202021-10-07 11:08:56 +02007369 /* Reject any attempt to create a public key. */
Gilles Peskine2f107ae2024-02-28 01:26:46 +01007370 if (PSA_KEY_TYPE_IS_PUBLIC_KEY(attributes->type)) {
Gilles Peskine449bd832023-01-11 14:50:10 +01007371 return PSA_ERROR_INVALID_ARGUMENT;
7372 }
Przemyslaw Stekielc0fe8202021-10-07 11:08:56 +02007373
Gilles Peskine7a18f962024-02-12 16:48:11 +01007374#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE)
Gilles Peskine2f107ae2024-02-28 01:26:46 +01007375 if (attributes->type == PSA_KEY_TYPE_RSA_KEY_PAIR) {
Gilles Peskine092ce512024-02-20 12:31:24 +01007376 if (params->flags != 0) {
Gilles Peskine7a18f962024-02-12 16:48:11 +01007377 return PSA_ERROR_INVALID_ARGUMENT;
7378 }
7379 } else
7380#endif
Gilles Peskine092ce512024-02-20 12:31:24 +01007381 if (!psa_key_production_parameters_are_default(params, params_data_length)) {
Gilles Peskinef0765fa2024-02-12 16:46:16 +01007382 return PSA_ERROR_INVALID_ARGUMENT;
7383 }
7384
Gilles Peskine449bd832023-01-11 14:50:10 +01007385 status = psa_start_key_creation(PSA_KEY_CREATION_GENERATE, attributes,
7386 &slot, &driver);
7387 if (status != PSA_SUCCESS) {
Gilles Peskine11792082019-08-06 18:36:36 +02007388 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007389 }
Gilles Peskine11792082019-08-06 18:36:36 +02007390
Ronald Cron977c2472020-10-13 08:32:21 +02007391 /* In the case of a transparent key or an opaque key stored in local
Archana449608b2021-09-08 15:36:05 +05307392 * storage ( thus not in the case of generating a key in a secure element
7393 * with storage ( MBEDTLS_PSA_CRYPTO_SE_C ) ),we have to allocate a
7394 * buffer to hold the generated key material. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007395 if (slot->key.data == NULL) {
Gilles Peskine2f107ae2024-02-28 01:26:46 +01007396 if (PSA_KEY_LIFETIME_GET_LOCATION(attributes->lifetime) ==
Gilles Peskine449bd832023-01-11 14:50:10 +01007397 PSA_KEY_LOCATION_LOCAL_STORAGE) {
Ronald Cron3772afe2021-02-08 16:10:05 +01007398 status = psa_validate_key_type_and_size_for_key_generation(
Gilles Peskine2f107ae2024-02-28 01:26:46 +01007399 attributes->type, attributes->bits);
Gilles Peskine449bd832023-01-11 14:50:10 +01007400 if (status != PSA_SUCCESS) {
Ronald Cron3772afe2021-02-08 16:10:05 +01007401 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007402 }
Ronald Cron3772afe2021-02-08 16:10:05 +01007403
7404 key_buffer_size = PSA_EXPORT_KEY_OUTPUT_SIZE(
Gilles Peskine2f107ae2024-02-28 01:26:46 +01007405 attributes->type,
7406 attributes->bits);
Gilles Peskine449bd832023-01-11 14:50:10 +01007407 } else {
Ronald Cron977c2472020-10-13 08:32:21 +02007408 status = psa_driver_wrapper_get_key_buffer_size(
Gilles Peskine449bd832023-01-11 14:50:10 +01007409 attributes, &key_buffer_size);
7410 if (status != PSA_SUCCESS) {
Ronald Cron3772afe2021-02-08 16:10:05 +01007411 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007412 }
Ronald Cron977c2472020-10-13 08:32:21 +02007413 }
Ronald Cron977c2472020-10-13 08:32:21 +02007414
Gilles Peskine449bd832023-01-11 14:50:10 +01007415 status = psa_allocate_buffer_to_slot(slot, key_buffer_size);
7416 if (status != PSA_SUCCESS) {
Ronald Cron977c2472020-10-13 08:32:21 +02007417 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007418 }
Ronald Cron977c2472020-10-13 08:32:21 +02007419 }
7420
Gilles Peskine449bd832023-01-11 14:50:10 +01007421 status = psa_driver_wrapper_generate_key(attributes,
Gilles Peskine092ce512024-02-20 12:31:24 +01007422 params, params_data_length,
Gilles Peskine7a18f962024-02-12 16:48:11 +01007423 slot->key.data, slot->key.bytes,
7424 &slot->key.bytes);
Gilles Peskine449bd832023-01-11 14:50:10 +01007425 if (status != PSA_SUCCESS) {
7426 psa_remove_key_data_from_memory(slot);
7427 }
Ronald Cron2b56bc82020-10-05 10:02:26 +02007428
Gilles Peskine11792082019-08-06 18:36:36 +02007429exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01007430 if (status == PSA_SUCCESS) {
7431 status = psa_finish_key_creation(slot, driver, key);
7432 }
7433 if (status != PSA_SUCCESS) {
7434 psa_fail_key_creation(slot, driver);
7435 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02007436
Gilles Peskine449bd832023-01-11 14:50:10 +01007437 return status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01007438}
7439
Gilles Peskinef0765fa2024-02-12 16:46:16 +01007440psa_status_t psa_generate_key(const psa_key_attributes_t *attributes,
7441 mbedtls_svc_key_id_t *key)
7442{
7443 return psa_generate_key_ext(attributes,
Gilles Peskine092ce512024-02-20 12:31:24 +01007444 &default_production_parameters, 0,
Gilles Peskinef0765fa2024-02-12 16:46:16 +01007445 key);
7446}
7447
Gilles Peskinee59236f2018-01-27 23:32:46 +01007448/****************************************************************/
7449/* Module setup */
7450/****************************************************************/
7451
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007452#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
Gilles Peskine5e769522018-11-20 21:59:56 +01007453psa_status_t mbedtls_psa_crypto_configure_entropy_sources(
Gilles Peskine449bd832023-01-11 14:50:10 +01007454 void (* entropy_init)(mbedtls_entropy_context *ctx),
7455 void (* entropy_free)(mbedtls_entropy_context *ctx))
Gilles Peskine5e769522018-11-20 21:59:56 +01007456{
Gilles Peskine449bd832023-01-11 14:50:10 +01007457 if (global_data.rng_state != RNG_NOT_INITIALIZED) {
7458 return PSA_ERROR_BAD_STATE;
7459 }
Gilles Peskine30524eb2020-11-13 17:02:26 +01007460 global_data.rng.entropy_init = entropy_init;
7461 global_data.rng.entropy_free = entropy_free;
Gilles Peskine449bd832023-01-11 14:50:10 +01007462 return PSA_SUCCESS;
Gilles Peskine5e769522018-11-20 21:59:56 +01007463}
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007464#endif /* !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) */
Gilles Peskine5e769522018-11-20 21:59:56 +01007465
Gilles Peskine449bd832023-01-11 14:50:10 +01007466void mbedtls_psa_crypto_free(void)
Gilles Peskinee59236f2018-01-27 23:32:46 +01007467{
Gilles Peskine449bd832023-01-11 14:50:10 +01007468 psa_wipe_all_key_slots();
Valerio Setti83e0de82023-11-24 12:13:05 +01007469 if (global_data.rng_state != RNG_NOT_INITIALIZED) {
7470 mbedtls_psa_random_free(&global_data.rng);
7471 }
Gilles Peskinec6b69072018-11-20 21:42:52 +01007472 /* Wipe all remaining data, including configuration.
7473 * In particular, this sets all state indicator to the value
7474 * indicating "uninitialized". */
Gilles Peskine449bd832023-01-11 14:50:10 +01007475 mbedtls_platform_zeroize(&global_data, sizeof(global_data));
Ronald Cron9ba76912021-04-10 16:57:30 +02007476
7477 /* Terminate drivers */
Gilles Peskine449bd832023-01-11 14:50:10 +01007478 psa_driver_wrapper_free();
Gilles Peskinee59236f2018-01-27 23:32:46 +01007479}
7480
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02007481#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
7482/** Recover a transaction that was interrupted by a power failure.
7483 *
7484 * This function is called during initialization, before psa_crypto_init()
7485 * returns. If this function returns a failure status, the initialization
7486 * fails.
7487 */
7488static psa_status_t psa_crypto_recover_transaction(
Gilles Peskine449bd832023-01-11 14:50:10 +01007489 const psa_crypto_transaction_t *transaction)
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02007490{
Gilles Peskine449bd832023-01-11 14:50:10 +01007491 switch (transaction->unknown.type) {
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02007492 case PSA_CRYPTO_TRANSACTION_CREATE_KEY:
7493 case PSA_CRYPTO_TRANSACTION_DESTROY_KEY:
Gilles Peskine449bd832023-01-11 14:50:10 +01007494 /* TODO - fall through to the failure case until this
7495 * is implemented.
7496 * https://github.com/ARMmbed/mbed-crypto/issues/218
7497 */
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02007498 default:
7499 /* We found an unsupported transaction in the storage.
7500 * We don't know what state the storage is in. Give up. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007501 return PSA_ERROR_DATA_INVALID;
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02007502 }
7503}
7504#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
7505
Gilles Peskine449bd832023-01-11 14:50:10 +01007506psa_status_t psa_crypto_init(void)
Gilles Peskinee59236f2018-01-27 23:32:46 +01007507{
Gilles Peskine66fb1262018-12-10 16:29:04 +01007508 psa_status_t status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01007509
Gilles Peskinec6b69072018-11-20 21:42:52 +01007510 /* Double initialization is explicitly allowed. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007511 if (global_data.initialized != 0) {
7512 return PSA_SUCCESS;
7513 }
Gilles Peskinee59236f2018-01-27 23:32:46 +01007514
Manuel Pégourié-Gonnard7abdf7e2023-03-09 11:17:43 +01007515 /* Init drivers */
7516 status = psa_driver_wrapper_init();
7517 if (status != PSA_SUCCESS) {
7518 goto exit;
7519 }
7520 global_data.drivers_initialized = 1;
7521
Valerio Setti402cfba2023-11-13 10:24:32 +01007522 status = psa_initialize_key_slots();
7523 if (status != PSA_SUCCESS) {
7524 goto exit;
7525 }
7526
Gilles Peskine30524eb2020-11-13 17:02:26 +01007527 /* Initialize and seed the random generator. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007528 mbedtls_psa_random_init(&global_data.rng);
Gilles Peskinec6b69072018-11-20 21:42:52 +01007529 global_data.rng_state = RNG_INITIALIZED;
Gilles Peskine449bd832023-01-11 14:50:10 +01007530 status = mbedtls_psa_random_seed(&global_data.rng);
7531 if (status != PSA_SUCCESS) {
Gilles Peskinee59236f2018-01-27 23:32:46 +01007532 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007533 }
Gilles Peskinec6b69072018-11-20 21:42:52 +01007534 global_data.rng_state = RNG_SEEDED;
Gilles Peskinee59236f2018-01-27 23:32:46 +01007535
Gilles Peskine4b734222019-07-24 15:56:31 +02007536#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
Gilles Peskine449bd832023-01-11 14:50:10 +01007537 status = psa_crypto_load_transaction();
7538 if (status == PSA_SUCCESS) {
7539 status = psa_crypto_recover_transaction(&psa_crypto_transaction);
7540 if (status != PSA_SUCCESS) {
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02007541 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007542 }
7543 status = psa_crypto_stop_transaction();
7544 } else if (status == PSA_ERROR_DOES_NOT_EXIST) {
Gilles Peskinefc762652019-07-22 19:30:34 +02007545 /* There's no transaction to complete. It's all good. */
7546 status = PSA_SUCCESS;
7547 }
Gilles Peskine4b734222019-07-24 15:56:31 +02007548#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
Gilles Peskinefc762652019-07-22 19:30:34 +02007549
Gilles Peskinec6b69072018-11-20 21:42:52 +01007550 /* All done. */
Gilles Peskinee59236f2018-01-27 23:32:46 +01007551 global_data.initialized = 1;
7552
7553exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01007554 if (status != PSA_SUCCESS) {
7555 mbedtls_psa_crypto_free();
7556 }
7557 return status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01007558}
7559
Yanray Wangffc3c482023-07-11 12:01:04 +08007560#if defined(PSA_WANT_ALG_SOME_PAKE)
Przemek Stekielca8d2b22023-01-17 16:21:33 +01007561psa_status_t psa_crypto_driver_pake_get_password_len(
7562 const psa_crypto_driver_pake_inputs_t *inputs,
7563 size_t *password_len)
7564{
7565 if (inputs->password_len == 0) {
7566 return PSA_ERROR_BAD_STATE;
7567 }
7568
7569 *password_len = inputs->password_len;
7570
7571 return PSA_SUCCESS;
7572}
7573
7574psa_status_t psa_crypto_driver_pake_get_password(
7575 const psa_crypto_driver_pake_inputs_t *inputs,
7576 uint8_t *buffer, size_t buffer_size, size_t *buffer_length)
7577{
7578 if (inputs->password_len == 0) {
7579 return PSA_ERROR_BAD_STATE;
7580 }
7581
7582 if (buffer_size < inputs->password_len) {
7583 return PSA_ERROR_BUFFER_TOO_SMALL;
7584 }
7585
7586 memcpy(buffer, inputs->password, inputs->password_len);
7587 *buffer_length = inputs->password_len;
7588
7589 return PSA_SUCCESS;
7590}
7591
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007592psa_status_t psa_crypto_driver_pake_get_user_len(
7593 const psa_crypto_driver_pake_inputs_t *inputs,
7594 size_t *user_len)
7595{
7596 if (inputs->user_len == 0) {
7597 return PSA_ERROR_BAD_STATE;
7598 }
7599
7600 *user_len = inputs->user_len;
7601
7602 return PSA_SUCCESS;
7603}
7604
7605psa_status_t psa_crypto_driver_pake_get_user(
7606 const psa_crypto_driver_pake_inputs_t *inputs,
Przemek Stekielc0e62502023-03-14 11:49:36 +01007607 uint8_t *user_id, size_t user_id_size, size_t *user_id_len)
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007608{
7609 if (inputs->user_len == 0) {
7610 return PSA_ERROR_BAD_STATE;
7611 }
7612
Przemek Stekielc0e62502023-03-14 11:49:36 +01007613 if (user_id_size < inputs->user_len) {
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007614 return PSA_ERROR_BUFFER_TOO_SMALL;
7615 }
7616
Przemek Stekielc0e62502023-03-14 11:49:36 +01007617 memcpy(user_id, inputs->user, inputs->user_len);
7618 *user_id_len = inputs->user_len;
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007619
7620 return PSA_SUCCESS;
7621}
7622
7623psa_status_t psa_crypto_driver_pake_get_peer_len(
7624 const psa_crypto_driver_pake_inputs_t *inputs,
7625 size_t *peer_len)
7626{
7627 if (inputs->peer_len == 0) {
7628 return PSA_ERROR_BAD_STATE;
7629 }
7630
7631 *peer_len = inputs->peer_len;
7632
7633 return PSA_SUCCESS;
7634}
7635
7636psa_status_t psa_crypto_driver_pake_get_peer(
7637 const psa_crypto_driver_pake_inputs_t *inputs,
Przemek Stekielc0e62502023-03-14 11:49:36 +01007638 uint8_t *peer_id, size_t peer_id_size, size_t *peer_id_length)
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007639{
7640 if (inputs->peer_len == 0) {
7641 return PSA_ERROR_BAD_STATE;
7642 }
7643
Przemek Stekielc0e62502023-03-14 11:49:36 +01007644 if (peer_id_size < inputs->peer_len) {
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007645 return PSA_ERROR_BUFFER_TOO_SMALL;
7646 }
7647
Przemek Stekielc0e62502023-03-14 11:49:36 +01007648 memcpy(peer_id, inputs->peer, inputs->peer_len);
7649 *peer_id_length = inputs->peer_len;
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007650
7651 return PSA_SUCCESS;
7652}
7653
Przemek Stekielca8d2b22023-01-17 16:21:33 +01007654psa_status_t psa_crypto_driver_pake_get_cipher_suite(
7655 const psa_crypto_driver_pake_inputs_t *inputs,
7656 psa_pake_cipher_suite_t *cipher_suite)
7657{
7658 if (inputs->cipher_suite.algorithm == PSA_ALG_NONE) {
7659 return PSA_ERROR_BAD_STATE;
7660 }
7661
7662 *cipher_suite = inputs->cipher_suite;
7663
7664 return PSA_SUCCESS;
7665}
7666
Neil Armstronga7d08c32022-06-01 18:21:20 +02007667psa_status_t psa_pake_setup(
7668 psa_pake_operation_t *operation,
7669 const psa_pake_cipher_suite_t *cipher_suite)
7670{
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007671 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007672
Przemek Stekiel1c3cfb42023-01-26 10:35:02 +01007673 if (operation->stage != PSA_PAKE_OPERATION_STAGE_SETUP) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007674 status = PSA_ERROR_BAD_STATE;
7675 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007676 }
7677
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01007678 if (PSA_ALG_IS_PAKE(cipher_suite->algorithm) == 0 ||
Przemek Stekiel51eac532022-12-07 11:04:51 +01007679 PSA_ALG_IS_HASH(cipher_suite->hash) == 0) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007680 status = PSA_ERROR_INVALID_ARGUMENT;
7681 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007682 }
7683
Przemek Stekiel51eac532022-12-07 11:04:51 +01007684 memset(&operation->data.inputs, 0, sizeof(operation->data.inputs));
7685
Przemek Stekiele12ed362022-12-21 12:54:46 +01007686 operation->alg = cipher_suite->algorithm;
Przemek Stekiel656b2592023-03-22 13:15:33 +01007687 operation->primitive = PSA_PAKE_PRIMITIVE(cipher_suite->type,
7688 cipher_suite->family, cipher_suite->bits);
Przemek Stekiel51eac532022-12-07 11:04:51 +01007689 operation->data.inputs.cipher_suite = *cipher_suite;
7690
Przemek Stekiel4aa99402023-02-27 13:00:57 +01007691#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01007692 if (operation->alg == PSA_ALG_JPAKE) {
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01007693 psa_jpake_computation_stage_t *computation_stage =
Przemek Stekieldde6a912023-01-26 08:46:37 +01007694 &operation->computation_stage.jpake;
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01007695
David Horstmann16f01512023-06-14 17:21:07 +01007696 memset(computation_stage, 0, sizeof(*computation_stage));
David Horstmanne7f21e62023-05-12 18:17:21 +01007697 computation_stage->step = PSA_PAKE_STEP_KEY_SHARE;
Przemek Stekiel80a88492023-02-20 13:32:22 +01007698 } else
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007699#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiel80a88492023-02-20 13:32:22 +01007700 {
7701 status = PSA_ERROR_NOT_SUPPORTED;
7702 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01007703 }
7704
Przemek Stekiel1c3cfb42023-01-26 10:35:02 +01007705 operation->stage = PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS;
7706
Przemek Stekiel51eac532022-12-07 11:04:51 +01007707 return PSA_SUCCESS;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007708exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007709 psa_pake_abort(operation);
7710 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02007711}
7712
7713psa_status_t psa_pake_set_password_key(
7714 psa_pake_operation_t *operation,
7715 mbedtls_svc_key_id_t password)
7716{
Neil Armstrong5ae60962022-09-15 11:29:46 +02007717 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel6c764412022-11-22 14:05:12 +01007718 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
7719 psa_key_slot_t *slot = NULL;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01007720 psa_key_type_t type;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007721
Przemek Stekiel51eac532022-12-07 11:04:51 +01007722 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007723 status = PSA_ERROR_BAD_STATE;
7724 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007725 }
7726
Przemek Stekiel6c764412022-11-22 14:05:12 +01007727 status = psa_get_and_lock_key_slot_with_policy(password, &slot,
7728 PSA_KEY_USAGE_DERIVE,
Przemek Stekield5d28a22023-01-26 10:46:05 +01007729 operation->alg);
Neil Armstrong5ae60962022-09-15 11:29:46 +02007730 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007731 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007732 }
7733
Gilles Peskine7a5d9202024-02-28 01:18:23 +01007734 type = psa_get_key_type(&slot->attr);
Neil Armstrong5ae60962022-09-15 11:29:46 +02007735
Przemek Stekiel51eac532022-12-07 11:04:51 +01007736 if (type != PSA_KEY_TYPE_PASSWORD &&
7737 type != PSA_KEY_TYPE_PASSWORD_HASH) {
7738 status = PSA_ERROR_INVALID_ARGUMENT;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007739 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007740 }
7741
Przemek Stekiel51eac532022-12-07 11:04:51 +01007742 operation->data.inputs.password = mbedtls_calloc(1, slot->key.bytes);
7743 if (operation->data.inputs.password == NULL) {
Przemek Stekiele12ed362022-12-21 12:54:46 +01007744 status = PSA_ERROR_INSUFFICIENT_MEMORY;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007745 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007746 }
7747
7748 memcpy(operation->data.inputs.password, slot->key.data, slot->key.bytes);
7749 operation->data.inputs.password_len = slot->key.bytes;
Gilles Peskine7fad3ef2024-02-28 01:08:27 +01007750 operation->data.inputs.attributes = slot->attr;
7751
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007752exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007753 if (status != PSA_SUCCESS) {
7754 psa_pake_abort(operation);
7755 }
Ryan Everettbbedfce2024-02-14 18:22:09 +00007756 unlock_status = psa_unregister_read_under_mutex(slot);
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007757 return (status == PSA_SUCCESS) ? unlock_status : status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02007758}
7759
7760psa_status_t psa_pake_set_user(
7761 psa_pake_operation_t *operation,
7762 const uint8_t *user_id,
7763 size_t user_id_len)
7764{
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007765 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007766
7767 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007768 status = PSA_ERROR_BAD_STATE;
7769 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007770 }
7771
Przemek Stekiel51eac532022-12-07 11:04:51 +01007772 if (user_id_len == 0) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007773 status = PSA_ERROR_INVALID_ARGUMENT;
7774 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007775 }
7776
Przemek Stekielf309d6b2023-03-10 09:54:45 +01007777 if (operation->data.inputs.user_len != 0) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007778 status = PSA_ERROR_BAD_STATE;
7779 goto exit;
7780 }
7781
Przemek Stekielf309d6b2023-03-10 09:54:45 +01007782 operation->data.inputs.user = mbedtls_calloc(1, user_id_len);
7783 if (operation->data.inputs.user == NULL) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007784 status = PSA_ERROR_INSUFFICIENT_MEMORY;
7785 goto exit;
7786 }
7787
Przemek Stekielf309d6b2023-03-10 09:54:45 +01007788 memcpy(operation->data.inputs.user, user_id, user_id_len);
7789 operation->data.inputs.user_len = user_id_len;
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007790
7791 return PSA_SUCCESS;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007792exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007793 psa_pake_abort(operation);
7794 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02007795}
7796
7797psa_status_t psa_pake_set_peer(
7798 psa_pake_operation_t *operation,
7799 const uint8_t *peer_id,
7800 size_t peer_id_len)
7801{
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007802 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007803
7804 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007805 status = PSA_ERROR_BAD_STATE;
7806 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007807 }
7808
Przemek Stekiel51eac532022-12-07 11:04:51 +01007809 if (peer_id_len == 0) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007810 status = PSA_ERROR_INVALID_ARGUMENT;
7811 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007812 }
7813
Przemek Stekielf309d6b2023-03-10 09:54:45 +01007814 if (operation->data.inputs.peer_len != 0) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007815 status = PSA_ERROR_BAD_STATE;
7816 goto exit;
7817 }
7818
Przemek Stekielf309d6b2023-03-10 09:54:45 +01007819 operation->data.inputs.peer = mbedtls_calloc(1, peer_id_len);
7820 if (operation->data.inputs.peer == NULL) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007821 status = PSA_ERROR_INSUFFICIENT_MEMORY;
7822 goto exit;
7823 }
7824
Przemek Stekielf309d6b2023-03-10 09:54:45 +01007825 memcpy(operation->data.inputs.peer, peer_id, peer_id_len);
7826 operation->data.inputs.peer_len = peer_id_len;
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007827
7828 return PSA_SUCCESS;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007829exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007830 psa_pake_abort(operation);
7831 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02007832}
7833
7834psa_status_t psa_pake_set_role(
7835 psa_pake_operation_t *operation,
7836 psa_pake_role_t role)
7837{
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007838 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007839
Przemek Stekiel51eac532022-12-07 11:04:51 +01007840 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007841 status = PSA_ERROR_BAD_STATE;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007842 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007843 }
7844
Przemek Stekiel09104b82023-03-06 14:11:51 +01007845 switch (operation->alg) {
7846#if defined(PSA_WANT_ALG_JPAKE)
7847 case PSA_ALG_JPAKE:
7848 if (role == PSA_PAKE_ROLE_NONE) {
7849 return PSA_SUCCESS;
7850 }
7851 status = PSA_ERROR_INVALID_ARGUMENT;
7852 break;
7853#endif
7854 default:
7855 (void) role;
7856 status = PSA_ERROR_NOT_SUPPORTED;
7857 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007858 }
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007859exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007860 psa_pake_abort(operation);
7861 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02007862}
7863
David Horstmanne7f21e62023-05-12 18:17:21 +01007864/* Auxiliary function to convert core computation stage to single driver step. */
Przemek Stekiel4aa99402023-02-27 13:00:57 +01007865#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiel251e86a2023-02-17 14:30:50 +01007866static psa_crypto_driver_pake_step_t convert_jpake_computation_stage_to_driver_step(
Przemek Stekieldde6a912023-01-26 08:46:37 +01007867 psa_jpake_computation_stage_t *stage)
Przemek Stekielb09c4872023-01-17 12:05:38 +01007868{
David Horstmann74a3d8c2023-06-14 18:28:19 +01007869 psa_crypto_driver_pake_step_t key_share_step;
David Horstmann5da95602023-06-08 15:37:12 +01007870 if (stage->round == PSA_JPAKE_FIRST) {
David Horstmanne7f21e62023-05-12 18:17:21 +01007871 int is_x1;
David Horstmann74a3d8c2023-06-14 18:28:19 +01007872
David Horstmann024e5c52023-06-14 15:48:21 +01007873 if (stage->io_mode == PSA_JPAKE_OUTPUT) {
David Horstmanne7f21e62023-05-12 18:17:21 +01007874 is_x1 = (stage->outputs < 1);
7875 } else {
7876 is_x1 = (stage->inputs < 1);
7877 }
7878
David Horstmann74a3d8c2023-06-14 18:28:19 +01007879 key_share_step = is_x1 ?
7880 PSA_JPAKE_X1_STEP_KEY_SHARE :
7881 PSA_JPAKE_X2_STEP_KEY_SHARE;
David Horstmann5da95602023-06-08 15:37:12 +01007882 } else if (stage->round == PSA_JPAKE_SECOND) {
David Horstmann74a3d8c2023-06-14 18:28:19 +01007883 key_share_step = (stage->io_mode == PSA_JPAKE_OUTPUT) ?
7884 PSA_JPAKE_X2S_STEP_KEY_SHARE :
7885 PSA_JPAKE_X4S_STEP_KEY_SHARE;
7886 } else {
7887 return PSA_JPAKE_STEP_INVALID;
Przemek Stekielb09c4872023-01-17 12:05:38 +01007888 }
Agathiyan Bragadeesh387bfa52023-07-17 17:01:33 +01007889 return (psa_crypto_driver_pake_step_t) (key_share_step + stage->step - PSA_PAKE_STEP_KEY_SHARE);
Przemek Stekielb09c4872023-01-17 12:05:38 +01007890}
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007891#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekielb09c4872023-01-17 12:05:38 +01007892
Przemek Stekiel2797d372022-12-22 11:19:22 +01007893static psa_status_t psa_pake_complete_inputs(
7894 psa_pake_operation_t *operation)
7895{
Przemek Stekiel2797d372022-12-22 11:19:22 +01007896 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel18620a32023-01-17 16:34:52 +01007897 /* Create copy of the inputs on stack as inputs share memory
7898 with the driver context which will be setup by the driver. */
7899 psa_crypto_driver_pake_inputs_t inputs = operation->data.inputs;
Przemek Stekiel2797d372022-12-22 11:19:22 +01007900
Przemek Stekielfde11282023-03-13 16:06:09 +01007901 if (inputs.password_len == 0) {
Przemek Stekiel2797d372022-12-22 11:19:22 +01007902 return PSA_ERROR_BAD_STATE;
7903 }
7904
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007905 if (operation->alg == PSA_ALG_JPAKE) {
Przemek Stekielfde11282023-03-13 16:06:09 +01007906 if (inputs.user_len == 0 || inputs.peer_len == 0) {
7907 return PSA_ERROR_BAD_STATE;
7908 }
Przemek Stekieldff21d32023-02-14 20:09:10 +01007909 }
7910
Przemek Stekiel18620a32023-01-17 16:34:52 +01007911 /* Clear driver context */
7912 mbedtls_platform_zeroize(&operation->data, sizeof(operation->data));
7913
7914 status = psa_driver_wrapper_pake_setup(operation, &inputs);
Przemek Stekiel2797d372022-12-22 11:19:22 +01007915
7916 /* Driver is responsible for creating its own copy of the password. */
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01007917 mbedtls_zeroize_and_free(inputs.password, inputs.password_len);
Przemek Stekiel2797d372022-12-22 11:19:22 +01007918
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007919 /* User and peer are translated to role. */
7920 mbedtls_free(inputs.user);
7921 mbedtls_free(inputs.peer);
7922
Przemek Stekiel2797d372022-12-22 11:19:22 +01007923 if (status == PSA_SUCCESS) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01007924#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiel2797d372022-12-22 11:19:22 +01007925 if (operation->alg == PSA_ALG_JPAKE) {
Przemek Stekield93de322023-02-24 08:39:04 +01007926 operation->stage = PSA_PAKE_OPERATION_STAGE_COMPUTATION;
Przemek Stekiel80a88492023-02-20 13:32:22 +01007927 } else
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007928#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiel80a88492023-02-20 13:32:22 +01007929 {
7930 status = PSA_ERROR_NOT_SUPPORTED;
Przemek Stekiel2797d372022-12-22 11:19:22 +01007931 }
Przemek Stekiel2797d372022-12-22 11:19:22 +01007932 }
Przemek Stekiel2797d372022-12-22 11:19:22 +01007933 return status;
7934}
7935
Przemek Stekiel4aa99402023-02-27 13:00:57 +01007936#if defined(PSA_WANT_ALG_JPAKE)
David Horstmanne7f21e62023-05-12 18:17:21 +01007937static psa_status_t psa_jpake_prologue(
Przemek Stekiele12ed362022-12-21 12:54:46 +01007938 psa_pake_operation_t *operation,
David Horstmanne7f21e62023-05-12 18:17:21 +01007939 psa_pake_step_t step,
David Horstmann00ad6bf2023-06-14 15:44:24 +01007940 psa_jpake_io_mode_t io_mode)
Przemek Stekiele12ed362022-12-21 12:54:46 +01007941{
Przemek Stekiele12ed362022-12-21 12:54:46 +01007942 if (step != PSA_PAKE_STEP_KEY_SHARE &&
7943 step != PSA_PAKE_STEP_ZK_PUBLIC &&
7944 step != PSA_PAKE_STEP_ZK_PROOF) {
7945 return PSA_ERROR_INVALID_ARGUMENT;
7946 }
7947
Przemek Stekiel5eff1032023-02-21 19:10:36 +01007948 psa_jpake_computation_stage_t *computation_stage =
7949 &operation->computation_stage.jpake;
Przemek Stekiele12ed362022-12-21 12:54:46 +01007950
David Horstmann5da95602023-06-08 15:37:12 +01007951 if (computation_stage->round != PSA_JPAKE_FIRST &&
7952 computation_stage->round != PSA_JPAKE_SECOND) {
Przemek Stekiel5eff1032023-02-21 19:10:36 +01007953 return PSA_ERROR_BAD_STATE;
7954 }
7955
David Horstmanne7f21e62023-05-12 18:17:21 +01007956 /* Check that the step we are given is the one we were expecting */
7957 if (step != computation_stage->step) {
Przemek Stekiel5eff1032023-02-21 19:10:36 +01007958 return PSA_ERROR_BAD_STATE;
7959 }
7960
David Horstmanne7f21e62023-05-12 18:17:21 +01007961 if (step == PSA_PAKE_STEP_KEY_SHARE &&
7962 computation_stage->inputs == 0 &&
7963 computation_stage->outputs == 0) {
7964 /* Start of the round, so function decides whether we are inputting
7965 * or outputting */
David Horstmann024e5c52023-06-14 15:48:21 +01007966 computation_stage->io_mode = io_mode;
7967 } else if (computation_stage->io_mode != io_mode) {
David Horstmanne7f21e62023-05-12 18:17:21 +01007968 /* Middle of the round so the mode we are in must match the function
7969 * called by the user */
7970 return PSA_ERROR_BAD_STATE;
Przemek Stekiele12ed362022-12-21 12:54:46 +01007971 }
7972
7973 return PSA_SUCCESS;
7974}
7975
David Horstmanne7f21e62023-05-12 18:17:21 +01007976static psa_status_t psa_jpake_epilogue(
7977 psa_pake_operation_t *operation,
David Horstmann00ad6bf2023-06-14 15:44:24 +01007978 psa_jpake_io_mode_t io_mode)
Przemek Stekiele12ed362022-12-21 12:54:46 +01007979{
David Horstmanne7f21e62023-05-12 18:17:21 +01007980 psa_jpake_computation_stage_t *stage =
Przemek Stekiel5eff1032023-02-21 19:10:36 +01007981 &operation->computation_stage.jpake;
Przemek Stekiele12ed362022-12-21 12:54:46 +01007982
David Horstmanne7f21e62023-05-12 18:17:21 +01007983 if (stage->step == PSA_PAKE_STEP_ZK_PROOF) {
7984 /* End of an input/output */
David Horstmann00ad6bf2023-06-14 15:44:24 +01007985 if (io_mode == PSA_JPAKE_INPUT) {
David Horstmanne7f21e62023-05-12 18:17:21 +01007986 stage->inputs++;
David Horstmann246ec5a2023-06-27 10:33:06 +01007987 if (stage->inputs == PSA_JPAKE_EXPECTED_INPUTS(stage->round)) {
David Horstmann024e5c52023-06-14 15:48:21 +01007988 stage->io_mode = PSA_JPAKE_OUTPUT;
David Horstmanne7f21e62023-05-12 18:17:21 +01007989 }
7990 }
David Horstmann00ad6bf2023-06-14 15:44:24 +01007991 if (io_mode == PSA_JPAKE_OUTPUT) {
David Horstmanne7f21e62023-05-12 18:17:21 +01007992 stage->outputs++;
David Horstmann246ec5a2023-06-27 10:33:06 +01007993 if (stage->outputs == PSA_JPAKE_EXPECTED_OUTPUTS(stage->round)) {
David Horstmann024e5c52023-06-14 15:48:21 +01007994 stage->io_mode = PSA_JPAKE_INPUT;
David Horstmanne7f21e62023-05-12 18:17:21 +01007995 }
7996 }
David Horstmann246ec5a2023-06-27 10:33:06 +01007997 if (stage->inputs == PSA_JPAKE_EXPECTED_INPUTS(stage->round) &&
7998 stage->outputs == PSA_JPAKE_EXPECTED_OUTPUTS(stage->round)) {
David Horstmanne7f21e62023-05-12 18:17:21 +01007999 /* End of a round, move to the next round */
8000 stage->inputs = 0;
8001 stage->outputs = 0;
8002 stage->round++;
8003 }
8004 stage->step = PSA_PAKE_STEP_KEY_SHARE;
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008005 } else {
David Horstmanne7f21e62023-05-12 18:17:21 +01008006 stage->step++;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008007 }
Przemek Stekiele12ed362022-12-21 12:54:46 +01008008 return PSA_SUCCESS;
8009}
David Horstmanne7f21e62023-05-12 18:17:21 +01008010
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008011#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008012
Neil Armstronga7d08c32022-06-01 18:21:20 +02008013psa_status_t psa_pake_output(
8014 psa_pake_operation_t *operation,
8015 psa_pake_step_t step,
8016 uint8_t *output,
8017 size_t output_size,
8018 size_t *output_length)
8019{
Przemek Stekiel51eac532022-12-07 11:04:51 +01008020 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008021 psa_crypto_driver_pake_step_t driver_step = PSA_JPAKE_STEP_INVALID;
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01008022 *output_length = 0;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008023
8024 if (operation->stage == PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel2797d372022-12-22 11:19:22 +01008025 status = psa_pake_complete_inputs(operation);
8026 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008027 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008028 }
8029 }
8030
8031 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COMPUTATION) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008032 status = PSA_ERROR_BAD_STATE;
8033 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008034 }
8035
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01008036 if (output_size == 0) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008037 status = PSA_ERROR_INVALID_ARGUMENT;
8038 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008039 }
8040
Przemek Stekiele12ed362022-12-21 12:54:46 +01008041 switch (operation->alg) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008042#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008043 case PSA_ALG_JPAKE:
David Horstmann5da95602023-06-08 15:37:12 +01008044 status = psa_jpake_prologue(operation, step, PSA_JPAKE_OUTPUT);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008045 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008046 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008047 }
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008048 driver_step = convert_jpake_computation_stage_to_driver_step(
8049 &operation->computation_stage.jpake);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008050 break;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008051#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008052 default:
Przemek Stekiel80a88492023-02-20 13:32:22 +01008053 (void) step;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008054 status = PSA_ERROR_NOT_SUPPORTED;
8055 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008056 }
8057
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008058 status = psa_driver_wrapper_pake_output(operation, driver_step,
8059 output, output_size, output_length);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008060
8061 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008062 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008063 }
8064
8065 switch (operation->alg) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008066#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008067 case PSA_ALG_JPAKE:
David Horstmann5da95602023-06-08 15:37:12 +01008068 status = psa_jpake_epilogue(operation, PSA_JPAKE_OUTPUT);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008069 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008070 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008071 }
8072 break;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008073#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008074 default:
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008075 status = PSA_ERROR_NOT_SUPPORTED;
8076 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008077 }
8078
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008079 return PSA_SUCCESS;
8080exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008081 psa_pake_abort(operation);
8082 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008083}
8084
8085psa_status_t psa_pake_input(
8086 psa_pake_operation_t *operation,
8087 psa_pake_step_t step,
8088 const uint8_t *input,
8089 size_t input_length)
8090{
Przemek Stekiel51eac532022-12-07 11:04:51 +01008091 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008092 psa_crypto_driver_pake_step_t driver_step = PSA_JPAKE_STEP_INVALID;
Przemek Stekiel256c75d2023-03-23 14:09:34 +01008093 const size_t max_input_length = (size_t) PSA_PAKE_INPUT_SIZE(operation->alg,
8094 operation->primitive,
8095 step);
Przemek Stekiel51eac532022-12-07 11:04:51 +01008096
8097 if (operation->stage == PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel2797d372022-12-22 11:19:22 +01008098 status = psa_pake_complete_inputs(operation);
8099 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008100 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008101 }
8102 }
8103
8104 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COMPUTATION) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008105 status = PSA_ERROR_BAD_STATE;
8106 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008107 }
8108
Przemek Stekiel256c75d2023-03-23 14:09:34 +01008109 if (input_length == 0 || input_length > max_input_length) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008110 status = PSA_ERROR_INVALID_ARGUMENT;
8111 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008112 }
8113
Przemek Stekiele12ed362022-12-21 12:54:46 +01008114 switch (operation->alg) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008115#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008116 case PSA_ALG_JPAKE:
David Horstmann5da95602023-06-08 15:37:12 +01008117 status = psa_jpake_prologue(operation, step, PSA_JPAKE_INPUT);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008118 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008119 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008120 }
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008121 driver_step = convert_jpake_computation_stage_to_driver_step(
8122 &operation->computation_stage.jpake);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008123 break;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008124#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008125 default:
Przemek Stekiel80a88492023-02-20 13:32:22 +01008126 (void) step;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008127 status = PSA_ERROR_NOT_SUPPORTED;
8128 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008129 }
8130
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008131 status = psa_driver_wrapper_pake_input(operation, driver_step,
8132 input, input_length);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008133
8134 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008135 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008136 }
8137
8138 switch (operation->alg) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008139#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008140 case PSA_ALG_JPAKE:
David Horstmann5da95602023-06-08 15:37:12 +01008141 status = psa_jpake_epilogue(operation, PSA_JPAKE_INPUT);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008142 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008143 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008144 }
8145 break;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008146#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008147 default:
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008148 status = PSA_ERROR_NOT_SUPPORTED;
8149 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008150 }
8151
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008152 return PSA_SUCCESS;
8153exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008154 psa_pake_abort(operation);
8155 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008156}
8157
8158psa_status_t psa_pake_get_implicit_key(
8159 psa_pake_operation_t *operation,
8160 psa_key_derivation_operation_t *output)
8161{
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01008162 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008163 psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel251e86a2023-02-17 14:30:50 +01008164 uint8_t shared_key[MBEDTLS_PSA_JPAKE_BUFFER_SIZE];
Przemek Stekiel0c781802022-11-29 14:53:13 +01008165 size_t shared_key_len = 0;
8166
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01008167 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COMPUTATION) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008168 status = PSA_ERROR_BAD_STATE;
8169 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008170 }
8171
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008172#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008173 if (operation->alg == PSA_ALG_JPAKE) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008174 psa_jpake_computation_stage_t *computation_stage =
Przemek Stekiel083745e2023-02-23 17:28:23 +01008175 &operation->computation_stage.jpake;
David Horstmann5da95602023-06-08 15:37:12 +01008176 if (computation_stage->round != PSA_JPAKE_FINISHED) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008177 status = PSA_ERROR_BAD_STATE;
8178 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008179 }
Przemek Stekiel80a88492023-02-20 13:32:22 +01008180 } else
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008181#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiel80a88492023-02-20 13:32:22 +01008182 {
8183 status = PSA_ERROR_NOT_SUPPORTED;
8184 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008185 }
8186
Przemek Stekiel0c781802022-11-29 14:53:13 +01008187 status = psa_driver_wrapper_pake_get_implicit_key(operation,
8188 shared_key,
Przemek Stekiel6b648622023-02-19 22:55:33 +01008189 sizeof(shared_key),
Przemek Stekiel0c781802022-11-29 14:53:13 +01008190 &shared_key_len);
8191
8192 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008193 goto exit;
Przemek Stekiel0c781802022-11-29 14:53:13 +01008194 }
8195
8196 status = psa_key_derivation_input_bytes(output,
8197 PSA_KEY_DERIVATION_INPUT_SECRET,
8198 shared_key,
8199 shared_key_len);
8200
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008201 mbedtls_platform_zeroize(shared_key, sizeof(shared_key));
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008202exit:
8203 abort_status = psa_pake_abort(operation);
8204 return status == PSA_SUCCESS ? abort_status : status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008205}
8206
8207psa_status_t psa_pake_abort(
8208 psa_pake_operation_t *operation)
8209{
Przemek Stekield69dca92023-01-31 19:59:20 +01008210 psa_status_t status = PSA_SUCCESS;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008211
Przemek Stekield69dca92023-01-31 19:59:20 +01008212 if (operation->stage == PSA_PAKE_OPERATION_STAGE_COMPUTATION) {
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01008213 status = psa_driver_wrapper_pake_abort(operation);
Neil Armstrong5ae60962022-09-15 11:29:46 +02008214 }
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01008215
Przemek Stekiel26c909d2023-02-28 12:34:03 +01008216 if (operation->stage == PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
8217 if (operation->data.inputs.password != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01008218 mbedtls_zeroize_and_free(operation->data.inputs.password,
Przemek Stekielaa183422023-03-06 14:21:44 +01008219 operation->data.inputs.password_len);
Przemek Stekiel26c909d2023-02-28 12:34:03 +01008220 }
8221 if (operation->data.inputs.user != NULL) {
8222 mbedtls_free(operation->data.inputs.user);
8223 }
8224 if (operation->data.inputs.peer != NULL) {
8225 mbedtls_free(operation->data.inputs.peer);
8226 }
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01008227 }
Przemek Stekield69dca92023-01-31 19:59:20 +01008228 memset(operation, 0, sizeof(psa_pake_operation_t));
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01008229
Przemek Stekield69dca92023-01-31 19:59:20 +01008230 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008231}
Tom Cosgrove6d62fac2023-05-10 14:40:05 +01008232#endif /* PSA_WANT_ALG_SOME_PAKE */
Neil Armstronga7d08c32022-06-01 18:21:20 +02008233
Gilles Peskinee59236f2018-01-27 23:32:46 +01008234#endif /* MBEDTLS_PSA_CRYPTO_C */