blob: 82e25499c42215ab666d8e6838e94737d1f1bc0f [file] [log] [blame]
Gilles Peskinee59236f2018-01-27 23:32:46 +01001/*
2 * PSA crypto layer on top of Mbed TLS crypto
3 */
Bence Szépkúti86974652020-06-15 11:59:37 +02004/*
Bence Szépkúti1e148272020-08-07 13:07:28 +02005 * Copyright The Mbed TLS Contributors
Gilles Peskinee59236f2018-01-27 23:32:46 +01006 * SPDX-License-Identifier: Apache-2.0
7 *
8 * Licensed under the Apache License, Version 2.0 (the "License"); you may
9 * not use this file except in compliance with the License.
10 * You may obtain a copy of the License at
11 *
12 * http://www.apache.org/licenses/LICENSE-2.0
13 *
14 * Unless required by applicable law or agreed to in writing, software
15 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
16 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17 * See the License for the specific language governing permissions and
18 * limitations under the License.
Gilles Peskinee59236f2018-01-27 23:32:46 +010019 */
20
Gilles Peskinedb09ef62020-06-03 01:43:33 +020021#include "common.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010022
23#if defined(MBEDTLS_PSA_CRYPTO_C)
mohammad160327010052018-07-03 13:16:15 +030024
itayzafrir7723ab12019-02-14 10:28:02 +020025#include "psa_crypto_service_integration.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010026#include "psa/crypto.h"
27
Gilles Peskine039b90c2018-12-07 18:24:41 +010028#include "psa_crypto_core.h"
Gilles Peskine5e769522018-11-20 21:59:56 +010029#include "psa_crypto_invasive.h"
Steven Cooremancd84cb42020-07-16 20:28:36 +020030#include "psa_crypto_driver_wrappers.h"
Gilles Peskinea8ade162019-06-26 11:24:49 +020031#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined0890212019-06-24 14:34:43 +020032#include "psa_crypto_se.h"
Gilles Peskinea8ade162019-06-26 11:24:49 +020033#endif
Gilles Peskine961849f2018-11-30 18:54:54 +010034#include "psa_crypto_slot_management.h"
Darryl Greend49a4992018-06-18 17:27:26 +010035/* Include internal declarations that are useful for implementing persistently
36 * stored keys. */
37#include "psa_crypto_storage.h"
38
Gilles Peskineb46bef22019-07-30 21:32:04 +020039#include <assert.h>
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010040#include <stdlib.h>
41#include <string.h>
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010042#include "mbedtls/platform.h"
Gilles Peskineff2d2002019-05-06 15:26:23 +020043#if !defined(MBEDTLS_PLATFORM_C)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010044#define mbedtls_calloc calloc
45#define mbedtls_free free
46#endif
47
Gilles Peskinea5905292018-02-07 20:59:33 +010048#include "mbedtls/arc4.h"
Gilles Peskine9a944802018-06-21 09:35:35 +020049#include "mbedtls/asn1.h"
Jaeden Amero25384a22019-01-10 10:23:21 +000050#include "mbedtls/asn1write.h"
Gilles Peskinea81d85b2018-06-26 16:10:23 +020051#include "mbedtls/bignum.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010052#include "mbedtls/blowfish.h"
53#include "mbedtls/camellia.h"
Gilles Peskine26869f22019-05-06 15:25:00 +020054#include "mbedtls/chacha20.h"
55#include "mbedtls/chachapoly.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010056#include "mbedtls/cipher.h"
57#include "mbedtls/ccm.h"
58#include "mbedtls/cmac.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010059#include "mbedtls/ctr_drbg.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010060#include "mbedtls/des.h"
Gilles Peskineb7ecdf02018-09-18 12:11:27 +020061#include "mbedtls/ecdh.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010062#include "mbedtls/ecp.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010063#include "mbedtls/entropy.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010064#include "mbedtls/error.h"
65#include "mbedtls/gcm.h"
66#include "mbedtls/md2.h"
67#include "mbedtls/md4.h"
68#include "mbedtls/md5.h"
Gilles Peskine20035e32018-02-03 22:44:14 +010069#include "mbedtls/md.h"
70#include "mbedtls/md_internal.h"
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010071#include "mbedtls/pk.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010072#include "mbedtls/pk_internal.h"
Gilles Peskine3f108122018-12-07 18:14:53 +010073#include "mbedtls/platform_util.h"
Janos Follath24eed8d2019-11-22 13:21:35 +000074#include "mbedtls/error.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010075#include "mbedtls/ripemd160.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010076#include "mbedtls/rsa.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010077#include "mbedtls/sha1.h"
78#include "mbedtls/sha256.h"
79#include "mbedtls/sha512.h"
80#include "mbedtls/xtea.h"
81
Gilles Peskine996deb12018-08-01 15:45:45 +020082#define ARRAY_LENGTH( array ) ( sizeof( array ) / sizeof( *( array ) ) )
83
Gilles Peskine9ef733f2018-02-07 21:05:37 +010084/* constant-time buffer comparison */
85static inline int safer_memcmp( const uint8_t *a, const uint8_t *b, size_t n )
86{
87 size_t i;
88 unsigned char diff = 0;
89
90 for( i = 0; i < n; i++ )
91 diff |= a[i] ^ b[i];
92
93 return( diff );
94}
95
96
97
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010098/****************************************************************/
99/* Global data, support functions and library management */
100/****************************************************************/
101
Gilles Peskine48c0ea12018-06-21 14:15:31 +0200102static int key_type_is_raw_bytes( psa_key_type_t type )
103{
Gilles Peskine78b3bb62018-08-10 16:03:41 +0200104 return( PSA_KEY_TYPE_IS_UNSTRUCTURED( type ) );
Gilles Peskine48c0ea12018-06-21 14:15:31 +0200105}
106
Gilles Peskine5a3c50e2018-12-04 12:27:09 +0100107/* Values for psa_global_data_t::rng_state */
108#define RNG_NOT_INITIALIZED 0
109#define RNG_INITIALIZED 1
110#define RNG_SEEDED 2
Gilles Peskinec6b69072018-11-20 21:42:52 +0100111
Gilles Peskine2d277862018-06-18 15:41:12 +0200112typedef struct
113{
Gilles Peskine5e769522018-11-20 21:59:56 +0100114 void (* entropy_init )( mbedtls_entropy_context *ctx );
115 void (* entropy_free )( mbedtls_entropy_context *ctx );
Gilles Peskinee59236f2018-01-27 23:32:46 +0100116 mbedtls_entropy_context entropy;
117 mbedtls_ctr_drbg_context ctr_drbg;
Gilles Peskinec6b69072018-11-20 21:42:52 +0100118 unsigned initialized : 1;
Gilles Peskine5a3c50e2018-12-04 12:27:09 +0100119 unsigned rng_state : 2;
Gilles Peskinee59236f2018-01-27 23:32:46 +0100120} psa_global_data_t;
121
122static psa_global_data_t global_data;
123
itayzafrir0adf0fc2018-09-06 16:24:41 +0300124#define GUARD_MODULE_INITIALIZED \
125 if( global_data.initialized == 0 ) \
126 return( PSA_ERROR_BAD_STATE );
127
Steven Cooreman01164162020-07-20 15:31:37 +0200128psa_status_t mbedtls_to_psa_error( int ret )
Gilles Peskinee59236f2018-01-27 23:32:46 +0100129{
Gilles Peskinea5905292018-02-07 20:59:33 +0100130 /* If there's both a high-level code and low-level code, dispatch on
131 * the high-level code. */
132 switch( ret < -0x7f ? - ( -ret & 0x7f80 ) : ret )
Gilles Peskinee59236f2018-01-27 23:32:46 +0100133 {
134 case 0:
135 return( PSA_SUCCESS );
Gilles Peskinea5905292018-02-07 20:59:33 +0100136
137 case MBEDTLS_ERR_AES_INVALID_KEY_LENGTH:
138 case MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH:
139 case MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE:
140 return( PSA_ERROR_NOT_SUPPORTED );
141 case MBEDTLS_ERR_AES_HW_ACCEL_FAILED:
142 return( PSA_ERROR_HARDWARE_FAILURE );
143
144 case MBEDTLS_ERR_ARC4_HW_ACCEL_FAILED:
145 return( PSA_ERROR_HARDWARE_FAILURE );
146
Gilles Peskine9a944802018-06-21 09:35:35 +0200147 case MBEDTLS_ERR_ASN1_OUT_OF_DATA:
148 case MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:
149 case MBEDTLS_ERR_ASN1_INVALID_LENGTH:
150 case MBEDTLS_ERR_ASN1_LENGTH_MISMATCH:
151 case MBEDTLS_ERR_ASN1_INVALID_DATA:
152 return( PSA_ERROR_INVALID_ARGUMENT );
153 case MBEDTLS_ERR_ASN1_ALLOC_FAILED:
154 return( PSA_ERROR_INSUFFICIENT_MEMORY );
155 case MBEDTLS_ERR_ASN1_BUF_TOO_SMALL:
156 return( PSA_ERROR_BUFFER_TOO_SMALL );
157
Jaeden Amero93e21112019-02-20 13:57:28 +0000158#if defined(MBEDTLS_ERR_BLOWFISH_BAD_INPUT_DATA)
Jaeden Amero892cd6d2019-02-11 12:21:12 +0000159 case MBEDTLS_ERR_BLOWFISH_BAD_INPUT_DATA:
Jaeden Amero93e21112019-02-20 13:57:28 +0000160#elif defined(MBEDTLS_ERR_BLOWFISH_INVALID_KEY_LENGTH)
161 case MBEDTLS_ERR_BLOWFISH_INVALID_KEY_LENGTH:
162#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100163 case MBEDTLS_ERR_BLOWFISH_INVALID_INPUT_LENGTH:
164 return( PSA_ERROR_NOT_SUPPORTED );
165 case MBEDTLS_ERR_BLOWFISH_HW_ACCEL_FAILED:
166 return( PSA_ERROR_HARDWARE_FAILURE );
167
Jaeden Amero93e21112019-02-20 13:57:28 +0000168#if defined(MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA)
Jaeden Amero892cd6d2019-02-11 12:21:12 +0000169 case MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA:
Jaeden Amero93e21112019-02-20 13:57:28 +0000170#elif defined(MBEDTLS_ERR_CAMELLIA_INVALID_KEY_LENGTH)
171 case MBEDTLS_ERR_CAMELLIA_INVALID_KEY_LENGTH:
172#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100173 case MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH:
174 return( PSA_ERROR_NOT_SUPPORTED );
175 case MBEDTLS_ERR_CAMELLIA_HW_ACCEL_FAILED:
176 return( PSA_ERROR_HARDWARE_FAILURE );
177
178 case MBEDTLS_ERR_CCM_BAD_INPUT:
179 return( PSA_ERROR_INVALID_ARGUMENT );
180 case MBEDTLS_ERR_CCM_AUTH_FAILED:
181 return( PSA_ERROR_INVALID_SIGNATURE );
182 case MBEDTLS_ERR_CCM_HW_ACCEL_FAILED:
183 return( PSA_ERROR_HARDWARE_FAILURE );
184
Gilles Peskine26869f22019-05-06 15:25:00 +0200185 case MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA:
186 return( PSA_ERROR_INVALID_ARGUMENT );
187
188 case MBEDTLS_ERR_CHACHAPOLY_BAD_STATE:
189 return( PSA_ERROR_BAD_STATE );
190 case MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED:
191 return( PSA_ERROR_INVALID_SIGNATURE );
192
Gilles Peskinea5905292018-02-07 20:59:33 +0100193 case MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE:
194 return( PSA_ERROR_NOT_SUPPORTED );
195 case MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA:
196 return( PSA_ERROR_INVALID_ARGUMENT );
197 case MBEDTLS_ERR_CIPHER_ALLOC_FAILED:
198 return( PSA_ERROR_INSUFFICIENT_MEMORY );
199 case MBEDTLS_ERR_CIPHER_INVALID_PADDING:
200 return( PSA_ERROR_INVALID_PADDING );
201 case MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED:
Fredrik Strupef90e3012020-09-28 16:11:33 +0200202 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskinea5905292018-02-07 20:59:33 +0100203 case MBEDTLS_ERR_CIPHER_AUTH_FAILED:
204 return( PSA_ERROR_INVALID_SIGNATURE );
205 case MBEDTLS_ERR_CIPHER_INVALID_CONTEXT:
Gilles Peskine4b3eb692019-05-16 21:35:18 +0200206 return( PSA_ERROR_CORRUPTION_DETECTED );
Gilles Peskinea5905292018-02-07 20:59:33 +0100207 case MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED:
208 return( PSA_ERROR_HARDWARE_FAILURE );
209
210 case MBEDTLS_ERR_CMAC_HW_ACCEL_FAILED:
211 return( PSA_ERROR_HARDWARE_FAILURE );
212
213 case MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED:
214 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
215 case MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG:
216 case MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG:
217 return( PSA_ERROR_NOT_SUPPORTED );
218 case MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR:
219 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
220
221 case MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH:
222 return( PSA_ERROR_NOT_SUPPORTED );
223 case MBEDTLS_ERR_DES_HW_ACCEL_FAILED:
224 return( PSA_ERROR_HARDWARE_FAILURE );
225
Gilles Peskinee59236f2018-01-27 23:32:46 +0100226 case MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED:
227 case MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE:
228 case MBEDTLS_ERR_ENTROPY_SOURCE_FAILED:
229 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
Gilles Peskinea5905292018-02-07 20:59:33 +0100230
231 case MBEDTLS_ERR_GCM_AUTH_FAILED:
232 return( PSA_ERROR_INVALID_SIGNATURE );
233 case MBEDTLS_ERR_GCM_BAD_INPUT:
Gilles Peskine8cac2e62018-08-21 15:07:38 +0200234 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskinea5905292018-02-07 20:59:33 +0100235 case MBEDTLS_ERR_GCM_HW_ACCEL_FAILED:
236 return( PSA_ERROR_HARDWARE_FAILURE );
237
238 case MBEDTLS_ERR_MD2_HW_ACCEL_FAILED:
239 case MBEDTLS_ERR_MD4_HW_ACCEL_FAILED:
240 case MBEDTLS_ERR_MD5_HW_ACCEL_FAILED:
241 return( PSA_ERROR_HARDWARE_FAILURE );
242
243 case MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE:
244 return( PSA_ERROR_NOT_SUPPORTED );
245 case MBEDTLS_ERR_MD_BAD_INPUT_DATA:
246 return( PSA_ERROR_INVALID_ARGUMENT );
247 case MBEDTLS_ERR_MD_ALLOC_FAILED:
248 return( PSA_ERROR_INSUFFICIENT_MEMORY );
249 case MBEDTLS_ERR_MD_FILE_IO_ERROR:
250 return( PSA_ERROR_STORAGE_FAILURE );
251 case MBEDTLS_ERR_MD_HW_ACCEL_FAILED:
252 return( PSA_ERROR_HARDWARE_FAILURE );
253
Gilles Peskinef76aa772018-10-29 19:24:33 +0100254 case MBEDTLS_ERR_MPI_FILE_IO_ERROR:
255 return( PSA_ERROR_STORAGE_FAILURE );
256 case MBEDTLS_ERR_MPI_BAD_INPUT_DATA:
257 return( PSA_ERROR_INVALID_ARGUMENT );
258 case MBEDTLS_ERR_MPI_INVALID_CHARACTER:
259 return( PSA_ERROR_INVALID_ARGUMENT );
260 case MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL:
261 return( PSA_ERROR_BUFFER_TOO_SMALL );
262 case MBEDTLS_ERR_MPI_NEGATIVE_VALUE:
263 return( PSA_ERROR_INVALID_ARGUMENT );
264 case MBEDTLS_ERR_MPI_DIVISION_BY_ZERO:
265 return( PSA_ERROR_INVALID_ARGUMENT );
266 case MBEDTLS_ERR_MPI_NOT_ACCEPTABLE:
267 return( PSA_ERROR_INVALID_ARGUMENT );
268 case MBEDTLS_ERR_MPI_ALLOC_FAILED:
269 return( PSA_ERROR_INSUFFICIENT_MEMORY );
270
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100271 case MBEDTLS_ERR_PK_ALLOC_FAILED:
272 return( PSA_ERROR_INSUFFICIENT_MEMORY );
273 case MBEDTLS_ERR_PK_TYPE_MISMATCH:
274 case MBEDTLS_ERR_PK_BAD_INPUT_DATA:
275 return( PSA_ERROR_INVALID_ARGUMENT );
276 case MBEDTLS_ERR_PK_FILE_IO_ERROR:
Gilles Peskinea5905292018-02-07 20:59:33 +0100277 return( PSA_ERROR_STORAGE_FAILURE );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100278 case MBEDTLS_ERR_PK_KEY_INVALID_VERSION:
279 case MBEDTLS_ERR_PK_KEY_INVALID_FORMAT:
280 return( PSA_ERROR_INVALID_ARGUMENT );
281 case MBEDTLS_ERR_PK_UNKNOWN_PK_ALG:
282 return( PSA_ERROR_NOT_SUPPORTED );
283 case MBEDTLS_ERR_PK_PASSWORD_REQUIRED:
284 case MBEDTLS_ERR_PK_PASSWORD_MISMATCH:
285 return( PSA_ERROR_NOT_PERMITTED );
286 case MBEDTLS_ERR_PK_INVALID_PUBKEY:
287 return( PSA_ERROR_INVALID_ARGUMENT );
288 case MBEDTLS_ERR_PK_INVALID_ALG:
289 case MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE:
290 case MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE:
291 return( PSA_ERROR_NOT_SUPPORTED );
292 case MBEDTLS_ERR_PK_SIG_LEN_MISMATCH:
293 return( PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskinea5905292018-02-07 20:59:33 +0100294 case MBEDTLS_ERR_PK_HW_ACCEL_FAILED:
295 return( PSA_ERROR_HARDWARE_FAILURE );
296
Gilles Peskineff2d2002019-05-06 15:26:23 +0200297 case MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED:
298 return( PSA_ERROR_HARDWARE_FAILURE );
299 case MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
300 return( PSA_ERROR_NOT_SUPPORTED );
301
Gilles Peskinea5905292018-02-07 20:59:33 +0100302 case MBEDTLS_ERR_RIPEMD160_HW_ACCEL_FAILED:
303 return( PSA_ERROR_HARDWARE_FAILURE );
304
305 case MBEDTLS_ERR_RSA_BAD_INPUT_DATA:
306 return( PSA_ERROR_INVALID_ARGUMENT );
307 case MBEDTLS_ERR_RSA_INVALID_PADDING:
308 return( PSA_ERROR_INVALID_PADDING );
309 case MBEDTLS_ERR_RSA_KEY_GEN_FAILED:
310 return( PSA_ERROR_HARDWARE_FAILURE );
311 case MBEDTLS_ERR_RSA_KEY_CHECK_FAILED:
312 return( PSA_ERROR_INVALID_ARGUMENT );
313 case MBEDTLS_ERR_RSA_PUBLIC_FAILED:
314 case MBEDTLS_ERR_RSA_PRIVATE_FAILED:
Gilles Peskine4b3eb692019-05-16 21:35:18 +0200315 return( PSA_ERROR_CORRUPTION_DETECTED );
Gilles Peskinea5905292018-02-07 20:59:33 +0100316 case MBEDTLS_ERR_RSA_VERIFY_FAILED:
317 return( PSA_ERROR_INVALID_SIGNATURE );
318 case MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE:
319 return( PSA_ERROR_BUFFER_TOO_SMALL );
320 case MBEDTLS_ERR_RSA_RNG_FAILED:
321 return( PSA_ERROR_INSUFFICIENT_MEMORY );
322 case MBEDTLS_ERR_RSA_UNSUPPORTED_OPERATION:
323 return( PSA_ERROR_NOT_SUPPORTED );
324 case MBEDTLS_ERR_RSA_HW_ACCEL_FAILED:
325 return( PSA_ERROR_HARDWARE_FAILURE );
326
327 case MBEDTLS_ERR_SHA1_HW_ACCEL_FAILED:
328 case MBEDTLS_ERR_SHA256_HW_ACCEL_FAILED:
329 case MBEDTLS_ERR_SHA512_HW_ACCEL_FAILED:
330 return( PSA_ERROR_HARDWARE_FAILURE );
331
332 case MBEDTLS_ERR_XTEA_INVALID_INPUT_LENGTH:
333 return( PSA_ERROR_INVALID_ARGUMENT );
334 case MBEDTLS_ERR_XTEA_HW_ACCEL_FAILED:
335 return( PSA_ERROR_HARDWARE_FAILURE );
336
itayzafrir5c753392018-05-08 11:18:38 +0300337 case MBEDTLS_ERR_ECP_BAD_INPUT_DATA:
itayzafrir7b30f8b2018-05-09 16:07:36 +0300338 case MBEDTLS_ERR_ECP_INVALID_KEY:
itayzafrir5c753392018-05-08 11:18:38 +0300339 return( PSA_ERROR_INVALID_ARGUMENT );
itayzafrir7b30f8b2018-05-09 16:07:36 +0300340 case MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL:
341 return( PSA_ERROR_BUFFER_TOO_SMALL );
342 case MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE:
343 return( PSA_ERROR_NOT_SUPPORTED );
344 case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH:
345 case MBEDTLS_ERR_ECP_VERIFY_FAILED:
346 return( PSA_ERROR_INVALID_SIGNATURE );
347 case MBEDTLS_ERR_ECP_ALLOC_FAILED:
348 return( PSA_ERROR_INSUFFICIENT_MEMORY );
349 case MBEDTLS_ERR_ECP_HW_ACCEL_FAILED:
350 return( PSA_ERROR_HARDWARE_FAILURE );
Janos Follatha13b9052019-11-22 12:48:59 +0000351 case MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED:
352 return( PSA_ERROR_CORRUPTION_DETECTED );
itayzafrir5c753392018-05-08 11:18:38 +0300353
Gilles Peskinee59236f2018-01-27 23:32:46 +0100354 default:
David Saadab4ecc272019-02-14 13:48:10 +0200355 return( PSA_ERROR_GENERIC_ERROR );
Gilles Peskinee59236f2018-01-27 23:32:46 +0100356 }
357}
358
Gilles Peskineb0b255c2018-07-06 17:01:38 +0200359
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +0200360
361
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100362/****************************************************************/
363/* Key management */
364/****************************************************************/
365
Gilles Peskine73167e12019-07-12 23:44:37 +0200366#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
367static inline int psa_key_slot_is_external( const psa_key_slot_t *slot )
368{
Gilles Peskine8e338702019-07-30 20:06:31 +0200369 return( psa_key_lifetime_is_external( slot->attr.lifetime ) );
Gilles Peskine73167e12019-07-12 23:44:37 +0200370}
371#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
372
Darryl Green8f8aa8f2018-07-24 15:44:51 +0100373#if defined(MBEDTLS_ECP_C)
Paul Elliott8ff510a2020-06-02 17:19:28 +0100374mbedtls_ecp_group_id mbedtls_ecc_group_of_psa( psa_ecc_family_t curve,
Gilles Peskine5055b232019-12-12 17:49:31 +0100375 size_t byte_length )
Gilles Peskine12313cd2018-06-20 00:20:32 +0200376{
377 switch( curve )
378 {
Paul Elliott8ff510a2020-06-02 17:19:28 +0100379 case PSA_ECC_FAMILY_SECP_R1:
Gilles Peskine228abc52019-12-03 17:24:19 +0100380 switch( byte_length )
381 {
382 case PSA_BITS_TO_BYTES( 192 ):
383 return( MBEDTLS_ECP_DP_SECP192R1 );
384 case PSA_BITS_TO_BYTES( 224 ):
385 return( MBEDTLS_ECP_DP_SECP224R1 );
386 case PSA_BITS_TO_BYTES( 256 ):
387 return( MBEDTLS_ECP_DP_SECP256R1 );
388 case PSA_BITS_TO_BYTES( 384 ):
389 return( MBEDTLS_ECP_DP_SECP384R1 );
390 case PSA_BITS_TO_BYTES( 521 ):
391 return( MBEDTLS_ECP_DP_SECP521R1 );
392 default:
393 return( MBEDTLS_ECP_DP_NONE );
394 }
395 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100396
Paul Elliott8ff510a2020-06-02 17:19:28 +0100397 case PSA_ECC_FAMILY_BRAINPOOL_P_R1:
Gilles Peskine228abc52019-12-03 17:24:19 +0100398 switch( byte_length )
399 {
400 case PSA_BITS_TO_BYTES( 256 ):
401 return( MBEDTLS_ECP_DP_BP256R1 );
402 case PSA_BITS_TO_BYTES( 384 ):
403 return( MBEDTLS_ECP_DP_BP384R1 );
404 case PSA_BITS_TO_BYTES( 512 ):
405 return( MBEDTLS_ECP_DP_BP512R1 );
406 default:
407 return( MBEDTLS_ECP_DP_NONE );
408 }
409 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100410
Paul Elliott8ff510a2020-06-02 17:19:28 +0100411 case PSA_ECC_FAMILY_MONTGOMERY:
Gilles Peskine228abc52019-12-03 17:24:19 +0100412 switch( byte_length )
413 {
414 case PSA_BITS_TO_BYTES( 255 ):
415 return( MBEDTLS_ECP_DP_CURVE25519 );
416 case PSA_BITS_TO_BYTES( 448 ):
417 return( MBEDTLS_ECP_DP_CURVE448 );
418 default:
419 return( MBEDTLS_ECP_DP_NONE );
420 }
421 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100422
Paul Elliott8ff510a2020-06-02 17:19:28 +0100423 case PSA_ECC_FAMILY_SECP_K1:
Gilles Peskine228abc52019-12-03 17:24:19 +0100424 switch( byte_length )
425 {
426 case PSA_BITS_TO_BYTES( 192 ):
427 return( MBEDTLS_ECP_DP_SECP192K1 );
428 case PSA_BITS_TO_BYTES( 224 ):
429 return( MBEDTLS_ECP_DP_SECP224K1 );
430 case PSA_BITS_TO_BYTES( 256 ):
431 return( MBEDTLS_ECP_DP_SECP256K1 );
432 default:
433 return( MBEDTLS_ECP_DP_NONE );
434 }
435 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100436
Gilles Peskine12313cd2018-06-20 00:20:32 +0200437 default:
438 return( MBEDTLS_ECP_DP_NONE );
439 }
440}
Darryl Green8f8aa8f2018-07-24 15:44:51 +0100441#endif /* defined(MBEDTLS_ECP_C) */
Gilles Peskine12313cd2018-06-20 00:20:32 +0200442
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200443static psa_status_t validate_unstructured_key_bit_size( psa_key_type_t type,
444 size_t bits )
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200445{
446 /* Check that the bit size is acceptable for the key type */
447 switch( type )
448 {
449 case PSA_KEY_TYPE_RAW_DATA:
450#if defined(MBEDTLS_MD_C)
451 case PSA_KEY_TYPE_HMAC:
Gilles Peskine46f1fd72018-06-28 19:31:31 +0200452#endif
Gilles Peskineea0fb492018-07-12 17:17:20 +0200453 case PSA_KEY_TYPE_DERIVE:
454 break;
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200455#if defined(MBEDTLS_AES_C)
456 case PSA_KEY_TYPE_AES:
457 if( bits != 128 && bits != 192 && bits != 256 )
458 return( PSA_ERROR_INVALID_ARGUMENT );
459 break;
460#endif
461#if defined(MBEDTLS_CAMELLIA_C)
462 case PSA_KEY_TYPE_CAMELLIA:
463 if( bits != 128 && bits != 192 && bits != 256 )
464 return( PSA_ERROR_INVALID_ARGUMENT );
465 break;
466#endif
467#if defined(MBEDTLS_DES_C)
468 case PSA_KEY_TYPE_DES:
469 if( bits != 64 && bits != 128 && bits != 192 )
470 return( PSA_ERROR_INVALID_ARGUMENT );
471 break;
472#endif
473#if defined(MBEDTLS_ARC4_C)
474 case PSA_KEY_TYPE_ARC4:
475 if( bits < 8 || bits > 2048 )
476 return( PSA_ERROR_INVALID_ARGUMENT );
477 break;
478#endif
Gilles Peskine26869f22019-05-06 15:25:00 +0200479#if defined(MBEDTLS_CHACHA20_C)
480 case PSA_KEY_TYPE_CHACHA20:
481 if( bits != 256 )
482 return( PSA_ERROR_INVALID_ARGUMENT );
483 break;
484#endif
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200485 default:
486 return( PSA_ERROR_NOT_SUPPORTED );
487 }
Gilles Peskineb54979a2018-06-21 09:32:47 +0200488 if( bits % 8 != 0 )
489 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200490
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200491 return( PSA_SUCCESS );
492}
493
Steven Cooremana01795d2020-07-24 22:48:15 +0200494#if defined(MBEDTLS_RSA_C)
495
496#if defined(MBEDTLS_PK_PARSE_C)
Gilles Peskine86a440b2018-11-12 18:39:40 +0100497/* Mbed TLS doesn't support non-byte-aligned key sizes (i.e. key sizes
498 * that are not a multiple of 8) well. For example, there is only
499 * mbedtls_rsa_get_len(), which returns a number of bytes, and no
500 * way to return the exact bit size of a key.
501 * To keep things simple, reject non-byte-aligned key sizes. */
502static psa_status_t psa_check_rsa_key_byte_aligned(
503 const mbedtls_rsa_context *rsa )
504{
505 mbedtls_mpi n;
506 psa_status_t status;
507 mbedtls_mpi_init( &n );
508 status = mbedtls_to_psa_error(
509 mbedtls_rsa_export( rsa, &n, NULL, NULL, NULL, NULL ) );
510 if( status == PSA_SUCCESS )
511 {
512 if( mbedtls_mpi_bitlen( &n ) % 8 != 0 )
513 status = PSA_ERROR_NOT_SUPPORTED;
514 }
515 mbedtls_mpi_free( &n );
516 return( status );
517}
Steven Cooremana01795d2020-07-24 22:48:15 +0200518#endif /* MBEDTLS_PK_PARSE_C */
Gilles Peskine86a440b2018-11-12 18:39:40 +0100519
Steven Cooreman7f391872020-07-30 14:57:44 +0200520/** Load the contents of a key buffer into an internal RSA representation
Steven Cooremana01795d2020-07-24 22:48:15 +0200521 *
Steven Cooreman4fed4552020-08-03 14:46:03 +0200522 * \param[in] type The type of key contained in \p data.
523 * \param[in] data The buffer from which to load the representation.
524 * \param[in] data_length The size in bytes of \p data.
525 * \param[out] p_rsa Returns a pointer to an RSA context on success.
526 * The caller is responsible for freeing both the
527 * contents of the context and the context itself
528 * when done.
Steven Cooremana01795d2020-07-24 22:48:15 +0200529 */
Steven Cooreman4fed4552020-08-03 14:46:03 +0200530static psa_status_t psa_load_rsa_representation( psa_key_type_t type,
531 const uint8_t *data,
532 size_t data_length,
Steven Cooremana2371e52020-07-28 14:30:39 +0200533 mbedtls_rsa_context **p_rsa )
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200534{
Steven Cooremana01795d2020-07-24 22:48:15 +0200535#if defined(MBEDTLS_PK_PARSE_C)
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000536 psa_status_t status;
Steven Cooremana01795d2020-07-24 22:48:15 +0200537 mbedtls_pk_context ctx;
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000538 size_t bits;
Steven Cooremana01795d2020-07-24 22:48:15 +0200539 mbedtls_pk_init( &ctx );
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000540
541 /* Parse the data. */
Steven Cooreman7f391872020-07-30 14:57:44 +0200542 if( PSA_KEY_TYPE_IS_KEY_PAIR( type ) )
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000543 status = mbedtls_to_psa_error(
Steven Cooreman4fed4552020-08-03 14:46:03 +0200544 mbedtls_pk_parse_key( &ctx, data, data_length, NULL, 0 ) );
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200545 else
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000546 status = mbedtls_to_psa_error(
Steven Cooreman4fed4552020-08-03 14:46:03 +0200547 mbedtls_pk_parse_public_key( &ctx, data, data_length ) );
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000548 if( status != PSA_SUCCESS )
549 goto exit;
550
551 /* We have something that the pkparse module recognizes. If it is a
552 * valid RSA key, store it. */
Steven Cooremana01795d2020-07-24 22:48:15 +0200553 if( mbedtls_pk_get_type( &ctx ) != MBEDTLS_PK_RSA )
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200554 {
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000555 status = PSA_ERROR_INVALID_ARGUMENT;
556 goto exit;
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200557 }
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000558
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000559 /* The size of an RSA key doesn't have to be a multiple of 8. Mbed TLS
560 * supports non-byte-aligned key sizes, but not well. For example,
561 * mbedtls_rsa_get_len() returns the key size in bytes, not in bits. */
Steven Cooremana01795d2020-07-24 22:48:15 +0200562 bits = PSA_BYTES_TO_BITS( mbedtls_rsa_get_len( mbedtls_pk_rsa( ctx ) ) );
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000563 if( bits > PSA_VENDOR_RSA_MAX_KEY_BITS )
564 {
565 status = PSA_ERROR_NOT_SUPPORTED;
566 goto exit;
567 }
Steven Cooremana01795d2020-07-24 22:48:15 +0200568 status = psa_check_rsa_key_byte_aligned( mbedtls_pk_rsa( ctx ) );
Steven Cooremana01795d2020-07-24 22:48:15 +0200569 if( status != PSA_SUCCESS )
570 goto exit;
571
Steven Cooremana2371e52020-07-28 14:30:39 +0200572 /* Copy out the pointer to the RSA context, and reset the PK context
573 * such that pk_free doesn't free the RSA context we just grabbed. */
574 *p_rsa = mbedtls_pk_rsa( ctx );
575 ctx.pk_info = NULL;
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000576
577exit:
Steven Cooremana01795d2020-07-24 22:48:15 +0200578 mbedtls_pk_free( &ctx );
579 return( status );
580#else
Steven Cooreman4fed4552020-08-03 14:46:03 +0200581 (void) data;
582 (void) data_length;
Steven Cooreman7f391872020-07-30 14:57:44 +0200583 (void) type;
Steven Cooremana01795d2020-07-24 22:48:15 +0200584 (void) rsa;
585 return( PSA_ERROR_NOT_SUPPORTED );
586#endif /* MBEDTLS_PK_PARSE_C */
587}
588
589/** Export an RSA key to export representation
590 *
591 * \param[in] type The type of key (public/private) to export
592 * \param[in] rsa The internal RSA representation from which to export
593 * \param[out] data The buffer to export to
594 * \param[in] data_size The length of the buffer to export to
595 * \param[out] data_length The amount of bytes written to \p data
596 */
597static psa_status_t psa_export_rsa_key( psa_key_type_t type,
598 mbedtls_rsa_context *rsa,
599 uint8_t *data,
600 size_t data_size,
601 size_t *data_length )
602{
603#if defined(MBEDTLS_PK_WRITE_C)
604 int ret;
605 mbedtls_pk_context pk;
606 uint8_t *pos = data + data_size;
607
608 mbedtls_pk_init( &pk );
609 pk.pk_info = &mbedtls_rsa_info;
610 pk.pk_ctx = rsa;
611
612 /* PSA Crypto API defines the format of an RSA key as a DER-encoded
Steven Cooreman75b74362020-07-28 14:30:13 +0200613 * representation of the non-encrypted PKCS#1 RSAPrivateKey for a
614 * private key and of the RFC3279 RSAPublicKey for a public key. */
Steven Cooremana01795d2020-07-24 22:48:15 +0200615 if( PSA_KEY_TYPE_IS_KEY_PAIR( type ) )
616 ret = mbedtls_pk_write_key_der( &pk, data, data_size );
617 else
618 ret = mbedtls_pk_write_pubkey( &pos, data, &pk );
619
620 if( ret < 0 )
Steven Cooreman4fed4552020-08-03 14:46:03 +0200621 {
622 /* Clean up in case pk_write failed halfway through. */
623 memset( data, 0, data_size );
Steven Cooreman29149862020-08-05 15:43:42 +0200624 return( mbedtls_to_psa_error( ret ) );
Steven Cooreman4fed4552020-08-03 14:46:03 +0200625 }
Steven Cooremana01795d2020-07-24 22:48:15 +0200626
627 /* The mbedtls_pk_xxx functions write to the end of the buffer.
628 * Move the data to the beginning and erase remaining data
629 * at the original location. */
630 if( 2 * (size_t) ret <= data_size )
631 {
632 memcpy( data, data + data_size - ret, ret );
633 memset( data + data_size - ret, 0, ret );
634 }
635 else if( (size_t) ret < data_size )
636 {
637 memmove( data, data + data_size - ret, ret );
638 memset( data + ret, 0, data_size - ret );
639 }
640
641 *data_length = ret;
642 return( PSA_SUCCESS );
643#else
644 (void) type;
645 (void) rsa;
646 (void) data;
647 (void) data_size;
648 (void) data_length;
649 return( PSA_ERROR_NOT_SUPPORTED );
650#endif /* MBEDTLS_PK_WRITE_C */
651}
652
653/** Import an RSA key from import representation to a slot
654 *
655 * \param[in,out] slot The slot where to store the export representation to
656 * \param[in] data The buffer containing the import representation
657 * \param[in] data_length The amount of bytes in \p data
658 */
659static psa_status_t psa_import_rsa_key( psa_key_slot_t *slot,
660 const uint8_t *data,
661 size_t data_length )
662{
663 psa_status_t status;
664 uint8_t* output = NULL;
Steven Cooremana2371e52020-07-28 14:30:39 +0200665 mbedtls_rsa_context *rsa = NULL;
Steven Cooremana01795d2020-07-24 22:48:15 +0200666
Steven Cooremana01795d2020-07-24 22:48:15 +0200667 /* Parse input */
Steven Cooreman4fed4552020-08-03 14:46:03 +0200668 status = psa_load_rsa_representation( slot->attr.type,
669 data,
Steven Cooreman7f391872020-07-30 14:57:44 +0200670 data_length,
Steven Cooreman7f391872020-07-30 14:57:44 +0200671 &rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +0200672 if( status != PSA_SUCCESS )
673 goto exit;
674
675 slot->attr.bits = (psa_key_bits_t) PSA_BYTES_TO_BITS(
Steven Cooremana2371e52020-07-28 14:30:39 +0200676 mbedtls_rsa_get_len( rsa ) );
Steven Cooremana01795d2020-07-24 22:48:15 +0200677
Steven Cooreman75b74362020-07-28 14:30:13 +0200678 /* Re-export the data to PSA export format, such that we can store export
679 * representation in the key slot. Export representation in case of RSA is
680 * the smallest representation that's allowed as input, so a straight-up
681 * allocation of the same size as the input buffer will be large enough. */
Steven Cooremana01795d2020-07-24 22:48:15 +0200682 output = mbedtls_calloc( 1, data_length );
Steven Cooremana01795d2020-07-24 22:48:15 +0200683 if( output == NULL )
684 {
685 status = PSA_ERROR_INSUFFICIENT_MEMORY;
686 goto exit;
687 }
688
Steven Cooremana01795d2020-07-24 22:48:15 +0200689 status = psa_export_rsa_key( slot->attr.type,
Steven Cooremana2371e52020-07-28 14:30:39 +0200690 rsa,
Steven Cooremana01795d2020-07-24 22:48:15 +0200691 output,
692 data_length,
693 &data_length);
Steven Cooremana01795d2020-07-24 22:48:15 +0200694exit:
695 /* Always free the RSA object */
Steven Cooremana2371e52020-07-28 14:30:39 +0200696 mbedtls_rsa_free( rsa );
Steven Cooreman6d839f02020-07-30 11:36:45 +0200697 mbedtls_free( rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +0200698
699 /* Free the allocated buffer only on error. */
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000700 if( status != PSA_SUCCESS )
701 {
Steven Cooremana01795d2020-07-24 22:48:15 +0200702 mbedtls_free( output );
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000703 return( status );
704 }
705
Steven Cooremana01795d2020-07-24 22:48:15 +0200706 /* On success, store the allocated export-formatted key. */
707 slot->data.key.data = output;
708 slot->data.key.bytes = data_length;
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000709
710 return( PSA_SUCCESS );
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200711}
Steven Cooremana01795d2020-07-24 22:48:15 +0200712#endif /* defined(MBEDTLS_RSA_C) */
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200713
Jaeden Ameroccdce902019-01-10 11:42:27 +0000714#if defined(MBEDTLS_ECP_C)
Steven Cooreman7f391872020-07-30 14:57:44 +0200715/** Load the contents of a key buffer into an internal ECP representation
Steven Cooremana2371e52020-07-28 14:30:39 +0200716 *
Steven Cooreman4fed4552020-08-03 14:46:03 +0200717 * \param[in] type The type of key contained in \p data.
718 * \param[in] data The buffer from which to load the representation.
719 * \param[in] data_length The size in bytes of \p data.
720 * \param[out] p_ecp Returns a pointer to an ECP context on success.
721 * The caller is responsible for freeing both the
722 * contents of the context and the context itself
723 * when done.
Steven Cooremana2371e52020-07-28 14:30:39 +0200724 */
Steven Cooreman4fed4552020-08-03 14:46:03 +0200725static psa_status_t psa_load_ecp_representation( psa_key_type_t type,
726 const uint8_t *data,
727 size_t data_length,
Steven Cooremana2371e52020-07-28 14:30:39 +0200728 mbedtls_ecp_keypair **p_ecp )
Gilles Peskine4cd32772019-12-02 20:49:42 +0100729{
730 mbedtls_ecp_group_id grp_id = MBEDTLS_ECP_DP_NONE;
Steven Cooremanacda8342020-07-24 23:09:52 +0200731 psa_status_t status;
Steven Cooreman6d839f02020-07-30 11:36:45 +0200732 mbedtls_ecp_keypair *ecp = NULL;
Steven Cooreman4fed4552020-08-03 14:46:03 +0200733 size_t curve_size = data_length;
Gilles Peskine4cd32772019-12-02 20:49:42 +0100734
Steven Cooreman4fed4552020-08-03 14:46:03 +0200735 if( PSA_KEY_TYPE_IS_PUBLIC_KEY( type ) &&
736 PSA_KEY_TYPE_ECC_GET_FAMILY( type ) != PSA_ECC_FAMILY_MONTGOMERY )
Gilles Peskine4295e8b2019-12-02 21:39:10 +0100737 {
Steven Cooreman4fed4552020-08-03 14:46:03 +0200738 /* A Weierstrass public key is represented as:
739 * - The byte 0x04;
740 * - `x_P` as a `ceiling(m/8)`-byte string, big-endian;
741 * - `y_P` as a `ceiling(m/8)`-byte string, big-endian.
Steven Cooreman3ea0ce42020-10-23 11:37:05 +0200742 * So its data length is 2m+1 where m is the curve size in bits.
Steven Cooreman4fed4552020-08-03 14:46:03 +0200743 */
744 if( ( data_length & 1 ) == 0 )
745 return( PSA_ERROR_INVALID_ARGUMENT );
746 curve_size = data_length / 2;
747
748 /* Montgomery public keys are represented in compressed format, meaning
749 * their curve_size is equal to the amount of input. */
750
751 /* Private keys are represented in uncompressed private random integer
752 * format, meaning their curve_size is equal to the amount of input. */
Gilles Peskine4295e8b2019-12-02 21:39:10 +0100753 }
754
Steven Cooreman6d839f02020-07-30 11:36:45 +0200755 /* Allocate and initialize a key representation. */
Steven Cooreman29149862020-08-05 15:43:42 +0200756 ecp = mbedtls_calloc( 1, sizeof( mbedtls_ecp_keypair ) );
Steven Cooreman6d839f02020-07-30 11:36:45 +0200757 if( ecp == NULL )
Steven Cooreman29149862020-08-05 15:43:42 +0200758 return( PSA_ERROR_INSUFFICIENT_MEMORY );
Steven Cooremana2371e52020-07-28 14:30:39 +0200759 mbedtls_ecp_keypair_init( ecp );
760
Gilles Peskine4cd32772019-12-02 20:49:42 +0100761 /* Load the group. */
Steven Cooreman7f391872020-07-30 14:57:44 +0200762 grp_id = mbedtls_ecc_group_of_psa( PSA_KEY_TYPE_ECC_GET_FAMILY( type ),
763 curve_size );
Gilles Peskine4295e8b2019-12-02 21:39:10 +0100764 if( grp_id == MBEDTLS_ECP_DP_NONE )
Steven Cooreman6d839f02020-07-30 11:36:45 +0200765 {
766 status = PSA_ERROR_INVALID_ARGUMENT;
767 goto exit;
768 }
769
Steven Cooremanacda8342020-07-24 23:09:52 +0200770 status = mbedtls_to_psa_error(
771 mbedtls_ecp_group_load( &ecp->grp, grp_id ) );
772 if( status != PSA_SUCCESS )
Steven Cooreman6d839f02020-07-30 11:36:45 +0200773 goto exit;
Steven Cooremanacda8342020-07-24 23:09:52 +0200774
Steven Cooreman6d839f02020-07-30 11:36:45 +0200775 /* Load the key material. */
Steven Cooreman7f391872020-07-30 14:57:44 +0200776 if( PSA_KEY_TYPE_IS_PUBLIC_KEY( type ) )
Steven Cooremanacda8342020-07-24 23:09:52 +0200777 {
778 /* Load the public value. */
779 status = mbedtls_to_psa_error(
780 mbedtls_ecp_point_read_binary( &ecp->grp, &ecp->Q,
Steven Cooreman4fed4552020-08-03 14:46:03 +0200781 data,
782 data_length ) );
Steven Cooremanacda8342020-07-24 23:09:52 +0200783 if( status != PSA_SUCCESS )
784 goto exit;
785
786 /* Check that the point is on the curve. */
787 status = mbedtls_to_psa_error(
788 mbedtls_ecp_check_pubkey( &ecp->grp, &ecp->Q ) );
789 if( status != PSA_SUCCESS )
790 goto exit;
791 }
792 else
793 {
Steven Cooreman6d839f02020-07-30 11:36:45 +0200794 /* Load and validate the secret value. */
Steven Cooremanacda8342020-07-24 23:09:52 +0200795 status = mbedtls_to_psa_error(
796 mbedtls_ecp_read_key( ecp->grp.id,
797 ecp,
Steven Cooreman4fed4552020-08-03 14:46:03 +0200798 data,
799 data_length ) );
Steven Cooremanacda8342020-07-24 23:09:52 +0200800 if( status != PSA_SUCCESS )
801 goto exit;
Steven Cooremanacda8342020-07-24 23:09:52 +0200802 }
Steven Cooremana2371e52020-07-28 14:30:39 +0200803
804 *p_ecp = ecp;
Steven Cooremanacda8342020-07-24 23:09:52 +0200805exit:
806 if( status != PSA_SUCCESS )
Steven Cooremana2371e52020-07-28 14:30:39 +0200807 {
Steven Cooremanacda8342020-07-24 23:09:52 +0200808 mbedtls_ecp_keypair_free( ecp );
Steven Cooremana2371e52020-07-28 14:30:39 +0200809 mbedtls_free( ecp );
810 }
811
Steven Cooreman29149862020-08-05 15:43:42 +0200812 return( status );
Gilles Peskine4cd32772019-12-02 20:49:42 +0100813}
Jaeden Ameroccdce902019-01-10 11:42:27 +0000814
Steven Cooreman4fed4552020-08-03 14:46:03 +0200815/** Export an ECP key to export representation
816 *
817 * \param[in] type The type of key (public/private) to export
818 * \param[in] ecp The internal ECP representation from which to export
819 * \param[out] data The buffer to export to
820 * \param[in] data_size The length of the buffer to export to
821 * \param[out] data_length The amount of bytes written to \p data
822 */
Steven Cooremanacda8342020-07-24 23:09:52 +0200823static psa_status_t psa_export_ecp_key( psa_key_type_t type,
824 mbedtls_ecp_keypair *ecp,
825 uint8_t *data,
826 size_t data_size,
827 size_t *data_length )
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200828{
Steven Cooremanacda8342020-07-24 23:09:52 +0200829 psa_status_t status;
Jaeden Ameroccdce902019-01-10 11:42:27 +0000830
Steven Cooremanacda8342020-07-24 23:09:52 +0200831 if( PSA_KEY_TYPE_IS_PUBLIC_KEY( type ) )
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200832 {
Steven Cooremanacda8342020-07-24 23:09:52 +0200833 /* Check whether the public part is loaded */
834 if( mbedtls_ecp_is_zero( &ecp->Q ) )
835 {
836 /* Calculate the public key */
837 status = mbedtls_to_psa_error(
838 mbedtls_ecp_mul( &ecp->grp, &ecp->Q, &ecp->d, &ecp->grp.G,
839 mbedtls_ctr_drbg_random, &global_data.ctr_drbg ) );
840 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +0200841 return( status );
Steven Cooremanacda8342020-07-24 23:09:52 +0200842 }
843
Steven Cooreman4fed4552020-08-03 14:46:03 +0200844 status = mbedtls_to_psa_error(
Steven Cooremanacda8342020-07-24 23:09:52 +0200845 mbedtls_ecp_point_write_binary( &ecp->grp, &ecp->Q,
846 MBEDTLS_ECP_PF_UNCOMPRESSED,
847 data_length,
848 data,
Steven Cooreman4fed4552020-08-03 14:46:03 +0200849 data_size ) );
Steven Cooreman4fed4552020-08-03 14:46:03 +0200850 if( status != PSA_SUCCESS )
851 memset( data, 0, data_size );
852
Steven Cooreman29149862020-08-05 15:43:42 +0200853 return( status );
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200854 }
Steven Cooremanacda8342020-07-24 23:09:52 +0200855 else
856 {
Steven Cooreman29149862020-08-05 15:43:42 +0200857 if( data_size < PSA_BITS_TO_BYTES( ecp->grp.nbits ) )
Steven Cooremanacda8342020-07-24 23:09:52 +0200858 return( PSA_ERROR_BUFFER_TOO_SMALL );
859
860 status = mbedtls_to_psa_error(
861 mbedtls_ecp_write_key( ecp,
862 data,
Steven Cooreman29149862020-08-05 15:43:42 +0200863 PSA_BITS_TO_BYTES( ecp->grp.nbits ) ) );
Steven Cooremanacda8342020-07-24 23:09:52 +0200864 if( status == PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +0200865 *data_length = PSA_BITS_TO_BYTES( ecp->grp.nbits );
Steven Cooremanb7f6dea2020-08-05 16:07:20 +0200866 else
867 memset( data, 0, data_size );
Steven Cooremanacda8342020-07-24 23:09:52 +0200868
869 return( status );
870 }
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200871}
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200872
Steven Cooreman4fed4552020-08-03 14:46:03 +0200873/** Import an ECP key from import representation to a slot
874 *
875 * \param[in,out] slot The slot where to store the export representation to
876 * \param[in] data The buffer containing the import representation
877 * \param[in] data_length The amount of bytes in \p data
878 */
Steven Cooremanacda8342020-07-24 23:09:52 +0200879static psa_status_t psa_import_ecp_key( psa_key_slot_t *slot,
880 const uint8_t *data,
881 size_t data_length )
Gilles Peskinef76aa772018-10-29 19:24:33 +0100882{
Steven Cooremanacda8342020-07-24 23:09:52 +0200883 psa_status_t status;
884 uint8_t* output = NULL;
Steven Cooremana2371e52020-07-28 14:30:39 +0200885 mbedtls_ecp_keypair *ecp = NULL;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100886
Steven Cooremanacda8342020-07-24 23:09:52 +0200887 /* Parse input */
Steven Cooreman4fed4552020-08-03 14:46:03 +0200888 status = psa_load_ecp_representation( slot->attr.type,
889 data,
Steven Cooreman7f391872020-07-30 14:57:44 +0200890 data_length,
Steven Cooreman7f391872020-07-30 14:57:44 +0200891 &ecp );
Gilles Peskinef76aa772018-10-29 19:24:33 +0100892 if( status != PSA_SUCCESS )
893 goto exit;
Gilles Peskine4cd32772019-12-02 20:49:42 +0100894
Steven Cooremanacda8342020-07-24 23:09:52 +0200895 if( PSA_KEY_TYPE_ECC_GET_FAMILY( slot->attr.type ) == PSA_ECC_FAMILY_MONTGOMERY)
Steven Cooremana2371e52020-07-28 14:30:39 +0200896 slot->attr.bits = (psa_key_bits_t) ecp->grp.nbits + 1;
Steven Cooremanacda8342020-07-24 23:09:52 +0200897 else
Steven Cooremana2371e52020-07-28 14:30:39 +0200898 slot->attr.bits = (psa_key_bits_t) ecp->grp.nbits;
Steven Cooremane3fd3922020-06-11 16:50:36 +0200899
Steven Cooremanacda8342020-07-24 23:09:52 +0200900 /* Re-export the data to PSA export format. There is currently no support
901 * for other input formats then the export format, so this is a 1-1
902 * copy operation. */
903 output = mbedtls_calloc( 1, data_length );
Steven Cooremanacda8342020-07-24 23:09:52 +0200904 if( output == NULL )
905 {
906 status = PSA_ERROR_INSUFFICIENT_MEMORY;
907 goto exit;
908 }
909
910 status = psa_export_ecp_key( slot->attr.type,
Steven Cooremana2371e52020-07-28 14:30:39 +0200911 ecp,
Steven Cooremanacda8342020-07-24 23:09:52 +0200912 output,
913 data_length,
914 &data_length);
Gilles Peskinef76aa772018-10-29 19:24:33 +0100915exit:
Steven Cooremana2371e52020-07-28 14:30:39 +0200916 /* Always free the PK object (will also free contained ECP context) */
917 mbedtls_ecp_keypair_free( ecp );
Steven Cooreman6d839f02020-07-30 11:36:45 +0200918 mbedtls_free( ecp );
Steven Cooremanacda8342020-07-24 23:09:52 +0200919
920 /* Free the allocated buffer only on error. */
921 if( status != PSA_SUCCESS )
Gilles Peskinef76aa772018-10-29 19:24:33 +0100922 {
Steven Cooremanacda8342020-07-24 23:09:52 +0200923 mbedtls_free( output );
Steven Cooremanacda8342020-07-24 23:09:52 +0200924 return( status );
Gilles Peskinef76aa772018-10-29 19:24:33 +0100925 }
Steven Cooremanacda8342020-07-24 23:09:52 +0200926
927 /* On success, store the allocated export-formatted key. */
928 slot->data.key.data = output;
929 slot->data.key.bytes = data_length;
930
931 return( PSA_SUCCESS );
Gilles Peskinef76aa772018-10-29 19:24:33 +0100932}
933#endif /* defined(MBEDTLS_ECP_C) */
934
Gilles Peskineb46bef22019-07-30 21:32:04 +0200935/** Return the size of the key in the given slot, in bits.
936 *
937 * \param[in] slot A key slot.
938 *
939 * \return The key size in bits, read from the metadata in the slot.
940 */
941static inline size_t psa_get_key_slot_bits( const psa_key_slot_t *slot )
942{
943 return( slot->attr.bits );
944}
945
Steven Cooreman75b74362020-07-28 14:30:13 +0200946/** Try to allocate a buffer to an empty key slot.
947 *
948 * \param[in,out] slot Key slot to attach buffer to.
949 * \param[in] buffer_length Requested size of the buffer.
950 *
951 * \retval #PSA_SUCCESS
952 * The buffer has been successfully allocated.
953 * \retval #PSA_ERROR_INSUFFICIENT_MEMORY
954 * Not enough memory was available for allocation.
955 * \retval #PSA_ERROR_ALREADY_EXISTS
956 * Trying to allocate a buffer to a non-empty key slot.
957 */
958static psa_status_t psa_allocate_buffer_to_slot( psa_key_slot_t *slot,
959 size_t buffer_length )
960{
961 if( slot->data.key.data != NULL )
Steven Cooreman29149862020-08-05 15:43:42 +0200962 return( PSA_ERROR_ALREADY_EXISTS );
Steven Cooreman75b74362020-07-28 14:30:13 +0200963
964 slot->data.key.data = mbedtls_calloc( 1, buffer_length );
965 if( slot->data.key.data == NULL )
Steven Cooreman29149862020-08-05 15:43:42 +0200966 return( PSA_ERROR_INSUFFICIENT_MEMORY );
Steven Cooreman75b74362020-07-28 14:30:13 +0200967
968 slot->data.key.bytes = buffer_length;
Steven Cooreman29149862020-08-05 15:43:42 +0200969 return( PSA_SUCCESS );
Steven Cooreman75b74362020-07-28 14:30:13 +0200970}
971
Steven Cooremanf7cebd42020-10-13 20:27:40 +0200972psa_status_t psa_copy_key_material_into_slot( psa_key_slot_t *slot,
973 const uint8_t* data,
974 size_t data_length )
975{
976 psa_status_t status = psa_allocate_buffer_to_slot( slot,
977 data_length );
978 if( status != PSA_SUCCESS )
979 return( status );
980
981 memcpy( slot->data.key.data, data, data_length );
982 return( PSA_SUCCESS );
983}
984
Steven Cooreman3ea0ce42020-10-23 11:37:05 +0200985/** Import key data into a slot.
986 *
987 * `slot->type` must have been set previously.
988 * This function assumes that the slot does not contain any key material yet.
989 * On failure, the slot content is unchanged.
990 *
991 * Persistent storage is not affected.
992 *
993 * \param[in,out] slot The key slot to import data into.
994 * Its `type` field must have previously been set to
995 * the desired key type.
996 * It must not contain any key material yet.
997 * \param[in] data Buffer containing the key material to parse and import.
998 * \param data_length Size of \p data in bytes.
999 *
1000 * \retval #PSA_SUCCESS
1001 * \retval #PSA_ERROR_INVALID_ARGUMENT
1002 * \retval #PSA_ERROR_NOT_SUPPORTED
1003 * \retval #PSA_ERROR_INSUFFICIENT_MEMORY
1004 */
1005static psa_status_t psa_import_key_into_slot( psa_key_slot_t *slot,
1006 const uint8_t *data,
1007 size_t data_length )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001008{
Gilles Peskineb0b255c2018-07-06 17:01:38 +02001009 psa_status_t status = PSA_SUCCESS;
Steven Cooreman04524762020-10-13 17:43:44 +02001010 size_t bit_size;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001011
Steven Cooreman81be2fa2020-07-24 22:04:59 +02001012 /* zero-length keys are never supported. */
1013 if( data_length == 0 )
1014 return( PSA_ERROR_NOT_SUPPORTED );
1015
Gilles Peskine8e338702019-07-30 20:06:31 +02001016 if( key_type_is_raw_bytes( slot->attr.type ) )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001017 {
Steven Cooreman04524762020-10-13 17:43:44 +02001018 bit_size = PSA_BYTES_TO_BITS( data_length );
Steven Cooreman81be2fa2020-07-24 22:04:59 +02001019
Steven Cooreman75b74362020-07-28 14:30:13 +02001020 /* Ensure that the bytes-to-bits conversion hasn't overflown. */
1021 if( data_length > SIZE_MAX / 8 )
1022 return( PSA_ERROR_NOT_SUPPORTED );
1023
Gilles Peskine1b9505c2019-08-07 10:59:45 +02001024 /* Enforce a size limit, and in particular ensure that the bit
1025 * size fits in its representation type. */
Gilles Peskinec744d992019-07-30 17:26:54 +02001026 if( bit_size > PSA_MAX_KEY_BITS )
1027 return( PSA_ERROR_NOT_SUPPORTED );
Steven Cooreman81be2fa2020-07-24 22:04:59 +02001028
1029 status = validate_unstructured_key_bit_size( slot->attr.type, bit_size );
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +02001030 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02001031 return( status );
Steven Cooreman81be2fa2020-07-24 22:04:59 +02001032
1033 /* Allocate memory for the key */
Steven Cooremanf7cebd42020-10-13 20:27:40 +02001034 status = psa_copy_key_material_into_slot( slot, data, data_length );
Steven Cooreman75b74362020-07-28 14:30:13 +02001035 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02001036 return( status );
Steven Cooreman81be2fa2020-07-24 22:04:59 +02001037
Steven Cooreman81be2fa2020-07-24 22:04:59 +02001038 /* Write the actual key size to the slot.
1039 * psa_start_key_creation() wrote the size declared by the
1040 * caller, which may be 0 (meaning unspecified) or wrong. */
1041 slot->attr.bits = (psa_key_bits_t) bit_size;
Steven Cooreman40120f62020-10-29 11:42:22 +01001042
1043 return( PSA_SUCCESS );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001044 }
Steven Cooreman3ea0ce42020-10-23 11:37:05 +02001045 else if( PSA_KEY_TYPE_IS_ASYMMETRIC( slot->attr.type ) )
Steven Cooreman19fd5742020-07-24 23:31:01 +02001046 {
Steven Cooreman3ea0ce42020-10-23 11:37:05 +02001047 /* Try validation through accelerators first. */
1048 bit_size = slot->attr.bits;
1049 psa_key_attributes_t attributes = {
1050 .core = slot->attr
1051 };
1052 status = psa_driver_wrapper_validate_key( &attributes,
1053 data,
1054 data_length,
1055 &bit_size );
1056 if( status == PSA_SUCCESS )
1057 {
1058 /* Key has been validated successfully by an accelerator.
1059 * Copy key material into slot. */
1060 status = psa_copy_key_material_into_slot( slot, data, data_length );
1061 if( status != PSA_SUCCESS )
1062 return( status );
1063
1064 slot->attr.bits = (psa_key_bits_t) bit_size;
1065 return( PSA_SUCCESS );
1066 }
1067 else if( status != PSA_ERROR_NOT_SUPPORTED )
1068 return( status );
1069
1070 /* Key format is not supported by any accelerator, try software fallback
1071 * if present. */
Gilles Peskinef76aa772018-10-29 19:24:33 +01001072#if defined(MBEDTLS_ECP_C)
Steven Cooreman3ea0ce42020-10-23 11:37:05 +02001073 if( PSA_KEY_TYPE_IS_ECC( slot->attr.type ) )
1074 {
Steven Cooreman40120f62020-10-29 11:42:22 +01001075 return( psa_import_ecp_key( slot, data, data_length ) );
1076 }
Steven Cooreman19fd5742020-07-24 23:31:01 +02001077#endif /* defined(MBEDTLS_ECP_C) */
Steven Cooreman19fd5742020-07-24 23:31:01 +02001078#if defined(MBEDTLS_RSA_C)
Steven Cooreman40120f62020-10-29 11:42:22 +01001079 if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
Steven Cooreman3ea0ce42020-10-23 11:37:05 +02001080 {
Steven Cooreman40120f62020-10-29 11:42:22 +01001081 return( psa_import_rsa_key( slot, data, data_length ) );
Steven Cooreman3ea0ce42020-10-23 11:37:05 +02001082 }
Steven Cooreman19fd5742020-07-24 23:31:01 +02001083#endif /* defined(MBEDTLS_RSA_C) */
Steven Cooreman40120f62020-10-29 11:42:22 +01001084
1085 /* Fell through the fallback as well, so have nothing else to try. */
1086 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001087 }
1088 else
Gilles Peskinec66ea6a2018-02-03 22:43:28 +01001089 {
Steven Cooreman19fd5742020-07-24 23:31:01 +02001090 /* Unknown key type */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001091 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine969ac722018-01-28 18:16:59 +01001092 }
Darryl Green06fd18d2018-07-16 11:21:11 +01001093}
1094
Gilles Peskinef603c712019-01-19 13:40:11 +01001095/** Calculate the intersection of two algorithm usage policies.
1096 *
1097 * Return 0 (which allows no operation) on incompatibility.
1098 */
1099static psa_algorithm_t psa_key_policy_algorithm_intersection(
1100 psa_algorithm_t alg1,
1101 psa_algorithm_t alg2 )
1102{
Gilles Peskine549ea862019-05-22 11:45:59 +02001103 /* Common case: both sides actually specify the same policy. */
Gilles Peskinef603c712019-01-19 13:40:11 +01001104 if( alg1 == alg2 )
1105 return( alg1 );
1106 /* If the policies are from the same hash-and-sign family, check
1107 * if one is a wildcard. If so the other has the specific algorithm. */
1108 if( PSA_ALG_IS_HASH_AND_SIGN( alg1 ) &&
1109 PSA_ALG_IS_HASH_AND_SIGN( alg2 ) &&
1110 ( alg1 & ~PSA_ALG_HASH_MASK ) == ( alg2 & ~PSA_ALG_HASH_MASK ) )
1111 {
1112 if( PSA_ALG_SIGN_GET_HASH( alg1 ) == PSA_ALG_ANY_HASH )
1113 return( alg2 );
1114 if( PSA_ALG_SIGN_GET_HASH( alg2 ) == PSA_ALG_ANY_HASH )
1115 return( alg1 );
1116 }
1117 /* If the policies are incompatible, allow nothing. */
1118 return( 0 );
1119}
1120
Gilles Peskined6f371b2019-05-10 19:33:38 +02001121static int psa_key_algorithm_permits( psa_algorithm_t policy_alg,
1122 psa_algorithm_t requested_alg )
1123{
Gilles Peskine549ea862019-05-22 11:45:59 +02001124 /* Common case: the policy only allows requested_alg. */
Gilles Peskined6f371b2019-05-10 19:33:38 +02001125 if( requested_alg == policy_alg )
1126 return( 1 );
1127 /* If policy_alg is a hash-and-sign with a wildcard for the hash,
Gilles Peskine549ea862019-05-22 11:45:59 +02001128 * and requested_alg is the same hash-and-sign family with any hash,
1129 * then requested_alg is compliant with policy_alg. */
Gilles Peskined6f371b2019-05-10 19:33:38 +02001130 if( PSA_ALG_IS_HASH_AND_SIGN( requested_alg ) &&
1131 PSA_ALG_SIGN_GET_HASH( policy_alg ) == PSA_ALG_ANY_HASH )
1132 {
1133 return( ( policy_alg & ~PSA_ALG_HASH_MASK ) ==
1134 ( requested_alg & ~PSA_ALG_HASH_MASK ) );
1135 }
Steven Cooremance48e852020-10-05 16:02:45 +02001136 /* If policy_alg is a generic key agreement operation, then using it for
Steven Cooremanfa5e6312020-10-15 17:07:12 +02001137 * a key derivation with that key agreement should also be allowed. This
1138 * behaviour is expected to be defined in a future specification version. */
Steven Cooremance48e852020-10-05 16:02:45 +02001139 if( PSA_ALG_IS_RAW_KEY_AGREEMENT( policy_alg ) &&
1140 PSA_ALG_IS_KEY_AGREEMENT( requested_alg ) )
1141 {
1142 return( PSA_ALG_KEY_AGREEMENT_GET_BASE( requested_alg ) ==
1143 policy_alg );
1144 }
Gilles Peskined6f371b2019-05-10 19:33:38 +02001145 /* If it isn't permitted, it's forbidden. */
1146 return( 0 );
1147}
1148
Gilles Peskine30f77cd2019-01-14 16:06:39 +01001149/** Test whether a policy permits an algorithm.
1150 *
1151 * The caller must test usage flags separately.
1152 */
1153static int psa_key_policy_permits( const psa_key_policy_t *policy,
1154 psa_algorithm_t alg )
1155{
Gilles Peskined6f371b2019-05-10 19:33:38 +02001156 return( psa_key_algorithm_permits( policy->alg, alg ) ||
1157 psa_key_algorithm_permits( policy->alg2, alg ) );
Gilles Peskine30f77cd2019-01-14 16:06:39 +01001158}
1159
Gilles Peskinef603c712019-01-19 13:40:11 +01001160/** Restrict a key policy based on a constraint.
1161 *
1162 * \param[in,out] policy The policy to restrict.
1163 * \param[in] constraint The policy constraint to apply.
1164 *
1165 * \retval #PSA_SUCCESS
1166 * \c *policy contains the intersection of the original value of
1167 * \c *policy and \c *constraint.
1168 * \retval #PSA_ERROR_INVALID_ARGUMENT
1169 * \c *policy and \c *constraint are incompatible.
1170 * \c *policy is unchanged.
1171 */
1172static psa_status_t psa_restrict_key_policy(
1173 psa_key_policy_t *policy,
1174 const psa_key_policy_t *constraint )
1175{
1176 psa_algorithm_t intersection_alg =
1177 psa_key_policy_algorithm_intersection( policy->alg, constraint->alg );
Gilles Peskined6f371b2019-05-10 19:33:38 +02001178 psa_algorithm_t intersection_alg2 =
1179 psa_key_policy_algorithm_intersection( policy->alg2, constraint->alg2 );
Gilles Peskinef603c712019-01-19 13:40:11 +01001180 if( intersection_alg == 0 && policy->alg != 0 && constraint->alg != 0 )
1181 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskined6f371b2019-05-10 19:33:38 +02001182 if( intersection_alg2 == 0 && policy->alg2 != 0 && constraint->alg2 != 0 )
1183 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskinef603c712019-01-19 13:40:11 +01001184 policy->usage &= constraint->usage;
1185 policy->alg = intersection_alg;
Gilles Peskined6f371b2019-05-10 19:33:38 +02001186 policy->alg2 = intersection_alg2;
Gilles Peskinef603c712019-01-19 13:40:11 +01001187 return( PSA_SUCCESS );
1188}
1189
Darryl Green06fd18d2018-07-16 11:21:11 +01001190/** Retrieve a slot which must contain a key. The key must have allow all the
1191 * usage flags set in \p usage. If \p alg is nonzero, the key must allow
1192 * operations with this algorithm. */
Ronald Croncf56a0a2020-08-04 09:51:30 +02001193static psa_status_t psa_get_key_from_slot( mbedtls_svc_key_id_t key,
Gilles Peskine2f060a82018-12-04 17:12:32 +01001194 psa_key_slot_t **p_slot,
Darryl Green06fd18d2018-07-16 11:21:11 +01001195 psa_key_usage_t usage,
1196 psa_algorithm_t alg )
1197{
1198 psa_status_t status;
Gilles Peskine2f060a82018-12-04 17:12:32 +01001199 psa_key_slot_t *slot = NULL;
Darryl Green06fd18d2018-07-16 11:21:11 +01001200
1201 *p_slot = NULL;
1202
Ronald Croncf56a0a2020-08-04 09:51:30 +02001203 status = psa_get_key_slot( key, &slot );
Darryl Green06fd18d2018-07-16 11:21:11 +01001204 if( status != PSA_SUCCESS )
1205 return( status );
Darryl Green06fd18d2018-07-16 11:21:11 +01001206
1207 /* Enforce that usage policy for the key slot contains all the flags
1208 * required by the usage parameter. There is one exception: public
1209 * keys can always be exported, so we treat public key objects as
1210 * if they had the export flag. */
Gilles Peskine8e338702019-07-30 20:06:31 +02001211 if( PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->attr.type ) )
Darryl Green06fd18d2018-07-16 11:21:11 +01001212 usage &= ~PSA_KEY_USAGE_EXPORT;
Gilles Peskine8e338702019-07-30 20:06:31 +02001213 if( ( slot->attr.policy.usage & usage ) != usage )
Darryl Green06fd18d2018-07-16 11:21:11 +01001214 return( PSA_ERROR_NOT_PERMITTED );
Gilles Peskine30f77cd2019-01-14 16:06:39 +01001215
1216 /* Enforce that the usage policy permits the requested algortihm. */
Gilles Peskine8e338702019-07-30 20:06:31 +02001217 if( alg != 0 && ! psa_key_policy_permits( &slot->attr.policy, alg ) )
Darryl Green06fd18d2018-07-16 11:21:11 +01001218 return( PSA_ERROR_NOT_PERMITTED );
1219
1220 *p_slot = slot;
1221 return( PSA_SUCCESS );
1222}
Darryl Green940d72c2018-07-13 13:18:51 +01001223
Gilles Peskine28f8f302019-07-24 13:30:31 +02001224/** Retrieve a slot which must contain a transparent key.
1225 *
1226 * A transparent key is a key for which the key material is directly
1227 * available, as opposed to a key in a secure element.
1228 *
Gilles Peskine60450a42019-07-25 11:32:45 +02001229 * This is a temporary function to use instead of psa_get_key_from_slot()
1230 * until secure element support is fully implemented.
Gilles Peskine28f8f302019-07-24 13:30:31 +02001231 */
1232#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Ronald Croncf56a0a2020-08-04 09:51:30 +02001233static psa_status_t psa_get_transparent_key( mbedtls_svc_key_id_t key,
Gilles Peskine28f8f302019-07-24 13:30:31 +02001234 psa_key_slot_t **p_slot,
1235 psa_key_usage_t usage,
1236 psa_algorithm_t alg )
1237{
Ronald Croncf56a0a2020-08-04 09:51:30 +02001238 psa_status_t status = psa_get_key_from_slot( key, p_slot, usage, alg );
Gilles Peskine28f8f302019-07-24 13:30:31 +02001239 if( status != PSA_SUCCESS )
1240 return( status );
Gilles Peskineadad8132019-07-25 11:31:23 +02001241 if( psa_key_slot_is_external( *p_slot ) )
Gilles Peskine28f8f302019-07-24 13:30:31 +02001242 {
1243 *p_slot = NULL;
1244 return( PSA_ERROR_NOT_SUPPORTED );
1245 }
1246 return( PSA_SUCCESS );
1247}
1248#else /* MBEDTLS_PSA_CRYPTO_SE_C */
1249/* With no secure element support, all keys are transparent. */
Ronald Croncf56a0a2020-08-04 09:51:30 +02001250#define psa_get_transparent_key( key, p_slot, usage, alg ) \
1251 psa_get_key_from_slot( key, p_slot, usage, alg )
Gilles Peskine28f8f302019-07-24 13:30:31 +02001252#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1253
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001254/** Wipe key data from a slot. Preserve metadata such as the policy. */
Gilles Peskine2f060a82018-12-04 17:12:32 +01001255static psa_status_t psa_remove_key_data_from_memory( psa_key_slot_t *slot )
Darryl Green40225ba2018-11-15 14:48:15 +00001256{
Gilles Peskine73167e12019-07-12 23:44:37 +02001257#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1258 if( psa_key_slot_is_external( slot ) )
Darryl Green40225ba2018-11-15 14:48:15 +00001259 {
1260 /* No key material to clean. */
1261 }
Gilles Peskine73167e12019-07-12 23:44:37 +02001262 else
1263#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Darryl Green40225ba2018-11-15 14:48:15 +00001264 {
Steven Cooremanfd4d69a2020-08-05 15:46:33 +02001265 /* Data pointer will always be either a valid pointer or NULL in an
1266 * initialized slot, so we can just free it. */
1267 if( slot->data.key.data != NULL )
1268 mbedtls_platform_zeroize( slot->data.key.data, slot->data.key.bytes);
Steven Cooremana01795d2020-07-24 22:48:15 +02001269 mbedtls_free( slot->data.key.data );
1270 slot->data.key.data = NULL;
1271 slot->data.key.bytes = 0;
Darryl Green40225ba2018-11-15 14:48:15 +00001272 }
Darryl Green40225ba2018-11-15 14:48:15 +00001273
1274 return( PSA_SUCCESS );
1275}
1276
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001277/** Completely wipe a slot in memory, including its policy.
1278 * Persistent storage is not affected. */
Gilles Peskine66fb1262018-12-10 16:29:04 +01001279psa_status_t psa_wipe_key_slot( psa_key_slot_t *slot )
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001280{
1281 psa_status_t status = psa_remove_key_data_from_memory( slot );
Gilles Peskine3f7cd622019-08-13 15:01:08 +02001282 /* Multipart operations may still be using the key. This is safe
1283 * because all multipart operation objects are independent from
1284 * the key slot: if they need to access the key after the setup
1285 * phase, they have a copy of the key. Note that this means that
1286 * key material can linger until all operations are completed. */
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001287 /* At this point, key material and other type-specific content has
1288 * been wiped. Clear remaining metadata. We can call memset and not
1289 * zeroize because the metadata is not particularly sensitive. */
1290 memset( slot, 0, sizeof( *slot ) );
1291 return( status );
1292}
1293
Ronald Croncf56a0a2020-08-04 09:51:30 +02001294psa_status_t psa_destroy_key( mbedtls_svc_key_id_t key )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001295{
Gilles Peskine2f060a82018-12-04 17:12:32 +01001296 psa_key_slot_t *slot;
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001297 psa_status_t status; /* status of the last operation */
1298 psa_status_t overall_status = PSA_SUCCESS;
Gilles Peskine354f7672019-07-12 23:46:38 +02001299#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1300 psa_se_drv_table_entry_t *driver;
1301#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001302
Ronald Croncf56a0a2020-08-04 09:51:30 +02001303 if( mbedtls_svc_key_id_is_null( key ) )
Gilles Peskine1841cf42019-10-08 15:48:25 +02001304 return( PSA_SUCCESS );
1305
Ronald Croncf56a0a2020-08-04 09:51:30 +02001306 status = psa_get_key_slot( key, &slot );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02001307 if( status != PSA_SUCCESS )
1308 return( status );
Gilles Peskine354f7672019-07-12 23:46:38 +02001309
1310#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine8e338702019-07-30 20:06:31 +02001311 driver = psa_get_se_driver_entry( slot->attr.lifetime );
Gilles Peskine354f7672019-07-12 23:46:38 +02001312 if( driver != NULL )
Gilles Peskinefc762652019-07-22 19:30:34 +02001313 {
Gilles Peskine60450a42019-07-25 11:32:45 +02001314 /* For a key in a secure element, we need to do three things:
1315 * remove the key file in internal storage, destroy the
1316 * key inside the secure element, and update the driver's
1317 * persistent data. Start a transaction that will encompass these
1318 * three actions. */
Gilles Peskinefc762652019-07-22 19:30:34 +02001319 psa_crypto_prepare_transaction( PSA_CRYPTO_TRANSACTION_DESTROY_KEY );
Gilles Peskine8e338702019-07-30 20:06:31 +02001320 psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
Gilles Peskinefc762652019-07-22 19:30:34 +02001321 psa_crypto_transaction.key.slot = slot->data.se.slot_number;
Gilles Peskine8e338702019-07-30 20:06:31 +02001322 psa_crypto_transaction.key.id = slot->attr.id;
Gilles Peskinefc762652019-07-22 19:30:34 +02001323 status = psa_crypto_save_transaction( );
1324 if( status != PSA_SUCCESS )
1325 {
Gilles Peskine66be51c2019-07-25 18:02:52 +02001326 (void) psa_crypto_stop_transaction( );
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001327 /* We should still try to destroy the key in the secure
1328 * element and the key metadata in storage. This is especially
1329 * important if the error is that the storage is full.
1330 * But how to do it exactly without risking an inconsistent
1331 * state after a reset?
1332 * https://github.com/ARMmbed/mbed-crypto/issues/215
1333 */
1334 overall_status = status;
1335 goto exit;
Gilles Peskinefc762652019-07-22 19:30:34 +02001336 }
1337
Gilles Peskine354f7672019-07-12 23:46:38 +02001338 status = psa_destroy_se_key( driver, slot->data.se.slot_number );
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001339 if( overall_status == PSA_SUCCESS )
1340 overall_status = status;
Gilles Peskinefc762652019-07-22 19:30:34 +02001341 }
Gilles Peskine354f7672019-07-12 23:46:38 +02001342#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1343
Darryl Greend49a4992018-06-18 17:27:26 +01001344#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Ronald Crond98059d2020-10-23 18:00:55 +02001345 if( ! PSA_KEY_LIFETIME_IS_VOLATILE( slot->attr.lifetime ) )
Darryl Greend49a4992018-06-18 17:27:26 +01001346 {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001347 status = psa_destroy_persistent_key( slot->attr.id );
1348 if( overall_status == PSA_SUCCESS )
1349 overall_status = status;
1350
Gilles Peskine9ce31c42019-08-13 15:14:20 +02001351 /* TODO: other slots may have a copy of the same key. We should
1352 * invalidate them.
1353 * https://github.com/ARMmbed/mbed-crypto/issues/214
1354 */
Darryl Greend49a4992018-06-18 17:27:26 +01001355 }
1356#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
Gilles Peskine354f7672019-07-12 23:46:38 +02001357
Gilles Peskinefc762652019-07-22 19:30:34 +02001358#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1359 if( driver != NULL )
1360 {
Gilles Peskine725f22a2019-07-25 11:31:48 +02001361 status = psa_save_se_persistent_data( driver );
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001362 if( overall_status == PSA_SUCCESS )
1363 overall_status = status;
1364 status = psa_crypto_stop_transaction( );
1365 if( overall_status == PSA_SUCCESS )
1366 overall_status = status;
Gilles Peskinefc762652019-07-22 19:30:34 +02001367 }
1368#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1369
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001370#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1371exit:
1372#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001373 status = psa_wipe_key_slot( slot );
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001374 /* Prioritize CORRUPTION_DETECTED from wiping over a storage error */
1375 if( overall_status == PSA_SUCCESS )
1376 overall_status = status;
1377 return( overall_status );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001378}
1379
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001380void psa_reset_key_attributes( psa_key_attributes_t *attributes )
Gilles Peskineb870b182018-07-06 16:02:09 +02001381{
Gilles Peskineb699f072019-04-26 16:06:02 +02001382 mbedtls_free( attributes->domain_parameters );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001383 memset( attributes, 0, sizeof( *attributes ) );
Gilles Peskineb870b182018-07-06 16:02:09 +02001384}
1385
Gilles Peskineb699f072019-04-26 16:06:02 +02001386psa_status_t psa_set_key_domain_parameters( psa_key_attributes_t *attributes,
1387 psa_key_type_t type,
1388 const uint8_t *data,
1389 size_t data_length )
1390{
1391 uint8_t *copy = NULL;
1392
1393 if( data_length != 0 )
1394 {
1395 copy = mbedtls_calloc( 1, data_length );
1396 if( copy == NULL )
1397 return( PSA_ERROR_INSUFFICIENT_MEMORY );
1398 memcpy( copy, data, data_length );
1399 }
1400 /* After this point, this function is guaranteed to succeed, so it
1401 * can start modifying `*attributes`. */
1402
1403 if( attributes->domain_parameters != NULL )
1404 {
1405 mbedtls_free( attributes->domain_parameters );
1406 attributes->domain_parameters = NULL;
1407 attributes->domain_parameters_size = 0;
1408 }
1409
1410 attributes->domain_parameters = copy;
1411 attributes->domain_parameters_size = data_length;
Gilles Peskine7e0cff92019-07-30 13:48:52 +02001412 attributes->core.type = type;
Gilles Peskineb699f072019-04-26 16:06:02 +02001413 return( PSA_SUCCESS );
1414}
1415
1416psa_status_t psa_get_key_domain_parameters(
1417 const psa_key_attributes_t *attributes,
1418 uint8_t *data, size_t data_size, size_t *data_length )
1419{
1420 if( attributes->domain_parameters_size > data_size )
1421 return( PSA_ERROR_BUFFER_TOO_SMALL );
1422 *data_length = attributes->domain_parameters_size;
1423 if( attributes->domain_parameters_size != 0 )
1424 memcpy( data, attributes->domain_parameters,
1425 attributes->domain_parameters_size );
1426 return( PSA_SUCCESS );
1427}
1428
1429#if defined(MBEDTLS_RSA_C)
1430static psa_status_t psa_get_rsa_public_exponent(
1431 const mbedtls_rsa_context *rsa,
1432 psa_key_attributes_t *attributes )
1433{
1434 mbedtls_mpi mpi;
Janos Follath24eed8d2019-11-22 13:21:35 +00001435 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskineb699f072019-04-26 16:06:02 +02001436 uint8_t *buffer = NULL;
1437 size_t buflen;
1438 mbedtls_mpi_init( &mpi );
1439
1440 ret = mbedtls_rsa_export( rsa, NULL, NULL, NULL, NULL, &mpi );
1441 if( ret != 0 )
1442 goto exit;
Gilles Peskine772c8b12019-04-26 17:37:21 +02001443 if( mbedtls_mpi_cmp_int( &mpi, 65537 ) == 0 )
1444 {
1445 /* It's the default value, which is reported as an empty string,
1446 * so there's nothing to do. */
1447 goto exit;
1448 }
Gilles Peskineb699f072019-04-26 16:06:02 +02001449
1450 buflen = mbedtls_mpi_size( &mpi );
1451 buffer = mbedtls_calloc( 1, buflen );
1452 if( buffer == NULL )
1453 {
1454 ret = MBEDTLS_ERR_MPI_ALLOC_FAILED;
1455 goto exit;
1456 }
1457 ret = mbedtls_mpi_write_binary( &mpi, buffer, buflen );
1458 if( ret != 0 )
1459 goto exit;
1460 attributes->domain_parameters = buffer;
1461 attributes->domain_parameters_size = buflen;
1462
1463exit:
1464 mbedtls_mpi_free( &mpi );
1465 if( ret != 0 )
1466 mbedtls_free( buffer );
1467 return( mbedtls_to_psa_error( ret ) );
1468}
1469#endif /* MBEDTLS_RSA_C */
1470
Gilles Peskinebfd322f2019-07-23 11:58:03 +02001471/** Retrieve all the publicly-accessible attributes of a key.
1472 */
Ronald Croncf56a0a2020-08-04 09:51:30 +02001473psa_status_t psa_get_key_attributes( mbedtls_svc_key_id_t key,
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001474 psa_key_attributes_t *attributes )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001475{
Gilles Peskine2f060a82018-12-04 17:12:32 +01001476 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02001477 psa_status_t status;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001478
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001479 psa_reset_key_attributes( attributes );
1480
Ronald Croncf56a0a2020-08-04 09:51:30 +02001481 status = psa_get_key_from_slot( key, &slot, 0, 0 );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02001482 if( status != PSA_SUCCESS )
1483 return( status );
Gilles Peskineb870b182018-07-06 16:02:09 +02001484
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001485 attributes->core = slot->attr;
Gilles Peskinec8000c02019-08-02 20:15:51 +02001486 attributes->core.flags &= ( MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY |
1487 MBEDTLS_PSA_KA_MASK_DUAL_USE );
1488
1489#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1490 if( psa_key_slot_is_external( slot ) )
1491 psa_set_key_slot_number( attributes, slot->data.se.slot_number );
1492#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskineb699f072019-04-26 16:06:02 +02001493
Gilles Peskine8e338702019-07-30 20:06:31 +02001494 switch( slot->attr.type )
Gilles Peskineb699f072019-04-26 16:06:02 +02001495 {
1496#if defined(MBEDTLS_RSA_C)
Gilles Peskinec93b80c2019-05-16 19:39:54 +02001497 case PSA_KEY_TYPE_RSA_KEY_PAIR:
Gilles Peskineb699f072019-04-26 16:06:02 +02001498 case PSA_KEY_TYPE_RSA_PUBLIC_KEY:
Gilles Peskinedc5bfe92019-07-24 19:09:30 +02001499#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Janos Follath1d57a202019-08-13 12:15:34 +01001500 /* TODO: reporting the public exponent for opaque keys
Gilles Peskinec9d7f942019-08-13 16:17:16 +02001501 * is not yet implemented.
1502 * https://github.com/ARMmbed/mbed-crypto/issues/216
1503 */
Gilles Peskinec8000c02019-08-02 20:15:51 +02001504 if( psa_key_slot_is_external( slot ) )
Gilles Peskinedc5bfe92019-07-24 19:09:30 +02001505 break;
1506#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Steven Cooremana01795d2020-07-24 22:48:15 +02001507 {
Steven Cooremana2371e52020-07-28 14:30:39 +02001508 mbedtls_rsa_context *rsa = NULL;
Steven Cooremana01795d2020-07-24 22:48:15 +02001509
Steven Cooreman4fed4552020-08-03 14:46:03 +02001510 status = psa_load_rsa_representation( slot->attr.type,
1511 slot->data.key.data,
Steven Cooreman7f391872020-07-30 14:57:44 +02001512 slot->data.key.bytes,
Steven Cooreman7f391872020-07-30 14:57:44 +02001513 &rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02001514 if( status != PSA_SUCCESS )
1515 break;
1516
Steven Cooremana2371e52020-07-28 14:30:39 +02001517 status = psa_get_rsa_public_exponent( rsa,
Steven Cooremana01795d2020-07-24 22:48:15 +02001518 attributes );
Steven Cooremana2371e52020-07-28 14:30:39 +02001519 mbedtls_rsa_free( rsa );
1520 mbedtls_free( rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02001521 }
Gilles Peskineb699f072019-04-26 16:06:02 +02001522 break;
Gilles Peskinedc5bfe92019-07-24 19:09:30 +02001523#endif /* MBEDTLS_RSA_C */
Gilles Peskineb699f072019-04-26 16:06:02 +02001524 default:
1525 /* Nothing else to do. */
1526 break;
1527 }
1528
1529 if( status != PSA_SUCCESS )
1530 psa_reset_key_attributes( attributes );
1531 return( status );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001532}
1533
Gilles Peskinec8000c02019-08-02 20:15:51 +02001534#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1535psa_status_t psa_get_key_slot_number(
1536 const psa_key_attributes_t *attributes,
1537 psa_key_slot_number_t *slot_number )
1538{
1539 if( attributes->core.flags & MBEDTLS_PSA_KA_FLAG_HAS_SLOT_NUMBER )
1540 {
1541 *slot_number = attributes->slot_number;
1542 return( PSA_SUCCESS );
1543 }
1544 else
1545 return( PSA_ERROR_INVALID_ARGUMENT );
1546}
1547#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1548
Steven Cooremana01795d2020-07-24 22:48:15 +02001549static psa_status_t psa_internal_export_key_buffer( const psa_key_slot_t *slot,
1550 uint8_t *data,
1551 size_t data_size,
1552 size_t *data_length )
1553{
1554 if( slot->data.key.bytes > data_size )
1555 return( PSA_ERROR_BUFFER_TOO_SMALL );
1556 memcpy( data, slot->data.key.data, slot->data.key.bytes );
1557 memset( data + slot->data.key.bytes, 0,
1558 data_size - slot->data.key.bytes );
1559 *data_length = slot->data.key.bytes;
1560 return( PSA_SUCCESS );
1561}
1562
Gilles Peskinef603c712019-01-19 13:40:11 +01001563static psa_status_t psa_internal_export_key( const psa_key_slot_t *slot,
1564 uint8_t *data,
1565 size_t data_size,
1566 size_t *data_length,
1567 int export_public_key )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001568{
Gilles Peskine5d309672019-07-12 23:47:28 +02001569#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1570 const psa_drv_se_t *drv;
1571 psa_drv_se_context_t *drv_context;
1572#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1573
Jaeden Amerof24c7f82018-06-27 17:20:43 +01001574 *data_length = 0;
1575
Gilles Peskine8e338702019-07-30 20:06:31 +02001576 if( export_public_key && ! PSA_KEY_TYPE_IS_ASYMMETRIC( slot->attr.type ) )
Moran Pekera998bc62018-04-16 18:16:20 +03001577 return( PSA_ERROR_INVALID_ARGUMENT );
mohammad160306e79202018-03-28 13:17:44 +03001578
Gilles Peskinef9168942019-09-12 19:20:29 +02001579 /* Reject a zero-length output buffer now, since this can never be a
1580 * valid key representation. This way we know that data must be a valid
1581 * pointer and we can do things like memset(data, ..., data_size). */
1582 if( data_size == 0 )
1583 return( PSA_ERROR_BUFFER_TOO_SMALL );
1584
Gilles Peskine5d309672019-07-12 23:47:28 +02001585#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine8e338702019-07-30 20:06:31 +02001586 if( psa_get_se_driver( slot->attr.lifetime, &drv, &drv_context ) )
Gilles Peskine5d309672019-07-12 23:47:28 +02001587 {
1588 psa_drv_se_export_key_t method;
1589 if( drv->key_management == NULL )
1590 return( PSA_ERROR_NOT_SUPPORTED );
1591 method = ( export_public_key ?
1592 drv->key_management->p_export_public :
1593 drv->key_management->p_export );
1594 if( method == NULL )
1595 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine2e0f3882019-07-25 11:34:33 +02001596 return( method( drv_context,
1597 slot->data.se.slot_number,
1598 data, data_size, data_length ) );
Gilles Peskine5d309672019-07-12 23:47:28 +02001599 }
1600#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1601
Gilles Peskine8e338702019-07-30 20:06:31 +02001602 if( key_type_is_raw_bytes( slot->attr.type ) )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001603 {
Steven Cooremanacda8342020-07-24 23:09:52 +02001604 return( psa_internal_export_key_buffer( slot, data, data_size, data_length ) );
Gilles Peskine188c71e2018-10-29 19:26:02 +01001605 }
Steven Cooreman560c28a2020-07-24 23:20:24 +02001606 else if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) ||
1607 PSA_KEY_TYPE_IS_ECC( slot->attr.type ) )
Moran Peker17e36e12018-05-02 12:55:20 +03001608 {
Steven Cooreman560c28a2020-07-24 23:20:24 +02001609 if( PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->attr.type ) )
Gilles Peskine969ac722018-01-28 18:16:59 +01001610 {
Steven Cooreman560c28a2020-07-24 23:20:24 +02001611 /* Exporting public -> public */
1612 return( psa_internal_export_key_buffer( slot, data, data_size, data_length ) );
1613 }
1614 else if( !export_public_key )
1615 {
1616 /* Exporting private -> private */
1617 return( psa_internal_export_key_buffer( slot, data, data_size, data_length ) );
1618 }
1619 /* Need to export the public part of a private key,
1620 * so conversion is needed */
1621 if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
1622 {
Darryl Green9e2d7a02018-07-24 16:33:30 +01001623#if defined(MBEDTLS_RSA_C)
Steven Cooremana2371e52020-07-28 14:30:39 +02001624 mbedtls_rsa_context *rsa = NULL;
Steven Cooreman7f391872020-07-30 14:57:44 +02001625 psa_status_t status = psa_load_rsa_representation(
Steven Cooreman4fed4552020-08-03 14:46:03 +02001626 slot->attr.type,
Steven Cooreman7f391872020-07-30 14:57:44 +02001627 slot->data.key.data,
1628 slot->data.key.bytes,
Steven Cooreman7f391872020-07-30 14:57:44 +02001629 &rsa );
Steven Cooreman560c28a2020-07-24 23:20:24 +02001630 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02001631 return( status );
Steven Cooremana01795d2020-07-24 22:48:15 +02001632
Steven Cooreman560c28a2020-07-24 23:20:24 +02001633 status = psa_export_rsa_key( PSA_KEY_TYPE_RSA_PUBLIC_KEY,
Steven Cooremana2371e52020-07-28 14:30:39 +02001634 rsa,
Steven Cooreman560c28a2020-07-24 23:20:24 +02001635 data,
1636 data_size,
1637 data_length );
Steven Cooremana01795d2020-07-24 22:48:15 +02001638
Steven Cooremana2371e52020-07-28 14:30:39 +02001639 mbedtls_rsa_free( rsa );
1640 mbedtls_free( rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02001641
Steven Cooreman560c28a2020-07-24 23:20:24 +02001642 return( status );
Darryl Green9e2d7a02018-07-24 16:33:30 +01001643#else
Steven Cooreman560c28a2020-07-24 23:20:24 +02001644 /* We don't know how to convert a private RSA key to public. */
1645 return( PSA_ERROR_NOT_SUPPORTED );
Darryl Green9e2d7a02018-07-24 16:33:30 +01001646#endif
Gilles Peskine969ac722018-01-28 18:16:59 +01001647 }
1648 else
Moran Pekera998bc62018-04-16 18:16:20 +03001649 {
Steven Cooreman560c28a2020-07-24 23:20:24 +02001650#if defined(MBEDTLS_ECP_C)
Steven Cooremana2371e52020-07-28 14:30:39 +02001651 mbedtls_ecp_keypair *ecp = NULL;
Steven Cooreman7f391872020-07-30 14:57:44 +02001652 psa_status_t status = psa_load_ecp_representation(
Steven Cooreman4fed4552020-08-03 14:46:03 +02001653 slot->attr.type,
Steven Cooreman7f391872020-07-30 14:57:44 +02001654 slot->data.key.data,
1655 slot->data.key.bytes,
Steven Cooreman7f391872020-07-30 14:57:44 +02001656 &ecp );
Steven Cooreman560c28a2020-07-24 23:20:24 +02001657 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02001658 return( status );
Steven Cooreman560c28a2020-07-24 23:20:24 +02001659
1660 status = psa_export_ecp_key( PSA_KEY_TYPE_ECC_PUBLIC_KEY(
1661 PSA_KEY_TYPE_ECC_GET_FAMILY(
1662 slot->attr.type ) ),
Steven Cooremana2371e52020-07-28 14:30:39 +02001663 ecp,
Steven Cooreman560c28a2020-07-24 23:20:24 +02001664 data,
1665 data_size,
1666 data_length );
1667
Steven Cooremana2371e52020-07-28 14:30:39 +02001668 mbedtls_ecp_keypair_free( ecp );
1669 mbedtls_free( ecp );
Steven Cooreman560c28a2020-07-24 23:20:24 +02001670 return( status );
1671#else
1672 /* We don't know how to convert a private ECC key to public */
Moran Pekera998bc62018-04-16 18:16:20 +03001673 return( PSA_ERROR_NOT_SUPPORTED );
Steven Cooreman560c28a2020-07-24 23:20:24 +02001674#endif
Moran Pekera998bc62018-04-16 18:16:20 +03001675 }
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001676 }
Steven Cooreman560c28a2020-07-24 23:20:24 +02001677 else
1678 {
1679 /* This shouldn't happen in the reference implementation, but
1680 it is valid for a special-purpose implementation to omit
1681 support for exporting certain key types. */
1682 return( PSA_ERROR_NOT_SUPPORTED );
1683 }
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001684}
1685
Ronald Croncf56a0a2020-08-04 09:51:30 +02001686psa_status_t psa_export_key( mbedtls_svc_key_id_t key,
Gilles Peskine2d277862018-06-18 15:41:12 +02001687 uint8_t *data,
1688 size_t data_size,
1689 size_t *data_length )
Moran Pekera998bc62018-04-16 18:16:20 +03001690{
Gilles Peskine2f060a82018-12-04 17:12:32 +01001691 psa_key_slot_t *slot;
Darryl Greendd8fb772018-11-07 16:00:44 +00001692 psa_status_t status;
1693
1694 /* Set the key to empty now, so that even when there are errors, we always
1695 * set data_length to a value between 0 and data_size. On error, setting
1696 * the key to empty is a good choice because an empty key representation is
1697 * unlikely to be accepted anywhere. */
1698 *data_length = 0;
1699
1700 /* Export requires the EXPORT flag. There is an exception for public keys,
1701 * which don't require any flag, but psa_get_key_from_slot takes
1702 * care of this. */
Ronald Croncf56a0a2020-08-04 09:51:30 +02001703 status = psa_get_key_from_slot( key, &slot, PSA_KEY_USAGE_EXPORT, 0 );
Darryl Greendd8fb772018-11-07 16:00:44 +00001704 if( status != PSA_SUCCESS )
1705 return( status );
1706 return( psa_internal_export_key( slot, data, data_size,
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001707 data_length, 0 ) );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001708}
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001709
Ronald Croncf56a0a2020-08-04 09:51:30 +02001710psa_status_t psa_export_public_key( mbedtls_svc_key_id_t key,
Gilles Peskine2d277862018-06-18 15:41:12 +02001711 uint8_t *data,
1712 size_t data_size,
1713 size_t *data_length )
Moran Pekerdd4ea382018-04-03 15:30:03 +03001714{
Gilles Peskine2f060a82018-12-04 17:12:32 +01001715 psa_key_slot_t *slot;
Darryl Greendd8fb772018-11-07 16:00:44 +00001716 psa_status_t status;
1717
1718 /* Set the key to empty now, so that even when there are errors, we always
1719 * set data_length to a value between 0 and data_size. On error, setting
1720 * the key to empty is a good choice because an empty key representation is
1721 * unlikely to be accepted anywhere. */
1722 *data_length = 0;
1723
1724 /* Exporting a public key doesn't require a usage flag. */
Ronald Croncf56a0a2020-08-04 09:51:30 +02001725 status = psa_get_key_from_slot( key, &slot, 0, 0 );
Darryl Greendd8fb772018-11-07 16:00:44 +00001726 if( status != PSA_SUCCESS )
1727 return( status );
1728 return( psa_internal_export_key( slot, data, data_size,
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001729 data_length, 1 ) );
Moran Pekerdd4ea382018-04-03 15:30:03 +03001730}
1731
Gilles Peskine91e8c332019-08-02 19:19:39 +02001732#if defined(static_assert)
1733static_assert( ( MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE ) == 0,
1734 "One or more key attribute flag is listed as both external-only and dual-use" );
Gilles Peskine5a680562019-08-05 17:32:13 +02001735static_assert( ( PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE ) == 0,
Gilles Peskine094dac12019-08-07 18:19:46 +02001736 "One or more key attribute flag is listed as both internal-only and dual-use" );
Gilles Peskine5a680562019-08-05 17:32:13 +02001737static_assert( ( PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY ) == 0,
Gilles Peskine91e8c332019-08-02 19:19:39 +02001738 "One or more key attribute flag is listed as both internal-only and external-only" );
1739#endif
1740
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001741/** Validate that a key policy is internally well-formed.
1742 *
1743 * This function only rejects invalid policies. It does not validate the
1744 * consistency of the policy with respect to other attributes of the key
1745 * such as the key type.
1746 */
1747static psa_status_t psa_validate_key_policy( const psa_key_policy_t *policy )
Gilles Peskine4747d192019-04-17 15:05:45 +02001748{
1749 if( ( policy->usage & ~( PSA_KEY_USAGE_EXPORT |
Gilles Peskine8e0206a2019-05-14 14:24:28 +02001750 PSA_KEY_USAGE_COPY |
Gilles Peskine4747d192019-04-17 15:05:45 +02001751 PSA_KEY_USAGE_ENCRYPT |
1752 PSA_KEY_USAGE_DECRYPT |
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01001753 PSA_KEY_USAGE_SIGN_HASH |
1754 PSA_KEY_USAGE_VERIFY_HASH |
Gilles Peskine4747d192019-04-17 15:05:45 +02001755 PSA_KEY_USAGE_DERIVE ) ) != 0 )
1756 return( PSA_ERROR_INVALID_ARGUMENT );
1757
Gilles Peskine4747d192019-04-17 15:05:45 +02001758 return( PSA_SUCCESS );
1759}
1760
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001761/** Validate the internal consistency of key attributes.
1762 *
1763 * This function only rejects invalid attribute values. If does not
1764 * validate the consistency of the attributes with any key data that may
1765 * be involved in the creation of the key.
1766 *
1767 * Call this function early in the key creation process.
1768 *
1769 * \param[in] attributes Key attributes for the new key.
1770 * \param[out] p_drv On any return, the driver for the key, if any.
1771 * NULL for a transparent key.
1772 *
1773 */
1774static psa_status_t psa_validate_key_attributes(
1775 const psa_key_attributes_t *attributes,
1776 psa_se_drv_table_entry_t **p_drv )
Darryl Green0c6575a2018-11-07 16:05:30 +00001777{
Steven Cooreman81fe7c32020-06-08 18:37:19 +02001778 psa_status_t status = PSA_ERROR_INVALID_ARGUMENT;
Ronald Crond2ed4812020-07-17 16:11:30 +02001779 psa_key_lifetime_t lifetime = psa_get_key_lifetime( attributes );
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001780
Steven Cooreman8c1e7592020-06-17 14:52:05 +02001781 status = psa_validate_key_location( psa_get_key_lifetime( attributes ),
1782 p_drv );
Steven Cooreman81fe7c32020-06-08 18:37:19 +02001783 if( status != PSA_SUCCESS )
1784 return( status );
1785
Ronald Crond2ed4812020-07-17 16:11:30 +02001786 status = psa_validate_key_persistence( lifetime );
Steven Cooreman81fe7c32020-06-08 18:37:19 +02001787 if( status != PSA_SUCCESS )
1788 return( status );
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001789
Ronald Crond2ed4812020-07-17 16:11:30 +02001790 /* Validate the key identifier only in the case of a persistent key. */
1791 if ( ! PSA_KEY_LIFETIME_IS_VOLATILE( lifetime ) )
1792 {
1793 status = psa_validate_key_id(
1794 psa_get_key_id( attributes ),
Ronald Cronfc9c5562020-10-15 19:24:49 +02001795 psa_key_lifetime_is_external( lifetime ), 0 );
Ronald Crond2ed4812020-07-17 16:11:30 +02001796
1797 if( status != PSA_SUCCESS )
1798 return( status );
1799 }
1800
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001801 status = psa_validate_key_policy( &attributes->core.policy );
Darryl Green0c6575a2018-11-07 16:05:30 +00001802 if( status != PSA_SUCCESS )
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001803 return( status );
1804
1805 /* Refuse to create overly large keys.
1806 * Note that this doesn't trigger on import if the attributes don't
1807 * explicitly specify a size (so psa_get_key_bits returns 0), so
1808 * psa_import_key() needs its own checks. */
1809 if( psa_get_key_bits( attributes ) > PSA_MAX_KEY_BITS )
1810 return( PSA_ERROR_NOT_SUPPORTED );
1811
Gilles Peskine91e8c332019-08-02 19:19:39 +02001812 /* Reject invalid flags. These should not be reachable through the API. */
1813 if( attributes->core.flags & ~ ( MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY |
1814 MBEDTLS_PSA_KA_MASK_DUAL_USE ) )
1815 return( PSA_ERROR_INVALID_ARGUMENT );
1816
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001817 return( PSA_SUCCESS );
1818}
1819
Gilles Peskine4747d192019-04-17 15:05:45 +02001820/** Prepare a key slot to receive key material.
1821 *
1822 * This function allocates a key slot and sets its metadata.
1823 *
1824 * If this function fails, call psa_fail_key_creation().
1825 *
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001826 * This function is intended to be used as follows:
1827 * -# Call psa_start_key_creation() to allocate a key slot, prepare
Ronald Croncf56a0a2020-08-04 09:51:30 +02001828 * it with the specified attributes, and in case of a volatile key assign it
1829 * a volatile key identifier.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001830 * -# Populate the slot with the key material.
1831 * -# Call psa_finish_key_creation() to finalize the creation of the slot.
1832 * In case of failure at any step, stop the sequence and call
1833 * psa_fail_key_creation().
1834 *
Gilles Peskinedf179142019-07-15 22:02:14 +02001835 * \param method An identification of the calling function.
Gilles Peskine011e4282019-06-26 18:34:38 +02001836 * \param[in] attributes Key attributes for the new key.
Ronald Cron3c76a422020-10-16 12:17:04 +02001837 * \param[out] key On success, identifier of the key. Note that the
1838 * key identifier is also stored in the prepared
1839 * slot.
Gilles Peskine011e4282019-06-26 18:34:38 +02001840 * \param[out] p_slot On success, a pointer to the prepared slot.
1841 * \param[out] p_drv On any return, the driver for the key, if any.
1842 * NULL for a transparent key.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001843 *
1844 * \retval #PSA_SUCCESS
1845 * The key slot is ready to receive key material.
1846 * \return If this function fails, the key slot is an invalid state.
1847 * You must call psa_fail_key_creation() to wipe and free the slot.
Gilles Peskine4747d192019-04-17 15:05:45 +02001848 */
1849static psa_status_t psa_start_key_creation(
Gilles Peskinedf179142019-07-15 22:02:14 +02001850 psa_key_creation_method_t method,
Gilles Peskine4747d192019-04-17 15:05:45 +02001851 const psa_key_attributes_t *attributes,
Ronald Croncf56a0a2020-08-04 09:51:30 +02001852 mbedtls_svc_key_id_t *key,
Gilles Peskine011e4282019-06-26 18:34:38 +02001853 psa_key_slot_t **p_slot,
Gilles Peskine8abe6a22019-07-12 23:40:35 +02001854 psa_se_drv_table_entry_t **p_drv )
Gilles Peskine4747d192019-04-17 15:05:45 +02001855{
1856 psa_status_t status;
Ronald Cron2a993152020-07-17 14:13:26 +02001857 psa_key_id_t volatile_key_id;
Gilles Peskine4747d192019-04-17 15:05:45 +02001858 psa_key_slot_t *slot;
1859
Gilles Peskinedf179142019-07-15 22:02:14 +02001860 (void) method;
Gilles Peskine011e4282019-06-26 18:34:38 +02001861 *p_drv = NULL;
1862
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001863 status = psa_validate_key_attributes( attributes, p_drv );
1864 if( status != PSA_SUCCESS )
1865 return( status );
1866
Ronald Cronc4d1b512020-07-31 11:26:37 +02001867 status = psa_get_empty_key_slot( &volatile_key_id, p_slot );
Gilles Peskine4747d192019-04-17 15:05:45 +02001868 if( status != PSA_SUCCESS )
1869 return( status );
1870 slot = *p_slot;
1871
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001872 /* We're storing the declared bit-size of the key. It's up to each
1873 * creation mechanism to verify that this information is correct.
1874 * It's automatically correct for mechanisms that use the bit-size as
Gilles Peskineb46bef22019-07-30 21:32:04 +02001875 * an input (generate, device) but not for those where the bit-size
Ronald Cronc4d1b512020-07-31 11:26:37 +02001876 * is optional (import, copy). In case of a volatile key, assign it the
1877 * volatile key identifier associated to the slot returned to contain its
1878 * definition. */
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001879
1880 slot->attr = attributes->core;
Ronald Cronc4d1b512020-07-31 11:26:37 +02001881 if( PSA_KEY_LIFETIME_IS_VOLATILE( slot->attr.lifetime ) )
1882 {
1883#if !defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER)
1884 slot->attr.id = volatile_key_id;
1885#else
1886 slot->attr.id.key_id = volatile_key_id;
1887#endif
1888 }
Gilles Peskinec744d992019-07-30 17:26:54 +02001889
Gilles Peskine91e8c332019-08-02 19:19:39 +02001890 /* Erase external-only flags from the internal copy. To access
Gilles Peskine013f5472019-08-07 15:42:14 +02001891 * external-only flags, query `attributes`. Thanks to the check
1892 * in psa_validate_key_attributes(), this leaves the dual-use
Gilles Peskineedbed562019-08-07 18:19:59 +02001893 * flags and any internal flag that psa_get_empty_key_slot()
Gilles Peskine013f5472019-08-07 15:42:14 +02001894 * may have set. */
1895 slot->attr.flags &= ~MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY;
Gilles Peskine91e8c332019-08-02 19:19:39 +02001896
Gilles Peskinecbaff462019-07-12 23:46:04 +02001897#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined7729582019-08-05 15:55:54 +02001898 /* For a key in a secure element, we need to do three things
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001899 * when creating or registering a persistent key:
Gilles Peskine60450a42019-07-25 11:32:45 +02001900 * create the key file in internal storage, create the
1901 * key inside the secure element, and update the driver's
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001902 * persistent data. This is done by starting a transaction that will
1903 * encompass these three actions.
1904 * For registering a volatile key, we just need to find an appropriate
1905 * slot number inside the SE. Since the key is designated volatile, creating
1906 * a transaction is not required. */
Gilles Peskine60450a42019-07-25 11:32:45 +02001907 /* The first thing to do is to find a slot number for the new key.
1908 * We save the slot number in persistent storage as part of the
1909 * transaction data. It will be needed to recover if the power
1910 * fails during the key creation process, to clean up on the secure
1911 * element side after restarting. Obtaining a slot number from the
1912 * secure element driver updates its persistent state, but we do not yet
1913 * save the driver's persistent state, so that if the power fails,
Gilles Peskinefc762652019-07-22 19:30:34 +02001914 * we can roll back to a state where the key doesn't exist. */
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001915 if( *p_drv != NULL )
Darryl Green0c6575a2018-11-07 16:05:30 +00001916 {
Gilles Peskinee88c2c12019-08-05 16:44:14 +02001917 status = psa_find_se_slot_for_key( attributes, method, *p_drv,
Gilles Peskinecbaff462019-07-12 23:46:04 +02001918 &slot->data.se.slot_number );
1919 if( status != PSA_SUCCESS )
1920 return( status );
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001921
1922 if( ! PSA_KEY_LIFETIME_IS_VOLATILE( attributes->core.lifetime ) )
Gilles Peskine66be51c2019-07-25 18:02:52 +02001923 {
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001924 psa_crypto_prepare_transaction( PSA_CRYPTO_TRANSACTION_CREATE_KEY );
1925 psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
1926 psa_crypto_transaction.key.slot = slot->data.se.slot_number;
1927 psa_crypto_transaction.key.id = slot->attr.id;
1928 status = psa_crypto_save_transaction( );
1929 if( status != PSA_SUCCESS )
1930 {
1931 (void) psa_crypto_stop_transaction( );
1932 return( status );
1933 }
Gilles Peskine66be51c2019-07-25 18:02:52 +02001934 }
Darryl Green0c6575a2018-11-07 16:05:30 +00001935 }
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001936
1937 if( *p_drv == NULL && method == PSA_KEY_CREATION_REGISTER )
1938 {
1939 /* Key registration only makes sense with a secure element. */
1940 return( PSA_ERROR_INVALID_ARGUMENT );
1941 }
Gilles Peskinecbaff462019-07-12 23:46:04 +02001942#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1943
Ronald Croncf56a0a2020-08-04 09:51:30 +02001944 *key = slot->attr.id;
Ronald Cronc4d1b512020-07-31 11:26:37 +02001945
1946 return( PSA_SUCCESS );
Darryl Green0c6575a2018-11-07 16:05:30 +00001947}
Gilles Peskine4747d192019-04-17 15:05:45 +02001948
1949/** Finalize the creation of a key once its key material has been set.
1950 *
1951 * This entails writing the key to persistent storage.
1952 *
1953 * If this function fails, call psa_fail_key_creation().
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001954 * See the documentation of psa_start_key_creation() for the intended use
1955 * of this function.
Gilles Peskine4747d192019-04-17 15:05:45 +02001956 *
Gilles Peskine011e4282019-06-26 18:34:38 +02001957 * \param[in,out] slot Pointer to the slot with key material.
1958 * \param[in] driver The secure element driver for the key,
1959 * or NULL for a transparent key.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001960 *
1961 * \retval #PSA_SUCCESS
Ronald Croncf56a0a2020-08-04 09:51:30 +02001962 * The key was successfully created.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001963 * \return If this function fails, the key slot is an invalid state.
1964 * You must call psa_fail_key_creation() to wipe and free the slot.
Gilles Peskine4747d192019-04-17 15:05:45 +02001965 */
Gilles Peskine011e4282019-06-26 18:34:38 +02001966static psa_status_t psa_finish_key_creation(
1967 psa_key_slot_t *slot,
Gilles Peskine8abe6a22019-07-12 23:40:35 +02001968 psa_se_drv_table_entry_t *driver )
Gilles Peskine4747d192019-04-17 15:05:45 +02001969{
1970 psa_status_t status = PSA_SUCCESS;
Gilles Peskine30afafd2019-04-25 13:47:40 +02001971 (void) slot;
Gilles Peskine011e4282019-06-26 18:34:38 +02001972 (void) driver;
Gilles Peskine4747d192019-04-17 15:05:45 +02001973
1974#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Steven Cooremanc59de6a2020-06-08 18:28:25 +02001975 if( ! PSA_KEY_LIFETIME_IS_VOLATILE( slot->attr.lifetime ) )
Gilles Peskine4747d192019-04-17 15:05:45 +02001976 {
Gilles Peskine1df83d42019-07-23 16:13:14 +02001977#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1978 if( driver != NULL )
1979 {
Gilles Peskineb46bef22019-07-30 21:32:04 +02001980 psa_se_key_data_storage_t data;
1981#if defined(static_assert)
1982 static_assert( sizeof( slot->data.se.slot_number ) ==
1983 sizeof( data.slot_number ),
1984 "Slot number size does not match psa_se_key_data_storage_t" );
Gilles Peskineb46bef22019-07-30 21:32:04 +02001985#endif
1986 memcpy( &data.slot_number, &slot->data.se.slot_number,
1987 sizeof( slot->data.se.slot_number ) );
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001988 status = psa_save_persistent_key( &slot->attr,
Gilles Peskineb46bef22019-07-30 21:32:04 +02001989 (uint8_t*) &data,
1990 sizeof( data ) );
Gilles Peskine1df83d42019-07-23 16:13:14 +02001991 }
1992 else
1993#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1994 {
Steven Cooreman40120f62020-10-29 11:42:22 +01001995 /* Key material is saved in export representation in the slot, so
1996 * just pass the slot buffer for storage. */
1997 status = psa_save_persistent_key( &slot->attr,
1998 slot->data.key.data,
1999 slot->data.key.bytes );
Gilles Peskine1df83d42019-07-23 16:13:14 +02002000 }
Gilles Peskine4747d192019-04-17 15:05:45 +02002001 }
Darryl Green0c6575a2018-11-07 16:05:30 +00002002#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
2003
Gilles Peskinecbaff462019-07-12 23:46:04 +02002004#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined7729582019-08-05 15:55:54 +02002005 /* Finish the transaction for a key creation. This does not
2006 * happen when registering an existing key. Detect this case
2007 * by checking whether a transaction is in progress (actual
Steven Cooremanbbeaf182020-06-08 18:29:44 +02002008 * creation of a persistent key in a secure element requires a transaction,
2009 * but registration or volatile key creation doesn't use one). */
Gilles Peskined7729582019-08-05 15:55:54 +02002010 if( driver != NULL &&
2011 psa_crypto_transaction.unknown.type == PSA_CRYPTO_TRANSACTION_CREATE_KEY )
Gilles Peskinecbaff462019-07-12 23:46:04 +02002012 {
2013 status = psa_save_se_persistent_data( driver );
2014 if( status != PSA_SUCCESS )
2015 {
Gilles Peskine8e338702019-07-30 20:06:31 +02002016 psa_destroy_persistent_key( slot->attr.id );
Gilles Peskinecbaff462019-07-12 23:46:04 +02002017 return( status );
2018 }
Gilles Peskinefc762652019-07-22 19:30:34 +02002019 status = psa_crypto_stop_transaction( );
2020 if( status != PSA_SUCCESS )
2021 return( status );
Gilles Peskinecbaff462019-07-12 23:46:04 +02002022 }
2023#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
2024
Gilles Peskine4747d192019-04-17 15:05:45 +02002025 return( status );
2026}
2027
2028/** Abort the creation of a key.
2029 *
2030 * You may call this function after calling psa_start_key_creation(),
2031 * or after psa_finish_key_creation() fails. In other circumstances, this
2032 * function may not clean up persistent storage.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02002033 * See the documentation of psa_start_key_creation() for the intended use
2034 * of this function.
Gilles Peskine4747d192019-04-17 15:05:45 +02002035 *
Gilles Peskine011e4282019-06-26 18:34:38 +02002036 * \param[in,out] slot Pointer to the slot with key material.
2037 * \param[in] driver The secure element driver for the key,
2038 * or NULL for a transparent key.
Gilles Peskine4747d192019-04-17 15:05:45 +02002039 */
Gilles Peskine011e4282019-06-26 18:34:38 +02002040static void psa_fail_key_creation( psa_key_slot_t *slot,
Gilles Peskine8abe6a22019-07-12 23:40:35 +02002041 psa_se_drv_table_entry_t *driver )
Gilles Peskine4747d192019-04-17 15:05:45 +02002042{
Gilles Peskine011e4282019-06-26 18:34:38 +02002043 (void) driver;
2044
Gilles Peskine4747d192019-04-17 15:05:45 +02002045 if( slot == NULL )
2046 return;
Gilles Peskine011e4282019-06-26 18:34:38 +02002047
2048#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Janos Follath1d57a202019-08-13 12:15:34 +01002049 /* TODO: If the key has already been created in the secure
Gilles Peskine011e4282019-06-26 18:34:38 +02002050 * element, and the failure happened later (when saving metadata
2051 * to internal storage), we need to destroy the key in the secure
Gilles Peskinec9d7f942019-08-13 16:17:16 +02002052 * element.
2053 * https://github.com/ARMmbed/mbed-crypto/issues/217
2054 */
Gilles Peskinefc762652019-07-22 19:30:34 +02002055
Gilles Peskined7729582019-08-05 15:55:54 +02002056 /* Abort the ongoing transaction if any (there may not be one if
2057 * the creation process failed before starting one, or if the
2058 * key creation is a registration of a key in a secure element).
2059 * Earlier functions must already have done what it takes to undo any
2060 * partial creation. All that's left is to update the transaction data
2061 * itself. */
Gilles Peskinefc762652019-07-22 19:30:34 +02002062 (void) psa_crypto_stop_transaction( );
Gilles Peskine011e4282019-06-26 18:34:38 +02002063#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
2064
Gilles Peskine4747d192019-04-17 15:05:45 +02002065 psa_wipe_key_slot( slot );
2066}
2067
Gilles Peskine1b8594a2019-07-31 17:21:46 +02002068/** Validate optional attributes during key creation.
2069 *
2070 * Some key attributes are optional during key creation. If they are
2071 * specified in the attributes structure, check that they are consistent
2072 * with the data in the slot.
2073 *
2074 * This function should be called near the end of key creation, after
2075 * the slot in memory is fully populated but before saving persistent data.
2076 */
2077static psa_status_t psa_validate_optional_attributes(
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002078 const psa_key_slot_t *slot,
2079 const psa_key_attributes_t *attributes )
2080{
Gilles Peskine7e0cff92019-07-30 13:48:52 +02002081 if( attributes->core.type != 0 )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002082 {
Gilles Peskine8e338702019-07-30 20:06:31 +02002083 if( attributes->core.type != slot->attr.type )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002084 return( PSA_ERROR_INVALID_ARGUMENT );
2085 }
2086
2087 if( attributes->domain_parameters_size != 0 )
2088 {
2089#if defined(MBEDTLS_RSA_C)
Gilles Peskine8e338702019-07-30 20:06:31 +02002090 if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002091 {
Steven Cooremana2371e52020-07-28 14:30:39 +02002092 mbedtls_rsa_context *rsa = NULL;
Steven Cooreman75b74362020-07-28 14:30:13 +02002093 mbedtls_mpi actual, required;
Steven Cooreman6d839f02020-07-30 11:36:45 +02002094 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Steven Cooremana01795d2020-07-24 22:48:15 +02002095
Steven Cooreman7f391872020-07-30 14:57:44 +02002096 psa_status_t status = psa_load_rsa_representation(
Steven Cooreman4fed4552020-08-03 14:46:03 +02002097 slot->attr.type,
Steven Cooreman7f391872020-07-30 14:57:44 +02002098 slot->data.key.data,
2099 slot->data.key.bytes,
Steven Cooreman7f391872020-07-30 14:57:44 +02002100 &rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02002101 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02002102 return( status );
Steven Cooreman75b74362020-07-28 14:30:13 +02002103
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002104 mbedtls_mpi_init( &actual );
2105 mbedtls_mpi_init( &required );
Steven Cooremana2371e52020-07-28 14:30:39 +02002106 ret = mbedtls_rsa_export( rsa,
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002107 NULL, NULL, NULL, NULL, &actual );
Steven Cooremana2371e52020-07-28 14:30:39 +02002108 mbedtls_rsa_free( rsa );
2109 mbedtls_free( rsa );
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002110 if( ret != 0 )
2111 goto rsa_exit;
2112 ret = mbedtls_mpi_read_binary( &required,
2113 attributes->domain_parameters,
2114 attributes->domain_parameters_size );
2115 if( ret != 0 )
2116 goto rsa_exit;
2117 if( mbedtls_mpi_cmp_mpi( &actual, &required ) != 0 )
2118 ret = MBEDTLS_ERR_RSA_BAD_INPUT_DATA;
2119 rsa_exit:
2120 mbedtls_mpi_free( &actual );
2121 mbedtls_mpi_free( &required );
2122 if( ret != 0)
2123 return( mbedtls_to_psa_error( ret ) );
2124 }
2125 else
2126#endif
2127 {
2128 return( PSA_ERROR_INVALID_ARGUMENT );
2129 }
2130 }
2131
Gilles Peskine7e0cff92019-07-30 13:48:52 +02002132 if( attributes->core.bits != 0 )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002133 {
Gilles Peskineb46bef22019-07-30 21:32:04 +02002134 if( attributes->core.bits != slot->attr.bits )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002135 return( PSA_ERROR_INVALID_ARGUMENT );
2136 }
2137
2138 return( PSA_SUCCESS );
2139}
2140
Gilles Peskine4747d192019-04-17 15:05:45 +02002141psa_status_t psa_import_key( const psa_key_attributes_t *attributes,
Gilles Peskine4747d192019-04-17 15:05:45 +02002142 const uint8_t *data,
Gilles Peskine73676cb2019-05-15 20:15:10 +02002143 size_t data_length,
Ronald Croncf56a0a2020-08-04 09:51:30 +02002144 mbedtls_svc_key_id_t *key )
Gilles Peskine4747d192019-04-17 15:05:45 +02002145{
2146 psa_status_t status;
2147 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02002148 psa_se_drv_table_entry_t *driver = NULL;
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002149
Gilles Peskine0f84d622019-09-12 19:03:13 +02002150 /* Reject zero-length symmetric keys (including raw data key objects).
2151 * This also rejects any key which might be encoded as an empty string,
2152 * which is never valid. */
2153 if( data_length == 0 )
2154 return( PSA_ERROR_INVALID_ARGUMENT );
2155
Gilles Peskinedf179142019-07-15 22:02:14 +02002156 status = psa_start_key_creation( PSA_KEY_CREATION_IMPORT, attributes,
Ronald Croncf56a0a2020-08-04 09:51:30 +02002157 key, &slot, &driver );
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002158 if( status != PSA_SUCCESS )
2159 goto exit;
2160
Gilles Peskine5d309672019-07-12 23:47:28 +02002161#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
2162 if( driver != NULL )
2163 {
2164 const psa_drv_se_t *drv = psa_get_se_driver_methods( driver );
Darryl Green0892d0f2019-08-20 09:50:14 +01002165 /* The driver should set the number of key bits, however in
2166 * case it doesn't, we initialize bits to an invalid value. */
2167 size_t bits = PSA_MAX_KEY_BITS + 1;
Gilles Peskine5d309672019-07-12 23:47:28 +02002168 if( drv->key_management == NULL ||
2169 drv->key_management->p_import == NULL )
2170 {
2171 status = PSA_ERROR_NOT_SUPPORTED;
2172 goto exit;
2173 }
2174 status = drv->key_management->p_import(
2175 psa_get_se_driver_context( driver ),
Gilles Peskinef3801ff2019-08-06 17:32:04 +02002176 slot->data.se.slot_number, attributes, data, data_length,
Gilles Peskineb46bef22019-07-30 21:32:04 +02002177 &bits );
2178 if( status != PSA_SUCCESS )
2179 goto exit;
2180 if( bits > PSA_MAX_KEY_BITS )
2181 {
2182 status = PSA_ERROR_NOT_SUPPORTED;
2183 goto exit;
2184 }
2185 slot->attr.bits = (psa_key_bits_t) bits;
Gilles Peskine5d309672019-07-12 23:47:28 +02002186 }
2187 else
2188#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
2189 {
2190 status = psa_import_key_into_slot( slot, data, data_length );
2191 if( status != PSA_SUCCESS )
2192 goto exit;
Gilles Peskine5d309672019-07-12 23:47:28 +02002193 }
Gilles Peskine1b8594a2019-07-31 17:21:46 +02002194 status = psa_validate_optional_attributes( slot, attributes );
Gilles Peskine18017402019-07-24 20:25:59 +02002195 if( status != PSA_SUCCESS )
2196 goto exit;
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002197
Gilles Peskine011e4282019-06-26 18:34:38 +02002198 status = psa_finish_key_creation( slot, driver );
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002199exit:
Gilles Peskine4747d192019-04-17 15:05:45 +02002200 if( status != PSA_SUCCESS )
2201 {
Gilles Peskine011e4282019-06-26 18:34:38 +02002202 psa_fail_key_creation( slot, driver );
Ronald Croncf56a0a2020-08-04 09:51:30 +02002203 *key = MBEDTLS_SVC_KEY_ID_INIT;
Gilles Peskine4747d192019-04-17 15:05:45 +02002204 }
2205 return( status );
2206}
2207
Gilles Peskined7729582019-08-05 15:55:54 +02002208#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
2209psa_status_t mbedtls_psa_register_se_key(
2210 const psa_key_attributes_t *attributes )
2211{
2212 psa_status_t status;
2213 psa_key_slot_t *slot = NULL;
2214 psa_se_drv_table_entry_t *driver = NULL;
Ronald Croncf56a0a2020-08-04 09:51:30 +02002215 mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT;
Gilles Peskined7729582019-08-05 15:55:54 +02002216
2217 /* Leaving attributes unspecified is not currently supported.
2218 * It could make sense to query the key type and size from the
2219 * secure element, but not all secure elements support this
2220 * and the driver HAL doesn't currently support it. */
2221 if( psa_get_key_type( attributes ) == PSA_KEY_TYPE_NONE )
2222 return( PSA_ERROR_NOT_SUPPORTED );
2223 if( psa_get_key_bits( attributes ) == 0 )
2224 return( PSA_ERROR_NOT_SUPPORTED );
2225
2226 status = psa_start_key_creation( PSA_KEY_CREATION_REGISTER, attributes,
Ronald Croncf56a0a2020-08-04 09:51:30 +02002227 &key, &slot, &driver );
Gilles Peskined7729582019-08-05 15:55:54 +02002228 if( status != PSA_SUCCESS )
2229 goto exit;
2230
Gilles Peskined7729582019-08-05 15:55:54 +02002231 status = psa_finish_key_creation( slot, driver );
2232
2233exit:
2234 if( status != PSA_SUCCESS )
2235 {
2236 psa_fail_key_creation( slot, driver );
2237 }
2238 /* Registration doesn't keep the key in RAM. */
Ronald Croncf56a0a2020-08-04 09:51:30 +02002239 psa_close_key( key );
Gilles Peskined7729582019-08-05 15:55:54 +02002240 return( status );
2241}
2242#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
2243
Gilles Peskinef603c712019-01-19 13:40:11 +01002244static psa_status_t psa_copy_key_material( const psa_key_slot_t *source,
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002245 psa_key_slot_t *target )
Gilles Peskinef603c712019-01-19 13:40:11 +01002246{
Steven Cooremanf7cebd42020-10-13 20:27:40 +02002247 psa_status_t status = psa_copy_key_material_into_slot( target,
2248 source->data.key.data,
2249 source->data.key.bytes );
Gilles Peskinef603c712019-01-19 13:40:11 +01002250 if( status != PSA_SUCCESS )
Steven Cooreman398aee52020-10-13 14:35:45 +02002251 return( status );
Gilles Peskinef603c712019-01-19 13:40:11 +01002252
Steven Cooreman398aee52020-10-13 14:35:45 +02002253 target->attr.type = source->attr.type;
2254 target->attr.bits = source->attr.bits;
2255
2256 return( PSA_SUCCESS );
Gilles Peskinef603c712019-01-19 13:40:11 +01002257}
2258
Ronald Croncf56a0a2020-08-04 09:51:30 +02002259psa_status_t psa_copy_key( mbedtls_svc_key_id_t source_key,
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002260 const psa_key_attributes_t *specified_attributes,
Ronald Croncf56a0a2020-08-04 09:51:30 +02002261 mbedtls_svc_key_id_t *target_key )
Gilles Peskinef603c712019-01-19 13:40:11 +01002262{
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002263 psa_status_t status;
Gilles Peskinef603c712019-01-19 13:40:11 +01002264 psa_key_slot_t *source_slot = NULL;
2265 psa_key_slot_t *target_slot = NULL;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002266 psa_key_attributes_t actual_attributes = *specified_attributes;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02002267 psa_se_drv_table_entry_t *driver = NULL;
Gilles Peskinef603c712019-01-19 13:40:11 +01002268
Ronald Croncf56a0a2020-08-04 09:51:30 +02002269 status = psa_get_transparent_key( source_key, &source_slot,
Gilles Peskinef77a6ac2019-07-25 10:51:03 +02002270 PSA_KEY_USAGE_COPY, 0 );
Gilles Peskinef603c712019-01-19 13:40:11 +01002271 if( status != PSA_SUCCESS )
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002272 goto exit;
2273
Gilles Peskine1b8594a2019-07-31 17:21:46 +02002274 status = psa_validate_optional_attributes( source_slot,
2275 specified_attributes );
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002276 if( status != PSA_SUCCESS )
2277 goto exit;
2278
Gilles Peskine7e0cff92019-07-30 13:48:52 +02002279 status = psa_restrict_key_policy( &actual_attributes.core.policy,
Gilles Peskine8e338702019-07-30 20:06:31 +02002280 &source_slot->attr.policy );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002281 if( status != PSA_SUCCESS )
2282 goto exit;
2283
Gilles Peskinedf179142019-07-15 22:02:14 +02002284 status = psa_start_key_creation( PSA_KEY_CREATION_COPY,
2285 &actual_attributes,
Ronald Croncf56a0a2020-08-04 09:51:30 +02002286 target_key, &target_slot, &driver );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002287 if( status != PSA_SUCCESS )
2288 goto exit;
2289
Gilles Peskinef4ee6622019-07-24 13:44:30 +02002290#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
2291 if( driver != NULL )
Gilles Peskinef603c712019-01-19 13:40:11 +01002292 {
Gilles Peskinef4ee6622019-07-24 13:44:30 +02002293 /* Copying to a secure element is not implemented yet. */
2294 status = PSA_ERROR_NOT_SUPPORTED;
2295 goto exit;
Gilles Peskinef603c712019-01-19 13:40:11 +01002296 }
Gilles Peskinef4ee6622019-07-24 13:44:30 +02002297#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskinef603c712019-01-19 13:40:11 +01002298
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002299 status = psa_copy_key_material( source_slot, target_slot );
Gilles Peskinef603c712019-01-19 13:40:11 +01002300 if( status != PSA_SUCCESS )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002301 goto exit;
Gilles Peskinef603c712019-01-19 13:40:11 +01002302
Gilles Peskine011e4282019-06-26 18:34:38 +02002303 status = psa_finish_key_creation( target_slot, driver );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002304exit:
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002305 if( status != PSA_SUCCESS )
2306 {
Gilles Peskine011e4282019-06-26 18:34:38 +02002307 psa_fail_key_creation( target_slot, driver );
Ronald Croncf56a0a2020-08-04 09:51:30 +02002308 *target_key = MBEDTLS_SVC_KEY_ID_INIT;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002309 }
2310 return( status );
Gilles Peskinef603c712019-01-19 13:40:11 +01002311}
2312
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02002313
2314
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01002315/****************************************************************/
Gilles Peskine20035e32018-02-03 22:44:14 +01002316/* Message digests */
2317/****************************************************************/
2318
John Durkop0ea39e02020-10-13 19:58:20 -07002319#if defined(MBEDTLS_RSA_C) || defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
Gilles Peskinedc2fc842018-03-07 16:42:59 +01002320static const mbedtls_md_info_t *mbedtls_md_info_from_psa( psa_algorithm_t alg )
Gilles Peskine20035e32018-02-03 22:44:14 +01002321{
2322 switch( alg )
2323 {
2324#if defined(MBEDTLS_MD2_C)
2325 case PSA_ALG_MD2:
2326 return( &mbedtls_md2_info );
2327#endif
2328#if defined(MBEDTLS_MD4_C)
2329 case PSA_ALG_MD4:
2330 return( &mbedtls_md4_info );
2331#endif
2332#if defined(MBEDTLS_MD5_C)
2333 case PSA_ALG_MD5:
2334 return( &mbedtls_md5_info );
2335#endif
2336#if defined(MBEDTLS_RIPEMD160_C)
2337 case PSA_ALG_RIPEMD160:
2338 return( &mbedtls_ripemd160_info );
2339#endif
2340#if defined(MBEDTLS_SHA1_C)
2341 case PSA_ALG_SHA_1:
2342 return( &mbedtls_sha1_info );
2343#endif
2344#if defined(MBEDTLS_SHA256_C)
2345 case PSA_ALG_SHA_224:
2346 return( &mbedtls_sha224_info );
2347 case PSA_ALG_SHA_256:
2348 return( &mbedtls_sha256_info );
2349#endif
2350#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnardd6020842019-07-17 16:28:21 +02002351#if !defined(MBEDTLS_SHA512_NO_SHA384)
Gilles Peskine20035e32018-02-03 22:44:14 +01002352 case PSA_ALG_SHA_384:
2353 return( &mbedtls_sha384_info );
Manuel Pégourié-Gonnardd6020842019-07-17 16:28:21 +02002354#endif
Gilles Peskine20035e32018-02-03 22:44:14 +01002355 case PSA_ALG_SHA_512:
2356 return( &mbedtls_sha512_info );
2357#endif
2358 default:
2359 return( NULL );
2360 }
2361}
John Durkop0ea39e02020-10-13 19:58:20 -07002362#endif /* defined(MBEDTLS_RSA_C) || defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Gilles Peskine20035e32018-02-03 22:44:14 +01002363
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002364psa_status_t psa_hash_abort( psa_hash_operation_t *operation )
2365{
2366 switch( operation->alg )
2367 {
Gilles Peskine81736312018-06-26 15:04:31 +02002368 case 0:
2369 /* The object has (apparently) been initialized but it is not
2370 * in use. It's ok to call abort on such an object, and there's
2371 * nothing to do. */
2372 break;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002373#if defined(MBEDTLS_MD2_C)
2374 case PSA_ALG_MD2:
2375 mbedtls_md2_free( &operation->ctx.md2 );
2376 break;
2377#endif
2378#if defined(MBEDTLS_MD4_C)
2379 case PSA_ALG_MD4:
2380 mbedtls_md4_free( &operation->ctx.md4 );
2381 break;
2382#endif
2383#if defined(MBEDTLS_MD5_C)
2384 case PSA_ALG_MD5:
2385 mbedtls_md5_free( &operation->ctx.md5 );
2386 break;
2387#endif
2388#if defined(MBEDTLS_RIPEMD160_C)
2389 case PSA_ALG_RIPEMD160:
2390 mbedtls_ripemd160_free( &operation->ctx.ripemd160 );
2391 break;
2392#endif
2393#if defined(MBEDTLS_SHA1_C)
2394 case PSA_ALG_SHA_1:
2395 mbedtls_sha1_free( &operation->ctx.sha1 );
2396 break;
2397#endif
2398#if defined(MBEDTLS_SHA256_C)
2399 case PSA_ALG_SHA_224:
2400 case PSA_ALG_SHA_256:
2401 mbedtls_sha256_free( &operation->ctx.sha256 );
2402 break;
2403#endif
2404#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnard792b16d2020-01-07 10:13:18 +01002405#if !defined(MBEDTLS_SHA512_NO_SHA384)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002406 case PSA_ALG_SHA_384:
Manuel Pégourié-Gonnard792b16d2020-01-07 10:13:18 +01002407#endif
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002408 case PSA_ALG_SHA_512:
2409 mbedtls_sha512_free( &operation->ctx.sha512 );
2410 break;
2411#endif
2412 default:
Gilles Peskinef9c2c092018-06-21 16:57:07 +02002413 return( PSA_ERROR_BAD_STATE );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002414 }
2415 operation->alg = 0;
2416 return( PSA_SUCCESS );
2417}
2418
Gilles Peskineda8191d1c2018-07-08 19:46:38 +02002419psa_status_t psa_hash_setup( psa_hash_operation_t *operation,
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002420 psa_algorithm_t alg )
2421{
Janos Follath24eed8d2019-11-22 13:21:35 +00002422 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jaeden Amero36ee5d02019-02-19 09:25:10 +00002423
2424 /* A context must be freshly initialized before it can be set up. */
2425 if( operation->alg != 0 )
2426 {
2427 return( PSA_ERROR_BAD_STATE );
2428 }
2429
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002430 switch( alg )
2431 {
2432#if defined(MBEDTLS_MD2_C)
2433 case PSA_ALG_MD2:
2434 mbedtls_md2_init( &operation->ctx.md2 );
2435 ret = mbedtls_md2_starts_ret( &operation->ctx.md2 );
2436 break;
2437#endif
2438#if defined(MBEDTLS_MD4_C)
2439 case PSA_ALG_MD4:
2440 mbedtls_md4_init( &operation->ctx.md4 );
2441 ret = mbedtls_md4_starts_ret( &operation->ctx.md4 );
2442 break;
2443#endif
2444#if defined(MBEDTLS_MD5_C)
2445 case PSA_ALG_MD5:
2446 mbedtls_md5_init( &operation->ctx.md5 );
2447 ret = mbedtls_md5_starts_ret( &operation->ctx.md5 );
2448 break;
2449#endif
2450#if defined(MBEDTLS_RIPEMD160_C)
2451 case PSA_ALG_RIPEMD160:
2452 mbedtls_ripemd160_init( &operation->ctx.ripemd160 );
2453 ret = mbedtls_ripemd160_starts_ret( &operation->ctx.ripemd160 );
2454 break;
2455#endif
2456#if defined(MBEDTLS_SHA1_C)
2457 case PSA_ALG_SHA_1:
2458 mbedtls_sha1_init( &operation->ctx.sha1 );
2459 ret = mbedtls_sha1_starts_ret( &operation->ctx.sha1 );
2460 break;
2461#endif
2462#if defined(MBEDTLS_SHA256_C)
2463 case PSA_ALG_SHA_224:
2464 mbedtls_sha256_init( &operation->ctx.sha256 );
2465 ret = mbedtls_sha256_starts_ret( &operation->ctx.sha256, 1 );
2466 break;
2467 case PSA_ALG_SHA_256:
2468 mbedtls_sha256_init( &operation->ctx.sha256 );
2469 ret = mbedtls_sha256_starts_ret( &operation->ctx.sha256, 0 );
2470 break;
2471#endif
2472#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnard792b16d2020-01-07 10:13:18 +01002473#if !defined(MBEDTLS_SHA512_NO_SHA384)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002474 case PSA_ALG_SHA_384:
2475 mbedtls_sha512_init( &operation->ctx.sha512 );
2476 ret = mbedtls_sha512_starts_ret( &operation->ctx.sha512, 1 );
2477 break;
Manuel Pégourié-Gonnard792b16d2020-01-07 10:13:18 +01002478#endif
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002479 case PSA_ALG_SHA_512:
2480 mbedtls_sha512_init( &operation->ctx.sha512 );
2481 ret = mbedtls_sha512_starts_ret( &operation->ctx.sha512, 0 );
2482 break;
2483#endif
2484 default:
Gilles Peskinec06e0712018-06-20 16:21:04 +02002485 return( PSA_ALG_IS_HASH( alg ) ?
2486 PSA_ERROR_NOT_SUPPORTED :
2487 PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002488 }
2489 if( ret == 0 )
2490 operation->alg = alg;
2491 else
2492 psa_hash_abort( operation );
2493 return( mbedtls_to_psa_error( ret ) );
2494}
2495
2496psa_status_t psa_hash_update( psa_hash_operation_t *operation,
2497 const uint8_t *input,
2498 size_t input_length )
2499{
Janos Follath24eed8d2019-11-22 13:21:35 +00002500 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine94e44542018-07-12 16:58:43 +02002501
2502 /* Don't require hash implementations to behave correctly on a
2503 * zero-length input, which may have an invalid pointer. */
2504 if( input_length == 0 )
2505 return( PSA_SUCCESS );
2506
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002507 switch( operation->alg )
2508 {
2509#if defined(MBEDTLS_MD2_C)
2510 case PSA_ALG_MD2:
2511 ret = mbedtls_md2_update_ret( &operation->ctx.md2,
2512 input, input_length );
2513 break;
2514#endif
2515#if defined(MBEDTLS_MD4_C)
2516 case PSA_ALG_MD4:
2517 ret = mbedtls_md4_update_ret( &operation->ctx.md4,
2518 input, input_length );
2519 break;
2520#endif
2521#if defined(MBEDTLS_MD5_C)
2522 case PSA_ALG_MD5:
2523 ret = mbedtls_md5_update_ret( &operation->ctx.md5,
2524 input, input_length );
2525 break;
2526#endif
2527#if defined(MBEDTLS_RIPEMD160_C)
2528 case PSA_ALG_RIPEMD160:
2529 ret = mbedtls_ripemd160_update_ret( &operation->ctx.ripemd160,
2530 input, input_length );
2531 break;
2532#endif
2533#if defined(MBEDTLS_SHA1_C)
2534 case PSA_ALG_SHA_1:
2535 ret = mbedtls_sha1_update_ret( &operation->ctx.sha1,
2536 input, input_length );
2537 break;
2538#endif
2539#if defined(MBEDTLS_SHA256_C)
2540 case PSA_ALG_SHA_224:
2541 case PSA_ALG_SHA_256:
2542 ret = mbedtls_sha256_update_ret( &operation->ctx.sha256,
2543 input, input_length );
2544 break;
2545#endif
2546#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnard792b16d2020-01-07 10:13:18 +01002547#if !defined(MBEDTLS_SHA512_NO_SHA384)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002548 case PSA_ALG_SHA_384:
Manuel Pégourié-Gonnard792b16d2020-01-07 10:13:18 +01002549#endif
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002550 case PSA_ALG_SHA_512:
2551 ret = mbedtls_sha512_update_ret( &operation->ctx.sha512,
2552 input, input_length );
2553 break;
2554#endif
2555 default:
Jaeden Ameroa0f625a2019-02-15 13:52:25 +00002556 return( PSA_ERROR_BAD_STATE );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002557 }
Gilles Peskine94e44542018-07-12 16:58:43 +02002558
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002559 if( ret != 0 )
2560 psa_hash_abort( operation );
2561 return( mbedtls_to_psa_error( ret ) );
2562}
2563
2564psa_status_t psa_hash_finish( psa_hash_operation_t *operation,
2565 uint8_t *hash,
2566 size_t hash_size,
2567 size_t *hash_length )
2568{
itayzafrir40835d42018-08-02 13:14:17 +03002569 psa_status_t status;
Janos Follath24eed8d2019-11-22 13:21:35 +00002570 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine71bb7b72018-04-19 08:29:59 +02002571 size_t actual_hash_length = PSA_HASH_SIZE( operation->alg );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002572
2573 /* Fill the output buffer with something that isn't a valid hash
2574 * (barring an attack on the hash and deliberately-crafted input),
2575 * in case the caller doesn't check the return status properly. */
Gilles Peskineaee13332018-07-02 12:15:28 +02002576 *hash_length = hash_size;
Gilles Peskine46f1fd72018-06-28 19:31:31 +02002577 /* If hash_size is 0 then hash may be NULL and then the
2578 * call to memset would have undefined behavior. */
2579 if( hash_size != 0 )
2580 memset( hash, '!', hash_size );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002581
2582 if( hash_size < actual_hash_length )
itayzafrir40835d42018-08-02 13:14:17 +03002583 {
2584 status = PSA_ERROR_BUFFER_TOO_SMALL;
2585 goto exit;
2586 }
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002587
2588 switch( operation->alg )
2589 {
2590#if defined(MBEDTLS_MD2_C)
2591 case PSA_ALG_MD2:
2592 ret = mbedtls_md2_finish_ret( &operation->ctx.md2, hash );
2593 break;
2594#endif
2595#if defined(MBEDTLS_MD4_C)
2596 case PSA_ALG_MD4:
2597 ret = mbedtls_md4_finish_ret( &operation->ctx.md4, hash );
2598 break;
2599#endif
2600#if defined(MBEDTLS_MD5_C)
2601 case PSA_ALG_MD5:
2602 ret = mbedtls_md5_finish_ret( &operation->ctx.md5, hash );
2603 break;
2604#endif
2605#if defined(MBEDTLS_RIPEMD160_C)
2606 case PSA_ALG_RIPEMD160:
2607 ret = mbedtls_ripemd160_finish_ret( &operation->ctx.ripemd160, hash );
2608 break;
2609#endif
2610#if defined(MBEDTLS_SHA1_C)
2611 case PSA_ALG_SHA_1:
2612 ret = mbedtls_sha1_finish_ret( &operation->ctx.sha1, hash );
2613 break;
2614#endif
2615#if defined(MBEDTLS_SHA256_C)
2616 case PSA_ALG_SHA_224:
2617 case PSA_ALG_SHA_256:
2618 ret = mbedtls_sha256_finish_ret( &operation->ctx.sha256, hash );
2619 break;
2620#endif
2621#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnard792b16d2020-01-07 10:13:18 +01002622#if !defined(MBEDTLS_SHA512_NO_SHA384)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002623 case PSA_ALG_SHA_384:
Manuel Pégourié-Gonnard792b16d2020-01-07 10:13:18 +01002624#endif
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002625 case PSA_ALG_SHA_512:
2626 ret = mbedtls_sha512_finish_ret( &operation->ctx.sha512, hash );
2627 break;
2628#endif
2629 default:
Jaeden Ameroa0f625a2019-02-15 13:52:25 +00002630 return( PSA_ERROR_BAD_STATE );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002631 }
itayzafrir40835d42018-08-02 13:14:17 +03002632 status = mbedtls_to_psa_error( ret );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002633
itayzafrir40835d42018-08-02 13:14:17 +03002634exit:
2635 if( status == PSA_SUCCESS )
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002636 {
Gilles Peskineaee13332018-07-02 12:15:28 +02002637 *hash_length = actual_hash_length;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002638 return( psa_hash_abort( operation ) );
2639 }
2640 else
2641 {
2642 psa_hash_abort( operation );
itayzafrir40835d42018-08-02 13:14:17 +03002643 return( status );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002644 }
2645}
2646
Gilles Peskine2d277862018-06-18 15:41:12 +02002647psa_status_t psa_hash_verify( psa_hash_operation_t *operation,
2648 const uint8_t *hash,
2649 size_t hash_length )
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002650{
2651 uint8_t actual_hash[MBEDTLS_MD_MAX_SIZE];
2652 size_t actual_hash_length;
2653 psa_status_t status = psa_hash_finish( operation,
2654 actual_hash, sizeof( actual_hash ),
2655 &actual_hash_length );
2656 if( status != PSA_SUCCESS )
2657 return( status );
2658 if( actual_hash_length != hash_length )
2659 return( PSA_ERROR_INVALID_SIGNATURE );
2660 if( safer_memcmp( hash, actual_hash, actual_hash_length ) != 0 )
2661 return( PSA_ERROR_INVALID_SIGNATURE );
2662 return( PSA_SUCCESS );
2663}
2664
Gilles Peskine0a749c82019-11-28 19:33:58 +01002665psa_status_t psa_hash_compute( psa_algorithm_t alg,
2666 const uint8_t *input, size_t input_length,
2667 uint8_t *hash, size_t hash_size,
2668 size_t *hash_length )
2669{
2670 psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT;
2671 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2672
2673 *hash_length = hash_size;
2674 status = psa_hash_setup( &operation, alg );
2675 if( status != PSA_SUCCESS )
2676 goto exit;
2677 status = psa_hash_update( &operation, input, input_length );
2678 if( status != PSA_SUCCESS )
2679 goto exit;
2680 status = psa_hash_finish( &operation, hash, hash_size, hash_length );
2681 if( status != PSA_SUCCESS )
2682 goto exit;
2683
2684exit:
2685 if( status == PSA_SUCCESS )
2686 status = psa_hash_abort( &operation );
2687 else
2688 psa_hash_abort( &operation );
2689 return( status );
2690}
2691
2692psa_status_t psa_hash_compare( psa_algorithm_t alg,
2693 const uint8_t *input, size_t input_length,
2694 const uint8_t *hash, size_t hash_length )
2695{
2696 psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT;
2697 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2698
2699 status = psa_hash_setup( &operation, alg );
2700 if( status != PSA_SUCCESS )
2701 goto exit;
2702 status = psa_hash_update( &operation, input, input_length );
2703 if( status != PSA_SUCCESS )
2704 goto exit;
2705 status = psa_hash_verify( &operation, hash, hash_length );
2706 if( status != PSA_SUCCESS )
2707 goto exit;
2708
2709exit:
2710 if( status == PSA_SUCCESS )
2711 status = psa_hash_abort( &operation );
2712 else
2713 psa_hash_abort( &operation );
2714 return( status );
2715}
2716
Gilles Peskineeb35d782019-01-22 17:56:16 +01002717psa_status_t psa_hash_clone( const psa_hash_operation_t *source_operation,
2718 psa_hash_operation_t *target_operation )
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002719{
2720 if( target_operation->alg != 0 )
2721 return( PSA_ERROR_BAD_STATE );
2722
2723 switch( source_operation->alg )
2724 {
2725 case 0:
2726 return( PSA_ERROR_BAD_STATE );
2727#if defined(MBEDTLS_MD2_C)
2728 case PSA_ALG_MD2:
2729 mbedtls_md2_clone( &target_operation->ctx.md2,
2730 &source_operation->ctx.md2 );
2731 break;
2732#endif
2733#if defined(MBEDTLS_MD4_C)
2734 case PSA_ALG_MD4:
2735 mbedtls_md4_clone( &target_operation->ctx.md4,
2736 &source_operation->ctx.md4 );
2737 break;
2738#endif
2739#if defined(MBEDTLS_MD5_C)
2740 case PSA_ALG_MD5:
2741 mbedtls_md5_clone( &target_operation->ctx.md5,
2742 &source_operation->ctx.md5 );
2743 break;
2744#endif
2745#if defined(MBEDTLS_RIPEMD160_C)
2746 case PSA_ALG_RIPEMD160:
2747 mbedtls_ripemd160_clone( &target_operation->ctx.ripemd160,
2748 &source_operation->ctx.ripemd160 );
2749 break;
2750#endif
2751#if defined(MBEDTLS_SHA1_C)
2752 case PSA_ALG_SHA_1:
2753 mbedtls_sha1_clone( &target_operation->ctx.sha1,
2754 &source_operation->ctx.sha1 );
2755 break;
2756#endif
2757#if defined(MBEDTLS_SHA256_C)
2758 case PSA_ALG_SHA_224:
2759 case PSA_ALG_SHA_256:
2760 mbedtls_sha256_clone( &target_operation->ctx.sha256,
2761 &source_operation->ctx.sha256 );
2762 break;
2763#endif
2764#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnard792b16d2020-01-07 10:13:18 +01002765#if !defined(MBEDTLS_SHA512_NO_SHA384)
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002766 case PSA_ALG_SHA_384:
Manuel Pégourié-Gonnard792b16d2020-01-07 10:13:18 +01002767#endif
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002768 case PSA_ALG_SHA_512:
2769 mbedtls_sha512_clone( &target_operation->ctx.sha512,
2770 &source_operation->ctx.sha512 );
2771 break;
2772#endif
2773 default:
2774 return( PSA_ERROR_NOT_SUPPORTED );
2775 }
2776
2777 target_operation->alg = source_operation->alg;
2778 return( PSA_SUCCESS );
2779}
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002780
2781
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002782/****************************************************************/
Gilles Peskine8c9def32018-02-08 10:02:12 +01002783/* MAC */
2784/****************************************************************/
2785
Gilles Peskinedc2fc842018-03-07 16:42:59 +01002786static const mbedtls_cipher_info_t *mbedtls_cipher_info_from_psa(
Gilles Peskine8c9def32018-02-08 10:02:12 +01002787 psa_algorithm_t alg,
2788 psa_key_type_t key_type,
Gilles Peskine2d277862018-06-18 15:41:12 +02002789 size_t key_bits,
mohammad1603f4f0d612018-06-03 15:04:51 +03002790 mbedtls_cipher_id_t* cipher_id )
Gilles Peskine8c9def32018-02-08 10:02:12 +01002791{
Gilles Peskine8c9def32018-02-08 10:02:12 +01002792 mbedtls_cipher_mode_t mode;
mohammad1603f4f0d612018-06-03 15:04:51 +03002793 mbedtls_cipher_id_t cipher_id_tmp;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002794
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02002795 if( PSA_ALG_IS_AEAD( alg ) )
Gilles Peskine57fbdb12018-10-17 18:29:17 +02002796 alg = PSA_ALG_AEAD_WITH_TAG_LENGTH( alg, 0 );
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02002797
Gilles Peskine8c9def32018-02-08 10:02:12 +01002798 if( PSA_ALG_IS_CIPHER( alg ) || PSA_ALG_IS_AEAD( alg ) )
2799 {
Nir Sonnenscheine9664c32018-06-17 14:41:30 +03002800 switch( alg )
Gilles Peskine8c9def32018-02-08 10:02:12 +01002801 {
Gilles Peskinedaea26f2018-08-21 14:02:45 +02002802 case PSA_ALG_ARC4:
Gilles Peskine26869f22019-05-06 15:25:00 +02002803 case PSA_ALG_CHACHA20:
Gilles Peskine8c9def32018-02-08 10:02:12 +01002804 mode = MBEDTLS_MODE_STREAM;
2805 break;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002806 case PSA_ALG_CTR:
2807 mode = MBEDTLS_MODE_CTR;
2808 break;
Gilles Peskinedaea26f2018-08-21 14:02:45 +02002809 case PSA_ALG_CFB:
2810 mode = MBEDTLS_MODE_CFB;
2811 break;
2812 case PSA_ALG_OFB:
2813 mode = MBEDTLS_MODE_OFB;
2814 break;
Steven Cooremaned3c9ec2020-07-06 14:08:59 +02002815 case PSA_ALG_ECB_NO_PADDING:
2816 mode = MBEDTLS_MODE_ECB;
2817 break;
Gilles Peskinedaea26f2018-08-21 14:02:45 +02002818 case PSA_ALG_CBC_NO_PADDING:
2819 mode = MBEDTLS_MODE_CBC;
2820 break;
2821 case PSA_ALG_CBC_PKCS7:
2822 mode = MBEDTLS_MODE_CBC;
2823 break;
Gilles Peskine57fbdb12018-10-17 18:29:17 +02002824 case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_CCM, 0 ):
Gilles Peskine8c9def32018-02-08 10:02:12 +01002825 mode = MBEDTLS_MODE_CCM;
2826 break;
Gilles Peskine57fbdb12018-10-17 18:29:17 +02002827 case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_GCM, 0 ):
Gilles Peskine8c9def32018-02-08 10:02:12 +01002828 mode = MBEDTLS_MODE_GCM;
2829 break;
Gilles Peskine26869f22019-05-06 15:25:00 +02002830 case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_CHACHA20_POLY1305, 0 ):
2831 mode = MBEDTLS_MODE_CHACHAPOLY;
2832 break;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002833 default:
2834 return( NULL );
2835 }
2836 }
2837 else if( alg == PSA_ALG_CMAC )
2838 mode = MBEDTLS_MODE_ECB;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002839 else
2840 return( NULL );
2841
2842 switch( key_type )
2843 {
2844 case PSA_KEY_TYPE_AES:
mohammad1603f4f0d612018-06-03 15:04:51 +03002845 cipher_id_tmp = MBEDTLS_CIPHER_ID_AES;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002846 break;
2847 case PSA_KEY_TYPE_DES:
Gilles Peskine9ad29e22018-06-21 09:40:04 +02002848 /* key_bits is 64 for Single-DES, 128 for two-key Triple-DES,
2849 * and 192 for three-key Triple-DES. */
Gilles Peskine8c9def32018-02-08 10:02:12 +01002850 if( key_bits == 64 )
mohammad1603f4f0d612018-06-03 15:04:51 +03002851 cipher_id_tmp = MBEDTLS_CIPHER_ID_DES;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002852 else
mohammad1603f4f0d612018-06-03 15:04:51 +03002853 cipher_id_tmp = MBEDTLS_CIPHER_ID_3DES;
Gilles Peskine9ad29e22018-06-21 09:40:04 +02002854 /* mbedtls doesn't recognize two-key Triple-DES as an algorithm,
2855 * but two-key Triple-DES is functionally three-key Triple-DES
2856 * with K1=K3, so that's how we present it to mbedtls. */
2857 if( key_bits == 128 )
2858 key_bits = 192;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002859 break;
2860 case PSA_KEY_TYPE_CAMELLIA:
mohammad1603f4f0d612018-06-03 15:04:51 +03002861 cipher_id_tmp = MBEDTLS_CIPHER_ID_CAMELLIA;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002862 break;
2863 case PSA_KEY_TYPE_ARC4:
mohammad1603f4f0d612018-06-03 15:04:51 +03002864 cipher_id_tmp = MBEDTLS_CIPHER_ID_ARC4;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002865 break;
Gilles Peskine26869f22019-05-06 15:25:00 +02002866 case PSA_KEY_TYPE_CHACHA20:
2867 cipher_id_tmp = MBEDTLS_CIPHER_ID_CHACHA20;
2868 break;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002869 default:
2870 return( NULL );
2871 }
mohammad1603f4f0d612018-06-03 15:04:51 +03002872 if( cipher_id != NULL )
mohammad160360a64d02018-06-03 17:20:42 +03002873 *cipher_id = cipher_id_tmp;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002874
Jaeden Amero23bbb752018-06-26 14:16:54 +01002875 return( mbedtls_cipher_info_from_values( cipher_id_tmp,
2876 (int) key_bits, mode ) );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002877}
2878
Gilles Peskinea05219c2018-11-16 16:02:56 +01002879#if defined(MBEDTLS_MD_C)
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002880static size_t psa_get_hash_block_size( psa_algorithm_t alg )
Nir Sonnenschein96272412018-06-17 14:41:10 +03002881{
Gilles Peskine2d277862018-06-18 15:41:12 +02002882 switch( alg )
Nir Sonnenschein96272412018-06-17 14:41:10 +03002883 {
2884 case PSA_ALG_MD2:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002885 return( 16 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002886 case PSA_ALG_MD4:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002887 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002888 case PSA_ALG_MD5:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002889 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002890 case PSA_ALG_RIPEMD160:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002891 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002892 case PSA_ALG_SHA_1:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002893 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002894 case PSA_ALG_SHA_224:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002895 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002896 case PSA_ALG_SHA_256:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002897 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002898 case PSA_ALG_SHA_384:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03002899 return( 128 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002900 case PSA_ALG_SHA_512:
Gilles Peskine2d277862018-06-18 15:41:12 +02002901 return( 128 );
2902 default:
2903 return( 0 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03002904 }
2905}
Gilles Peskinea05219c2018-11-16 16:02:56 +01002906#endif /* MBEDTLS_MD_C */
Nir Sonnenschein0c9ec532018-06-07 13:27:47 +03002907
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002908/* Initialize the MAC operation structure. Once this function has been
2909 * called, psa_mac_abort can run and will do the right thing. */
2910static psa_status_t psa_mac_init( psa_mac_operation_t *operation,
2911 psa_algorithm_t alg )
2912{
2913 psa_status_t status = PSA_ERROR_NOT_SUPPORTED;
2914
2915 operation->alg = alg;
2916 operation->key_set = 0;
2917 operation->iv_set = 0;
2918 operation->iv_required = 0;
2919 operation->has_input = 0;
Gilles Peskine89167cb2018-07-08 20:12:23 +02002920 operation->is_sign = 0;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002921
2922#if defined(MBEDTLS_CMAC_C)
2923 if( alg == PSA_ALG_CMAC )
2924 {
2925 operation->iv_required = 0;
2926 mbedtls_cipher_init( &operation->ctx.cmac );
2927 status = PSA_SUCCESS;
2928 }
2929 else
2930#endif /* MBEDTLS_CMAC_C */
2931#if defined(MBEDTLS_MD_C)
2932 if( PSA_ALG_IS_HMAC( operation->alg ) )
2933 {
Gilles Peskineff94abd2018-07-12 17:07:52 +02002934 /* We'll set up the hash operation later in psa_hmac_setup_internal. */
2935 operation->ctx.hmac.hash_ctx.alg = 0;
2936 status = PSA_SUCCESS;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002937 }
2938 else
2939#endif /* MBEDTLS_MD_C */
2940 {
Gilles Peskinec06e0712018-06-20 16:21:04 +02002941 if( ! PSA_ALG_IS_MAC( alg ) )
2942 status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002943 }
2944
2945 if( status != PSA_SUCCESS )
2946 memset( operation, 0, sizeof( *operation ) );
2947 return( status );
2948}
2949
Gilles Peskine01126fa2018-07-12 17:04:55 +02002950#if defined(MBEDTLS_MD_C)
2951static psa_status_t psa_hmac_abort_internal( psa_hmac_internal_data *hmac )
2952{
Gilles Peskine3f108122018-12-07 18:14:53 +01002953 mbedtls_platform_zeroize( hmac->opad, sizeof( hmac->opad ) );
Gilles Peskine01126fa2018-07-12 17:04:55 +02002954 return( psa_hash_abort( &hmac->hash_ctx ) );
2955}
2956#endif /* MBEDTLS_MD_C */
2957
Gilles Peskine8c9def32018-02-08 10:02:12 +01002958psa_status_t psa_mac_abort( psa_mac_operation_t *operation )
2959{
Gilles Peskinefbfac682018-07-08 20:51:54 +02002960 if( operation->alg == 0 )
Gilles Peskine8c9def32018-02-08 10:02:12 +01002961 {
Gilles Peskinefbfac682018-07-08 20:51:54 +02002962 /* The object has (apparently) been initialized but it is not
2963 * in use. It's ok to call abort on such an object, and there's
2964 * nothing to do. */
2965 return( PSA_SUCCESS );
2966 }
2967 else
Gilles Peskine8c9def32018-02-08 10:02:12 +01002968#if defined(MBEDTLS_CMAC_C)
Gilles Peskinefbfac682018-07-08 20:51:54 +02002969 if( operation->alg == PSA_ALG_CMAC )
2970 {
2971 mbedtls_cipher_free( &operation->ctx.cmac );
2972 }
2973 else
Gilles Peskine8c9def32018-02-08 10:02:12 +01002974#endif /* MBEDTLS_CMAC_C */
Gilles Peskine8c9def32018-02-08 10:02:12 +01002975#if defined(MBEDTLS_MD_C)
Gilles Peskinefbfac682018-07-08 20:51:54 +02002976 if( PSA_ALG_IS_HMAC( operation->alg ) )
2977 {
Gilles Peskine01126fa2018-07-12 17:04:55 +02002978 psa_hmac_abort_internal( &operation->ctx.hmac );
Gilles Peskinefbfac682018-07-08 20:51:54 +02002979 }
2980 else
Gilles Peskine8c9def32018-02-08 10:02:12 +01002981#endif /* MBEDTLS_MD_C */
Gilles Peskinefbfac682018-07-08 20:51:54 +02002982 {
2983 /* Sanity check (shouldn't happen: operation->alg should
2984 * always have been initialized to a valid value). */
2985 goto bad_state;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002986 }
Moran Peker41deec42018-04-04 15:43:05 +03002987
Gilles Peskine8c9def32018-02-08 10:02:12 +01002988 operation->alg = 0;
2989 operation->key_set = 0;
2990 operation->iv_set = 0;
2991 operation->iv_required = 0;
2992 operation->has_input = 0;
Gilles Peskine89167cb2018-07-08 20:12:23 +02002993 operation->is_sign = 0;
Moran Peker41deec42018-04-04 15:43:05 +03002994
Gilles Peskine8c9def32018-02-08 10:02:12 +01002995 return( PSA_SUCCESS );
Gilles Peskinefbfac682018-07-08 20:51:54 +02002996
2997bad_state:
2998 /* If abort is called on an uninitialized object, we can't trust
2999 * anything. Wipe the object in case it contains confidential data.
3000 * This may result in a memory leak if a pointer gets overwritten,
3001 * but it's too late to do anything about this. */
3002 memset( operation, 0, sizeof( *operation ) );
3003 return( PSA_ERROR_BAD_STATE );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003004}
3005
Gilles Peskinee3b07d82018-06-19 11:57:35 +02003006#if defined(MBEDTLS_CMAC_C)
Gilles Peskine89167cb2018-07-08 20:12:23 +02003007static int psa_cmac_setup( psa_mac_operation_t *operation,
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003008 size_t key_bits,
Gilles Peskine2f060a82018-12-04 17:12:32 +01003009 psa_key_slot_t *slot,
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003010 const mbedtls_cipher_info_t *cipher_info )
3011{
Janos Follath24eed8d2019-11-22 13:21:35 +00003012 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003013
3014 operation->mac_size = cipher_info->block_size;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003015
3016 ret = mbedtls_cipher_setup( &operation->ctx.cmac, cipher_info );
3017 if( ret != 0 )
3018 return( ret );
3019
3020 ret = mbedtls_cipher_cmac_starts( &operation->ctx.cmac,
Steven Cooreman71fd80d2020-07-07 21:12:27 +02003021 slot->data.key.data,
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003022 key_bits );
3023 return( ret );
3024}
Gilles Peskinee3b07d82018-06-19 11:57:35 +02003025#endif /* MBEDTLS_CMAC_C */
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003026
Gilles Peskine248051a2018-06-20 16:09:38 +02003027#if defined(MBEDTLS_MD_C)
Gilles Peskine01126fa2018-07-12 17:04:55 +02003028static psa_status_t psa_hmac_setup_internal( psa_hmac_internal_data *hmac,
3029 const uint8_t *key,
3030 size_t key_length,
3031 psa_algorithm_t hash_alg )
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003032{
Gilles Peskinec11c4dc2019-07-15 11:06:38 +02003033 uint8_t ipad[PSA_HMAC_MAX_HASH_BLOCK_SIZE];
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003034 size_t i;
Gilles Peskine9aa369e2018-07-16 00:36:29 +02003035 size_t hash_size = PSA_HASH_SIZE( hash_alg );
Gilles Peskine01126fa2018-07-12 17:04:55 +02003036 size_t block_size = psa_get_hash_block_size( hash_alg );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003037 psa_status_t status;
3038
Gilles Peskine9aa369e2018-07-16 00:36:29 +02003039 /* Sanity checks on block_size, to guarantee that there won't be a buffer
3040 * overflow below. This should never trigger if the hash algorithm
3041 * is implemented correctly. */
3042 /* The size checks against the ipad and opad buffers cannot be written
3043 * `block_size > sizeof( ipad ) || block_size > sizeof( hmac->opad )`
3044 * because that triggers -Wlogical-op on GCC 7.3. */
3045 if( block_size > sizeof( ipad ) )
3046 return( PSA_ERROR_NOT_SUPPORTED );
3047 if( block_size > sizeof( hmac->opad ) )
3048 return( PSA_ERROR_NOT_SUPPORTED );
3049 if( block_size < hash_size )
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003050 return( PSA_ERROR_NOT_SUPPORTED );
3051
Gilles Peskined223b522018-06-11 18:12:58 +02003052 if( key_length > block_size )
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003053 {
Gilles Peskine84b8fc82019-11-28 20:07:20 +01003054 status = psa_hash_compute( hash_alg, key, key_length,
3055 ipad, sizeof( ipad ), &key_length );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003056 if( status != PSA_SUCCESS )
Gilles Peskineb8be2882018-07-17 16:24:34 +02003057 goto cleanup;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003058 }
Gilles Peskine96889972018-07-12 17:07:03 +02003059 /* A 0-length key is not commonly used in HMAC when used as a MAC,
3060 * but it is permitted. It is common when HMAC is used in HKDF, for
3061 * example. Don't call `memcpy` in the 0-length because `key` could be
3062 * an invalid pointer which would make the behavior undefined. */
3063 else if( key_length != 0 )
Gilles Peskine01126fa2018-07-12 17:04:55 +02003064 memcpy( ipad, key, key_length );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003065
Gilles Peskined223b522018-06-11 18:12:58 +02003066 /* ipad contains the key followed by garbage. Xor and fill with 0x36
3067 * to create the ipad value. */
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003068 for( i = 0; i < key_length; i++ )
Gilles Peskined223b522018-06-11 18:12:58 +02003069 ipad[i] ^= 0x36;
3070 memset( ipad + key_length, 0x36, block_size - key_length );
3071
3072 /* Copy the key material from ipad to opad, flipping the requisite bits,
3073 * and filling the rest of opad with the requisite constant. */
3074 for( i = 0; i < key_length; i++ )
Gilles Peskine01126fa2018-07-12 17:04:55 +02003075 hmac->opad[i] = ipad[i] ^ 0x36 ^ 0x5C;
3076 memset( hmac->opad + key_length, 0x5C, block_size - key_length );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003077
Gilles Peskine01126fa2018-07-12 17:04:55 +02003078 status = psa_hash_setup( &hmac->hash_ctx, hash_alg );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003079 if( status != PSA_SUCCESS )
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02003080 goto cleanup;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003081
Gilles Peskine01126fa2018-07-12 17:04:55 +02003082 status = psa_hash_update( &hmac->hash_ctx, ipad, block_size );
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02003083
3084cleanup:
Steven Cooreman29149862020-08-05 15:43:42 +02003085 mbedtls_platform_zeroize( ipad, sizeof( ipad ) );
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02003086
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003087 return( status );
3088}
Gilles Peskine248051a2018-06-20 16:09:38 +02003089#endif /* MBEDTLS_MD_C */
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003090
Gilles Peskine89167cb2018-07-08 20:12:23 +02003091static psa_status_t psa_mac_setup( psa_mac_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02003092 mbedtls_svc_key_id_t key,
Gilles Peskine89167cb2018-07-08 20:12:23 +02003093 psa_algorithm_t alg,
3094 int is_sign )
Gilles Peskine8c9def32018-02-08 10:02:12 +01003095{
Gilles Peskine8c9def32018-02-08 10:02:12 +01003096 psa_status_t status;
Gilles Peskine2f060a82018-12-04 17:12:32 +01003097 psa_key_slot_t *slot;
Gilles Peskine8c9def32018-02-08 10:02:12 +01003098 size_t key_bits;
Gilles Peskine89167cb2018-07-08 20:12:23 +02003099 psa_key_usage_t usage =
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01003100 is_sign ? PSA_KEY_USAGE_SIGN_HASH : PSA_KEY_USAGE_VERIFY_HASH;
Gilles Peskinec11c4dc2019-07-15 11:06:38 +02003101 uint8_t truncated = PSA_MAC_TRUNCATED_LENGTH( alg );
Gilles Peskinee0e9c7c2018-10-17 18:28:05 +02003102 psa_algorithm_t full_length_alg = PSA_ALG_FULL_LENGTH_MAC( alg );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003103
Jaeden Amero36ee5d02019-02-19 09:25:10 +00003104 /* A context must be freshly initialized before it can be set up. */
3105 if( operation->alg != 0 )
3106 {
3107 return( PSA_ERROR_BAD_STATE );
3108 }
3109
Gilles Peskined911eb72018-08-14 15:18:45 +02003110 status = psa_mac_init( operation, full_length_alg );
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02003111 if( status != PSA_SUCCESS )
3112 return( status );
Gilles Peskine89167cb2018-07-08 20:12:23 +02003113 if( is_sign )
3114 operation->is_sign = 1;
Gilles Peskine8c9def32018-02-08 10:02:12 +01003115
Ronald Croncf56a0a2020-08-04 09:51:30 +02003116 status = psa_get_transparent_key( key, &slot, usage, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003117 if( status != PSA_SUCCESS )
Gilles Peskinefbfac682018-07-08 20:51:54 +02003118 goto exit;
Gilles Peskinedb4b3ab2019-04-18 12:53:01 +02003119 key_bits = psa_get_key_slot_bits( slot );
Gilles Peskineab1d7ab2018-07-06 16:07:47 +02003120
Gilles Peskine8c9def32018-02-08 10:02:12 +01003121#if defined(MBEDTLS_CMAC_C)
Gilles Peskined911eb72018-08-14 15:18:45 +02003122 if( full_length_alg == PSA_ALG_CMAC )
Gilles Peskinefbfac682018-07-08 20:51:54 +02003123 {
3124 const mbedtls_cipher_info_t *cipher_info =
Gilles Peskined911eb72018-08-14 15:18:45 +02003125 mbedtls_cipher_info_from_psa( full_length_alg,
Gilles Peskine8e338702019-07-30 20:06:31 +02003126 slot->attr.type, key_bits, NULL );
Janos Follath24eed8d2019-11-22 13:21:35 +00003127 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskinefbfac682018-07-08 20:51:54 +02003128 if( cipher_info == NULL )
3129 {
3130 status = PSA_ERROR_NOT_SUPPORTED;
3131 goto exit;
3132 }
3133 operation->mac_size = cipher_info->block_size;
3134 ret = psa_cmac_setup( operation, key_bits, slot, cipher_info );
3135 status = mbedtls_to_psa_error( ret );
3136 }
3137 else
Gilles Peskine8c9def32018-02-08 10:02:12 +01003138#endif /* MBEDTLS_CMAC_C */
Gilles Peskine8c9def32018-02-08 10:02:12 +01003139#if defined(MBEDTLS_MD_C)
Gilles Peskined911eb72018-08-14 15:18:45 +02003140 if( PSA_ALG_IS_HMAC( full_length_alg ) )
Gilles Peskinefbfac682018-07-08 20:51:54 +02003141 {
Gilles Peskine00709fa2018-08-22 18:25:41 +02003142 psa_algorithm_t hash_alg = PSA_ALG_HMAC_GET_HASH( alg );
Gilles Peskine01126fa2018-07-12 17:04:55 +02003143 if( hash_alg == 0 )
3144 {
3145 status = PSA_ERROR_NOT_SUPPORTED;
3146 goto exit;
3147 }
Gilles Peskine9aa369e2018-07-16 00:36:29 +02003148
3149 operation->mac_size = PSA_HASH_SIZE( hash_alg );
3150 /* Sanity check. This shouldn't fail on a valid configuration. */
3151 if( operation->mac_size == 0 ||
3152 operation->mac_size > sizeof( operation->ctx.hmac.opad ) )
3153 {
3154 status = PSA_ERROR_NOT_SUPPORTED;
3155 goto exit;
3156 }
3157
Gilles Peskine8e338702019-07-30 20:06:31 +02003158 if( slot->attr.type != PSA_KEY_TYPE_HMAC )
Gilles Peskine01126fa2018-07-12 17:04:55 +02003159 {
3160 status = PSA_ERROR_INVALID_ARGUMENT;
3161 goto exit;
3162 }
Gilles Peskine9aa369e2018-07-16 00:36:29 +02003163
Gilles Peskine01126fa2018-07-12 17:04:55 +02003164 status = psa_hmac_setup_internal( &operation->ctx.hmac,
Steven Cooreman71fd80d2020-07-07 21:12:27 +02003165 slot->data.key.data,
3166 slot->data.key.bytes,
Gilles Peskine01126fa2018-07-12 17:04:55 +02003167 hash_alg );
Gilles Peskinefbfac682018-07-08 20:51:54 +02003168 }
3169 else
Gilles Peskine8c9def32018-02-08 10:02:12 +01003170#endif /* MBEDTLS_MD_C */
Gilles Peskinefbfac682018-07-08 20:51:54 +02003171 {
Jaeden Amero82df32e2018-11-23 15:11:20 +00003172 (void) key_bits;
Gilles Peskinefbfac682018-07-08 20:51:54 +02003173 status = PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine8c9def32018-02-08 10:02:12 +01003174 }
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003175
Gilles Peskined911eb72018-08-14 15:18:45 +02003176 if( truncated == 0 )
3177 {
3178 /* The "normal" case: untruncated algorithm. Nothing to do. */
3179 }
3180 else if( truncated < 4 )
3181 {
Gilles Peskine6d72ff92018-08-21 14:55:08 +02003182 /* A very short MAC is too short for security since it can be
3183 * brute-forced. Ancient protocols with 32-bit MACs do exist,
3184 * so we make this our minimum, even though 32 bits is still
3185 * too small for security. */
Gilles Peskined911eb72018-08-14 15:18:45 +02003186 status = PSA_ERROR_NOT_SUPPORTED;
3187 }
3188 else if( truncated > operation->mac_size )
3189 {
3190 /* It's impossible to "truncate" to a larger length. */
3191 status = PSA_ERROR_INVALID_ARGUMENT;
3192 }
3193 else
3194 operation->mac_size = truncated;
3195
Gilles Peskinefbfac682018-07-08 20:51:54 +02003196exit:
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003197 if( status != PSA_SUCCESS )
Gilles Peskine8c9def32018-02-08 10:02:12 +01003198 {
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02003199 psa_mac_abort( operation );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003200 }
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003201 else
3202 {
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003203 operation->key_set = 1;
3204 }
3205 return( status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003206}
3207
Gilles Peskine89167cb2018-07-08 20:12:23 +02003208psa_status_t psa_mac_sign_setup( psa_mac_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02003209 mbedtls_svc_key_id_t key,
Gilles Peskine89167cb2018-07-08 20:12:23 +02003210 psa_algorithm_t alg )
3211{
Ronald Croncf56a0a2020-08-04 09:51:30 +02003212 return( psa_mac_setup( operation, key, alg, 1 ) );
Gilles Peskine89167cb2018-07-08 20:12:23 +02003213}
3214
3215psa_status_t psa_mac_verify_setup( psa_mac_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02003216 mbedtls_svc_key_id_t key,
Gilles Peskine89167cb2018-07-08 20:12:23 +02003217 psa_algorithm_t alg )
3218{
Ronald Croncf56a0a2020-08-04 09:51:30 +02003219 return( psa_mac_setup( operation, key, alg, 0 ) );
Gilles Peskine89167cb2018-07-08 20:12:23 +02003220}
3221
Gilles Peskine8c9def32018-02-08 10:02:12 +01003222psa_status_t psa_mac_update( psa_mac_operation_t *operation,
3223 const uint8_t *input,
3224 size_t input_length )
3225{
Gilles Peskinefbfac682018-07-08 20:51:54 +02003226 psa_status_t status = PSA_ERROR_BAD_STATE;
Gilles Peskine8c9def32018-02-08 10:02:12 +01003227 if( ! operation->key_set )
Jaeden Ameroe236c2a2019-02-20 15:37:15 +00003228 return( PSA_ERROR_BAD_STATE );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003229 if( operation->iv_required && ! operation->iv_set )
Jaeden Ameroe236c2a2019-02-20 15:37:15 +00003230 return( PSA_ERROR_BAD_STATE );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003231 operation->has_input = 1;
3232
Gilles Peskine8c9def32018-02-08 10:02:12 +01003233#if defined(MBEDTLS_CMAC_C)
Gilles Peskinefbfac682018-07-08 20:51:54 +02003234 if( operation->alg == PSA_ALG_CMAC )
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03003235 {
Gilles Peskinefbfac682018-07-08 20:51:54 +02003236 int ret = mbedtls_cipher_cmac_update( &operation->ctx.cmac,
3237 input, input_length );
3238 status = mbedtls_to_psa_error( ret );
3239 }
3240 else
3241#endif /* MBEDTLS_CMAC_C */
3242#if defined(MBEDTLS_MD_C)
3243 if( PSA_ALG_IS_HMAC( operation->alg ) )
3244 {
3245 status = psa_hash_update( &operation->ctx.hmac.hash_ctx, input,
3246 input_length );
3247 }
3248 else
3249#endif /* MBEDTLS_MD_C */
3250 {
3251 /* This shouldn't happen if `operation` was initialized by
3252 * a setup function. */
Jaeden Ameroe236c2a2019-02-20 15:37:15 +00003253 return( PSA_ERROR_BAD_STATE );
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03003254 }
3255
Gilles Peskinefbfac682018-07-08 20:51:54 +02003256 if( status != PSA_SUCCESS )
3257 psa_mac_abort( operation );
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02003258 return( status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003259}
3260
Gilles Peskine01126fa2018-07-12 17:04:55 +02003261#if defined(MBEDTLS_MD_C)
3262static psa_status_t psa_hmac_finish_internal( psa_hmac_internal_data *hmac,
3263 uint8_t *mac,
3264 size_t mac_size )
3265{
Gilles Peskinec11c4dc2019-07-15 11:06:38 +02003266 uint8_t tmp[MBEDTLS_MD_MAX_SIZE];
Gilles Peskine01126fa2018-07-12 17:04:55 +02003267 psa_algorithm_t hash_alg = hmac->hash_ctx.alg;
3268 size_t hash_size = 0;
3269 size_t block_size = psa_get_hash_block_size( hash_alg );
3270 psa_status_t status;
3271
Gilles Peskine01126fa2018-07-12 17:04:55 +02003272 status = psa_hash_finish( &hmac->hash_ctx, tmp, sizeof( tmp ), &hash_size );
3273 if( status != PSA_SUCCESS )
3274 return( status );
3275 /* From here on, tmp needs to be wiped. */
3276
3277 status = psa_hash_setup( &hmac->hash_ctx, hash_alg );
3278 if( status != PSA_SUCCESS )
3279 goto exit;
3280
3281 status = psa_hash_update( &hmac->hash_ctx, hmac->opad, block_size );
3282 if( status != PSA_SUCCESS )
3283 goto exit;
3284
3285 status = psa_hash_update( &hmac->hash_ctx, tmp, hash_size );
3286 if( status != PSA_SUCCESS )
3287 goto exit;
3288
Gilles Peskined911eb72018-08-14 15:18:45 +02003289 status = psa_hash_finish( &hmac->hash_ctx, tmp, sizeof( tmp ), &hash_size );
3290 if( status != PSA_SUCCESS )
3291 goto exit;
3292
3293 memcpy( mac, tmp, mac_size );
Gilles Peskine01126fa2018-07-12 17:04:55 +02003294
3295exit:
Gilles Peskine3f108122018-12-07 18:14:53 +01003296 mbedtls_platform_zeroize( tmp, hash_size );
Gilles Peskine01126fa2018-07-12 17:04:55 +02003297 return( status );
3298}
3299#endif /* MBEDTLS_MD_C */
3300
mohammad16036df908f2018-04-02 08:34:15 -07003301static psa_status_t psa_mac_finish_internal( psa_mac_operation_t *operation,
Gilles Peskine2d277862018-06-18 15:41:12 +02003302 uint8_t *mac,
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003303 size_t mac_size )
Gilles Peskine8c9def32018-02-08 10:02:12 +01003304{
Gilles Peskine1d96fff2018-07-02 12:15:39 +02003305 if( ! operation->key_set )
3306 return( PSA_ERROR_BAD_STATE );
3307 if( operation->iv_required && ! operation->iv_set )
3308 return( PSA_ERROR_BAD_STATE );
3309
Gilles Peskine8c9def32018-02-08 10:02:12 +01003310 if( mac_size < operation->mac_size )
3311 return( PSA_ERROR_BUFFER_TOO_SMALL );
3312
Gilles Peskine8c9def32018-02-08 10:02:12 +01003313#if defined(MBEDTLS_CMAC_C)
Gilles Peskinefbfac682018-07-08 20:51:54 +02003314 if( operation->alg == PSA_ALG_CMAC )
3315 {
Gilles Peskined911eb72018-08-14 15:18:45 +02003316 uint8_t tmp[PSA_MAX_BLOCK_CIPHER_BLOCK_SIZE];
3317 int ret = mbedtls_cipher_cmac_finish( &operation->ctx.cmac, tmp );
3318 if( ret == 0 )
Gilles Peskine87b0ac42018-08-21 14:55:49 +02003319 memcpy( mac, tmp, operation->mac_size );
Gilles Peskine3f108122018-12-07 18:14:53 +01003320 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
Gilles Peskinefbfac682018-07-08 20:51:54 +02003321 return( mbedtls_to_psa_error( ret ) );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003322 }
Gilles Peskinefbfac682018-07-08 20:51:54 +02003323 else
3324#endif /* MBEDTLS_CMAC_C */
3325#if defined(MBEDTLS_MD_C)
3326 if( PSA_ALG_IS_HMAC( operation->alg ) )
3327 {
Gilles Peskine01126fa2018-07-12 17:04:55 +02003328 return( psa_hmac_finish_internal( &operation->ctx.hmac,
Gilles Peskined911eb72018-08-14 15:18:45 +02003329 mac, operation->mac_size ) );
Gilles Peskinefbfac682018-07-08 20:51:54 +02003330 }
3331 else
3332#endif /* MBEDTLS_MD_C */
3333 {
3334 /* This shouldn't happen if `operation` was initialized by
3335 * a setup function. */
3336 return( PSA_ERROR_BAD_STATE );
3337 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01003338}
3339
Gilles Peskineacd4be32018-07-08 19:56:25 +02003340psa_status_t psa_mac_sign_finish( psa_mac_operation_t *operation,
3341 uint8_t *mac,
3342 size_t mac_size,
3343 size_t *mac_length )
mohammad16036df908f2018-04-02 08:34:15 -07003344{
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003345 psa_status_t status;
3346
Jaeden Amero252ef282019-02-15 14:05:35 +00003347 if( operation->alg == 0 )
3348 {
3349 return( PSA_ERROR_BAD_STATE );
3350 }
3351
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003352 /* Fill the output buffer with something that isn't a valid mac
3353 * (barring an attack on the mac and deliberately-crafted input),
3354 * in case the caller doesn't check the return status properly. */
3355 *mac_length = mac_size;
3356 /* If mac_size is 0 then mac may be NULL and then the
3357 * call to memset would have undefined behavior. */
3358 if( mac_size != 0 )
3359 memset( mac, '!', mac_size );
3360
Gilles Peskine89167cb2018-07-08 20:12:23 +02003361 if( ! operation->is_sign )
3362 {
Jaeden Ameroe236c2a2019-02-20 15:37:15 +00003363 return( PSA_ERROR_BAD_STATE );
Gilles Peskine89167cb2018-07-08 20:12:23 +02003364 }
mohammad16036df908f2018-04-02 08:34:15 -07003365
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003366 status = psa_mac_finish_internal( operation, mac, mac_size );
3367
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003368 if( status == PSA_SUCCESS )
3369 {
3370 status = psa_mac_abort( operation );
3371 if( status == PSA_SUCCESS )
3372 *mac_length = operation->mac_size;
3373 else
3374 memset( mac, '!', mac_size );
3375 }
3376 else
3377 psa_mac_abort( operation );
3378 return( status );
mohammad16036df908f2018-04-02 08:34:15 -07003379}
3380
Gilles Peskineacd4be32018-07-08 19:56:25 +02003381psa_status_t psa_mac_verify_finish( psa_mac_operation_t *operation,
3382 const uint8_t *mac,
3383 size_t mac_length )
Gilles Peskine8c9def32018-02-08 10:02:12 +01003384{
Gilles Peskine828ed142018-06-18 23:25:51 +02003385 uint8_t actual_mac[PSA_MAC_MAX_SIZE];
mohammad16036df908f2018-04-02 08:34:15 -07003386 psa_status_t status;
3387
Jaeden Amero252ef282019-02-15 14:05:35 +00003388 if( operation->alg == 0 )
3389 {
3390 return( PSA_ERROR_BAD_STATE );
3391 }
3392
Gilles Peskine89167cb2018-07-08 20:12:23 +02003393 if( operation->is_sign )
3394 {
Jaeden Ameroe236c2a2019-02-20 15:37:15 +00003395 return( PSA_ERROR_BAD_STATE );
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003396 }
3397 if( operation->mac_size != mac_length )
3398 {
3399 status = PSA_ERROR_INVALID_SIGNATURE;
3400 goto cleanup;
Gilles Peskine89167cb2018-07-08 20:12:23 +02003401 }
mohammad16036df908f2018-04-02 08:34:15 -07003402
3403 status = psa_mac_finish_internal( operation,
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003404 actual_mac, sizeof( actual_mac ) );
Gilles Peskine28cd4162020-01-20 16:31:06 +01003405 if( status != PSA_SUCCESS )
3406 goto cleanup;
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003407
3408 if( safer_memcmp( mac, actual_mac, mac_length ) != 0 )
3409 status = PSA_ERROR_INVALID_SIGNATURE;
3410
3411cleanup:
3412 if( status == PSA_SUCCESS )
3413 status = psa_mac_abort( operation );
3414 else
3415 psa_mac_abort( operation );
3416
Gilles Peskine3f108122018-12-07 18:14:53 +01003417 mbedtls_platform_zeroize( actual_mac, sizeof( actual_mac ) );
Gilles Peskined911eb72018-08-14 15:18:45 +02003418
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003419 return( status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003420}
3421
3422
Gilles Peskine20035e32018-02-03 22:44:14 +01003423
Gilles Peskine20035e32018-02-03 22:44:14 +01003424/****************************************************************/
3425/* Asymmetric cryptography */
3426/****************************************************************/
3427
Gilles Peskine2b450e32018-06-27 15:42:46 +02003428#if defined(MBEDTLS_RSA_C)
Gilles Peskine8b18a4f2018-06-08 16:34:46 +02003429/* Decode the hash algorithm from alg and store the mbedtls encoding in
Gilles Peskine71ac7b12018-06-29 23:36:35 +02003430 * md_alg. Verify that the hash length is acceptable. */
Gilles Peskine8b18a4f2018-06-08 16:34:46 +02003431static psa_status_t psa_rsa_decode_md_type( psa_algorithm_t alg,
3432 size_t hash_length,
3433 mbedtls_md_type_t *md_alg )
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03003434{
Gilles Peskine7ed29c52018-06-26 15:50:08 +02003435 psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH( alg );
Gilles Peskine61b91d42018-06-08 16:09:36 +02003436 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
Gilles Peskine71ac7b12018-06-29 23:36:35 +02003437 *md_alg = mbedtls_md_get_type( md_info );
3438
3439 /* The Mbed TLS RSA module uses an unsigned int for hash length
3440 * parameters. Validate that it fits so that we don't risk an
3441 * overflow later. */
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03003442#if SIZE_MAX > UINT_MAX
Gilles Peskine71ac7b12018-06-29 23:36:35 +02003443 if( hash_length > UINT_MAX )
3444 return( PSA_ERROR_INVALID_ARGUMENT );
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03003445#endif
Gilles Peskine71ac7b12018-06-29 23:36:35 +02003446
3447#if defined(MBEDTLS_PKCS1_V15)
3448 /* For PKCS#1 v1.5 signature, if using a hash, the hash length
3449 * must be correct. */
3450 if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) &&
3451 alg != PSA_ALG_RSA_PKCS1V15_SIGN_RAW )
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03003452 {
Gilles Peskine71ac7b12018-06-29 23:36:35 +02003453 if( md_info == NULL )
3454 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine61b91d42018-06-08 16:09:36 +02003455 if( mbedtls_md_get_size( md_info ) != hash_length )
3456 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine71ac7b12018-06-29 23:36:35 +02003457 }
3458#endif /* MBEDTLS_PKCS1_V15 */
3459
3460#if defined(MBEDTLS_PKCS1_V21)
3461 /* PSS requires a hash internally. */
3462 if( PSA_ALG_IS_RSA_PSS( alg ) )
3463 {
Gilles Peskine61b91d42018-06-08 16:09:36 +02003464 if( md_info == NULL )
3465 return( PSA_ERROR_NOT_SUPPORTED );
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03003466 }
Gilles Peskine71ac7b12018-06-29 23:36:35 +02003467#endif /* MBEDTLS_PKCS1_V21 */
3468
Gilles Peskine61b91d42018-06-08 16:09:36 +02003469 return( PSA_SUCCESS );
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03003470}
3471
Gilles Peskine2b450e32018-06-27 15:42:46 +02003472static psa_status_t psa_rsa_sign( mbedtls_rsa_context *rsa,
3473 psa_algorithm_t alg,
3474 const uint8_t *hash,
3475 size_t hash_length,
3476 uint8_t *signature,
3477 size_t signature_size,
3478 size_t *signature_length )
3479{
3480 psa_status_t status;
Janos Follath24eed8d2019-11-22 13:21:35 +00003481 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2b450e32018-06-27 15:42:46 +02003482 mbedtls_md_type_t md_alg;
3483
3484 status = psa_rsa_decode_md_type( alg, hash_length, &md_alg );
3485 if( status != PSA_SUCCESS )
3486 return( status );
3487
Gilles Peskine630a18a2018-06-29 17:49:35 +02003488 if( signature_size < mbedtls_rsa_get_len( rsa ) )
Gilles Peskine2b450e32018-06-27 15:42:46 +02003489 return( PSA_ERROR_BUFFER_TOO_SMALL );
3490
3491#if defined(MBEDTLS_PKCS1_V15)
3492 if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) )
3493 {
3494 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V15,
3495 MBEDTLS_MD_NONE );
3496 ret = mbedtls_rsa_pkcs1_sign( rsa,
3497 mbedtls_ctr_drbg_random,
3498 &global_data.ctr_drbg,
3499 MBEDTLS_RSA_PRIVATE,
Jaeden Amerobbf97e32018-06-26 14:20:51 +01003500 md_alg,
3501 (unsigned int) hash_length,
3502 hash,
Gilles Peskine2b450e32018-06-27 15:42:46 +02003503 signature );
3504 }
3505 else
3506#endif /* MBEDTLS_PKCS1_V15 */
3507#if defined(MBEDTLS_PKCS1_V21)
3508 if( PSA_ALG_IS_RSA_PSS( alg ) )
3509 {
3510 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
3511 ret = mbedtls_rsa_rsassa_pss_sign( rsa,
3512 mbedtls_ctr_drbg_random,
3513 &global_data.ctr_drbg,
3514 MBEDTLS_RSA_PRIVATE,
Gilles Peskine71ac7b12018-06-29 23:36:35 +02003515 MBEDTLS_MD_NONE,
Jaeden Amerobbf97e32018-06-26 14:20:51 +01003516 (unsigned int) hash_length,
3517 hash,
Gilles Peskine2b450e32018-06-27 15:42:46 +02003518 signature );
3519 }
3520 else
3521#endif /* MBEDTLS_PKCS1_V21 */
3522 {
3523 return( PSA_ERROR_INVALID_ARGUMENT );
3524 }
3525
3526 if( ret == 0 )
Gilles Peskine630a18a2018-06-29 17:49:35 +02003527 *signature_length = mbedtls_rsa_get_len( rsa );
Gilles Peskine2b450e32018-06-27 15:42:46 +02003528 return( mbedtls_to_psa_error( ret ) );
3529}
3530
3531static psa_status_t psa_rsa_verify( mbedtls_rsa_context *rsa,
3532 psa_algorithm_t alg,
3533 const uint8_t *hash,
3534 size_t hash_length,
3535 const uint8_t *signature,
3536 size_t signature_length )
3537{
3538 psa_status_t status;
Janos Follath24eed8d2019-11-22 13:21:35 +00003539 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2b450e32018-06-27 15:42:46 +02003540 mbedtls_md_type_t md_alg;
3541
3542 status = psa_rsa_decode_md_type( alg, hash_length, &md_alg );
3543 if( status != PSA_SUCCESS )
3544 return( status );
3545
Gilles Peskine89cc74f2019-09-12 22:08:23 +02003546 if( signature_length != mbedtls_rsa_get_len( rsa ) )
3547 return( PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskine2b450e32018-06-27 15:42:46 +02003548
3549#if defined(MBEDTLS_PKCS1_V15)
3550 if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) )
3551 {
3552 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V15,
3553 MBEDTLS_MD_NONE );
3554 ret = mbedtls_rsa_pkcs1_verify( rsa,
3555 mbedtls_ctr_drbg_random,
3556 &global_data.ctr_drbg,
3557 MBEDTLS_RSA_PUBLIC,
3558 md_alg,
Jaeden Amerobbf97e32018-06-26 14:20:51 +01003559 (unsigned int) hash_length,
Gilles Peskine2b450e32018-06-27 15:42:46 +02003560 hash,
3561 signature );
3562 }
3563 else
3564#endif /* MBEDTLS_PKCS1_V15 */
3565#if defined(MBEDTLS_PKCS1_V21)
3566 if( PSA_ALG_IS_RSA_PSS( alg ) )
3567 {
3568 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
3569 ret = mbedtls_rsa_rsassa_pss_verify( rsa,
3570 mbedtls_ctr_drbg_random,
3571 &global_data.ctr_drbg,
3572 MBEDTLS_RSA_PUBLIC,
Gilles Peskine71ac7b12018-06-29 23:36:35 +02003573 MBEDTLS_MD_NONE,
Jaeden Amerobbf97e32018-06-26 14:20:51 +01003574 (unsigned int) hash_length,
3575 hash,
Gilles Peskine2b450e32018-06-27 15:42:46 +02003576 signature );
3577 }
3578 else
3579#endif /* MBEDTLS_PKCS1_V21 */
3580 {
3581 return( PSA_ERROR_INVALID_ARGUMENT );
3582 }
Gilles Peskineef12c632018-09-13 20:37:48 +02003583
3584 /* Mbed TLS distinguishes "invalid padding" from "valid padding but
3585 * the rest of the signature is invalid". This has little use in
3586 * practice and PSA doesn't report this distinction. */
3587 if( ret == MBEDTLS_ERR_RSA_INVALID_PADDING )
3588 return( PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskine2b450e32018-06-27 15:42:46 +02003589 return( mbedtls_to_psa_error( ret ) );
3590}
3591#endif /* MBEDTLS_RSA_C */
3592
John Durkopf87e3ae2020-10-26 15:25:23 -07003593#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003594/* `ecp` cannot be const because `ecp->grp` needs to be non-const
3595 * for mbedtls_ecdsa_sign() and mbedtls_ecdsa_sign_det()
3596 * (even though these functions don't modify it). */
3597static psa_status_t psa_ecdsa_sign( mbedtls_ecp_keypair *ecp,
3598 psa_algorithm_t alg,
3599 const uint8_t *hash,
3600 size_t hash_length,
3601 uint8_t *signature,
3602 size_t signature_size,
3603 size_t *signature_length )
3604{
Janos Follath24eed8d2019-11-22 13:21:35 +00003605 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003606 mbedtls_mpi r, s;
Gilles Peskineeae6eee2018-06-28 13:56:01 +02003607 size_t curve_bytes = PSA_BITS_TO_BYTES( ecp->grp.pbits );
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003608 mbedtls_mpi_init( &r );
3609 mbedtls_mpi_init( &s );
3610
Gilles Peskineeae6eee2018-06-28 13:56:01 +02003611 if( signature_size < 2 * curve_bytes )
3612 {
3613 ret = MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL;
3614 goto cleanup;
3615 }
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003616
John Durkop0ea39e02020-10-13 19:58:20 -07003617#if defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003618 if( PSA_ALG_DSA_IS_DETERMINISTIC( alg ) )
3619 {
3620 psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH( alg );
3621 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
3622 mbedtls_md_type_t md_alg = mbedtls_md_get_type( md_info );
Darryl Green5e843fa2019-09-05 14:06:34 +01003623 MBEDTLS_MPI_CHK( mbedtls_ecdsa_sign_det_ext( &ecp->grp, &r, &s,
3624 &ecp->d, hash,
3625 hash_length, md_alg,
3626 mbedtls_ctr_drbg_random,
3627 &global_data.ctr_drbg ) );
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003628 }
3629 else
John Durkop0ea39e02020-10-13 19:58:20 -07003630#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003631 {
Gilles Peskinea05219c2018-11-16 16:02:56 +01003632 (void) alg;
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003633 MBEDTLS_MPI_CHK( mbedtls_ecdsa_sign( &ecp->grp, &r, &s, &ecp->d,
3634 hash, hash_length,
3635 mbedtls_ctr_drbg_random,
3636 &global_data.ctr_drbg ) );
3637 }
Gilles Peskineeae6eee2018-06-28 13:56:01 +02003638
3639 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &r,
3640 signature,
3641 curve_bytes ) );
3642 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &s,
3643 signature + curve_bytes,
3644 curve_bytes ) );
3645
3646cleanup:
3647 mbedtls_mpi_free( &r );
3648 mbedtls_mpi_free( &s );
3649 if( ret == 0 )
3650 *signature_length = 2 * curve_bytes;
Gilles Peskineeae6eee2018-06-28 13:56:01 +02003651 return( mbedtls_to_psa_error( ret ) );
3652}
3653
3654static psa_status_t psa_ecdsa_verify( mbedtls_ecp_keypair *ecp,
3655 const uint8_t *hash,
3656 size_t hash_length,
3657 const uint8_t *signature,
3658 size_t signature_length )
3659{
Janos Follath24eed8d2019-11-22 13:21:35 +00003660 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskineeae6eee2018-06-28 13:56:01 +02003661 mbedtls_mpi r, s;
3662 size_t curve_bytes = PSA_BITS_TO_BYTES( ecp->grp.pbits );
3663 mbedtls_mpi_init( &r );
3664 mbedtls_mpi_init( &s );
3665
3666 if( signature_length != 2 * curve_bytes )
3667 return( PSA_ERROR_INVALID_SIGNATURE );
3668
3669 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &r,
3670 signature,
3671 curve_bytes ) );
3672 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &s,
3673 signature + curve_bytes,
3674 curve_bytes ) );
3675
Steven Cooremanacda8342020-07-24 23:09:52 +02003676 /* Check whether the public part is loaded. If not, load it. */
3677 if( mbedtls_ecp_is_zero( &ecp->Q ) )
3678 {
3679 MBEDTLS_MPI_CHK(
3680 mbedtls_ecp_mul( &ecp->grp, &ecp->Q, &ecp->d, &ecp->grp.G,
3681 mbedtls_ctr_drbg_random, &global_data.ctr_drbg ) );
3682 }
3683
Gilles Peskineeae6eee2018-06-28 13:56:01 +02003684 ret = mbedtls_ecdsa_verify( &ecp->grp, hash, hash_length,
3685 &ecp->Q, &r, &s );
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003686
3687cleanup:
3688 mbedtls_mpi_free( &r );
3689 mbedtls_mpi_free( &s );
3690 return( mbedtls_to_psa_error( ret ) );
3691}
John Durkopf87e3ae2020-10-26 15:25:23 -07003692#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA */
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003693
Ronald Croncf56a0a2020-08-04 09:51:30 +02003694psa_status_t psa_sign_hash( mbedtls_svc_key_id_t key,
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01003695 psa_algorithm_t alg,
3696 const uint8_t *hash,
3697 size_t hash_length,
3698 uint8_t *signature,
3699 size_t signature_size,
3700 size_t *signature_length )
Gilles Peskine20035e32018-02-03 22:44:14 +01003701{
Gilles Peskine2f060a82018-12-04 17:12:32 +01003702 psa_key_slot_t *slot;
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003703 psa_status_t status;
3704
3705 *signature_length = signature_size;
Gilles Peskine4019f0e2019-09-12 22:05:59 +02003706 /* Immediately reject a zero-length signature buffer. This guarantees
3707 * that signature must be a valid pointer. (On the other hand, the hash
3708 * buffer can in principle be empty since it doesn't actually have
3709 * to be a hash.) */
3710 if( signature_size == 0 )
3711 return( PSA_ERROR_BUFFER_TOO_SMALL );
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003712
Ronald Croncf56a0a2020-08-04 09:51:30 +02003713 status = psa_get_key_from_slot( key, &slot, PSA_KEY_USAGE_SIGN_HASH, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003714 if( status != PSA_SUCCESS )
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003715 goto exit;
Gilles Peskine8e338702019-07-30 20:06:31 +02003716 if( ! PSA_KEY_TYPE_IS_KEY_PAIR( slot->attr.type ) )
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003717 {
3718 status = PSA_ERROR_INVALID_ARGUMENT;
3719 goto exit;
3720 }
Gilles Peskine20035e32018-02-03 22:44:14 +01003721
Steven Cooremancd84cb42020-07-16 20:28:36 +02003722 /* Try any of the available accelerators first */
3723 status = psa_driver_wrapper_sign_hash( slot,
3724 alg,
3725 hash,
3726 hash_length,
3727 signature,
3728 signature_size,
3729 signature_length );
Steven Cooreman8d2bde72020-09-04 13:06:39 +02003730 if( status != PSA_ERROR_NOT_SUPPORTED ||
3731 psa_key_lifetime_is_external( slot->attr.lifetime ) )
Steven Cooremancd84cb42020-07-16 20:28:36 +02003732 goto exit;
3733
Steven Cooreman7a250572020-07-17 16:43:05 +02003734 /* If the operation was not supported by any accelerator, try fallback. */
Gilles Peskine20035e32018-02-03 22:44:14 +01003735#if defined(MBEDTLS_RSA_C)
Gilles Peskine8e338702019-07-30 20:06:31 +02003736 if( slot->attr.type == PSA_KEY_TYPE_RSA_KEY_PAIR )
Gilles Peskine20035e32018-02-03 22:44:14 +01003737 {
Steven Cooremana2371e52020-07-28 14:30:39 +02003738 mbedtls_rsa_context *rsa = NULL;
Steven Cooremana01795d2020-07-24 22:48:15 +02003739
Steven Cooreman4fed4552020-08-03 14:46:03 +02003740 status = psa_load_rsa_representation( slot->attr.type,
3741 slot->data.key.data,
Steven Cooreman7f391872020-07-30 14:57:44 +02003742 slot->data.key.bytes,
Steven Cooremana01795d2020-07-24 22:48:15 +02003743 &rsa );
3744 if( status != PSA_SUCCESS )
3745 goto exit;
3746
Steven Cooremana2371e52020-07-28 14:30:39 +02003747 status = psa_rsa_sign( rsa,
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003748 alg,
3749 hash, hash_length,
3750 signature, signature_size,
3751 signature_length );
Steven Cooremana01795d2020-07-24 22:48:15 +02003752
Steven Cooremana2371e52020-07-28 14:30:39 +02003753 mbedtls_rsa_free( rsa );
3754 mbedtls_free( rsa );
Gilles Peskine20035e32018-02-03 22:44:14 +01003755 }
3756 else
3757#endif /* defined(MBEDTLS_RSA_C) */
3758#if defined(MBEDTLS_ECP_C)
Gilles Peskine8e338702019-07-30 20:06:31 +02003759 if( PSA_KEY_TYPE_IS_ECC( slot->attr.type ) )
Gilles Peskine20035e32018-02-03 22:44:14 +01003760 {
John Durkop0ea39e02020-10-13 19:58:20 -07003761#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA)
Gilles Peskinea05219c2018-11-16 16:02:56 +01003762 if(
John Durkop0ea39e02020-10-13 19:58:20 -07003763#if defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
Gilles Peskinea05219c2018-11-16 16:02:56 +01003764 PSA_ALG_IS_ECDSA( alg )
3765#else
3766 PSA_ALG_IS_RANDOMIZED_ECDSA( alg )
3767#endif
3768 )
Steven Cooremanacda8342020-07-24 23:09:52 +02003769 {
Steven Cooremana2371e52020-07-28 14:30:39 +02003770 mbedtls_ecp_keypair *ecp = NULL;
Steven Cooreman4fed4552020-08-03 14:46:03 +02003771 status = psa_load_ecp_representation( slot->attr.type,
3772 slot->data.key.data,
Steven Cooreman7f391872020-07-30 14:57:44 +02003773 slot->data.key.bytes,
Steven Cooreman7f391872020-07-30 14:57:44 +02003774 &ecp );
Steven Cooremanacda8342020-07-24 23:09:52 +02003775 if( status != PSA_SUCCESS )
3776 goto exit;
Steven Cooremana2371e52020-07-28 14:30:39 +02003777 status = psa_ecdsa_sign( ecp,
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003778 alg,
3779 hash, hash_length,
3780 signature, signature_size,
3781 signature_length );
Steven Cooremana2371e52020-07-28 14:30:39 +02003782 mbedtls_ecp_keypair_free( ecp );
3783 mbedtls_free( ecp );
Steven Cooremanacda8342020-07-24 23:09:52 +02003784 }
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003785 else
John Durkop0ea39e02020-10-13 19:58:20 -07003786#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) */
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003787 {
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003788 status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003789 }
itayzafrir5c753392018-05-08 11:18:38 +03003790 }
3791 else
3792#endif /* defined(MBEDTLS_ECP_C) */
3793 {
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003794 status = PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine20035e32018-02-03 22:44:14 +01003795 }
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003796
3797exit:
3798 /* Fill the unused part of the output buffer (the whole buffer on error,
3799 * the trailing part on success) with something that isn't a valid mac
3800 * (barring an attack on the mac and deliberately-crafted input),
3801 * in case the caller doesn't check the return status properly. */
3802 if( status == PSA_SUCCESS )
3803 memset( signature + *signature_length, '!',
3804 signature_size - *signature_length );
Gilles Peskine4019f0e2019-09-12 22:05:59 +02003805 else
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003806 memset( signature, '!', signature_size );
Gilles Peskine46f1fd72018-06-28 19:31:31 +02003807 /* If signature_size is 0 then we have nothing to do. We must not call
3808 * memset because signature may be NULL in this case. */
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003809 return( status );
itayzafrir5c753392018-05-08 11:18:38 +03003810}
3811
Ronald Croncf56a0a2020-08-04 09:51:30 +02003812psa_status_t psa_verify_hash( mbedtls_svc_key_id_t key,
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01003813 psa_algorithm_t alg,
3814 const uint8_t *hash,
3815 size_t hash_length,
3816 const uint8_t *signature,
3817 size_t signature_length )
itayzafrir5c753392018-05-08 11:18:38 +03003818{
Gilles Peskine2f060a82018-12-04 17:12:32 +01003819 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003820 psa_status_t status;
Gilles Peskine2b450e32018-06-27 15:42:46 +02003821
Ronald Croncf56a0a2020-08-04 09:51:30 +02003822 status = psa_get_key_from_slot( key, &slot,
3823 PSA_KEY_USAGE_VERIFY_HASH, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003824 if( status != PSA_SUCCESS )
3825 return( status );
itayzafrir5c753392018-05-08 11:18:38 +03003826
Steven Cooreman55ae2172020-07-17 19:46:15 +02003827 /* Try any of the available accelerators first */
3828 status = psa_driver_wrapper_verify_hash( slot,
3829 alg,
3830 hash,
3831 hash_length,
3832 signature,
3833 signature_length );
Steven Cooreman8d2bde72020-09-04 13:06:39 +02003834 if( status != PSA_ERROR_NOT_SUPPORTED ||
3835 psa_key_lifetime_is_external( slot->attr.lifetime ) )
Steven Cooreman55ae2172020-07-17 19:46:15 +02003836 return status;
3837
Gilles Peskine61b91d42018-06-08 16:09:36 +02003838#if defined(MBEDTLS_RSA_C)
Gilles Peskine8e338702019-07-30 20:06:31 +02003839 if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003840 {
Steven Cooremana2371e52020-07-28 14:30:39 +02003841 mbedtls_rsa_context *rsa = NULL;
Steven Cooremana01795d2020-07-24 22:48:15 +02003842
Steven Cooreman4fed4552020-08-03 14:46:03 +02003843 status = psa_load_rsa_representation( slot->attr.type,
3844 slot->data.key.data,
Steven Cooreman7f391872020-07-30 14:57:44 +02003845 slot->data.key.bytes,
Steven Cooreman7f391872020-07-30 14:57:44 +02003846 &rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02003847 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02003848 return( status );
Steven Cooremana01795d2020-07-24 22:48:15 +02003849
Steven Cooremana2371e52020-07-28 14:30:39 +02003850 status = psa_rsa_verify( rsa,
Steven Cooremana01795d2020-07-24 22:48:15 +02003851 alg,
3852 hash, hash_length,
3853 signature, signature_length );
Steven Cooremana2371e52020-07-28 14:30:39 +02003854 mbedtls_rsa_free( rsa );
3855 mbedtls_free( rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02003856 return( status );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003857 }
3858 else
3859#endif /* defined(MBEDTLS_RSA_C) */
itayzafrir5c753392018-05-08 11:18:38 +03003860#if defined(MBEDTLS_ECP_C)
Gilles Peskine8e338702019-07-30 20:06:31 +02003861 if( PSA_KEY_TYPE_IS_ECC( slot->attr.type ) )
itayzafrir5c753392018-05-08 11:18:38 +03003862 {
John Durkopf87e3ae2020-10-26 15:25:23 -07003863#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003864 if( PSA_ALG_IS_ECDSA( alg ) )
Steven Cooremanacda8342020-07-24 23:09:52 +02003865 {
Steven Cooremana2371e52020-07-28 14:30:39 +02003866 mbedtls_ecp_keypair *ecp = NULL;
Steven Cooreman4fed4552020-08-03 14:46:03 +02003867 status = psa_load_ecp_representation( slot->attr.type,
3868 slot->data.key.data,
Steven Cooreman7f391872020-07-30 14:57:44 +02003869 slot->data.key.bytes,
Steven Cooreman7f391872020-07-30 14:57:44 +02003870 &ecp );
Steven Cooremanacda8342020-07-24 23:09:52 +02003871 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02003872 return( status );
Steven Cooremana2371e52020-07-28 14:30:39 +02003873 status = psa_ecdsa_verify( ecp,
Steven Cooremanacda8342020-07-24 23:09:52 +02003874 hash, hash_length,
3875 signature, signature_length );
Steven Cooremana2371e52020-07-28 14:30:39 +02003876 mbedtls_ecp_keypair_free( ecp );
3877 mbedtls_free( ecp );
Steven Cooreman29149862020-08-05 15:43:42 +02003878 return( status );
Steven Cooremanacda8342020-07-24 23:09:52 +02003879 }
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003880 else
John Durkopf87e3ae2020-10-26 15:25:23 -07003881#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003882 {
3883 return( PSA_ERROR_INVALID_ARGUMENT );
3884 }
itayzafrir5c753392018-05-08 11:18:38 +03003885 }
Gilles Peskine20035e32018-02-03 22:44:14 +01003886 else
3887#endif /* defined(MBEDTLS_ECP_C) */
3888 {
3889 return( PSA_ERROR_NOT_SUPPORTED );
3890 }
3891}
3892
Gilles Peskine072ac562018-06-30 00:21:29 +02003893#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PKCS1_V21)
3894static void psa_rsa_oaep_set_padding_mode( psa_algorithm_t alg,
3895 mbedtls_rsa_context *rsa )
3896{
3897 psa_algorithm_t hash_alg = PSA_ALG_RSA_OAEP_GET_HASH( alg );
3898 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
3899 mbedtls_md_type_t md_alg = mbedtls_md_get_type( md_info );
3900 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
3901}
3902#endif /* defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PKCS1_V21) */
3903
Ronald Croncf56a0a2020-08-04 09:51:30 +02003904psa_status_t psa_asymmetric_encrypt( mbedtls_svc_key_id_t key,
Gilles Peskine61b91d42018-06-08 16:09:36 +02003905 psa_algorithm_t alg,
3906 const uint8_t *input,
3907 size_t input_length,
3908 const uint8_t *salt,
3909 size_t salt_length,
3910 uint8_t *output,
3911 size_t output_size,
3912 size_t *output_length )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003913{
Gilles Peskine2f060a82018-12-04 17:12:32 +01003914 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003915 psa_status_t status;
3916
Darryl Green5cc689a2018-07-24 15:34:10 +01003917 (void) input;
3918 (void) input_length;
3919 (void) salt;
3920 (void) output;
3921 (void) output_size;
3922
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03003923 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003924
Gilles Peskineb3fc05d2018-06-30 19:04:35 +02003925 if( ! PSA_ALG_IS_RSA_OAEP( alg ) && salt_length != 0 )
3926 return( PSA_ERROR_INVALID_ARGUMENT );
3927
Ronald Croncf56a0a2020-08-04 09:51:30 +02003928 status = psa_get_transparent_key( key, &slot, PSA_KEY_USAGE_ENCRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003929 if( status != PSA_SUCCESS )
3930 return( status );
Gilles Peskine8e338702019-07-30 20:06:31 +02003931 if( ! ( PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->attr.type ) ||
3932 PSA_KEY_TYPE_IS_KEY_PAIR( slot->attr.type ) ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003933 return( PSA_ERROR_INVALID_ARGUMENT );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003934
3935#if defined(MBEDTLS_RSA_C)
Gilles Peskine8e338702019-07-30 20:06:31 +02003936 if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003937 {
Steven Cooremana2371e52020-07-28 14:30:39 +02003938 mbedtls_rsa_context *rsa = NULL;
Steven Cooreman4fed4552020-08-03 14:46:03 +02003939 status = psa_load_rsa_representation( slot->attr.type,
3940 slot->data.key.data,
Steven Cooreman7f391872020-07-30 14:57:44 +02003941 slot->data.key.bytes,
Steven Cooreman7f391872020-07-30 14:57:44 +02003942 &rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02003943 if( status != PSA_SUCCESS )
Steven Cooreman4fed4552020-08-03 14:46:03 +02003944 goto rsa_exit;
Steven Cooremana2371e52020-07-28 14:30:39 +02003945
3946 if( output_size < mbedtls_rsa_get_len( rsa ) )
Steven Cooremana01795d2020-07-24 22:48:15 +02003947 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02003948 status = PSA_ERROR_BUFFER_TOO_SMALL;
3949 goto rsa_exit;
Steven Cooremana01795d2020-07-24 22:48:15 +02003950 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003951#if defined(MBEDTLS_PKCS1_V15)
Gilles Peskine6afe7892018-05-31 13:16:08 +02003952 if( alg == PSA_ALG_RSA_PKCS1V15_CRYPT )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003953 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02003954 status = mbedtls_to_psa_error(
3955 mbedtls_rsa_pkcs1_encrypt( rsa,
3956 mbedtls_ctr_drbg_random,
3957 &global_data.ctr_drbg,
3958 MBEDTLS_RSA_PUBLIC,
3959 input_length,
3960 input,
3961 output ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003962 }
3963 else
3964#endif /* MBEDTLS_PKCS1_V15 */
3965#if defined(MBEDTLS_PKCS1_V21)
Gilles Peskine55bf3d12018-06-26 15:53:48 +02003966 if( PSA_ALG_IS_RSA_OAEP( alg ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003967 {
Steven Cooremana2371e52020-07-28 14:30:39 +02003968 psa_rsa_oaep_set_padding_mode( alg, rsa );
Steven Cooreman4fed4552020-08-03 14:46:03 +02003969 status = mbedtls_to_psa_error(
3970 mbedtls_rsa_rsaes_oaep_encrypt( rsa,
3971 mbedtls_ctr_drbg_random,
3972 &global_data.ctr_drbg,
3973 MBEDTLS_RSA_PUBLIC,
3974 salt, salt_length,
3975 input_length,
3976 input,
3977 output ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003978 }
3979 else
3980#endif /* MBEDTLS_PKCS1_V21 */
3981 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02003982 status = PSA_ERROR_INVALID_ARGUMENT;
3983 goto rsa_exit;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003984 }
Steven Cooreman4fed4552020-08-03 14:46:03 +02003985rsa_exit:
3986 if( status == PSA_SUCCESS )
Steven Cooremana2371e52020-07-28 14:30:39 +02003987 *output_length = mbedtls_rsa_get_len( rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02003988
Steven Cooremana2371e52020-07-28 14:30:39 +02003989 mbedtls_rsa_free( rsa );
3990 mbedtls_free( rsa );
Steven Cooreman4fed4552020-08-03 14:46:03 +02003991 return( status );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003992 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003993 else
Gilles Peskineb75e4f12018-06-08 17:44:47 +02003994#endif /* defined(MBEDTLS_RSA_C) */
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003995 {
3996 return( PSA_ERROR_NOT_SUPPORTED );
3997 }
Gilles Peskine5b051bc2018-05-31 13:25:48 +02003998}
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003999
Ronald Croncf56a0a2020-08-04 09:51:30 +02004000psa_status_t psa_asymmetric_decrypt( mbedtls_svc_key_id_t key,
Gilles Peskine61b91d42018-06-08 16:09:36 +02004001 psa_algorithm_t alg,
4002 const uint8_t *input,
4003 size_t input_length,
4004 const uint8_t *salt,
4005 size_t salt_length,
4006 uint8_t *output,
4007 size_t output_size,
4008 size_t *output_length )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004009{
Gilles Peskine2f060a82018-12-04 17:12:32 +01004010 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02004011 psa_status_t status;
4012
Darryl Green5cc689a2018-07-24 15:34:10 +01004013 (void) input;
4014 (void) input_length;
4015 (void) salt;
4016 (void) output;
4017 (void) output_size;
4018
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03004019 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004020
Gilles Peskineb3fc05d2018-06-30 19:04:35 +02004021 if( ! PSA_ALG_IS_RSA_OAEP( alg ) && salt_length != 0 )
4022 return( PSA_ERROR_INVALID_ARGUMENT );
4023
Ronald Croncf56a0a2020-08-04 09:51:30 +02004024 status = psa_get_transparent_key( key, &slot, PSA_KEY_USAGE_DECRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02004025 if( status != PSA_SUCCESS )
4026 return( status );
Gilles Peskine8e338702019-07-30 20:06:31 +02004027 if( ! PSA_KEY_TYPE_IS_KEY_PAIR( slot->attr.type ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004028 return( PSA_ERROR_INVALID_ARGUMENT );
4029
4030#if defined(MBEDTLS_RSA_C)
Gilles Peskine8e338702019-07-30 20:06:31 +02004031 if( slot->attr.type == PSA_KEY_TYPE_RSA_KEY_PAIR )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004032 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02004033 mbedtls_rsa_context *rsa = NULL;
4034 status = psa_load_rsa_representation( slot->attr.type,
4035 slot->data.key.data,
Steven Cooreman7f391872020-07-30 14:57:44 +02004036 slot->data.key.bytes,
Steven Cooreman7f391872020-07-30 14:57:44 +02004037 &rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02004038 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02004039 return( status );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004040
Steven Cooremana2371e52020-07-28 14:30:39 +02004041 if( input_length != mbedtls_rsa_get_len( rsa ) )
Steven Cooremana01795d2020-07-24 22:48:15 +02004042 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02004043 status = PSA_ERROR_INVALID_ARGUMENT;
4044 goto rsa_exit;
Steven Cooremana01795d2020-07-24 22:48:15 +02004045 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004046
4047#if defined(MBEDTLS_PKCS1_V15)
Gilles Peskine6afe7892018-05-31 13:16:08 +02004048 if( alg == PSA_ALG_RSA_PKCS1V15_CRYPT )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004049 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02004050 status = mbedtls_to_psa_error(
4051 mbedtls_rsa_pkcs1_decrypt( rsa,
4052 mbedtls_ctr_drbg_random,
4053 &global_data.ctr_drbg,
4054 MBEDTLS_RSA_PRIVATE,
4055 output_length,
4056 input,
4057 output,
4058 output_size ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004059 }
4060 else
4061#endif /* MBEDTLS_PKCS1_V15 */
4062#if defined(MBEDTLS_PKCS1_V21)
Gilles Peskine55bf3d12018-06-26 15:53:48 +02004063 if( PSA_ALG_IS_RSA_OAEP( alg ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004064 {
Steven Cooremana2371e52020-07-28 14:30:39 +02004065 psa_rsa_oaep_set_padding_mode( alg, rsa );
Steven Cooreman4fed4552020-08-03 14:46:03 +02004066 status = mbedtls_to_psa_error(
4067 mbedtls_rsa_rsaes_oaep_decrypt( rsa,
4068 mbedtls_ctr_drbg_random,
4069 &global_data.ctr_drbg,
4070 MBEDTLS_RSA_PRIVATE,
4071 salt, salt_length,
4072 output_length,
4073 input,
4074 output,
4075 output_size ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004076 }
4077 else
4078#endif /* MBEDTLS_PKCS1_V21 */
4079 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02004080 status = PSA_ERROR_INVALID_ARGUMENT;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004081 }
Nir Sonnenschein717a0402018-06-04 16:36:15 +03004082
Steven Cooreman4fed4552020-08-03 14:46:03 +02004083rsa_exit:
Steven Cooremana2371e52020-07-28 14:30:39 +02004084 mbedtls_rsa_free( rsa );
4085 mbedtls_free( rsa );
Steven Cooreman4fed4552020-08-03 14:46:03 +02004086 return( status );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004087 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004088 else
Gilles Peskineb75e4f12018-06-08 17:44:47 +02004089#endif /* defined(MBEDTLS_RSA_C) */
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004090 {
4091 return( PSA_ERROR_NOT_SUPPORTED );
4092 }
Gilles Peskine5b051bc2018-05-31 13:25:48 +02004093}
Gilles Peskine20035e32018-02-03 22:44:14 +01004094
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02004095
4096
mohammad1603503973b2018-03-12 15:59:30 +02004097/****************************************************************/
4098/* Symmetric cryptography */
4099/****************************************************************/
4100
Gilles Peskinee553c652018-06-04 16:22:46 +02004101static psa_status_t psa_cipher_setup( psa_cipher_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02004102 mbedtls_svc_key_id_t key,
Gilles Peskine7e928852018-06-04 16:23:10 +02004103 psa_algorithm_t alg,
4104 mbedtls_operation_t cipher_operation )
mohammad1603503973b2018-03-12 15:59:30 +02004105{
Gilles Peskine9ab61b62019-02-25 17:43:14 +01004106 int ret = 0;
4107 psa_status_t status = PSA_ERROR_GENERIC_ERROR;
Gilles Peskine2f060a82018-12-04 17:12:32 +01004108 psa_key_slot_t *slot;
mohammad1603503973b2018-03-12 15:59:30 +02004109 size_t key_bits;
4110 const mbedtls_cipher_info_t *cipher_info = NULL;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02004111 psa_key_usage_t usage = ( cipher_operation == MBEDTLS_ENCRYPT ?
4112 PSA_KEY_USAGE_ENCRYPT :
4113 PSA_KEY_USAGE_DECRYPT );
mohammad1603503973b2018-03-12 15:59:30 +02004114
Steven Cooremand3feccd2020-09-01 15:56:14 +02004115 /* A context must be freshly initialized before it can be set up. */
4116 if( operation->alg != 0 )
4117 return( PSA_ERROR_BAD_STATE );
4118
Steven Cooremana07b9972020-09-10 14:54:14 +02004119 /* The requested algorithm must be one that can be processed by cipher. */
4120 if( ! PSA_ALG_IS_CIPHER( alg ) )
Steven Cooremana07b9972020-09-10 14:54:14 +02004121 return( PSA_ERROR_INVALID_ARGUMENT );
Steven Cooremand3feccd2020-09-01 15:56:14 +02004122
Steven Cooremanef8575e2020-09-11 11:44:50 +02004123 /* Fetch key material from key storage. */
Ronald Croncf56a0a2020-08-04 09:51:30 +02004124 status = psa_get_key_from_slot( key, &slot, usage, alg );
Steven Cooremanef8575e2020-09-11 11:44:50 +02004125 if( status != PSA_SUCCESS )
4126 goto exit;
4127
4128 /* Initialize the operation struct members, except for alg. The alg member
4129 * is used to indicate to psa_cipher_abort that there are resources to free,
4130 * so we only set it after resources have been allocated/initialized. */
Steven Cooremana07b9972020-09-10 14:54:14 +02004131 operation->key_set = 0;
4132 operation->iv_set = 0;
Steven Cooremanef8575e2020-09-11 11:44:50 +02004133 operation->mbedtls_in_use = 0;
Steven Cooremana07b9972020-09-10 14:54:14 +02004134 operation->iv_size = 0;
4135 operation->block_size = 0;
4136 if( alg == PSA_ALG_ECB_NO_PADDING )
4137 operation->iv_required = 0;
4138 else
4139 operation->iv_required = 1;
4140
Steven Cooremana07b9972020-09-10 14:54:14 +02004141 /* Try doing the operation through a driver before using software fallback. */
Steven Cooreman37941cb2020-07-28 18:49:51 +02004142 if( cipher_operation == MBEDTLS_ENCRYPT )
Steven Cooremanfb81aa52020-09-09 12:01:43 +02004143 status = psa_driver_wrapper_cipher_encrypt_setup( &operation->ctx.driver,
Steven Cooreman37941cb2020-07-28 18:49:51 +02004144 slot,
4145 alg );
4146 else
Steven Cooremanfb81aa52020-09-09 12:01:43 +02004147 status = psa_driver_wrapper_cipher_decrypt_setup( &operation->ctx.driver,
Steven Cooreman37941cb2020-07-28 18:49:51 +02004148 slot,
4149 alg );
4150
Steven Cooremanef8575e2020-09-11 11:44:50 +02004151 if( status == PSA_SUCCESS )
Steven Cooreman6d81f7e2020-09-14 13:14:31 +02004152 {
Steven Cooremanef8575e2020-09-11 11:44:50 +02004153 /* Once the driver context is initialised, it needs to be freed using
4154 * psa_cipher_abort. Indicate this through setting alg. */
4155 operation->alg = alg;
Steven Cooreman6d81f7e2020-09-14 13:14:31 +02004156 }
Steven Cooremanef8575e2020-09-11 11:44:50 +02004157
Steven Cooremand3feccd2020-09-01 15:56:14 +02004158 if( status != PSA_ERROR_NOT_SUPPORTED ||
4159 psa_key_lifetime_is_external( slot->attr.lifetime ) )
4160 goto exit;
4161
Steven Cooremana07b9972020-09-10 14:54:14 +02004162 /* Proceed with initializing an mbed TLS cipher context if no driver is
Steven Cooremand3feccd2020-09-01 15:56:14 +02004163 * available for the given algorithm & key. */
4164 mbedtls_cipher_init( &operation->ctx.cipher );
mohammad1603503973b2018-03-12 15:59:30 +02004165
Steven Cooremana07b9972020-09-10 14:54:14 +02004166 /* Once the cipher context is initialised, it needs to be freed using
Steven Cooremanef8575e2020-09-11 11:44:50 +02004167 * psa_cipher_abort. Indicate there is something to be freed through setting
4168 * alg, and indicate the operation is being done using mbedtls crypto through
4169 * setting mbedtls_in_use. */
Steven Cooremana07b9972020-09-10 14:54:14 +02004170 operation->alg = alg;
Steven Cooremanef8575e2020-09-11 11:44:50 +02004171 operation->mbedtls_in_use = 1;
Steven Cooremana07b9972020-09-10 14:54:14 +02004172
Gilles Peskinedb4b3ab2019-04-18 12:53:01 +02004173 key_bits = psa_get_key_slot_bits( slot );
Gilles Peskine8e338702019-07-30 20:06:31 +02004174 cipher_info = mbedtls_cipher_info_from_psa( alg, slot->attr.type, key_bits, NULL );
mohammad1603503973b2018-03-12 15:59:30 +02004175 if( cipher_info == NULL )
Gilles Peskine9ab61b62019-02-25 17:43:14 +01004176 {
4177 status = PSA_ERROR_NOT_SUPPORTED;
4178 goto exit;
4179 }
mohammad1603503973b2018-03-12 15:59:30 +02004180
mohammad1603503973b2018-03-12 15:59:30 +02004181 ret = mbedtls_cipher_setup( &operation->ctx.cipher, cipher_info );
Moran Peker41deec42018-04-04 15:43:05 +03004182 if( ret != 0 )
Gilles Peskine9ab61b62019-02-25 17:43:14 +01004183 goto exit;
mohammad1603503973b2018-03-12 15:59:30 +02004184
Gilles Peskine9ad29e22018-06-21 09:40:04 +02004185#if defined(MBEDTLS_DES_C)
Gilles Peskine8e338702019-07-30 20:06:31 +02004186 if( slot->attr.type == PSA_KEY_TYPE_DES && key_bits == 128 )
Gilles Peskine9ad29e22018-06-21 09:40:04 +02004187 {
4188 /* Two-key Triple-DES is 3-key Triple-DES with K1=K3 */
Gilles Peskinec11c4dc2019-07-15 11:06:38 +02004189 uint8_t keys[24];
Steven Cooreman71fd80d2020-07-07 21:12:27 +02004190 memcpy( keys, slot->data.key.data, 16 );
4191 memcpy( keys + 16, slot->data.key.data, 8 );
Gilles Peskine9ad29e22018-06-21 09:40:04 +02004192 ret = mbedtls_cipher_setkey( &operation->ctx.cipher,
4193 keys,
4194 192, cipher_operation );
4195 }
4196 else
4197#endif
4198 {
4199 ret = mbedtls_cipher_setkey( &operation->ctx.cipher,
Steven Cooreman71fd80d2020-07-07 21:12:27 +02004200 slot->data.key.data,
Jaeden Amero23bbb752018-06-26 14:16:54 +01004201 (int) key_bits, cipher_operation );
Gilles Peskine9ad29e22018-06-21 09:40:04 +02004202 }
Moran Peker41deec42018-04-04 15:43:05 +03004203 if( ret != 0 )
Gilles Peskine9ab61b62019-02-25 17:43:14 +01004204 goto exit;
mohammad1603503973b2018-03-12 15:59:30 +02004205
mohammad16038481e742018-03-18 13:57:31 +02004206#if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING)
Gilles Peskinedaea26f2018-08-21 14:02:45 +02004207 switch( alg )
mohammad16038481e742018-03-18 13:57:31 +02004208 {
Gilles Peskinedaea26f2018-08-21 14:02:45 +02004209 case PSA_ALG_CBC_NO_PADDING:
4210 ret = mbedtls_cipher_set_padding_mode( &operation->ctx.cipher,
4211 MBEDTLS_PADDING_NONE );
4212 break;
4213 case PSA_ALG_CBC_PKCS7:
4214 ret = mbedtls_cipher_set_padding_mode( &operation->ctx.cipher,
4215 MBEDTLS_PADDING_PKCS7 );
4216 break;
4217 default:
4218 /* The algorithm doesn't involve padding. */
4219 ret = 0;
4220 break;
4221 }
4222 if( ret != 0 )
Gilles Peskine9ab61b62019-02-25 17:43:14 +01004223 goto exit;
mohammad16038481e742018-03-18 13:57:31 +02004224#endif //MBEDTLS_CIPHER_MODE_WITH_PADDING
4225
Gilles Peskinedaea26f2018-08-21 14:02:45 +02004226 operation->block_size = ( PSA_ALG_IS_STREAM_CIPHER( alg ) ? 1 :
Gilles Peskine8e338702019-07-30 20:06:31 +02004227 PSA_BLOCK_CIPHER_BLOCK_SIZE( slot->attr.type ) );
Steven Cooremana6033e92020-08-25 11:47:50 +02004228 if( ( alg & PSA_ALG_CIPHER_FROM_BLOCK_FLAG ) != 0 &&
4229 alg != PSA_ALG_ECB_NO_PADDING )
mohammad16038481e742018-03-18 13:57:31 +02004230 {
Gilles Peskine8e338702019-07-30 20:06:31 +02004231 operation->iv_size = PSA_BLOCK_CIPHER_BLOCK_SIZE( slot->attr.type );
mohammad16038481e742018-03-18 13:57:31 +02004232 }
Gilles Peskine26869f22019-05-06 15:25:00 +02004233#if defined(MBEDTLS_CHACHA20_C)
4234 else
4235 if( alg == PSA_ALG_CHACHA20 )
4236 operation->iv_size = 12;
4237#endif
mohammad1603503973b2018-03-12 15:59:30 +02004238
Steven Cooreman7df02922020-09-09 15:28:49 +02004239 status = PSA_SUCCESS;
4240
Gilles Peskine9ab61b62019-02-25 17:43:14 +01004241exit:
Steven Cooreman7df02922020-09-09 15:28:49 +02004242 if( ret != 0 )
Gilles Peskine9ab61b62019-02-25 17:43:14 +01004243 status = mbedtls_to_psa_error( ret );
Steven Cooreman7df02922020-09-09 15:28:49 +02004244 if( status == PSA_SUCCESS )
4245 {
4246 /* Update operation flags for both driver and software implementations */
4247 operation->key_set = 1;
4248 }
4249 else
Gilles Peskine9ab61b62019-02-25 17:43:14 +01004250 psa_cipher_abort( operation );
4251 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02004252}
4253
Gilles Peskinefe119512018-07-08 21:39:34 +02004254psa_status_t psa_cipher_encrypt_setup( psa_cipher_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02004255 mbedtls_svc_key_id_t key,
Gilles Peskinefe119512018-07-08 21:39:34 +02004256 psa_algorithm_t alg )
mohammad16038481e742018-03-18 13:57:31 +02004257{
Ronald Croncf56a0a2020-08-04 09:51:30 +02004258 return( psa_cipher_setup( operation, key, alg, MBEDTLS_ENCRYPT ) );
mohammad16038481e742018-03-18 13:57:31 +02004259}
4260
Gilles Peskinefe119512018-07-08 21:39:34 +02004261psa_status_t psa_cipher_decrypt_setup( psa_cipher_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02004262 mbedtls_svc_key_id_t key,
Gilles Peskinefe119512018-07-08 21:39:34 +02004263 psa_algorithm_t alg )
mohammad16038481e742018-03-18 13:57:31 +02004264{
Ronald Croncf56a0a2020-08-04 09:51:30 +02004265 return( psa_cipher_setup( operation, key, alg, MBEDTLS_DECRYPT ) );
mohammad16038481e742018-03-18 13:57:31 +02004266}
4267
Gilles Peskinefe119512018-07-08 21:39:34 +02004268psa_status_t psa_cipher_generate_iv( psa_cipher_operation_t *operation,
Andrew Thoelke163639b2019-05-15 12:33:23 +01004269 uint8_t *iv,
Gilles Peskinefe119512018-07-08 21:39:34 +02004270 size_t iv_size,
4271 size_t *iv_length )
mohammad1603503973b2018-03-12 15:59:30 +02004272{
itayzafrir534bd7c2018-08-02 13:56:32 +03004273 psa_status_t status;
Janos Follath24eed8d2019-11-22 13:21:35 +00004274 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Steven Cooreman7df02922020-09-09 15:28:49 +02004275 if( operation->iv_set || ! operation->iv_required )
4276 {
4277 return( PSA_ERROR_BAD_STATE );
4278 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004279
Steven Cooremanef8575e2020-09-11 11:44:50 +02004280 if( operation->mbedtls_in_use == 0 )
Steven Cooreman8b122252020-09-03 15:30:32 +02004281 {
Steven Cooremanfb81aa52020-09-09 12:01:43 +02004282 status = psa_driver_wrapper_cipher_generate_iv( &operation->ctx.driver,
Steven Cooreman8b122252020-09-03 15:30:32 +02004283 iv,
4284 iv_size,
4285 iv_length );
4286 goto exit;
4287 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004288
Moran Peker41deec42018-04-04 15:43:05 +03004289 if( iv_size < operation->iv_size )
mohammad1603503973b2018-03-12 15:59:30 +02004290 {
itayzafrir534bd7c2018-08-02 13:56:32 +03004291 status = PSA_ERROR_BUFFER_TOO_SMALL;
Moran Peker41deec42018-04-04 15:43:05 +03004292 goto exit;
4293 }
Gilles Peskine7e928852018-06-04 16:23:10 +02004294 ret = mbedtls_ctr_drbg_random( &global_data.ctr_drbg,
4295 iv, operation->iv_size );
Moran Peker41deec42018-04-04 15:43:05 +03004296 if( ret != 0 )
4297 {
itayzafrir534bd7c2018-08-02 13:56:32 +03004298 status = mbedtls_to_psa_error( ret );
Gilles Peskinee553c652018-06-04 16:22:46 +02004299 goto exit;
mohammad1603503973b2018-03-12 15:59:30 +02004300 }
Gilles Peskinee553c652018-06-04 16:22:46 +02004301
mohammad16038481e742018-03-18 13:57:31 +02004302 *iv_length = operation->iv_size;
itayzafrir534bd7c2018-08-02 13:56:32 +03004303 status = psa_cipher_set_iv( operation, iv, *iv_length );
Moran Peker41deec42018-04-04 15:43:05 +03004304
Moran Peker395db872018-05-31 14:07:14 +03004305exit:
Steven Cooreman7df02922020-09-09 15:28:49 +02004306 if( status == PSA_SUCCESS )
4307 operation->iv_set = 1;
4308 else
Moran Peker395db872018-05-31 14:07:14 +03004309 psa_cipher_abort( operation );
itayzafrir534bd7c2018-08-02 13:56:32 +03004310 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02004311}
4312
Gilles Peskinefe119512018-07-08 21:39:34 +02004313psa_status_t psa_cipher_set_iv( psa_cipher_operation_t *operation,
Andrew Thoelke163639b2019-05-15 12:33:23 +01004314 const uint8_t *iv,
Gilles Peskinefe119512018-07-08 21:39:34 +02004315 size_t iv_length )
mohammad1603503973b2018-03-12 15:59:30 +02004316{
itayzafrir534bd7c2018-08-02 13:56:32 +03004317 psa_status_t status;
Janos Follath24eed8d2019-11-22 13:21:35 +00004318 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Steven Cooreman7df02922020-09-09 15:28:49 +02004319 if( operation->iv_set || ! operation->iv_required )
4320 {
4321 return( PSA_ERROR_BAD_STATE );
4322 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004323
Steven Cooremanef8575e2020-09-11 11:44:50 +02004324 if( operation->mbedtls_in_use == 0 )
Steven Cooreman8b122252020-09-03 15:30:32 +02004325 {
Steven Cooremanfb81aa52020-09-09 12:01:43 +02004326 status = psa_driver_wrapper_cipher_set_iv( &operation->ctx.driver,
Steven Cooreman8b122252020-09-03 15:30:32 +02004327 iv,
4328 iv_length );
4329 goto exit;
4330 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004331
Moran Pekera28258c2018-05-29 16:25:04 +03004332 if( iv_length != operation->iv_size )
Moran Peker71f19ae2018-04-22 20:23:16 +03004333 {
itayzafrir534bd7c2018-08-02 13:56:32 +03004334 status = PSA_ERROR_INVALID_ARGUMENT;
4335 goto exit;
Moran Peker71f19ae2018-04-22 20:23:16 +03004336 }
itayzafrir534bd7c2018-08-02 13:56:32 +03004337 ret = mbedtls_cipher_set_iv( &operation->ctx.cipher, iv, iv_length );
4338 status = mbedtls_to_psa_error( ret );
4339exit:
4340 if( status == PSA_SUCCESS )
4341 operation->iv_set = 1;
4342 else
mohammad1603503973b2018-03-12 15:59:30 +02004343 psa_cipher_abort( operation );
itayzafrir534bd7c2018-08-02 13:56:32 +03004344 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02004345}
4346
Steven Cooreman177deba2020-09-07 17:14:14 +02004347/* Process input for which the algorithm is set to ECB mode. This requires
4348 * manual processing, since the PSA API is defined as being able to process
4349 * arbitrary-length calls to psa_cipher_update() with ECB mode, but the
4350 * underlying mbedtls_cipher_update only takes full blocks. */
4351static psa_status_t psa_cipher_update_ecb_internal(
4352 mbedtls_cipher_context_t *ctx,
4353 const uint8_t *input,
4354 size_t input_length,
4355 uint8_t *output,
4356 size_t output_size,
4357 size_t *output_length )
4358{
4359 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4360 size_t block_size = ctx->cipher_info->block_size;
4361 size_t internal_output_length = 0;
4362 *output_length = 0;
4363
4364 if( input_length == 0 )
4365 {
4366 status = PSA_SUCCESS;
4367 goto exit;
4368 }
4369
4370 if( ctx->unprocessed_len > 0 )
4371 {
4372 /* Fill up to block size, and run the block if there's a full one. */
4373 size_t bytes_to_copy = block_size - ctx->unprocessed_len;
4374
4375 if( input_length < bytes_to_copy )
4376 bytes_to_copy = input_length;
4377
4378 memcpy( &( ctx->unprocessed_data[ctx->unprocessed_len] ),
4379 input, bytes_to_copy );
4380 input_length -= bytes_to_copy;
4381 input += bytes_to_copy;
4382 ctx->unprocessed_len += bytes_to_copy;
4383
4384 if( ctx->unprocessed_len == block_size )
4385 {
4386 status = mbedtls_to_psa_error(
4387 mbedtls_cipher_update( ctx,
4388 ctx->unprocessed_data,
4389 block_size,
4390 output, &internal_output_length ) );
4391
4392 if( status != PSA_SUCCESS )
4393 goto exit;
4394
4395 output += internal_output_length;
4396 output_size -= internal_output_length;
4397 *output_length += internal_output_length;
4398 ctx->unprocessed_len = 0;
4399 }
4400 }
4401
4402 while( input_length >= block_size )
4403 {
4404 /* Run all full blocks we have, one by one */
4405 status = mbedtls_to_psa_error(
4406 mbedtls_cipher_update( ctx, input,
4407 block_size,
4408 output, &internal_output_length ) );
4409
4410 if( status != PSA_SUCCESS )
4411 goto exit;
4412
4413 input_length -= block_size;
4414 input += block_size;
4415
4416 output += internal_output_length;
4417 output_size -= internal_output_length;
4418 *output_length += internal_output_length;
4419 }
4420
4421 if( input_length > 0 )
4422 {
4423 /* Save unprocessed bytes for later processing */
4424 memcpy( &( ctx->unprocessed_data[ctx->unprocessed_len] ),
4425 input, input_length );
4426 ctx->unprocessed_len += input_length;
4427 }
4428
4429 status = PSA_SUCCESS;
4430
4431exit:
4432 return( status );
4433}
4434
Gilles Peskinee553c652018-06-04 16:22:46 +02004435psa_status_t psa_cipher_update( psa_cipher_operation_t *operation,
4436 const uint8_t *input,
4437 size_t input_length,
Andrew Thoelke163639b2019-05-15 12:33:23 +01004438 uint8_t *output,
Gilles Peskinee553c652018-06-04 16:22:46 +02004439 size_t output_size,
4440 size_t *output_length )
mohammad1603503973b2018-03-12 15:59:30 +02004441{
Steven Cooremanffecb7b2020-08-25 15:13:13 +02004442 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine89d789c2018-06-04 17:17:16 +02004443 size_t expected_output_size;
Steven Cooreman7df02922020-09-09 15:28:49 +02004444 if( operation->alg == 0 )
4445 {
4446 return( PSA_ERROR_BAD_STATE );
4447 }
4448 if( operation->iv_required && ! operation->iv_set )
4449 {
4450 return( PSA_ERROR_BAD_STATE );
4451 }
Jaeden Ameroab439972019-02-15 14:12:05 +00004452
Steven Cooremanef8575e2020-09-11 11:44:50 +02004453 if( operation->mbedtls_in_use == 0 )
Steven Cooreman8b122252020-09-03 15:30:32 +02004454 {
Steven Cooremanfb81aa52020-09-09 12:01:43 +02004455 status = psa_driver_wrapper_cipher_update( &operation->ctx.driver,
Steven Cooreman8b122252020-09-03 15:30:32 +02004456 input,
4457 input_length,
4458 output,
4459 output_size,
4460 output_length );
4461 goto exit;
4462 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004463
Gilles Peskinedaea26f2018-08-21 14:02:45 +02004464 if( ! PSA_ALG_IS_STREAM_CIPHER( operation->alg ) )
Gilles Peskine89d789c2018-06-04 17:17:16 +02004465 {
4466 /* Take the unprocessed partial block left over from previous
4467 * update calls, if any, plus the input to this call. Remove
4468 * the last partial block, if any. You get the data that will be
4469 * output in this call. */
4470 expected_output_size =
4471 ( operation->ctx.cipher.unprocessed_len + input_length )
4472 / operation->block_size * operation->block_size;
4473 }
4474 else
4475 {
4476 expected_output_size = input_length;
4477 }
itayzafrir534bd7c2018-08-02 13:56:32 +03004478
Gilles Peskine89d789c2018-06-04 17:17:16 +02004479 if( output_size < expected_output_size )
itayzafrir534bd7c2018-08-02 13:56:32 +03004480 {
4481 status = PSA_ERROR_BUFFER_TOO_SMALL;
4482 goto exit;
4483 }
mohammad160382759612018-03-12 18:16:40 +02004484
Steven Cooremanffecb7b2020-08-25 15:13:13 +02004485 if( operation->alg == PSA_ALG_ECB_NO_PADDING )
4486 {
4487 /* mbedtls_cipher_update has an API inconsistency: it will only
4488 * process a single block at a time in ECB mode. Abstract away that
4489 * inconsistency here to match the PSA API behaviour. */
Steven Cooreman177deba2020-09-07 17:14:14 +02004490 status = psa_cipher_update_ecb_internal( &operation->ctx.cipher,
4491 input,
4492 input_length,
4493 output,
4494 output_size,
4495 output_length );
Steven Cooremanffecb7b2020-08-25 15:13:13 +02004496 }
4497 else
4498 {
4499 status = mbedtls_to_psa_error(
4500 mbedtls_cipher_update( &operation->ctx.cipher, input,
4501 input_length, output, output_length ) );
4502 }
itayzafrir534bd7c2018-08-02 13:56:32 +03004503exit:
4504 if( status != PSA_SUCCESS )
mohammad1603503973b2018-03-12 15:59:30 +02004505 psa_cipher_abort( operation );
itayzafrir534bd7c2018-08-02 13:56:32 +03004506 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02004507}
4508
Gilles Peskinee553c652018-06-04 16:22:46 +02004509psa_status_t psa_cipher_finish( psa_cipher_operation_t *operation,
4510 uint8_t *output,
4511 size_t output_size,
4512 size_t *output_length )
mohammad1603503973b2018-03-12 15:59:30 +02004513{
David Saadab4ecc272019-02-14 13:48:10 +02004514 psa_status_t status = PSA_ERROR_GENERIC_ERROR;
Gilles Peskinee553c652018-06-04 16:22:46 +02004515 uint8_t temp_output_buffer[MBEDTLS_MAX_BLOCK_LENGTH];
Steven Cooreman7df02922020-09-09 15:28:49 +02004516 if( operation->alg == 0 )
4517 {
4518 return( PSA_ERROR_BAD_STATE );
4519 }
4520 if( operation->iv_required && ! operation->iv_set )
4521 {
4522 return( PSA_ERROR_BAD_STATE );
4523 }
Moran Pekerbed71a22018-04-22 20:19:20 +03004524
Steven Cooremanef8575e2020-09-11 11:44:50 +02004525 if( operation->mbedtls_in_use == 0 )
Steven Cooreman8b122252020-09-03 15:30:32 +02004526 {
Steven Cooremanfb81aa52020-09-09 12:01:43 +02004527 status = psa_driver_wrapper_cipher_finish( &operation->ctx.driver,
Steven Cooreman8b122252020-09-03 15:30:32 +02004528 output,
4529 output_size,
4530 output_length );
Steven Cooremanef8575e2020-09-11 11:44:50 +02004531 goto exit;
Steven Cooreman8b122252020-09-03 15:30:32 +02004532 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004533
Steven Cooremaned3c9ec2020-07-06 14:08:59 +02004534 if( operation->ctx.cipher.unprocessed_len != 0 )
Moran Peker7cb22b82018-06-05 11:40:02 +03004535 {
Steven Cooremaned3c9ec2020-07-06 14:08:59 +02004536 if( operation->alg == PSA_ALG_ECB_NO_PADDING ||
Fredrik Strupef90e3012020-09-28 16:11:33 +02004537 operation->alg == PSA_ALG_CBC_NO_PADDING )
Steven Cooremana6033e92020-08-25 11:47:50 +02004538 {
Gilles Peskinedaea26f2018-08-21 14:02:45 +02004539 status = PSA_ERROR_INVALID_ARGUMENT;
Steven Cooremanef8575e2020-09-11 11:44:50 +02004540 goto exit;
Steven Cooremaned3c9ec2020-07-06 14:08:59 +02004541 }
Moran Pekerdc38ebc2018-04-30 15:45:34 +03004542 }
4543
Steven Cooremanef8575e2020-09-11 11:44:50 +02004544 status = mbedtls_to_psa_error(
4545 mbedtls_cipher_finish( &operation->ctx.cipher,
4546 temp_output_buffer,
4547 output_length ) );
4548 if( status != PSA_SUCCESS )
4549 goto exit;
Janos Follath315b51c2018-07-09 16:04:51 +01004550
Gilles Peskine46f1fd72018-06-28 19:31:31 +02004551 if( *output_length == 0 )
Janos Follath315b51c2018-07-09 16:04:51 +01004552 ; /* Nothing to copy. Note that output may be NULL in this case. */
Gilles Peskine46f1fd72018-06-28 19:31:31 +02004553 else if( output_size >= *output_length )
Moran Pekerdc38ebc2018-04-30 15:45:34 +03004554 memcpy( output, temp_output_buffer, *output_length );
4555 else
Janos Follath315b51c2018-07-09 16:04:51 +01004556 status = PSA_ERROR_BUFFER_TOO_SMALL;
mohammad1603503973b2018-03-12 15:59:30 +02004557
Steven Cooremanef8575e2020-09-11 11:44:50 +02004558exit:
4559 if( operation->mbedtls_in_use == 1 )
4560 mbedtls_platform_zeroize( temp_output_buffer, sizeof( temp_output_buffer ) );
Janos Follath315b51c2018-07-09 16:04:51 +01004561
Steven Cooremanef8575e2020-09-11 11:44:50 +02004562 if( status == PSA_SUCCESS )
4563 return( psa_cipher_abort( operation ) );
4564 else
4565 {
4566 *output_length = 0;
Steven Cooremanef8575e2020-09-11 11:44:50 +02004567 (void) psa_cipher_abort( operation );
Janos Follath315b51c2018-07-09 16:04:51 +01004568
Steven Cooremanef8575e2020-09-11 11:44:50 +02004569 return( status );
4570 }
mohammad1603503973b2018-03-12 15:59:30 +02004571}
4572
Gilles Peskinee553c652018-06-04 16:22:46 +02004573psa_status_t psa_cipher_abort( psa_cipher_operation_t *operation )
4574{
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02004575 if( operation->alg == 0 )
Gilles Peskine81736312018-06-26 15:04:31 +02004576 {
Steven Cooremana07b9972020-09-10 14:54:14 +02004577 /* The object has (apparently) been initialized but it is not (yet)
Gilles Peskine81736312018-06-26 15:04:31 +02004578 * in use. It's ok to call abort on such an object, and there's
4579 * nothing to do. */
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02004580 return( PSA_SUCCESS );
Gilles Peskine81736312018-06-26 15:04:31 +02004581 }
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02004582
Gilles Peskinef9c2c092018-06-21 16:57:07 +02004583 /* Sanity check (shouldn't happen: operation->alg should
4584 * always have been initialized to a valid value). */
4585 if( ! PSA_ALG_IS_CIPHER( operation->alg ) )
4586 return( PSA_ERROR_BAD_STATE );
4587
Steven Cooremanef8575e2020-09-11 11:44:50 +02004588 if( operation->mbedtls_in_use == 0 )
Steven Cooremanfb81aa52020-09-09 12:01:43 +02004589 psa_driver_wrapper_cipher_abort( &operation->ctx.driver );
Steven Cooremand3feccd2020-09-01 15:56:14 +02004590 else
4591 mbedtls_cipher_free( &operation->ctx.cipher );
Gilles Peskinee553c652018-06-04 16:22:46 +02004592
Moran Peker41deec42018-04-04 15:43:05 +03004593 operation->alg = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03004594 operation->key_set = 0;
4595 operation->iv_set = 0;
Steven Cooremanef8575e2020-09-11 11:44:50 +02004596 operation->mbedtls_in_use = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03004597 operation->iv_size = 0;
Moran Peker41deec42018-04-04 15:43:05 +03004598 operation->block_size = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03004599 operation->iv_required = 0;
Moran Peker41deec42018-04-04 15:43:05 +03004600
Moran Peker395db872018-05-31 14:07:14 +03004601 return( PSA_SUCCESS );
mohammad1603503973b2018-03-12 15:59:30 +02004602}
4603
Gilles Peskinea0655c32018-04-30 17:06:50 +02004604
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02004605
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02004606
mohammad16035955c982018-04-26 00:53:03 +03004607/****************************************************************/
4608/* AEAD */
4609/****************************************************************/
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02004610
Gilles Peskineedf9a652018-08-17 18:11:56 +02004611typedef struct
4612{
Gilles Peskine2f060a82018-12-04 17:12:32 +01004613 psa_key_slot_t *slot;
Gilles Peskineedf9a652018-08-17 18:11:56 +02004614 const mbedtls_cipher_info_t *cipher_info;
4615 union
4616 {
4617#if defined(MBEDTLS_CCM_C)
4618 mbedtls_ccm_context ccm;
4619#endif /* MBEDTLS_CCM_C */
4620#if defined(MBEDTLS_GCM_C)
4621 mbedtls_gcm_context gcm;
4622#endif /* MBEDTLS_GCM_C */
Gilles Peskine26869f22019-05-06 15:25:00 +02004623#if defined(MBEDTLS_CHACHAPOLY_C)
4624 mbedtls_chachapoly_context chachapoly;
4625#endif /* MBEDTLS_CHACHAPOLY_C */
Gilles Peskineedf9a652018-08-17 18:11:56 +02004626 } ctx;
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02004627 psa_algorithm_t core_alg;
4628 uint8_t full_tag_length;
Gilles Peskineedf9a652018-08-17 18:11:56 +02004629 uint8_t tag_length;
4630} aead_operation_t;
4631
Gilles Peskine30a9e412019-01-14 18:36:12 +01004632static void psa_aead_abort_internal( aead_operation_t *operation )
Gilles Peskineedf9a652018-08-17 18:11:56 +02004633{
Gilles Peskinef8a8fe62018-08-21 16:38:05 +02004634 switch( operation->core_alg )
Gilles Peskineedf9a652018-08-17 18:11:56 +02004635 {
4636#if defined(MBEDTLS_CCM_C)
4637 case PSA_ALG_CCM:
4638 mbedtls_ccm_free( &operation->ctx.ccm );
4639 break;
4640#endif /* MBEDTLS_CCM_C */
Gilles Peskineb0b189f2018-11-28 17:30:58 +01004641#if defined(MBEDTLS_GCM_C)
Gilles Peskineedf9a652018-08-17 18:11:56 +02004642 case PSA_ALG_GCM:
4643 mbedtls_gcm_free( &operation->ctx.gcm );
4644 break;
4645#endif /* MBEDTLS_GCM_C */
4646 }
4647}
4648
4649static psa_status_t psa_aead_setup( aead_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02004650 mbedtls_svc_key_id_t key,
Gilles Peskineedf9a652018-08-17 18:11:56 +02004651 psa_key_usage_t usage,
4652 psa_algorithm_t alg )
4653{
4654 psa_status_t status;
4655 size_t key_bits;
4656 mbedtls_cipher_id_t cipher_id;
4657
Ronald Croncf56a0a2020-08-04 09:51:30 +02004658 status = psa_get_transparent_key( key, &operation->slot, usage, alg );
Gilles Peskineedf9a652018-08-17 18:11:56 +02004659 if( status != PSA_SUCCESS )
4660 return( status );
4661
Gilles Peskinedb4b3ab2019-04-18 12:53:01 +02004662 key_bits = psa_get_key_slot_bits( operation->slot );
Gilles Peskineedf9a652018-08-17 18:11:56 +02004663
4664 operation->cipher_info =
Gilles Peskine8e338702019-07-30 20:06:31 +02004665 mbedtls_cipher_info_from_psa( alg, operation->slot->attr.type, key_bits,
Gilles Peskineedf9a652018-08-17 18:11:56 +02004666 &cipher_id );
4667 if( operation->cipher_info == NULL )
4668 return( PSA_ERROR_NOT_SUPPORTED );
4669
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02004670 switch( PSA_ALG_AEAD_WITH_TAG_LENGTH( alg, 0 ) )
Gilles Peskineedf9a652018-08-17 18:11:56 +02004671 {
4672#if defined(MBEDTLS_CCM_C)
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02004673 case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_CCM, 0 ):
4674 operation->core_alg = PSA_ALG_CCM;
4675 operation->full_tag_length = 16;
Gilles Peskinef7e7b012019-05-06 15:27:16 +02004676 /* CCM allows the following tag lengths: 4, 6, 8, 10, 12, 14, 16.
4677 * The call to mbedtls_ccm_encrypt_and_tag or
4678 * mbedtls_ccm_auth_decrypt will validate the tag length. */
Gilles Peskine8e338702019-07-30 20:06:31 +02004679 if( PSA_BLOCK_CIPHER_BLOCK_SIZE( operation->slot->attr.type ) != 16 )
Gilles Peskineedf9a652018-08-17 18:11:56 +02004680 return( PSA_ERROR_INVALID_ARGUMENT );
4681 mbedtls_ccm_init( &operation->ctx.ccm );
4682 status = mbedtls_to_psa_error(
4683 mbedtls_ccm_setkey( &operation->ctx.ccm, cipher_id,
Steven Cooreman71fd80d2020-07-07 21:12:27 +02004684 operation->slot->data.key.data,
Gilles Peskineedf9a652018-08-17 18:11:56 +02004685 (unsigned int) key_bits ) );
4686 if( status != 0 )
4687 goto cleanup;
4688 break;
4689#endif /* MBEDTLS_CCM_C */
4690
4691#if defined(MBEDTLS_GCM_C)
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02004692 case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_GCM, 0 ):
4693 operation->core_alg = PSA_ALG_GCM;
4694 operation->full_tag_length = 16;
Gilles Peskinef7e7b012019-05-06 15:27:16 +02004695 /* GCM allows the following tag lengths: 4, 8, 12, 13, 14, 15, 16.
4696 * The call to mbedtls_gcm_crypt_and_tag or
4697 * mbedtls_gcm_auth_decrypt will validate the tag length. */
Gilles Peskine8e338702019-07-30 20:06:31 +02004698 if( PSA_BLOCK_CIPHER_BLOCK_SIZE( operation->slot->attr.type ) != 16 )
Gilles Peskineedf9a652018-08-17 18:11:56 +02004699 return( PSA_ERROR_INVALID_ARGUMENT );
4700 mbedtls_gcm_init( &operation->ctx.gcm );
4701 status = mbedtls_to_psa_error(
4702 mbedtls_gcm_setkey( &operation->ctx.gcm, cipher_id,
Steven Cooreman71fd80d2020-07-07 21:12:27 +02004703 operation->slot->data.key.data,
Gilles Peskineedf9a652018-08-17 18:11:56 +02004704 (unsigned int) key_bits ) );
Gilles Peskinef7e7b012019-05-06 15:27:16 +02004705 if( status != 0 )
4706 goto cleanup;
Gilles Peskineedf9a652018-08-17 18:11:56 +02004707 break;
4708#endif /* MBEDTLS_GCM_C */
4709
Gilles Peskine26869f22019-05-06 15:25:00 +02004710#if defined(MBEDTLS_CHACHAPOLY_C)
4711 case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_CHACHA20_POLY1305, 0 ):
4712 operation->core_alg = PSA_ALG_CHACHA20_POLY1305;
4713 operation->full_tag_length = 16;
4714 /* We only support the default tag length. */
4715 if( alg != PSA_ALG_CHACHA20_POLY1305 )
4716 return( PSA_ERROR_NOT_SUPPORTED );
4717 mbedtls_chachapoly_init( &operation->ctx.chachapoly );
4718 status = mbedtls_to_psa_error(
4719 mbedtls_chachapoly_setkey( &operation->ctx.chachapoly,
Steven Cooreman71fd80d2020-07-07 21:12:27 +02004720 operation->slot->data.key.data ) );
Gilles Peskine26869f22019-05-06 15:25:00 +02004721 if( status != 0 )
4722 goto cleanup;
4723 break;
4724#endif /* MBEDTLS_CHACHAPOLY_C */
4725
Gilles Peskineedf9a652018-08-17 18:11:56 +02004726 default:
4727 return( PSA_ERROR_NOT_SUPPORTED );
4728 }
4729
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02004730 if( PSA_AEAD_TAG_LENGTH( alg ) > operation->full_tag_length )
4731 {
4732 status = PSA_ERROR_INVALID_ARGUMENT;
4733 goto cleanup;
4734 }
4735 operation->tag_length = PSA_AEAD_TAG_LENGTH( alg );
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02004736
Gilles Peskineedf9a652018-08-17 18:11:56 +02004737 return( PSA_SUCCESS );
4738
4739cleanup:
Gilles Peskine30a9e412019-01-14 18:36:12 +01004740 psa_aead_abort_internal( operation );
Gilles Peskineedf9a652018-08-17 18:11:56 +02004741 return( status );
4742}
4743
Ronald Croncf56a0a2020-08-04 09:51:30 +02004744psa_status_t psa_aead_encrypt( mbedtls_svc_key_id_t key,
mohammad16035955c982018-04-26 00:53:03 +03004745 psa_algorithm_t alg,
4746 const uint8_t *nonce,
4747 size_t nonce_length,
4748 const uint8_t *additional_data,
4749 size_t additional_data_length,
4750 const uint8_t *plaintext,
4751 size_t plaintext_length,
4752 uint8_t *ciphertext,
4753 size_t ciphertext_size,
4754 size_t *ciphertext_length )
4755{
mohammad16035955c982018-04-26 00:53:03 +03004756 psa_status_t status;
Gilles Peskineedf9a652018-08-17 18:11:56 +02004757 aead_operation_t operation;
mohammad160315223a82018-06-03 17:19:55 +03004758 uint8_t *tag;
Gilles Peskine2d277862018-06-18 15:41:12 +02004759
mohammad1603f08a5502018-06-03 15:05:47 +03004760 *ciphertext_length = 0;
mohammad1603e58e6842018-05-09 04:58:32 -07004761
Ronald Croncf56a0a2020-08-04 09:51:30 +02004762 status = psa_aead_setup( &operation, key, PSA_KEY_USAGE_ENCRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02004763 if( status != PSA_SUCCESS )
4764 return( status );
mohammad16035955c982018-04-26 00:53:03 +03004765
Gilles Peskineedf9a652018-08-17 18:11:56 +02004766 /* For all currently supported modes, the tag is at the end of the
4767 * ciphertext. */
4768 if( ciphertext_size < ( plaintext_length + operation.tag_length ) )
4769 {
4770 status = PSA_ERROR_BUFFER_TOO_SMALL;
4771 goto exit;
4772 }
4773 tag = ciphertext + plaintext_length;
mohammad16035955c982018-04-26 00:53:03 +03004774
Gilles Peskineb0b189f2018-11-28 17:30:58 +01004775#if defined(MBEDTLS_GCM_C)
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02004776 if( operation.core_alg == PSA_ALG_GCM )
mohammad16035955c982018-04-26 00:53:03 +03004777 {
Gilles Peskineedf9a652018-08-17 18:11:56 +02004778 status = mbedtls_to_psa_error(
4779 mbedtls_gcm_crypt_and_tag( &operation.ctx.gcm,
4780 MBEDTLS_GCM_ENCRYPT,
4781 plaintext_length,
4782 nonce, nonce_length,
4783 additional_data, additional_data_length,
4784 plaintext, ciphertext,
4785 operation.tag_length, tag ) );
mohammad16035955c982018-04-26 00:53:03 +03004786 }
Gilles Peskineb0b189f2018-11-28 17:30:58 +01004787 else
4788#endif /* MBEDTLS_GCM_C */
4789#if defined(MBEDTLS_CCM_C)
4790 if( operation.core_alg == PSA_ALG_CCM )
mohammad16035955c982018-04-26 00:53:03 +03004791 {
Gilles Peskineedf9a652018-08-17 18:11:56 +02004792 status = mbedtls_to_psa_error(
4793 mbedtls_ccm_encrypt_and_tag( &operation.ctx.ccm,
4794 plaintext_length,
4795 nonce, nonce_length,
4796 additional_data,
4797 additional_data_length,
4798 plaintext, ciphertext,
4799 tag, operation.tag_length ) );
mohammad16035955c982018-04-26 00:53:03 +03004800 }
mohammad16035c8845f2018-05-09 05:40:09 -07004801 else
Gilles Peskineb0b189f2018-11-28 17:30:58 +01004802#endif /* MBEDTLS_CCM_C */
Gilles Peskine26869f22019-05-06 15:25:00 +02004803#if defined(MBEDTLS_CHACHAPOLY_C)
4804 if( operation.core_alg == PSA_ALG_CHACHA20_POLY1305 )
4805 {
4806 if( nonce_length != 12 || operation.tag_length != 16 )
4807 {
4808 status = PSA_ERROR_NOT_SUPPORTED;
4809 goto exit;
4810 }
4811 status = mbedtls_to_psa_error(
4812 mbedtls_chachapoly_encrypt_and_tag( &operation.ctx.chachapoly,
4813 plaintext_length,
4814 nonce,
4815 additional_data,
4816 additional_data_length,
4817 plaintext,
4818 ciphertext,
4819 tag ) );
4820 }
4821 else
4822#endif /* MBEDTLS_CHACHAPOLY_C */
mohammad16035c8845f2018-05-09 05:40:09 -07004823 {
mohammad1603554faad2018-06-03 15:07:38 +03004824 return( PSA_ERROR_NOT_SUPPORTED );
mohammad16035c8845f2018-05-09 05:40:09 -07004825 }
Gilles Peskine2d277862018-06-18 15:41:12 +02004826
Gilles Peskineedf9a652018-08-17 18:11:56 +02004827 if( status != PSA_SUCCESS && ciphertext_size != 0 )
4828 memset( ciphertext, 0, ciphertext_size );
Gilles Peskine2d277862018-06-18 15:41:12 +02004829
Gilles Peskineedf9a652018-08-17 18:11:56 +02004830exit:
Gilles Peskine30a9e412019-01-14 18:36:12 +01004831 psa_aead_abort_internal( &operation );
Gilles Peskineedf9a652018-08-17 18:11:56 +02004832 if( status == PSA_SUCCESS )
4833 *ciphertext_length = plaintext_length + operation.tag_length;
4834 return( status );
mohammad16035955c982018-04-26 00:53:03 +03004835}
4836
Gilles Peskineee652a32018-06-01 19:23:52 +02004837/* Locate the tag in a ciphertext buffer containing the encrypted data
4838 * followed by the tag. Return the length of the part preceding the tag in
4839 * *plaintext_length. This is the size of the plaintext in modes where
4840 * the encrypted data has the same size as the plaintext, such as
4841 * CCM and GCM. */
4842static psa_status_t psa_aead_unpadded_locate_tag( size_t tag_length,
4843 const uint8_t *ciphertext,
4844 size_t ciphertext_length,
4845 size_t plaintext_size,
Gilles Peskineee652a32018-06-01 19:23:52 +02004846 const uint8_t **p_tag )
4847{
4848 size_t payload_length;
4849 if( tag_length > ciphertext_length )
4850 return( PSA_ERROR_INVALID_ARGUMENT );
4851 payload_length = ciphertext_length - tag_length;
4852 if( payload_length > plaintext_size )
4853 return( PSA_ERROR_BUFFER_TOO_SMALL );
4854 *p_tag = ciphertext + payload_length;
Gilles Peskineee652a32018-06-01 19:23:52 +02004855 return( PSA_SUCCESS );
4856}
4857
Ronald Croncf56a0a2020-08-04 09:51:30 +02004858psa_status_t psa_aead_decrypt( mbedtls_svc_key_id_t key,
mohammad16035955c982018-04-26 00:53:03 +03004859 psa_algorithm_t alg,
4860 const uint8_t *nonce,
4861 size_t nonce_length,
4862 const uint8_t *additional_data,
4863 size_t additional_data_length,
4864 const uint8_t *ciphertext,
4865 size_t ciphertext_length,
4866 uint8_t *plaintext,
4867 size_t plaintext_size,
4868 size_t *plaintext_length )
4869{
mohammad16035955c982018-04-26 00:53:03 +03004870 psa_status_t status;
Gilles Peskineedf9a652018-08-17 18:11:56 +02004871 aead_operation_t operation;
4872 const uint8_t *tag = NULL;
Gilles Peskine2d277862018-06-18 15:41:12 +02004873
Gilles Peskineee652a32018-06-01 19:23:52 +02004874 *plaintext_length = 0;
mohammad16039e5a5152018-04-26 12:07:35 +03004875
Ronald Croncf56a0a2020-08-04 09:51:30 +02004876 status = psa_aead_setup( &operation, key, PSA_KEY_USAGE_DECRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02004877 if( status != PSA_SUCCESS )
4878 return( status );
mohammad16035955c982018-04-26 00:53:03 +03004879
Gilles Peskinef7e7b012019-05-06 15:27:16 +02004880 status = psa_aead_unpadded_locate_tag( operation.tag_length,
4881 ciphertext, ciphertext_length,
4882 plaintext_size, &tag );
4883 if( status != PSA_SUCCESS )
4884 goto exit;
4885
Gilles Peskineb0b189f2018-11-28 17:30:58 +01004886#if defined(MBEDTLS_GCM_C)
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02004887 if( operation.core_alg == PSA_ALG_GCM )
mohammad16035955c982018-04-26 00:53:03 +03004888 {
Gilles Peskineedf9a652018-08-17 18:11:56 +02004889 status = mbedtls_to_psa_error(
4890 mbedtls_gcm_auth_decrypt( &operation.ctx.gcm,
4891 ciphertext_length - operation.tag_length,
4892 nonce, nonce_length,
4893 additional_data,
4894 additional_data_length,
4895 tag, operation.tag_length,
4896 ciphertext, plaintext ) );
mohammad16035955c982018-04-26 00:53:03 +03004897 }
Gilles Peskineb0b189f2018-11-28 17:30:58 +01004898 else
4899#endif /* MBEDTLS_GCM_C */
4900#if defined(MBEDTLS_CCM_C)
4901 if( operation.core_alg == PSA_ALG_CCM )
mohammad16035955c982018-04-26 00:53:03 +03004902 {
Gilles Peskineedf9a652018-08-17 18:11:56 +02004903 status = mbedtls_to_psa_error(
4904 mbedtls_ccm_auth_decrypt( &operation.ctx.ccm,
4905 ciphertext_length - operation.tag_length,
4906 nonce, nonce_length,
4907 additional_data,
4908 additional_data_length,
4909 ciphertext, plaintext,
4910 tag, operation.tag_length ) );
mohammad16035955c982018-04-26 00:53:03 +03004911 }
mohammad160339574652018-06-01 04:39:53 -07004912 else
Gilles Peskineb0b189f2018-11-28 17:30:58 +01004913#endif /* MBEDTLS_CCM_C */
Gilles Peskine26869f22019-05-06 15:25:00 +02004914#if defined(MBEDTLS_CHACHAPOLY_C)
4915 if( operation.core_alg == PSA_ALG_CHACHA20_POLY1305 )
4916 {
4917 if( nonce_length != 12 || operation.tag_length != 16 )
4918 {
4919 status = PSA_ERROR_NOT_SUPPORTED;
4920 goto exit;
4921 }
4922 status = mbedtls_to_psa_error(
4923 mbedtls_chachapoly_auth_decrypt( &operation.ctx.chachapoly,
4924 ciphertext_length - operation.tag_length,
4925 nonce,
4926 additional_data,
4927 additional_data_length,
4928 tag,
4929 ciphertext,
4930 plaintext ) );
4931 }
4932 else
4933#endif /* MBEDTLS_CHACHAPOLY_C */
mohammad160339574652018-06-01 04:39:53 -07004934 {
mohammad1603554faad2018-06-03 15:07:38 +03004935 return( PSA_ERROR_NOT_SUPPORTED );
mohammad160339574652018-06-01 04:39:53 -07004936 }
Gilles Peskinea40d7742018-06-01 16:28:30 +02004937
Gilles Peskineedf9a652018-08-17 18:11:56 +02004938 if( status != PSA_SUCCESS && plaintext_size != 0 )
4939 memset( plaintext, 0, plaintext_size );
mohammad160360a64d02018-06-03 17:20:42 +03004940
Gilles Peskineedf9a652018-08-17 18:11:56 +02004941exit:
Gilles Peskine30a9e412019-01-14 18:36:12 +01004942 psa_aead_abort_internal( &operation );
Gilles Peskineedf9a652018-08-17 18:11:56 +02004943 if( status == PSA_SUCCESS )
4944 *plaintext_length = ciphertext_length - operation.tag_length;
4945 return( status );
mohammad16035955c982018-04-26 00:53:03 +03004946}
4947
Gilles Peskinea0655c32018-04-30 17:06:50 +02004948
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02004949
Gilles Peskine20035e32018-02-03 22:44:14 +01004950/****************************************************************/
Gilles Peskineeab56e42018-07-12 17:12:33 +02004951/* Generators */
4952/****************************************************************/
4953
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004954#define HKDF_STATE_INIT 0 /* no input yet */
4955#define HKDF_STATE_STARTED 1 /* got salt */
4956#define HKDF_STATE_KEYED 2 /* got key */
4957#define HKDF_STATE_OUTPUT 3 /* output started */
4958
Gilles Peskinecbe66502019-05-16 16:59:18 +02004959static psa_algorithm_t psa_key_derivation_get_kdf_alg(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004960 const psa_key_derivation_operation_t *operation )
Gilles Peskine969c5d62019-01-16 15:53:06 +01004961{
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004962 if ( PSA_ALG_IS_KEY_AGREEMENT( operation->alg ) )
4963 return( PSA_ALG_KEY_AGREEMENT_GET_KDF( operation->alg ) );
Gilles Peskine969c5d62019-01-16 15:53:06 +01004964 else
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004965 return( operation->alg );
Gilles Peskine969c5d62019-01-16 15:53:06 +01004966}
4967
4968
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004969psa_status_t psa_key_derivation_abort( psa_key_derivation_operation_t *operation )
Gilles Peskineeab56e42018-07-12 17:12:33 +02004970{
4971 psa_status_t status = PSA_SUCCESS;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004972 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg( operation );
Gilles Peskine969c5d62019-01-16 15:53:06 +01004973 if( kdf_alg == 0 )
Gilles Peskineeab56e42018-07-12 17:12:33 +02004974 {
4975 /* The object has (apparently) been initialized but it is not
4976 * in use. It's ok to call abort on such an object, and there's
4977 * nothing to do. */
4978 }
4979 else
Gilles Peskinebef7f142018-07-12 17:22:21 +02004980#if defined(MBEDTLS_MD_C)
Gilles Peskine969c5d62019-01-16 15:53:06 +01004981 if( PSA_ALG_IS_HKDF( kdf_alg ) )
Gilles Peskinebef7f142018-07-12 17:22:21 +02004982 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004983 mbedtls_free( operation->ctx.hkdf.info );
4984 status = psa_hmac_abort_internal( &operation->ctx.hkdf.hmac );
Gilles Peskinebef7f142018-07-12 17:22:21 +02004985 }
Gilles Peskine969c5d62019-01-16 15:53:06 +01004986 else if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004987 /* TLS-1.2 PSK-to-MS KDF uses the same core as TLS-1.2 PRF */
Gilles Peskine969c5d62019-01-16 15:53:06 +01004988 PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Hanno Beckerc8a41d72018-10-09 17:33:01 +01004989 {
Janos Follath6a1d2622019-06-11 10:37:28 +01004990 if( operation->ctx.tls12_prf.seed != NULL )
4991 {
4992 mbedtls_platform_zeroize( operation->ctx.tls12_prf.seed,
4993 operation->ctx.tls12_prf.seed_length );
4994 mbedtls_free( operation->ctx.tls12_prf.seed );
4995 }
4996
4997 if( operation->ctx.tls12_prf.label != NULL )
4998 {
4999 mbedtls_platform_zeroize( operation->ctx.tls12_prf.label,
5000 operation->ctx.tls12_prf.label_length );
5001 mbedtls_free( operation->ctx.tls12_prf.label );
5002 }
5003
5004 status = psa_hmac_abort_internal( &operation->ctx.tls12_prf.hmac );
5005
5006 /* We leave the fields Ai and output_block to be erased safely by the
5007 * mbedtls_platform_zeroize() in the end of this function. */
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005008 }
Gilles Peskinebef7f142018-07-12 17:22:21 +02005009 else
5010#endif /* MBEDTLS_MD_C */
Gilles Peskineeab56e42018-07-12 17:12:33 +02005011 {
5012 status = PSA_ERROR_BAD_STATE;
5013 }
Janos Follath083036a2019-06-11 10:22:26 +01005014 mbedtls_platform_zeroize( operation, sizeof( *operation ) );
Gilles Peskineeab56e42018-07-12 17:12:33 +02005015 return( status );
5016}
5017
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005018psa_status_t psa_key_derivation_get_capacity(const psa_key_derivation_operation_t *operation,
Gilles Peskineeab56e42018-07-12 17:12:33 +02005019 size_t *capacity)
5020{
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005021 if( operation->alg == 0 )
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005022 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005023 /* This is a blank key derivation operation. */
Steven Cooreman29149862020-08-05 15:43:42 +02005024 return( PSA_ERROR_BAD_STATE );
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005025 }
5026
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005027 *capacity = operation->capacity;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005028 return( PSA_SUCCESS );
5029}
5030
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005031psa_status_t psa_key_derivation_set_capacity( psa_key_derivation_operation_t *operation,
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005032 size_t capacity )
5033{
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005034 if( operation->alg == 0 )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005035 return( PSA_ERROR_BAD_STATE );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005036 if( capacity > operation->capacity )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005037 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005038 operation->capacity = capacity;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005039 return( PSA_SUCCESS );
5040}
5041
Gilles Peskinebef7f142018-07-12 17:22:21 +02005042#if defined(MBEDTLS_MD_C)
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005043/* Read some bytes from an HKDF-based operation. This performs a chunk
Gilles Peskinebef7f142018-07-12 17:22:21 +02005044 * of the expand phase of the HKDF algorithm. */
Gilles Peskinecbe66502019-05-16 16:59:18 +02005045static psa_status_t psa_key_derivation_hkdf_read( psa_hkdf_key_derivation_t *hkdf,
Gilles Peskinebef7f142018-07-12 17:22:21 +02005046 psa_algorithm_t hash_alg,
5047 uint8_t *output,
5048 size_t output_length )
5049{
5050 uint8_t hash_length = PSA_HASH_SIZE( hash_alg );
5051 psa_status_t status;
5052
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005053 if( hkdf->state < HKDF_STATE_KEYED || ! hkdf->info_set )
5054 return( PSA_ERROR_BAD_STATE );
5055 hkdf->state = HKDF_STATE_OUTPUT;
5056
Gilles Peskinebef7f142018-07-12 17:22:21 +02005057 while( output_length != 0 )
5058 {
5059 /* Copy what remains of the current block */
5060 uint8_t n = hash_length - hkdf->offset_in_block;
5061 if( n > output_length )
5062 n = (uint8_t) output_length;
5063 memcpy( output, hkdf->output_block + hkdf->offset_in_block, n );
5064 output += n;
5065 output_length -= n;
5066 hkdf->offset_in_block += n;
Gilles Peskined54931c2018-07-17 21:06:59 +02005067 if( output_length == 0 )
Gilles Peskinebef7f142018-07-12 17:22:21 +02005068 break;
Gilles Peskined54931c2018-07-17 21:06:59 +02005069 /* We can't be wanting more output after block 0xff, otherwise
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02005070 * the capacity check in psa_key_derivation_output_bytes() would have
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005071 * prevented this call. It could happen only if the operation
Gilles Peskined54931c2018-07-17 21:06:59 +02005072 * object was corrupted or if this function is called directly
5073 * inside the library. */
5074 if( hkdf->block_number == 0xff )
5075 return( PSA_ERROR_BAD_STATE );
Gilles Peskinebef7f142018-07-12 17:22:21 +02005076
5077 /* We need a new block */
5078 ++hkdf->block_number;
5079 hkdf->offset_in_block = 0;
5080 status = psa_hmac_setup_internal( &hkdf->hmac,
5081 hkdf->prk, hash_length,
5082 hash_alg );
5083 if( status != PSA_SUCCESS )
5084 return( status );
5085 if( hkdf->block_number != 1 )
5086 {
5087 status = psa_hash_update( &hkdf->hmac.hash_ctx,
5088 hkdf->output_block,
5089 hash_length );
5090 if( status != PSA_SUCCESS )
5091 return( status );
5092 }
5093 status = psa_hash_update( &hkdf->hmac.hash_ctx,
5094 hkdf->info,
5095 hkdf->info_length );
5096 if( status != PSA_SUCCESS )
5097 return( status );
5098 status = psa_hash_update( &hkdf->hmac.hash_ctx,
5099 &hkdf->block_number, 1 );
5100 if( status != PSA_SUCCESS )
5101 return( status );
5102 status = psa_hmac_finish_internal( &hkdf->hmac,
5103 hkdf->output_block,
5104 sizeof( hkdf->output_block ) );
5105 if( status != PSA_SUCCESS )
5106 return( status );
5107 }
5108
5109 return( PSA_SUCCESS );
5110}
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005111
Janos Follath7742fee2019-06-17 12:58:10 +01005112static psa_status_t psa_key_derivation_tls12_prf_generate_next_block(
5113 psa_tls12_prf_key_derivation_t *tls12_prf,
5114 psa_algorithm_t alg )
5115{
5116 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( alg );
5117 uint8_t hash_length = PSA_HASH_SIZE( hash_alg );
Janos Follathea29bfb2019-06-19 12:21:20 +01005118 psa_hash_operation_t backup = PSA_HASH_OPERATION_INIT;
5119 psa_status_t status, cleanup_status;
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005120
Janos Follath7742fee2019-06-17 12:58:10 +01005121 /* We can't be wanting more output after block 0xff, otherwise
5122 * the capacity check in psa_key_derivation_output_bytes() would have
5123 * prevented this call. It could happen only if the operation
5124 * object was corrupted or if this function is called directly
5125 * inside the library. */
5126 if( tls12_prf->block_number == 0xff )
Janos Follath30090bc2019-06-25 10:15:04 +01005127 return( PSA_ERROR_CORRUPTION_DETECTED );
Janos Follath7742fee2019-06-17 12:58:10 +01005128
5129 /* We need a new block */
5130 ++tls12_prf->block_number;
Janos Follath844eb0e2019-06-19 12:10:49 +01005131 tls12_prf->left_in_block = hash_length;
Janos Follath7742fee2019-06-17 12:58:10 +01005132
5133 /* Recall the definition of the TLS-1.2-PRF from RFC 5246:
5134 *
5135 * PRF(secret, label, seed) = P_<hash>(secret, label + seed)
5136 *
5137 * P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
5138 * HMAC_hash(secret, A(2) + seed) +
5139 * HMAC_hash(secret, A(3) + seed) + ...
5140 *
5141 * A(0) = seed
Janos Follathea29bfb2019-06-19 12:21:20 +01005142 * A(i) = HMAC_hash(secret, A(i-1))
Janos Follath7742fee2019-06-17 12:58:10 +01005143 *
Janos Follathea29bfb2019-06-19 12:21:20 +01005144 * The `psa_tls12_prf_key_derivation` structure saves the block
Janos Follath7742fee2019-06-17 12:58:10 +01005145 * `HMAC_hash(secret, A(i) + seed)` from which the output
Janos Follath76c39842019-06-26 12:50:36 +01005146 * is currently extracted as `output_block` and where i is
5147 * `block_number`.
Janos Follath7742fee2019-06-17 12:58:10 +01005148 */
5149
Janos Follathea29bfb2019-06-19 12:21:20 +01005150 /* Save the hash context before using it, to preserve the hash state with
5151 * only the inner padding in it. We need this, because inner padding depends
5152 * on the key (secret in the RFC's terminology). */
5153 status = psa_hash_clone( &tls12_prf->hmac.hash_ctx, &backup );
5154 if( status != PSA_SUCCESS )
5155 goto cleanup;
5156
5157 /* Calculate A(i) where i = tls12_prf->block_number. */
5158 if( tls12_prf->block_number == 1 )
5159 {
5160 /* A(1) = HMAC_hash(secret, A(0)), where A(0) = seed. (The RFC overloads
5161 * the variable seed and in this instance means it in the context of the
5162 * P_hash function, where seed = label + seed.) */
5163 status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
5164 tls12_prf->label, tls12_prf->label_length );
5165 if( status != PSA_SUCCESS )
5166 goto cleanup;
5167 status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
5168 tls12_prf->seed, tls12_prf->seed_length );
5169 if( status != PSA_SUCCESS )
5170 goto cleanup;
5171 }
5172 else
5173 {
5174 /* A(i) = HMAC_hash(secret, A(i-1)) */
5175 status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
5176 tls12_prf->Ai, hash_length );
5177 if( status != PSA_SUCCESS )
5178 goto cleanup;
5179 }
5180
5181 status = psa_hmac_finish_internal( &tls12_prf->hmac,
5182 tls12_prf->Ai, hash_length );
5183 if( status != PSA_SUCCESS )
5184 goto cleanup;
5185 status = psa_hash_clone( &backup, &tls12_prf->hmac.hash_ctx );
5186 if( status != PSA_SUCCESS )
5187 goto cleanup;
5188
5189 /* Calculate HMAC_hash(secret, A(i) + label + seed). */
5190 status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
5191 tls12_prf->Ai, hash_length );
5192 if( status != PSA_SUCCESS )
5193 goto cleanup;
5194 status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
5195 tls12_prf->label, tls12_prf->label_length );
5196 if( status != PSA_SUCCESS )
5197 goto cleanup;
5198 status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
5199 tls12_prf->seed, tls12_prf->seed_length );
5200 if( status != PSA_SUCCESS )
5201 goto cleanup;
5202 status = psa_hmac_finish_internal( &tls12_prf->hmac,
5203 tls12_prf->output_block, hash_length );
5204 if( status != PSA_SUCCESS )
5205 goto cleanup;
5206 status = psa_hash_clone( &backup, &tls12_prf->hmac.hash_ctx );
5207 if( status != PSA_SUCCESS )
5208 goto cleanup;
5209
Janos Follath7742fee2019-06-17 12:58:10 +01005210
5211cleanup:
5212
Janos Follathea29bfb2019-06-19 12:21:20 +01005213 cleanup_status = psa_hash_abort( &backup );
5214 if( status == PSA_SUCCESS && cleanup_status != PSA_SUCCESS )
5215 status = cleanup_status;
5216
5217 return( status );
Janos Follath7742fee2019-06-17 12:58:10 +01005218}
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005219
Janos Follath844eb0e2019-06-19 12:10:49 +01005220static psa_status_t psa_key_derivation_tls12_prf_read(
5221 psa_tls12_prf_key_derivation_t *tls12_prf,
5222 psa_algorithm_t alg,
5223 uint8_t *output,
5224 size_t output_length )
5225{
5226 psa_algorithm_t hash_alg = PSA_ALG_TLS12_PRF_GET_HASH( alg );
5227 uint8_t hash_length = PSA_HASH_SIZE( hash_alg );
5228 psa_status_t status;
5229 uint8_t offset, length;
5230
5231 while( output_length != 0 )
5232 {
5233 /* Check if we have fully processed the current block. */
5234 if( tls12_prf->left_in_block == 0 )
5235 {
5236 status = psa_key_derivation_tls12_prf_generate_next_block( tls12_prf,
5237 alg );
5238 if( status != PSA_SUCCESS )
5239 return( status );
5240
5241 continue;
5242 }
5243
5244 if( tls12_prf->left_in_block > output_length )
5245 length = (uint8_t) output_length;
5246 else
5247 length = tls12_prf->left_in_block;
5248
5249 offset = hash_length - tls12_prf->left_in_block;
5250 memcpy( output, tls12_prf->output_block + offset, length );
5251 output += length;
5252 output_length -= length;
5253 tls12_prf->left_in_block -= length;
5254 }
5255
5256 return( PSA_SUCCESS );
5257}
Gilles Peskinebef7f142018-07-12 17:22:21 +02005258#endif /* MBEDTLS_MD_C */
5259
Janos Follath6c6c8fc2019-06-17 12:38:20 +01005260psa_status_t psa_key_derivation_output_bytes(
5261 psa_key_derivation_operation_t *operation,
5262 uint8_t *output,
5263 size_t output_length )
Gilles Peskineeab56e42018-07-12 17:12:33 +02005264{
5265 psa_status_t status;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005266 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg( operation );
Gilles Peskineeab56e42018-07-12 17:12:33 +02005267
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005268 if( operation->alg == 0 )
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005269 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005270 /* This is a blank operation. */
Steven Cooreman29149862020-08-05 15:43:42 +02005271 return( PSA_ERROR_BAD_STATE );
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005272 }
5273
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005274 if( output_length > operation->capacity )
Gilles Peskineeab56e42018-07-12 17:12:33 +02005275 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005276 operation->capacity = 0;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005277 /* Go through the error path to wipe all confidential data now
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005278 * that the operation object is useless. */
David Saadab4ecc272019-02-14 13:48:10 +02005279 status = PSA_ERROR_INSUFFICIENT_DATA;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005280 goto exit;
5281 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005282 if( output_length == 0 && operation->capacity == 0 )
Gilles Peskineeab56e42018-07-12 17:12:33 +02005283 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005284 /* Edge case: this is a finished operation, and 0 bytes
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005285 * were requested. The right error in this case could
Gilles Peskineeab56e42018-07-12 17:12:33 +02005286 * be either INSUFFICIENT_CAPACITY or BAD_STATE. Return
5287 * INSUFFICIENT_CAPACITY, which is right for a finished
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005288 * operation, for consistency with the case when
Gilles Peskineeab56e42018-07-12 17:12:33 +02005289 * output_length > 0. */
David Saadab4ecc272019-02-14 13:48:10 +02005290 return( PSA_ERROR_INSUFFICIENT_DATA );
Gilles Peskineeab56e42018-07-12 17:12:33 +02005291 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005292 operation->capacity -= output_length;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005293
Gilles Peskinebef7f142018-07-12 17:22:21 +02005294#if defined(MBEDTLS_MD_C)
Gilles Peskine969c5d62019-01-16 15:53:06 +01005295 if( PSA_ALG_IS_HKDF( kdf_alg ) )
Gilles Peskinebef7f142018-07-12 17:22:21 +02005296 {
Gilles Peskine969c5d62019-01-16 15:53:06 +01005297 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( kdf_alg );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005298 status = psa_key_derivation_hkdf_read( &operation->ctx.hkdf, hash_alg,
Gilles Peskinebef7f142018-07-12 17:22:21 +02005299 output, output_length );
5300 }
Janos Follathadbec812019-06-14 11:05:39 +01005301 else
Janos Follathadbec812019-06-14 11:05:39 +01005302 if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
Gilles Peskine969c5d62019-01-16 15:53:06 +01005303 PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005304 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005305 status = psa_key_derivation_tls12_prf_read( &operation->ctx.tls12_prf,
Gilles Peskine969c5d62019-01-16 15:53:06 +01005306 kdf_alg, output,
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005307 output_length );
5308 }
Gilles Peskinebef7f142018-07-12 17:22:21 +02005309 else
5310#endif /* MBEDTLS_MD_C */
Gilles Peskineeab56e42018-07-12 17:12:33 +02005311 {
5312 return( PSA_ERROR_BAD_STATE );
5313 }
5314
5315exit:
5316 if( status != PSA_SUCCESS )
5317 {
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005318 /* Preserve the algorithm upon errors, but clear all sensitive state.
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005319 * This allows us to differentiate between exhausted operations and
5320 * blank operations, so we can return PSA_ERROR_BAD_STATE on blank
5321 * operations. */
5322 psa_algorithm_t alg = operation->alg;
5323 psa_key_derivation_abort( operation );
5324 operation->alg = alg;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005325 memset( output, '!', output_length );
5326 }
5327 return( status );
5328}
5329
Gilles Peskine08542d82018-07-19 17:05:42 +02005330#if defined(MBEDTLS_DES_C)
5331static void psa_des_set_key_parity( uint8_t *data, size_t data_size )
5332{
5333 if( data_size >= 8 )
5334 mbedtls_des_key_set_parity( data );
5335 if( data_size >= 16 )
5336 mbedtls_des_key_set_parity( data + 8 );
5337 if( data_size >= 24 )
5338 mbedtls_des_key_set_parity( data + 16 );
5339}
5340#endif /* MBEDTLS_DES_C */
5341
Adrian L. Shaw5a5a79a2019-05-03 15:44:28 +01005342static psa_status_t psa_generate_derived_key_internal(
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005343 psa_key_slot_t *slot,
5344 size_t bits,
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005345 psa_key_derivation_operation_t *operation )
Gilles Peskineeab56e42018-07-12 17:12:33 +02005346{
5347 uint8_t *data = NULL;
5348 size_t bytes = PSA_BITS_TO_BYTES( bits );
5349 psa_status_t status;
5350
Gilles Peskine8e338702019-07-30 20:06:31 +02005351 if( ! key_type_is_raw_bytes( slot->attr.type ) )
Gilles Peskineeab56e42018-07-12 17:12:33 +02005352 return( PSA_ERROR_INVALID_ARGUMENT );
5353 if( bits % 8 != 0 )
5354 return( PSA_ERROR_INVALID_ARGUMENT );
5355 data = mbedtls_calloc( 1, bytes );
5356 if( data == NULL )
5357 return( PSA_ERROR_INSUFFICIENT_MEMORY );
5358
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005359 status = psa_key_derivation_output_bytes( operation, data, bytes );
Gilles Peskineeab56e42018-07-12 17:12:33 +02005360 if( status != PSA_SUCCESS )
5361 goto exit;
Gilles Peskine08542d82018-07-19 17:05:42 +02005362#if defined(MBEDTLS_DES_C)
Gilles Peskine8e338702019-07-30 20:06:31 +02005363 if( slot->attr.type == PSA_KEY_TYPE_DES )
Gilles Peskine08542d82018-07-19 17:05:42 +02005364 psa_des_set_key_parity( data, bytes );
5365#endif /* MBEDTLS_DES_C */
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005366 status = psa_import_key_into_slot( slot, data, bytes );
Gilles Peskineeab56e42018-07-12 17:12:33 +02005367
5368exit:
5369 mbedtls_free( data );
5370 return( status );
5371}
5372
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02005373psa_status_t psa_key_derivation_output_key( const psa_key_attributes_t *attributes,
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005374 psa_key_derivation_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02005375 mbedtls_svc_key_id_t *key )
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005376{
5377 psa_status_t status;
5378 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02005379 psa_se_drv_table_entry_t *driver = NULL;
Gilles Peskine0f84d622019-09-12 19:03:13 +02005380
5381 /* Reject any attempt to create a zero-length key so that we don't
5382 * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
5383 if( psa_get_key_bits( attributes ) == 0 )
5384 return( PSA_ERROR_INVALID_ARGUMENT );
5385
Gilles Peskine178c9aa2019-09-24 18:21:06 +02005386 if( ! operation->can_output_key )
5387 return( PSA_ERROR_NOT_PERMITTED );
5388
Gilles Peskinedf179142019-07-15 22:02:14 +02005389 status = psa_start_key_creation( PSA_KEY_CREATION_DERIVE,
Ronald Croncf56a0a2020-08-04 09:51:30 +02005390 attributes, key, &slot, &driver );
Gilles Peskinef4ee6622019-07-24 13:44:30 +02005391#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
5392 if( driver != NULL )
5393 {
5394 /* Deriving a key in a secure element is not implemented yet. */
5395 status = PSA_ERROR_NOT_SUPPORTED;
5396 }
5397#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005398 if( status == PSA_SUCCESS )
5399 {
Adrian L. Shaw5a5a79a2019-05-03 15:44:28 +01005400 status = psa_generate_derived_key_internal( slot,
Gilles Peskine7e0cff92019-07-30 13:48:52 +02005401 attributes->core.bits,
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005402 operation );
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005403 }
5404 if( status == PSA_SUCCESS )
Gilles Peskine011e4282019-06-26 18:34:38 +02005405 status = psa_finish_key_creation( slot, driver );
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005406 if( status != PSA_SUCCESS )
5407 {
Gilles Peskine011e4282019-06-26 18:34:38 +02005408 psa_fail_key_creation( slot, driver );
Ronald Croncf56a0a2020-08-04 09:51:30 +02005409 *key = MBEDTLS_SVC_KEY_ID_INIT;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005410 }
5411 return( status );
5412}
5413
Gilles Peskineeab56e42018-07-12 17:12:33 +02005414
5415
5416/****************************************************************/
Gilles Peskineea0fb492018-07-12 17:17:20 +02005417/* Key derivation */
5418/****************************************************************/
5419
Gilles Peskine969c5d62019-01-16 15:53:06 +01005420static psa_status_t psa_key_derivation_setup_kdf(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005421 psa_key_derivation_operation_t *operation,
Gilles Peskine969c5d62019-01-16 15:53:06 +01005422 psa_algorithm_t kdf_alg )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005423{
Janos Follath5fe19732019-06-20 15:09:30 +01005424 /* Make sure that operation->ctx is properly zero-initialised. (Macro
5425 * initialisers for this union leave some bytes unspecified.) */
5426 memset( &operation->ctx, 0, sizeof( operation->ctx ) );
5427
Gilles Peskine969c5d62019-01-16 15:53:06 +01005428 /* Make sure that kdf_alg is a supported key derivation algorithm. */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005429#if defined(MBEDTLS_MD_C)
Gilles Peskine969c5d62019-01-16 15:53:06 +01005430 if( PSA_ALG_IS_HKDF( kdf_alg ) ||
5431 PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
5432 PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005433 {
Gilles Peskine969c5d62019-01-16 15:53:06 +01005434 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( kdf_alg );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005435 size_t hash_size = PSA_HASH_SIZE( hash_alg );
5436 if( hash_size == 0 )
5437 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine969c5d62019-01-16 15:53:06 +01005438 if( ( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
5439 PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) ) &&
Gilles Peskineab4b2012019-04-12 15:06:27 +02005440 ! ( hash_alg == PSA_ALG_SHA_256 || hash_alg == PSA_ALG_SHA_384 ) )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005441 {
5442 return( PSA_ERROR_NOT_SUPPORTED );
5443 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005444 operation->capacity = 255 * hash_size;
Gilles Peskine969c5d62019-01-16 15:53:06 +01005445 return( PSA_SUCCESS );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005446 }
5447#endif /* MBEDTLS_MD_C */
Gilles Peskine969c5d62019-01-16 15:53:06 +01005448 else
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005449 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine969c5d62019-01-16 15:53:06 +01005450}
5451
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005452psa_status_t psa_key_derivation_setup( psa_key_derivation_operation_t *operation,
Gilles Peskine969c5d62019-01-16 15:53:06 +01005453 psa_algorithm_t alg )
5454{
5455 psa_status_t status;
5456
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005457 if( operation->alg != 0 )
Gilles Peskine969c5d62019-01-16 15:53:06 +01005458 return( PSA_ERROR_BAD_STATE );
5459
Gilles Peskine6843c292019-01-18 16:44:49 +01005460 if( PSA_ALG_IS_RAW_KEY_AGREEMENT( alg ) )
5461 return( PSA_ERROR_INVALID_ARGUMENT );
5462 else if( PSA_ALG_IS_KEY_AGREEMENT( alg ) )
Gilles Peskine969c5d62019-01-16 15:53:06 +01005463 {
5464 psa_algorithm_t kdf_alg = PSA_ALG_KEY_AGREEMENT_GET_KDF( alg );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005465 status = psa_key_derivation_setup_kdf( operation, kdf_alg );
Gilles Peskine969c5d62019-01-16 15:53:06 +01005466 }
5467 else if( PSA_ALG_IS_KEY_DERIVATION( alg ) )
5468 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005469 status = psa_key_derivation_setup_kdf( operation, alg );
Gilles Peskine969c5d62019-01-16 15:53:06 +01005470 }
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005471 else
5472 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine969c5d62019-01-16 15:53:06 +01005473
5474 if( status == PSA_SUCCESS )
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005475 operation->alg = alg;
Gilles Peskine969c5d62019-01-16 15:53:06 +01005476 return( status );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005477}
5478
5479#if defined(MBEDTLS_MD_C)
Gilles Peskinecbe66502019-05-16 16:59:18 +02005480static psa_status_t psa_hkdf_input( psa_hkdf_key_derivation_t *hkdf,
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005481 psa_algorithm_t hash_alg,
5482 psa_key_derivation_step_t step,
5483 const uint8_t *data,
5484 size_t data_length )
5485{
5486 psa_status_t status;
5487 switch( step )
5488 {
Gilles Peskine03410b52019-05-16 16:05:19 +02005489 case PSA_KEY_DERIVATION_INPUT_SALT:
Gilles Peskine2b522db2019-04-12 15:11:49 +02005490 if( hkdf->state != HKDF_STATE_INIT )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005491 return( PSA_ERROR_BAD_STATE );
Gilles Peskine2b522db2019-04-12 15:11:49 +02005492 status = psa_hmac_setup_internal( &hkdf->hmac,
5493 data, data_length,
5494 hash_alg );
5495 if( status != PSA_SUCCESS )
5496 return( status );
5497 hkdf->state = HKDF_STATE_STARTED;
5498 return( PSA_SUCCESS );
Gilles Peskine03410b52019-05-16 16:05:19 +02005499 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005500 /* If no salt was provided, use an empty salt. */
5501 if( hkdf->state == HKDF_STATE_INIT )
5502 {
5503 status = psa_hmac_setup_internal( &hkdf->hmac,
5504 NULL, 0,
Gilles Peskinef9ee6332019-04-11 21:22:52 +02005505 hash_alg );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005506 if( status != PSA_SUCCESS )
5507 return( status );
5508 hkdf->state = HKDF_STATE_STARTED;
5509 }
Gilles Peskine2b522db2019-04-12 15:11:49 +02005510 if( hkdf->state != HKDF_STATE_STARTED )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005511 return( PSA_ERROR_BAD_STATE );
Gilles Peskine2b522db2019-04-12 15:11:49 +02005512 status = psa_hash_update( &hkdf->hmac.hash_ctx,
5513 data, data_length );
5514 if( status != PSA_SUCCESS )
5515 return( status );
5516 status = psa_hmac_finish_internal( &hkdf->hmac,
5517 hkdf->prk,
5518 sizeof( hkdf->prk ) );
5519 if( status != PSA_SUCCESS )
5520 return( status );
5521 hkdf->offset_in_block = PSA_HASH_SIZE( hash_alg );
5522 hkdf->block_number = 0;
5523 hkdf->state = HKDF_STATE_KEYED;
5524 return( PSA_SUCCESS );
Gilles Peskine03410b52019-05-16 16:05:19 +02005525 case PSA_KEY_DERIVATION_INPUT_INFO:
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005526 if( hkdf->state == HKDF_STATE_OUTPUT )
5527 return( PSA_ERROR_BAD_STATE );
5528 if( hkdf->info_set )
5529 return( PSA_ERROR_BAD_STATE );
5530 hkdf->info_length = data_length;
5531 if( data_length != 0 )
5532 {
5533 hkdf->info = mbedtls_calloc( 1, data_length );
5534 if( hkdf->info == NULL )
5535 return( PSA_ERROR_INSUFFICIENT_MEMORY );
5536 memcpy( hkdf->info, data, data_length );
5537 }
5538 hkdf->info_set = 1;
5539 return( PSA_SUCCESS );
5540 default:
5541 return( PSA_ERROR_INVALID_ARGUMENT );
5542 }
5543}
Janos Follathb03233e2019-06-11 15:30:30 +01005544
Janos Follathf08e2652019-06-13 09:05:41 +01005545static psa_status_t psa_tls12_prf_set_seed( psa_tls12_prf_key_derivation_t *prf,
5546 const uint8_t *data,
5547 size_t data_length )
5548{
5549 if( prf->state != TLS12_PRF_STATE_INIT )
5550 return( PSA_ERROR_BAD_STATE );
5551
Janos Follathd6dce9f2019-07-04 09:11:38 +01005552 if( data_length != 0 )
5553 {
5554 prf->seed = mbedtls_calloc( 1, data_length );
5555 if( prf->seed == NULL )
5556 return( PSA_ERROR_INSUFFICIENT_MEMORY );
Janos Follathf08e2652019-06-13 09:05:41 +01005557
Janos Follathd6dce9f2019-07-04 09:11:38 +01005558 memcpy( prf->seed, data, data_length );
5559 prf->seed_length = data_length;
5560 }
Janos Follathf08e2652019-06-13 09:05:41 +01005561
5562 prf->state = TLS12_PRF_STATE_SEED_SET;
5563
5564 return( PSA_SUCCESS );
5565}
5566
Janos Follath81550542019-06-13 14:26:34 +01005567static psa_status_t psa_tls12_prf_set_key( psa_tls12_prf_key_derivation_t *prf,
5568 psa_algorithm_t hash_alg,
5569 const uint8_t *data,
5570 size_t data_length )
5571{
5572 psa_status_t status;
5573 if( prf->state != TLS12_PRF_STATE_SEED_SET )
5574 return( PSA_ERROR_BAD_STATE );
5575
5576 status = psa_hmac_setup_internal( &prf->hmac, data, data_length, hash_alg );
5577 if( status != PSA_SUCCESS )
5578 return( status );
5579
5580 prf->state = TLS12_PRF_STATE_KEY_SET;
5581
5582 return( PSA_SUCCESS );
5583}
5584
Janos Follath6660f0e2019-06-17 08:44:03 +01005585static psa_status_t psa_tls12_prf_psk_to_ms_set_key(
5586 psa_tls12_prf_key_derivation_t *prf,
5587 psa_algorithm_t hash_alg,
5588 const uint8_t *data,
5589 size_t data_length )
5590{
5591 psa_status_t status;
Gilles Peskinec11c4dc2019-07-15 11:06:38 +02005592 uint8_t pms[ 4 + 2 * PSA_ALG_TLS12_PSK_TO_MS_MAX_PSK_LEN ];
5593 uint8_t *cur = pms;
Janos Follath6660f0e2019-06-17 08:44:03 +01005594
5595 if( data_length > PSA_ALG_TLS12_PSK_TO_MS_MAX_PSK_LEN )
5596 return( PSA_ERROR_INVALID_ARGUMENT );
5597
5598 /* Quoting RFC 4279, Section 2:
5599 *
5600 * The premaster secret is formed as follows: if the PSK is N octets
5601 * long, concatenate a uint16 with the value N, N zero octets, a second
5602 * uint16 with the value N, and the PSK itself.
5603 */
5604
Janos Follath40e13932019-06-26 13:22:29 +01005605 *cur++ = ( data_length >> 8 ) & 0xff;
5606 *cur++ = ( data_length >> 0 ) & 0xff;
5607 memset( cur, 0, data_length );
5608 cur += data_length;
5609 *cur++ = pms[0];
5610 *cur++ = pms[1];
5611 memcpy( cur, data, data_length );
5612 cur += data_length;
Janos Follath6660f0e2019-06-17 08:44:03 +01005613
Janos Follath40e13932019-06-26 13:22:29 +01005614 status = psa_tls12_prf_set_key( prf, hash_alg, pms, cur - pms );
Janos Follath6660f0e2019-06-17 08:44:03 +01005615
5616 mbedtls_platform_zeroize( pms, sizeof( pms ) );
5617 return( status );
5618}
5619
Janos Follath63028dd2019-06-13 09:15:47 +01005620static psa_status_t psa_tls12_prf_set_label( psa_tls12_prf_key_derivation_t *prf,
5621 const uint8_t *data,
5622 size_t data_length )
5623{
5624 if( prf->state != TLS12_PRF_STATE_KEY_SET )
5625 return( PSA_ERROR_BAD_STATE );
5626
Janos Follathd6dce9f2019-07-04 09:11:38 +01005627 if( data_length != 0 )
5628 {
5629 prf->label = mbedtls_calloc( 1, data_length );
5630 if( prf->label == NULL )
5631 return( PSA_ERROR_INSUFFICIENT_MEMORY );
Janos Follath63028dd2019-06-13 09:15:47 +01005632
Janos Follathd6dce9f2019-07-04 09:11:38 +01005633 memcpy( prf->label, data, data_length );
5634 prf->label_length = data_length;
5635 }
Janos Follath63028dd2019-06-13 09:15:47 +01005636
5637 prf->state = TLS12_PRF_STATE_LABEL_SET;
5638
5639 return( PSA_SUCCESS );
5640}
5641
Janos Follathb03233e2019-06-11 15:30:30 +01005642static psa_status_t psa_tls12_prf_input( psa_tls12_prf_key_derivation_t *prf,
5643 psa_algorithm_t hash_alg,
5644 psa_key_derivation_step_t step,
5645 const uint8_t *data,
5646 size_t data_length )
5647{
Janos Follathb03233e2019-06-11 15:30:30 +01005648 switch( step )
5649 {
Janos Follathf08e2652019-06-13 09:05:41 +01005650 case PSA_KEY_DERIVATION_INPUT_SEED:
5651 return( psa_tls12_prf_set_seed( prf, data, data_length ) );
Janos Follath81550542019-06-13 14:26:34 +01005652 case PSA_KEY_DERIVATION_INPUT_SECRET:
5653 return( psa_tls12_prf_set_key( prf, hash_alg, data, data_length ) );
Janos Follath63028dd2019-06-13 09:15:47 +01005654 case PSA_KEY_DERIVATION_INPUT_LABEL:
5655 return( psa_tls12_prf_set_label( prf, data, data_length ) );
Janos Follathb03233e2019-06-11 15:30:30 +01005656 default:
5657 return( PSA_ERROR_INVALID_ARGUMENT );
5658 }
5659}
Janos Follath6660f0e2019-06-17 08:44:03 +01005660
5661static psa_status_t psa_tls12_prf_psk_to_ms_input(
5662 psa_tls12_prf_key_derivation_t *prf,
5663 psa_algorithm_t hash_alg,
5664 psa_key_derivation_step_t step,
5665 const uint8_t *data,
5666 size_t data_length )
5667{
5668 if( step == PSA_KEY_DERIVATION_INPUT_SECRET )
Janos Follath0c1ed842019-06-28 13:35:36 +01005669 {
Janos Follath6660f0e2019-06-17 08:44:03 +01005670 return( psa_tls12_prf_psk_to_ms_set_key( prf, hash_alg,
5671 data, data_length ) );
Janos Follath0c1ed842019-06-28 13:35:36 +01005672 }
Janos Follath6660f0e2019-06-17 08:44:03 +01005673
5674 return( psa_tls12_prf_input( prf, hash_alg, step, data, data_length ) );
5675}
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005676#endif /* MBEDTLS_MD_C */
5677
Gilles Peskineb8965192019-09-24 16:21:10 +02005678/** Check whether the given key type is acceptable for the given
5679 * input step of a key derivation.
5680 *
5681 * Secret inputs must have the type #PSA_KEY_TYPE_DERIVE.
5682 * Non-secret inputs must have the type #PSA_KEY_TYPE_RAW_DATA.
5683 * Both secret and non-secret inputs can alternatively have the type
5684 * #PSA_KEY_TYPE_NONE, which is never the type of a key object, meaning
5685 * that the input was passed as a buffer rather than via a key object.
5686 */
Gilles Peskine224b0d62019-09-23 18:13:17 +02005687static int psa_key_derivation_check_input_type(
5688 psa_key_derivation_step_t step,
5689 psa_key_type_t key_type )
5690{
5691 switch( step )
5692 {
5693 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskineb8965192019-09-24 16:21:10 +02005694 if( key_type == PSA_KEY_TYPE_DERIVE )
5695 return( PSA_SUCCESS );
5696 if( key_type == PSA_KEY_TYPE_NONE )
Gilles Peskine224b0d62019-09-23 18:13:17 +02005697 return( PSA_SUCCESS );
5698 break;
5699 case PSA_KEY_DERIVATION_INPUT_LABEL:
5700 case PSA_KEY_DERIVATION_INPUT_SALT:
5701 case PSA_KEY_DERIVATION_INPUT_INFO:
5702 case PSA_KEY_DERIVATION_INPUT_SEED:
Gilles Peskineb8965192019-09-24 16:21:10 +02005703 if( key_type == PSA_KEY_TYPE_RAW_DATA )
5704 return( PSA_SUCCESS );
5705 if( key_type == PSA_KEY_TYPE_NONE )
Gilles Peskine224b0d62019-09-23 18:13:17 +02005706 return( PSA_SUCCESS );
5707 break;
5708 }
5709 return( PSA_ERROR_INVALID_ARGUMENT );
5710}
5711
Janos Follathb80a94e2019-06-12 15:54:46 +01005712static psa_status_t psa_key_derivation_input_internal(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005713 psa_key_derivation_operation_t *operation,
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01005714 psa_key_derivation_step_t step,
Gilles Peskine224b0d62019-09-23 18:13:17 +02005715 psa_key_type_t key_type,
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01005716 const uint8_t *data,
5717 size_t data_length )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005718{
Gilles Peskine46d7faf2019-09-23 19:22:55 +02005719 psa_status_t status;
5720 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg( operation );
5721
5722 status = psa_key_derivation_check_input_type( step, key_type );
Gilles Peskine224b0d62019-09-23 18:13:17 +02005723 if( status != PSA_SUCCESS )
5724 goto exit;
5725
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005726#if defined(MBEDTLS_MD_C)
Gilles Peskine969c5d62019-01-16 15:53:06 +01005727 if( PSA_ALG_IS_HKDF( kdf_alg ) )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005728 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005729 status = psa_hkdf_input( &operation->ctx.hkdf,
Gilles Peskine969c5d62019-01-16 15:53:06 +01005730 PSA_ALG_HKDF_GET_HASH( kdf_alg ),
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005731 step, data, data_length );
5732 }
k-stachowiak012dcc42019-08-13 14:55:03 +02005733 else if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005734 {
Janos Follathb03233e2019-06-11 15:30:30 +01005735 status = psa_tls12_prf_input( &operation->ctx.tls12_prf,
5736 PSA_ALG_HKDF_GET_HASH( kdf_alg ),
5737 step, data, data_length );
Janos Follath6660f0e2019-06-17 08:44:03 +01005738 }
5739 else if( PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
5740 {
5741 status = psa_tls12_prf_psk_to_ms_input( &operation->ctx.tls12_prf,
5742 PSA_ALG_HKDF_GET_HASH( kdf_alg ),
5743 step, data, data_length );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005744 }
5745 else
5746#endif /* MBEDTLS_MD_C */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005747 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005748 /* This can't happen unless the operation object was not initialized */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005749 return( PSA_ERROR_BAD_STATE );
5750 }
5751
Gilles Peskine224b0d62019-09-23 18:13:17 +02005752exit:
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005753 if( status != PSA_SUCCESS )
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005754 psa_key_derivation_abort( operation );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005755 return( status );
5756}
5757
Janos Follath51f4a0f2019-06-14 11:35:55 +01005758psa_status_t psa_key_derivation_input_bytes(
5759 psa_key_derivation_operation_t *operation,
5760 psa_key_derivation_step_t step,
5761 const uint8_t *data,
5762 size_t data_length )
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01005763{
Gilles Peskineb8965192019-09-24 16:21:10 +02005764 return( psa_key_derivation_input_internal( operation, step,
5765 PSA_KEY_TYPE_NONE,
Janos Follathc5621512019-06-14 11:27:57 +01005766 data, data_length ) );
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01005767}
5768
Janos Follath51f4a0f2019-06-14 11:35:55 +01005769psa_status_t psa_key_derivation_input_key(
5770 psa_key_derivation_operation_t *operation,
5771 psa_key_derivation_step_t step,
Ronald Croncf56a0a2020-08-04 09:51:30 +02005772 mbedtls_svc_key_id_t key )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005773{
5774 psa_key_slot_t *slot;
5775 psa_status_t status;
Gilles Peskine178c9aa2019-09-24 18:21:06 +02005776
Ronald Croncf56a0a2020-08-04 09:51:30 +02005777 status = psa_get_transparent_key( key, &slot,
5778 PSA_KEY_USAGE_DERIVE, operation->alg );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005779 if( status != PSA_SUCCESS )
Gilles Peskine593773d2019-09-23 18:17:40 +02005780 {
5781 psa_key_derivation_abort( operation );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005782 return( status );
Gilles Peskine593773d2019-09-23 18:17:40 +02005783 }
Gilles Peskine178c9aa2019-09-24 18:21:06 +02005784
5785 /* Passing a key object as a SECRET input unlocks the permission
5786 * to output to a key object. */
5787 if( step == PSA_KEY_DERIVATION_INPUT_SECRET )
5788 operation->can_output_key = 1;
5789
Janos Follathb80a94e2019-06-12 15:54:46 +01005790 return( psa_key_derivation_input_internal( operation,
Gilles Peskine224b0d62019-09-23 18:13:17 +02005791 step, slot->attr.type,
Steven Cooreman71fd80d2020-07-07 21:12:27 +02005792 slot->data.key.data,
5793 slot->data.key.bytes ) );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005794}
Gilles Peskineea0fb492018-07-12 17:17:20 +02005795
5796
5797
5798/****************************************************************/
Gilles Peskine01d718c2018-09-18 12:01:02 +02005799/* Key agreement */
5800/****************************************************************/
5801
Gilles Peskinea05219c2018-11-16 16:02:56 +01005802#if defined(MBEDTLS_ECDH_C)
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005803static psa_status_t psa_key_agreement_ecdh( const uint8_t *peer_key,
5804 size_t peer_key_length,
5805 const mbedtls_ecp_keypair *our_key,
5806 uint8_t *shared_secret,
5807 size_t shared_secret_size,
5808 size_t *shared_secret_length )
5809{
Steven Cooremand4867872020-08-05 16:31:39 +02005810 mbedtls_ecp_keypair *their_key = NULL;
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005811 mbedtls_ecdh_context ecdh;
Jaeden Amero97271b32019-01-10 19:38:51 +00005812 psa_status_t status;
Gilles Peskinec7ef5b32019-12-12 16:58:00 +01005813 size_t bits = 0;
Paul Elliott8ff510a2020-06-02 17:19:28 +01005814 psa_ecc_family_t curve = mbedtls_ecc_group_to_psa( our_key->grp.id, &bits );
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005815 mbedtls_ecdh_init( &ecdh );
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005816
Steven Cooreman4fed4552020-08-03 14:46:03 +02005817 status = psa_load_ecp_representation( PSA_KEY_TYPE_ECC_PUBLIC_KEY(curve),
5818 peer_key,
Steven Cooreman7f391872020-07-30 14:57:44 +02005819 peer_key_length,
Steven Cooreman7f391872020-07-30 14:57:44 +02005820 &their_key );
Jaeden Amero97271b32019-01-10 19:38:51 +00005821 if( status != PSA_SUCCESS )
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005822 goto exit;
5823
Jaeden Amero97271b32019-01-10 19:38:51 +00005824 status = mbedtls_to_psa_error(
Steven Cooremana2371e52020-07-28 14:30:39 +02005825 mbedtls_ecdh_get_params( &ecdh, their_key, MBEDTLS_ECDH_THEIRS ) );
Jaeden Amero97271b32019-01-10 19:38:51 +00005826 if( status != PSA_SUCCESS )
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005827 goto exit;
Jaeden Amero97271b32019-01-10 19:38:51 +00005828 status = mbedtls_to_psa_error(
5829 mbedtls_ecdh_get_params( &ecdh, our_key, MBEDTLS_ECDH_OURS ) );
5830 if( status != PSA_SUCCESS )
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005831 goto exit;
5832
Jaeden Amero97271b32019-01-10 19:38:51 +00005833 status = mbedtls_to_psa_error(
5834 mbedtls_ecdh_calc_secret( &ecdh,
5835 shared_secret_length,
5836 shared_secret, shared_secret_size,
5837 mbedtls_ctr_drbg_random,
5838 &global_data.ctr_drbg ) );
Gilles Peskinec7ef5b32019-12-12 16:58:00 +01005839 if( status != PSA_SUCCESS )
5840 goto exit;
5841 if( PSA_BITS_TO_BYTES( bits ) != *shared_secret_length )
5842 status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005843
5844exit:
Gilles Peskine3e819b72019-12-20 14:09:55 +01005845 if( status != PSA_SUCCESS )
5846 mbedtls_platform_zeroize( shared_secret, shared_secret_size );
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005847 mbedtls_ecdh_free( &ecdh );
Steven Cooremana2371e52020-07-28 14:30:39 +02005848 mbedtls_ecp_keypair_free( their_key );
Steven Cooreman6d839f02020-07-30 11:36:45 +02005849 mbedtls_free( their_key );
Steven Cooremana2371e52020-07-28 14:30:39 +02005850
Jaeden Amero97271b32019-01-10 19:38:51 +00005851 return( status );
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005852}
Gilles Peskinea05219c2018-11-16 16:02:56 +01005853#endif /* MBEDTLS_ECDH_C */
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005854
Gilles Peskine01d718c2018-09-18 12:01:02 +02005855#define PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE MBEDTLS_ECP_MAX_BYTES
5856
Gilles Peskine0216fe12019-04-11 21:23:21 +02005857static psa_status_t psa_key_agreement_raw_internal( psa_algorithm_t alg,
5858 psa_key_slot_t *private_key,
5859 const uint8_t *peer_key,
5860 size_t peer_key_length,
5861 uint8_t *shared_secret,
5862 size_t shared_secret_size,
5863 size_t *shared_secret_length )
Gilles Peskine01d718c2018-09-18 12:01:02 +02005864{
Gilles Peskine0216fe12019-04-11 21:23:21 +02005865 switch( alg )
Gilles Peskine01d718c2018-09-18 12:01:02 +02005866 {
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005867#if defined(MBEDTLS_ECDH_C)
Gilles Peskine0216fe12019-04-11 21:23:21 +02005868 case PSA_ALG_ECDH:
Gilles Peskine8e338702019-07-30 20:06:31 +02005869 if( ! PSA_KEY_TYPE_IS_ECC_KEY_PAIR( private_key->attr.type ) )
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005870 return( PSA_ERROR_INVALID_ARGUMENT );
Steven Cooremana2371e52020-07-28 14:30:39 +02005871 mbedtls_ecp_keypair *ecp = NULL;
Steven Cooreman7f391872020-07-30 14:57:44 +02005872 psa_status_t status = psa_load_ecp_representation(
Steven Cooreman4fed4552020-08-03 14:46:03 +02005873 private_key->attr.type,
Steven Cooreman7f391872020-07-30 14:57:44 +02005874 private_key->data.key.data,
5875 private_key->data.key.bytes,
Steven Cooreman7f391872020-07-30 14:57:44 +02005876 &ecp );
Steven Cooremanacda8342020-07-24 23:09:52 +02005877 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02005878 return( status );
Steven Cooremanacda8342020-07-24 23:09:52 +02005879 status = psa_key_agreement_ecdh( peer_key, peer_key_length,
Steven Cooremana2371e52020-07-28 14:30:39 +02005880 ecp,
Steven Cooremanacda8342020-07-24 23:09:52 +02005881 shared_secret, shared_secret_size,
5882 shared_secret_length );
Steven Cooremana2371e52020-07-28 14:30:39 +02005883 mbedtls_ecp_keypair_free( ecp );
5884 mbedtls_free( ecp );
Steven Cooreman29149862020-08-05 15:43:42 +02005885 return( status );
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02005886#endif /* MBEDTLS_ECDH_C */
Gilles Peskine01d718c2018-09-18 12:01:02 +02005887 default:
Gilles Peskine93f85002018-11-16 16:43:31 +01005888 (void) private_key;
5889 (void) peer_key;
5890 (void) peer_key_length;
Gilles Peskine0216fe12019-04-11 21:23:21 +02005891 (void) shared_secret;
5892 (void) shared_secret_size;
5893 (void) shared_secret_length;
Gilles Peskine01d718c2018-09-18 12:01:02 +02005894 return( PSA_ERROR_NOT_SUPPORTED );
5895 }
Gilles Peskine0216fe12019-04-11 21:23:21 +02005896}
5897
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02005898/* Note that if this function fails, you must call psa_key_derivation_abort()
Gilles Peskine01d718c2018-09-18 12:01:02 +02005899 * to potentially free embedded data structures and wipe confidential data.
5900 */
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005901static psa_status_t psa_key_agreement_internal( psa_key_derivation_operation_t *operation,
Gilles Peskine969c5d62019-01-16 15:53:06 +01005902 psa_key_derivation_step_t step,
Gilles Peskine01d718c2018-09-18 12:01:02 +02005903 psa_key_slot_t *private_key,
5904 const uint8_t *peer_key,
Gilles Peskine969c5d62019-01-16 15:53:06 +01005905 size_t peer_key_length )
Gilles Peskine01d718c2018-09-18 12:01:02 +02005906{
5907 psa_status_t status;
5908 uint8_t shared_secret[PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE];
5909 size_t shared_secret_length = 0;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005910 psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE( operation->alg );
Gilles Peskine01d718c2018-09-18 12:01:02 +02005911
5912 /* Step 1: run the secret agreement algorithm to generate the shared
5913 * secret. */
Gilles Peskine0216fe12019-04-11 21:23:21 +02005914 status = psa_key_agreement_raw_internal( ka_alg,
5915 private_key,
5916 peer_key, peer_key_length,
itayzafrir0adf0fc2018-09-06 16:24:41 +03005917 shared_secret,
5918 sizeof( shared_secret ),
Gilles Peskine05d69892018-06-19 22:00:52 +02005919 &shared_secret_length );
Gilles Peskine53d991e2018-07-12 01:14:59 +02005920 if( status != PSA_SUCCESS )
Gilles Peskine12313cd2018-06-20 00:20:32 +02005921 goto exit;
5922
Gilles Peskineb0b255c2018-07-06 17:01:38 +02005923 /* Step 2: set up the key derivation to generate key material from
Gilles Peskine224b0d62019-09-23 18:13:17 +02005924 * the shared secret. A shared secret is permitted wherever a key
5925 * of type DERIVE is permitted. */
Janos Follathb80a94e2019-06-12 15:54:46 +01005926 status = psa_key_derivation_input_internal( operation, step,
Gilles Peskine224b0d62019-09-23 18:13:17 +02005927 PSA_KEY_TYPE_DERIVE,
Janos Follathb80a94e2019-06-12 15:54:46 +01005928 shared_secret,
5929 shared_secret_length );
Gilles Peskine12313cd2018-06-20 00:20:32 +02005930exit:
Gilles Peskine3f108122018-12-07 18:14:53 +01005931 mbedtls_platform_zeroize( shared_secret, shared_secret_length );
Gilles Peskine12313cd2018-06-20 00:20:32 +02005932 return( status );
5933}
5934
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005935psa_status_t psa_key_derivation_key_agreement( psa_key_derivation_operation_t *operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02005936 psa_key_derivation_step_t step,
Ronald Croncf56a0a2020-08-04 09:51:30 +02005937 mbedtls_svc_key_id_t private_key,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02005938 const uint8_t *peer_key,
5939 size_t peer_key_length )
Gilles Peskine12313cd2018-06-20 00:20:32 +02005940{
Gilles Peskine2f060a82018-12-04 17:12:32 +01005941 psa_key_slot_t *slot;
Gilles Peskine08542d82018-07-19 17:05:42 +02005942 psa_status_t status;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005943 if( ! PSA_ALG_IS_KEY_AGREEMENT( operation->alg ) )
Gilles Peskine12313cd2018-06-20 00:20:32 +02005944 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine28f8f302019-07-24 13:30:31 +02005945 status = psa_get_transparent_key( private_key, &slot,
Gilles Peskinef77a6ac2019-07-25 10:51:03 +02005946 PSA_KEY_USAGE_DERIVE, operation->alg );
Gilles Peskine12313cd2018-06-20 00:20:32 +02005947 if( status != PSA_SUCCESS )
5948 return( status );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005949 status = psa_key_agreement_internal( operation, step,
Gilles Peskine346797d2018-11-16 16:05:06 +01005950 slot,
Gilles Peskine969c5d62019-01-16 15:53:06 +01005951 peer_key, peer_key_length );
Gilles Peskine346797d2018-11-16 16:05:06 +01005952 if( status != PSA_SUCCESS )
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005953 psa_key_derivation_abort( operation );
Steven Cooremanfa5e6312020-10-15 17:07:12 +02005954 else
5955 {
5956 /* If a private key has been added as SECRET, we allow the derived
5957 * key material to be used as a key in PSA Crypto. */
5958 if( step == PSA_KEY_DERIVATION_INPUT_SECRET )
5959 operation->can_output_key = 1;
5960 }
Gilles Peskine346797d2018-11-16 16:05:06 +01005961 return( status );
Gilles Peskineaf3baab2018-06-27 22:55:52 +02005962}
5963
Gilles Peskinebe697d82019-05-16 18:00:41 +02005964psa_status_t psa_raw_key_agreement( psa_algorithm_t alg,
Ronald Croncf56a0a2020-08-04 09:51:30 +02005965 mbedtls_svc_key_id_t private_key,
Gilles Peskinebe697d82019-05-16 18:00:41 +02005966 const uint8_t *peer_key,
5967 size_t peer_key_length,
5968 uint8_t *output,
5969 size_t output_size,
5970 size_t *output_length )
Gilles Peskine0216fe12019-04-11 21:23:21 +02005971{
5972 psa_key_slot_t *slot;
5973 psa_status_t status;
5974
5975 if( ! PSA_ALG_IS_KEY_AGREEMENT( alg ) )
5976 {
5977 status = PSA_ERROR_INVALID_ARGUMENT;
5978 goto exit;
5979 }
Gilles Peskine28f8f302019-07-24 13:30:31 +02005980 status = psa_get_transparent_key( private_key, &slot,
Gilles Peskinef77a6ac2019-07-25 10:51:03 +02005981 PSA_KEY_USAGE_DERIVE, alg );
Gilles Peskine0216fe12019-04-11 21:23:21 +02005982 if( status != PSA_SUCCESS )
5983 goto exit;
5984
5985 status = psa_key_agreement_raw_internal( alg, slot,
5986 peer_key, peer_key_length,
5987 output, output_size,
5988 output_length );
5989
5990exit:
5991 if( status != PSA_SUCCESS )
5992 {
5993 /* If an error happens and is not handled properly, the output
5994 * may be used as a key to protect sensitive data. Arrange for such
5995 * a key to be random, which is likely to result in decryption or
5996 * verification errors. This is better than filling the buffer with
5997 * some constant data such as zeros, which would result in the data
5998 * being protected with a reproducible, easily knowable key.
5999 */
6000 psa_generate_random( output, output_size );
6001 *output_length = output_size;
6002 }
6003 return( status );
6004}
Gilles Peskine86a440b2018-11-12 18:39:40 +01006005
6006
6007/****************************************************************/
6008/* Random generation */
Gilles Peskine53d991e2018-07-12 01:14:59 +02006009/****************************************************************/
Gilles Peskine12313cd2018-06-20 00:20:32 +02006010
Gilles Peskine4c317f42018-07-12 01:24:09 +02006011psa_status_t psa_generate_random( uint8_t *output,
Gilles Peskine53d991e2018-07-12 01:14:59 +02006012 size_t output_size )
Gilles Peskine12313cd2018-06-20 00:20:32 +02006013{
Janos Follath24eed8d2019-11-22 13:21:35 +00006014 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskinee59236f2018-01-27 23:32:46 +01006015 GUARD_MODULE_INITIALIZED;
6016
Gilles Peskinef181eca2019-08-07 13:49:00 +02006017 while( output_size > MBEDTLS_CTR_DRBG_MAX_REQUEST )
6018 {
6019 ret = mbedtls_ctr_drbg_random( &global_data.ctr_drbg,
6020 output,
6021 MBEDTLS_CTR_DRBG_MAX_REQUEST );
6022 if( ret != 0 )
6023 return( mbedtls_to_psa_error( ret ) );
6024 output += MBEDTLS_CTR_DRBG_MAX_REQUEST;
6025 output_size -= MBEDTLS_CTR_DRBG_MAX_REQUEST;
6026 }
6027
Gilles Peskinee59236f2018-01-27 23:32:46 +01006028 ret = mbedtls_ctr_drbg_random( &global_data.ctr_drbg, output, output_size );
6029 return( mbedtls_to_psa_error( ret ) );
6030}
6031
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01006032#if defined(MBEDTLS_PSA_INJECT_ENTROPY)
6033#include "mbedtls/entropy_poll.h"
6034
Gilles Peskine7228da22019-07-15 11:06:15 +02006035psa_status_t mbedtls_psa_inject_entropy( const uint8_t *seed,
Netanel Gonen2bcd3122018-11-19 11:53:02 +02006036 size_t seed_size )
6037{
Netanel Gonen2bcd3122018-11-19 11:53:02 +02006038 if( global_data.initialized )
6039 return( PSA_ERROR_NOT_PERMITTED );
Netanel Gonen21f37cb2018-11-19 11:53:55 +02006040
6041 if( ( ( seed_size < MBEDTLS_ENTROPY_MIN_PLATFORM ) ||
6042 ( seed_size < MBEDTLS_ENTROPY_BLOCK_SIZE ) ) ||
6043 ( seed_size > MBEDTLS_ENTROPY_MAX_SEED_SIZE ) )
6044 return( PSA_ERROR_INVALID_ARGUMENT );
6045
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01006046 return( mbedtls_psa_storage_inject_entropy( seed, seed_size ) );
Netanel Gonen2bcd3122018-11-19 11:53:02 +02006047}
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01006048#endif /* MBEDTLS_PSA_INJECT_ENTROPY */
Netanel Gonen2bcd3122018-11-19 11:53:02 +02006049
Gilles Peskinee56e8782019-04-26 17:34:02 +02006050#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_GENPRIME)
6051static psa_status_t psa_read_rsa_exponent( const uint8_t *domain_parameters,
6052 size_t domain_parameters_size,
6053 int *exponent )
Gilles Peskinee59236f2018-01-27 23:32:46 +01006054{
Gilles Peskinee56e8782019-04-26 17:34:02 +02006055 size_t i;
6056 uint32_t acc = 0;
Gilles Peskinee59236f2018-01-27 23:32:46 +01006057
Gilles Peskinee56e8782019-04-26 17:34:02 +02006058 if( domain_parameters_size == 0 )
6059 {
6060 *exponent = 65537;
6061 return( PSA_SUCCESS );
6062 }
6063
6064 /* Mbed TLS encodes the public exponent as an int. For simplicity, only
6065 * support values that fit in a 32-bit integer, which is larger than
6066 * int on just about every platform anyway. */
6067 if( domain_parameters_size > sizeof( acc ) )
6068 return( PSA_ERROR_NOT_SUPPORTED );
6069 for( i = 0; i < domain_parameters_size; i++ )
6070 acc = ( acc << 8 ) | domain_parameters[i];
6071 if( acc > INT_MAX )
6072 return( PSA_ERROR_NOT_SUPPORTED );
6073 *exponent = acc;
6074 return( PSA_SUCCESS );
6075}
6076#endif /* MBEDTLS_RSA_C && MBEDTLS_GENPRIME */
6077
Gilles Peskine35ef36b2019-05-16 19:42:05 +02006078static psa_status_t psa_generate_key_internal(
Gilles Peskinee56e8782019-04-26 17:34:02 +02006079 psa_key_slot_t *slot, size_t bits,
6080 const uint8_t *domain_parameters, size_t domain_parameters_size )
Gilles Peskinee59236f2018-01-27 23:32:46 +01006081{
Gilles Peskine8e338702019-07-30 20:06:31 +02006082 psa_key_type_t type = slot->attr.type;
Gilles Peskinee59236f2018-01-27 23:32:46 +01006083
Gilles Peskinee56e8782019-04-26 17:34:02 +02006084 if( domain_parameters == NULL && domain_parameters_size != 0 )
Gilles Peskinee59236f2018-01-27 23:32:46 +01006085 return( PSA_ERROR_INVALID_ARGUMENT );
6086
Gilles Peskinee59236f2018-01-27 23:32:46 +01006087 if( key_type_is_raw_bytes( type ) )
6088 {
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006089 psa_status_t status;
Steven Cooreman81be2fa2020-07-24 22:04:59 +02006090
6091 status = validate_unstructured_key_bit_size( slot->attr.type, bits );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006092 if( status != PSA_SUCCESS )
6093 return( status );
Steven Cooreman81be2fa2020-07-24 22:04:59 +02006094
6095 /* Allocate memory for the key */
Steven Cooreman75b74362020-07-28 14:30:13 +02006096 status = psa_allocate_buffer_to_slot( slot, PSA_BITS_TO_BYTES( bits ) );
6097 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02006098 return( status );
Steven Cooreman81be2fa2020-07-24 22:04:59 +02006099
Steven Cooreman71fd80d2020-07-07 21:12:27 +02006100 status = psa_generate_random( slot->data.key.data,
6101 slot->data.key.bytes );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006102 if( status != PSA_SUCCESS )
Gilles Peskinee59236f2018-01-27 23:32:46 +01006103 return( status );
Steven Cooreman81be2fa2020-07-24 22:04:59 +02006104
6105 slot->attr.bits = (psa_key_bits_t) bits;
Gilles Peskinee59236f2018-01-27 23:32:46 +01006106#if defined(MBEDTLS_DES_C)
6107 if( type == PSA_KEY_TYPE_DES )
Steven Cooreman71fd80d2020-07-07 21:12:27 +02006108 psa_des_set_key_parity( slot->data.key.data,
6109 slot->data.key.bytes );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006110#endif /* MBEDTLS_DES_C */
6111 }
6112 else
6113
6114#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_GENPRIME)
Gilles Peskinec93b80c2019-05-16 19:39:54 +02006115 if ( type == PSA_KEY_TYPE_RSA_KEY_PAIR )
Gilles Peskinee59236f2018-01-27 23:32:46 +01006116 {
Steven Cooremana01795d2020-07-24 22:48:15 +02006117 mbedtls_rsa_context rsa;
Janos Follath24eed8d2019-11-22 13:21:35 +00006118 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskinee56e8782019-04-26 17:34:02 +02006119 int exponent;
6120 psa_status_t status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01006121 if( bits > PSA_VENDOR_RSA_MAX_KEY_BITS )
6122 return( PSA_ERROR_NOT_SUPPORTED );
6123 /* Accept only byte-aligned keys, for the same reasons as
6124 * in psa_import_rsa_key(). */
6125 if( bits % 8 != 0 )
6126 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskinee56e8782019-04-26 17:34:02 +02006127 status = psa_read_rsa_exponent( domain_parameters,
6128 domain_parameters_size,
6129 &exponent );
6130 if( status != PSA_SUCCESS )
6131 return( status );
Steven Cooremana01795d2020-07-24 22:48:15 +02006132 mbedtls_rsa_init( &rsa, MBEDTLS_RSA_PKCS_V15, MBEDTLS_MD_NONE );
6133 ret = mbedtls_rsa_gen_key( &rsa,
Gilles Peskinee59236f2018-01-27 23:32:46 +01006134 mbedtls_ctr_drbg_random,
6135 &global_data.ctr_drbg,
6136 (unsigned int) bits,
6137 exponent );
6138 if( ret != 0 )
Gilles Peskinee59236f2018-01-27 23:32:46 +01006139 return( mbedtls_to_psa_error( ret ) );
Steven Cooremana01795d2020-07-24 22:48:15 +02006140
6141 /* Make sure to always have an export representation available */
6142 size_t bytes = PSA_KEY_EXPORT_RSA_KEY_PAIR_MAX_SIZE( bits );
6143
Steven Cooreman75b74362020-07-28 14:30:13 +02006144 status = psa_allocate_buffer_to_slot( slot, bytes );
6145 if( status != PSA_SUCCESS )
Steven Cooremana01795d2020-07-24 22:48:15 +02006146 {
6147 mbedtls_rsa_free( &rsa );
Steven Cooreman29149862020-08-05 15:43:42 +02006148 return( status );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006149 }
Steven Cooremana01795d2020-07-24 22:48:15 +02006150
6151 status = psa_export_rsa_key( type,
6152 &rsa,
6153 slot->data.key.data,
6154 bytes,
6155 &slot->data.key.bytes );
6156 mbedtls_rsa_free( &rsa );
6157 if( status != PSA_SUCCESS )
Steven Cooremana01795d2020-07-24 22:48:15 +02006158 psa_remove_key_data_from_memory( slot );
Steven Cooreman560c28a2020-07-24 23:20:24 +02006159 return( status );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006160 }
6161 else
6162#endif /* MBEDTLS_RSA_C && MBEDTLS_GENPRIME */
6163
6164#if defined(MBEDTLS_ECP_C)
Gilles Peskinec93b80c2019-05-16 19:39:54 +02006165 if ( PSA_KEY_TYPE_IS_ECC( type ) && PSA_KEY_TYPE_IS_KEY_PAIR( type ) )
Gilles Peskinee59236f2018-01-27 23:32:46 +01006166 {
Paul Elliott8ff510a2020-06-02 17:19:28 +01006167 psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY( type );
Gilles Peskine4295e8b2019-12-02 21:39:10 +01006168 mbedtls_ecp_group_id grp_id =
6169 mbedtls_ecc_group_of_psa( curve, PSA_BITS_TO_BYTES( bits ) );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006170 const mbedtls_ecp_curve_info *curve_info =
6171 mbedtls_ecp_curve_info_from_grp_id( grp_id );
Steven Cooremanacda8342020-07-24 23:09:52 +02006172 mbedtls_ecp_keypair ecp;
Janos Follath24eed8d2019-11-22 13:21:35 +00006173 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskinee56e8782019-04-26 17:34:02 +02006174 if( domain_parameters_size != 0 )
Gilles Peskinee59236f2018-01-27 23:32:46 +01006175 return( PSA_ERROR_NOT_SUPPORTED );
6176 if( grp_id == MBEDTLS_ECP_DP_NONE || curve_info == NULL )
6177 return( PSA_ERROR_NOT_SUPPORTED );
Steven Cooremanacda8342020-07-24 23:09:52 +02006178 mbedtls_ecp_keypair_init( &ecp );
6179 ret = mbedtls_ecp_gen_key( grp_id, &ecp,
Gilles Peskinee59236f2018-01-27 23:32:46 +01006180 mbedtls_ctr_drbg_random,
6181 &global_data.ctr_drbg );
6182 if( ret != 0 )
6183 {
Steven Cooremanacda8342020-07-24 23:09:52 +02006184 mbedtls_ecp_keypair_free( &ecp );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006185 return( mbedtls_to_psa_error( ret ) );
6186 }
Steven Cooremanacda8342020-07-24 23:09:52 +02006187
6188
6189 /* Make sure to always have an export representation available */
6190 size_t bytes = PSA_BITS_TO_BYTES( bits );
Steven Cooreman75b74362020-07-28 14:30:13 +02006191 psa_status_t status = psa_allocate_buffer_to_slot( slot, bytes );
6192 if( status != PSA_SUCCESS )
Steven Cooremanacda8342020-07-24 23:09:52 +02006193 {
6194 mbedtls_ecp_keypair_free( &ecp );
Steven Cooreman29149862020-08-05 15:43:42 +02006195 return( status );
Steven Cooremanacda8342020-07-24 23:09:52 +02006196 }
Steven Cooreman75b74362020-07-28 14:30:13 +02006197
6198 status = mbedtls_to_psa_error(
Steven Cooremanacda8342020-07-24 23:09:52 +02006199 mbedtls_ecp_write_key( &ecp, slot->data.key.data, bytes ) );
6200
6201 mbedtls_ecp_keypair_free( &ecp );
Steven Cooremanb7f6dea2020-08-05 16:07:20 +02006202 if( status != PSA_SUCCESS ) {
6203 memset( slot->data.key.data, 0, bytes );
Steven Cooremanacda8342020-07-24 23:09:52 +02006204 psa_remove_key_data_from_memory( slot );
Steven Cooremanb7f6dea2020-08-05 16:07:20 +02006205 }
Steven Cooreman560c28a2020-07-24 23:20:24 +02006206 return( status );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006207 }
6208 else
6209#endif /* MBEDTLS_ECP_C */
Steven Cooreman29149862020-08-05 15:43:42 +02006210 {
Gilles Peskinee59236f2018-01-27 23:32:46 +01006211 return( PSA_ERROR_NOT_SUPPORTED );
Steven Cooreman29149862020-08-05 15:43:42 +02006212 }
Gilles Peskinee59236f2018-01-27 23:32:46 +01006213
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006214 return( PSA_SUCCESS );
6215}
Darryl Green0c6575a2018-11-07 16:05:30 +00006216
Gilles Peskine35ef36b2019-05-16 19:42:05 +02006217psa_status_t psa_generate_key( const psa_key_attributes_t *attributes,
Ronald Croncf56a0a2020-08-04 09:51:30 +02006218 mbedtls_svc_key_id_t *key )
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006219{
6220 psa_status_t status;
6221 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02006222 psa_se_drv_table_entry_t *driver = NULL;
Gilles Peskine11792082019-08-06 18:36:36 +02006223
Gilles Peskine0f84d622019-09-12 19:03:13 +02006224 /* Reject any attempt to create a zero-length key so that we don't
6225 * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
6226 if( psa_get_key_bits( attributes ) == 0 )
6227 return( PSA_ERROR_INVALID_ARGUMENT );
6228
Gilles Peskinedf179142019-07-15 22:02:14 +02006229 status = psa_start_key_creation( PSA_KEY_CREATION_GENERATE,
Ronald Croncf56a0a2020-08-04 09:51:30 +02006230 attributes, key, &slot, &driver );
Gilles Peskine11792082019-08-06 18:36:36 +02006231 if( status != PSA_SUCCESS )
6232 goto exit;
6233
Steven Cooreman2a1664c2020-07-20 15:33:08 +02006234 status = psa_driver_wrapper_generate_key( attributes,
6235 slot );
6236 if( status != PSA_ERROR_NOT_SUPPORTED ||
6237 psa_key_lifetime_is_external( attributes->core.lifetime ) )
6238 goto exit;
6239
6240 status = psa_generate_key_internal(
6241 slot, attributes->core.bits,
6242 attributes->domain_parameters, attributes->domain_parameters_size );
Gilles Peskine11792082019-08-06 18:36:36 +02006243
6244exit:
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006245 if( status == PSA_SUCCESS )
Gilles Peskine011e4282019-06-26 18:34:38 +02006246 status = psa_finish_key_creation( slot, driver );
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006247 if( status != PSA_SUCCESS )
6248 {
Gilles Peskine011e4282019-06-26 18:34:38 +02006249 psa_fail_key_creation( slot, driver );
Ronald Croncf56a0a2020-08-04 09:51:30 +02006250 *key = MBEDTLS_SVC_KEY_ID_INIT;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006251 }
Darryl Green0c6575a2018-11-07 16:05:30 +00006252 return( status );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006253}
6254
6255
Gilles Peskinee59236f2018-01-27 23:32:46 +01006256
6257/****************************************************************/
6258/* Module setup */
6259/****************************************************************/
6260
Gilles Peskine5e769522018-11-20 21:59:56 +01006261psa_status_t mbedtls_psa_crypto_configure_entropy_sources(
6262 void (* entropy_init )( mbedtls_entropy_context *ctx ),
6263 void (* entropy_free )( mbedtls_entropy_context *ctx ) )
6264{
6265 if( global_data.rng_state != RNG_NOT_INITIALIZED )
6266 return( PSA_ERROR_BAD_STATE );
6267 global_data.entropy_init = entropy_init;
6268 global_data.entropy_free = entropy_free;
6269 return( PSA_SUCCESS );
6270}
6271
Gilles Peskinee59236f2018-01-27 23:32:46 +01006272void mbedtls_psa_crypto_free( void )
6273{
Gilles Peskine66fb1262018-12-10 16:29:04 +01006274 psa_wipe_all_key_slots( );
Gilles Peskinec6b69072018-11-20 21:42:52 +01006275 if( global_data.rng_state != RNG_NOT_INITIALIZED )
6276 {
6277 mbedtls_ctr_drbg_free( &global_data.ctr_drbg );
Gilles Peskine5e769522018-11-20 21:59:56 +01006278 global_data.entropy_free( &global_data.entropy );
Gilles Peskinec6b69072018-11-20 21:42:52 +01006279 }
6280 /* Wipe all remaining data, including configuration.
6281 * In particular, this sets all state indicator to the value
6282 * indicating "uninitialized". */
Gilles Peskine3f108122018-12-07 18:14:53 +01006283 mbedtls_platform_zeroize( &global_data, sizeof( global_data ) );
Gilles Peskinea8ade162019-06-26 11:24:49 +02006284#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined0890212019-06-24 14:34:43 +02006285 /* Unregister all secure element drivers, so that we restart from
6286 * a pristine state. */
6287 psa_unregister_all_se_drivers( );
Gilles Peskinea8ade162019-06-26 11:24:49 +02006288#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskinee59236f2018-01-27 23:32:46 +01006289}
6290
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02006291#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
6292/** Recover a transaction that was interrupted by a power failure.
6293 *
6294 * This function is called during initialization, before psa_crypto_init()
6295 * returns. If this function returns a failure status, the initialization
6296 * fails.
6297 */
6298static psa_status_t psa_crypto_recover_transaction(
6299 const psa_crypto_transaction_t *transaction )
6300{
6301 switch( transaction->unknown.type )
6302 {
6303 case PSA_CRYPTO_TRANSACTION_CREATE_KEY:
6304 case PSA_CRYPTO_TRANSACTION_DESTROY_KEY:
Janos Follath1d57a202019-08-13 12:15:34 +01006305 /* TODO - fall through to the failure case until this
Gilles Peskinec9d7f942019-08-13 16:17:16 +02006306 * is implemented.
6307 * https://github.com/ARMmbed/mbed-crypto/issues/218
6308 */
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02006309 default:
6310 /* We found an unsupported transaction in the storage.
6311 * We don't know what state the storage is in. Give up. */
6312 return( PSA_ERROR_STORAGE_FAILURE );
6313 }
6314}
6315#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
6316
Gilles Peskinee59236f2018-01-27 23:32:46 +01006317psa_status_t psa_crypto_init( void )
6318{
Gilles Peskine66fb1262018-12-10 16:29:04 +01006319 psa_status_t status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01006320 const unsigned char drbg_seed[] = "PSA";
6321
Gilles Peskinec6b69072018-11-20 21:42:52 +01006322 /* Double initialization is explicitly allowed. */
Gilles Peskinee59236f2018-01-27 23:32:46 +01006323 if( global_data.initialized != 0 )
6324 return( PSA_SUCCESS );
6325
Gilles Peskine5e769522018-11-20 21:59:56 +01006326 /* Set default configuration if
6327 * mbedtls_psa_crypto_configure_entropy_sources() hasn't been called. */
6328 if( global_data.entropy_init == NULL )
6329 global_data.entropy_init = mbedtls_entropy_init;
6330 if( global_data.entropy_free == NULL )
6331 global_data.entropy_free = mbedtls_entropy_free;
Gilles Peskinee59236f2018-01-27 23:32:46 +01006332
Gilles Peskinec6b69072018-11-20 21:42:52 +01006333 /* Initialize the random generator. */
Gilles Peskine5e769522018-11-20 21:59:56 +01006334 global_data.entropy_init( &global_data.entropy );
Jaeden Amero76541612019-06-04 17:14:43 +01006335#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \
6336 defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES)
6337 /* The PSA entropy injection feature depends on using NV seed as an entropy
6338 * source. Add NV seed as an entropy source for PSA entropy injection. */
6339 mbedtls_entropy_add_source( &global_data.entropy,
6340 mbedtls_nv_seed_poll, NULL,
6341 MBEDTLS_ENTROPY_BLOCK_SIZE,
6342 MBEDTLS_ENTROPY_SOURCE_STRONG );
6343#endif
Gilles Peskinee59236f2018-01-27 23:32:46 +01006344 mbedtls_ctr_drbg_init( &global_data.ctr_drbg );
Gilles Peskinec6b69072018-11-20 21:42:52 +01006345 global_data.rng_state = RNG_INITIALIZED;
Gilles Peskine66fb1262018-12-10 16:29:04 +01006346 status = mbedtls_to_psa_error(
6347 mbedtls_ctr_drbg_seed( &global_data.ctr_drbg,
6348 mbedtls_entropy_func,
6349 &global_data.entropy,
6350 drbg_seed, sizeof( drbg_seed ) - 1 ) );
6351 if( status != PSA_SUCCESS )
Gilles Peskinee59236f2018-01-27 23:32:46 +01006352 goto exit;
Gilles Peskinec6b69072018-11-20 21:42:52 +01006353 global_data.rng_state = RNG_SEEDED;
Gilles Peskinee59236f2018-01-27 23:32:46 +01006354
Gilles Peskine66fb1262018-12-10 16:29:04 +01006355 status = psa_initialize_key_slots( );
6356 if( status != PSA_SUCCESS )
6357 goto exit;
Gilles Peskinec6b69072018-11-20 21:42:52 +01006358
Gilles Peskined9348f22019-10-01 15:22:29 +02006359#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
6360 status = psa_init_all_se_drivers( );
6361 if( status != PSA_SUCCESS )
6362 goto exit;
6363#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
6364
Gilles Peskine4b734222019-07-24 15:56:31 +02006365#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
Gilles Peskinefc762652019-07-22 19:30:34 +02006366 status = psa_crypto_load_transaction( );
6367 if( status == PSA_SUCCESS )
6368 {
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02006369 status = psa_crypto_recover_transaction( &psa_crypto_transaction );
6370 if( status != PSA_SUCCESS )
6371 goto exit;
6372 status = psa_crypto_stop_transaction( );
Gilles Peskinefc762652019-07-22 19:30:34 +02006373 }
6374 else if( status == PSA_ERROR_DOES_NOT_EXIST )
6375 {
6376 /* There's no transaction to complete. It's all good. */
6377 status = PSA_SUCCESS;
6378 }
Gilles Peskine4b734222019-07-24 15:56:31 +02006379#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
Gilles Peskinefc762652019-07-22 19:30:34 +02006380
Gilles Peskinec6b69072018-11-20 21:42:52 +01006381 /* All done. */
Gilles Peskinee59236f2018-01-27 23:32:46 +01006382 global_data.initialized = 1;
6383
6384exit:
Gilles Peskine66fb1262018-12-10 16:29:04 +01006385 if( status != PSA_SUCCESS )
Gilles Peskinee59236f2018-01-27 23:32:46 +01006386 mbedtls_psa_crypto_free( );
Gilles Peskine66fb1262018-12-10 16:29:04 +01006387 return( status );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006388}
6389
6390#endif /* MBEDTLS_PSA_CRYPTO_C */