blob: 12c21d7b62ce60dc38de803af8fcd19a4114d9be [file] [log] [blame]
Gilles Peskinee59236f2018-01-27 23:32:46 +01001/*
2 * PSA crypto layer on top of Mbed TLS crypto
3 */
4/* Copyright (C) 2018, ARM Limited, All Rights Reserved
5 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 *
19 * This file is part of mbed TLS (https://tls.mbed.org)
20 */
21
22#if !defined(MBEDTLS_CONFIG_FILE)
23#include "mbedtls/config.h"
24#else
25#include MBEDTLS_CONFIG_FILE
26#endif
27
28#if defined(MBEDTLS_PSA_CRYPTO_C)
29
30#include "psa/crypto.h"
31
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010032#include <stdlib.h>
33#include <string.h>
34#if defined(MBEDTLS_PLATFORM_C)
35#include "mbedtls/platform.h"
36#else
37#define mbedtls_calloc calloc
38#define mbedtls_free free
39#endif
40
Gilles Peskinea5905292018-02-07 20:59:33 +010041#include "mbedtls/arc4.h"
Gilles Peskine9a944802018-06-21 09:35:35 +020042#include "mbedtls/asn1.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010043#include "mbedtls/blowfish.h"
44#include "mbedtls/camellia.h"
45#include "mbedtls/cipher.h"
46#include "mbedtls/ccm.h"
47#include "mbedtls/cmac.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010048#include "mbedtls/ctr_drbg.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010049#include "mbedtls/des.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010050#include "mbedtls/ecp.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010051#include "mbedtls/entropy.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010052#include "mbedtls/error.h"
53#include "mbedtls/gcm.h"
54#include "mbedtls/md2.h"
55#include "mbedtls/md4.h"
56#include "mbedtls/md5.h"
Gilles Peskine20035e32018-02-03 22:44:14 +010057#include "mbedtls/md.h"
58#include "mbedtls/md_internal.h"
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010059#include "mbedtls/pk.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010060#include "mbedtls/pk_internal.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010061#include "mbedtls/ripemd160.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010062#include "mbedtls/rsa.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010063#include "mbedtls/sha1.h"
64#include "mbedtls/sha256.h"
65#include "mbedtls/sha512.h"
66#include "mbedtls/xtea.h"
67
Gilles Peskinee59236f2018-01-27 23:32:46 +010068
69
70/* Implementation that should never be optimized out by the compiler */
71static void mbedtls_zeroize( void *v, size_t n )
72{
73 volatile unsigned char *p = v; while( n-- ) *p++ = 0;
74}
75
Gilles Peskine9ef733f2018-02-07 21:05:37 +010076/* constant-time buffer comparison */
77static inline int safer_memcmp( const uint8_t *a, const uint8_t *b, size_t n )
78{
79 size_t i;
80 unsigned char diff = 0;
81
82 for( i = 0; i < n; i++ )
83 diff |= a[i] ^ b[i];
84
85 return( diff );
86}
87
88
89
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010090/****************************************************************/
91/* Global data, support functions and library management */
92/****************************************************************/
93
94/* Number of key slots (plus one because 0 is not used).
95 * The value is a compile-time constant for now, for simplicity. */
Gilles Peskine828ed142018-06-18 23:25:51 +020096#define PSA_KEY_SLOT_COUNT 32
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010097
Gilles Peskine2d277862018-06-18 15:41:12 +020098typedef struct
99{
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100100 psa_key_type_t type;
mohammad16038cc1cee2018-03-28 01:21:33 +0300101 psa_key_policy_t policy;
mohammad1603804cd712018-03-20 22:44:08 +0200102 psa_key_lifetime_t lifetime;
Gilles Peskine2d277862018-06-18 15:41:12 +0200103 union
104 {
105 struct raw_data
106 {
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100107 uint8_t *data;
108 size_t bytes;
109 } raw;
Gilles Peskine969ac722018-01-28 18:16:59 +0100110#if defined(MBEDTLS_RSA_C)
111 mbedtls_rsa_context *rsa;
112#endif /* MBEDTLS_RSA_C */
113#if defined(MBEDTLS_ECP_C)
114 mbedtls_ecp_keypair *ecp;
115#endif /* MBEDTLS_ECP_C */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100116 } data;
117} key_slot_t;
118
Gilles Peskine48c0ea12018-06-21 14:15:31 +0200119static int key_type_is_raw_bytes( psa_key_type_t type )
120{
121 psa_key_type_t category = type & PSA_KEY_TYPE_CATEGORY_MASK;
122 return( category == PSA_KEY_TYPE_RAW_DATA ||
123 category == PSA_KEY_TYPE_CATEGORY_SYMMETRIC );
124}
125
Gilles Peskine2d277862018-06-18 15:41:12 +0200126typedef struct
127{
Gilles Peskinee59236f2018-01-27 23:32:46 +0100128 int initialized;
129 mbedtls_entropy_context entropy;
130 mbedtls_ctr_drbg_context ctr_drbg;
Gilles Peskine828ed142018-06-18 23:25:51 +0200131 key_slot_t key_slots[PSA_KEY_SLOT_COUNT];
Gilles Peskinee59236f2018-01-27 23:32:46 +0100132} psa_global_data_t;
133
134static psa_global_data_t global_data;
135
136static psa_status_t mbedtls_to_psa_error( int ret )
137{
Gilles Peskinea5905292018-02-07 20:59:33 +0100138 /* If there's both a high-level code and low-level code, dispatch on
139 * the high-level code. */
140 switch( ret < -0x7f ? - ( -ret & 0x7f80 ) : ret )
Gilles Peskinee59236f2018-01-27 23:32:46 +0100141 {
142 case 0:
143 return( PSA_SUCCESS );
Gilles Peskinea5905292018-02-07 20:59:33 +0100144
145 case MBEDTLS_ERR_AES_INVALID_KEY_LENGTH:
146 case MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH:
147 case MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE:
148 return( PSA_ERROR_NOT_SUPPORTED );
149 case MBEDTLS_ERR_AES_HW_ACCEL_FAILED:
150 return( PSA_ERROR_HARDWARE_FAILURE );
151
152 case MBEDTLS_ERR_ARC4_HW_ACCEL_FAILED:
153 return( PSA_ERROR_HARDWARE_FAILURE );
154
Gilles Peskine9a944802018-06-21 09:35:35 +0200155 case MBEDTLS_ERR_ASN1_OUT_OF_DATA:
156 case MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:
157 case MBEDTLS_ERR_ASN1_INVALID_LENGTH:
158 case MBEDTLS_ERR_ASN1_LENGTH_MISMATCH:
159 case MBEDTLS_ERR_ASN1_INVALID_DATA:
160 return( PSA_ERROR_INVALID_ARGUMENT );
161 case MBEDTLS_ERR_ASN1_ALLOC_FAILED:
162 return( PSA_ERROR_INSUFFICIENT_MEMORY );
163 case MBEDTLS_ERR_ASN1_BUF_TOO_SMALL:
164 return( PSA_ERROR_BUFFER_TOO_SMALL );
165
Gilles Peskinea5905292018-02-07 20:59:33 +0100166 case MBEDTLS_ERR_BLOWFISH_INVALID_KEY_LENGTH:
167 case MBEDTLS_ERR_BLOWFISH_INVALID_INPUT_LENGTH:
168 return( PSA_ERROR_NOT_SUPPORTED );
169 case MBEDTLS_ERR_BLOWFISH_HW_ACCEL_FAILED:
170 return( PSA_ERROR_HARDWARE_FAILURE );
171
172 case MBEDTLS_ERR_CAMELLIA_INVALID_KEY_LENGTH:
173 case MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH:
174 return( PSA_ERROR_NOT_SUPPORTED );
175 case MBEDTLS_ERR_CAMELLIA_HW_ACCEL_FAILED:
176 return( PSA_ERROR_HARDWARE_FAILURE );
177
178 case MBEDTLS_ERR_CCM_BAD_INPUT:
179 return( PSA_ERROR_INVALID_ARGUMENT );
180 case MBEDTLS_ERR_CCM_AUTH_FAILED:
181 return( PSA_ERROR_INVALID_SIGNATURE );
182 case MBEDTLS_ERR_CCM_HW_ACCEL_FAILED:
183 return( PSA_ERROR_HARDWARE_FAILURE );
184
185 case MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE:
186 return( PSA_ERROR_NOT_SUPPORTED );
187 case MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA:
188 return( PSA_ERROR_INVALID_ARGUMENT );
189 case MBEDTLS_ERR_CIPHER_ALLOC_FAILED:
190 return( PSA_ERROR_INSUFFICIENT_MEMORY );
191 case MBEDTLS_ERR_CIPHER_INVALID_PADDING:
192 return( PSA_ERROR_INVALID_PADDING );
193 case MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED:
194 return( PSA_ERROR_BAD_STATE );
195 case MBEDTLS_ERR_CIPHER_AUTH_FAILED:
196 return( PSA_ERROR_INVALID_SIGNATURE );
197 case MBEDTLS_ERR_CIPHER_INVALID_CONTEXT:
198 return( PSA_ERROR_TAMPERING_DETECTED );
199 case MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED:
200 return( PSA_ERROR_HARDWARE_FAILURE );
201
202 case MBEDTLS_ERR_CMAC_HW_ACCEL_FAILED:
203 return( PSA_ERROR_HARDWARE_FAILURE );
204
205 case MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED:
206 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
207 case MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG:
208 case MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG:
209 return( PSA_ERROR_NOT_SUPPORTED );
210 case MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR:
211 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
212
213 case MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH:
214 return( PSA_ERROR_NOT_SUPPORTED );
215 case MBEDTLS_ERR_DES_HW_ACCEL_FAILED:
216 return( PSA_ERROR_HARDWARE_FAILURE );
217
Gilles Peskinee59236f2018-01-27 23:32:46 +0100218 case MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED:
219 case MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE:
220 case MBEDTLS_ERR_ENTROPY_SOURCE_FAILED:
221 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
Gilles Peskinea5905292018-02-07 20:59:33 +0100222
223 case MBEDTLS_ERR_GCM_AUTH_FAILED:
224 return( PSA_ERROR_INVALID_SIGNATURE );
225 case MBEDTLS_ERR_GCM_BAD_INPUT:
226 return( PSA_ERROR_NOT_SUPPORTED );
227 case MBEDTLS_ERR_GCM_HW_ACCEL_FAILED:
228 return( PSA_ERROR_HARDWARE_FAILURE );
229
230 case MBEDTLS_ERR_MD2_HW_ACCEL_FAILED:
231 case MBEDTLS_ERR_MD4_HW_ACCEL_FAILED:
232 case MBEDTLS_ERR_MD5_HW_ACCEL_FAILED:
233 return( PSA_ERROR_HARDWARE_FAILURE );
234
235 case MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE:
236 return( PSA_ERROR_NOT_SUPPORTED );
237 case MBEDTLS_ERR_MD_BAD_INPUT_DATA:
238 return( PSA_ERROR_INVALID_ARGUMENT );
239 case MBEDTLS_ERR_MD_ALLOC_FAILED:
240 return( PSA_ERROR_INSUFFICIENT_MEMORY );
241 case MBEDTLS_ERR_MD_FILE_IO_ERROR:
242 return( PSA_ERROR_STORAGE_FAILURE );
243 case MBEDTLS_ERR_MD_HW_ACCEL_FAILED:
244 return( PSA_ERROR_HARDWARE_FAILURE );
245
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100246 case MBEDTLS_ERR_PK_ALLOC_FAILED:
247 return( PSA_ERROR_INSUFFICIENT_MEMORY );
248 case MBEDTLS_ERR_PK_TYPE_MISMATCH:
249 case MBEDTLS_ERR_PK_BAD_INPUT_DATA:
250 return( PSA_ERROR_INVALID_ARGUMENT );
251 case MBEDTLS_ERR_PK_FILE_IO_ERROR:
Gilles Peskinea5905292018-02-07 20:59:33 +0100252 return( PSA_ERROR_STORAGE_FAILURE );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100253 case MBEDTLS_ERR_PK_KEY_INVALID_VERSION:
254 case MBEDTLS_ERR_PK_KEY_INVALID_FORMAT:
255 return( PSA_ERROR_INVALID_ARGUMENT );
256 case MBEDTLS_ERR_PK_UNKNOWN_PK_ALG:
257 return( PSA_ERROR_NOT_SUPPORTED );
258 case MBEDTLS_ERR_PK_PASSWORD_REQUIRED:
259 case MBEDTLS_ERR_PK_PASSWORD_MISMATCH:
260 return( PSA_ERROR_NOT_PERMITTED );
261 case MBEDTLS_ERR_PK_INVALID_PUBKEY:
262 return( PSA_ERROR_INVALID_ARGUMENT );
263 case MBEDTLS_ERR_PK_INVALID_ALG:
264 case MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE:
265 case MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE:
266 return( PSA_ERROR_NOT_SUPPORTED );
267 case MBEDTLS_ERR_PK_SIG_LEN_MISMATCH:
268 return( PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskinea5905292018-02-07 20:59:33 +0100269 case MBEDTLS_ERR_PK_HW_ACCEL_FAILED:
270 return( PSA_ERROR_HARDWARE_FAILURE );
271
272 case MBEDTLS_ERR_RIPEMD160_HW_ACCEL_FAILED:
273 return( PSA_ERROR_HARDWARE_FAILURE );
274
275 case MBEDTLS_ERR_RSA_BAD_INPUT_DATA:
276 return( PSA_ERROR_INVALID_ARGUMENT );
277 case MBEDTLS_ERR_RSA_INVALID_PADDING:
278 return( PSA_ERROR_INVALID_PADDING );
279 case MBEDTLS_ERR_RSA_KEY_GEN_FAILED:
280 return( PSA_ERROR_HARDWARE_FAILURE );
281 case MBEDTLS_ERR_RSA_KEY_CHECK_FAILED:
282 return( PSA_ERROR_INVALID_ARGUMENT );
283 case MBEDTLS_ERR_RSA_PUBLIC_FAILED:
284 case MBEDTLS_ERR_RSA_PRIVATE_FAILED:
285 return( PSA_ERROR_TAMPERING_DETECTED );
286 case MBEDTLS_ERR_RSA_VERIFY_FAILED:
287 return( PSA_ERROR_INVALID_SIGNATURE );
288 case MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE:
289 return( PSA_ERROR_BUFFER_TOO_SMALL );
290 case MBEDTLS_ERR_RSA_RNG_FAILED:
291 return( PSA_ERROR_INSUFFICIENT_MEMORY );
292 case MBEDTLS_ERR_RSA_UNSUPPORTED_OPERATION:
293 return( PSA_ERROR_NOT_SUPPORTED );
294 case MBEDTLS_ERR_RSA_HW_ACCEL_FAILED:
295 return( PSA_ERROR_HARDWARE_FAILURE );
296
297 case MBEDTLS_ERR_SHA1_HW_ACCEL_FAILED:
298 case MBEDTLS_ERR_SHA256_HW_ACCEL_FAILED:
299 case MBEDTLS_ERR_SHA512_HW_ACCEL_FAILED:
300 return( PSA_ERROR_HARDWARE_FAILURE );
301
302 case MBEDTLS_ERR_XTEA_INVALID_INPUT_LENGTH:
303 return( PSA_ERROR_INVALID_ARGUMENT );
304 case MBEDTLS_ERR_XTEA_HW_ACCEL_FAILED:
305 return( PSA_ERROR_HARDWARE_FAILURE );
306
itayzafrir5c753392018-05-08 11:18:38 +0300307 case MBEDTLS_ERR_ECP_BAD_INPUT_DATA:
itayzafrir7b30f8b2018-05-09 16:07:36 +0300308 case MBEDTLS_ERR_ECP_INVALID_KEY:
itayzafrir5c753392018-05-08 11:18:38 +0300309 return( PSA_ERROR_INVALID_ARGUMENT );
itayzafrir7b30f8b2018-05-09 16:07:36 +0300310 case MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL:
311 return( PSA_ERROR_BUFFER_TOO_SMALL );
312 case MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE:
313 return( PSA_ERROR_NOT_SUPPORTED );
314 case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH:
315 case MBEDTLS_ERR_ECP_VERIFY_FAILED:
316 return( PSA_ERROR_INVALID_SIGNATURE );
317 case MBEDTLS_ERR_ECP_ALLOC_FAILED:
318 return( PSA_ERROR_INSUFFICIENT_MEMORY );
319 case MBEDTLS_ERR_ECP_HW_ACCEL_FAILED:
320 return( PSA_ERROR_HARDWARE_FAILURE );
itayzafrir5c753392018-05-08 11:18:38 +0300321
Gilles Peskinee59236f2018-01-27 23:32:46 +0100322 default:
323 return( PSA_ERROR_UNKNOWN_ERROR );
324 }
325}
326
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +0200327
328
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100329/****************************************************************/
330/* Key management */
331/****************************************************************/
332
Gilles Peskine34ef7f52018-06-18 20:47:51 +0200333static psa_ecc_curve_t mbedtls_ecc_group_to_psa( mbedtls_ecp_group_id grpid )
334{
335 switch( grpid )
336 {
337 case MBEDTLS_ECP_DP_SECP192R1:
338 return( PSA_ECC_CURVE_SECP192R1 );
339 case MBEDTLS_ECP_DP_SECP224R1:
340 return( PSA_ECC_CURVE_SECP224R1 );
341 case MBEDTLS_ECP_DP_SECP256R1:
342 return( PSA_ECC_CURVE_SECP256R1 );
343 case MBEDTLS_ECP_DP_SECP384R1:
344 return( PSA_ECC_CURVE_SECP384R1 );
345 case MBEDTLS_ECP_DP_SECP521R1:
346 return( PSA_ECC_CURVE_SECP521R1 );
347 case MBEDTLS_ECP_DP_BP256R1:
348 return( PSA_ECC_CURVE_BRAINPOOL_P256R1 );
349 case MBEDTLS_ECP_DP_BP384R1:
350 return( PSA_ECC_CURVE_BRAINPOOL_P384R1 );
351 case MBEDTLS_ECP_DP_BP512R1:
352 return( PSA_ECC_CURVE_BRAINPOOL_P512R1 );
353 case MBEDTLS_ECP_DP_CURVE25519:
354 return( PSA_ECC_CURVE_CURVE25519 );
355 case MBEDTLS_ECP_DP_SECP192K1:
356 return( PSA_ECC_CURVE_SECP192K1 );
357 case MBEDTLS_ECP_DP_SECP224K1:
358 return( PSA_ECC_CURVE_SECP224K1 );
359 case MBEDTLS_ECP_DP_SECP256K1:
360 return( PSA_ECC_CURVE_SECP256K1 );
361 case MBEDTLS_ECP_DP_CURVE448:
362 return( PSA_ECC_CURVE_CURVE448 );
363 default:
364 return( 0 );
365 }
366}
367
Gilles Peskine12313cd2018-06-20 00:20:32 +0200368static mbedtls_ecp_group_id mbedtls_ecc_group_of_psa( psa_ecc_curve_t curve )
369{
370 switch( curve )
371 {
372 case PSA_ECC_CURVE_SECP192R1:
373 return( MBEDTLS_ECP_DP_SECP192R1 );
374 case PSA_ECC_CURVE_SECP224R1:
375 return( MBEDTLS_ECP_DP_SECP224R1 );
376 case PSA_ECC_CURVE_SECP256R1:
377 return( MBEDTLS_ECP_DP_SECP256R1 );
378 case PSA_ECC_CURVE_SECP384R1:
379 return( MBEDTLS_ECP_DP_SECP384R1 );
380 case PSA_ECC_CURVE_SECP521R1:
381 return( MBEDTLS_ECP_DP_SECP521R1 );
382 case PSA_ECC_CURVE_BRAINPOOL_P256R1:
383 return( MBEDTLS_ECP_DP_BP256R1 );
384 case PSA_ECC_CURVE_BRAINPOOL_P384R1:
385 return( MBEDTLS_ECP_DP_BP384R1 );
386 case PSA_ECC_CURVE_BRAINPOOL_P512R1:
387 return( MBEDTLS_ECP_DP_BP512R1 );
388 case PSA_ECC_CURVE_CURVE25519:
389 return( MBEDTLS_ECP_DP_CURVE25519 );
390 case PSA_ECC_CURVE_SECP192K1:
391 return( MBEDTLS_ECP_DP_SECP192K1 );
392 case PSA_ECC_CURVE_SECP224K1:
393 return( MBEDTLS_ECP_DP_SECP224K1 );
394 case PSA_ECC_CURVE_SECP256K1:
395 return( MBEDTLS_ECP_DP_SECP256K1 );
396 case PSA_ECC_CURVE_CURVE448:
397 return( MBEDTLS_ECP_DP_CURVE448 );
398 default:
399 return( MBEDTLS_ECP_DP_NONE );
400 }
401}
402
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200403static psa_status_t prepare_raw_data_slot( psa_key_type_t type,
404 size_t bits,
405 struct raw_data *raw )
406{
407 /* Check that the bit size is acceptable for the key type */
408 switch( type )
409 {
410 case PSA_KEY_TYPE_RAW_DATA:
411#if defined(MBEDTLS_MD_C)
412 case PSA_KEY_TYPE_HMAC:
413#endif
414 break;
415#if defined(MBEDTLS_AES_C)
416 case PSA_KEY_TYPE_AES:
417 if( bits != 128 && bits != 192 && bits != 256 )
418 return( PSA_ERROR_INVALID_ARGUMENT );
419 break;
420#endif
421#if defined(MBEDTLS_CAMELLIA_C)
422 case PSA_KEY_TYPE_CAMELLIA:
423 if( bits != 128 && bits != 192 && bits != 256 )
424 return( PSA_ERROR_INVALID_ARGUMENT );
425 break;
426#endif
427#if defined(MBEDTLS_DES_C)
428 case PSA_KEY_TYPE_DES:
429 if( bits != 64 && bits != 128 && bits != 192 )
430 return( PSA_ERROR_INVALID_ARGUMENT );
431 break;
432#endif
433#if defined(MBEDTLS_ARC4_C)
434 case PSA_KEY_TYPE_ARC4:
435 if( bits < 8 || bits > 2048 )
436 return( PSA_ERROR_INVALID_ARGUMENT );
437 break;
438#endif
439 default:
440 return( PSA_ERROR_NOT_SUPPORTED );
441 }
Gilles Peskineb54979a2018-06-21 09:32:47 +0200442 if( bits % 8 != 0 )
443 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200444
445 /* Allocate memory for the key */
446 raw->bytes = PSA_BITS_TO_BYTES( bits );
447 raw->data = mbedtls_calloc( 1, raw->bytes );
448 if( raw->data == NULL )
449 {
450 raw->bytes = 0;
451 return( PSA_ERROR_INSUFFICIENT_MEMORY );
452 }
453 return( PSA_SUCCESS );
454}
455
Gilles Peskine2d277862018-06-18 15:41:12 +0200456psa_status_t psa_import_key( psa_key_slot_t key,
457 psa_key_type_t type,
458 const uint8_t *data,
459 size_t data_length )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100460{
461 key_slot_t *slot;
462
Gilles Peskine828ed142018-06-18 23:25:51 +0200463 if( key == 0 || key > PSA_KEY_SLOT_COUNT )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100464 return( PSA_ERROR_INVALID_ARGUMENT );
465 slot = &global_data.key_slots[key];
466 if( slot->type != PSA_KEY_TYPE_NONE )
467 return( PSA_ERROR_OCCUPIED_SLOT );
468
Gilles Peskine48c0ea12018-06-21 14:15:31 +0200469 if( key_type_is_raw_bytes( type ) )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100470 {
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200471 psa_status_t status;
Gilles Peskine6d912132018-03-07 16:41:37 +0100472 /* Ensure that a bytes-to-bit conversion won't overflow. */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100473 if( data_length > SIZE_MAX / 8 )
474 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200475 status = prepare_raw_data_slot( type,
476 PSA_BYTES_TO_BITS( data_length ),
477 &slot->data.raw );
478 if( status != PSA_SUCCESS )
479 return( status );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100480 memcpy( slot->data.raw.data, data, data_length );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100481 }
482 else
Gilles Peskine969ac722018-01-28 18:16:59 +0100483#if defined(MBEDTLS_PK_PARSE_C)
Gilles Peskinec66ea6a2018-02-03 22:43:28 +0100484 if( type == PSA_KEY_TYPE_RSA_PUBLIC_KEY ||
485 type == PSA_KEY_TYPE_RSA_KEYPAIR ||
486 PSA_KEY_TYPE_IS_ECC( type ) )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100487 {
488 int ret;
Gilles Peskine969ac722018-01-28 18:16:59 +0100489 mbedtls_pk_context pk;
490 mbedtls_pk_init( &pk );
Gilles Peskinec66ea6a2018-02-03 22:43:28 +0100491 if( PSA_KEY_TYPE_IS_KEYPAIR( type ) )
492 ret = mbedtls_pk_parse_key( &pk, data, data_length, NULL, 0 );
493 else
494 ret = mbedtls_pk_parse_public_key( &pk, data, data_length );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100495 if( ret != 0 )
496 return( mbedtls_to_psa_error( ret ) );
Gilles Peskine969ac722018-01-28 18:16:59 +0100497 switch( mbedtls_pk_get_type( &pk ) )
498 {
499#if defined(MBEDTLS_RSA_C)
500 case MBEDTLS_PK_RSA:
Gilles Peskinec66ea6a2018-02-03 22:43:28 +0100501 if( type == PSA_KEY_TYPE_RSA_PUBLIC_KEY ||
502 type == PSA_KEY_TYPE_RSA_KEYPAIR )
Gilles Peskine34ef7f52018-06-18 20:47:51 +0200503 slot->data.rsa = mbedtls_pk_rsa( pk );
Gilles Peskine969ac722018-01-28 18:16:59 +0100504 else
505 return( PSA_ERROR_INVALID_ARGUMENT );
506 break;
507#endif /* MBEDTLS_RSA_C */
508#if defined(MBEDTLS_ECP_C)
509 case MBEDTLS_PK_ECKEY:
510 if( PSA_KEY_TYPE_IS_ECC( type ) )
511 {
Gilles Peskine34ef7f52018-06-18 20:47:51 +0200512 mbedtls_ecp_keypair *ecp = mbedtls_pk_ec( pk );
513 psa_ecc_curve_t actual_curve =
514 mbedtls_ecc_group_to_psa( ecp->grp.id );
515 psa_ecc_curve_t expected_curve =
516 PSA_KEY_TYPE_GET_CURVE( type );
517 if( actual_curve != expected_curve )
518 return( PSA_ERROR_INVALID_ARGUMENT );
519 slot->data.ecp = ecp;
Gilles Peskine969ac722018-01-28 18:16:59 +0100520 }
521 else
522 return( PSA_ERROR_INVALID_ARGUMENT );
523 break;
524#endif /* MBEDTLS_ECP_C */
525 default:
526 return( PSA_ERROR_INVALID_ARGUMENT );
527 }
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100528 }
529 else
Gilles Peskine969ac722018-01-28 18:16:59 +0100530#endif /* defined(MBEDTLS_PK_PARSE_C) */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100531 {
532 return( PSA_ERROR_NOT_SUPPORTED );
533 }
534
535 slot->type = type;
536 return( PSA_SUCCESS );
537}
538
Gilles Peskine2d277862018-06-18 15:41:12 +0200539psa_status_t psa_destroy_key( psa_key_slot_t key )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100540{
541 key_slot_t *slot;
542
Gilles Peskine828ed142018-06-18 23:25:51 +0200543 if( key == 0 || key > PSA_KEY_SLOT_COUNT )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100544 return( PSA_ERROR_INVALID_ARGUMENT );
545 slot = &global_data.key_slots[key];
546 if( slot->type == PSA_KEY_TYPE_NONE )
Gilles Peskine154bd952018-04-19 08:38:16 +0200547 {
548 /* No key material to clean, but do zeroize the slot below to wipe
549 * metadata such as policies. */
550 }
Gilles Peskine48c0ea12018-06-21 14:15:31 +0200551 else if( key_type_is_raw_bytes( slot->type ) )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100552 {
553 mbedtls_free( slot->data.raw.data );
554 }
555 else
Gilles Peskine969ac722018-01-28 18:16:59 +0100556#if defined(MBEDTLS_RSA_C)
Gilles Peskinec66ea6a2018-02-03 22:43:28 +0100557 if( slot->type == PSA_KEY_TYPE_RSA_PUBLIC_KEY ||
558 slot->type == PSA_KEY_TYPE_RSA_KEYPAIR )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100559 {
Gilles Peskine969ac722018-01-28 18:16:59 +0100560 mbedtls_rsa_free( slot->data.rsa );
Gilles Peskine3c6e9702018-03-07 16:42:44 +0100561 mbedtls_free( slot->data.rsa );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100562 }
563 else
Gilles Peskine969ac722018-01-28 18:16:59 +0100564#endif /* defined(MBEDTLS_RSA_C) */
565#if defined(MBEDTLS_ECP_C)
566 if( PSA_KEY_TYPE_IS_ECC( slot->type ) )
567 {
568 mbedtls_ecp_keypair_free( slot->data.ecp );
Gilles Peskine3c6e9702018-03-07 16:42:44 +0100569 mbedtls_free( slot->data.ecp );
Gilles Peskine969ac722018-01-28 18:16:59 +0100570 }
571 else
572#endif /* defined(MBEDTLS_ECP_C) */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100573 {
574 /* Shouldn't happen: the key type is not any type that we
Gilles Peskine6d912132018-03-07 16:41:37 +0100575 * put in. */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100576 return( PSA_ERROR_TAMPERING_DETECTED );
577 }
578
579 mbedtls_zeroize( slot, sizeof( *slot ) );
580 return( PSA_SUCCESS );
581}
582
Gilles Peskine2d277862018-06-18 15:41:12 +0200583psa_status_t psa_get_key_information( psa_key_slot_t key,
584 psa_key_type_t *type,
585 size_t *bits )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100586{
587 key_slot_t *slot;
588
Gilles Peskine828ed142018-06-18 23:25:51 +0200589 if( key == 0 || key > PSA_KEY_SLOT_COUNT )
Gilles Peskinec66ea6a2018-02-03 22:43:28 +0100590 return( PSA_ERROR_EMPTY_SLOT );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100591 slot = &global_data.key_slots[key];
592 if( type != NULL )
593 *type = slot->type;
594 if( bits != NULL )
595 *bits = 0;
596 if( slot->type == PSA_KEY_TYPE_NONE )
597 return( PSA_ERROR_EMPTY_SLOT );
598
Gilles Peskine48c0ea12018-06-21 14:15:31 +0200599 if( key_type_is_raw_bytes( slot->type ) )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100600 {
601 if( bits != NULL )
602 *bits = slot->data.raw.bytes * 8;
603 }
604 else
Gilles Peskine969ac722018-01-28 18:16:59 +0100605#if defined(MBEDTLS_RSA_C)
Gilles Peskinec66ea6a2018-02-03 22:43:28 +0100606 if( slot->type == PSA_KEY_TYPE_RSA_PUBLIC_KEY ||
607 slot->type == PSA_KEY_TYPE_RSA_KEYPAIR )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100608 {
609 if( bits != NULL )
Gilles Peskine969ac722018-01-28 18:16:59 +0100610 *bits = mbedtls_rsa_get_bitlen( slot->data.rsa );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100611 }
612 else
Gilles Peskine969ac722018-01-28 18:16:59 +0100613#endif /* defined(MBEDTLS_RSA_C) */
614#if defined(MBEDTLS_ECP_C)
615 if( PSA_KEY_TYPE_IS_ECC( slot->type ) )
616 {
617 if( bits != NULL )
618 *bits = slot->data.ecp->grp.pbits;
619 }
620 else
621#endif /* defined(MBEDTLS_ECP_C) */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100622 {
623 /* Shouldn't happen: the key type is not any type that we
Gilles Peskine6d912132018-03-07 16:41:37 +0100624 * put in. */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100625 return( PSA_ERROR_TAMPERING_DETECTED );
626 }
627
628 return( PSA_SUCCESS );
629}
630
Gilles Peskine2d277862018-06-18 15:41:12 +0200631static psa_status_t psa_internal_export_key( psa_key_slot_t key,
632 uint8_t *data,
633 size_t data_size,
634 size_t *data_length,
635 int export_public_key )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100636{
637 key_slot_t *slot;
638
Gilles Peskine828ed142018-06-18 23:25:51 +0200639 if( key == 0 || key > PSA_KEY_SLOT_COUNT )
Gilles Peskinec66ea6a2018-02-03 22:43:28 +0100640 return( PSA_ERROR_EMPTY_SLOT );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100641 slot = &global_data.key_slots[key];
642 if( slot->type == PSA_KEY_TYPE_NONE )
643 return( PSA_ERROR_EMPTY_SLOT );
644
Gilles Peskinec1bb6c82018-06-18 16:04:39 +0200645 if( export_public_key && ! PSA_KEY_TYPE_IS_ASYMMETRIC( slot->type ) )
Moran Pekera998bc62018-04-16 18:16:20 +0300646 return( PSA_ERROR_INVALID_ARGUMENT );
mohammad160306e79202018-03-28 13:17:44 +0300647
Gilles Peskinec1bb6c82018-06-18 16:04:39 +0200648 if( ! export_public_key &&
649 ! PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->type ) &&
650 ( slot->policy.usage & PSA_KEY_USAGE_EXPORT ) == 0 )
Moran Peker87567632018-06-04 18:41:37 +0300651 return( PSA_ERROR_NOT_PERMITTED );
Gilles Peskine2d277862018-06-18 15:41:12 +0200652
Gilles Peskine48c0ea12018-06-21 14:15:31 +0200653 if( key_type_is_raw_bytes( slot->type ) )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100654 {
655 if( slot->data.raw.bytes > data_size )
656 return( PSA_ERROR_BUFFER_TOO_SMALL );
657 memcpy( data, slot->data.raw.data, slot->data.raw.bytes );
658 *data_length = slot->data.raw.bytes;
659 return( PSA_SUCCESS );
660 }
661 else
Moran Peker17e36e12018-05-02 12:55:20 +0300662 {
Gilles Peskine969ac722018-01-28 18:16:59 +0100663#if defined(MBEDTLS_PK_WRITE_C)
Gilles Peskinec66ea6a2018-02-03 22:43:28 +0100664 if( slot->type == PSA_KEY_TYPE_RSA_PUBLIC_KEY ||
Moran Pekera998bc62018-04-16 18:16:20 +0300665 slot->type == PSA_KEY_TYPE_RSA_KEYPAIR ||
666 PSA_KEY_TYPE_IS_ECC( slot->type ) )
Gilles Peskine969ac722018-01-28 18:16:59 +0100667 {
Moran Pekera998bc62018-04-16 18:16:20 +0300668 mbedtls_pk_context pk;
669 int ret;
670 mbedtls_pk_init( &pk );
671 if( slot->type == PSA_KEY_TYPE_RSA_PUBLIC_KEY ||
672 slot->type == PSA_KEY_TYPE_RSA_KEYPAIR )
673 {
674 pk.pk_info = &mbedtls_rsa_info;
675 pk.pk_ctx = slot->data.rsa;
676 }
677 else
678 {
679 pk.pk_info = &mbedtls_eckey_info;
680 pk.pk_ctx = slot->data.ecp;
681 }
Moran Pekerd7326592018-05-29 16:56:39 +0300682 if( export_public_key || PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->type ) )
Moran Pekera998bc62018-04-16 18:16:20 +0300683 ret = mbedtls_pk_write_pubkey_der( &pk, data, data_size );
Moran Peker17e36e12018-05-02 12:55:20 +0300684 else
685 ret = mbedtls_pk_write_key_der( &pk, data, data_size );
Moran Peker60364322018-04-29 11:34:58 +0300686 if( ret < 0 )
Gilles Peskinee66ca3b2018-06-20 00:11:45 +0200687 {
688 memset( data, 0, data_size );
Moran Pekera998bc62018-04-16 18:16:20 +0300689 return( mbedtls_to_psa_error( ret ) );
Gilles Peskinee66ca3b2018-06-20 00:11:45 +0200690 }
Gilles Peskine0e231582018-06-20 00:11:07 +0200691 /* The mbedtls_pk_xxx functions write to the end of the buffer.
692 * Move the data to the beginning and erase remaining data
693 * at the original location. */
694 if( 2 * (size_t) ret <= data_size )
695 {
696 memcpy( data, data + data_size - ret, ret );
Gilles Peskinee66ca3b2018-06-20 00:11:45 +0200697 memset( data + data_size - ret, 0, ret );
Gilles Peskine0e231582018-06-20 00:11:07 +0200698 }
699 else if( (size_t) ret < data_size )
700 {
701 memmove( data, data + data_size - ret, ret );
Gilles Peskinee66ca3b2018-06-20 00:11:45 +0200702 memset( data + ret, 0, data_size - ret );
Gilles Peskine0e231582018-06-20 00:11:07 +0200703 }
Moran Pekera998bc62018-04-16 18:16:20 +0300704 *data_length = ret;
705 return( PSA_SUCCESS );
Gilles Peskine969ac722018-01-28 18:16:59 +0100706 }
707 else
Gilles Peskine6d912132018-03-07 16:41:37 +0100708#endif /* defined(MBEDTLS_PK_WRITE_C) */
Moran Pekera998bc62018-04-16 18:16:20 +0300709 {
710 /* This shouldn't happen in the reference implementation, but
Gilles Peskine785fd552018-06-04 15:08:56 +0200711 it is valid for a special-purpose implementation to omit
712 support for exporting certain key types. */
Moran Pekera998bc62018-04-16 18:16:20 +0300713 return( PSA_ERROR_NOT_SUPPORTED );
714 }
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100715 }
716}
717
Gilles Peskine2d277862018-06-18 15:41:12 +0200718psa_status_t psa_export_key( psa_key_slot_t key,
719 uint8_t *data,
720 size_t data_size,
721 size_t *data_length )
Moran Pekera998bc62018-04-16 18:16:20 +0300722{
Gilles Peskinec1bb6c82018-06-18 16:04:39 +0200723 return( psa_internal_export_key( key, data, data_size,
724 data_length, 0 ) );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100725}
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100726
Gilles Peskine2d277862018-06-18 15:41:12 +0200727psa_status_t psa_export_public_key( psa_key_slot_t key,
728 uint8_t *data,
729 size_t data_size,
730 size_t *data_length )
Moran Pekerdd4ea382018-04-03 15:30:03 +0300731{
Gilles Peskinec1bb6c82018-06-18 16:04:39 +0200732 return( psa_internal_export_key( key, data, data_size,
733 data_length, 1 ) );
Moran Pekerdd4ea382018-04-03 15:30:03 +0300734}
735
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +0200736
737
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100738/****************************************************************/
Gilles Peskine20035e32018-02-03 22:44:14 +0100739/* Message digests */
740/****************************************************************/
741
Gilles Peskinedc2fc842018-03-07 16:42:59 +0100742static const mbedtls_md_info_t *mbedtls_md_info_from_psa( psa_algorithm_t alg )
Gilles Peskine20035e32018-02-03 22:44:14 +0100743{
744 switch( alg )
745 {
746#if defined(MBEDTLS_MD2_C)
747 case PSA_ALG_MD2:
748 return( &mbedtls_md2_info );
749#endif
750#if defined(MBEDTLS_MD4_C)
751 case PSA_ALG_MD4:
752 return( &mbedtls_md4_info );
753#endif
754#if defined(MBEDTLS_MD5_C)
755 case PSA_ALG_MD5:
756 return( &mbedtls_md5_info );
757#endif
758#if defined(MBEDTLS_RIPEMD160_C)
759 case PSA_ALG_RIPEMD160:
760 return( &mbedtls_ripemd160_info );
761#endif
762#if defined(MBEDTLS_SHA1_C)
763 case PSA_ALG_SHA_1:
764 return( &mbedtls_sha1_info );
765#endif
766#if defined(MBEDTLS_SHA256_C)
767 case PSA_ALG_SHA_224:
768 return( &mbedtls_sha224_info );
769 case PSA_ALG_SHA_256:
770 return( &mbedtls_sha256_info );
771#endif
772#if defined(MBEDTLS_SHA512_C)
773 case PSA_ALG_SHA_384:
774 return( &mbedtls_sha384_info );
775 case PSA_ALG_SHA_512:
776 return( &mbedtls_sha512_info );
777#endif
778 default:
779 return( NULL );
780 }
781}
782
Gilles Peskine9ef733f2018-02-07 21:05:37 +0100783psa_status_t psa_hash_abort( psa_hash_operation_t *operation )
784{
785 switch( operation->alg )
786 {
787#if defined(MBEDTLS_MD2_C)
788 case PSA_ALG_MD2:
789 mbedtls_md2_free( &operation->ctx.md2 );
790 break;
791#endif
792#if defined(MBEDTLS_MD4_C)
793 case PSA_ALG_MD4:
794 mbedtls_md4_free( &operation->ctx.md4 );
795 break;
796#endif
797#if defined(MBEDTLS_MD5_C)
798 case PSA_ALG_MD5:
799 mbedtls_md5_free( &operation->ctx.md5 );
800 break;
801#endif
802#if defined(MBEDTLS_RIPEMD160_C)
803 case PSA_ALG_RIPEMD160:
804 mbedtls_ripemd160_free( &operation->ctx.ripemd160 );
805 break;
806#endif
807#if defined(MBEDTLS_SHA1_C)
808 case PSA_ALG_SHA_1:
809 mbedtls_sha1_free( &operation->ctx.sha1 );
810 break;
811#endif
812#if defined(MBEDTLS_SHA256_C)
813 case PSA_ALG_SHA_224:
814 case PSA_ALG_SHA_256:
815 mbedtls_sha256_free( &operation->ctx.sha256 );
816 break;
817#endif
818#if defined(MBEDTLS_SHA512_C)
819 case PSA_ALG_SHA_384:
820 case PSA_ALG_SHA_512:
821 mbedtls_sha512_free( &operation->ctx.sha512 );
822 break;
823#endif
824 default:
Gilles Peskinef9c2c092018-06-21 16:57:07 +0200825 return( PSA_ERROR_BAD_STATE );
Gilles Peskine9ef733f2018-02-07 21:05:37 +0100826 }
827 operation->alg = 0;
828 return( PSA_SUCCESS );
829}
830
831psa_status_t psa_hash_start( psa_hash_operation_t *operation,
832 psa_algorithm_t alg )
833{
834 int ret;
835 operation->alg = 0;
836 switch( alg )
837 {
838#if defined(MBEDTLS_MD2_C)
839 case PSA_ALG_MD2:
840 mbedtls_md2_init( &operation->ctx.md2 );
841 ret = mbedtls_md2_starts_ret( &operation->ctx.md2 );
842 break;
843#endif
844#if defined(MBEDTLS_MD4_C)
845 case PSA_ALG_MD4:
846 mbedtls_md4_init( &operation->ctx.md4 );
847 ret = mbedtls_md4_starts_ret( &operation->ctx.md4 );
848 break;
849#endif
850#if defined(MBEDTLS_MD5_C)
851 case PSA_ALG_MD5:
852 mbedtls_md5_init( &operation->ctx.md5 );
853 ret = mbedtls_md5_starts_ret( &operation->ctx.md5 );
854 break;
855#endif
856#if defined(MBEDTLS_RIPEMD160_C)
857 case PSA_ALG_RIPEMD160:
858 mbedtls_ripemd160_init( &operation->ctx.ripemd160 );
859 ret = mbedtls_ripemd160_starts_ret( &operation->ctx.ripemd160 );
860 break;
861#endif
862#if defined(MBEDTLS_SHA1_C)
863 case PSA_ALG_SHA_1:
864 mbedtls_sha1_init( &operation->ctx.sha1 );
865 ret = mbedtls_sha1_starts_ret( &operation->ctx.sha1 );
866 break;
867#endif
868#if defined(MBEDTLS_SHA256_C)
869 case PSA_ALG_SHA_224:
870 mbedtls_sha256_init( &operation->ctx.sha256 );
871 ret = mbedtls_sha256_starts_ret( &operation->ctx.sha256, 1 );
872 break;
873 case PSA_ALG_SHA_256:
874 mbedtls_sha256_init( &operation->ctx.sha256 );
875 ret = mbedtls_sha256_starts_ret( &operation->ctx.sha256, 0 );
876 break;
877#endif
878#if defined(MBEDTLS_SHA512_C)
879 case PSA_ALG_SHA_384:
880 mbedtls_sha512_init( &operation->ctx.sha512 );
881 ret = mbedtls_sha512_starts_ret( &operation->ctx.sha512, 1 );
882 break;
883 case PSA_ALG_SHA_512:
884 mbedtls_sha512_init( &operation->ctx.sha512 );
885 ret = mbedtls_sha512_starts_ret( &operation->ctx.sha512, 0 );
886 break;
887#endif
888 default:
Gilles Peskinec06e0712018-06-20 16:21:04 +0200889 return( PSA_ALG_IS_HASH( alg ) ?
890 PSA_ERROR_NOT_SUPPORTED :
891 PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine9ef733f2018-02-07 21:05:37 +0100892 }
893 if( ret == 0 )
894 operation->alg = alg;
895 else
896 psa_hash_abort( operation );
897 return( mbedtls_to_psa_error( ret ) );
898}
899
900psa_status_t psa_hash_update( psa_hash_operation_t *operation,
901 const uint8_t *input,
902 size_t input_length )
903{
904 int ret;
905 switch( operation->alg )
906 {
907#if defined(MBEDTLS_MD2_C)
908 case PSA_ALG_MD2:
909 ret = mbedtls_md2_update_ret( &operation->ctx.md2,
910 input, input_length );
911 break;
912#endif
913#if defined(MBEDTLS_MD4_C)
914 case PSA_ALG_MD4:
915 ret = mbedtls_md4_update_ret( &operation->ctx.md4,
916 input, input_length );
917 break;
918#endif
919#if defined(MBEDTLS_MD5_C)
920 case PSA_ALG_MD5:
921 ret = mbedtls_md5_update_ret( &operation->ctx.md5,
922 input, input_length );
923 break;
924#endif
925#if defined(MBEDTLS_RIPEMD160_C)
926 case PSA_ALG_RIPEMD160:
927 ret = mbedtls_ripemd160_update_ret( &operation->ctx.ripemd160,
928 input, input_length );
929 break;
930#endif
931#if defined(MBEDTLS_SHA1_C)
932 case PSA_ALG_SHA_1:
933 ret = mbedtls_sha1_update_ret( &operation->ctx.sha1,
934 input, input_length );
935 break;
936#endif
937#if defined(MBEDTLS_SHA256_C)
938 case PSA_ALG_SHA_224:
939 case PSA_ALG_SHA_256:
940 ret = mbedtls_sha256_update_ret( &operation->ctx.sha256,
941 input, input_length );
942 break;
943#endif
944#if defined(MBEDTLS_SHA512_C)
945 case PSA_ALG_SHA_384:
946 case PSA_ALG_SHA_512:
947 ret = mbedtls_sha512_update_ret( &operation->ctx.sha512,
948 input, input_length );
949 break;
950#endif
951 default:
952 ret = MBEDTLS_ERR_MD_BAD_INPUT_DATA;
953 break;
954 }
955 if( ret != 0 )
956 psa_hash_abort( operation );
957 return( mbedtls_to_psa_error( ret ) );
958}
959
960psa_status_t psa_hash_finish( psa_hash_operation_t *operation,
961 uint8_t *hash,
962 size_t hash_size,
963 size_t *hash_length )
964{
965 int ret;
Gilles Peskine71bb7b72018-04-19 08:29:59 +0200966 size_t actual_hash_length = PSA_HASH_SIZE( operation->alg );
Gilles Peskine9ef733f2018-02-07 21:05:37 +0100967
968 /* Fill the output buffer with something that isn't a valid hash
969 * (barring an attack on the hash and deliberately-crafted input),
970 * in case the caller doesn't check the return status properly. */
971 *hash_length = actual_hash_length;
972 memset( hash, '!', hash_size );
973
974 if( hash_size < actual_hash_length )
975 return( PSA_ERROR_BUFFER_TOO_SMALL );
976
977 switch( operation->alg )
978 {
979#if defined(MBEDTLS_MD2_C)
980 case PSA_ALG_MD2:
981 ret = mbedtls_md2_finish_ret( &operation->ctx.md2, hash );
982 break;
983#endif
984#if defined(MBEDTLS_MD4_C)
985 case PSA_ALG_MD4:
986 ret = mbedtls_md4_finish_ret( &operation->ctx.md4, hash );
987 break;
988#endif
989#if defined(MBEDTLS_MD5_C)
990 case PSA_ALG_MD5:
991 ret = mbedtls_md5_finish_ret( &operation->ctx.md5, hash );
992 break;
993#endif
994#if defined(MBEDTLS_RIPEMD160_C)
995 case PSA_ALG_RIPEMD160:
996 ret = mbedtls_ripemd160_finish_ret( &operation->ctx.ripemd160, hash );
997 break;
998#endif
999#if defined(MBEDTLS_SHA1_C)
1000 case PSA_ALG_SHA_1:
1001 ret = mbedtls_sha1_finish_ret( &operation->ctx.sha1, hash );
1002 break;
1003#endif
1004#if defined(MBEDTLS_SHA256_C)
1005 case PSA_ALG_SHA_224:
1006 case PSA_ALG_SHA_256:
1007 ret = mbedtls_sha256_finish_ret( &operation->ctx.sha256, hash );
1008 break;
1009#endif
1010#if defined(MBEDTLS_SHA512_C)
1011 case PSA_ALG_SHA_384:
1012 case PSA_ALG_SHA_512:
1013 ret = mbedtls_sha512_finish_ret( &operation->ctx.sha512, hash );
1014 break;
1015#endif
1016 default:
1017 ret = MBEDTLS_ERR_MD_BAD_INPUT_DATA;
1018 break;
1019 }
1020
1021 if( ret == 0 )
1022 {
1023 return( psa_hash_abort( operation ) );
1024 }
1025 else
1026 {
1027 psa_hash_abort( operation );
1028 return( mbedtls_to_psa_error( ret ) );
1029 }
1030}
1031
Gilles Peskine2d277862018-06-18 15:41:12 +02001032psa_status_t psa_hash_verify( psa_hash_operation_t *operation,
1033 const uint8_t *hash,
1034 size_t hash_length )
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001035{
1036 uint8_t actual_hash[MBEDTLS_MD_MAX_SIZE];
1037 size_t actual_hash_length;
1038 psa_status_t status = psa_hash_finish( operation,
1039 actual_hash, sizeof( actual_hash ),
1040 &actual_hash_length );
1041 if( status != PSA_SUCCESS )
1042 return( status );
1043 if( actual_hash_length != hash_length )
1044 return( PSA_ERROR_INVALID_SIGNATURE );
1045 if( safer_memcmp( hash, actual_hash, actual_hash_length ) != 0 )
1046 return( PSA_ERROR_INVALID_SIGNATURE );
1047 return( PSA_SUCCESS );
1048}
1049
1050
1051
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001052/****************************************************************/
Gilles Peskine8c9def32018-02-08 10:02:12 +01001053/* MAC */
1054/****************************************************************/
1055
Gilles Peskinedc2fc842018-03-07 16:42:59 +01001056static const mbedtls_cipher_info_t *mbedtls_cipher_info_from_psa(
Gilles Peskine8c9def32018-02-08 10:02:12 +01001057 psa_algorithm_t alg,
1058 psa_key_type_t key_type,
Gilles Peskine2d277862018-06-18 15:41:12 +02001059 size_t key_bits,
mohammad1603f4f0d612018-06-03 15:04:51 +03001060 mbedtls_cipher_id_t* cipher_id )
Gilles Peskine8c9def32018-02-08 10:02:12 +01001061{
Gilles Peskine8c9def32018-02-08 10:02:12 +01001062 mbedtls_cipher_mode_t mode;
mohammad1603f4f0d612018-06-03 15:04:51 +03001063 mbedtls_cipher_id_t cipher_id_tmp;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001064
1065 if( PSA_ALG_IS_CIPHER( alg ) || PSA_ALG_IS_AEAD( alg ) )
1066 {
1067 if( PSA_ALG_IS_BLOCK_CIPHER( alg ) )
mohammad16038481e742018-03-18 13:57:31 +02001068 {
1069 alg &= ~PSA_ALG_BLOCK_CIPHER_PADDING_MASK;
1070 }
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001071
Nir Sonnenscheine9664c32018-06-17 14:41:30 +03001072 switch( alg )
Gilles Peskine8c9def32018-02-08 10:02:12 +01001073 {
1074 case PSA_ALG_STREAM_CIPHER:
1075 mode = MBEDTLS_MODE_STREAM;
1076 break;
1077 case PSA_ALG_CBC_BASE:
1078 mode = MBEDTLS_MODE_CBC;
1079 break;
1080 case PSA_ALG_CFB_BASE:
1081 mode = MBEDTLS_MODE_CFB;
1082 break;
1083 case PSA_ALG_OFB_BASE:
1084 mode = MBEDTLS_MODE_OFB;
1085 break;
1086 case PSA_ALG_CTR:
1087 mode = MBEDTLS_MODE_CTR;
1088 break;
1089 case PSA_ALG_CCM:
1090 mode = MBEDTLS_MODE_CCM;
1091 break;
1092 case PSA_ALG_GCM:
1093 mode = MBEDTLS_MODE_GCM;
1094 break;
1095 default:
1096 return( NULL );
1097 }
1098 }
1099 else if( alg == PSA_ALG_CMAC )
1100 mode = MBEDTLS_MODE_ECB;
1101 else if( alg == PSA_ALG_GMAC )
1102 mode = MBEDTLS_MODE_GCM;
1103 else
1104 return( NULL );
1105
1106 switch( key_type )
1107 {
1108 case PSA_KEY_TYPE_AES:
mohammad1603f4f0d612018-06-03 15:04:51 +03001109 cipher_id_tmp = MBEDTLS_CIPHER_ID_AES;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001110 break;
1111 case PSA_KEY_TYPE_DES:
Gilles Peskine9ad29e22018-06-21 09:40:04 +02001112 /* key_bits is 64 for Single-DES, 128 for two-key Triple-DES,
1113 * and 192 for three-key Triple-DES. */
Gilles Peskine8c9def32018-02-08 10:02:12 +01001114 if( key_bits == 64 )
mohammad1603f4f0d612018-06-03 15:04:51 +03001115 cipher_id_tmp = MBEDTLS_CIPHER_ID_DES;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001116 else
mohammad1603f4f0d612018-06-03 15:04:51 +03001117 cipher_id_tmp = MBEDTLS_CIPHER_ID_3DES;
Gilles Peskine9ad29e22018-06-21 09:40:04 +02001118 /* mbedtls doesn't recognize two-key Triple-DES as an algorithm,
1119 * but two-key Triple-DES is functionally three-key Triple-DES
1120 * with K1=K3, so that's how we present it to mbedtls. */
1121 if( key_bits == 128 )
1122 key_bits = 192;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001123 break;
1124 case PSA_KEY_TYPE_CAMELLIA:
mohammad1603f4f0d612018-06-03 15:04:51 +03001125 cipher_id_tmp = MBEDTLS_CIPHER_ID_CAMELLIA;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001126 break;
1127 case PSA_KEY_TYPE_ARC4:
mohammad1603f4f0d612018-06-03 15:04:51 +03001128 cipher_id_tmp = MBEDTLS_CIPHER_ID_ARC4;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001129 break;
1130 default:
1131 return( NULL );
1132 }
mohammad1603f4f0d612018-06-03 15:04:51 +03001133 if( cipher_id != NULL )
mohammad160360a64d02018-06-03 17:20:42 +03001134 *cipher_id = cipher_id_tmp;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001135
mohammad1603f4f0d612018-06-03 15:04:51 +03001136 return( mbedtls_cipher_info_from_values( cipher_id_tmp, key_bits, mode ) );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001137}
1138
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001139static size_t psa_get_hash_block_size( psa_algorithm_t alg )
Nir Sonnenschein96272412018-06-17 14:41:10 +03001140{
Gilles Peskine2d277862018-06-18 15:41:12 +02001141 switch( alg )
Nir Sonnenschein96272412018-06-17 14:41:10 +03001142 {
1143 case PSA_ALG_MD2:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001144 return( 16 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001145 case PSA_ALG_MD4:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001146 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001147 case PSA_ALG_MD5:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001148 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001149 case PSA_ALG_RIPEMD160:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001150 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001151 case PSA_ALG_SHA_1:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001152 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001153 case PSA_ALG_SHA_224:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001154 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001155 case PSA_ALG_SHA_256:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001156 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001157 case PSA_ALG_SHA_384:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001158 return( 128 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001159 case PSA_ALG_SHA_512:
Gilles Peskine2d277862018-06-18 15:41:12 +02001160 return( 128 );
1161 default:
1162 return( 0 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001163 }
1164}
Nir Sonnenschein0c9ec532018-06-07 13:27:47 +03001165
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02001166/* Initialize the MAC operation structure. Once this function has been
1167 * called, psa_mac_abort can run and will do the right thing. */
1168static psa_status_t psa_mac_init( psa_mac_operation_t *operation,
1169 psa_algorithm_t alg )
1170{
1171 psa_status_t status = PSA_ERROR_NOT_SUPPORTED;
1172
1173 operation->alg = alg;
1174 operation->key_set = 0;
1175 operation->iv_set = 0;
1176 operation->iv_required = 0;
1177 operation->has_input = 0;
1178 operation->key_usage_sign = 0;
1179 operation->key_usage_verify = 0;
1180
1181#if defined(MBEDTLS_CMAC_C)
1182 if( alg == PSA_ALG_CMAC )
1183 {
1184 operation->iv_required = 0;
1185 mbedtls_cipher_init( &operation->ctx.cmac );
1186 status = PSA_SUCCESS;
1187 }
1188 else
1189#endif /* MBEDTLS_CMAC_C */
1190#if defined(MBEDTLS_MD_C)
1191 if( PSA_ALG_IS_HMAC( operation->alg ) )
1192 {
1193 status = psa_hash_start( &operation->ctx.hmac.hash_ctx,
1194 PSA_ALG_HMAC_HASH( alg ) );
1195 }
1196 else
1197#endif /* MBEDTLS_MD_C */
1198 {
Gilles Peskinec06e0712018-06-20 16:21:04 +02001199 if( ! PSA_ALG_IS_MAC( alg ) )
1200 status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02001201 }
1202
1203 if( status != PSA_SUCCESS )
1204 memset( operation, 0, sizeof( *operation ) );
1205 return( status );
1206}
1207
Gilles Peskine8c9def32018-02-08 10:02:12 +01001208psa_status_t psa_mac_abort( psa_mac_operation_t *operation )
1209{
1210 switch( operation->alg )
1211 {
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02001212 case 0:
1213 return( PSA_SUCCESS );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001214#if defined(MBEDTLS_CMAC_C)
1215 case PSA_ALG_CMAC:
1216 mbedtls_cipher_free( &operation->ctx.cmac );
1217 break;
1218#endif /* MBEDTLS_CMAC_C */
1219 default:
1220#if defined(MBEDTLS_MD_C)
1221 if( PSA_ALG_IS_HMAC( operation->alg ) )
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001222 {
Gilles Peskine99bc6492018-06-11 17:13:00 +02001223 unsigned int block_size =
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001224 psa_get_hash_block_size( PSA_ALG_HMAC_HASH( operation->alg ) );
Nir Sonnenschein084832d2018-06-08 22:52:24 +03001225
Gilles Peskine99bc6492018-06-11 17:13:00 +02001226 if( block_size == 0 )
Nir Sonnenschein084832d2018-06-08 22:52:24 +03001227 return( PSA_ERROR_NOT_SUPPORTED );
1228
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001229 psa_hash_abort( &operation->ctx.hmac.hash_ctx );
Gilles Peskine2d277862018-06-18 15:41:12 +02001230 mbedtls_zeroize( operation->ctx.hmac.opad, block_size );
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001231 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01001232 else
1233#endif /* MBEDTLS_MD_C */
Gilles Peskinef9c2c092018-06-21 16:57:07 +02001234 {
1235 /* Sanity check (shouldn't happen: operation->alg should
1236 * always have been initialized to a valid value). */
1237 return( PSA_ERROR_BAD_STATE );
1238 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01001239 }
Moran Peker41deec42018-04-04 15:43:05 +03001240
Gilles Peskine8c9def32018-02-08 10:02:12 +01001241 operation->alg = 0;
1242 operation->key_set = 0;
1243 operation->iv_set = 0;
1244 operation->iv_required = 0;
1245 operation->has_input = 0;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02001246 operation->key_usage_sign = 0;
1247 operation->key_usage_verify = 0;
Moran Peker41deec42018-04-04 15:43:05 +03001248
Gilles Peskine8c9def32018-02-08 10:02:12 +01001249 return( PSA_SUCCESS );
1250}
1251
Gilles Peskinee3b07d82018-06-19 11:57:35 +02001252#if defined(MBEDTLS_CMAC_C)
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001253static int psa_cmac_start( psa_mac_operation_t *operation,
1254 size_t key_bits,
1255 key_slot_t *slot,
1256 const mbedtls_cipher_info_t *cipher_info )
1257{
1258 int ret;
1259
1260 operation->mac_size = cipher_info->block_size;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001261
1262 ret = mbedtls_cipher_setup( &operation->ctx.cmac, cipher_info );
1263 if( ret != 0 )
1264 return( ret );
1265
1266 ret = mbedtls_cipher_cmac_starts( &operation->ctx.cmac,
1267 slot->data.raw.data,
1268 key_bits );
1269 return( ret );
1270}
Gilles Peskinee3b07d82018-06-19 11:57:35 +02001271#endif /* MBEDTLS_CMAC_C */
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001272
Gilles Peskine248051a2018-06-20 16:09:38 +02001273#if defined(MBEDTLS_MD_C)
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001274static int psa_hmac_start( psa_mac_operation_t *operation,
1275 psa_key_type_t key_type,
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001276 key_slot_t *slot,
1277 psa_algorithm_t alg )
1278{
Gilles Peskineb3e6e5d2018-06-18 22:16:43 +02001279 unsigned char ipad[PSA_HMAC_MAX_HASH_BLOCK_SIZE];
Nir Sonnenschein5ca65472018-06-17 14:03:40 +03001280 unsigned char *opad = operation->ctx.hmac.opad;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001281 size_t i;
Gilles Peskinee1bc6802018-06-11 17:36:05 +02001282 size_t block_size =
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001283 psa_get_hash_block_size( PSA_ALG_HMAC_HASH( alg ) );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001284 unsigned int digest_size =
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001285 PSA_HASH_SIZE( PSA_ALG_HMAC_HASH( alg ) );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001286 size_t key_length = slot->data.raw.bytes;
1287 psa_status_t status;
1288
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001289 if( block_size == 0 || digest_size == 0 )
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001290 return( PSA_ERROR_NOT_SUPPORTED );
1291
1292 if( key_type != PSA_KEY_TYPE_HMAC )
1293 return( PSA_ERROR_INVALID_ARGUMENT );
1294
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001295 operation->mac_size = digest_size;
1296
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02001297 /* The hash was started earlier in psa_mac_init. */
Gilles Peskined223b522018-06-11 18:12:58 +02001298 if( key_length > block_size )
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001299 {
1300 status = psa_hash_update( &operation->ctx.hmac.hash_ctx,
Gilles Peskined223b522018-06-11 18:12:58 +02001301 slot->data.raw.data, slot->data.raw.bytes );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001302 if( status != PSA_SUCCESS )
1303 return( status );
1304 status = psa_hash_finish( &operation->ctx.hmac.hash_ctx,
Gilles Peskined223b522018-06-11 18:12:58 +02001305 ipad, sizeof( ipad ), &key_length );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001306 if( status != PSA_SUCCESS )
1307 return( status );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001308 }
Gilles Peskined223b522018-06-11 18:12:58 +02001309 else
1310 memcpy( ipad, slot->data.raw.data, slot->data.raw.bytes );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001311
Gilles Peskined223b522018-06-11 18:12:58 +02001312 /* ipad contains the key followed by garbage. Xor and fill with 0x36
1313 * to create the ipad value. */
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001314 for( i = 0; i < key_length; i++ )
Gilles Peskined223b522018-06-11 18:12:58 +02001315 ipad[i] ^= 0x36;
1316 memset( ipad + key_length, 0x36, block_size - key_length );
1317
1318 /* Copy the key material from ipad to opad, flipping the requisite bits,
1319 * and filling the rest of opad with the requisite constant. */
1320 for( i = 0; i < key_length; i++ )
1321 opad[i] = ipad[i] ^ 0x36 ^ 0x5C;
1322 memset( opad + key_length, 0x5C, block_size - key_length );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001323
1324 status = psa_hash_start( &operation->ctx.hmac.hash_ctx,
1325 PSA_ALG_HMAC_HASH( alg ) );
1326 if( status != PSA_SUCCESS )
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02001327 goto cleanup;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001328
1329 status = psa_hash_update( &operation->ctx.hmac.hash_ctx, ipad,
1330 block_size );
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02001331
1332cleanup:
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02001333 mbedtls_zeroize( ipad, key_length );
1334 /* opad is in the context. It needs to stay in memory if this function
1335 * succeeds, and it will be wiped by psa_mac_abort() called from
1336 * psa_mac_start in the error case. */
1337
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001338 return( status );
1339}
Gilles Peskine248051a2018-06-20 16:09:38 +02001340#endif /* MBEDTLS_MD_C */
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001341
Gilles Peskine8c9def32018-02-08 10:02:12 +01001342psa_status_t psa_mac_start( psa_mac_operation_t *operation,
1343 psa_key_slot_t key,
1344 psa_algorithm_t alg )
1345{
Gilles Peskine8c9def32018-02-08 10:02:12 +01001346 psa_status_t status;
1347 key_slot_t *slot;
1348 psa_key_type_t key_type;
1349 size_t key_bits;
Gilles Peskine828ed142018-06-18 23:25:51 +02001350 const mbedtls_cipher_info_t *cipher_info = NULL;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001351
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02001352 status = psa_mac_init( operation, alg );
1353 if( status != PSA_SUCCESS )
1354 return( status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001355
1356 status = psa_get_key_information( key, &key_type, &key_bits );
1357 if( status != PSA_SUCCESS )
1358 return( status );
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001359
Gilles Peskine8c9def32018-02-08 10:02:12 +01001360 slot = &global_data.key_slots[key];
Gilles Peskine99bc6492018-06-11 17:13:00 +02001361 if( slot->type == PSA_KEY_TYPE_NONE )
1362 return( PSA_ERROR_EMPTY_SLOT );
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001363
Moran Pekerd7326592018-05-29 16:56:39 +03001364 if( ( slot->policy.usage & PSA_KEY_USAGE_SIGN ) != 0 )
mohammad16036df908f2018-04-02 08:34:15 -07001365 operation->key_usage_sign = 1;
1366
Moran Pekerd7326592018-05-29 16:56:39 +03001367 if( ( slot->policy.usage & PSA_KEY_USAGE_VERIFY ) != 0 )
mohammad16036df908f2018-04-02 08:34:15 -07001368 operation->key_usage_verify = 1;
1369
Gilles Peskine8c9def32018-02-08 10:02:12 +01001370 if( ! PSA_ALG_IS_HMAC( alg ) )
1371 {
mohammad1603f4f0d612018-06-03 15:04:51 +03001372 cipher_info = mbedtls_cipher_info_from_psa( alg, key_type, key_bits, NULL );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001373 if( cipher_info == NULL )
1374 return( PSA_ERROR_NOT_SUPPORTED );
1375 operation->mac_size = cipher_info->block_size;
1376 }
1377 switch( alg )
1378 {
1379#if defined(MBEDTLS_CMAC_C)
1380 case PSA_ALG_CMAC:
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001381 status = mbedtls_to_psa_error( psa_cmac_start( operation,
1382 key_bits,
1383 slot,
1384 cipher_info ) );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001385 break;
1386#endif /* MBEDTLS_CMAC_C */
1387 default:
1388#if defined(MBEDTLS_MD_C)
1389 if( PSA_ALG_IS_HMAC( alg ) )
Gilles Peskined223b522018-06-11 18:12:58 +02001390 status = psa_hmac_start( operation, key_type, slot, alg );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001391 else
1392#endif /* MBEDTLS_MD_C */
1393 return( PSA_ERROR_NOT_SUPPORTED );
1394 }
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001395
Gilles Peskine8c9def32018-02-08 10:02:12 +01001396 /* If we reach this point, then the algorithm-specific part of the
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001397 * context may contain data that needs to be wiped on error. */
1398 if( status != PSA_SUCCESS )
Gilles Peskine8c9def32018-02-08 10:02:12 +01001399 {
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02001400 psa_mac_abort( operation );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001401 }
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001402 else
1403 {
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001404 operation->key_set = 1;
1405 }
1406 return( status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001407}
1408
1409psa_status_t psa_mac_update( psa_mac_operation_t *operation,
1410 const uint8_t *input,
1411 size_t input_length )
1412{
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001413 int ret = 0 ;
1414 psa_status_t status = PSA_SUCCESS;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001415 if( ! operation->key_set )
1416 return( PSA_ERROR_BAD_STATE );
1417 if( operation->iv_required && ! operation->iv_set )
1418 return( PSA_ERROR_BAD_STATE );
1419 operation->has_input = 1;
1420
1421 switch( operation->alg )
1422 {
1423#if defined(MBEDTLS_CMAC_C)
1424 case PSA_ALG_CMAC:
1425 ret = mbedtls_cipher_cmac_update( &operation->ctx.cmac,
1426 input, input_length );
1427 break;
1428#endif /* MBEDTLS_CMAC_C */
1429 default:
1430#if defined(MBEDTLS_MD_C)
1431 if( PSA_ALG_IS_HMAC( operation->alg ) )
1432 {
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001433 status = psa_hash_update( &operation->ctx.hmac.hash_ctx, input,
Gilles Peskine2d277862018-06-18 15:41:12 +02001434 input_length );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001435 }
1436 else
1437#endif /* MBEDTLS_MD_C */
1438 {
1439 ret = MBEDTLS_ERR_MD_BAD_INPUT_DATA;
1440 }
1441 break;
1442 }
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001443 if( ret != 0 || status != PSA_SUCCESS )
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001444 {
Nir Sonnenscheine9664c32018-06-17 14:41:30 +03001445 psa_mac_abort( operation );
Gilles Peskine2d277862018-06-18 15:41:12 +02001446 if( ret != 0 )
Nir Sonnenscheine9664c32018-06-17 14:41:30 +03001447 status = mbedtls_to_psa_error( ret );
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001448 }
1449
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001450 return( status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001451}
1452
mohammad16036df908f2018-04-02 08:34:15 -07001453static psa_status_t psa_mac_finish_internal( psa_mac_operation_t *operation,
Gilles Peskine2d277862018-06-18 15:41:12 +02001454 uint8_t *mac,
1455 size_t mac_size,
1456 size_t *mac_length )
Gilles Peskine8c9def32018-02-08 10:02:12 +01001457{
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001458 int ret = 0;
1459 psa_status_t status = PSA_SUCCESS;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001460 if( ! operation->key_set )
1461 return( PSA_ERROR_BAD_STATE );
1462 if( operation->iv_required && ! operation->iv_set )
1463 return( PSA_ERROR_BAD_STATE );
1464
1465 /* Fill the output buffer with something that isn't a valid mac
1466 * (barring an attack on the mac and deliberately-crafted input),
1467 * in case the caller doesn't check the return status properly. */
1468 *mac_length = operation->mac_size;
1469 memset( mac, '!', mac_size );
1470
1471 if( mac_size < operation->mac_size )
1472 return( PSA_ERROR_BUFFER_TOO_SMALL );
1473
1474 switch( operation->alg )
1475 {
1476#if defined(MBEDTLS_CMAC_C)
1477 case PSA_ALG_CMAC:
1478 ret = mbedtls_cipher_cmac_finish( &operation->ctx.cmac, mac );
1479 break;
1480#endif /* MBEDTLS_CMAC_C */
1481 default:
1482#if defined(MBEDTLS_MD_C)
1483 if( PSA_ALG_IS_HMAC( operation->alg ) )
1484 {
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001485 unsigned char tmp[MBEDTLS_MD_MAX_SIZE];
Nir Sonnenschein5ca65472018-06-17 14:03:40 +03001486 unsigned char *opad = operation->ctx.hmac.opad;
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001487 size_t hash_size = 0;
Nir Sonnenschein96272412018-06-17 14:41:10 +03001488 size_t block_size =
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001489 psa_get_hash_block_size( PSA_ALG_HMAC_HASH( operation->alg ) );
Nir Sonnenschein084832d2018-06-08 22:52:24 +03001490
Gilles Peskine99bc6492018-06-11 17:13:00 +02001491 if( block_size == 0 )
1492 return( PSA_ERROR_NOT_SUPPORTED );
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001493
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001494 status = psa_hash_finish( &operation->ctx.hmac.hash_ctx, tmp,
Gilles Peskine99bc6492018-06-11 17:13:00 +02001495 sizeof( tmp ), &hash_size );
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001496 if( status != PSA_SUCCESS )
1497 goto cleanup;
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02001498 /* From here on, tmp needs to be wiped. */
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001499
1500 status = psa_hash_start( &operation->ctx.hmac.hash_ctx,
1501 PSA_ALG_HMAC_HASH( operation->alg ) );
1502 if( status != PSA_SUCCESS )
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02001503 goto hmac_cleanup;
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001504
1505 status = psa_hash_update( &operation->ctx.hmac.hash_ctx, opad,
Nir Sonnenschein0c9ec532018-06-07 13:27:47 +03001506 block_size );
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001507 if( status != PSA_SUCCESS )
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02001508 goto hmac_cleanup;
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001509
1510 status = psa_hash_update( &operation->ctx.hmac.hash_ctx, tmp,
Gilles Peskine2d277862018-06-18 15:41:12 +02001511 hash_size );
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001512 if( status != PSA_SUCCESS )
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02001513 goto hmac_cleanup;
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001514
1515 status = psa_hash_finish( &operation->ctx.hmac.hash_ctx, mac,
1516 mac_size, mac_length );
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02001517 hmac_cleanup:
1518 mbedtls_zeroize( tmp, hash_size );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001519 }
1520 else
1521#endif /* MBEDTLS_MD_C */
1522 {
1523 ret = MBEDTLS_ERR_MD_BAD_INPUT_DATA;
1524 }
1525 break;
1526 }
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001527cleanup:
Gilles Peskine8c9def32018-02-08 10:02:12 +01001528
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001529 if( ret == 0 && status == PSA_SUCCESS )
Gilles Peskine8c9def32018-02-08 10:02:12 +01001530 {
1531 return( psa_mac_abort( operation ) );
1532 }
1533 else
1534 {
1535 psa_mac_abort( operation );
Gilles Peskine99bc6492018-06-11 17:13:00 +02001536 if( ret != 0 )
Gilles Peskine2d277862018-06-18 15:41:12 +02001537 status = mbedtls_to_psa_error( ret );
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001538
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001539 return( status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001540 }
1541}
1542
mohammad16036df908f2018-04-02 08:34:15 -07001543psa_status_t psa_mac_finish( psa_mac_operation_t *operation,
1544 uint8_t *mac,
1545 size_t mac_size,
1546 size_t *mac_length )
1547{
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001548 if( ! operation->key_usage_sign )
mohammad16036df908f2018-04-02 08:34:15 -07001549 return( PSA_ERROR_NOT_PERMITTED );
1550
Gilles Peskine99bc6492018-06-11 17:13:00 +02001551 return( psa_mac_finish_internal( operation, mac,
1552 mac_size, mac_length ) );
mohammad16036df908f2018-04-02 08:34:15 -07001553}
1554
Gilles Peskine828ed142018-06-18 23:25:51 +02001555#define PSA_MAC_MAX_SIZE \
Gilles Peskine2d277862018-06-18 15:41:12 +02001556 ( MBEDTLS_MD_MAX_SIZE > MBEDTLS_MAX_BLOCK_LENGTH ? \
1557 MBEDTLS_MD_MAX_SIZE : \
Gilles Peskine8c9def32018-02-08 10:02:12 +01001558 MBEDTLS_MAX_BLOCK_LENGTH )
1559psa_status_t psa_mac_verify( psa_mac_operation_t *operation,
1560 const uint8_t *mac,
1561 size_t mac_length )
1562{
Gilles Peskine828ed142018-06-18 23:25:51 +02001563 uint8_t actual_mac[PSA_MAC_MAX_SIZE];
Gilles Peskine8c9def32018-02-08 10:02:12 +01001564 size_t actual_mac_length;
mohammad16036df908f2018-04-02 08:34:15 -07001565 psa_status_t status;
1566
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001567 if( ! operation->key_usage_verify )
mohammad16036df908f2018-04-02 08:34:15 -07001568 return( PSA_ERROR_NOT_PERMITTED );
1569
1570 status = psa_mac_finish_internal( operation,
1571 actual_mac, sizeof( actual_mac ),
1572 &actual_mac_length );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001573 if( status != PSA_SUCCESS )
1574 return( status );
1575 if( actual_mac_length != mac_length )
1576 return( PSA_ERROR_INVALID_SIGNATURE );
1577 if( safer_memcmp( mac, actual_mac, actual_mac_length ) != 0 )
1578 return( PSA_ERROR_INVALID_SIGNATURE );
1579 return( PSA_SUCCESS );
1580}
1581
1582
Gilles Peskine20035e32018-02-03 22:44:14 +01001583
Gilles Peskine20035e32018-02-03 22:44:14 +01001584/****************************************************************/
1585/* Asymmetric cryptography */
1586/****************************************************************/
1587
Gilles Peskine8b18a4f2018-06-08 16:34:46 +02001588/* Decode the hash algorithm from alg and store the mbedtls encoding in
1589 * md_alg. Verify that the hash length is consistent. */
1590static psa_status_t psa_rsa_decode_md_type( psa_algorithm_t alg,
1591 size_t hash_length,
1592 mbedtls_md_type_t *md_alg )
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03001593{
Gilles Peskine61b91d42018-06-08 16:09:36 +02001594 psa_algorithm_t hash_alg = PSA_ALG_RSA_GET_HASH( alg );
1595 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
1596 *md_alg = hash_alg == 0 ? MBEDTLS_MD_NONE : mbedtls_md_get_type( md_info );
1597 if( *md_alg == MBEDTLS_MD_NONE )
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03001598 {
1599#if SIZE_MAX > UINT_MAX
Gilles Peskine61b91d42018-06-08 16:09:36 +02001600 if( hash_length > UINT_MAX )
1601 return( PSA_ERROR_INVALID_ARGUMENT );
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03001602#endif
1603 }
1604 else
1605 {
Gilles Peskine61b91d42018-06-08 16:09:36 +02001606 if( mbedtls_md_get_size( md_info ) != hash_length )
1607 return( PSA_ERROR_INVALID_ARGUMENT );
1608 if( md_info == NULL )
1609 return( PSA_ERROR_NOT_SUPPORTED );
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03001610 }
Gilles Peskine61b91d42018-06-08 16:09:36 +02001611 return( PSA_SUCCESS );
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03001612}
1613
Gilles Peskine61b91d42018-06-08 16:09:36 +02001614psa_status_t psa_asymmetric_sign( psa_key_slot_t key,
1615 psa_algorithm_t alg,
1616 const uint8_t *hash,
1617 size_t hash_length,
1618 const uint8_t *salt,
1619 size_t salt_length,
1620 uint8_t *signature,
1621 size_t signature_size,
1622 size_t *signature_length )
Gilles Peskine20035e32018-02-03 22:44:14 +01001623{
1624 key_slot_t *slot;
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03001625 psa_status_t status;
Gilles Peskine93aa0332018-02-03 23:58:03 +01001626 *signature_length = 0;
1627 (void) salt;
1628 (void) salt_length;
1629
Gilles Peskine828ed142018-06-18 23:25:51 +02001630 if( key == 0 || key > PSA_KEY_SLOT_COUNT )
Gilles Peskine20035e32018-02-03 22:44:14 +01001631 return( PSA_ERROR_EMPTY_SLOT );
1632 slot = &global_data.key_slots[key];
1633 if( slot->type == PSA_KEY_TYPE_NONE )
1634 return( PSA_ERROR_EMPTY_SLOT );
1635 if( ! PSA_KEY_TYPE_IS_KEYPAIR( slot->type ) )
1636 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine61b91d42018-06-08 16:09:36 +02001637 if( ! ( slot->policy.usage & PSA_KEY_USAGE_SIGN ) )
mohammad160306e79202018-03-28 13:17:44 +03001638 return( PSA_ERROR_NOT_PERMITTED );
Gilles Peskine20035e32018-02-03 22:44:14 +01001639
Gilles Peskine20035e32018-02-03 22:44:14 +01001640#if defined(MBEDTLS_RSA_C)
1641 if( slot->type == PSA_KEY_TYPE_RSA_KEYPAIR )
1642 {
1643 mbedtls_rsa_context *rsa = slot->data.rsa;
1644 int ret;
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03001645 mbedtls_md_type_t md_alg;
Gilles Peskine8b18a4f2018-06-08 16:34:46 +02001646 status = psa_rsa_decode_md_type( alg, hash_length, &md_alg );
Gilles Peskine61b91d42018-06-08 16:09:36 +02001647 if( status != PSA_SUCCESS )
1648 return( status );
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03001649
Gilles Peskine20035e32018-02-03 22:44:14 +01001650 if( signature_size < rsa->len )
1651 return( PSA_ERROR_BUFFER_TOO_SMALL );
1652#if defined(MBEDTLS_PKCS1_V15)
Gilles Peskinea5926232018-03-28 14:16:50 +02001653 if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) )
Gilles Peskine20035e32018-02-03 22:44:14 +01001654 {
1655 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V15,
1656 MBEDTLS_MD_NONE );
1657 ret = mbedtls_rsa_pkcs1_sign( rsa,
1658 mbedtls_ctr_drbg_random,
1659 &global_data.ctr_drbg,
1660 MBEDTLS_RSA_PRIVATE,
1661 md_alg, hash_length, hash,
1662 signature );
1663 }
1664 else
1665#endif /* MBEDTLS_PKCS1_V15 */
1666#if defined(MBEDTLS_PKCS1_V21)
1667 if( alg == PSA_ALG_RSA_PSS_MGF1 )
1668 {
1669 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
1670 ret = mbedtls_rsa_rsassa_pss_sign( rsa,
1671 mbedtls_ctr_drbg_random,
1672 &global_data.ctr_drbg,
1673 MBEDTLS_RSA_PRIVATE,
1674 md_alg, hash_length, hash,
1675 signature );
1676 }
1677 else
1678#endif /* MBEDTLS_PKCS1_V21 */
1679 {
1680 return( PSA_ERROR_INVALID_ARGUMENT );
1681 }
Gilles Peskine93aa0332018-02-03 23:58:03 +01001682 if( ret == 0 )
1683 *signature_length = rsa->len;
Gilles Peskine20035e32018-02-03 22:44:14 +01001684 return( mbedtls_to_psa_error( ret ) );
1685 }
1686 else
1687#endif /* defined(MBEDTLS_RSA_C) */
1688#if defined(MBEDTLS_ECP_C)
1689 if( PSA_KEY_TYPE_IS_ECC( slot->type ) )
1690 {
itayzafrir5c753392018-05-08 11:18:38 +03001691 mbedtls_ecp_keypair *ecdsa = slot->data.ecp;
1692 int ret;
1693 const mbedtls_md_info_t *md_info;
1694 mbedtls_md_type_t md_alg;
1695 if( signature_size < PSA_ECDSA_SIGNATURE_SIZE( ecdsa->grp.pbits ) )
1696 return( PSA_ERROR_BUFFER_TOO_SMALL );
1697 md_info = mbedtls_md_info_from_psa( alg );
1698 md_alg = mbedtls_md_get_type( md_info );
1699 ret = mbedtls_ecdsa_write_signature( ecdsa, md_alg, hash, hash_length,
Gilles Peskine61b91d42018-06-08 16:09:36 +02001700 signature, signature_length,
1701 mbedtls_ctr_drbg_random,
1702 &global_data.ctr_drbg );
itayzafrir5c753392018-05-08 11:18:38 +03001703 return( mbedtls_to_psa_error( ret ) );
1704 }
1705 else
1706#endif /* defined(MBEDTLS_ECP_C) */
1707 {
Gilles Peskine20035e32018-02-03 22:44:14 +01001708 return( PSA_ERROR_NOT_SUPPORTED );
1709 }
itayzafrir5c753392018-05-08 11:18:38 +03001710}
1711
1712psa_status_t psa_asymmetric_verify( psa_key_slot_t key,
1713 psa_algorithm_t alg,
1714 const uint8_t *hash,
1715 size_t hash_length,
1716 const uint8_t *salt,
1717 size_t salt_length,
1718 uint8_t *signature,
1719 size_t signature_size )
1720{
1721 key_slot_t *slot;
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03001722 psa_status_t status;
itayzafrir5c753392018-05-08 11:18:38 +03001723 (void) salt;
1724 (void) salt_length;
1725
Gilles Peskine828ed142018-06-18 23:25:51 +02001726 if( key == 0 || key > PSA_KEY_SLOT_COUNT )
itayzafrir5c753392018-05-08 11:18:38 +03001727 return( PSA_ERROR_INVALID_ARGUMENT );
1728 slot = &global_data.key_slots[key];
1729 if( slot->type == PSA_KEY_TYPE_NONE )
1730 return( PSA_ERROR_EMPTY_SLOT );
Gilles Peskine61b91d42018-06-08 16:09:36 +02001731 if( ! ( slot->policy.usage & PSA_KEY_USAGE_VERIFY ) )
itayzafrir5c753392018-05-08 11:18:38 +03001732 return( PSA_ERROR_NOT_PERMITTED );
1733
Gilles Peskine61b91d42018-06-08 16:09:36 +02001734#if defined(MBEDTLS_RSA_C)
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001735 if( slot->type == PSA_KEY_TYPE_RSA_KEYPAIR ||
1736 slot->type == PSA_KEY_TYPE_RSA_PUBLIC_KEY )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03001737 {
1738 mbedtls_rsa_context *rsa = slot->data.rsa;
1739 int ret;
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03001740 mbedtls_md_type_t md_alg;
Gilles Peskine8b18a4f2018-06-08 16:34:46 +02001741 status = psa_rsa_decode_md_type( alg, hash_length, &md_alg );
Gilles Peskine61b91d42018-06-08 16:09:36 +02001742 if( status != PSA_SUCCESS )
1743 return( status );
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03001744
Nir Sonnenschein39e59142018-05-02 23:16:26 +03001745 if( signature_size < rsa->len )
1746 return( PSA_ERROR_BUFFER_TOO_SMALL );
1747#if defined(MBEDTLS_PKCS1_V15)
Gilles Peskine6afe7892018-05-31 13:16:08 +02001748 if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03001749 {
1750 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V15,
1751 MBEDTLS_MD_NONE );
1752
1753 ret = mbedtls_rsa_pkcs1_verify( rsa,
Gilles Peskine61b91d42018-06-08 16:09:36 +02001754 mbedtls_ctr_drbg_random,
1755 &global_data.ctr_drbg,
1756 MBEDTLS_RSA_PUBLIC,
1757 md_alg,
1758 hash_length,
1759 hash,
1760 signature );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03001761
1762 }
1763 else
1764#endif /* MBEDTLS_PKCS1_V15 */
1765#if defined(MBEDTLS_PKCS1_V21)
1766 if( alg == PSA_ALG_RSA_PSS_MGF1 )
1767 {
Gilles Peskinebeb49482018-06-08 17:44:35 +02001768 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
1769 ret = mbedtls_rsa_rsassa_pss_verify( rsa,
1770 mbedtls_ctr_drbg_random,
1771 &global_data.ctr_drbg,
1772 MBEDTLS_RSA_PUBLIC,
1773 md_alg, hash_length, hash,
1774 signature );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03001775 }
1776 else
1777#endif /* MBEDTLS_PKCS1_V21 */
1778 {
1779 return( PSA_ERROR_INVALID_ARGUMENT );
1780 }
1781 return( mbedtls_to_psa_error( ret ) );
1782 }
1783 else
1784#endif /* defined(MBEDTLS_RSA_C) */
itayzafrir5c753392018-05-08 11:18:38 +03001785#if defined(MBEDTLS_ECP_C)
1786 if( PSA_KEY_TYPE_IS_ECC( slot->type ) )
1787 {
1788 mbedtls_ecp_keypair *ecdsa = slot->data.ecp;
1789 int ret;
Gilles Peskine2d277862018-06-18 15:41:12 +02001790 (void) alg;
Gilles Peskine61b91d42018-06-08 16:09:36 +02001791 ret = mbedtls_ecdsa_read_signature( ecdsa, hash, hash_length,
1792 signature, signature_size );
itayzafrir5c753392018-05-08 11:18:38 +03001793 return( mbedtls_to_psa_error( ret ) );
1794 }
Gilles Peskine20035e32018-02-03 22:44:14 +01001795 else
1796#endif /* defined(MBEDTLS_ECP_C) */
1797 {
1798 return( PSA_ERROR_NOT_SUPPORTED );
1799 }
1800}
1801
Gilles Peskine61b91d42018-06-08 16:09:36 +02001802psa_status_t psa_asymmetric_encrypt( psa_key_slot_t key,
1803 psa_algorithm_t alg,
1804 const uint8_t *input,
1805 size_t input_length,
1806 const uint8_t *salt,
1807 size_t salt_length,
1808 uint8_t *output,
1809 size_t output_size,
1810 size_t *output_length )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03001811{
1812 key_slot_t *slot;
1813 (void) salt;
1814 (void) salt_length;
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03001815 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03001816
Gilles Peskine828ed142018-06-18 23:25:51 +02001817 if( key == 0 || key > PSA_KEY_SLOT_COUNT )
Nir Sonnenschein7f5a3192018-05-06 22:26:54 +03001818 return( PSA_ERROR_INVALID_ARGUMENT );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03001819 slot = &global_data.key_slots[key];
1820 if( slot->type == PSA_KEY_TYPE_NONE )
1821 return( PSA_ERROR_EMPTY_SLOT );
1822 if( ! PSA_KEY_TYPE_IS_KEYPAIR( slot->type ) )
1823 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine61b91d42018-06-08 16:09:36 +02001824 if( ! ( slot->policy.usage & PSA_KEY_USAGE_ENCRYPT ) )
1825 return( PSA_ERROR_NOT_PERMITTED );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03001826
1827#if defined(MBEDTLS_RSA_C)
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001828 if( slot->type == PSA_KEY_TYPE_RSA_KEYPAIR ||
1829 slot->type == PSA_KEY_TYPE_RSA_PUBLIC_KEY )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03001830 {
1831 mbedtls_rsa_context *rsa = slot->data.rsa;
1832 int ret;
Gilles Peskine5b051bc2018-05-31 13:25:48 +02001833 if( output_size < rsa->len )
Gilles Peskine61b91d42018-06-08 16:09:36 +02001834 return( PSA_ERROR_INVALID_ARGUMENT );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03001835#if defined(MBEDTLS_PKCS1_V15)
Gilles Peskine6afe7892018-05-31 13:16:08 +02001836 if( alg == PSA_ALG_RSA_PKCS1V15_CRYPT )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03001837 {
Gilles Peskine61b91d42018-06-08 16:09:36 +02001838 ret = mbedtls_rsa_pkcs1_encrypt( rsa,
1839 mbedtls_ctr_drbg_random,
1840 &global_data.ctr_drbg,
1841 MBEDTLS_RSA_PUBLIC,
1842 input_length,
1843 input,
1844 output );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03001845 }
1846 else
1847#endif /* MBEDTLS_PKCS1_V15 */
1848#if defined(MBEDTLS_PKCS1_V21)
Gilles Peskine625b01c2018-06-08 17:43:16 +02001849 if( PSA_ALG_IS_RSA_OAEP_MGF1( alg ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03001850 {
1851 return( PSA_ERROR_NOT_SUPPORTED );
1852 }
1853 else
1854#endif /* MBEDTLS_PKCS1_V21 */
1855 {
1856 return( PSA_ERROR_INVALID_ARGUMENT );
1857 }
1858 if( ret == 0 )
Nir Sonnenschein717a0402018-06-04 16:36:15 +03001859 *output_length = rsa->len;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03001860 return( mbedtls_to_psa_error( ret ) );
1861 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03001862 else
Gilles Peskineb75e4f12018-06-08 17:44:47 +02001863#endif /* defined(MBEDTLS_RSA_C) */
Nir Sonnenschein39e59142018-05-02 23:16:26 +03001864 {
1865 return( PSA_ERROR_NOT_SUPPORTED );
1866 }
Gilles Peskine5b051bc2018-05-31 13:25:48 +02001867}
Nir Sonnenschein39e59142018-05-02 23:16:26 +03001868
Gilles Peskine61b91d42018-06-08 16:09:36 +02001869psa_status_t psa_asymmetric_decrypt( psa_key_slot_t key,
1870 psa_algorithm_t alg,
1871 const uint8_t *input,
1872 size_t input_length,
1873 const uint8_t *salt,
1874 size_t salt_length,
1875 uint8_t *output,
1876 size_t output_size,
1877 size_t *output_length )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03001878{
1879 key_slot_t *slot;
1880 (void) salt;
1881 (void) salt_length;
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03001882 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03001883
Gilles Peskine828ed142018-06-18 23:25:51 +02001884 if( key == 0 || key > PSA_KEY_SLOT_COUNT )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03001885 return( PSA_ERROR_EMPTY_SLOT );
1886 slot = &global_data.key_slots[key];
1887 if( slot->type == PSA_KEY_TYPE_NONE )
1888 return( PSA_ERROR_EMPTY_SLOT );
1889 if( ! PSA_KEY_TYPE_IS_KEYPAIR( slot->type ) )
1890 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine61b91d42018-06-08 16:09:36 +02001891 if( ! ( slot->policy.usage & PSA_KEY_USAGE_DECRYPT ) )
1892 return( PSA_ERROR_NOT_PERMITTED );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03001893
1894#if defined(MBEDTLS_RSA_C)
1895 if( slot->type == PSA_KEY_TYPE_RSA_KEYPAIR )
1896 {
1897 mbedtls_rsa_context *rsa = slot->data.rsa;
1898 int ret;
1899
Gilles Peskinec4def2f2018-06-08 17:53:48 +02001900 if( input_length != rsa->len )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03001901 return( PSA_ERROR_INVALID_ARGUMENT );
1902
1903#if defined(MBEDTLS_PKCS1_V15)
Gilles Peskine6afe7892018-05-31 13:16:08 +02001904 if( alg == PSA_ALG_RSA_PKCS1V15_CRYPT )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03001905 {
Gilles Peskine61b91d42018-06-08 16:09:36 +02001906 ret = mbedtls_rsa_pkcs1_decrypt( rsa,
1907 mbedtls_ctr_drbg_random,
1908 &global_data.ctr_drbg,
1909 MBEDTLS_RSA_PRIVATE,
1910 output_length,
1911 input,
1912 output,
1913 output_size );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03001914 }
1915 else
1916#endif /* MBEDTLS_PKCS1_V15 */
1917#if defined(MBEDTLS_PKCS1_V21)
Gilles Peskine625b01c2018-06-08 17:43:16 +02001918 if( PSA_ALG_IS_RSA_OAEP_MGF1( alg ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03001919 {
1920 return( PSA_ERROR_NOT_SUPPORTED );
1921 }
1922 else
1923#endif /* MBEDTLS_PKCS1_V21 */
1924 {
1925 return( PSA_ERROR_INVALID_ARGUMENT );
1926 }
Nir Sonnenschein717a0402018-06-04 16:36:15 +03001927
Nir Sonnenschein39e59142018-05-02 23:16:26 +03001928 return( mbedtls_to_psa_error( ret ) );
1929 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03001930 else
Gilles Peskineb75e4f12018-06-08 17:44:47 +02001931#endif /* defined(MBEDTLS_RSA_C) */
Nir Sonnenschein39e59142018-05-02 23:16:26 +03001932 {
1933 return( PSA_ERROR_NOT_SUPPORTED );
1934 }
Gilles Peskine5b051bc2018-05-31 13:25:48 +02001935}
Gilles Peskine20035e32018-02-03 22:44:14 +01001936
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02001937
1938
mohammad1603503973b2018-03-12 15:59:30 +02001939/****************************************************************/
1940/* Symmetric cryptography */
1941/****************************************************************/
1942
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02001943/* Initialize the cipher operation structure. Once this function has been
1944 * called, psa_cipher_abort can run and will do the right thing. */
1945static psa_status_t psa_cipher_init( psa_cipher_operation_t *operation,
1946 psa_algorithm_t alg )
1947{
Gilles Peskinec06e0712018-06-20 16:21:04 +02001948 if( ! PSA_ALG_IS_CIPHER( alg ) )
1949 {
1950 memset( operation, 0, sizeof( *operation ) );
1951 return( PSA_ERROR_INVALID_ARGUMENT );
1952 }
1953
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02001954 operation->alg = alg;
1955 operation->key_set = 0;
1956 operation->iv_set = 0;
1957 operation->iv_required = 1;
1958 operation->iv_size = 0;
1959 operation->block_size = 0;
1960 mbedtls_cipher_init( &operation->ctx.cipher );
1961 return( PSA_SUCCESS );
1962}
1963
Gilles Peskinee553c652018-06-04 16:22:46 +02001964static psa_status_t psa_cipher_setup( psa_cipher_operation_t *operation,
1965 psa_key_slot_t key,
Gilles Peskine7e928852018-06-04 16:23:10 +02001966 psa_algorithm_t alg,
1967 mbedtls_operation_t cipher_operation )
mohammad1603503973b2018-03-12 15:59:30 +02001968{
1969 int ret = MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE;
1970 psa_status_t status;
1971 key_slot_t *slot;
1972 psa_key_type_t key_type;
1973 size_t key_bits;
1974 const mbedtls_cipher_info_t *cipher_info = NULL;
1975
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02001976 status = psa_cipher_init( operation, alg );
1977 if( status != PSA_SUCCESS )
1978 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02001979
1980 status = psa_get_key_information( key, &key_type, &key_bits );
1981 if( status != PSA_SUCCESS )
1982 return( status );
1983 slot = &global_data.key_slots[key];
1984
Gilles Peskinebb1072f2018-06-08 18:46:05 +02001985 cipher_info = mbedtls_cipher_info_from_psa( alg, key_type, key_bits, NULL );
mohammad1603503973b2018-03-12 15:59:30 +02001986 if( cipher_info == NULL )
1987 return( PSA_ERROR_NOT_SUPPORTED );
1988
mohammad1603503973b2018-03-12 15:59:30 +02001989 ret = mbedtls_cipher_setup( &operation->ctx.cipher, cipher_info );
Moran Peker41deec42018-04-04 15:43:05 +03001990 if( ret != 0 )
mohammad1603503973b2018-03-12 15:59:30 +02001991 {
1992 psa_cipher_abort( operation );
1993 return( mbedtls_to_psa_error( ret ) );
1994 }
1995
Gilles Peskine9ad29e22018-06-21 09:40:04 +02001996#if defined(MBEDTLS_DES_C)
1997 if( key_type == PSA_KEY_TYPE_DES && key_bits == 128 )
1998 {
1999 /* Two-key Triple-DES is 3-key Triple-DES with K1=K3 */
2000 unsigned char keys[24];
2001 memcpy( keys, slot->data.raw.data, 16 );
2002 memcpy( keys + 16, slot->data.raw.data, 8 );
2003 ret = mbedtls_cipher_setkey( &operation->ctx.cipher,
2004 keys,
2005 192, cipher_operation );
2006 }
2007 else
2008#endif
2009 {
2010 ret = mbedtls_cipher_setkey( &operation->ctx.cipher,
2011 slot->data.raw.data,
2012 key_bits, cipher_operation );
2013 }
Moran Peker41deec42018-04-04 15:43:05 +03002014 if( ret != 0 )
mohammad1603503973b2018-03-12 15:59:30 +02002015 {
2016 psa_cipher_abort( operation );
2017 return( mbedtls_to_psa_error( ret ) );
2018 }
2019
mohammad16038481e742018-03-18 13:57:31 +02002020#if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING)
Moran Peker7cb22b82018-06-05 11:40:02 +03002021 if( ( alg & ~PSA_ALG_BLOCK_CIPHER_PADDING_MASK ) == PSA_ALG_CBC_BASE )
mohammad16038481e742018-03-18 13:57:31 +02002022 {
Gilles Peskine53514202018-06-06 15:11:46 +02002023 psa_algorithm_t padding_mode = alg & PSA_ALG_BLOCK_CIPHER_PADDING_MASK;
2024 mbedtls_cipher_padding_t mode;
mohammad16038481e742018-03-18 13:57:31 +02002025
Moran Pekera28258c2018-05-29 16:25:04 +03002026 switch ( padding_mode )
mohammad16038481e742018-03-18 13:57:31 +02002027 {
2028 case PSA_ALG_BLOCK_CIPHER_PAD_PKCS7:
2029 mode = MBEDTLS_PADDING_PKCS7;
2030 break;
2031 case PSA_ALG_BLOCK_CIPHER_PAD_NONE:
2032 mode = MBEDTLS_PADDING_NONE;
2033 break;
2034 default:
Moran Pekerae382792018-05-31 14:06:17 +03002035 psa_cipher_abort( operation );
2036 return( PSA_ERROR_INVALID_ARGUMENT );
mohammad16038481e742018-03-18 13:57:31 +02002037 }
2038 ret = mbedtls_cipher_set_padding_mode( &operation->ctx.cipher, mode );
Moran Pekera28258c2018-05-29 16:25:04 +03002039 if( ret != 0 )
Moran Peker71f19ae2018-04-22 20:23:16 +03002040 {
2041 psa_cipher_abort( operation );
mohammad16038481e742018-03-18 13:57:31 +02002042 return( mbedtls_to_psa_error( ret ) );
Moran Peker71f19ae2018-04-22 20:23:16 +03002043 }
mohammad16038481e742018-03-18 13:57:31 +02002044 }
2045#endif //MBEDTLS_CIPHER_MODE_WITH_PADDING
2046
mohammad1603503973b2018-03-12 15:59:30 +02002047 operation->key_set = 1;
Gilles Peskine7e928852018-06-04 16:23:10 +02002048 operation->block_size = ( PSA_ALG_IS_BLOCK_CIPHER( alg ) ?
2049 PSA_BLOCK_CIPHER_BLOCK_SIZE( key_type ) :
2050 1 );
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02002051 if( PSA_ALG_IS_BLOCK_CIPHER( alg ) || alg == PSA_ALG_CTR )
mohammad16038481e742018-03-18 13:57:31 +02002052 {
mohammad160389e0f462018-04-12 08:48:45 +03002053 operation->iv_size = PSA_BLOCK_CIPHER_BLOCK_SIZE( key_type );
mohammad16038481e742018-03-18 13:57:31 +02002054 }
mohammad1603503973b2018-03-12 15:59:30 +02002055
Moran Peker395db872018-05-31 14:07:14 +03002056 return( PSA_SUCCESS );
mohammad1603503973b2018-03-12 15:59:30 +02002057}
2058
Gilles Peskinee553c652018-06-04 16:22:46 +02002059psa_status_t psa_encrypt_setup( psa_cipher_operation_t *operation,
2060 psa_key_slot_t key,
2061 psa_algorithm_t alg )
mohammad16038481e742018-03-18 13:57:31 +02002062{
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02002063 return( psa_cipher_setup( operation, key, alg, MBEDTLS_ENCRYPT ) );
mohammad16038481e742018-03-18 13:57:31 +02002064}
2065
Gilles Peskinee553c652018-06-04 16:22:46 +02002066psa_status_t psa_decrypt_setup( psa_cipher_operation_t *operation,
2067 psa_key_slot_t key,
2068 psa_algorithm_t alg )
mohammad16038481e742018-03-18 13:57:31 +02002069{
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02002070 return( psa_cipher_setup( operation, key, alg, MBEDTLS_DECRYPT ) );
mohammad16038481e742018-03-18 13:57:31 +02002071}
2072
Gilles Peskinee553c652018-06-04 16:22:46 +02002073psa_status_t psa_encrypt_generate_iv( psa_cipher_operation_t *operation,
2074 unsigned char *iv,
2075 size_t iv_size,
2076 size_t *iv_length )
mohammad1603503973b2018-03-12 15:59:30 +02002077{
Moran Peker41deec42018-04-04 15:43:05 +03002078 int ret = PSA_SUCCESS;
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02002079 if( operation->iv_set || ! operation->iv_required )
Moran Peker41deec42018-04-04 15:43:05 +03002080 return( PSA_ERROR_BAD_STATE );
2081 if( iv_size < operation->iv_size )
mohammad1603503973b2018-03-12 15:59:30 +02002082 {
Moran Peker41deec42018-04-04 15:43:05 +03002083 ret = PSA_ERROR_BUFFER_TOO_SMALL;
2084 goto exit;
2085 }
Gilles Peskine7e928852018-06-04 16:23:10 +02002086 ret = mbedtls_ctr_drbg_random( &global_data.ctr_drbg,
2087 iv, operation->iv_size );
Moran Peker41deec42018-04-04 15:43:05 +03002088 if( ret != 0 )
2089 {
2090 ret = mbedtls_to_psa_error( ret );
Gilles Peskinee553c652018-06-04 16:22:46 +02002091 goto exit;
mohammad1603503973b2018-03-12 15:59:30 +02002092 }
Gilles Peskinee553c652018-06-04 16:22:46 +02002093
mohammad16038481e742018-03-18 13:57:31 +02002094 *iv_length = operation->iv_size;
mohammad160389e0f462018-04-12 08:48:45 +03002095 ret = psa_encrypt_set_iv( operation, iv, *iv_length );
Moran Peker41deec42018-04-04 15:43:05 +03002096
Moran Peker395db872018-05-31 14:07:14 +03002097exit:
2098 if( ret != PSA_SUCCESS )
2099 psa_cipher_abort( operation );
2100 return( ret );
mohammad1603503973b2018-03-12 15:59:30 +02002101}
2102
Gilles Peskinee553c652018-06-04 16:22:46 +02002103psa_status_t psa_encrypt_set_iv( psa_cipher_operation_t *operation,
2104 const unsigned char *iv,
2105 size_t iv_length )
mohammad1603503973b2018-03-12 15:59:30 +02002106{
Moran Peker41deec42018-04-04 15:43:05 +03002107 int ret = PSA_SUCCESS;
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02002108 if( operation->iv_set || ! operation->iv_required )
Moran Peker41deec42018-04-04 15:43:05 +03002109 return( PSA_ERROR_BAD_STATE );
Moran Pekera28258c2018-05-29 16:25:04 +03002110 if( iv_length != operation->iv_size )
Moran Peker71f19ae2018-04-22 20:23:16 +03002111 {
Moran Pekerae382792018-05-31 14:06:17 +03002112 psa_cipher_abort( operation );
2113 return( PSA_ERROR_INVALID_ARGUMENT );
Moran Peker71f19ae2018-04-22 20:23:16 +03002114 }
mohammad1603503973b2018-03-12 15:59:30 +02002115 ret = mbedtls_cipher_set_iv( &operation->ctx.cipher, iv, iv_length );
Moran Peker41deec42018-04-04 15:43:05 +03002116 if( ret != 0 )
mohammad1603503973b2018-03-12 15:59:30 +02002117 {
2118 psa_cipher_abort( operation );
2119 return( mbedtls_to_psa_error( ret ) );
2120 }
2121
2122 operation->iv_set = 1;
mohammad1603503973b2018-03-12 15:59:30 +02002123
Moran Peker395db872018-05-31 14:07:14 +03002124 return( PSA_SUCCESS );
mohammad1603503973b2018-03-12 15:59:30 +02002125}
2126
Gilles Peskinee553c652018-06-04 16:22:46 +02002127psa_status_t psa_cipher_update( psa_cipher_operation_t *operation,
2128 const uint8_t *input,
2129 size_t input_length,
2130 unsigned char *output,
2131 size_t output_size,
2132 size_t *output_length )
mohammad1603503973b2018-03-12 15:59:30 +02002133{
2134 int ret = MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE;
Gilles Peskine89d789c2018-06-04 17:17:16 +02002135 size_t expected_output_size;
2136 if( PSA_ALG_IS_BLOCK_CIPHER( operation->alg ) )
2137 {
2138 /* Take the unprocessed partial block left over from previous
2139 * update calls, if any, plus the input to this call. Remove
2140 * the last partial block, if any. You get the data that will be
2141 * output in this call. */
2142 expected_output_size =
2143 ( operation->ctx.cipher.unprocessed_len + input_length )
2144 / operation->block_size * operation->block_size;
2145 }
2146 else
2147 {
2148 expected_output_size = input_length;
2149 }
2150 if( output_size < expected_output_size )
Moran Peker395db872018-05-31 14:07:14 +03002151 return( PSA_ERROR_BUFFER_TOO_SMALL );
mohammad160382759612018-03-12 18:16:40 +02002152
mohammad1603503973b2018-03-12 15:59:30 +02002153 ret = mbedtls_cipher_update( &operation->ctx.cipher, input,
Gilles Peskinee553c652018-06-04 16:22:46 +02002154 input_length, output, output_length );
Moran Peker41deec42018-04-04 15:43:05 +03002155 if( ret != 0 )
mohammad1603503973b2018-03-12 15:59:30 +02002156 {
2157 psa_cipher_abort( operation );
2158 return( mbedtls_to_psa_error( ret ) );
2159 }
2160
Moran Peker395db872018-05-31 14:07:14 +03002161 return( PSA_SUCCESS );
mohammad1603503973b2018-03-12 15:59:30 +02002162}
2163
Gilles Peskinee553c652018-06-04 16:22:46 +02002164psa_status_t psa_cipher_finish( psa_cipher_operation_t *operation,
2165 uint8_t *output,
2166 size_t output_size,
2167 size_t *output_length )
mohammad1603503973b2018-03-12 15:59:30 +02002168{
2169 int ret = MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE;
Gilles Peskinee553c652018-06-04 16:22:46 +02002170 uint8_t temp_output_buffer[MBEDTLS_MAX_BLOCK_LENGTH];
Moran Pekerbed71a22018-04-22 20:19:20 +03002171
mohammad1603503973b2018-03-12 15:59:30 +02002172 if( ! operation->key_set )
Moran Pekerdc38ebc2018-04-30 15:45:34 +03002173 {
Moran Peker7cb22b82018-06-05 11:40:02 +03002174 psa_cipher_abort( operation );
2175 return( PSA_ERROR_BAD_STATE );
2176 }
2177 if( operation->iv_required && ! operation->iv_set )
2178 {
Gilles Peskine2c5219a2018-06-06 15:12:32 +02002179 psa_cipher_abort( operation );
Moran Peker7cb22b82018-06-05 11:40:02 +03002180 return( PSA_ERROR_BAD_STATE );
2181 }
Gilles Peskine2c5219a2018-06-06 15:12:32 +02002182 if( operation->ctx.cipher.operation == MBEDTLS_ENCRYPT &&
2183 PSA_ALG_IS_BLOCK_CIPHER( operation->alg ) )
Moran Peker7cb22b82018-06-05 11:40:02 +03002184 {
Gilles Peskine53514202018-06-06 15:11:46 +02002185 psa_algorithm_t padding_mode =
2186 operation->alg & PSA_ALG_BLOCK_CIPHER_PADDING_MASK;
Moran Peker7cb22b82018-06-05 11:40:02 +03002187 if( operation->ctx.cipher.unprocessed_len >= operation->block_size )
Gilles Peskine89d789c2018-06-04 17:17:16 +02002188 {
Gilles Peskine2c5219a2018-06-06 15:12:32 +02002189 psa_cipher_abort( operation );
Moran Peker7cb22b82018-06-05 11:40:02 +03002190 return( PSA_ERROR_TAMPERING_DETECTED );
2191 }
Gilles Peskine53514202018-06-06 15:11:46 +02002192 if( padding_mode == PSA_ALG_BLOCK_CIPHER_PAD_NONE )
Moran Peker7cb22b82018-06-05 11:40:02 +03002193 {
2194 if( operation->ctx.cipher.unprocessed_len != 0 )
2195 {
Gilles Peskine2c5219a2018-06-06 15:12:32 +02002196 psa_cipher_abort( operation );
Moran Peker7cb22b82018-06-05 11:40:02 +03002197 return( PSA_ERROR_INVALID_ARGUMENT );
2198 }
Gilles Peskine89d789c2018-06-04 17:17:16 +02002199 }
Moran Pekerdc38ebc2018-04-30 15:45:34 +03002200 }
2201
2202 ret = mbedtls_cipher_finish( &operation->ctx.cipher, temp_output_buffer,
Gilles Peskinee553c652018-06-04 16:22:46 +02002203 output_length );
Moran Peker41deec42018-04-04 15:43:05 +03002204 if( ret != 0 )
mohammad1603503973b2018-03-12 15:59:30 +02002205 {
2206 psa_cipher_abort( operation );
2207 return( mbedtls_to_psa_error( ret ) );
2208 }
Gilles Peskinee553c652018-06-04 16:22:46 +02002209 if( output_size >= *output_length )
Moran Pekerdc38ebc2018-04-30 15:45:34 +03002210 memcpy( output, temp_output_buffer, *output_length );
2211 else
2212 {
2213 psa_cipher_abort( operation );
2214 return( PSA_ERROR_BUFFER_TOO_SMALL );
2215 }
mohammad1603503973b2018-03-12 15:59:30 +02002216
Moran Peker4c80d832018-04-22 20:15:31 +03002217 return( PSA_SUCCESS );
mohammad1603503973b2018-03-12 15:59:30 +02002218}
2219
Gilles Peskinee553c652018-06-04 16:22:46 +02002220psa_status_t psa_cipher_abort( psa_cipher_operation_t *operation )
2221{
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002222 if( operation->alg == 0 )
2223 return( PSA_SUCCESS );
2224
Gilles Peskinef9c2c092018-06-21 16:57:07 +02002225 /* Sanity check (shouldn't happen: operation->alg should
2226 * always have been initialized to a valid value). */
2227 if( ! PSA_ALG_IS_CIPHER( operation->alg ) )
2228 return( PSA_ERROR_BAD_STATE );
2229
mohammad1603503973b2018-03-12 15:59:30 +02002230 mbedtls_cipher_free( &operation->ctx.cipher );
Gilles Peskinee553c652018-06-04 16:22:46 +02002231
Moran Peker41deec42018-04-04 15:43:05 +03002232 operation->alg = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03002233 operation->key_set = 0;
2234 operation->iv_set = 0;
2235 operation->iv_size = 0;
Moran Peker41deec42018-04-04 15:43:05 +03002236 operation->block_size = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03002237 operation->iv_required = 0;
Moran Peker41deec42018-04-04 15:43:05 +03002238
Moran Peker395db872018-05-31 14:07:14 +03002239 return( PSA_SUCCESS );
mohammad1603503973b2018-03-12 15:59:30 +02002240}
2241
Gilles Peskinea0655c32018-04-30 17:06:50 +02002242
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02002243
mohammad16038cc1cee2018-03-28 01:21:33 +03002244/****************************************************************/
2245/* Key Policy */
2246/****************************************************************/
2247
Gilles Peskine2d277862018-06-18 15:41:12 +02002248void psa_key_policy_init( psa_key_policy_t *policy )
mohammad16038cc1cee2018-03-28 01:21:33 +03002249{
Gilles Peskine803ce742018-06-18 16:07:14 +02002250 memset( policy, 0, sizeof( *policy ) );
mohammad16038cc1cee2018-03-28 01:21:33 +03002251}
2252
Gilles Peskine2d277862018-06-18 15:41:12 +02002253void psa_key_policy_set_usage( psa_key_policy_t *policy,
2254 psa_key_usage_t usage,
2255 psa_algorithm_t alg )
mohammad16038cc1cee2018-03-28 01:21:33 +03002256{
mohammad16034eed7572018-03-28 05:14:59 -07002257 policy->usage = usage;
2258 policy->alg = alg;
mohammad16038cc1cee2018-03-28 01:21:33 +03002259}
2260
Gilles Peskine2d277862018-06-18 15:41:12 +02002261psa_key_usage_t psa_key_policy_get_usage( psa_key_policy_t *policy )
mohammad16038cc1cee2018-03-28 01:21:33 +03002262{
mohammad16036df908f2018-04-02 08:34:15 -07002263 return( policy->usage );
mohammad16038cc1cee2018-03-28 01:21:33 +03002264}
2265
Gilles Peskine2d277862018-06-18 15:41:12 +02002266psa_algorithm_t psa_key_policy_get_algorithm( psa_key_policy_t *policy )
mohammad16038cc1cee2018-03-28 01:21:33 +03002267{
mohammad16036df908f2018-04-02 08:34:15 -07002268 return( policy->alg );
mohammad16038cc1cee2018-03-28 01:21:33 +03002269}
2270
Gilles Peskine2d277862018-06-18 15:41:12 +02002271psa_status_t psa_set_key_policy( psa_key_slot_t key,
2272 const psa_key_policy_t *policy )
mohammad16038cc1cee2018-03-28 01:21:33 +03002273{
2274 key_slot_t *slot;
mohammad16038cc1cee2018-03-28 01:21:33 +03002275
Gilles Peskine828ed142018-06-18 23:25:51 +02002276 if( key == 0 || key > PSA_KEY_SLOT_COUNT || policy == NULL )
mohammad16038cc1cee2018-03-28 01:21:33 +03002277 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine5b051bc2018-05-31 13:25:48 +02002278
mohammad16038cc1cee2018-03-28 01:21:33 +03002279 slot = &global_data.key_slots[key];
2280 if( slot->type != PSA_KEY_TYPE_NONE )
2281 return( PSA_ERROR_OCCUPIED_SLOT );
2282
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02002283 if( ( policy->usage & ~( PSA_KEY_USAGE_EXPORT |
2284 PSA_KEY_USAGE_ENCRYPT |
2285 PSA_KEY_USAGE_DECRYPT |
2286 PSA_KEY_USAGE_SIGN |
2287 PSA_KEY_USAGE_VERIFY ) ) != 0 )
mohammad16035feda722018-04-16 04:38:57 -07002288 return( PSA_ERROR_INVALID_ARGUMENT );
mohammad16038cc1cee2018-03-28 01:21:33 +03002289
mohammad16036df908f2018-04-02 08:34:15 -07002290 slot->policy = *policy;
mohammad16038cc1cee2018-03-28 01:21:33 +03002291
2292 return( PSA_SUCCESS );
2293}
2294
Gilles Peskine2d277862018-06-18 15:41:12 +02002295psa_status_t psa_get_key_policy( psa_key_slot_t key,
2296 psa_key_policy_t *policy )
mohammad16038cc1cee2018-03-28 01:21:33 +03002297{
2298 key_slot_t *slot;
2299
Gilles Peskine828ed142018-06-18 23:25:51 +02002300 if( key == 0 || key > PSA_KEY_SLOT_COUNT || policy == NULL )
mohammad16038cc1cee2018-03-28 01:21:33 +03002301 return( PSA_ERROR_INVALID_ARGUMENT );
2302
2303 slot = &global_data.key_slots[key];
Gilles Peskine5b051bc2018-05-31 13:25:48 +02002304
mohammad16036df908f2018-04-02 08:34:15 -07002305 *policy = slot->policy;
mohammad16038cc1cee2018-03-28 01:21:33 +03002306
2307 return( PSA_SUCCESS );
2308}
Gilles Peskine20035e32018-02-03 22:44:14 +01002309
Gilles Peskinea0655c32018-04-30 17:06:50 +02002310
2311
mohammad1603804cd712018-03-20 22:44:08 +02002312/****************************************************************/
2313/* Key Lifetime */
2314/****************************************************************/
2315
Gilles Peskine2d277862018-06-18 15:41:12 +02002316psa_status_t psa_get_key_lifetime( psa_key_slot_t key,
2317 psa_key_lifetime_t *lifetime )
mohammad1603804cd712018-03-20 22:44:08 +02002318{
2319 key_slot_t *slot;
2320
Gilles Peskine828ed142018-06-18 23:25:51 +02002321 if( key == 0 || key > PSA_KEY_SLOT_COUNT )
mohammad1603804cd712018-03-20 22:44:08 +02002322 return( PSA_ERROR_INVALID_ARGUMENT );
2323
2324 slot = &global_data.key_slots[key];
Gilles Peskine5b051bc2018-05-31 13:25:48 +02002325
mohammad1603804cd712018-03-20 22:44:08 +02002326 *lifetime = slot->lifetime;
2327
2328 return( PSA_SUCCESS );
2329}
2330
Gilles Peskine2d277862018-06-18 15:41:12 +02002331psa_status_t psa_set_key_lifetime( psa_key_slot_t key,
2332 const psa_key_lifetime_t lifetime )
mohammad1603804cd712018-03-20 22:44:08 +02002333{
2334 key_slot_t *slot;
2335
Gilles Peskine828ed142018-06-18 23:25:51 +02002336 if( key == 0 || key > PSA_KEY_SLOT_COUNT )
mohammad1603804cd712018-03-20 22:44:08 +02002337 return( PSA_ERROR_INVALID_ARGUMENT );
2338
Gilles Peskine5b051bc2018-05-31 13:25:48 +02002339 if( lifetime != PSA_KEY_LIFETIME_VOLATILE &&
2340 lifetime != PSA_KEY_LIFETIME_PERSISTENT &&
mohammad1603ba178512018-03-21 04:35:20 -07002341 lifetime != PSA_KEY_LIFETIME_WRITE_ONCE)
2342 return( PSA_ERROR_INVALID_ARGUMENT );
2343
mohammad1603804cd712018-03-20 22:44:08 +02002344 slot = &global_data.key_slots[key];
mohammad16035d7ec202018-03-28 01:29:41 +03002345 if( slot->type != PSA_KEY_TYPE_NONE )
2346 return( PSA_ERROR_OCCUPIED_SLOT );
mohammad1603804cd712018-03-20 22:44:08 +02002347
Moran Pekerd7326592018-05-29 16:56:39 +03002348 if( lifetime != PSA_KEY_LIFETIME_VOLATILE )
mohammad1603ba178512018-03-21 04:35:20 -07002349 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine5b051bc2018-05-31 13:25:48 +02002350
mohammad1603060ad8a2018-03-20 14:28:38 -07002351 slot->lifetime = lifetime;
mohammad1603804cd712018-03-20 22:44:08 +02002352
2353 return( PSA_SUCCESS );
2354}
2355
Gilles Peskine20035e32018-02-03 22:44:14 +01002356
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02002357
mohammad16035955c982018-04-26 00:53:03 +03002358/****************************************************************/
2359/* AEAD */
2360/****************************************************************/
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02002361
mohammad16035955c982018-04-26 00:53:03 +03002362psa_status_t psa_aead_encrypt( psa_key_slot_t key,
2363 psa_algorithm_t alg,
2364 const uint8_t *nonce,
2365 size_t nonce_length,
2366 const uint8_t *additional_data,
2367 size_t additional_data_length,
2368 const uint8_t *plaintext,
2369 size_t plaintext_length,
2370 uint8_t *ciphertext,
2371 size_t ciphertext_size,
2372 size_t *ciphertext_length )
2373{
2374 int ret;
2375 psa_status_t status;
2376 key_slot_t *slot;
2377 psa_key_type_t key_type;
2378 size_t key_bits;
mohammad160315223a82018-06-03 17:19:55 +03002379 uint8_t *tag;
2380 size_t tag_length;
mohammad1603dad36fa2018-05-09 02:24:42 -07002381 mbedtls_cipher_id_t cipher_id;
mohammad16030f214652018-06-03 15:10:06 +03002382 const mbedtls_cipher_info_t *cipher_info = NULL;
Gilles Peskine2d277862018-06-18 15:41:12 +02002383
mohammad1603f08a5502018-06-03 15:05:47 +03002384 *ciphertext_length = 0;
mohammad1603e58e6842018-05-09 04:58:32 -07002385
mohammad16035955c982018-04-26 00:53:03 +03002386 status = psa_get_key_information( key, &key_type, &key_bits );
2387 if( status != PSA_SUCCESS )
2388 return( status );
2389 slot = &global_data.key_slots[key];
mohammad1603a1d98012018-06-06 13:45:55 +03002390 if( slot->type == PSA_KEY_TYPE_NONE )
Gilles Peskine2d277862018-06-18 15:41:12 +02002391 return( PSA_ERROR_EMPTY_SLOT );
mohammad16035955c982018-04-26 00:53:03 +03002392
mohammad16035ed06212018-06-06 13:09:34 +03002393 cipher_info = mbedtls_cipher_info_from_psa( alg, key_type,
2394 key_bits, &cipher_id );
mohammad16030f214652018-06-03 15:10:06 +03002395 if( cipher_info == NULL )
Gilles Peskine2d277862018-06-18 15:41:12 +02002396 return( PSA_ERROR_NOT_SUPPORTED );
mohammad1603dad36fa2018-05-09 02:24:42 -07002397
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02002398 if( ( slot->policy.usage & PSA_KEY_USAGE_ENCRYPT ) == 0 )
mohammad1603f14394b2018-06-04 14:33:19 +03002399 return( PSA_ERROR_NOT_PERMITTED );
mohammad16035955c982018-04-26 00:53:03 +03002400
Gilles Peskine2d277862018-06-18 15:41:12 +02002401 if( ( key_type & PSA_KEY_TYPE_CATEGORY_MASK ) !=
2402 PSA_KEY_TYPE_CATEGORY_SYMMETRIC )
mohammad1603db624732018-04-30 17:21:50 +03002403 return( PSA_ERROR_INVALID_ARGUMENT );
mohammad16035955c982018-04-26 00:53:03 +03002404
mohammad16035955c982018-04-26 00:53:03 +03002405 if( alg == PSA_ALG_GCM )
2406 {
2407 mbedtls_gcm_context gcm;
mohammad160315223a82018-06-03 17:19:55 +03002408 tag_length = 16;
2409
mohammad160396910d82018-06-04 14:33:00 +03002410 if( PSA_BLOCK_CIPHER_BLOCK_SIZE( key_type ) != 16 )
2411 return( PSA_ERROR_INVALID_ARGUMENT );
2412
mohammad160315223a82018-06-03 17:19:55 +03002413 //make sure we have place to hold the tag in the ciphertext buffer
2414 if( ciphertext_size < ( plaintext_length + tag_length ) )
mohammad1603e3cb8a82018-06-06 13:45:03 +03002415 return( PSA_ERROR_BUFFER_TOO_SMALL );
mohammad160315223a82018-06-03 17:19:55 +03002416
2417 //update the tag pointer to point to the end of the ciphertext_length
2418 tag = ciphertext + plaintext_length;
2419
mohammad16035955c982018-04-26 00:53:03 +03002420 mbedtls_gcm_init( &gcm );
Gilles Peskinea40d7742018-06-01 16:28:30 +02002421 ret = mbedtls_gcm_setkey( &gcm, cipher_id,
mohammad160395893f82018-06-03 15:06:17 +03002422 slot->data.raw.data,
Gilles Peskinea40d7742018-06-01 16:28:30 +02002423 key_bits );
mohammad16035955c982018-04-26 00:53:03 +03002424 if( ret != 0 )
2425 {
2426 mbedtls_gcm_free( &gcm );
2427 return( mbedtls_to_psa_error( ret ) );
2428 }
2429 ret = mbedtls_gcm_crypt_and_tag( &gcm, MBEDTLS_GCM_ENCRYPT,
Gilles Peskinea40d7742018-06-01 16:28:30 +02002430 plaintext_length, nonce,
2431 nonce_length, additional_data,
2432 additional_data_length, plaintext,
mohammad160315223a82018-06-03 17:19:55 +03002433 ciphertext, tag_length, tag );
mohammad16035955c982018-04-26 00:53:03 +03002434 mbedtls_gcm_free( &gcm );
2435 }
2436 else if( alg == PSA_ALG_CCM )
2437 {
2438 mbedtls_ccm_context ccm;
mohammad160315223a82018-06-03 17:19:55 +03002439 tag_length = 16;
2440
mohammad160396910d82018-06-04 14:33:00 +03002441 if( PSA_BLOCK_CIPHER_BLOCK_SIZE( key_type ) != 16 )
2442 return( PSA_ERROR_INVALID_ARGUMENT );
2443
mohammad160347ddf3d2018-04-26 01:11:21 +03002444 if( nonce_length < 7 || nonce_length > 13 )
2445 return( PSA_ERROR_INVALID_ARGUMENT );
2446
mohammad160315223a82018-06-03 17:19:55 +03002447 //make sure we have place to hold the tag in the ciphertext buffer
2448 if( ciphertext_size < ( plaintext_length + tag_length ) )
mohammad1603e3cb8a82018-06-06 13:45:03 +03002449 return( PSA_ERROR_BUFFER_TOO_SMALL );
mohammad160315223a82018-06-03 17:19:55 +03002450
2451 //update the tag pointer to point to the end of the ciphertext_length
2452 tag = ciphertext + plaintext_length;
2453
mohammad16035955c982018-04-26 00:53:03 +03002454 mbedtls_ccm_init( &ccm );
Gilles Peskinea40d7742018-06-01 16:28:30 +02002455 ret = mbedtls_ccm_setkey( &ccm, cipher_id,
mohammad16036bbd8c72018-04-30 17:22:52 +03002456 slot->data.raw.data, key_bits );
mohammad16035955c982018-04-26 00:53:03 +03002457 if( ret != 0 )
2458 {
2459 mbedtls_ccm_free( &ccm );
2460 return( mbedtls_to_psa_error( ret ) );
2461 }
Gilles Peskinea40d7742018-06-01 16:28:30 +02002462 ret = mbedtls_ccm_encrypt_and_tag( &ccm, plaintext_length,
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02002463 nonce, nonce_length,
2464 additional_data,
Gilles Peskinea40d7742018-06-01 16:28:30 +02002465 additional_data_length,
2466 plaintext, ciphertext,
mohammad160315223a82018-06-03 17:19:55 +03002467 tag, tag_length );
mohammad16035955c982018-04-26 00:53:03 +03002468 mbedtls_ccm_free( &ccm );
2469 }
mohammad16035c8845f2018-05-09 05:40:09 -07002470 else
2471 {
mohammad1603554faad2018-06-03 15:07:38 +03002472 return( PSA_ERROR_NOT_SUPPORTED );
mohammad16035c8845f2018-05-09 05:40:09 -07002473 }
Gilles Peskine2d277862018-06-18 15:41:12 +02002474
mohammad160315223a82018-06-03 17:19:55 +03002475 if( ret != 0 )
2476 {
2477 memset( ciphertext, 0, ciphertext_size );
2478 return( mbedtls_to_psa_error( ret ) );
2479 }
Gilles Peskine2d277862018-06-18 15:41:12 +02002480
mohammad160315223a82018-06-03 17:19:55 +03002481 *ciphertext_length = plaintext_length + tag_length;
mohammad160347ddf3d2018-04-26 01:11:21 +03002482 return( PSA_SUCCESS );
mohammad16035955c982018-04-26 00:53:03 +03002483}
2484
Gilles Peskineee652a32018-06-01 19:23:52 +02002485/* Locate the tag in a ciphertext buffer containing the encrypted data
2486 * followed by the tag. Return the length of the part preceding the tag in
2487 * *plaintext_length. This is the size of the plaintext in modes where
2488 * the encrypted data has the same size as the plaintext, such as
2489 * CCM and GCM. */
2490static psa_status_t psa_aead_unpadded_locate_tag( size_t tag_length,
2491 const uint8_t *ciphertext,
2492 size_t ciphertext_length,
2493 size_t plaintext_size,
Gilles Peskineee652a32018-06-01 19:23:52 +02002494 const uint8_t **p_tag )
2495{
2496 size_t payload_length;
2497 if( tag_length > ciphertext_length )
2498 return( PSA_ERROR_INVALID_ARGUMENT );
2499 payload_length = ciphertext_length - tag_length;
2500 if( payload_length > plaintext_size )
2501 return( PSA_ERROR_BUFFER_TOO_SMALL );
2502 *p_tag = ciphertext + payload_length;
Gilles Peskineee652a32018-06-01 19:23:52 +02002503 return( PSA_SUCCESS );
2504}
2505
mohammad16035955c982018-04-26 00:53:03 +03002506psa_status_t psa_aead_decrypt( psa_key_slot_t key,
2507 psa_algorithm_t alg,
2508 const uint8_t *nonce,
2509 size_t nonce_length,
2510 const uint8_t *additional_data,
2511 size_t additional_data_length,
2512 const uint8_t *ciphertext,
2513 size_t ciphertext_length,
2514 uint8_t *plaintext,
2515 size_t plaintext_size,
2516 size_t *plaintext_length )
2517{
2518 int ret;
2519 psa_status_t status;
2520 key_slot_t *slot;
2521 psa_key_type_t key_type;
2522 size_t key_bits;
Gilles Peskineee652a32018-06-01 19:23:52 +02002523 const uint8_t *tag;
2524 size_t tag_length;
mohammad1603dad36fa2018-05-09 02:24:42 -07002525 mbedtls_cipher_id_t cipher_id;
mohammad16030f214652018-06-03 15:10:06 +03002526 const mbedtls_cipher_info_t *cipher_info = NULL;
Gilles Peskine2d277862018-06-18 15:41:12 +02002527
Gilles Peskineee652a32018-06-01 19:23:52 +02002528 *plaintext_length = 0;
mohammad16039e5a5152018-04-26 12:07:35 +03002529
mohammad16035955c982018-04-26 00:53:03 +03002530 status = psa_get_key_information( key, &key_type, &key_bits );
2531 if( status != PSA_SUCCESS )
2532 return( status );
2533 slot = &global_data.key_slots[key];
mohammad1603a1d98012018-06-06 13:45:55 +03002534 if( slot->type == PSA_KEY_TYPE_NONE )
Gilles Peskine2d277862018-06-18 15:41:12 +02002535 return( PSA_ERROR_EMPTY_SLOT );
mohammad16035955c982018-04-26 00:53:03 +03002536
mohammad16035ed06212018-06-06 13:09:34 +03002537 cipher_info = mbedtls_cipher_info_from_psa( alg, key_type,
2538 key_bits, &cipher_id );
mohammad16030f214652018-06-03 15:10:06 +03002539 if( cipher_info == NULL )
Gilles Peskine2d277862018-06-18 15:41:12 +02002540 return( PSA_ERROR_NOT_SUPPORTED );
2541
mohammad1603f14394b2018-06-04 14:33:19 +03002542 if( !( slot->policy.usage & PSA_KEY_USAGE_DECRYPT ) )
2543 return( PSA_ERROR_NOT_PERMITTED );
mohammad16035955c982018-04-26 00:53:03 +03002544
Gilles Peskine2d277862018-06-18 15:41:12 +02002545 if( ( key_type & PSA_KEY_TYPE_CATEGORY_MASK ) !=
2546 PSA_KEY_TYPE_CATEGORY_SYMMETRIC )
mohammad1603a7e6df72018-04-30 17:25:45 +03002547 return( PSA_ERROR_INVALID_ARGUMENT );
mohammad16035955c982018-04-26 00:53:03 +03002548
mohammad16035955c982018-04-26 00:53:03 +03002549 if( alg == PSA_ALG_GCM )
2550 {
2551 mbedtls_gcm_context gcm;
mohammad160347ddf3d2018-04-26 01:11:21 +03002552
Gilles Peskineee652a32018-06-01 19:23:52 +02002553 tag_length = 16;
2554 status = psa_aead_unpadded_locate_tag( tag_length,
2555 ciphertext, ciphertext_length,
mohammad160360a64d02018-06-03 17:20:42 +03002556 plaintext_size, &tag );
Gilles Peskineee652a32018-06-01 19:23:52 +02002557 if( status != PSA_SUCCESS )
2558 return( status );
2559
mohammad16035955c982018-04-26 00:53:03 +03002560 mbedtls_gcm_init( &gcm );
Gilles Peskinea40d7742018-06-01 16:28:30 +02002561 ret = mbedtls_gcm_setkey( &gcm, cipher_id,
mohammad16036bbd8c72018-04-30 17:22:52 +03002562 slot->data.raw.data, key_bits );
mohammad16035955c982018-04-26 00:53:03 +03002563 if( ret != 0 )
2564 {
2565 mbedtls_gcm_free( &gcm );
2566 return( mbedtls_to_psa_error( ret ) );
2567 }
mohammad16035955c982018-04-26 00:53:03 +03002568
Gilles Peskineee652a32018-06-01 19:23:52 +02002569 ret = mbedtls_gcm_auth_decrypt( &gcm,
mohammad160360a64d02018-06-03 17:20:42 +03002570 ciphertext_length - tag_length,
Gilles Peskineee652a32018-06-01 19:23:52 +02002571 nonce, nonce_length,
mohammad16035ed06212018-06-06 13:09:34 +03002572 additional_data,
2573 additional_data_length,
Gilles Peskineee652a32018-06-01 19:23:52 +02002574 tag, tag_length,
2575 ciphertext, plaintext );
mohammad16035955c982018-04-26 00:53:03 +03002576 mbedtls_gcm_free( &gcm );
2577 }
2578 else if( alg == PSA_ALG_CCM )
2579 {
2580 mbedtls_ccm_context ccm;
Gilles Peskinea40d7742018-06-01 16:28:30 +02002581
mohammad160347ddf3d2018-04-26 01:11:21 +03002582 if( nonce_length < 7 || nonce_length > 13 )
2583 return( PSA_ERROR_INVALID_ARGUMENT );
2584
mohammad16039375f842018-06-03 14:28:24 +03002585 tag_length = 16;
2586 status = psa_aead_unpadded_locate_tag( tag_length,
2587 ciphertext, ciphertext_length,
mohammad160360a64d02018-06-03 17:20:42 +03002588 plaintext_size, &tag );
mohammad16039375f842018-06-03 14:28:24 +03002589 if( status != PSA_SUCCESS )
2590 return( status );
2591
mohammad16035955c982018-04-26 00:53:03 +03002592 mbedtls_ccm_init( &ccm );
Gilles Peskinea40d7742018-06-01 16:28:30 +02002593 ret = mbedtls_ccm_setkey( &ccm, cipher_id,
mohammad16036bbd8c72018-04-30 17:22:52 +03002594 slot->data.raw.data, key_bits );
mohammad16035955c982018-04-26 00:53:03 +03002595 if( ret != 0 )
2596 {
2597 mbedtls_ccm_free( &ccm );
2598 return( mbedtls_to_psa_error( ret ) );
2599 }
mohammad160360a64d02018-06-03 17:20:42 +03002600 ret = mbedtls_ccm_auth_decrypt( &ccm, ciphertext_length - tag_length,
Gilles Peskineee652a32018-06-01 19:23:52 +02002601 nonce, nonce_length,
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02002602 additional_data,
2603 additional_data_length,
Gilles Peskineee652a32018-06-01 19:23:52 +02002604 ciphertext, plaintext,
2605 tag, tag_length );
mohammad16035955c982018-04-26 00:53:03 +03002606 mbedtls_ccm_free( &ccm );
2607 }
mohammad160339574652018-06-01 04:39:53 -07002608 else
2609 {
mohammad1603554faad2018-06-03 15:07:38 +03002610 return( PSA_ERROR_NOT_SUPPORTED );
mohammad160339574652018-06-01 04:39:53 -07002611 }
Gilles Peskinea40d7742018-06-01 16:28:30 +02002612
Gilles Peskineee652a32018-06-01 19:23:52 +02002613 if( ret != 0 )
mohammad160360a64d02018-06-03 17:20:42 +03002614 memset( plaintext, 0, plaintext_size );
2615 else
2616 *plaintext_length = ciphertext_length - tag_length;
2617
Gilles Peskineee652a32018-06-01 19:23:52 +02002618 return( mbedtls_to_psa_error( ret ) );
mohammad16035955c982018-04-26 00:53:03 +03002619}
2620
Gilles Peskinea0655c32018-04-30 17:06:50 +02002621
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02002622
Gilles Peskine20035e32018-02-03 22:44:14 +01002623/****************************************************************/
Gilles Peskine05d69892018-06-19 22:00:52 +02002624/* Key generation */
2625/****************************************************************/
2626
2627psa_status_t psa_generate_random( uint8_t *output,
2628 size_t output_size )
2629{
2630 int ret = mbedtls_ctr_drbg_random( &global_data.ctr_drbg,
2631 output, output_size );
2632 return( mbedtls_to_psa_error( ret ) );
2633}
2634
2635psa_status_t psa_generate_key( psa_key_slot_t key,
2636 psa_key_type_t type,
2637 size_t bits,
2638 const void *parameters,
2639 size_t parameters_size )
2640{
Gilles Peskine12313cd2018-06-20 00:20:32 +02002641 key_slot_t *slot;
2642
2643 if( key == 0 || key > PSA_KEY_SLOT_COUNT )
2644 return( PSA_ERROR_INVALID_ARGUMENT );
2645 slot = &global_data.key_slots[key];
2646 if( slot->type != PSA_KEY_TYPE_NONE )
2647 return( PSA_ERROR_OCCUPIED_SLOT );
2648 if( parameters == NULL && parameters_size != 0 )
2649 return( PSA_ERROR_INVALID_ARGUMENT );
2650
Gilles Peskine48c0ea12018-06-21 14:15:31 +02002651 if( key_type_is_raw_bytes( type ) )
Gilles Peskine12313cd2018-06-20 00:20:32 +02002652 {
2653 psa_status_t status = prepare_raw_data_slot( type, bits,
2654 &slot->data.raw );
2655 if( status != PSA_SUCCESS )
2656 return( status );
2657 status = psa_generate_random( slot->data.raw.data,
2658 slot->data.raw.bytes );
2659 if( status != PSA_SUCCESS )
2660 {
2661 mbedtls_free( slot->data.raw.data );
2662 return( status );
2663 }
2664#if defined(MBEDTLS_DES_C)
2665 if( type == PSA_KEY_TYPE_DES )
2666 {
2667 mbedtls_des_key_set_parity( slot->data.raw.data );
2668 if( slot->data.raw.bytes >= 16 )
2669 mbedtls_des_key_set_parity( slot->data.raw.data + 8 );
2670 if( slot->data.raw.bytes == 24 )
2671 mbedtls_des_key_set_parity( slot->data.raw.data + 16 );
2672 }
2673#endif /* MBEDTLS_DES_C */
2674 }
2675 else
2676
2677#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_GENPRIME)
2678 if ( type == PSA_KEY_TYPE_RSA_KEYPAIR )
2679 {
2680 mbedtls_rsa_context *rsa;
2681 int ret;
2682 int exponent = 65537;
2683 if( parameters != NULL )
2684 {
2685 const unsigned *p = parameters;
2686 if( parameters_size != sizeof( *p ) )
2687 return( PSA_ERROR_INVALID_ARGUMENT );
2688 if( *p > INT_MAX )
2689 return( PSA_ERROR_INVALID_ARGUMENT );
2690 exponent = *p;
2691 }
2692 rsa = mbedtls_calloc( 1, sizeof( *rsa ) );
2693 if( rsa == NULL )
2694 return( PSA_ERROR_INSUFFICIENT_MEMORY );
2695 mbedtls_rsa_init( rsa, MBEDTLS_RSA_PKCS_V15, MBEDTLS_MD_NONE );
2696 ret = mbedtls_rsa_gen_key( rsa,
2697 mbedtls_ctr_drbg_random,
2698 &global_data.ctr_drbg,
2699 bits,
2700 exponent );
2701 if( ret != 0 )
2702 {
2703 mbedtls_rsa_free( rsa );
2704 mbedtls_free( rsa );
2705 return( mbedtls_to_psa_error( ret ) );
2706 }
2707 slot->data.rsa = rsa;
2708 }
2709 else
2710#endif /* MBEDTLS_RSA_C && MBEDTLS_GENPRIME */
2711
2712#if defined(MBEDTLS_ECP_C)
2713 if ( PSA_KEY_TYPE_IS_ECC( type ) && PSA_KEY_TYPE_IS_KEYPAIR( type ) )
2714 {
2715 psa_ecc_curve_t curve = PSA_KEY_TYPE_GET_CURVE( type );
2716 mbedtls_ecp_group_id grp_id = mbedtls_ecc_group_of_psa( curve );
2717 const mbedtls_ecp_curve_info *curve_info =
2718 mbedtls_ecp_curve_info_from_grp_id( grp_id );
2719 mbedtls_ecp_keypair *ecp;
2720 int ret;
2721 if( parameters != NULL )
2722 return( PSA_ERROR_NOT_SUPPORTED );
2723 if( grp_id == MBEDTLS_ECP_DP_NONE || curve_info == NULL )
2724 return( PSA_ERROR_NOT_SUPPORTED );
2725 if( curve_info->bit_size != bits )
2726 return( PSA_ERROR_INVALID_ARGUMENT );
2727 ecp = mbedtls_calloc( 1, sizeof( *ecp ) );
2728 if( ecp == NULL )
2729 return( PSA_ERROR_INSUFFICIENT_MEMORY );
2730 mbedtls_ecp_keypair_init( ecp );
2731 ret = mbedtls_ecp_gen_key( grp_id, ecp,
2732 mbedtls_ctr_drbg_random,
2733 &global_data.ctr_drbg );
2734 if( ret != 0 )
2735 {
2736 mbedtls_ecp_keypair_free( ecp );
2737 mbedtls_free( ecp );
2738 return( mbedtls_to_psa_error( ret ) );
2739 }
2740 slot->data.ecp = ecp;
2741 }
2742 else
2743#endif /* MBEDTLS_ECP_C */
2744
2745 return( PSA_ERROR_NOT_SUPPORTED );
2746
2747 slot->type = type;
2748 return( PSA_SUCCESS );
Gilles Peskine05d69892018-06-19 22:00:52 +02002749}
2750
2751
2752/****************************************************************/
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01002753/* Module setup */
2754/****************************************************************/
2755
Gilles Peskinee59236f2018-01-27 23:32:46 +01002756void mbedtls_psa_crypto_free( void )
2757{
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01002758 size_t key;
Gilles Peskine828ed142018-06-18 23:25:51 +02002759 for( key = 1; key < PSA_KEY_SLOT_COUNT; key++ )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01002760 psa_destroy_key( key );
Gilles Peskinee59236f2018-01-27 23:32:46 +01002761 mbedtls_ctr_drbg_free( &global_data.ctr_drbg );
2762 mbedtls_entropy_free( &global_data.entropy );
2763 mbedtls_zeroize( &global_data, sizeof( global_data ) );
2764}
2765
2766psa_status_t psa_crypto_init( void )
2767{
2768 int ret;
2769 const unsigned char drbg_seed[] = "PSA";
2770
2771 if( global_data.initialized != 0 )
2772 return( PSA_SUCCESS );
2773
2774 mbedtls_zeroize( &global_data, sizeof( global_data ) );
2775 mbedtls_entropy_init( &global_data.entropy );
2776 mbedtls_ctr_drbg_init( &global_data.ctr_drbg );
2777
2778 ret = mbedtls_ctr_drbg_seed( &global_data.ctr_drbg,
2779 mbedtls_entropy_func,
2780 &global_data.entropy,
2781 drbg_seed, sizeof( drbg_seed ) - 1 );
2782 if( ret != 0 )
2783 goto exit;
2784
Gilles Peskinee4ebc122018-03-07 14:16:44 +01002785 global_data.initialized = 1;
2786
Gilles Peskinee59236f2018-01-27 23:32:46 +01002787exit:
2788 if( ret != 0 )
2789 mbedtls_psa_crypto_free( );
2790 return( mbedtls_to_psa_error( ret ) );
2791}
2792
2793#endif /* MBEDTLS_PSA_CRYPTO_C */