library/psa_crypto_aead.c

/*
 *  PSA AEAD entry points
 */
/*
 *  Copyright The Mbed TLS Contributors
 *  SPDX-License-Identifier: Apache-2.0
 *
 *  Licensed under the Apache License, Version 2.0 (the "License"); you may
 *  not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *  http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
 *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 */

#include "common.h"


#if defined(MBEDTLS_PSA_CRYPTO_C)

#include "psa_crypto_aead.h"
#include "psa_crypto_core.h"

#include <string.h>
#include "mbedtls/platform.h"
#if !defined(MBEDTLS_PLATFORM_C)
#define mbedtls_calloc calloc
#define mbedtls_free   free
#endif

#include "mbedtls/ccm.h"
#include "mbedtls/chachapoly.h"
#include "mbedtls/cipher.h"
#include "mbedtls/gcm.h"
#include "mbedtls/error.h"

/* Constant-time buffer comparison. This is duplication of code from
 * psa_crypto.c, but has nowhere private I can put it for the minute. Really
   belongs in the constant time module, when that gets implemented */
static inline int safer_memcmp( const uint8_t *a, const uint8_t *b, size_t n )
{
    size_t i;
    unsigned char diff = 0;

    for( i = 0; i < n; i++ )
        diff |= a[i] ^ b[i];

    return( diff );
}


static psa_status_t psa_aead_setup(
    psa_aead_operation_t *operation,
    const psa_key_attributes_t *attributes,
    const uint8_t *key_buffer,
    psa_algorithm_t alg )
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    size_t key_bits;
    const mbedtls_cipher_info_t *cipher_info;
    mbedtls_cipher_id_t cipher_id;
    size_t full_tag_length = 0;

    if( operation->key_set || operation->nonce_set ||
        operation->ad_started || operation->body_started )
    {
        return( PSA_ERROR_BAD_STATE );
    }

    key_bits = attributes->core.bits;

    cipher_info = mbedtls_cipher_info_from_psa( alg,
                                                attributes->core.type, key_bits,
                                                &cipher_id );
    if( cipher_info == NULL )
        return( PSA_ERROR_NOT_SUPPORTED );

    switch( PSA_ALG_AEAD_WITH_SHORTENED_TAG( alg, 0 ) )
    {
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
        case PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, 0 ):
            operation->alg = PSA_ALG_CCM;
            full_tag_length = 16;
            /* CCM allows the following tag lengths: 4, 6, 8, 10, 12, 14, 16.
             * The call to mbedtls_ccm_encrypt_and_tag or
             * mbedtls_ccm_auth_decrypt will validate the tag length. */
            if( PSA_BLOCK_CIPHER_BLOCK_LENGTH( attributes->core.type ) != 16 )
                return( PSA_ERROR_INVALID_ARGUMENT );

            mbedtls_ccm_init( &operation->ctx.ccm );
            status = mbedtls_to_psa_error(
                mbedtls_ccm_setkey( &operation->ctx.ccm, cipher_id,
                                    key_buffer, (unsigned int) key_bits ) );
            if( status != PSA_SUCCESS )
                return( status );
            break;
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */

#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM)
        case PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_GCM, 0 ):
            operation->alg = PSA_ALG_GCM;
            full_tag_length = 16;
            /* GCM allows the following tag lengths: 4, 8, 12, 13, 14, 15, 16.
             * The call to mbedtls_gcm_crypt_and_tag or
             * mbedtls_gcm_auth_decrypt will validate the tag length. */
            if( PSA_BLOCK_CIPHER_BLOCK_LENGTH( attributes->core.type ) != 16 )
                return( PSA_ERROR_INVALID_ARGUMENT );

            mbedtls_gcm_init( &operation->ctx.gcm );
            status = mbedtls_to_psa_error(
                mbedtls_gcm_setkey( &operation->ctx.gcm, cipher_id,
                                    key_buffer, (unsigned int) key_bits ) );
            if( status != PSA_SUCCESS )
                return( status );
            break;
#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */

#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305)
        case PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CHACHA20_POLY1305, 0 ):
            operation->alg = PSA_ALG_CHACHA20_POLY1305;
            full_tag_length = 16;
            /* We only support the default tag length. */
            if( alg != PSA_ALG_CHACHA20_POLY1305 )
                return( PSA_ERROR_NOT_SUPPORTED );

            mbedtls_chachapoly_init( &operation->ctx.chachapoly );
            status = mbedtls_to_psa_error(
                mbedtls_chachapoly_setkey( &operation->ctx.chachapoly,
                                           key_buffer ) );
            if( status != PSA_SUCCESS )
                return( status );
            break;
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */

        default:
            return( PSA_ERROR_NOT_SUPPORTED );
    }

    if( PSA_AEAD_TAG_LENGTH( attributes->core.type,
                             key_bits, alg )
        > full_tag_length )
        return( PSA_ERROR_INVALID_ARGUMENT );

    operation->tag_length = PSA_AEAD_TAG_LENGTH( attributes->core.type,
                                                 key_bits,
                                                 alg );

    operation->key_set = 1;

    return( PSA_SUCCESS );
}

psa_status_t mbedtls_psa_aead_encrypt(
    const psa_key_attributes_t *attributes,
    const uint8_t *key_buffer, size_t key_buffer_size,
    psa_algorithm_t alg,
    const uint8_t *nonce, size_t nonce_length,
    const uint8_t *additional_data, size_t additional_data_length,
    const uint8_t *plaintext, size_t plaintext_length,
    uint8_t *ciphertext, size_t ciphertext_size, size_t *ciphertext_length )
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_aead_operation_t operation = PSA_AEAD_OPERATION_INIT;
    uint8_t *tag;
    (void) key_buffer_size;

    status = psa_aead_setup( &operation, attributes, key_buffer, alg );
    if( status != PSA_SUCCESS )
        goto exit;

    /* For all currently supported modes, the tag is at the end of the
     * ciphertext. */
    if( ciphertext_size < ( plaintext_length + operation.tag_length ) )
    {
        status = PSA_ERROR_BUFFER_TOO_SMALL;
        goto exit;
    }
    tag = ciphertext + plaintext_length;

#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
    if( operation.alg == PSA_ALG_CCM )
    {
        status = mbedtls_to_psa_error(
            mbedtls_ccm_encrypt_and_tag( &operation.ctx.ccm,
                                         plaintext_length,
                                         nonce, nonce_length,
                                         additional_data,
                                         additional_data_length,
                                         plaintext, ciphertext,
                                         tag, operation.tag_length ) );
    }
    else
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM)
    if( operation.alg == PSA_ALG_GCM )
    {
        status = mbedtls_to_psa_error(
            mbedtls_gcm_crypt_and_tag( &operation.ctx.gcm,
                                       MBEDTLS_GCM_ENCRYPT,
                                       plaintext_length,
                                       nonce, nonce_length,
                                       additional_data, additional_data_length,
                                       plaintext, ciphertext,
                                       operation.tag_length, tag ) );
    }
    else
#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305)
    if( operation.alg == PSA_ALG_CHACHA20_POLY1305 )
    {
        if( nonce_length != 12 || operation.tag_length != 16 )
        {
            status = PSA_ERROR_NOT_SUPPORTED;
            goto exit;
        }
        status = mbedtls_to_psa_error(
            mbedtls_chachapoly_encrypt_and_tag( &operation.ctx.chachapoly,
                                                plaintext_length,
                                                nonce,
                                                additional_data,
                                                additional_data_length,
                                                plaintext,
                                                ciphertext,
                                                tag ) );
    }
    else
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */
    {
        (void) tag;
        return( PSA_ERROR_NOT_SUPPORTED );
    }

    if( status == PSA_SUCCESS )
        *ciphertext_length = plaintext_length + operation.tag_length;

exit:
    mbedtls_psa_aead_abort( &operation );

    return( status );
}

/* Locate the tag in a ciphertext buffer containing the encrypted data
 * followed by the tag. Return the length of the part preceding the tag in
 * *plaintext_length. This is the size of the plaintext in modes where
 * the encrypted data has the same size as the plaintext, such as
 * CCM and GCM. */
static psa_status_t psa_aead_unpadded_locate_tag( size_t tag_length,
                                                  const uint8_t *ciphertext,
                                                  size_t ciphertext_length,
                                                  size_t plaintext_size,
                                                  const uint8_t **p_tag )
{
    size_t payload_length;
    if( tag_length > ciphertext_length )
        return( PSA_ERROR_INVALID_ARGUMENT );
    payload_length = ciphertext_length - tag_length;
    if( payload_length > plaintext_size )
        return( PSA_ERROR_BUFFER_TOO_SMALL );
    *p_tag = ciphertext + payload_length;
    return( PSA_SUCCESS );
}

psa_status_t mbedtls_psa_aead_decrypt(
    const psa_key_attributes_t *attributes,
    const uint8_t *key_buffer, size_t key_buffer_size,
    psa_algorithm_t alg,
    const uint8_t *nonce, size_t nonce_length,
    const uint8_t *additional_data, size_t additional_data_length,
    const uint8_t *ciphertext, size_t ciphertext_length,
    uint8_t *plaintext, size_t plaintext_size, size_t *plaintext_length )
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_aead_operation_t operation = PSA_AEAD_OPERATION_INIT;
    const uint8_t *tag = NULL;
    (void) key_buffer_size;

    status = psa_aead_setup( &operation, attributes, key_buffer, alg );
    if( status != PSA_SUCCESS )
        goto exit;

    status = psa_aead_unpadded_locate_tag( operation.tag_length,
                                           ciphertext, ciphertext_length,
                                           plaintext_size, &tag );
    if( status != PSA_SUCCESS )
        goto exit;

#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
    if( operation.alg == PSA_ALG_CCM )
    {
        status = mbedtls_to_psa_error(
            mbedtls_ccm_auth_decrypt( &operation.ctx.ccm,
                                      ciphertext_length - operation.tag_length,
                                      nonce, nonce_length,
                                      additional_data,
                                      additional_data_length,
                                      ciphertext, plaintext,
                                      tag, operation.tag_length ) );
    }
    else
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM)
    if( operation.alg == PSA_ALG_GCM )
    {
        status = mbedtls_to_psa_error(
            mbedtls_gcm_auth_decrypt( &operation.ctx.gcm,
                                      ciphertext_length - operation.tag_length,
                                      nonce, nonce_length,
                                      additional_data,
                                      additional_data_length,
                                      tag, operation.tag_length,
                                      ciphertext, plaintext ) );
    }
    else
#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305)
    if( operation.alg == PSA_ALG_CHACHA20_POLY1305 )
    {
        if( nonce_length != 12 || operation.tag_length != 16 )
        {
            status = PSA_ERROR_NOT_SUPPORTED;
            goto exit;
        }
        status = mbedtls_to_psa_error(
            mbedtls_chachapoly_auth_decrypt( &operation.ctx.chachapoly,
                                             ciphertext_length - operation.tag_length,
                                             nonce,
                                             additional_data,
                                             additional_data_length,
                                             tag,
                                             ciphertext,
                                             plaintext ) );
    }
    else
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */
    {
        return( PSA_ERROR_NOT_SUPPORTED );
    }

    if( status == PSA_SUCCESS )
        *plaintext_length = ciphertext_length - operation.tag_length;

exit:
    mbedtls_psa_aead_abort( &operation );

    if( status == PSA_SUCCESS )
        *plaintext_length = ciphertext_length - operation.tag_length;
    return( status );
}

/* Set the key and algorithm for a multipart authenticated encryption
 * operation. */
psa_status_t mbedtls_psa_aead_encrypt_setup( psa_aead_operation_t *operation,
                                             const psa_key_attributes_t *attributes,
                                             const uint8_t *key_buffer, size_t key_buffer_size,
                                             psa_algorithm_t alg )
{
    psa_status_t status;

    (void) key_buffer_size;

    status = psa_aead_setup( operation, attributes, key_buffer, alg );

    if( status == PSA_SUCCESS )
    {
        operation->is_encrypt = 1;
    }

    return ( status );
}

/* Set the key and algorithm for a multipart authenticated decryption
 * operation. */
psa_status_t mbedtls_psa_aead_decrypt_setup( psa_aead_operation_t *operation,
                                             const psa_key_attributes_t *attributes,
                                             const uint8_t *key_buffer, size_t key_buffer_size,
                                             psa_algorithm_t alg )
{
    psa_status_t status;

    (void) key_buffer_size;

    status = psa_aead_setup( operation, attributes, key_buffer, alg );

    if( status == PSA_SUCCESS )
    {
        operation->is_encrypt = 0;
    }

    return ( status );
}

/* Set a nonce for the multipart AEAD operation*/
psa_status_t mbedtls_psa_aead_set_nonce( psa_aead_operation_t *operation,
                                         const uint8_t *nonce,
                                         size_t nonce_length )
{
    psa_status_t status;

    #if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM)
    if( operation->alg == PSA_ALG_GCM )
    {
        /* GCM sets nonce once additional data has been supplied */
        memcpy(operation->nonce, nonce, nonce_length);

        /* We know that nonce size cannot exceed the uint8_t size */
        operation->nonce_length = ( uint8_t ) nonce_length;
        status = PSA_SUCCESS;
    }
    else
#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
    if( operation->alg == PSA_ALG_CCM )
    {
        /* Multipart CCM not supported as yet, so CCM is basically operating
           in oneshot mode. Store the nonce as we need this later */
        memcpy(operation->nonce, nonce, nonce_length);

        /* We know that nonce size cannot exceed the uint8_t size */
        operation->nonce_length = ( uint8_t ) nonce_length;
        status = PSA_SUCCESS;
    }
    else
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305)
    if( operation->alg == PSA_ALG_CHACHA20_POLY1305 )
    {
        if( nonce_length != 12 && nonce_length != 8)
        {
            return( PSA_ERROR_INVALID_ARGUMENT );
        }

        status = mbedtls_to_psa_error(mbedtls_chachapoly_starts( &operation->ctx.chachapoly,
                                                                 nonce,
                                                                 operation->is_encrypt ?
                                                                 MBEDTLS_CHACHAPOLY_ENCRYPT :
                                                                 MBEDTLS_CHACHAPOLY_DECRYPT ) );
        }
    else
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */
    {
        ( void ) nonce;
        ( void ) nonce_length;

        return ( PSA_ERROR_NOT_SUPPORTED );
    }

    if( status == PSA_SUCCESS )
    {
        operation->nonce_set = 1;
    }

    return( status );
}
 /* Declare the lengths of the message and additional data for AEAD. */
psa_status_t mbedtls_psa_aead_set_lengths( psa_aead_operation_t *operation,
                                           size_t ad_length,
                                           size_t plaintext_length )
{

#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM)
    if( operation->alg == PSA_ALG_GCM )
    {
#if SIZE_MAX > UINT32_MAX
        if( ( (uint64_t) ad_length ) >> 61 != 0 ||
            ( (uint64_t) plaintext_length ) > 0xFFFFFFFE0ull )
        {
            return ( PSA_ERROR_INVALID_ARGUMENT );
        }
#endif
    }
    else
#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
    if( operation->alg == PSA_ALG_CCM )
    {
        if( ad_length > 0xFF00 )
        {
            return ( PSA_ERROR_INVALID_ARGUMENT );
        }
    }
    else
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305)
    if( operation->alg == PSA_ALG_CHACHA20_POLY1305 )
    {
        /* No length restrictions for ChaChaPoly. */
    }
    else
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */
    {
        ( void ) ad_length;
        ( void ) plaintext_length;

        return ( PSA_ERROR_NOT_SUPPORTED );
    }

    operation->ad_remaining = ad_length;
    operation->body_remaining = plaintext_length;
    operation->lengths_set = 1;

    return ( PSA_SUCCESS );
}

/* Pass additional data to an active multipart AEAD operation. */
psa_status_t mbedtls_psa_aead_update_ad( psa_aead_operation_t *operation,
                                         const uint8_t *input,
                                         size_t input_length )
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;

    if( operation->lengths_set )
    {
        if ( operation->ad_remaining < input_length )
        {
            return( PSA_ERROR_INVALID_ARGUMENT );
        }

        operation->ad_remaining -= input_length;
    }

#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM)
    if( operation->alg == PSA_ALG_GCM )
    {
        if( !operation->lengths_set || operation->ad_started )
        {
            return( PSA_ERROR_BAD_STATE );
        }

        /* GCM currently requires all the additional data to be passed in in
         * one contigious buffer, so until that is re-done, we have to enforce
         * this, as we cannot allocate a buffer to collate multiple calls into.
           */
        if( operation->ad_remaining != 0 )
        {
            return ( PSA_ERROR_INVALID_ARGUMENT );
        }

        status = mbedtls_to_psa_error( mbedtls_gcm_starts( &operation->ctx.gcm,
                                                          operation->is_encrypt ?
                                                           MBEDTLS_GCM_ENCRYPT : MBEDTLS_GCM_DECRYPT,
                                                          operation->nonce,
                                                          operation->nonce_length,
                                                          input,
                                                          input_length ) );

    }
    else
#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
    if( operation->alg == PSA_ALG_CCM )
    {
        /* CCM requires all additional data to be passed in in one go at the
           minute, as we are basically operating in oneshot mode. */
        if( operation->ad_started )
        {
            return( PSA_ERROR_BAD_STATE );
        }

        /* Save the additional data for later, this will be passed in
           when we have the body. */
        operation->ad_buffer = ( uint8_t * ) mbedtls_calloc(1, input_length );

        if( operation->ad_buffer )
        {
            memcpy( operation->ad_buffer, input, input_length );
            operation->ad_length = input_length;
            status = PSA_SUCCESS;
        }
        else
        {
            return ( PSA_ERROR_INSUFFICIENT_MEMORY );
        }
    }
    else
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305)
    if( operation->alg == PSA_ALG_CHACHA20_POLY1305 )
    {
        status = mbedtls_to_psa_error( mbedtls_chachapoly_update_aad( &operation->ctx.chachapoly,
                                                                      input,
                                                                      input_length ) );
    }
    else
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */
    {
        (void) input;
        (void) input_length;

        return ( PSA_ERROR_NOT_SUPPORTED );
    }

    if( status == PSA_SUCCESS )
    {
        operation->ad_started = 1;
    }

    return ( status );
}

/* Encrypt or decrypt a message fragment in an active multipart AEAD
 * operation.*/
psa_status_t mbedtls_psa_aead_update( psa_aead_operation_t *operation,
                                      const uint8_t *input,
                                      size_t input_length,
                                      uint8_t *output,
                                      size_t output_size,
                                      size_t *output_length )
{
    size_t update_output_size;
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;

    update_output_size = input_length;

    if( PSA_AEAD_UPDATE_OUTPUT_SIZE( operation->key_type, operation->alg,
                                        input_length ) > output_size )
    {
        return ( PSA_ERROR_BUFFER_TOO_SMALL );
    }

    if( operation->lengths_set)
    {
        /* Additional data length was supplied, but not all the additional
           data was supplied.*/
        if( operation->ad_remaining != 0 )
        {
            return ( PSA_ERROR_INVALID_ARGUMENT );
        }

        /* Too much data provided. */
        if( operation->body_remaining < input_length )
        {
            return ( PSA_ERROR_INVALID_ARGUMENT );
        }

        operation->body_remaining -= input_length;
    }

#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM)
    if( operation->alg == PSA_ALG_GCM )
    {
        /* For the time being set the requirement that all of the body data
         * must be passed in in one update, rather than deal with the complexity
         * of non block size aligned updates. This will be fixed in 3.0 when
           we can change the signature of the GCM multipart functions */
        if( !operation->lengths_set || operation->body_remaining != 0 )
        {
            return( PSA_ERROR_BAD_STATE );
        }

        if( !operation->ad_started )
        {
            return( PSA_ERROR_BAD_STATE );
        }

        status =  mbedtls_to_psa_error( mbedtls_gcm_update( &operation->ctx.gcm,
                                                        input_length,
                                                        input,
                                                        output ) );
    }
    else
#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
    if( operation->alg == PSA_ALG_CCM )
    {
        /* CCM dooes not support multipart yet, so all the input has to be
           passed in in one go. */
        if( operation->body_started )
        {
            return( PSA_ERROR_BAD_STATE );
        }

        /* Need to store tag for Finish() / Verify() */
        operation->tag_buffer = ( uint8_t * ) mbedtls_calloc(1, operation->tag_length );

        if( operation->tag_buffer )
        {

            if( operation->is_encrypt )
            {
                /* Perform oneshot CCM encryption with additional data already
                   stored, as CCM does not support multipart yet.*/
                status = mbedtls_to_psa_error( mbedtls_ccm_encrypt_and_tag( &operation->ctx.ccm,
                                                                            input_length,
                                                                            operation->nonce,
                                                                            operation->nonce_length,
                                                                            operation->ad_buffer,
                                                                            operation->ad_length,
                                                                            input,
                                                                            output,
                                                                            operation->tag_buffer,
                                                                            operation->tag_length ) );

                /* Even if the above operation fails, we no longer need the
                   additional data.*/
                mbedtls_free(operation->ad_buffer);
                operation->ad_buffer = NULL;
                operation->ad_length = 0;
            }
            else
            {
                /* Need to back up the body data so we can do this again
                   later.*/
                operation->body_buffer = ( uint8_t * ) mbedtls_calloc(1, input_length );

                if( operation->body_buffer )
                {
                    memcpy( operation->body_buffer, input, input_length );
                    operation->body_length = input_length;

                    /* this will fail, as the tag is clearly false, but will write the
                       decrypted data to the output buffer. */
                    ret = mbedtls_ccm_auth_decrypt( &operation->ctx.ccm, input_length,
                                                    operation->nonce, operation->nonce_length,
                                                    operation->ad_buffer, operation->ad_length,
                                                    input, output,
                                                    operation->tag_buffer,
                                                    operation->tag_length );

                    if( ret == MBEDTLS_ERR_CCM_AUTH_FAILED )
                    {
                        status = PSA_SUCCESS;
                    }
                    else
                    {
                        status = mbedtls_to_psa_error( ret );
                    }
                }
                else
                {
                    status = PSA_ERROR_INSUFFICIENT_MEMORY;
                }
            }
        }
        else
        {
            status = PSA_ERROR_INSUFFICIENT_MEMORY;
        }
    }
    else
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305)
    if( operation->alg == PSA_ALG_CHACHA20_POLY1305 )
    {
        status = mbedtls_to_psa_error( mbedtls_chachapoly_update( &operation->ctx.chachapoly,
                                                                  input_length,
                                                                  input,
                                                                  output ) );
    }
    else
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */
    {
        (void) input;
        (void) input_length;

        return ( PSA_ERROR_NOT_SUPPORTED );
    }

    if( status == PSA_SUCCESS )
    {
        *output_length = update_output_size;
        operation->body_started = 1;
    }

    return( status );
}

/* Common checks for both mbedtls_psa_aead_finish() and
   mbedtls_psa_aead_verify() */
static psa_status_t mbedtls_psa_aead_finish_checks( psa_aead_operation_t *operation,
                                                    size_t output_size,
                                                    size_t tag_size )
{
    size_t finish_output_size;

    if( operation->lengths_set )
    {
        if( operation->ad_remaining != 0 || operation->body_remaining != 0 )
        {
            return( PSA_ERROR_BAD_STATE );
        }
    }

    if( tag_size < operation->tag_length )
    {
        return ( PSA_ERROR_BUFFER_TOO_SMALL );
    }

    if( operation->is_encrypt )
    {
            finish_output_size = PSA_AEAD_FINISH_OUTPUT_SIZE( operation->key_type,
                                                              operation->alg );
    }
    else
    {
            finish_output_size = PSA_AEAD_VERIFY_OUTPUT_SIZE( operation->key_type,
                                                               operation->alg );
    }

    if( output_size < finish_output_size )
    {
        return ( PSA_ERROR_BUFFER_TOO_SMALL );
    }

    return ( PSA_SUCCESS );
}

/* Finish encrypting a message in a multipart AEAD operation. */
psa_status_t mbedtls_psa_aead_finish( psa_aead_operation_t *operation,
                                      uint8_t *ciphertext,
                                      size_t ciphertext_size,
                                      size_t *ciphertext_length,
                                      uint8_t *tag,
                                      size_t tag_size,
                                      size_t *tag_length )
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    size_t finish_output_size = 0;

    status = mbedtls_psa_aead_finish_checks( operation, ciphertext_size, tag_size );

    if( status != PSA_SUCCESS )
    {
        return status;
    }

#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM)
    if( operation->alg == PSA_ALG_GCM )
    {
        /* We will need to do final GCM pass in here when multipart is done. */
        status =  mbedtls_to_psa_error( mbedtls_gcm_finish( &operation->ctx.gcm,
                                                            tag,
                                                            tag_size ) );
    }
    else
#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
    if( operation->alg == PSA_ALG_CCM )
    {
        /* Copy the previously generated tag into place */
        memcpy( tag, operation->tag_buffer, operation->tag_length );

        mbedtls_free(operation->tag_buffer);
        operation->tag_buffer = NULL;

        status = PSA_SUCCESS;
    }
    else
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305)
    if( operation->alg == PSA_ALG_CHACHA20_POLY1305 )
    {
        status = mbedtls_to_psa_error( mbedtls_chachapoly_finish( &operation->ctx.chachapoly,
                                                                  tag ) );
    }
    else
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */
    {
        ( void ) ciphertext;
        ( void ) ciphertext_size;
        ( void ) ciphertext_length;
        ( void ) tag;
        ( void ) tag_size;
        ( void ) tag_length;

        return ( PSA_ERROR_NOT_SUPPORTED );
    }

    if( status == PSA_SUCCESS )
    {
        *ciphertext_length = finish_output_size;
        *tag_length = operation->tag_length;
    }

    mbedtls_psa_aead_abort(operation);

    return ( status );
}

/* Finish authenticating and decrypting a message in a multipart AEAD
 * operation.*/
psa_status_t mbedtls_psa_aead_verify( psa_aead_operation_t *operation,
                                      uint8_t *plaintext,
                                      size_t plaintext_size,
                                      size_t *plaintext_length,
                                      const uint8_t *tag,
                                      size_t tag_length )
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;

    uint8_t * temp_buffer;
    size_t temp_buffer_size;

    size_t finish_output_size = 0;

    int do_tag_check = 1;
    uint8_t check_tag[16];

    status = mbedtls_psa_aead_finish_checks( operation, plaintext_size, tag_length );

    if( status != PSA_SUCCESS )
    {
        return status;
    }

#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM)
    if( operation->alg == PSA_ALG_GCM )
    {
        /* Call finish to get the tag for comparison */
        status =  mbedtls_to_psa_error( mbedtls_gcm_finish( &operation->ctx.gcm,
                                                            check_tag,
                                                            operation->tag_length ) );
    }
    else
#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
    if( operation->alg == PSA_ALG_CCM )
    {
        if( !operation->ad_buffer || !operation->body_buffer )
        {
            return( PSA_ERROR_BAD_STATE );
        }

        /* Perform oneshot CCM decryption *again*, as its the
         * only way to get the tag, but this time throw away the
           results, as verify cannot write that much data. */
        temp_buffer_size = PSA_AEAD_UPDATE_OUTPUT_SIZE( operation->key_type,
                                                        operation->alg, operation->body_length );

        temp_buffer = ( uint8_t * ) mbedtls_calloc(1, temp_buffer_size );

        if( temp_buffer )
        {
            ret = mbedtls_ccm_auth_decrypt( &operation->ctx.ccm, operation->body_length,
                                           operation->nonce, operation->nonce_length,
                                           operation->ad_buffer, operation->ad_length,
                                           operation->body_buffer, temp_buffer,
                                           tag, tag_length );

            if( ret == MBEDTLS_ERR_CCM_AUTH_FAILED )
            {
                status = PSA_ERROR_INVALID_SIGNATURE;
            }
            else
            {
                status = mbedtls_to_psa_error( ret );
                do_tag_check = 0;
            }
        }
        else
        {
            status = PSA_ERROR_INSUFFICIENT_MEMORY;
        }

        /* Even if the above operation fails, we no longer need the data */
        mbedtls_free(temp_buffer);

        mbedtls_free(operation->body_buffer);
        operation->body_buffer = NULL;
        operation->body_length = 0;

        mbedtls_free(operation->tag_buffer);
        operation->tag_buffer = NULL;
    }
    else
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305)
    if( operation->alg == PSA_ALG_CHACHA20_POLY1305 )
    {
        // call finish to get the tag for comparison.
        status = mbedtls_to_psa_error( mbedtls_chachapoly_finish( &operation->ctx.chachapoly,
                                                                  check_tag ) );

    }
    else
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */
    {
        ( void ) plaintext;
        ( void ) plaintext_size;
        ( void ) plaintext_length;
        ( void ) tag;
        ( void ) tag_length;

        return ( PSA_ERROR_NOT_SUPPORTED );
    }

    if( status == PSA_SUCCESS )
    {
        *plaintext_length = finish_output_size;

        if( do_tag_check && safer_memcmp(tag, check_tag, tag_length) != 0 )
        {
            status = PSA_ERROR_INVALID_SIGNATURE;
        }
    }

    mbedtls_psa_aead_abort(operation);

    return ( status );
}

/* Abort an AEAD operation */
psa_status_t mbedtls_psa_aead_abort( psa_aead_operation_t *operation )
{
    switch( operation->alg )
    {
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
        case PSA_ALG_CCM:
            mbedtls_ccm_free( &operation->ctx.ccm );
            break;
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM)
        case PSA_ALG_GCM:
            mbedtls_gcm_free( &operation->ctx.gcm );
            break;
#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305)
        case PSA_ALG_CHACHA20_POLY1305:
            mbedtls_chachapoly_free( &operation->ctx.chachapoly );
            break;
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */
    }

    mbedtls_free(operation->ad_buffer);
    operation->ad_buffer = NULL;
    operation->ad_length = 0;

    mbedtls_free(operation->body_buffer);
    operation->body_buffer = NULL;
    operation->body_length = 0;

    mbedtls_free(operation->tag_buffer);
    operation->tag_buffer = NULL;

    return( PSA_SUCCESS );
}

#endif /* MBEDTLS_PSA_CRYPTO_C */