Introduce public macro for maximum symmetric cipher key length
This commit introduces the public macro MBEDTLS_MAX_KEY_LENGTH,
which evaluates to an upper bound for the key lengths of all enabled
ciphers, in Bytes.
This is analogous to the already existing macros MBEDTLS_MAX_IV_LENGTH
and MBEDTLS_MAX_BLOCK_LENGTH, which provide upper bounds for the IV
and block length, respectively.
For now, MBEDTLS_MAX_KEY_LENGTH is 32 Bytes by default, and 64 in case
XTS is enabled. This is a strict overapproximation for some restricted
configurations. Ideally, the upper bound should be calculated exactly
and automatically from the list of enabled ciphers. The same applies
to the existing macros MBEDTLS_MAX_IV_LENGTH and MBEDTLS_MAX_BLOCK_LENGTH,
though, and is left for future work.
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
diff --git a/include/mbedtls/cipher.h b/include/mbedtls/cipher.h
index 014786a..8a6c8eb 100644
--- a/include/mbedtls/cipher.h
+++ b/include/mbedtls/cipher.h
@@ -227,10 +227,23 @@
};
/** Maximum length of any IV, in Bytes. */
+/* This should ideally be derived automatically from list of ciphers. */
#define MBEDTLS_MAX_IV_LENGTH 16
+
/** Maximum block size of any cipher, in Bytes. */
+/* This should ideally be derived automatically from list of ciphers. */
#define MBEDTLS_MAX_BLOCK_LENGTH 16
+/** Maximum key length, in Bytes. */
+/* This should ideally be derived automatically from list of ciphers.
+ * For now, only check whether XTS is enabled which uses 64 Byte keys,
+ * and use 32 Bytes as an upper bound for the maximum key length otherwise. */
+#if defined(MBEDTLS_CIPHER_MODE_XTS)
+#define MBEDTLS_MAX_KEY_LENGTH 64
+#else
+#define MBEDTLS_MAX_KEY_LENGTH 32
+#endif /* MBEDTLS_CIPHER_MODE_XTS */
+
/**
* Base cipher information (opaque struct).
*/