Add and splice in signature verification through driver
Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
diff --git a/library/psa_crypto.c b/library/psa_crypto.c
index 460b9df..edef287 100644
--- a/library/psa_crypto.c
+++ b/library/psa_crypto.c
@@ -3754,29 +3754,21 @@
{
psa_key_slot_t *slot;
psa_status_t status;
-#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
- const psa_drv_se_t *drv;
- psa_drv_se_context_t *drv_context;
-#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
status = psa_get_key_from_slot( handle, &slot, PSA_KEY_USAGE_VERIFY_HASH, alg );
if( status != PSA_SUCCESS )
return( status );
-#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
- if( psa_get_se_driver( slot->attr.lifetime, &drv, &drv_context ) )
- {
- if( drv->asymmetric == NULL ||
- drv->asymmetric->p_verify == NULL )
- return( PSA_ERROR_NOT_SUPPORTED );
- return( drv->asymmetric->p_verify( drv_context,
- slot->data.se.slot_number,
- alg,
- hash, hash_length,
- signature, signature_length ) );
- }
- else
-#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
+ /* Try any of the available accelerators first */
+ status = psa_driver_wrapper_verify_hash( slot,
+ alg,
+ hash,
+ hash_length,
+ signature,
+ signature_length );
+ if( status != PSA_ERROR_NOT_SUPPORTED )
+ return status;
+
#if defined(MBEDTLS_RSA_C)
if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
{
diff --git a/library/psa_crypto_driver_wrappers.c b/library/psa_crypto_driver_wrappers.c
index 06f3369..09a7ccd 100644
--- a/library/psa_crypto_driver_wrappers.c
+++ b/library/psa_crypto_driver_wrappers.c
@@ -135,4 +135,101 @@
#endif /* MBEDTLS_PSA_CRYPTO_DRIVER_PRESENT */
}
+psa_status_t psa_driver_wrapper_verify_hash( psa_key_slot_t *slot,
+ psa_algorithm_t alg,
+ const uint8_t *hash,
+ size_t hash_length,
+ const uint8_t *signature,
+ size_t signature_length )
+{
+#if defined(MBEDTLS_PSA_CRYPTO_DRIVER_PRESENT)
+ /* Try dynamically-registered SE interface first */
+#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
+ const psa_drv_se_t *drv;
+ psa_drv_se_context_t *drv_context;
+
+ if( psa_get_se_driver( slot->attr.lifetime, &drv, &drv_context ) )
+ {
+ if( drv->asymmetric == NULL ||
+ drv->asymmetric->p_verify == NULL )
+ {
+ /* Key is defined in SE, but we have no way to exercise it */
+ return PSA_ERROR_INVALID_ARGUMENT;
+ }
+ return( drv->asymmetric->p_verify( drv_context,
+ slot->data.se.slot_number,
+ alg,
+ hash, hash_length,
+ signature, signature_length ) );
+ }
+#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
+
+ /* Then try accelerator API */
+#if defined(MBEDTLS_PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
+ psa_status_t status = PSA_ERROR_INVALID_ARGUMENT;
+ psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(slot->attr.lifetime);
+ psa_key_attributes_t attributes = {
+ .core = slot->attr
+ };
+
+ switch( location )
+ {
+ case PSA_KEY_LOCATION_LOCAL_STORAGE:
+ /* Key is stored in the slot in export representation, so
+ * cycle through all known transparent accelerators */
+#if defined(MBEDTLS_TEST_HOOKS)
+ status = test_transparent_signature_verify_hash( &attributes,
+ slot->data.key.data,
+ slot->data.key.bytes,
+ alg,
+ hash,
+ hash_length,
+ signature,
+ signature_length );
+ /* Declared with fallback == true */
+ if( status != PSA_ERROR_NOT_SUPPORTED )
+ return status;
+#endif /* MBEDTLS_TEST_HOOKS */
+ /* Fell through, meaning no accelerator supports this operation */
+ return PSA_ERROR_NOT_SUPPORTED;
+ /* Add cases for opaque driver here */
+#if defined(MBEDTLS_TEST_HOOKS)
+ case MBEDTLS_PSA_CRYPTO_TEST_DRIVER_LIFETIME:
+ return( test_opaque_signature_verify_hash( &attributes,
+ slot->data.key.data,
+ slot->data.key.bytes,
+ alg,
+ hash,
+ hash_length,
+ signature,
+ signature_length ) );
+#endif /* MBEDTLS_TEST_HOOKS */
+ default:
+ /* Key is declared with a lifetime not known to us */
+ return status;
+ }
+#else /* MBEDTLS_PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
+ return PSA_ERROR_NOT_SUPPORTED;
+#endif /* MBEDTLS_PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
+#else /* MBEDTLS_PSA_CRYPTO_DRIVER_PRESENT */
+ (void)slot;
+ (void)alg;
+ (void)hash;
+ (void)hash_length;
+ (void)signature;
+ (void)signature_length;
+
+ return PSA_ERROR_NOT_SUPPORTED;
+#endif /* MBEDTLS_PSA_CRYPTO_DRIVER_PRESENT */
+}
+
+psa_status_t psa_driver_wrapper_generate_key( const psa_key_attributes_t *attributes,
+ psa_key_slot_t *slot )
+{
+ (void) attributes;
+ (void) slot;
+
+ return PSA_ERROR_NOT_SUPPORTED;
+}
+
/* End of automatically generated file. */
diff --git a/library/psa_crypto_driver_wrappers.h b/library/psa_crypto_driver_wrappers.h
index 8fbf034..6ab2d90 100644
--- a/library/psa_crypto_driver_wrappers.h
+++ b/library/psa_crypto_driver_wrappers.h
@@ -35,6 +35,16 @@
size_t signature_size,
size_t *signature_length );
+psa_status_t psa_driver_wrapper_verify_hash( psa_key_slot_t *slot,
+ psa_algorithm_t alg,
+ const uint8_t *hash,
+ size_t hash_length,
+ const uint8_t *signature,
+ size_t signature_length );
+
+psa_status_t psa_driver_wrapper_generate_key( const psa_key_attributes_t *attributes,
+ psa_key_slot_t *slot );
+
#endif /* PSA_CRYPTO_DRIVER_WRAPPERS_H */
/* End of automatically generated file. */