library/psa_crypto_aead.c - mirror/mbed-tls.git - TrustedFirmware Git Browser

 /*
  *  PSA AEAD entry points
  */
 /*
  *  Copyright The Mbed TLS Contributors
  *  SPDX-License-Identifier: Apache-2.0
  *
  *  Licensed under the Apache License, Version 2.0 (the "License"); you may
  *  not use this file except in compliance with the License.
  *  You may obtain a copy of the License at
  *
  *  http://www.apache.org/licenses/LICENSE-2.0
  *
  *  Unless required by applicable law or agreed to in writing, software
  *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  *  See the License for the specific language governing permissions and
  *  limitations under the License.
  */

 #include "common.h"

 #if defined(MBEDTLS_PSA_CRYPTO_C)

 #include "psa_crypto_aead.h"
 #include "psa_crypto_core.h"

 #include "mbedtls/ccm.h"
 #include "mbedtls/chachapoly.h"
 #include "mbedtls/cipher.h"
 #include "mbedtls/gcm.h"

 typedef struct
 {
     union
     {
         unsigned dummy; /* Make the union non-empty even with no supported algorithms. */
 #if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
         mbedtls_ccm_context ccm;
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */
 #if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM)
         mbedtls_gcm_context gcm;
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */
 #if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305)
         mbedtls_chachapoly_context chachapoly;
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */
     } ctx;
     psa_algorithm_t core_alg;
     uint8_t tag_length;
 } aead_operation_t;

 #define AEAD_OPERATION_INIT {{0}, 0, 0}

 static void psa_aead_abort_internal( aead_operation_t *operation )
 {
     switch( operation->core_alg )
     {
 #if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
         case PSA_ALG_CCM:
             mbedtls_ccm_free( &operation->ctx.ccm );
             break;
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */
 #if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM)
         case PSA_ALG_GCM:
             mbedtls_gcm_free( &operation->ctx.gcm );
             break;
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */
 #if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305)
         case PSA_ALG_CHACHA20_POLY1305:
             mbedtls_chachapoly_free( &operation->ctx.chachapoly );
             break;
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */
     }
 }

 static psa_status_t psa_aead_setup(
     aead_operation_t *operation,
     const psa_key_attributes_t *attributes,
     const uint8_t *key_buffer,
     psa_algorithm_t alg )
 {
     psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
     size_t key_bits;
     const mbedtls_cipher_info_t *cipher_info;
     mbedtls_cipher_id_t cipher_id;
     size_t full_tag_length = 0;

     key_bits = attributes->core.bits;

     cipher_info = mbedtls_cipher_info_from_psa( alg,
                                                 attributes->core.type, key_bits,
                                                 &cipher_id );
     if( cipher_info == NULL )
         return( PSA_ERROR_NOT_SUPPORTED );

     switch( PSA_ALG_AEAD_WITH_SHORTENED_TAG( alg, 0 ) )
     {
 #if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
         case PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, 0 ):
             operation->core_alg = PSA_ALG_CCM;
             full_tag_length = 16;
             /* CCM allows the following tag lengths: 4, 6, 8, 10, 12, 14, 16.
              * The call to mbedtls_ccm_encrypt_and_tag or
              * mbedtls_ccm_auth_decrypt will validate the tag length. */
             if( PSA_BLOCK_CIPHER_BLOCK_LENGTH( attributes->core.type ) != 16 )
                 return( PSA_ERROR_INVALID_ARGUMENT );

             mbedtls_ccm_init( &operation->ctx.ccm );
             status = mbedtls_to_psa_error(
                 mbedtls_ccm_setkey( &operation->ctx.ccm, cipher_id,
                                     key_buffer, (unsigned int) key_bits ) );
             if( status != PSA_SUCCESS )
                 return( status );
             break;
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */

 #if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM)
         case PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_GCM, 0 ):
             operation->core_alg = PSA_ALG_GCM;
             full_tag_length = 16;
             /* GCM allows the following tag lengths: 4, 8, 12, 13, 14, 15, 16.
              * The call to mbedtls_gcm_crypt_and_tag or
              * mbedtls_gcm_auth_decrypt will validate the tag length. */
             if( PSA_BLOCK_CIPHER_BLOCK_LENGTH( attributes->core.type ) != 16 )
                 return( PSA_ERROR_INVALID_ARGUMENT );

             mbedtls_gcm_init( &operation->ctx.gcm );
             status = mbedtls_to_psa_error(
                 mbedtls_gcm_setkey( &operation->ctx.gcm, cipher_id,
                                     key_buffer, (unsigned int) key_bits ) );
             if( status != PSA_SUCCESS )
                 return( status );
             break;
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */

 #if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305)
         case PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CHACHA20_POLY1305, 0 ):
             operation->core_alg = PSA_ALG_CHACHA20_POLY1305;
             full_tag_length = 16;
             /* We only support the default tag length. */
             if( alg != PSA_ALG_CHACHA20_POLY1305 )
                 return( PSA_ERROR_NOT_SUPPORTED );

             mbedtls_chachapoly_init( &operation->ctx.chachapoly );
             status = mbedtls_to_psa_error(
                 mbedtls_chachapoly_setkey( &operation->ctx.chachapoly,
                                            key_buffer ) );
             if( status != PSA_SUCCESS )
                 return( status );
             break;
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */

         default:
             return( PSA_ERROR_NOT_SUPPORTED );
     }

     if( PSA_AEAD_TAG_LENGTH( attributes->core.type,
                              key_bits, alg )
         > full_tag_length )
         return( PSA_ERROR_INVALID_ARGUMENT );

     operation->tag_length = PSA_AEAD_TAG_LENGTH( attributes->core.type,
                                                  key_bits,
                                                  alg );

     return( PSA_SUCCESS );
 }

 psa_status_t mbedtls_psa_aead_encrypt(
     const psa_key_attributes_t *attributes,
     const uint8_t *key_buffer, size_t key_buffer_size,
     psa_algorithm_t alg,
     const uint8_t *nonce, size_t nonce_length,
     const uint8_t *additional_data, size_t additional_data_length,
     const uint8_t *plaintext, size_t plaintext_length,
     uint8_t *ciphertext, size_t ciphertext_size, size_t *ciphertext_length )
 {
     psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
     aead_operation_t operation = AEAD_OPERATION_INIT;
     uint8_t *tag;
     (void) key_buffer_size;

     status = psa_aead_setup( &operation, attributes, key_buffer, alg );
     if( status != PSA_SUCCESS )
         goto exit;

     /* For all currently supported modes, the tag is at the end of the
      * ciphertext. */
     if( ciphertext_size < ( plaintext_length + operation.tag_length ) )
     {
         status = PSA_ERROR_BUFFER_TOO_SMALL;
         goto exit;
     }
     tag = ciphertext + plaintext_length;

 #if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
     if( operation.core_alg == PSA_ALG_CCM )
     {
         status = mbedtls_to_psa_error(
             mbedtls_ccm_encrypt_and_tag( &operation.ctx.ccm,
                                          plaintext_length,
                                          nonce, nonce_length,
                                          additional_data,
                                          additional_data_length,
                                          plaintext, ciphertext,
                                          tag, operation.tag_length ) );
     }
     else
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */
 #if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM)
     if( operation.core_alg == PSA_ALG_GCM )
     {
         status = mbedtls_to_psa_error(
             mbedtls_gcm_crypt_and_tag( &operation.ctx.gcm,
                                        MBEDTLS_GCM_ENCRYPT,
                                        plaintext_length,
                                        nonce, nonce_length,
                                        additional_data, additional_data_length,
                                        plaintext, ciphertext,
                                        operation.tag_length, tag ) );
     }
     else
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */
 #if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305)
     if( operation.core_alg == PSA_ALG_CHACHA20_POLY1305 )
     {
         if( nonce_length != 12 || operation.tag_length != 16 )
         {
             status = PSA_ERROR_NOT_SUPPORTED;
             goto exit;
         }
         status = mbedtls_to_psa_error(
             mbedtls_chachapoly_encrypt_and_tag( &operation.ctx.chachapoly,
                                                 plaintext_length,
                                                 nonce,
                                                 additional_data,
                                                 additional_data_length,
                                                 plaintext,
                                                 ciphertext,
                                                 tag ) );
     }
     else
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */
     {
         (void) tag;
         return( PSA_ERROR_NOT_SUPPORTED );
     }

     if( status == PSA_SUCCESS )
         *ciphertext_length = plaintext_length + operation.tag_length;

 exit:
     psa_aead_abort_internal( &operation );

     return( status );
 }

 /* Locate the tag in a ciphertext buffer containing the encrypted data
  * followed by the tag. Return the length of the part preceding the tag in
  * *plaintext_length. This is the size of the plaintext in modes where
  * the encrypted data has the same size as the plaintext, such as
  * CCM and GCM. */
 static psa_status_t psa_aead_unpadded_locate_tag( size_t tag_length,
                                                   const uint8_t *ciphertext,
                                                   size_t ciphertext_length,
                                                   size_t plaintext_size,
                                                   const uint8_t **p_tag )
 {
     size_t payload_length;
     if( tag_length > ciphertext_length )
         return( PSA_ERROR_INVALID_ARGUMENT );
     payload_length = ciphertext_length - tag_length;
     if( payload_length > plaintext_size )
         return( PSA_ERROR_BUFFER_TOO_SMALL );
     *p_tag = ciphertext + payload_length;
     return( PSA_SUCCESS );
 }

 psa_status_t mbedtls_psa_aead_decrypt(
     const psa_key_attributes_t *attributes,
     const uint8_t *key_buffer, size_t key_buffer_size,
     psa_algorithm_t alg,
     const uint8_t *nonce, size_t nonce_length,
     const uint8_t *additional_data, size_t additional_data_length,
     const uint8_t *ciphertext, size_t ciphertext_length,
     uint8_t *plaintext, size_t plaintext_size, size_t *plaintext_length )
 {
     psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
     aead_operation_t operation = AEAD_OPERATION_INIT;
     const uint8_t *tag = NULL;
     (void) key_buffer_size;

     status = psa_aead_setup( &operation, attributes, key_buffer, alg );
     if( status != PSA_SUCCESS )
         goto exit;

     status = psa_aead_unpadded_locate_tag( operation.tag_length,
                                            ciphertext, ciphertext_length,
                                            plaintext_size, &tag );
     if( status != PSA_SUCCESS )
         goto exit;

 #if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
     if( operation.core_alg == PSA_ALG_CCM )
     {
         status = mbedtls_to_psa_error(
             mbedtls_ccm_auth_decrypt( &operation.ctx.ccm,
                                       ciphertext_length - operation.tag_length,
                                       nonce, nonce_length,
                                       additional_data,
                                       additional_data_length,
                                       ciphertext, plaintext,
                                       tag, operation.tag_length ) );
     }
     else
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */
 #if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM)
     if( operation.core_alg == PSA_ALG_GCM )
     {
         status = mbedtls_to_psa_error(
             mbedtls_gcm_auth_decrypt( &operation.ctx.gcm,
                                       ciphertext_length - operation.tag_length,
                                       nonce, nonce_length,
                                       additional_data,
                                       additional_data_length,
                                       tag, operation.tag_length,
                                       ciphertext, plaintext ) );
     }
     else
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */
 #if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305)
     if( operation.core_alg == PSA_ALG_CHACHA20_POLY1305 )
     {
         if( nonce_length != 12 || operation.tag_length != 16 )
         {
             status = PSA_ERROR_NOT_SUPPORTED;
             goto exit;
         }
         status = mbedtls_to_psa_error(
             mbedtls_chachapoly_auth_decrypt( &operation.ctx.chachapoly,
                                              ciphertext_length - operation.tag_length,
                                              nonce,
                                              additional_data,
                                              additional_data_length,
                                              tag,
                                              ciphertext,
                                              plaintext ) );
     }
     else
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */
     {
         return( PSA_ERROR_NOT_SUPPORTED );
     }

     if( status == PSA_SUCCESS )
         *plaintext_length = ciphertext_length - operation.tag_length;

 exit:
     psa_aead_abort_internal( &operation );

     if( status == PSA_SUCCESS )
         *plaintext_length = ciphertext_length - operation.tag_length;
     return( status );
 }

 #endif /* MBEDTLS_PSA_CRYPTO_C */
	/*
	* PSA AEAD entry points
	*/
	/*
	* Copyright The Mbed TLS Contributors
	* SPDX-License-Identifier: Apache-2.0
	*
	* Licensed under the Apache License, Version 2.0 (the "License"); you may
	* not use this file except in compliance with the License.
	* You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
	* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/

	#include "common.h"

	#if defined(MBEDTLS_PSA_CRYPTO_C)

	#include "psa_crypto_aead.h"
	#include "psa_crypto_core.h"

	#include "mbedtls/ccm.h"
	#include "mbedtls/chachapoly.h"
	#include "mbedtls/cipher.h"
	#include "mbedtls/gcm.h"

	typedef struct
	{
	union
	{
	unsigned dummy; /* Make the union non-empty even with no supported algorithms. */
	#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
	mbedtls_ccm_context ccm;
	#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */
	#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM)
	mbedtls_gcm_context gcm;
	#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */
	#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305)
	mbedtls_chachapoly_context chachapoly;
	#endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */
	} ctx;
	psa_algorithm_t core_alg;
	uint8_t tag_length;
	} aead_operation_t;

	#define AEAD_OPERATION_INIT {{0}, 0, 0}

	static void psa_aead_abort_internal( aead_operation_t *operation )
	{
	switch( operation->core_alg )
	{
	#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
	case PSA_ALG_CCM:
	mbedtls_ccm_free( &operation->ctx.ccm );
	break;
	#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */
	#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM)
	case PSA_ALG_GCM:
	mbedtls_gcm_free( &operation->ctx.gcm );
	break;
	#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */
	#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305)
	case PSA_ALG_CHACHA20_POLY1305:
	mbedtls_chachapoly_free( &operation->ctx.chachapoly );
	break;
	#endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */
	}
	}

	static psa_status_t psa_aead_setup(
	aead_operation_t *operation,
	const psa_key_attributes_t *attributes,
	const uint8_t *key_buffer,
	psa_algorithm_t alg )
	{
	psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
	size_t key_bits;
	const mbedtls_cipher_info_t *cipher_info;
	mbedtls_cipher_id_t cipher_id;
	size_t full_tag_length = 0;

	key_bits = attributes->core.bits;

	cipher_info = mbedtls_cipher_info_from_psa( alg,
	attributes->core.type, key_bits,
	&cipher_id );
	if( cipher_info == NULL )
	return( PSA_ERROR_NOT_SUPPORTED );

	switch( PSA_ALG_AEAD_WITH_SHORTENED_TAG( alg, 0 ) )
	{
	#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
	case PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, 0 ):
	operation->core_alg = PSA_ALG_CCM;
	full_tag_length = 16;
	/* CCM allows the following tag lengths: 4, 6, 8, 10, 12, 14, 16.
	* The call to mbedtls_ccm_encrypt_and_tag or
	* mbedtls_ccm_auth_decrypt will validate the tag length. */
	if( PSA_BLOCK_CIPHER_BLOCK_LENGTH( attributes->core.type ) != 16 )
	return( PSA_ERROR_INVALID_ARGUMENT );

	mbedtls_ccm_init( &operation->ctx.ccm );
	status = mbedtls_to_psa_error(
	mbedtls_ccm_setkey( &operation->ctx.ccm, cipher_id,
	key_buffer, (unsigned int) key_bits ) );
	if( status != PSA_SUCCESS )
	return( status );
	break;
	#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */

	#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM)
	case PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_GCM, 0 ):
	operation->core_alg = PSA_ALG_GCM;
	full_tag_length = 16;
	/* GCM allows the following tag lengths: 4, 8, 12, 13, 14, 15, 16.
	* The call to mbedtls_gcm_crypt_and_tag or
	* mbedtls_gcm_auth_decrypt will validate the tag length. */
	if( PSA_BLOCK_CIPHER_BLOCK_LENGTH( attributes->core.type ) != 16 )
	return( PSA_ERROR_INVALID_ARGUMENT );

	mbedtls_gcm_init( &operation->ctx.gcm );
	status = mbedtls_to_psa_error(
	mbedtls_gcm_setkey( &operation->ctx.gcm, cipher_id,
	key_buffer, (unsigned int) key_bits ) );
	if( status != PSA_SUCCESS )
	return( status );
	break;
	#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */

	#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305)
	case PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CHACHA20_POLY1305, 0 ):
	operation->core_alg = PSA_ALG_CHACHA20_POLY1305;
	full_tag_length = 16;
	/* We only support the default tag length. */
	if( alg != PSA_ALG_CHACHA20_POLY1305 )
	return( PSA_ERROR_NOT_SUPPORTED );

	mbedtls_chachapoly_init( &operation->ctx.chachapoly );
	status = mbedtls_to_psa_error(
	mbedtls_chachapoly_setkey( &operation->ctx.chachapoly,
	key_buffer ) );
	if( status != PSA_SUCCESS )
	return( status );
	break;
	#endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */

	default:
	return( PSA_ERROR_NOT_SUPPORTED );
	}

	if( PSA_AEAD_TAG_LENGTH( attributes->core.type,
	key_bits, alg )
	> full_tag_length )
	return( PSA_ERROR_INVALID_ARGUMENT );

	operation->tag_length = PSA_AEAD_TAG_LENGTH( attributes->core.type,
	key_bits,
	alg );

	return( PSA_SUCCESS );
	}

	psa_status_t mbedtls_psa_aead_encrypt(
	const psa_key_attributes_t *attributes,
	const uint8_t *key_buffer, size_t key_buffer_size,
	psa_algorithm_t alg,
	const uint8_t *nonce, size_t nonce_length,
	const uint8_t *additional_data, size_t additional_data_length,
	const uint8_t *plaintext, size_t plaintext_length,
	uint8_t ciphertext, size_t ciphertext_size, size_t ciphertext_length )
	{
	psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
	aead_operation_t operation = AEAD_OPERATION_INIT;
	uint8_t *tag;
	(void) key_buffer_size;

	status = psa_aead_setup( &operation, attributes, key_buffer, alg );
	if( status != PSA_SUCCESS )
	goto exit;

	/* For all currently supported modes, the tag is at the end of the
	* ciphertext. */
	if( ciphertext_size < ( plaintext_length + operation.tag_length ) )
	{
	status = PSA_ERROR_BUFFER_TOO_SMALL;
	goto exit;
	}
	tag = ciphertext + plaintext_length;

	#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
	if( operation.core_alg == PSA_ALG_CCM )
	{
	status = mbedtls_to_psa_error(
	mbedtls_ccm_encrypt_and_tag( &operation.ctx.ccm,
	plaintext_length,
	nonce, nonce_length,
	additional_data,
	additional_data_length,
	plaintext, ciphertext,
	tag, operation.tag_length ) );
	}
	else
	#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */
	#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM)
	if( operation.core_alg == PSA_ALG_GCM )
	{
	status = mbedtls_to_psa_error(
	mbedtls_gcm_crypt_and_tag( &operation.ctx.gcm,
	MBEDTLS_GCM_ENCRYPT,
	plaintext_length,
	nonce, nonce_length,
	additional_data, additional_data_length,
	plaintext, ciphertext,
	operation.tag_length, tag ) );
	}
	else
	#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */
	#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305)
	if( operation.core_alg == PSA_ALG_CHACHA20_POLY1305 )
	{
	if( nonce_length != 12 \|\| operation.tag_length != 16 )
	{
	status = PSA_ERROR_NOT_SUPPORTED;
	goto exit;
	}
	status = mbedtls_to_psa_error(
	mbedtls_chachapoly_encrypt_and_tag( &operation.ctx.chachapoly,
	plaintext_length,
	nonce,
	additional_data,
	additional_data_length,
	plaintext,
	ciphertext,
	tag ) );
	}
	else
	#endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */
	{
	(void) tag;
	return( PSA_ERROR_NOT_SUPPORTED );
	}

	if( status == PSA_SUCCESS )
	*ciphertext_length = plaintext_length + operation.tag_length;

	exit:
	psa_aead_abort_internal( &operation );

	return( status );
	}

	/* Locate the tag in a ciphertext buffer containing the encrypted data
	* followed by the tag. Return the length of the part preceding the tag in
	* *plaintext_length. This is the size of the plaintext in modes where
	* the encrypted data has the same size as the plaintext, such as
	* CCM and GCM. */
	static psa_status_t psa_aead_unpadded_locate_tag( size_t tag_length,
	const uint8_t *ciphertext,
	size_t ciphertext_length,
	size_t plaintext_size,
	const uint8_t **p_tag )
	{
	size_t payload_length;
	if( tag_length > ciphertext_length )
	return( PSA_ERROR_INVALID_ARGUMENT );
	payload_length = ciphertext_length - tag_length;
	if( payload_length > plaintext_size )
	return( PSA_ERROR_BUFFER_TOO_SMALL );
	*p_tag = ciphertext + payload_length;
	return( PSA_SUCCESS );
	}

	psa_status_t mbedtls_psa_aead_decrypt(
	const psa_key_attributes_t *attributes,
	const uint8_t *key_buffer, size_t key_buffer_size,
	psa_algorithm_t alg,
	const uint8_t *nonce, size_t nonce_length,
	const uint8_t *additional_data, size_t additional_data_length,
	const uint8_t *ciphertext, size_t ciphertext_length,
	uint8_t plaintext, size_t plaintext_size, size_t plaintext_length )
	{
	psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
	aead_operation_t operation = AEAD_OPERATION_INIT;
	const uint8_t *tag = NULL;
	(void) key_buffer_size;

	status = psa_aead_setup( &operation, attributes, key_buffer, alg );
	if( status != PSA_SUCCESS )
	goto exit;

	status = psa_aead_unpadded_locate_tag( operation.tag_length,
	ciphertext, ciphertext_length,
	plaintext_size, &tag );
	if( status != PSA_SUCCESS )
	goto exit;

	#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
	if( operation.core_alg == PSA_ALG_CCM )
	{
	status = mbedtls_to_psa_error(
	mbedtls_ccm_auth_decrypt( &operation.ctx.ccm,
	ciphertext_length - operation.tag_length,
	nonce, nonce_length,
	additional_data,
	additional_data_length,
	ciphertext, plaintext,
	tag, operation.tag_length ) );
	}
	else
	#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */
	#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM)
	if( operation.core_alg == PSA_ALG_GCM )
	{
	status = mbedtls_to_psa_error(
	mbedtls_gcm_auth_decrypt( &operation.ctx.gcm,
	ciphertext_length - operation.tag_length,
	nonce, nonce_length,
	additional_data,
	additional_data_length,
	tag, operation.tag_length,
	ciphertext, plaintext ) );
	}
	else
	#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */
	#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305)
	if( operation.core_alg == PSA_ALG_CHACHA20_POLY1305 )
	{
	if( nonce_length != 12 \|\| operation.tag_length != 16 )
	{
	status = PSA_ERROR_NOT_SUPPORTED;
	goto exit;
	}
	status = mbedtls_to_psa_error(
	mbedtls_chachapoly_auth_decrypt( &operation.ctx.chachapoly,
	ciphertext_length - operation.tag_length,
	nonce,
	additional_data,
	additional_data_length,
	tag,
	ciphertext,
	plaintext ) );
	}
	else
	#endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */
	{
	return( PSA_ERROR_NOT_SUPPORTED );
	}

	if( status == PSA_SUCCESS )
	*plaintext_length = ciphertext_length - operation.tag_length;

	exit:
	psa_aead_abort_internal( &operation );

	if( status == PSA_SUCCESS )
	*plaintext_length = ciphertext_length - operation.tag_length;
	return( status );
	}

	#endif /* MBEDTLS_PSA_CRYPTO_C */