blob: 13b8cb0c3c2163462142c33110d2b6b94e93a936 [file] [log] [blame]
Gilles Peskinee59236f2018-01-27 23:32:46 +01001/*
2 * PSA crypto layer on top of Mbed TLS crypto
3 */
Bence Szépkúti86974652020-06-15 11:59:37 +02004/*
Bence Szépkúti1e148272020-08-07 13:07:28 +02005 * Copyright The Mbed TLS Contributors
Gilles Peskinee59236f2018-01-27 23:32:46 +01006 * SPDX-License-Identifier: Apache-2.0
7 *
8 * Licensed under the Apache License, Version 2.0 (the "License"); you may
9 * not use this file except in compliance with the License.
10 * You may obtain a copy of the License at
11 *
12 * http://www.apache.org/licenses/LICENSE-2.0
13 *
14 * Unless required by applicable law or agreed to in writing, software
15 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
16 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17 * See the License for the specific language governing permissions and
18 * limitations under the License.
Gilles Peskinee59236f2018-01-27 23:32:46 +010019 */
20
Gilles Peskinedb09ef62020-06-03 01:43:33 +020021#include "common.h"
Ronald Cronafbc7ed2023-01-24 16:02:04 +010022#include "psa_crypto_core_common.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010023
24#if defined(MBEDTLS_PSA_CRYPTO_C)
mohammad160327010052018-07-03 13:16:15 +030025
John Durkop07cc04a2020-11-16 22:08:34 -080026#if defined(MBEDTLS_PSA_CRYPTO_CONFIG)
27#include "check_crypto_config.h"
28#endif
29
Gilles Peskinee59236f2018-01-27 23:32:46 +010030#include "psa/crypto.h"
Przemyslaw Stekiel705fb0f2021-11-24 08:47:29 +010031#include "psa/crypto_values.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010032
Ronald Crond6d28882020-12-14 14:56:02 +010033#include "psa_crypto_cipher.h"
Gilles Peskine039b90c2018-12-07 18:24:41 +010034#include "psa_crypto_core.h"
Gilles Peskine5e769522018-11-20 21:59:56 +010035#include "psa_crypto_invasive.h"
Steven Cooremancd84cb42020-07-16 20:28:36 +020036#include "psa_crypto_driver_wrappers.h"
Ronald Cron00b7bfc2020-11-25 15:25:26 +010037#include "psa_crypto_ecp.h"
Przemek Stekiel359f4622022-12-05 14:11:55 +010038#include "psa_crypto_ffdh.h"
Steven Cooreman5f88e772021-03-15 11:07:12 +010039#include "psa_crypto_hash.h"
Steven Cooreman82c66b62021-03-19 17:39:17 +010040#include "psa_crypto_mac.h"
Ronald Cron00b7bfc2020-11-25 15:25:26 +010041#include "psa_crypto_rsa.h"
Ronald Cron7023db52020-11-20 18:17:42 +010042#include "psa_crypto_ecp.h"
Gilles Peskinea8ade162019-06-26 11:24:49 +020043#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined0890212019-06-24 14:34:43 +020044#include "psa_crypto_se.h"
Gilles Peskinea8ade162019-06-26 11:24:49 +020045#endif
Gilles Peskine961849f2018-11-30 18:54:54 +010046#include "psa_crypto_slot_management.h"
Darryl Greend49a4992018-06-18 17:27:26 +010047/* Include internal declarations that are useful for implementing persistently
48 * stored keys. */
49#include "psa_crypto_storage.h"
50
Gilles Peskineb2b64d32020-12-14 16:43:58 +010051#include "psa_crypto_random_impl.h"
Gilles Peskine90edc992020-11-13 15:39:19 +010052
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010053#include <stdlib.h>
54#include <string.h>
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010055#include "mbedtls/platform.h"
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010056
Gilles Peskine1c49f1a2020-11-13 18:46:25 +010057#include "mbedtls/aes.h"
Gilles Peskine9a944802018-06-21 09:35:35 +020058#include "mbedtls/asn1.h"
Jaeden Amero25384a22019-01-10 10:23:21 +000059#include "mbedtls/asn1write.h"
Gilles Peskinea81d85b2018-06-26 16:10:23 +020060#include "mbedtls/bignum.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010061#include "mbedtls/camellia.h"
Gilles Peskine26869f22019-05-06 15:25:00 +020062#include "mbedtls/chacha20.h"
63#include "mbedtls/chachapoly.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010064#include "mbedtls/cipher.h"
65#include "mbedtls/ccm.h"
66#include "mbedtls/cmac.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010067#include "mbedtls/des.h"
Gilles Peskineb7ecdf02018-09-18 12:11:27 +020068#include "mbedtls/ecdh.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010069#include "mbedtls/ecp.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010070#include "mbedtls/entropy.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010071#include "mbedtls/error.h"
72#include "mbedtls/gcm.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010073#include "mbedtls/md5.h"
Gilles Peskine20035e32018-02-03 22:44:14 +010074#include "mbedtls/md.h"
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010075#include "mbedtls/pk.h"
Chris Jonesdaacb592021-03-09 17:03:29 +000076#include "pk_wrap.h"
Gilles Peskine3f108122018-12-07 18:14:53 +010077#include "mbedtls/platform_util.h"
Janos Follath24eed8d2019-11-22 13:21:35 +000078#include "mbedtls/error.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010079#include "mbedtls/ripemd160.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010080#include "mbedtls/rsa.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010081#include "mbedtls/sha1.h"
82#include "mbedtls/sha256.h"
83#include "mbedtls/sha512.h"
Manuel Pégourié-Gonnard02b10d82023-03-28 12:33:20 +020084#include "md_psa.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010085
Gilles Peskine449bd832023-01-11 14:50:10 +010086#define ARRAY_LENGTH(array) (sizeof(array) / sizeof(*(array)))
Gilles Peskine996deb12018-08-01 15:45:45 +020087
Przemek Stekiel75fe3fb2022-06-09 14:44:55 +020088#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF) || \
89 defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) || \
90 defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Przemek Stekiel69c46792022-06-10 12:59:51 +020091#define BUILTIN_ALG_ANY_HKDF 1
Przemek Stekiel75fe3fb2022-06-09 14:44:55 +020092#endif
93
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010094/****************************************************************/
95/* Global data, support functions and library management */
96/****************************************************************/
97
Gilles Peskine449bd832023-01-11 14:50:10 +010098static int key_type_is_raw_bytes(psa_key_type_t type)
Gilles Peskine48c0ea12018-06-21 14:15:31 +020099{
Gilles Peskine449bd832023-01-11 14:50:10 +0100100 return PSA_KEY_TYPE_IS_UNSTRUCTURED(type);
Gilles Peskine48c0ea12018-06-21 14:15:31 +0200101}
102
Gilles Peskine5a3c50e2018-12-04 12:27:09 +0100103/* Values for psa_global_data_t::rng_state */
104#define RNG_NOT_INITIALIZED 0
105#define RNG_INITIALIZED 1
106#define RNG_SEEDED 2
Gilles Peskinec6b69072018-11-20 21:42:52 +0100107
Gilles Peskine449bd832023-01-11 14:50:10 +0100108typedef struct {
Gilles Peskinec6b69072018-11-20 21:42:52 +0100109 unsigned initialized : 1;
Gilles Peskine5a3c50e2018-12-04 12:27:09 +0100110 unsigned rng_state : 2;
Manuel Pégourié-Gonnard7abdf7e2023-03-09 11:17:43 +0100111 unsigned drivers_initialized : 1;
Gilles Peskine2d8a1822021-11-08 22:20:03 +0100112 mbedtls_psa_random_context_t rng;
Gilles Peskinee59236f2018-01-27 23:32:46 +0100113} psa_global_data_t;
114
115static psa_global_data_t global_data;
116
Gilles Peskine5894e8e2020-12-14 14:54:06 +0100117#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
118mbedtls_psa_drbg_context_t *const mbedtls_psa_random_state =
119 &global_data.rng.drbg;
120#endif
121
itayzafrir0adf0fc2018-09-06 16:24:41 +0300122#define GUARD_MODULE_INITIALIZED \
Gilles Peskine449bd832023-01-11 14:50:10 +0100123 if (global_data.initialized == 0) \
124 return PSA_ERROR_BAD_STATE;
itayzafrir0adf0fc2018-09-06 16:24:41 +0300125
Manuel Pégourié-Gonnard7abdf7e2023-03-09 11:17:43 +0100126int psa_can_do_hash(psa_algorithm_t hash_alg)
127{
128 (void) hash_alg;
129 return global_data.drivers_initialized;
130}
Valerio Setti8bb57632023-05-26 13:48:07 +0200131#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_LEGACY) || \
Przemek Stekiel53410502023-04-28 13:18:43 +0200132 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) || \
Valerio Setti8bb57632023-05-26 13:48:07 +0200133 defined(MBEDTLS_PSA_WANT_KEY_TYPE_DH_KEY_PAIR_LEGACY)
Przemek Stekiel134cc2e2023-05-05 10:13:37 +0200134static int psa_is_dh_key_size_valid(size_t bits)
135{
Przemek Stekield1cf1ba2023-04-27 12:04:21 +0200136 if (bits != 2048 && bits != 3072 && bits != 4096 &&
137 bits != 6144 && bits != 8192) {
138 return 0;
139 }
140
141 return 1;
142}
Valerio Setti8bb57632023-05-26 13:48:07 +0200143#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_LEGACY ||
Przemek Stekiel53410502023-04-28 13:18:43 +0200144 MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY ||
Valerio Setti8bb57632023-05-26 13:48:07 +0200145 MBEDTLS_PSA_WANT_KEY_TYPE_DH_KEY_PAIR_LEGACY */
Manuel Pégourié-Gonnard7abdf7e2023-03-09 11:17:43 +0100146
Gilles Peskine449bd832023-01-11 14:50:10 +0100147psa_status_t mbedtls_to_psa_error(int ret)
Gilles Peskinee59236f2018-01-27 23:32:46 +0100148{
Gilles Peskinedbf68962021-01-06 20:04:23 +0100149 /* Mbed TLS error codes can combine a high-level error code and a
150 * low-level error code. The low-level error usually reflects the
151 * root cause better, so dispatch on that preferably. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100152 int low_level_ret = -(-ret & 0x007f);
153 switch (low_level_ret != 0 ? low_level_ret : ret) {
Gilles Peskinee59236f2018-01-27 23:32:46 +0100154 case 0:
Gilles Peskine449bd832023-01-11 14:50:10 +0100155 return PSA_SUCCESS;
Gilles Peskinea5905292018-02-07 20:59:33 +0100156
157 case MBEDTLS_ERR_AES_INVALID_KEY_LENGTH:
158 case MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100159 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine9a944802018-06-21 09:35:35 +0200160 case MBEDTLS_ERR_ASN1_OUT_OF_DATA:
161 case MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:
162 case MBEDTLS_ERR_ASN1_INVALID_LENGTH:
163 case MBEDTLS_ERR_ASN1_LENGTH_MISMATCH:
164 case MBEDTLS_ERR_ASN1_INVALID_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100165 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine9a944802018-06-21 09:35:35 +0200166 case MBEDTLS_ERR_ASN1_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100167 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskine9a944802018-06-21 09:35:35 +0200168 case MBEDTLS_ERR_ASN1_BUF_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100169 return PSA_ERROR_BUFFER_TOO_SMALL;
Gilles Peskine9a944802018-06-21 09:35:35 +0200170
Jaeden Amero93e21112019-02-20 13:57:28 +0000171#if defined(MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA)
Jaeden Amero892cd6d2019-02-11 12:21:12 +0000172 case MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA:
Jaeden Amero93e21112019-02-20 13:57:28 +0000173#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100174 case MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100175 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100176
177 case MBEDTLS_ERR_CCM_BAD_INPUT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100178 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100179 case MBEDTLS_ERR_CCM_AUTH_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100180 return PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskinea5905292018-02-07 20:59:33 +0100181
Gilles Peskine26869f22019-05-06 15:25:00 +0200182 case MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100183 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine26869f22019-05-06 15:25:00 +0200184
185 case MBEDTLS_ERR_CHACHAPOLY_BAD_STATE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100186 return PSA_ERROR_BAD_STATE;
Gilles Peskine26869f22019-05-06 15:25:00 +0200187 case MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100188 return PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskine26869f22019-05-06 15:25:00 +0200189
Gilles Peskinea5905292018-02-07 20:59:33 +0100190 case MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100191 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100192 case MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100193 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100194 case MBEDTLS_ERR_CIPHER_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100195 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskinea5905292018-02-07 20:59:33 +0100196 case MBEDTLS_ERR_CIPHER_INVALID_PADDING:
Gilles Peskine449bd832023-01-11 14:50:10 +0100197 return PSA_ERROR_INVALID_PADDING;
Gilles Peskinea5905292018-02-07 20:59:33 +0100198 case MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100199 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100200 case MBEDTLS_ERR_CIPHER_AUTH_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100201 return PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskinea5905292018-02-07 20:59:33 +0100202 case MBEDTLS_ERR_CIPHER_INVALID_CONTEXT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100203 return PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100204
Gilles Peskine449bd832023-01-11 14:50:10 +0100205#if !(defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) || \
206 defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE))
Gilles Peskinebee96c82020-11-23 21:00:09 +0100207 /* Only check CTR_DRBG error codes if underlying mbedtls_xxx
208 * functions are passed a CTR_DRBG instance. */
Gilles Peskinea5905292018-02-07 20:59:33 +0100209 case MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100210 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskinea5905292018-02-07 20:59:33 +0100211 case MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG:
212 case MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG:
Gilles Peskine449bd832023-01-11 14:50:10 +0100213 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100214 case MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100215 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskine82e57d12020-11-13 21:31:17 +0100216#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100217
218 case MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100219 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100220
Gilles Peskinee59236f2018-01-27 23:32:46 +0100221 case MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED:
222 case MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE:
223 case MBEDTLS_ERR_ENTROPY_SOURCE_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100224 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskinea5905292018-02-07 20:59:33 +0100225
226 case MBEDTLS_ERR_GCM_AUTH_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100227 return PSA_ERROR_INVALID_SIGNATURE;
Mateusz Starzykf28261f2021-09-30 16:39:07 +0200228 case MBEDTLS_ERR_GCM_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100229 return PSA_ERROR_BUFFER_TOO_SMALL;
Gilles Peskinea5905292018-02-07 20:59:33 +0100230 case MBEDTLS_ERR_GCM_BAD_INPUT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100231 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100232
Gilles Peskine82e57d12020-11-13 21:31:17 +0100233#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) && \
Gilles Peskine449bd832023-01-11 14:50:10 +0100234 defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE)
Gilles Peskinebee96c82020-11-23 21:00:09 +0100235 /* Only check HMAC_DRBG error codes if underlying mbedtls_xxx
236 * functions are passed a HMAC_DRBG instance. */
Gilles Peskine82e57d12020-11-13 21:31:17 +0100237 case MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100238 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskine82e57d12020-11-13 21:31:17 +0100239 case MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG:
240 case MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG:
Gilles Peskine449bd832023-01-11 14:50:10 +0100241 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine82e57d12020-11-13 21:31:17 +0100242 case MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100243 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskine82e57d12020-11-13 21:31:17 +0100244#endif
245
Gilles Peskinea5905292018-02-07 20:59:33 +0100246 case MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100247 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100248 case MBEDTLS_ERR_MD_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100249 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100250 case MBEDTLS_ERR_MD_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100251 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskinea5905292018-02-07 20:59:33 +0100252 case MBEDTLS_ERR_MD_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100253 return PSA_ERROR_STORAGE_FAILURE;
Gilles Peskinea5905292018-02-07 20:59:33 +0100254
Gilles Peskinef76aa772018-10-29 19:24:33 +0100255 case MBEDTLS_ERR_MPI_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100256 return PSA_ERROR_STORAGE_FAILURE;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100257 case MBEDTLS_ERR_MPI_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100258 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100259 case MBEDTLS_ERR_MPI_INVALID_CHARACTER:
Gilles Peskine449bd832023-01-11 14:50:10 +0100260 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100261 case MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100262 return PSA_ERROR_BUFFER_TOO_SMALL;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100263 case MBEDTLS_ERR_MPI_NEGATIVE_VALUE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100264 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100265 case MBEDTLS_ERR_MPI_DIVISION_BY_ZERO:
Gilles Peskine449bd832023-01-11 14:50:10 +0100266 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100267 case MBEDTLS_ERR_MPI_NOT_ACCEPTABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100268 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100269 case MBEDTLS_ERR_MPI_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100270 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100271
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100272 case MBEDTLS_ERR_PK_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100273 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100274 case MBEDTLS_ERR_PK_TYPE_MISMATCH:
275 case MBEDTLS_ERR_PK_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100276 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100277 case MBEDTLS_ERR_PK_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100278 return PSA_ERROR_STORAGE_FAILURE;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100279 case MBEDTLS_ERR_PK_KEY_INVALID_VERSION:
280 case MBEDTLS_ERR_PK_KEY_INVALID_FORMAT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100281 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100282 case MBEDTLS_ERR_PK_UNKNOWN_PK_ALG:
Gilles Peskine449bd832023-01-11 14:50:10 +0100283 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100284 case MBEDTLS_ERR_PK_PASSWORD_REQUIRED:
285 case MBEDTLS_ERR_PK_PASSWORD_MISMATCH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100286 return PSA_ERROR_NOT_PERMITTED;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100287 case MBEDTLS_ERR_PK_INVALID_PUBKEY:
Gilles Peskine449bd832023-01-11 14:50:10 +0100288 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100289 case MBEDTLS_ERR_PK_INVALID_ALG:
290 case MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE:
291 case MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100292 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100293 case MBEDTLS_ERR_PK_SIG_LEN_MISMATCH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100294 return PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskinef9f1bdf2021-06-23 20:32:27 +0200295 case MBEDTLS_ERR_PK_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100296 return PSA_ERROR_BUFFER_TOO_SMALL;
Gilles Peskinea5905292018-02-07 20:59:33 +0100297
Gilles Peskineff2d2002019-05-06 15:26:23 +0200298 case MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100299 return PSA_ERROR_HARDWARE_FAILURE;
Gilles Peskineff2d2002019-05-06 15:26:23 +0200300 case MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100301 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskineff2d2002019-05-06 15:26:23 +0200302
Gilles Peskinea5905292018-02-07 20:59:33 +0100303 case MBEDTLS_ERR_RSA_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100304 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100305 case MBEDTLS_ERR_RSA_INVALID_PADDING:
Gilles Peskine449bd832023-01-11 14:50:10 +0100306 return PSA_ERROR_INVALID_PADDING;
Gilles Peskinea5905292018-02-07 20:59:33 +0100307 case MBEDTLS_ERR_RSA_KEY_GEN_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100308 return PSA_ERROR_HARDWARE_FAILURE;
Gilles Peskinea5905292018-02-07 20:59:33 +0100309 case MBEDTLS_ERR_RSA_KEY_CHECK_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100310 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100311 case MBEDTLS_ERR_RSA_PUBLIC_FAILED:
312 case MBEDTLS_ERR_RSA_PRIVATE_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100313 return PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100314 case MBEDTLS_ERR_RSA_VERIFY_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100315 return PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskinea5905292018-02-07 20:59:33 +0100316 case MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100317 return PSA_ERROR_BUFFER_TOO_SMALL;
Gilles Peskinea5905292018-02-07 20:59:33 +0100318 case MBEDTLS_ERR_RSA_RNG_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100319 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Manuel Pégourié-Gonnard93c08472021-04-15 12:23:55 +0200320
itayzafrir5c753392018-05-08 11:18:38 +0300321 case MBEDTLS_ERR_ECP_BAD_INPUT_DATA:
itayzafrir7b30f8b2018-05-09 16:07:36 +0300322 case MBEDTLS_ERR_ECP_INVALID_KEY:
Gilles Peskine449bd832023-01-11 14:50:10 +0100323 return PSA_ERROR_INVALID_ARGUMENT;
itayzafrir7b30f8b2018-05-09 16:07:36 +0300324 case MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100325 return PSA_ERROR_BUFFER_TOO_SMALL;
itayzafrir7b30f8b2018-05-09 16:07:36 +0300326 case MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100327 return PSA_ERROR_NOT_SUPPORTED;
itayzafrir7b30f8b2018-05-09 16:07:36 +0300328 case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH:
329 case MBEDTLS_ERR_ECP_VERIFY_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100330 return PSA_ERROR_INVALID_SIGNATURE;
itayzafrir7b30f8b2018-05-09 16:07:36 +0300331 case MBEDTLS_ERR_ECP_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100332 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskine40d81602020-11-25 00:09:47 +0100333 case MBEDTLS_ERR_ECP_RANDOM_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100334 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskine40d81602020-11-25 00:09:47 +0100335
Paul Elliott588f8ed2022-12-02 18:10:26 +0000336 case MBEDTLS_ERR_ECP_IN_PROGRESS:
337 return PSA_OPERATION_INCOMPLETE;
338
Janos Follatha13b9052019-11-22 12:48:59 +0000339 case MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100340 return PSA_ERROR_CORRUPTION_DETECTED;
itayzafrir5c753392018-05-08 11:18:38 +0300341
Gilles Peskinee59236f2018-01-27 23:32:46 +0100342 default:
Gilles Peskine449bd832023-01-11 14:50:10 +0100343 return PSA_ERROR_GENERIC_ERROR;
Gilles Peskinee59236f2018-01-27 23:32:46 +0100344 }
345}
346
Paul Elliottdc42ca82023-02-24 18:11:59 +0000347/**
348 * \brief For output buffers which contain "tags"
349 * (outputs that may be checked for validity like
350 * hashes, MACs and signatures), fill the unused
351 * part of the output buffer (the whole buffer on
352 * error, the trailing part on success) with
353 * something that isn't a valid tag (barring an
354 * attack on the tag and deliberately-crafted
355 * input), in case the caller doesn't check the
356 * return status properly.
357 *
358 * \param output_buffer Pointer to buffer to wipe. May not be NULL
359 * unless \p output_buffer_size is zero.
360 * \param status Status of function called to generate
361 * output_buffer originally
362 * \param output_buffer_size Size of output buffer. If zero, \p output_buffer
363 * could be NULL.
364 * \param output_buffer_length Length of data written to output_buffer, must be
365 * less than \p output_buffer_size
366 */
367static void psa_wipe_tag_output_buffer(uint8_t *output_buffer, psa_status_t status,
Paul Elliott7118d172023-02-26 16:57:05 +0000368 size_t output_buffer_size, size_t output_buffer_length)
369{
Paul Elliottdc42ca82023-02-24 18:11:59 +0000370 size_t offset = 0;
371
372 if (output_buffer_size == 0) {
373 /* If output_buffer_size is 0 then we have nothing to do. We must not
374 call memset because output_buffer may be NULL in this case */
375 return;
376 }
377
378 if (status == PSA_SUCCESS) {
379 offset = output_buffer_length;
380 }
381
382 memset(output_buffer + offset, '!', output_buffer_size - offset);
383}
384
Gilles Peskineb0b255c2018-07-06 17:01:38 +0200385
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +0200386
387
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100388/****************************************************************/
389/* Key management */
390/****************************************************************/
391
Valerio Settid4a5d462023-04-05 18:19:01 +0200392#if defined(MBEDTLS_ECP_LIGHT)
Gilles Peskine449bd832023-01-11 14:50:10 +0100393mbedtls_ecp_group_id mbedtls_ecc_group_of_psa(psa_ecc_family_t curve,
394 size_t bits,
395 int bits_is_sloppy)
Gilles Peskine12313cd2018-06-20 00:20:32 +0200396{
Gilles Peskine449bd832023-01-11 14:50:10 +0100397 switch (curve) {
Paul Elliott8ff510a2020-06-02 17:19:28 +0100398 case PSA_ECC_FAMILY_SECP_R1:
Gilles Peskine449bd832023-01-11 14:50:10 +0100399 switch (bits) {
Gilles Peskinea1684f42021-03-23 13:12:34 +0100400#if defined(PSA_WANT_ECC_SECP_R1_192)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100401 case 192:
Gilles Peskine449bd832023-01-11 14:50:10 +0100402 return MBEDTLS_ECP_DP_SECP192R1;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100403#endif
404#if defined(PSA_WANT_ECC_SECP_R1_224)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100405 case 224:
Gilles Peskine449bd832023-01-11 14:50:10 +0100406 return MBEDTLS_ECP_DP_SECP224R1;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100407#endif
408#if defined(PSA_WANT_ECC_SECP_R1_256)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100409 case 256:
Gilles Peskine449bd832023-01-11 14:50:10 +0100410 return MBEDTLS_ECP_DP_SECP256R1;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100411#endif
412#if defined(PSA_WANT_ECC_SECP_R1_384)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100413 case 384:
Gilles Peskine449bd832023-01-11 14:50:10 +0100414 return MBEDTLS_ECP_DP_SECP384R1;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100415#endif
416#if defined(PSA_WANT_ECC_SECP_R1_521)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100417 case 521:
Gilles Peskine449bd832023-01-11 14:50:10 +0100418 return MBEDTLS_ECP_DP_SECP521R1;
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100419 case 528:
Gilles Peskine449bd832023-01-11 14:50:10 +0100420 if (bits_is_sloppy) {
421 return MBEDTLS_ECP_DP_SECP521R1;
422 }
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100423 break;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100424#endif
Gilles Peskine228abc52019-12-03 17:24:19 +0100425 }
426 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100427
Paul Elliott8ff510a2020-06-02 17:19:28 +0100428 case PSA_ECC_FAMILY_BRAINPOOL_P_R1:
Gilles Peskine449bd832023-01-11 14:50:10 +0100429 switch (bits) {
Gilles Peskinea1684f42021-03-23 13:12:34 +0100430#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100431 case 256:
Gilles Peskine449bd832023-01-11 14:50:10 +0100432 return MBEDTLS_ECP_DP_BP256R1;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100433#endif
434#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100435 case 384:
Gilles Peskine449bd832023-01-11 14:50:10 +0100436 return MBEDTLS_ECP_DP_BP384R1;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100437#endif
438#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100439 case 512:
Gilles Peskine449bd832023-01-11 14:50:10 +0100440 return MBEDTLS_ECP_DP_BP512R1;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100441#endif
Gilles Peskine228abc52019-12-03 17:24:19 +0100442 }
443 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100444
Paul Elliott8ff510a2020-06-02 17:19:28 +0100445 case PSA_ECC_FAMILY_MONTGOMERY:
Gilles Peskine449bd832023-01-11 14:50:10 +0100446 switch (bits) {
Gilles Peskinea1684f42021-03-23 13:12:34 +0100447#if defined(PSA_WANT_ECC_MONTGOMERY_255)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100448 case 255:
Gilles Peskine449bd832023-01-11 14:50:10 +0100449 return MBEDTLS_ECP_DP_CURVE25519;
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100450 case 256:
Gilles Peskine449bd832023-01-11 14:50:10 +0100451 if (bits_is_sloppy) {
452 return MBEDTLS_ECP_DP_CURVE25519;
453 }
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100454 break;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100455#endif
456#if defined(PSA_WANT_ECC_MONTGOMERY_448)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100457 case 448:
Gilles Peskine449bd832023-01-11 14:50:10 +0100458 return MBEDTLS_ECP_DP_CURVE448;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100459#endif
Gilles Peskine228abc52019-12-03 17:24:19 +0100460 }
461 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100462
Paul Elliott8ff510a2020-06-02 17:19:28 +0100463 case PSA_ECC_FAMILY_SECP_K1:
Gilles Peskine449bd832023-01-11 14:50:10 +0100464 switch (bits) {
Gilles Peskinea1684f42021-03-23 13:12:34 +0100465#if defined(PSA_WANT_ECC_SECP_K1_192)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100466 case 192:
Gilles Peskine449bd832023-01-11 14:50:10 +0100467 return MBEDTLS_ECP_DP_SECP192K1;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100468#endif
469#if defined(PSA_WANT_ECC_SECP_K1_224)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100470 case 224:
Gilles Peskine449bd832023-01-11 14:50:10 +0100471 return MBEDTLS_ECP_DP_SECP224K1;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100472#endif
473#if defined(PSA_WANT_ECC_SECP_K1_256)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100474 case 256:
Gilles Peskine449bd832023-01-11 14:50:10 +0100475 return MBEDTLS_ECP_DP_SECP256K1;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100476#endif
Gilles Peskine228abc52019-12-03 17:24:19 +0100477 }
478 break;
Gilles Peskine12313cd2018-06-20 00:20:32 +0200479 }
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100480
Gilles Peskine71f45ba2021-03-23 14:17:55 +0100481 (void) bits_is_sloppy;
Gilles Peskine449bd832023-01-11 14:50:10 +0100482 return MBEDTLS_ECP_DP_NONE;
Gilles Peskine12313cd2018-06-20 00:20:32 +0200483}
Valerio Settid4a5d462023-04-05 18:19:01 +0200484#endif /* MBEDTLS_ECP_LIGHT */
Gilles Peskine12313cd2018-06-20 00:20:32 +0200485
Gilles Peskine449bd832023-01-11 14:50:10 +0100486psa_status_t psa_validate_unstructured_key_bit_size(psa_key_type_t type,
487 size_t bits)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200488{
489 /* Check that the bit size is acceptable for the key type */
Gilles Peskine449bd832023-01-11 14:50:10 +0100490 switch (type) {
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200491 case PSA_KEY_TYPE_RAW_DATA:
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200492 case PSA_KEY_TYPE_HMAC:
Gilles Peskineea0fb492018-07-12 17:17:20 +0200493 case PSA_KEY_TYPE_DERIVE:
Neil Armstrong4b5710f2022-05-25 11:30:27 +0200494 case PSA_KEY_TYPE_PASSWORD:
495 case PSA_KEY_TYPE_PASSWORD_HASH:
Gilles Peskineea0fb492018-07-12 17:17:20 +0200496 break;
Ronald Cron1f0db802021-03-12 09:59:30 +0100497#if defined(PSA_WANT_KEY_TYPE_AES)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200498 case PSA_KEY_TYPE_AES:
Gilles Peskine449bd832023-01-11 14:50:10 +0100499 if (bits != 128 && bits != 192 && bits != 256) {
500 return PSA_ERROR_INVALID_ARGUMENT;
501 }
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200502 break;
503#endif
Gilles Peskine6c12a1e2021-09-21 11:59:39 +0200504#if defined(PSA_WANT_KEY_TYPE_ARIA)
505 case PSA_KEY_TYPE_ARIA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100506 if (bits != 128 && bits != 192 && bits != 256) {
507 return PSA_ERROR_INVALID_ARGUMENT;
508 }
Gilles Peskine6c12a1e2021-09-21 11:59:39 +0200509 break;
510#endif
Ronald Cron1f0db802021-03-12 09:59:30 +0100511#if defined(PSA_WANT_KEY_TYPE_CAMELLIA)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200512 case PSA_KEY_TYPE_CAMELLIA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100513 if (bits != 128 && bits != 192 && bits != 256) {
514 return PSA_ERROR_INVALID_ARGUMENT;
515 }
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200516 break;
517#endif
Ronald Cron1f0db802021-03-12 09:59:30 +0100518#if defined(PSA_WANT_KEY_TYPE_DES)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200519 case PSA_KEY_TYPE_DES:
Gilles Peskine449bd832023-01-11 14:50:10 +0100520 if (bits != 64 && bits != 128 && bits != 192) {
521 return PSA_ERROR_INVALID_ARGUMENT;
522 }
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200523 break;
524#endif
Ronald Cron1f0db802021-03-12 09:59:30 +0100525#if defined(PSA_WANT_KEY_TYPE_CHACHA20)
Gilles Peskine26869f22019-05-06 15:25:00 +0200526 case PSA_KEY_TYPE_CHACHA20:
Gilles Peskine449bd832023-01-11 14:50:10 +0100527 if (bits != 256) {
528 return PSA_ERROR_INVALID_ARGUMENT;
529 }
Gilles Peskine26869f22019-05-06 15:25:00 +0200530 break;
531#endif
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200532 default:
Gilles Peskine449bd832023-01-11 14:50:10 +0100533 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200534 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100535 if (bits % 8 != 0) {
536 return PSA_ERROR_INVALID_ARGUMENT;
537 }
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200538
Gilles Peskine449bd832023-01-11 14:50:10 +0100539 return PSA_SUCCESS;
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200540}
541
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100542/** Check whether a given key type is valid for use with a given MAC algorithm
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100543 *
Steven Cooremancd640932021-03-08 12:00:27 +0100544 * Upon successful return of this function, the behavior of #PSA_MAC_LENGTH
545 * when called with the validated \p algorithm and \p key_type is well-defined.
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100546 *
547 * \param[in] algorithm The specific MAC algorithm (can be wildcard).
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100548 * \param[in] key_type The key type of the key to be used with the
549 * \p algorithm.
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100550 *
551 * \retval #PSA_SUCCESS
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100552 * The \p key_type is valid for use with the \p algorithm
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100553 * \retval #PSA_ERROR_INVALID_ARGUMENT
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100554 * The \p key_type is not valid for use with the \p algorithm
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100555 */
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100556MBEDTLS_STATIC_TESTABLE psa_status_t psa_mac_key_can_do(
Steven Cooreman58c94d32021-03-02 21:31:17 +0100557 psa_algorithm_t algorithm,
Gilles Peskine449bd832023-01-11 14:50:10 +0100558 psa_key_type_t key_type)
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100559{
Gilles Peskine449bd832023-01-11 14:50:10 +0100560 if (PSA_ALG_IS_HMAC(algorithm)) {
561 if (key_type == PSA_KEY_TYPE_HMAC) {
562 return PSA_SUCCESS;
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100563 }
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100564 }
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100565
Gilles Peskine449bd832023-01-11 14:50:10 +0100566 if (PSA_ALG_IS_BLOCK_CIPHER_MAC(algorithm)) {
567 /* Check that we're calling PSA_BLOCK_CIPHER_BLOCK_LENGTH with a cipher
568 * key. */
569 if ((key_type & PSA_KEY_TYPE_CATEGORY_MASK) ==
570 PSA_KEY_TYPE_CATEGORY_SYMMETRIC) {
571 /* PSA_BLOCK_CIPHER_BLOCK_LENGTH returns 1 for stream ciphers and
572 * the block length (larger than 1) for block ciphers. */
573 if (PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type) > 1) {
574 return PSA_SUCCESS;
575 }
576 }
577 }
578
579 return PSA_ERROR_INVALID_ARGUMENT;
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100580}
581
Gilles Peskine449bd832023-01-11 14:50:10 +0100582psa_status_t psa_allocate_buffer_to_slot(psa_key_slot_t *slot,
583 size_t buffer_length)
Steven Cooreman75b74362020-07-28 14:30:13 +0200584{
Gilles Peskine449bd832023-01-11 14:50:10 +0100585 if (slot->key.data != NULL) {
586 return PSA_ERROR_ALREADY_EXISTS;
587 }
Steven Cooreman75b74362020-07-28 14:30:13 +0200588
Gilles Peskine449bd832023-01-11 14:50:10 +0100589 slot->key.data = mbedtls_calloc(1, buffer_length);
590 if (slot->key.data == NULL) {
591 return PSA_ERROR_INSUFFICIENT_MEMORY;
592 }
Steven Cooreman75b74362020-07-28 14:30:13 +0200593
Ronald Cronea0f8a62020-11-25 17:52:23 +0100594 slot->key.bytes = buffer_length;
Gilles Peskine449bd832023-01-11 14:50:10 +0100595 return PSA_SUCCESS;
Steven Cooreman75b74362020-07-28 14:30:13 +0200596}
597
Gilles Peskine449bd832023-01-11 14:50:10 +0100598psa_status_t psa_copy_key_material_into_slot(psa_key_slot_t *slot,
599 const uint8_t *data,
600 size_t data_length)
Steven Cooremanf7cebd42020-10-13 20:27:40 +0200601{
Gilles Peskine449bd832023-01-11 14:50:10 +0100602 psa_status_t status = psa_allocate_buffer_to_slot(slot,
603 data_length);
604 if (status != PSA_SUCCESS) {
605 return status;
606 }
Steven Cooremanf7cebd42020-10-13 20:27:40 +0200607
Gilles Peskine449bd832023-01-11 14:50:10 +0100608 memcpy(slot->key.data, data, data_length);
609 return PSA_SUCCESS;
Steven Cooremanf7cebd42020-10-13 20:27:40 +0200610}
611
Ronald Crona0fe59f2020-11-29 11:14:53 +0100612psa_status_t psa_import_key_into_slot(
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100613 const psa_key_attributes_t *attributes,
614 const uint8_t *data, size_t data_length,
615 uint8_t *key_buffer, size_t key_buffer_size,
Gilles Peskine449bd832023-01-11 14:50:10 +0100616 size_t *key_buffer_length, size_t *bits)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100617{
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100618 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
619 psa_key_type_t type = attributes->core.type;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100620
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200621 /* zero-length keys are never supported. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100622 if (data_length == 0) {
623 return PSA_ERROR_NOT_SUPPORTED;
624 }
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200625
Gilles Peskine449bd832023-01-11 14:50:10 +0100626 if (key_type_is_raw_bytes(type)) {
627 *bits = PSA_BYTES_TO_BITS(data_length);
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200628
Gilles Peskine449bd832023-01-11 14:50:10 +0100629 status = psa_validate_unstructured_key_bit_size(attributes->core.type,
630 *bits);
631 if (status != PSA_SUCCESS) {
632 return status;
633 }
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200634
Ronald Crondd04d422020-11-28 15:14:42 +0100635 /* Copy the key material. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100636 memcpy(key_buffer, data, data_length);
Ronald Crondd04d422020-11-28 15:14:42 +0100637 *key_buffer_length = data_length;
Gilles Peskine449bd832023-01-11 14:50:10 +0100638 (void) key_buffer_size;
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200639
Gilles Peskine449bd832023-01-11 14:50:10 +0100640 return PSA_SUCCESS;
641 } else if (PSA_KEY_TYPE_IS_ASYMMETRIC(type)) {
Valerio Setti8bb57632023-05-26 13:48:07 +0200642#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_LEGACY) || \
Przemek Stekiel6d85afa2023-04-28 11:42:17 +0200643 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY)
Przemek Stekiel472b3f32022-12-01 14:38:49 +0100644 if (PSA_KEY_TYPE_IS_DH(type)) {
Przemek Stekield1cf1ba2023-04-27 12:04:21 +0200645 if (psa_is_dh_key_size_valid(PSA_BYTES_TO_BITS(data_length)) == 0) {
Przemek Stekiel472b3f32022-12-01 14:38:49 +0100646 return PSA_ERROR_INVALID_ARGUMENT;
647 }
Przemek Stekiel33c91eb2023-05-30 15:16:35 +0200648 return mbedtls_psa_ffdh_import_key(attributes,
649 data, data_length,
650 key_buffer, key_buffer_size,
651 key_buffer_length,
652 bits);
Przemek Stekiel472b3f32022-12-01 14:38:49 +0100653 }
Valerio Setti8bb57632023-05-26 13:48:07 +0200654#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_LEGACY) ||
Przemek Stekiel6d85afa2023-04-28 11:42:17 +0200655 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) */
Valerio Setti8bb57632023-05-26 13:48:07 +0200656#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_LEGACY) || \
Gilles Peskine449bd832023-01-11 14:50:10 +0100657 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
658 if (PSA_KEY_TYPE_IS_ECC(type)) {
659 return mbedtls_psa_ecp_import_key(attributes,
660 data, data_length,
661 key_buffer, key_buffer_size,
662 key_buffer_length,
663 bits);
Steven Cooreman40120f62020-10-29 11:42:22 +0100664 }
Valerio Setti8bb57632023-05-26 13:48:07 +0200665#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_LEGACY) ||
John Durkop9814fa22020-11-04 12:28:15 -0800666 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
Valerio Setti8bb57632023-05-26 13:48:07 +0200667#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_LEGACY) || \
Gilles Peskine449bd832023-01-11 14:50:10 +0100668 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
669 if (PSA_KEY_TYPE_IS_RSA(type)) {
670 return mbedtls_psa_rsa_import_key(attributes,
671 data, data_length,
672 key_buffer, key_buffer_size,
673 key_buffer_length,
674 bits);
Steven Cooreman3ea0ce42020-10-23 11:37:05 +0200675 }
Valerio Setti8bb57632023-05-26 13:48:07 +0200676#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_LEGACY) ||
John Durkop9814fa22020-11-04 12:28:15 -0800677 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100678 }
Steven Cooreman40120f62020-10-29 11:42:22 +0100679
Gilles Peskine449bd832023-01-11 14:50:10 +0100680 return PSA_ERROR_NOT_SUPPORTED;
Darryl Green06fd18d2018-07-16 11:21:11 +0100681}
682
Gilles Peskinef603c712019-01-19 13:40:11 +0100683/** Calculate the intersection of two algorithm usage policies.
684 *
685 * Return 0 (which allows no operation) on incompatibility.
686 */
687static psa_algorithm_t psa_key_policy_algorithm_intersection(
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100688 psa_key_type_t key_type,
Gilles Peskinef603c712019-01-19 13:40:11 +0100689 psa_algorithm_t alg1,
Gilles Peskine449bd832023-01-11 14:50:10 +0100690 psa_algorithm_t alg2)
Gilles Peskinef603c712019-01-19 13:40:11 +0100691{
Gilles Peskine549ea862019-05-22 11:45:59 +0200692 /* Common case: both sides actually specify the same policy. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100693 if (alg1 == alg2) {
694 return alg1;
695 }
Steven Cooreman03488022021-02-18 12:07:20 +0100696 /* If the policies are from the same hash-and-sign family, check
697 * if one is a wildcard. If so the other has the specific algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100698 if (PSA_ALG_IS_SIGN_HASH(alg1) &&
699 PSA_ALG_IS_SIGN_HASH(alg2) &&
700 (alg1 & ~PSA_ALG_HASH_MASK) == (alg2 & ~PSA_ALG_HASH_MASK)) {
701 if (PSA_ALG_SIGN_GET_HASH(alg1) == PSA_ALG_ANY_HASH) {
702 return alg2;
703 }
704 if (PSA_ALG_SIGN_GET_HASH(alg2) == PSA_ALG_ANY_HASH) {
705 return alg1;
706 }
Steven Cooreman03488022021-02-18 12:07:20 +0100707 }
708 /* If the policies are from the same AEAD family, check whether
Steven Cooreman7de9e2d2021-02-22 17:05:56 +0100709 * one of them is a minimum-tag-length wildcard. Calculate the most
Steven Cooreman03488022021-02-18 12:07:20 +0100710 * restrictive tag length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100711 if (PSA_ALG_IS_AEAD(alg1) && PSA_ALG_IS_AEAD(alg2) &&
712 (PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg1, 0) ==
713 PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg2, 0))) {
714 size_t alg1_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg1);
715 size_t alg2_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg2);
Steven Cooremancd640932021-03-08 12:00:27 +0100716 size_t restricted_len = alg1_len > alg2_len ? alg1_len : alg2_len;
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100717
Steven Cooreman7de9e2d2021-02-22 17:05:56 +0100718 /* If both are wildcards, return most restrictive wildcard */
Gilles Peskine449bd832023-01-11 14:50:10 +0100719 if (((alg1 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
720 ((alg2 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0)) {
721 return PSA_ALG_AEAD_WITH_AT_LEAST_THIS_LENGTH_TAG(
722 alg1, restricted_len);
Steven Cooreman03488022021-02-18 12:07:20 +0100723 }
724 /* If only one is a wildcard, return specific algorithm if compatible. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100725 if (((alg1 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
726 (alg1_len <= alg2_len)) {
727 return alg2;
Steven Cooreman03488022021-02-18 12:07:20 +0100728 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100729 if (((alg2 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
730 (alg2_len <= alg1_len)) {
731 return alg1;
Steven Cooreman03488022021-02-18 12:07:20 +0100732 }
733 }
734 /* If the policies are from the same MAC family, check whether one
735 * of them is a minimum-MAC-length policy. Calculate the most
736 * restrictive tag length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100737 if (PSA_ALG_IS_MAC(alg1) && PSA_ALG_IS_MAC(alg2) &&
738 (PSA_ALG_FULL_LENGTH_MAC(alg1) ==
739 PSA_ALG_FULL_LENGTH_MAC(alg2))) {
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100740 /* Validate the combination of key type and algorithm. Since the base
741 * algorithm of alg1 and alg2 are the same, we only need this once. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100742 if (PSA_SUCCESS != psa_mac_key_can_do(alg1, key_type)) {
743 return 0;
744 }
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100745
Steven Cooreman31a876d2021-03-03 20:47:40 +0100746 /* Get the (exact or at-least) output lengths for both sides of the
747 * requested intersection. None of the currently supported algorithms
748 * have an output length dependent on the actual key size, so setting it
749 * to a bogus value of 0 is currently OK.
750 *
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100751 * Note that for at-least-this-length wildcard algorithms, the output
752 * length is set to the shortest allowed length, which allows us to
753 * calculate the most restrictive tag length for the intersection. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100754 size_t alg1_len = PSA_MAC_LENGTH(key_type, 0, alg1);
755 size_t alg2_len = PSA_MAC_LENGTH(key_type, 0, alg2);
Steven Cooremancd640932021-03-08 12:00:27 +0100756 size_t restricted_len = alg1_len > alg2_len ? alg1_len : alg2_len;
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100757
Steven Cooremana1d83222021-02-25 10:20:29 +0100758 /* If both are wildcards, return most restrictive wildcard */
Gilles Peskine449bd832023-01-11 14:50:10 +0100759 if (((alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
760 ((alg2 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0)) {
761 return PSA_ALG_AT_LEAST_THIS_LENGTH_MAC(alg1, restricted_len);
Steven Cooreman03488022021-02-18 12:07:20 +0100762 }
Steven Cooreman31a876d2021-03-03 20:47:40 +0100763
764 /* If only one is an at-least-this-length policy, the intersection would
765 * be the other (fixed-length) policy as long as said fixed length is
766 * equal to or larger than the shortest allowed length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100767 if ((alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) {
768 return (alg1_len <= alg2_len) ? alg2 : 0;
Steven Cooreman03488022021-02-18 12:07:20 +0100769 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100770 if ((alg2 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) {
771 return (alg2_len <= alg1_len) ? alg1 : 0;
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100772 }
Steven Cooreman31a876d2021-03-03 20:47:40 +0100773
Steven Cooremancd640932021-03-08 12:00:27 +0100774 /* If none of them are wildcards, check whether they define the same tag
775 * length. This is still possible here when one is default-length and
776 * the other specific-length. Ensure to always return the
777 * specific-length version for the intersection. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100778 if (alg1_len == alg2_len) {
779 return PSA_ALG_TRUNCATED_MAC(alg1, alg1_len);
780 }
Gilles Peskinef603c712019-01-19 13:40:11 +0100781 }
782 /* If the policies are incompatible, allow nothing. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100783 return 0;
Gilles Peskinef603c712019-01-19 13:40:11 +0100784}
785
Gilles Peskine449bd832023-01-11 14:50:10 +0100786static int psa_key_algorithm_permits(psa_key_type_t key_type,
787 psa_algorithm_t policy_alg,
788 psa_algorithm_t requested_alg)
Gilles Peskined6f371b2019-05-10 19:33:38 +0200789{
Gilles Peskine549ea862019-05-22 11:45:59 +0200790 /* Common case: the policy only allows requested_alg. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100791 if (requested_alg == policy_alg) {
792 return 1;
793 }
Steven Cooreman03488022021-02-18 12:07:20 +0100794 /* If policy_alg is a hash-and-sign with a wildcard for the hash,
795 * and requested_alg is the same hash-and-sign family with any hash,
796 * then requested_alg is compliant with policy_alg. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100797 if (PSA_ALG_IS_SIGN_HASH(requested_alg) &&
798 PSA_ALG_SIGN_GET_HASH(policy_alg) == PSA_ALG_ANY_HASH) {
799 return (policy_alg & ~PSA_ALG_HASH_MASK) ==
800 (requested_alg & ~PSA_ALG_HASH_MASK);
Steven Cooreman03488022021-02-18 12:07:20 +0100801 }
802 /* If policy_alg is a wildcard AEAD algorithm of the same base as
803 * the requested algorithm, check the requested tag length to be
804 * equal-length or longer than the wildcard-specified length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100805 if (PSA_ALG_IS_AEAD(policy_alg) &&
806 PSA_ALG_IS_AEAD(requested_alg) &&
807 (PSA_ALG_AEAD_WITH_SHORTENED_TAG(policy_alg, 0) ==
808 PSA_ALG_AEAD_WITH_SHORTENED_TAG(requested_alg, 0)) &&
809 ((policy_alg & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0)) {
810 return PSA_ALG_AEAD_GET_TAG_LENGTH(policy_alg) <=
811 PSA_ALG_AEAD_GET_TAG_LENGTH(requested_alg);
Steven Cooreman03488022021-02-18 12:07:20 +0100812 }
Steven Cooremancd640932021-03-08 12:00:27 +0100813 /* If policy_alg is a MAC algorithm of the same base as the requested
814 * algorithm, check whether their MAC lengths are compatible. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100815 if (PSA_ALG_IS_MAC(policy_alg) &&
816 PSA_ALG_IS_MAC(requested_alg) &&
817 (PSA_ALG_FULL_LENGTH_MAC(policy_alg) ==
818 PSA_ALG_FULL_LENGTH_MAC(requested_alg))) {
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100819 /* Validate the combination of key type and algorithm. Since the policy
820 * and requested algorithms are the same, we only need this once. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100821 if (PSA_SUCCESS != psa_mac_key_can_do(policy_alg, key_type)) {
822 return 0;
823 }
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100824
Steven Cooreman31a876d2021-03-03 20:47:40 +0100825 /* Get both the requested output length for the algorithm which is to be
826 * verified, and the default output length for the base algorithm.
827 * Note that none of the currently supported algorithms have an output
828 * length dependent on actual key size, so setting it to a bogus value
829 * of 0 is currently OK. */
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100830 size_t requested_output_length = PSA_MAC_LENGTH(
Gilles Peskine449bd832023-01-11 14:50:10 +0100831 key_type, 0, requested_alg);
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100832 size_t default_output_length = PSA_MAC_LENGTH(
Gilles Peskine449bd832023-01-11 14:50:10 +0100833 key_type, 0,
834 PSA_ALG_FULL_LENGTH_MAC(requested_alg));
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100835
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100836 /* If the policy is default-length, only allow an algorithm with
837 * a declared exact-length matching the default. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100838 if (PSA_MAC_TRUNCATED_LENGTH(policy_alg) == 0) {
839 return requested_output_length == default_output_length;
840 }
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100841
842 /* If the requested algorithm is default-length, allow it if the policy
Steven Cooremancd640932021-03-08 12:00:27 +0100843 * length exactly matches the default length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100844 if (PSA_MAC_TRUNCATED_LENGTH(requested_alg) == 0 &&
845 PSA_MAC_TRUNCATED_LENGTH(policy_alg) == default_output_length) {
846 return 1;
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100847 }
848
Steven Cooremancd640932021-03-08 12:00:27 +0100849 /* If policy_alg is an at-least-this-length wildcard MAC algorithm,
850 * check for the requested MAC length to be equal to or longer than the
851 * minimum allowed length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100852 if ((policy_alg & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) {
853 return PSA_MAC_TRUNCATED_LENGTH(policy_alg) <=
854 requested_output_length;
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100855 }
Gilles Peskined6f371b2019-05-10 19:33:38 +0200856 }
Steven Cooremance48e852020-10-05 16:02:45 +0200857 /* If policy_alg is a generic key agreement operation, then using it for
Steven Cooremanfa5e6312020-10-15 17:07:12 +0200858 * a key derivation with that key agreement should also be allowed. This
859 * behaviour is expected to be defined in a future specification version. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100860 if (PSA_ALG_IS_RAW_KEY_AGREEMENT(policy_alg) &&
861 PSA_ALG_IS_KEY_AGREEMENT(requested_alg)) {
862 return PSA_ALG_KEY_AGREEMENT_GET_BASE(requested_alg) ==
863 policy_alg;
Steven Cooremance48e852020-10-05 16:02:45 +0200864 }
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100865 /* If it isn't explicitly permitted, it's forbidden. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100866 return 0;
Gilles Peskined6f371b2019-05-10 19:33:38 +0200867}
868
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100869/** Test whether a policy permits an algorithm.
870 *
871 * The caller must test usage flags separately.
Steven Cooreman7e39f052021-02-23 14:18:32 +0100872 *
Steven Cooreman5a172672021-03-02 21:27:42 +0100873 * \note This function requires providing the key type for which the policy is
874 * being validated, since some algorithm policy definitions (e.g. MAC)
875 * have different properties depending on what kind of cipher it is
876 * combined with.
877 *
Steven Cooreman7e39f052021-02-23 14:18:32 +0100878 * \retval PSA_SUCCESS When \p alg is a specific algorithm
879 * allowed by the \p policy.
880 * \retval PSA_ERROR_INVALID_ARGUMENT When \p alg is not a specific algorithm
881 * \retval PSA_ERROR_NOT_PERMITTED When \p alg is a specific algorithm, but
882 * the \p policy does not allow it.
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100883 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100884static psa_status_t psa_key_policy_permits(const psa_key_policy_t *policy,
885 psa_key_type_t key_type,
886 psa_algorithm_t alg)
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100887{
Steven Cooremand788fab2021-02-25 11:29:17 +0100888 /* '0' is not a valid algorithm */
Gilles Peskine449bd832023-01-11 14:50:10 +0100889 if (alg == 0) {
890 return PSA_ERROR_INVALID_ARGUMENT;
891 }
Steven Cooremand788fab2021-02-25 11:29:17 +0100892
Steven Cooreman7e39f052021-02-23 14:18:32 +0100893 /* A requested algorithm cannot be a wildcard. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100894 if (PSA_ALG_IS_WILDCARD(alg)) {
895 return PSA_ERROR_INVALID_ARGUMENT;
896 }
Steven Cooreman7e39f052021-02-23 14:18:32 +0100897
Gilles Peskine449bd832023-01-11 14:50:10 +0100898 if (psa_key_algorithm_permits(key_type, policy->alg, alg) ||
899 psa_key_algorithm_permits(key_type, policy->alg2, alg)) {
900 return PSA_SUCCESS;
901 } else {
902 return PSA_ERROR_NOT_PERMITTED;
903 }
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100904}
905
Gilles Peskinef603c712019-01-19 13:40:11 +0100906/** Restrict a key policy based on a constraint.
907 *
Steven Cooreman5a172672021-03-02 21:27:42 +0100908 * \note This function requires providing the key type for which the policy is
909 * being restricted, since some algorithm policy definitions (e.g. MAC)
910 * have different properties depending on what kind of cipher it is
911 * combined with.
912 *
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100913 * \param[in] key_type The key type for which to restrict the policy
Gilles Peskinef603c712019-01-19 13:40:11 +0100914 * \param[in,out] policy The policy to restrict.
915 * \param[in] constraint The policy constraint to apply.
916 *
917 * \retval #PSA_SUCCESS
918 * \c *policy contains the intersection of the original value of
919 * \c *policy and \c *constraint.
920 * \retval #PSA_ERROR_INVALID_ARGUMENT
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100921 * \c key_type, \c *policy and \c *constraint are incompatible.
Gilles Peskinef603c712019-01-19 13:40:11 +0100922 * \c *policy is unchanged.
923 */
924static psa_status_t psa_restrict_key_policy(
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100925 psa_key_type_t key_type,
Gilles Peskinef603c712019-01-19 13:40:11 +0100926 psa_key_policy_t *policy,
Gilles Peskine449bd832023-01-11 14:50:10 +0100927 const psa_key_policy_t *constraint)
Gilles Peskinef603c712019-01-19 13:40:11 +0100928{
929 psa_algorithm_t intersection_alg =
Gilles Peskine449bd832023-01-11 14:50:10 +0100930 psa_key_policy_algorithm_intersection(key_type, policy->alg,
931 constraint->alg);
Gilles Peskined6f371b2019-05-10 19:33:38 +0200932 psa_algorithm_t intersection_alg2 =
Gilles Peskine449bd832023-01-11 14:50:10 +0100933 psa_key_policy_algorithm_intersection(key_type, policy->alg2,
934 constraint->alg2);
935 if (intersection_alg == 0 && policy->alg != 0 && constraint->alg != 0) {
936 return PSA_ERROR_INVALID_ARGUMENT;
937 }
938 if (intersection_alg2 == 0 && policy->alg2 != 0 && constraint->alg2 != 0) {
939 return PSA_ERROR_INVALID_ARGUMENT;
940 }
Gilles Peskinef603c712019-01-19 13:40:11 +0100941 policy->usage &= constraint->usage;
942 policy->alg = intersection_alg;
Gilles Peskined6f371b2019-05-10 19:33:38 +0200943 policy->alg2 = intersection_alg2;
Gilles Peskine449bd832023-01-11 14:50:10 +0100944 return PSA_SUCCESS;
Gilles Peskinef603c712019-01-19 13:40:11 +0100945}
946
Przemek Stekiel061f6942022-11-30 10:51:35 +0100947/** Get the description of a key given its identifier and policy constraints
948 * and lock it.
949 *
950 * The key must have allow all the usage flags set in \p usage. If \p alg is
951 * nonzero, the key must allow operations with this algorithm. If \p alg is
952 * zero, the algorithm is not checked.
953 *
954 * In case of a persistent key, the function loads the description of the key
955 * into a key slot if not already done.
956 *
957 * On success, the returned key slot is locked. It is the responsibility of
958 * the caller to unlock the key slot when it does not access it anymore.
959 */
960static psa_status_t psa_get_and_lock_key_slot_with_policy(
Ronald Cron5c522922020-11-14 16:35:34 +0100961 mbedtls_svc_key_id_t key,
962 psa_key_slot_t **p_slot,
963 psa_key_usage_t usage,
Gilles Peskine449bd832023-01-11 14:50:10 +0100964 psa_algorithm_t alg)
Darryl Green06fd18d2018-07-16 11:21:11 +0100965{
Ronald Cronf95a2b12020-10-22 15:24:49 +0200966 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel9a5b8122022-12-22 13:34:47 +0100967 psa_key_slot_t *slot = NULL;
Darryl Green06fd18d2018-07-16 11:21:11 +0100968
Gilles Peskine449bd832023-01-11 14:50:10 +0100969 status = psa_get_and_lock_key_slot(key, p_slot);
970 if (status != PSA_SUCCESS) {
971 return status;
972 }
Ronald Cronf95a2b12020-10-22 15:24:49 +0200973 slot = *p_slot;
Darryl Green06fd18d2018-07-16 11:21:11 +0100974
975 /* Enforce that usage policy for the key slot contains all the flags
976 * required by the usage parameter. There is one exception: public
977 * keys can always be exported, so we treat public key objects as
978 * if they had the export flag. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100979 if (PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type)) {
Darryl Green06fd18d2018-07-16 11:21:11 +0100980 usage &= ~PSA_KEY_USAGE_EXPORT;
Gilles Peskine449bd832023-01-11 14:50:10 +0100981 }
Ronald Cronf95a2b12020-10-22 15:24:49 +0200982
Gilles Peskine449bd832023-01-11 14:50:10 +0100983 if ((slot->attr.policy.usage & usage) != usage) {
Steven Cooreman328f11c2021-03-02 11:44:51 +0100984 status = PSA_ERROR_NOT_PERMITTED;
Ronald Cronf95a2b12020-10-22 15:24:49 +0200985 goto error;
Steven Cooreman328f11c2021-03-02 11:44:51 +0100986 }
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100987
Shaun Case8b0ecbc2021-12-20 21:14:10 -0800988 /* Enforce that the usage policy permits the requested algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100989 if (alg != 0) {
990 status = psa_key_policy_permits(&slot->attr.policy,
991 slot->attr.type,
992 alg);
993 if (status != PSA_SUCCESS) {
Steven Cooreman7e39f052021-02-23 14:18:32 +0100994 goto error;
Gilles Peskine449bd832023-01-11 14:50:10 +0100995 }
Steven Cooreman7e39f052021-02-23 14:18:32 +0100996 }
Darryl Green06fd18d2018-07-16 11:21:11 +0100997
Gilles Peskine449bd832023-01-11 14:50:10 +0100998 return PSA_SUCCESS;
Ronald Cronf95a2b12020-10-22 15:24:49 +0200999
1000error:
1001 *p_slot = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01001002 psa_unlock_key_slot(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02001003
Gilles Peskine449bd832023-01-11 14:50:10 +01001004 return status;
Darryl Green06fd18d2018-07-16 11:21:11 +01001005}
Darryl Green940d72c2018-07-13 13:18:51 +01001006
Ronald Cron5c522922020-11-14 16:35:34 +01001007/** Get a key slot containing a transparent key and lock it.
Gilles Peskine28f8f302019-07-24 13:30:31 +02001008 *
1009 * A transparent key is a key for which the key material is directly
Ronald Cronddae0f52021-08-24 15:39:44 +02001010 * available, as opposed to a key in a secure element and/or to be used
1011 * by a secure element.
Gilles Peskine28f8f302019-07-24 13:30:31 +02001012 *
Ronald Cronddae0f52021-08-24 15:39:44 +02001013 * This is a temporary function that may be used instead of
1014 * psa_get_and_lock_key_slot_with_policy() when there is no opaque key support
1015 * for a cryptographic operation.
Ronald Cronf95a2b12020-10-22 15:24:49 +02001016 *
Ronald Cron5c522922020-11-14 16:35:34 +01001017 * On success, the returned key slot is locked. It is the responsibility of the
1018 * caller to unlock the key slot when it does not access it anymore.
Gilles Peskine28f8f302019-07-24 13:30:31 +02001019 */
Ronald Cron5c522922020-11-14 16:35:34 +01001020static psa_status_t psa_get_and_lock_transparent_key_slot_with_policy(
1021 mbedtls_svc_key_id_t key,
1022 psa_key_slot_t **p_slot,
1023 psa_key_usage_t usage,
Gilles Peskine449bd832023-01-11 14:50:10 +01001024 psa_algorithm_t alg)
Gilles Peskine28f8f302019-07-24 13:30:31 +02001025{
Gilles Peskine449bd832023-01-11 14:50:10 +01001026 psa_status_t status = psa_get_and_lock_key_slot_with_policy(key, p_slot,
1027 usage, alg);
1028 if (status != PSA_SUCCESS) {
1029 return status;
Gilles Peskine28f8f302019-07-24 13:30:31 +02001030 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02001031
Gilles Peskine449bd832023-01-11 14:50:10 +01001032 if (psa_key_lifetime_is_external((*p_slot)->attr.lifetime)) {
1033 psa_unlock_key_slot(*p_slot);
1034 *p_slot = NULL;
1035 return PSA_ERROR_NOT_SUPPORTED;
1036 }
1037
1038 return PSA_SUCCESS;
Gilles Peskine28f8f302019-07-24 13:30:31 +02001039}
Gilles Peskine28f8f302019-07-24 13:30:31 +02001040
Gilles Peskine449bd832023-01-11 14:50:10 +01001041psa_status_t psa_remove_key_data_from_memory(psa_key_slot_t *slot)
Darryl Green40225ba2018-11-15 14:48:15 +00001042{
Ronald Cronea0f8a62020-11-25 17:52:23 +01001043 /* Data pointer will always be either a valid pointer or NULL in an
1044 * initialized slot, so we can just free it. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001045 if (slot->key.data != NULL) {
1046 mbedtls_platform_zeroize(slot->key.data, slot->key.bytes);
1047 }
Ronald Cronea0f8a62020-11-25 17:52:23 +01001048
Gilles Peskine449bd832023-01-11 14:50:10 +01001049 mbedtls_free(slot->key.data);
Ronald Cronea0f8a62020-11-25 17:52:23 +01001050 slot->key.data = NULL;
1051 slot->key.bytes = 0;
Darryl Green40225ba2018-11-15 14:48:15 +00001052
Gilles Peskine449bd832023-01-11 14:50:10 +01001053 return PSA_SUCCESS;
Darryl Green40225ba2018-11-15 14:48:15 +00001054}
1055
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001056/** Completely wipe a slot in memory, including its policy.
1057 * Persistent storage is not affected. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001058psa_status_t psa_wipe_key_slot(psa_key_slot_t *slot)
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001059{
Gilles Peskine449bd832023-01-11 14:50:10 +01001060 psa_status_t status = psa_remove_key_data_from_memory(slot);
Ronald Cronddd3d052020-10-30 14:07:07 +01001061
Gilles Peskine449bd832023-01-11 14:50:10 +01001062 /*
1063 * As the return error code may not be handled in case of multiple errors,
1064 * do our best to report an unexpected lock counter. Assert with
1065 * MBEDTLS_TEST_HOOK_TEST_ASSERT that the lock counter is equal to one:
1066 * if the MBEDTLS_TEST_HOOKS configuration option is enabled and the
1067 * function is called as part of the execution of a test suite, the
1068 * execution of the test suite is stopped in error if the assertion fails.
1069 */
1070 if (slot->lock_count != 1) {
1071 MBEDTLS_TEST_HOOK_TEST_ASSERT(slot->lock_count == 1);
Ronald Cronddd3d052020-10-30 14:07:07 +01001072 status = PSA_ERROR_CORRUPTION_DETECTED;
1073 }
1074
Gilles Peskine3f7cd622019-08-13 15:01:08 +02001075 /* Multipart operations may still be using the key. This is safe
1076 * because all multipart operation objects are independent from
1077 * the key slot: if they need to access the key after the setup
1078 * phase, they have a copy of the key. Note that this means that
1079 * key material can linger until all operations are completed. */
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001080 /* At this point, key material and other type-specific content has
1081 * been wiped. Clear remaining metadata. We can call memset and not
1082 * zeroize because the metadata is not particularly sensitive. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001083 memset(slot, 0, sizeof(*slot));
1084 return status;
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001085}
1086
Gilles Peskine449bd832023-01-11 14:50:10 +01001087psa_status_t psa_destroy_key(mbedtls_svc_key_id_t key)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001088{
Gilles Peskine2f060a82018-12-04 17:12:32 +01001089 psa_key_slot_t *slot;
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001090 psa_status_t status; /* status of the last operation */
1091 psa_status_t overall_status = PSA_SUCCESS;
Gilles Peskine354f7672019-07-12 23:46:38 +02001092#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1093 psa_se_drv_table_entry_t *driver;
1094#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001095
Gilles Peskine449bd832023-01-11 14:50:10 +01001096 if (mbedtls_svc_key_id_is_null(key)) {
1097 return PSA_SUCCESS;
1098 }
Gilles Peskine1841cf42019-10-08 15:48:25 +02001099
Ronald Cronf2911112020-10-29 17:51:10 +01001100 /*
Ronald Cron19daca92020-11-10 18:08:03 +01001101 * Get the description of the key in a key slot. In case of a persistent
Ronald Cronf2911112020-10-29 17:51:10 +01001102 * key, this will load the key description from persistent memory if not
1103 * done yet. We cannot avoid this loading as without it we don't know if
1104 * the key is operated by an SE or not and this information is needed by
1105 * the current implementation.
1106 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001107 status = psa_get_and_lock_key_slot(key, &slot);
1108 if (status != PSA_SUCCESS) {
1109 return status;
1110 }
Gilles Peskine354f7672019-07-12 23:46:38 +02001111
Ronald Cronf2911112020-10-29 17:51:10 +01001112 /*
1113 * If the key slot containing the key description is under access by the
1114 * library (apart from the present access), the key cannot be destroyed
1115 * yet. For the time being, just return in error. Eventually (to be
1116 * implemented), the key should be destroyed when all accesses have
1117 * stopped.
1118 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001119 if (slot->lock_count > 1) {
1120 psa_unlock_key_slot(slot);
1121 return PSA_ERROR_GENERIC_ERROR;
Ronald Cronf2911112020-10-29 17:51:10 +01001122 }
1123
Gilles Peskine449bd832023-01-11 14:50:10 +01001124 if (PSA_KEY_LIFETIME_IS_READ_ONLY(slot->attr.lifetime)) {
Gilles Peskine6687cd02021-04-21 22:32:05 +02001125 /* Refuse the destruction of a read-only key (which may or may not work
1126 * if we attempt it, depending on whether the key is merely read-only
1127 * by policy or actually physically read-only).
Gilles Peskinef9a046e2021-06-07 23:27:54 +02001128 * Just do the best we can, which is to wipe the copy in memory
1129 * (done in this function's cleanup code). */
1130 overall_status = PSA_ERROR_NOT_PERMITTED;
1131 goto exit;
Gilles Peskine6687cd02021-04-21 22:32:05 +02001132 }
1133
Gilles Peskine354f7672019-07-12 23:46:38 +02001134#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001135 driver = psa_get_se_driver_entry(slot->attr.lifetime);
1136 if (driver != NULL) {
Gilles Peskine60450a42019-07-25 11:32:45 +02001137 /* For a key in a secure element, we need to do three things:
1138 * remove the key file in internal storage, destroy the
1139 * key inside the secure element, and update the driver's
1140 * persistent data. Start a transaction that will encompass these
1141 * three actions. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001142 psa_crypto_prepare_transaction(PSA_CRYPTO_TRANSACTION_DESTROY_KEY);
Gilles Peskine8e338702019-07-30 20:06:31 +02001143 psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
Gilles Peskine449bd832023-01-11 14:50:10 +01001144 psa_crypto_transaction.key.slot = psa_key_slot_get_slot_number(slot);
Gilles Peskine8e338702019-07-30 20:06:31 +02001145 psa_crypto_transaction.key.id = slot->attr.id;
Gilles Peskine449bd832023-01-11 14:50:10 +01001146 status = psa_crypto_save_transaction();
1147 if (status != PSA_SUCCESS) {
1148 (void) psa_crypto_stop_transaction();
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001149 /* We should still try to destroy the key in the secure
1150 * element and the key metadata in storage. This is especially
1151 * important if the error is that the storage is full.
1152 * But how to do it exactly without risking an inconsistent
1153 * state after a reset?
1154 * https://github.com/ARMmbed/mbed-crypto/issues/215
1155 */
1156 overall_status = status;
1157 goto exit;
Gilles Peskinefc762652019-07-22 19:30:34 +02001158 }
1159
Gilles Peskine449bd832023-01-11 14:50:10 +01001160 status = psa_destroy_se_key(driver,
1161 psa_key_slot_get_slot_number(slot));
1162 if (overall_status == PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001163 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001164 }
Gilles Peskinefc762652019-07-22 19:30:34 +02001165 }
Gilles Peskine354f7672019-07-12 23:46:38 +02001166#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1167
Darryl Greend49a4992018-06-18 17:27:26 +01001168#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001169 if (!PSA_KEY_LIFETIME_IS_VOLATILE(slot->attr.lifetime)) {
1170 status = psa_destroy_persistent_key(slot->attr.id);
1171 if (overall_status == PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001172 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001173 }
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001174
Gilles Peskine9ce31c42019-08-13 15:14:20 +02001175 /* TODO: other slots may have a copy of the same key. We should
1176 * invalidate them.
1177 * https://github.com/ARMmbed/mbed-crypto/issues/214
1178 */
Darryl Greend49a4992018-06-18 17:27:26 +01001179 }
1180#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
Gilles Peskine354f7672019-07-12 23:46:38 +02001181
Gilles Peskinefc762652019-07-22 19:30:34 +02001182#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001183 if (driver != NULL) {
1184 status = psa_save_se_persistent_data(driver);
1185 if (overall_status == PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001186 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001187 }
1188 status = psa_crypto_stop_transaction();
1189 if (overall_status == PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001190 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001191 }
Gilles Peskinefc762652019-07-22 19:30:34 +02001192 }
1193#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1194
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001195exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001196 status = psa_wipe_key_slot(slot);
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001197 /* Prioritize CORRUPTION_DETECTED from wiping over a storage error */
Gilles Peskine449bd832023-01-11 14:50:10 +01001198 if (status != PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001199 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001200 }
1201 return overall_status;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001202}
1203
Valerio Setti8bb57632023-05-26 13:48:07 +02001204#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_LEGACY) || \
John Durkop0e005192020-10-31 22:06:54 -07001205 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Gilles Peskineb699f072019-04-26 16:06:02 +02001206static psa_status_t psa_get_rsa_public_exponent(
1207 const mbedtls_rsa_context *rsa,
Gilles Peskine449bd832023-01-11 14:50:10 +01001208 psa_key_attributes_t *attributes)
Gilles Peskineb699f072019-04-26 16:06:02 +02001209{
1210 mbedtls_mpi mpi;
Janos Follath24eed8d2019-11-22 13:21:35 +00001211 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskineb699f072019-04-26 16:06:02 +02001212 uint8_t *buffer = NULL;
1213 size_t buflen;
Gilles Peskine449bd832023-01-11 14:50:10 +01001214 mbedtls_mpi_init(&mpi);
Gilles Peskineb699f072019-04-26 16:06:02 +02001215
Gilles Peskine449bd832023-01-11 14:50:10 +01001216 ret = mbedtls_rsa_export(rsa, NULL, NULL, NULL, NULL, &mpi);
1217 if (ret != 0) {
Gilles Peskineb699f072019-04-26 16:06:02 +02001218 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001219 }
1220 if (mbedtls_mpi_cmp_int(&mpi, 65537) == 0) {
Gilles Peskine772c8b12019-04-26 17:37:21 +02001221 /* It's the default value, which is reported as an empty string,
1222 * so there's nothing to do. */
1223 goto exit;
1224 }
Gilles Peskineb699f072019-04-26 16:06:02 +02001225
Gilles Peskine449bd832023-01-11 14:50:10 +01001226 buflen = mbedtls_mpi_size(&mpi);
1227 buffer = mbedtls_calloc(1, buflen);
1228 if (buffer == NULL) {
Gilles Peskineb699f072019-04-26 16:06:02 +02001229 ret = MBEDTLS_ERR_MPI_ALLOC_FAILED;
1230 goto exit;
1231 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001232 ret = mbedtls_mpi_write_binary(&mpi, buffer, buflen);
1233 if (ret != 0) {
Gilles Peskineb699f072019-04-26 16:06:02 +02001234 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001235 }
Gilles Peskineb699f072019-04-26 16:06:02 +02001236 attributes->domain_parameters = buffer;
1237 attributes->domain_parameters_size = buflen;
1238
1239exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001240 mbedtls_mpi_free(&mpi);
1241 if (ret != 0) {
1242 mbedtls_free(buffer);
1243 }
1244 return mbedtls_to_psa_error(ret);
Gilles Peskineb699f072019-04-26 16:06:02 +02001245}
Valerio Setti8bb57632023-05-26 13:48:07 +02001246#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_LEGACY) ||
John Durkop9814fa22020-11-04 12:28:15 -08001247 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Gilles Peskineb699f072019-04-26 16:06:02 +02001248
Gilles Peskinebfd322f2019-07-23 11:58:03 +02001249/** Retrieve all the publicly-accessible attributes of a key.
1250 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001251psa_status_t psa_get_key_attributes(mbedtls_svc_key_id_t key,
1252 psa_key_attributes_t *attributes)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001253{
Ronald Cronf95a2b12020-10-22 15:24:49 +02001254 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01001255 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01001256 psa_key_slot_t *slot;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001257
Gilles Peskine449bd832023-01-11 14:50:10 +01001258 psa_reset_key_attributes(attributes);
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001259
Gilles Peskine449bd832023-01-11 14:50:10 +01001260 status = psa_get_and_lock_key_slot_with_policy(key, &slot, 0, 0);
1261 if (status != PSA_SUCCESS) {
1262 return status;
1263 }
Gilles Peskineb870b182018-07-06 16:02:09 +02001264
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001265 attributes->core = slot->attr;
Gilles Peskine449bd832023-01-11 14:50:10 +01001266 attributes->core.flags &= (MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY |
1267 MBEDTLS_PSA_KA_MASK_DUAL_USE);
Gilles Peskinec8000c02019-08-02 20:15:51 +02001268
1269#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001270 if (psa_get_se_driver_entry(slot->attr.lifetime) != NULL) {
1271 psa_set_key_slot_number(attributes,
1272 psa_key_slot_get_slot_number(slot));
1273 }
Gilles Peskinec8000c02019-08-02 20:15:51 +02001274#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskineb699f072019-04-26 16:06:02 +02001275
Gilles Peskine449bd832023-01-11 14:50:10 +01001276 switch (slot->attr.type) {
Valerio Setti8bb57632023-05-26 13:48:07 +02001277#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_LEGACY) || \
John Durkop0e005192020-10-31 22:06:54 -07001278 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Gilles Peskinec93b80c2019-05-16 19:39:54 +02001279 case PSA_KEY_TYPE_RSA_KEY_PAIR:
Gilles Peskineb699f072019-04-26 16:06:02 +02001280 case PSA_KEY_TYPE_RSA_PUBLIC_KEY:
Janos Follath1d57a202019-08-13 12:15:34 +01001281 /* TODO: reporting the public exponent for opaque keys
Gilles Peskinec9d7f942019-08-13 16:17:16 +02001282 * is not yet implemented.
1283 * https://github.com/ARMmbed/mbed-crypto/issues/216
1284 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001285 if (!psa_key_lifetime_is_external(slot->attr.lifetime)) {
Steven Cooremana2371e52020-07-28 14:30:39 +02001286 mbedtls_rsa_context *rsa = NULL;
Steven Cooremana01795d2020-07-24 22:48:15 +02001287
Ronald Cron90857082020-11-25 14:58:33 +01001288 status = mbedtls_psa_rsa_load_representation(
Gilles Peskine449bd832023-01-11 14:50:10 +01001289 slot->attr.type,
1290 slot->key.data,
1291 slot->key.bytes,
1292 &rsa);
1293 if (status != PSA_SUCCESS) {
Steven Cooremana01795d2020-07-24 22:48:15 +02001294 break;
Gilles Peskine449bd832023-01-11 14:50:10 +01001295 }
Steven Cooremana01795d2020-07-24 22:48:15 +02001296
Gilles Peskine449bd832023-01-11 14:50:10 +01001297 status = psa_get_rsa_public_exponent(rsa,
1298 attributes);
1299 mbedtls_rsa_free(rsa);
1300 mbedtls_free(rsa);
Steven Cooremana01795d2020-07-24 22:48:15 +02001301 }
Gilles Peskineb699f072019-04-26 16:06:02 +02001302 break;
Valerio Setti8bb57632023-05-26 13:48:07 +02001303#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_LEGACY) ||
John Durkop9814fa22020-11-04 12:28:15 -08001304 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Gilles Peskineb699f072019-04-26 16:06:02 +02001305 default:
1306 /* Nothing else to do. */
1307 break;
1308 }
1309
Gilles Peskine449bd832023-01-11 14:50:10 +01001310 if (status != PSA_SUCCESS) {
1311 psa_reset_key_attributes(attributes);
1312 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02001313
Gilles Peskine449bd832023-01-11 14:50:10 +01001314 unlock_status = psa_unlock_key_slot(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02001315
Gilles Peskine449bd832023-01-11 14:50:10 +01001316 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001317}
1318
Gilles Peskinec8000c02019-08-02 20:15:51 +02001319#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1320psa_status_t psa_get_key_slot_number(
1321 const psa_key_attributes_t *attributes,
Gilles Peskine449bd832023-01-11 14:50:10 +01001322 psa_key_slot_number_t *slot_number)
Gilles Peskinec8000c02019-08-02 20:15:51 +02001323{
Gilles Peskine449bd832023-01-11 14:50:10 +01001324 if (attributes->core.flags & MBEDTLS_PSA_KA_FLAG_HAS_SLOT_NUMBER) {
Gilles Peskinec8000c02019-08-02 20:15:51 +02001325 *slot_number = attributes->slot_number;
Gilles Peskine449bd832023-01-11 14:50:10 +01001326 return PSA_SUCCESS;
1327 } else {
1328 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinec8000c02019-08-02 20:15:51 +02001329 }
Gilles Peskinec8000c02019-08-02 20:15:51 +02001330}
1331#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1332
Gilles Peskine449bd832023-01-11 14:50:10 +01001333static psa_status_t psa_export_key_buffer_internal(const uint8_t *key_buffer,
1334 size_t key_buffer_size,
1335 uint8_t *data,
1336 size_t data_size,
1337 size_t *data_length)
Steven Cooremana01795d2020-07-24 22:48:15 +02001338{
Gilles Peskine449bd832023-01-11 14:50:10 +01001339 if (key_buffer_size > data_size) {
1340 return PSA_ERROR_BUFFER_TOO_SMALL;
1341 }
1342 memcpy(data, key_buffer, key_buffer_size);
1343 memset(data + key_buffer_size, 0,
1344 data_size - key_buffer_size);
Ronald Crond18b5f82020-11-25 16:46:05 +01001345 *data_length = key_buffer_size;
Gilles Peskine449bd832023-01-11 14:50:10 +01001346 return PSA_SUCCESS;
Steven Cooremana01795d2020-07-24 22:48:15 +02001347}
1348
Ronald Cron7285cda2020-11-26 14:46:37 +01001349psa_status_t psa_export_key_internal(
Ronald Crond18b5f82020-11-25 16:46:05 +01001350 const psa_key_attributes_t *attributes,
1351 const uint8_t *key_buffer, size_t key_buffer_size,
Gilles Peskine449bd832023-01-11 14:50:10 +01001352 uint8_t *data, size_t data_size, size_t *data_length)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001353{
Ronald Crond18b5f82020-11-25 16:46:05 +01001354 psa_key_type_t type = attributes->core.type;
1355
Gilles Peskine449bd832023-01-11 14:50:10 +01001356 if (key_type_is_raw_bytes(type) ||
1357 PSA_KEY_TYPE_IS_RSA(type) ||
Przemek Stekiel472b3f32022-12-01 14:38:49 +01001358 PSA_KEY_TYPE_IS_ECC(type) ||
1359 PSA_KEY_TYPE_IS_DH(type)) {
Gilles Peskine449bd832023-01-11 14:50:10 +01001360 return psa_export_key_buffer_internal(
1361 key_buffer, key_buffer_size,
1362 data, data_size, data_length);
1363 } else {
Ronald Cron9486f9d2020-11-26 13:36:23 +01001364 /* This shouldn't happen in the reference implementation, but
1365 it is valid for a special-purpose implementation to omit
1366 support for exporting certain key types. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001367 return PSA_ERROR_NOT_SUPPORTED;
Ronald Cron9486f9d2020-11-26 13:36:23 +01001368 }
1369}
1370
Gilles Peskine449bd832023-01-11 14:50:10 +01001371psa_status_t psa_export_key(mbedtls_svc_key_id_t key,
1372 uint8_t *data,
1373 size_t data_size,
1374 size_t *data_length)
Ronald Cron9486f9d2020-11-26 13:36:23 +01001375{
1376 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
1377 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
1378 psa_key_slot_t *slot;
1379
Ronald Crone907e552021-01-18 13:22:38 +01001380 /* Reject a zero-length output buffer now, since this can never be a
1381 * valid key representation. This way we know that data must be a valid
1382 * pointer and we can do things like memset(data, ..., data_size). */
Gilles Peskine449bd832023-01-11 14:50:10 +01001383 if (data_size == 0) {
1384 return PSA_ERROR_BUFFER_TOO_SMALL;
1385 }
Ronald Crone907e552021-01-18 13:22:38 +01001386
Ronald Cron9486f9d2020-11-26 13:36:23 +01001387 /* Set the key to empty now, so that even when there are errors, we always
1388 * set data_length to a value between 0 and data_size. On error, setting
1389 * the key to empty is a good choice because an empty key representation is
1390 * unlikely to be accepted anywhere. */
Jaeden Amerof24c7f82018-06-27 17:20:43 +01001391 *data_length = 0;
1392
Ronald Cron9486f9d2020-11-26 13:36:23 +01001393 /* Export requires the EXPORT flag. There is an exception for public keys,
1394 * which don't require any flag, but
1395 * psa_get_and_lock_key_slot_with_policy() takes care of this.
1396 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001397 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
1398 PSA_KEY_USAGE_EXPORT, 0);
1399 if (status != PSA_SUCCESS) {
1400 return status;
1401 }
mohammad160306e79202018-03-28 13:17:44 +03001402
Ronald Crond18b5f82020-11-25 16:46:05 +01001403 psa_key_attributes_t attributes = {
1404 .core = slot->attr
1405 };
Gilles Peskine449bd832023-01-11 14:50:10 +01001406 status = psa_driver_wrapper_export_key(&attributes,
1407 slot->key.data, slot->key.bytes,
1408 data, data_size, data_length);
Ronald Cron9486f9d2020-11-26 13:36:23 +01001409
Gilles Peskine449bd832023-01-11 14:50:10 +01001410 unlock_status = psa_unlock_key_slot(slot);
Ronald Cron9486f9d2020-11-26 13:36:23 +01001411
Gilles Peskine449bd832023-01-11 14:50:10 +01001412 return (status == PSA_SUCCESS) ? unlock_status : status;
Ronald Cron9486f9d2020-11-26 13:36:23 +01001413}
1414
Ronald Cron7285cda2020-11-26 14:46:37 +01001415psa_status_t psa_export_public_key_internal(
Ronald Crond18b5f82020-11-25 16:46:05 +01001416 const psa_key_attributes_t *attributes,
1417 const uint8_t *key_buffer,
1418 size_t key_buffer_size,
1419 uint8_t *data,
1420 size_t data_size,
Gilles Peskine449bd832023-01-11 14:50:10 +01001421 size_t *data_length)
Ronald Cron9486f9d2020-11-26 13:36:23 +01001422{
Ronald Crond18b5f82020-11-25 16:46:05 +01001423 psa_key_type_t type = attributes->core.type;
Ronald Crond18b5f82020-11-25 16:46:05 +01001424
Przemek Stekiel6fd72b62023-04-27 10:20:56 +02001425 if (PSA_KEY_TYPE_IS_PUBLIC_KEY(type) &&
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001426 (PSA_KEY_TYPE_IS_RSA(type) || PSA_KEY_TYPE_IS_ECC(type) ||
1427 PSA_KEY_TYPE_IS_DH(type))) {
Przemek Stekiel6fd72b62023-04-27 10:20:56 +02001428 /* Exporting public -> public */
1429 return psa_export_key_buffer_internal(
1430 key_buffer, key_buffer_size,
1431 data, data_size, data_length);
1432 } else if (PSA_KEY_TYPE_IS_RSA(type)) {
Valerio Setti8bb57632023-05-26 13:48:07 +02001433#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_LEGACY) || \
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001434 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
1435 return mbedtls_psa_rsa_export_public_key(attributes,
1436 key_buffer,
1437 key_buffer_size,
1438 data,
1439 data_size,
1440 data_length);
Darryl Green9e2d7a02018-07-24 16:33:30 +01001441#else
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001442 /* We don't know how to convert a private RSA key to public. */
1443 return PSA_ERROR_NOT_SUPPORTED;
Valerio Setti8bb57632023-05-26 13:48:07 +02001444#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_LEGACY) ||
John Durkop9814fa22020-11-04 12:28:15 -08001445 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Przemek Stekiel6fd72b62023-04-27 10:20:56 +02001446 } else if (PSA_KEY_TYPE_IS_ECC(type)) {
Valerio Setti8bb57632023-05-26 13:48:07 +02001447#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_LEGACY) || \
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001448 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
1449 return mbedtls_psa_ecp_export_public_key(attributes,
1450 key_buffer,
1451 key_buffer_size,
1452 data,
1453 data_size,
1454 data_length);
Steven Cooreman560c28a2020-07-24 23:20:24 +02001455#else
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001456 /* We don't know how to convert a private ECC key to public */
1457 return PSA_ERROR_NOT_SUPPORTED;
Valerio Setti8bb57632023-05-26 13:48:07 +02001458#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_LEGACY) ||
John Durkop9814fa22020-11-04 12:28:15 -08001459 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
Przemek Stekiel6fd72b62023-04-27 10:20:56 +02001460 } else if (PSA_KEY_TYPE_IS_DH(type)) {
Valerio Setti8bb57632023-05-26 13:48:07 +02001461#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_LEGACY) || \
Przemek Stekiel6d85afa2023-04-28 11:42:17 +02001462 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY)
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001463 return mbedtls_psa_export_ffdh_public_key(attributes,
1464 key_buffer,
1465 key_buffer_size,
1466 data, data_size,
1467 data_length);
Przemek Stekiel472b3f32022-12-01 14:38:49 +01001468#else
Przemek Stekiel472b3f32022-12-01 14:38:49 +01001469 return PSA_ERROR_NOT_SUPPORTED;
Valerio Setti8bb57632023-05-26 13:48:07 +02001470#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_LEGACY) ||
Przemek Stekiel6d85afa2023-04-28 11:42:17 +02001471 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) */
Gilles Peskine449bd832023-01-11 14:50:10 +01001472 } else {
Przemek Stekiel0b11ee02023-05-16 13:26:06 +02001473 (void) key_buffer;
1474 (void) key_buffer_size;
1475 (void) data;
1476 (void) data_size;
1477 (void) data_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01001478 return PSA_ERROR_NOT_SUPPORTED;
Steven Cooreman560c28a2020-07-24 23:20:24 +02001479 }
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001480}
Ronald Crond18b5f82020-11-25 16:46:05 +01001481
Gilles Peskine449bd832023-01-11 14:50:10 +01001482psa_status_t psa_export_public_key(mbedtls_svc_key_id_t key,
1483 uint8_t *data,
1484 size_t data_size,
1485 size_t *data_length)
Moran Pekerdd4ea382018-04-03 15:30:03 +03001486{
Ronald Cronf95a2b12020-10-22 15:24:49 +02001487 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01001488 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01001489 psa_key_slot_t *slot;
Darryl Greendd8fb772018-11-07 16:00:44 +00001490
Ronald Crone907e552021-01-18 13:22:38 +01001491 /* Reject a zero-length output buffer now, since this can never be a
1492 * valid key representation. This way we know that data must be a valid
1493 * pointer and we can do things like memset(data, ..., data_size). */
Gilles Peskine449bd832023-01-11 14:50:10 +01001494 if (data_size == 0) {
1495 return PSA_ERROR_BUFFER_TOO_SMALL;
1496 }
Ronald Crone907e552021-01-18 13:22:38 +01001497
Darryl Greendd8fb772018-11-07 16:00:44 +00001498 /* Set the key to empty now, so that even when there are errors, we always
1499 * set data_length to a value between 0 and data_size. On error, setting
1500 * the key to empty is a good choice because an empty key representation is
1501 * unlikely to be accepted anywhere. */
1502 *data_length = 0;
1503
1504 /* Exporting a public key doesn't require a usage flag. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001505 status = psa_get_and_lock_key_slot_with_policy(key, &slot, 0, 0);
1506 if (status != PSA_SUCCESS) {
1507 return status;
1508 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02001509
Gilles Peskine449bd832023-01-11 14:50:10 +01001510 if (!PSA_KEY_TYPE_IS_ASYMMETRIC(slot->attr.type)) {
1511 status = PSA_ERROR_INVALID_ARGUMENT;
1512 goto exit;
Ronald Cron9486f9d2020-11-26 13:36:23 +01001513 }
1514
Ronald Crond18b5f82020-11-25 16:46:05 +01001515 psa_key_attributes_t attributes = {
1516 .core = slot->attr
1517 };
Ronald Cron67227982020-11-26 15:16:05 +01001518 status = psa_driver_wrapper_export_public_key(
Ronald Crond18b5f82020-11-25 16:46:05 +01001519 &attributes, slot->key.data, slot->key.bytes,
Gilles Peskine449bd832023-01-11 14:50:10 +01001520 data, data_size, data_length);
Ronald Cron9486f9d2020-11-26 13:36:23 +01001521
1522exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001523 unlock_status = psa_unlock_key_slot(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02001524
Gilles Peskine449bd832023-01-11 14:50:10 +01001525 return (status == PSA_SUCCESS) ? unlock_status : status;
Moran Pekerdd4ea382018-04-03 15:30:03 +03001526}
1527
Tom Cosgrove6ef9bb32023-03-08 14:19:51 +00001528MBEDTLS_STATIC_ASSERT(
1529 (MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE) == 0,
1530 "One or more key attribute flag is listed as both external-only and dual-use")
1531MBEDTLS_STATIC_ASSERT(
1532 (PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE) == 0,
1533 "One or more key attribute flag is listed as both internal-only and dual-use")
1534MBEDTLS_STATIC_ASSERT(
1535 (PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY) == 0,
1536 "One or more key attribute flag is listed as both internal-only and external-only")
Gilles Peskine91e8c332019-08-02 19:19:39 +02001537
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001538/** Validate that a key policy is internally well-formed.
1539 *
1540 * This function only rejects invalid policies. It does not validate the
1541 * consistency of the policy with respect to other attributes of the key
1542 * such as the key type.
1543 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001544static psa_status_t psa_validate_key_policy(const psa_key_policy_t *policy)
Gilles Peskine4747d192019-04-17 15:05:45 +02001545{
Gilles Peskine449bd832023-01-11 14:50:10 +01001546 if ((policy->usage & ~(PSA_KEY_USAGE_EXPORT |
1547 PSA_KEY_USAGE_COPY |
1548 PSA_KEY_USAGE_ENCRYPT |
1549 PSA_KEY_USAGE_DECRYPT |
1550 PSA_KEY_USAGE_SIGN_MESSAGE |
1551 PSA_KEY_USAGE_VERIFY_MESSAGE |
1552 PSA_KEY_USAGE_SIGN_HASH |
1553 PSA_KEY_USAGE_VERIFY_HASH |
1554 PSA_KEY_USAGE_VERIFY_DERIVATION |
1555 PSA_KEY_USAGE_DERIVE)) != 0) {
1556 return PSA_ERROR_INVALID_ARGUMENT;
1557 }
Gilles Peskine4747d192019-04-17 15:05:45 +02001558
Gilles Peskine449bd832023-01-11 14:50:10 +01001559 return PSA_SUCCESS;
Gilles Peskine4747d192019-04-17 15:05:45 +02001560}
1561
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001562/** Validate the internal consistency of key attributes.
1563 *
1564 * This function only rejects invalid attribute values. If does not
1565 * validate the consistency of the attributes with any key data that may
1566 * be involved in the creation of the key.
1567 *
1568 * Call this function early in the key creation process.
1569 *
1570 * \param[in] attributes Key attributes for the new key.
1571 * \param[out] p_drv On any return, the driver for the key, if any.
1572 * NULL for a transparent key.
1573 *
1574 */
1575static psa_status_t psa_validate_key_attributes(
1576 const psa_key_attributes_t *attributes,
Gilles Peskine449bd832023-01-11 14:50:10 +01001577 psa_se_drv_table_entry_t **p_drv)
Darryl Green0c6575a2018-11-07 16:05:30 +00001578{
Steven Cooreman81fe7c32020-06-08 18:37:19 +02001579 psa_status_t status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine449bd832023-01-11 14:50:10 +01001580 psa_key_lifetime_t lifetime = psa_get_key_lifetime(attributes);
1581 mbedtls_svc_key_id_t key = psa_get_key_id(attributes);
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001582
Gilles Peskine449bd832023-01-11 14:50:10 +01001583 status = psa_validate_key_location(lifetime, p_drv);
1584 if (status != PSA_SUCCESS) {
1585 return status;
Ronald Crond2ed4812020-07-17 16:11:30 +02001586 }
1587
Gilles Peskine449bd832023-01-11 14:50:10 +01001588 status = psa_validate_key_persistence(lifetime);
1589 if (status != PSA_SUCCESS) {
1590 return status;
1591 }
1592
1593 if (PSA_KEY_LIFETIME_IS_VOLATILE(lifetime)) {
1594 if (MBEDTLS_SVC_KEY_ID_GET_KEY_ID(key) != 0) {
1595 return PSA_ERROR_INVALID_ARGUMENT;
1596 }
1597 } else {
1598 if (!psa_is_valid_key_id(psa_get_key_id(attributes), 0)) {
1599 return PSA_ERROR_INVALID_ARGUMENT;
1600 }
1601 }
1602
1603 status = psa_validate_key_policy(&attributes->core.policy);
1604 if (status != PSA_SUCCESS) {
1605 return status;
1606 }
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001607
1608 /* Refuse to create overly large keys.
1609 * Note that this doesn't trigger on import if the attributes don't
1610 * explicitly specify a size (so psa_get_key_bits returns 0), so
1611 * psa_import_key() needs its own checks. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001612 if (psa_get_key_bits(attributes) > PSA_MAX_KEY_BITS) {
1613 return PSA_ERROR_NOT_SUPPORTED;
1614 }
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001615
Gilles Peskine91e8c332019-08-02 19:19:39 +02001616 /* Reject invalid flags. These should not be reachable through the API. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001617 if (attributes->core.flags & ~(MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY |
1618 MBEDTLS_PSA_KA_MASK_DUAL_USE)) {
1619 return PSA_ERROR_INVALID_ARGUMENT;
1620 }
Gilles Peskine91e8c332019-08-02 19:19:39 +02001621
Gilles Peskine449bd832023-01-11 14:50:10 +01001622 return PSA_SUCCESS;
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001623}
1624
Gilles Peskine4747d192019-04-17 15:05:45 +02001625/** Prepare a key slot to receive key material.
1626 *
1627 * This function allocates a key slot and sets its metadata.
1628 *
1629 * If this function fails, call psa_fail_key_creation().
1630 *
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001631 * This function is intended to be used as follows:
1632 * -# Call psa_start_key_creation() to allocate a key slot, prepare
Ronald Croncf56a0a2020-08-04 09:51:30 +02001633 * it with the specified attributes, and in case of a volatile key assign it
1634 * a volatile key identifier.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001635 * -# Populate the slot with the key material.
1636 * -# Call psa_finish_key_creation() to finalize the creation of the slot.
1637 * In case of failure at any step, stop the sequence and call
1638 * psa_fail_key_creation().
1639 *
Ronald Cron5c522922020-11-14 16:35:34 +01001640 * On success, the key slot is locked. It is the responsibility of the caller
1641 * to unlock the key slot when it does not access it anymore.
Ronald Cronf95a2b12020-10-22 15:24:49 +02001642 *
Gilles Peskinedf179142019-07-15 22:02:14 +02001643 * \param method An identification of the calling function.
Gilles Peskine011e4282019-06-26 18:34:38 +02001644 * \param[in] attributes Key attributes for the new key.
Gilles Peskine011e4282019-06-26 18:34:38 +02001645 * \param[out] p_slot On success, a pointer to the prepared slot.
1646 * \param[out] p_drv On any return, the driver for the key, if any.
1647 * NULL for a transparent key.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001648 *
1649 * \retval #PSA_SUCCESS
1650 * The key slot is ready to receive key material.
1651 * \return If this function fails, the key slot is an invalid state.
1652 * You must call psa_fail_key_creation() to wipe and free the slot.
Gilles Peskine4747d192019-04-17 15:05:45 +02001653 */
1654static psa_status_t psa_start_key_creation(
Gilles Peskinedf179142019-07-15 22:02:14 +02001655 psa_key_creation_method_t method,
Gilles Peskine4747d192019-04-17 15:05:45 +02001656 const psa_key_attributes_t *attributes,
Gilles Peskine011e4282019-06-26 18:34:38 +02001657 psa_key_slot_t **p_slot,
Gilles Peskine449bd832023-01-11 14:50:10 +01001658 psa_se_drv_table_entry_t **p_drv)
Gilles Peskine4747d192019-04-17 15:05:45 +02001659{
1660 psa_status_t status;
Ronald Cron2a993152020-07-17 14:13:26 +02001661 psa_key_id_t volatile_key_id;
Gilles Peskine4747d192019-04-17 15:05:45 +02001662 psa_key_slot_t *slot;
1663
Gilles Peskinedf179142019-07-15 22:02:14 +02001664 (void) method;
Gilles Peskine011e4282019-06-26 18:34:38 +02001665 *p_drv = NULL;
1666
Gilles Peskine449bd832023-01-11 14:50:10 +01001667 status = psa_validate_key_attributes(attributes, p_drv);
1668 if (status != PSA_SUCCESS) {
1669 return status;
1670 }
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001671
Gilles Peskine449bd832023-01-11 14:50:10 +01001672 status = psa_get_empty_key_slot(&volatile_key_id, p_slot);
1673 if (status != PSA_SUCCESS) {
1674 return status;
1675 }
Gilles Peskine4747d192019-04-17 15:05:45 +02001676 slot = *p_slot;
1677
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001678 /* We're storing the declared bit-size of the key. It's up to each
1679 * creation mechanism to verify that this information is correct.
1680 * It's automatically correct for mechanisms that use the bit-size as
Gilles Peskineb46bef22019-07-30 21:32:04 +02001681 * an input (generate, device) but not for those where the bit-size
Ronald Cronc4d1b512020-07-31 11:26:37 +02001682 * is optional (import, copy). In case of a volatile key, assign it the
1683 * volatile key identifier associated to the slot returned to contain its
1684 * definition. */
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001685
1686 slot->attr = attributes->core;
Gilles Peskine449bd832023-01-11 14:50:10 +01001687 if (PSA_KEY_LIFETIME_IS_VOLATILE(slot->attr.lifetime)) {
Ronald Cronc4d1b512020-07-31 11:26:37 +02001688#if !defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER)
1689 slot->attr.id = volatile_key_id;
1690#else
1691 slot->attr.id.key_id = volatile_key_id;
1692#endif
1693 }
Gilles Peskinec744d992019-07-30 17:26:54 +02001694
Gilles Peskine91e8c332019-08-02 19:19:39 +02001695 /* Erase external-only flags from the internal copy. To access
Gilles Peskine013f5472019-08-07 15:42:14 +02001696 * external-only flags, query `attributes`. Thanks to the check
1697 * in psa_validate_key_attributes(), this leaves the dual-use
Gilles Peskineedbed562019-08-07 18:19:59 +02001698 * flags and any internal flag that psa_get_empty_key_slot()
Gilles Peskine013f5472019-08-07 15:42:14 +02001699 * may have set. */
1700 slot->attr.flags &= ~MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY;
Gilles Peskine91e8c332019-08-02 19:19:39 +02001701
Gilles Peskinecbaff462019-07-12 23:46:04 +02001702#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined7729582019-08-05 15:55:54 +02001703 /* For a key in a secure element, we need to do three things
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001704 * when creating or registering a persistent key:
Gilles Peskine60450a42019-07-25 11:32:45 +02001705 * create the key file in internal storage, create the
1706 * key inside the secure element, and update the driver's
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001707 * persistent data. This is done by starting a transaction that will
1708 * encompass these three actions.
1709 * For registering a volatile key, we just need to find an appropriate
1710 * slot number inside the SE. Since the key is designated volatile, creating
1711 * a transaction is not required. */
Gilles Peskine60450a42019-07-25 11:32:45 +02001712 /* The first thing to do is to find a slot number for the new key.
1713 * We save the slot number in persistent storage as part of the
1714 * transaction data. It will be needed to recover if the power
1715 * fails during the key creation process, to clean up on the secure
1716 * element side after restarting. Obtaining a slot number from the
1717 * secure element driver updates its persistent state, but we do not yet
1718 * save the driver's persistent state, so that if the power fails,
Gilles Peskinefc762652019-07-22 19:30:34 +02001719 * we can roll back to a state where the key doesn't exist. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001720 if (*p_drv != NULL) {
Ronald Cronea0f8a62020-11-25 17:52:23 +01001721 psa_key_slot_number_t slot_number;
Gilles Peskine449bd832023-01-11 14:50:10 +01001722 status = psa_find_se_slot_for_key(attributes, method, *p_drv,
1723 &slot_number);
1724 if (status != PSA_SUCCESS) {
1725 return status;
1726 }
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001727
Gilles Peskine449bd832023-01-11 14:50:10 +01001728 if (!PSA_KEY_LIFETIME_IS_VOLATILE(attributes->core.lifetime)) {
1729 psa_crypto_prepare_transaction(PSA_CRYPTO_TRANSACTION_CREATE_KEY);
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001730 psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
Ronald Cronea0f8a62020-11-25 17:52:23 +01001731 psa_crypto_transaction.key.slot = slot_number;
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001732 psa_crypto_transaction.key.id = slot->attr.id;
Gilles Peskine449bd832023-01-11 14:50:10 +01001733 status = psa_crypto_save_transaction();
1734 if (status != PSA_SUCCESS) {
1735 (void) psa_crypto_stop_transaction();
1736 return status;
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001737 }
Gilles Peskine66be51c2019-07-25 18:02:52 +02001738 }
Ronald Cronea0f8a62020-11-25 17:52:23 +01001739
1740 status = psa_copy_key_material_into_slot(
Gilles Peskine449bd832023-01-11 14:50:10 +01001741 slot, (uint8_t *) (&slot_number), sizeof(slot_number));
Darryl Green0c6575a2018-11-07 16:05:30 +00001742 }
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001743
Gilles Peskine449bd832023-01-11 14:50:10 +01001744 if (*p_drv == NULL && method == PSA_KEY_CREATION_REGISTER) {
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001745 /* Key registration only makes sense with a secure element. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001746 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001747 }
Gilles Peskinecbaff462019-07-12 23:46:04 +02001748#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1749
Gilles Peskine449bd832023-01-11 14:50:10 +01001750 return PSA_SUCCESS;
Darryl Green0c6575a2018-11-07 16:05:30 +00001751}
Gilles Peskine4747d192019-04-17 15:05:45 +02001752
1753/** Finalize the creation of a key once its key material has been set.
1754 *
1755 * This entails writing the key to persistent storage.
1756 *
1757 * If this function fails, call psa_fail_key_creation().
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001758 * See the documentation of psa_start_key_creation() for the intended use
1759 * of this function.
Gilles Peskine4747d192019-04-17 15:05:45 +02001760 *
Ronald Cron5c522922020-11-14 16:35:34 +01001761 * If the finalization succeeds, the function unlocks the key slot (it was
1762 * locked by psa_start_key_creation()) and the key slot cannot be accessed
1763 * anymore as part of the key creation process.
Ronald Cron50972942020-11-14 11:28:25 +01001764 *
Gilles Peskine011e4282019-06-26 18:34:38 +02001765 * \param[in,out] slot Pointer to the slot with key material.
1766 * \param[in] driver The secure element driver for the key,
1767 * or NULL for a transparent key.
Ronald Cron81709fc2020-11-14 12:10:32 +01001768 * \param[out] key On success, identifier of the key. Note that the
1769 * key identifier is also stored in the key slot.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001770 *
1771 * \retval #PSA_SUCCESS
Ronald Croncf56a0a2020-08-04 09:51:30 +02001772 * The key was successfully created.
Gilles Peskineed733552023-02-14 19:21:09 +01001773 * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription
1774 * \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription
1775 * \retval #PSA_ERROR_ALREADY_EXISTS \emptydescription
1776 * \retval #PSA_ERROR_DATA_INVALID \emptydescription
1777 * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription
1778 * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription
gabor-mezei-arm452b0a32020-11-09 17:42:55 +01001779 *
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001780 * \return If this function fails, the key slot is an invalid state.
1781 * You must call psa_fail_key_creation() to wipe and free the slot.
Gilles Peskine4747d192019-04-17 15:05:45 +02001782 */
Gilles Peskine011e4282019-06-26 18:34:38 +02001783static psa_status_t psa_finish_key_creation(
1784 psa_key_slot_t *slot,
Ronald Cron81709fc2020-11-14 12:10:32 +01001785 psa_se_drv_table_entry_t *driver,
1786 mbedtls_svc_key_id_t *key)
Gilles Peskine4747d192019-04-17 15:05:45 +02001787{
1788 psa_status_t status = PSA_SUCCESS;
Gilles Peskine30afafd2019-04-25 13:47:40 +02001789 (void) slot;
Gilles Peskine011e4282019-06-26 18:34:38 +02001790 (void) driver;
Gilles Peskine4747d192019-04-17 15:05:45 +02001791
1792#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001793 if (!PSA_KEY_LIFETIME_IS_VOLATILE(slot->attr.lifetime)) {
Gilles Peskine1df83d42019-07-23 16:13:14 +02001794#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001795 if (driver != NULL) {
Gilles Peskineb46bef22019-07-30 21:32:04 +02001796 psa_se_key_data_storage_t data;
Ronald Cronea0f8a62020-11-25 17:52:23 +01001797 psa_key_slot_number_t slot_number =
Gilles Peskine449bd832023-01-11 14:50:10 +01001798 psa_key_slot_get_slot_number(slot);
Ronald Cronea0f8a62020-11-25 17:52:23 +01001799
Tom Cosgrove6ef9bb32023-03-08 14:19:51 +00001800 MBEDTLS_STATIC_ASSERT(sizeof(slot_number) ==
1801 sizeof(data.slot_number),
1802 "Slot number size does not match psa_se_key_data_storage_t");
1803
Gilles Peskine449bd832023-01-11 14:50:10 +01001804 memcpy(&data.slot_number, &slot_number, sizeof(slot_number));
1805 status = psa_save_persistent_key(&slot->attr,
1806 (uint8_t *) &data,
1807 sizeof(data));
1808 } else
Gilles Peskine1df83d42019-07-23 16:13:14 +02001809#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1810 {
Steven Cooreman40120f62020-10-29 11:42:22 +01001811 /* Key material is saved in export representation in the slot, so
1812 * just pass the slot buffer for storage. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001813 status = psa_save_persistent_key(&slot->attr,
1814 slot->key.data,
1815 slot->key.bytes);
Gilles Peskine1df83d42019-07-23 16:13:14 +02001816 }
Gilles Peskine4747d192019-04-17 15:05:45 +02001817 }
Darryl Green0c6575a2018-11-07 16:05:30 +00001818#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
1819
Gilles Peskinecbaff462019-07-12 23:46:04 +02001820#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined7729582019-08-05 15:55:54 +02001821 /* Finish the transaction for a key creation. This does not
1822 * happen when registering an existing key. Detect this case
1823 * by checking whether a transaction is in progress (actual
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001824 * creation of a persistent key in a secure element requires a transaction,
1825 * but registration or volatile key creation doesn't use one). */
Gilles Peskine449bd832023-01-11 14:50:10 +01001826 if (driver != NULL &&
1827 psa_crypto_transaction.unknown.type == PSA_CRYPTO_TRANSACTION_CREATE_KEY) {
1828 status = psa_save_se_persistent_data(driver);
1829 if (status != PSA_SUCCESS) {
1830 psa_destroy_persistent_key(slot->attr.id);
1831 return status;
Gilles Peskinecbaff462019-07-12 23:46:04 +02001832 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001833 status = psa_crypto_stop_transaction();
Gilles Peskinecbaff462019-07-12 23:46:04 +02001834 }
1835#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1836
Gilles Peskine449bd832023-01-11 14:50:10 +01001837 if (status == PSA_SUCCESS) {
Ronald Cron81709fc2020-11-14 12:10:32 +01001838 *key = slot->attr.id;
Gilles Peskine449bd832023-01-11 14:50:10 +01001839 status = psa_unlock_key_slot(slot);
1840 if (status != PSA_SUCCESS) {
Ronald Cron81709fc2020-11-14 12:10:32 +01001841 *key = MBEDTLS_SVC_KEY_ID_INIT;
Gilles Peskine449bd832023-01-11 14:50:10 +01001842 }
Ronald Cron81709fc2020-11-14 12:10:32 +01001843 }
Ronald Cron50972942020-11-14 11:28:25 +01001844
Gilles Peskine449bd832023-01-11 14:50:10 +01001845 return status;
Gilles Peskine4747d192019-04-17 15:05:45 +02001846}
1847
1848/** Abort the creation of a key.
1849 *
1850 * You may call this function after calling psa_start_key_creation(),
1851 * or after psa_finish_key_creation() fails. In other circumstances, this
1852 * function may not clean up persistent storage.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001853 * See the documentation of psa_start_key_creation() for the intended use
1854 * of this function.
Gilles Peskine4747d192019-04-17 15:05:45 +02001855 *
Gilles Peskine011e4282019-06-26 18:34:38 +02001856 * \param[in,out] slot Pointer to the slot with key material.
1857 * \param[in] driver The secure element driver for the key,
1858 * or NULL for a transparent key.
Gilles Peskine4747d192019-04-17 15:05:45 +02001859 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001860static void psa_fail_key_creation(psa_key_slot_t *slot,
1861 psa_se_drv_table_entry_t *driver)
Gilles Peskine4747d192019-04-17 15:05:45 +02001862{
Gilles Peskine011e4282019-06-26 18:34:38 +02001863 (void) driver;
1864
Gilles Peskine449bd832023-01-11 14:50:10 +01001865 if (slot == NULL) {
Gilles Peskine4747d192019-04-17 15:05:45 +02001866 return;
Gilles Peskine449bd832023-01-11 14:50:10 +01001867 }
Gilles Peskine011e4282019-06-26 18:34:38 +02001868
1869#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Janos Follath1d57a202019-08-13 12:15:34 +01001870 /* TODO: If the key has already been created in the secure
Gilles Peskine011e4282019-06-26 18:34:38 +02001871 * element, and the failure happened later (when saving metadata
1872 * to internal storage), we need to destroy the key in the secure
Gilles Peskinec9d7f942019-08-13 16:17:16 +02001873 * element.
1874 * https://github.com/ARMmbed/mbed-crypto/issues/217
1875 */
Gilles Peskinefc762652019-07-22 19:30:34 +02001876
Gilles Peskined7729582019-08-05 15:55:54 +02001877 /* Abort the ongoing transaction if any (there may not be one if
1878 * the creation process failed before starting one, or if the
1879 * key creation is a registration of a key in a secure element).
1880 * Earlier functions must already have done what it takes to undo any
1881 * partial creation. All that's left is to update the transaction data
1882 * itself. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001883 (void) psa_crypto_stop_transaction();
Gilles Peskine011e4282019-06-26 18:34:38 +02001884#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1885
Gilles Peskine449bd832023-01-11 14:50:10 +01001886 psa_wipe_key_slot(slot);
Gilles Peskine4747d192019-04-17 15:05:45 +02001887}
1888
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001889/** Validate optional attributes during key creation.
1890 *
1891 * Some key attributes are optional during key creation. If they are
1892 * specified in the attributes structure, check that they are consistent
1893 * with the data in the slot.
1894 *
1895 * This function should be called near the end of key creation, after
1896 * the slot in memory is fully populated but before saving persistent data.
1897 */
1898static psa_status_t psa_validate_optional_attributes(
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001899 const psa_key_slot_t *slot,
Gilles Peskine449bd832023-01-11 14:50:10 +01001900 const psa_key_attributes_t *attributes)
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001901{
Gilles Peskine449bd832023-01-11 14:50:10 +01001902 if (attributes->core.type != 0) {
1903 if (attributes->core.type != slot->attr.type) {
1904 return PSA_ERROR_INVALID_ARGUMENT;
1905 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001906 }
1907
Gilles Peskine449bd832023-01-11 14:50:10 +01001908 if (attributes->domain_parameters_size != 0) {
Valerio Setti8bb57632023-05-26 13:48:07 +02001909#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_LEGACY) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01001910 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
1911 if (PSA_KEY_TYPE_IS_RSA(slot->attr.type)) {
Steven Cooremana2371e52020-07-28 14:30:39 +02001912 mbedtls_rsa_context *rsa = NULL;
Steven Cooreman75b74362020-07-28 14:30:13 +02001913 mbedtls_mpi actual, required;
Steven Cooreman6d839f02020-07-30 11:36:45 +02001914 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Steven Cooremana01795d2020-07-24 22:48:15 +02001915
Ronald Cron90857082020-11-25 14:58:33 +01001916 psa_status_t status = mbedtls_psa_rsa_load_representation(
Gilles Peskine449bd832023-01-11 14:50:10 +01001917 slot->attr.type,
1918 slot->key.data,
1919 slot->key.bytes,
1920 &rsa);
1921 if (status != PSA_SUCCESS) {
1922 return status;
1923 }
Steven Cooreman75b74362020-07-28 14:30:13 +02001924
Gilles Peskine449bd832023-01-11 14:50:10 +01001925 mbedtls_mpi_init(&actual);
1926 mbedtls_mpi_init(&required);
1927 ret = mbedtls_rsa_export(rsa,
1928 NULL, NULL, NULL, NULL, &actual);
1929 mbedtls_rsa_free(rsa);
1930 mbedtls_free(rsa);
1931 if (ret != 0) {
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001932 goto rsa_exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001933 }
1934 ret = mbedtls_mpi_read_binary(&required,
1935 attributes->domain_parameters,
1936 attributes->domain_parameters_size);
1937 if (ret != 0) {
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001938 goto rsa_exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001939 }
1940 if (mbedtls_mpi_cmp_mpi(&actual, &required) != 0) {
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001941 ret = MBEDTLS_ERR_RSA_BAD_INPUT_DATA;
Gilles Peskine449bd832023-01-11 14:50:10 +01001942 }
1943rsa_exit:
1944 mbedtls_mpi_free(&actual);
1945 mbedtls_mpi_free(&required);
1946 if (ret != 0) {
1947 return mbedtls_to_psa_error(ret);
1948 }
1949 } else
Valerio Setti8bb57632023-05-26 13:48:07 +02001950#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_LEGACY) ||
John Durkop9814fa22020-11-04 12:28:15 -08001951 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001952 {
Gilles Peskine449bd832023-01-11 14:50:10 +01001953 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001954 }
1955 }
1956
Gilles Peskine449bd832023-01-11 14:50:10 +01001957 if (attributes->core.bits != 0) {
1958 if (attributes->core.bits != slot->attr.bits) {
1959 return PSA_ERROR_INVALID_ARGUMENT;
1960 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001961 }
1962
Gilles Peskine449bd832023-01-11 14:50:10 +01001963 return PSA_SUCCESS;
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001964}
1965
Gilles Peskine449bd832023-01-11 14:50:10 +01001966psa_status_t psa_import_key(const psa_key_attributes_t *attributes,
1967 const uint8_t *data,
1968 size_t data_length,
1969 mbedtls_svc_key_id_t *key)
Gilles Peskine4747d192019-04-17 15:05:45 +02001970{
1971 psa_status_t status;
1972 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02001973 psa_se_drv_table_entry_t *driver = NULL;
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01001974 size_t bits;
Archanad8a83dc2021-06-14 10:04:16 +05301975 size_t storage_size = data_length;
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001976
Ronald Cron81709fc2020-11-14 12:10:32 +01001977 *key = MBEDTLS_SVC_KEY_ID_INIT;
1978
Gilles Peskine0f84d622019-09-12 19:03:13 +02001979 /* Reject zero-length symmetric keys (including raw data key objects).
1980 * This also rejects any key which might be encoded as an empty string,
1981 * which is never valid. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001982 if (data_length == 0) {
1983 return PSA_ERROR_INVALID_ARGUMENT;
1984 }
Gilles Peskine0f84d622019-09-12 19:03:13 +02001985
Archana449608b2021-09-08 15:36:05 +05301986 /* Ensure that the bytes-to-bits conversion cannot overflow. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001987 if (data_length > SIZE_MAX / 8) {
1988 return PSA_ERROR_NOT_SUPPORTED;
1989 }
Archana6ed4bda2021-08-04 10:47:15 +05301990
Gilles Peskine449bd832023-01-11 14:50:10 +01001991 status = psa_start_key_creation(PSA_KEY_CREATION_IMPORT, attributes,
1992 &slot, &driver);
1993 if (status != PSA_SUCCESS) {
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001994 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001995 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001996
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01001997 /* In the case of a transparent key or an opaque key stored in local
Archana449608b2021-09-08 15:36:05 +05301998 * storage ( thus not in the case of importing a key in a secure element
1999 * with storage ( MBEDTLS_PSA_CRYPTO_SE_C ) ),we have to allocate a
2000 * buffer to hold the imported key material. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002001 if (slot->key.data == NULL) {
2002 if (psa_key_lifetime_is_external(attributes->core.lifetime)) {
Archana449608b2021-09-08 15:36:05 +05302003 status = psa_driver_wrapper_get_key_buffer_size_from_key_data(
Gilles Peskine449bd832023-01-11 14:50:10 +01002004 attributes, data, data_length, &storage_size);
2005 if (status != PSA_SUCCESS) {
Archanad8a83dc2021-06-14 10:04:16 +05302006 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002007 }
Archanad8a83dc2021-06-14 10:04:16 +05302008 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002009 status = psa_allocate_buffer_to_slot(slot, storage_size);
2010 if (status != PSA_SUCCESS) {
Gilles Peskineb46bef22019-07-30 21:32:04 +02002011 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002012 }
Gilles Peskine5d309672019-07-12 23:47:28 +02002013 }
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01002014
2015 bits = slot->attr.bits;
Gilles Peskine449bd832023-01-11 14:50:10 +01002016 status = psa_driver_wrapper_import_key(attributes,
2017 data, data_length,
2018 slot->key.data,
2019 slot->key.bytes,
2020 &slot->key.bytes, &bits);
2021 if (status != PSA_SUCCESS) {
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01002022 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002023 }
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01002024
Gilles Peskine449bd832023-01-11 14:50:10 +01002025 if (slot->attr.bits == 0) {
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01002026 slot->attr.bits = (psa_key_bits_t) bits;
Gilles Peskine449bd832023-01-11 14:50:10 +01002027 } else if (bits != slot->attr.bits) {
Steven Cooremanac3434f2021-01-15 17:36:02 +01002028 status = PSA_ERROR_INVALID_ARGUMENT;
2029 goto exit;
Gilles Peskine5d309672019-07-12 23:47:28 +02002030 }
Ronald Cron2ebfdcc2020-11-28 15:54:54 +01002031
Archana6ed4bda2021-08-04 10:47:15 +05302032 /* Enforce a size limit, and in particular ensure that the bit
2033 * size fits in its representation type.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01002034 if (bits > PSA_MAX_KEY_BITS) {
Archana6ed4bda2021-08-04 10:47:15 +05302035 status = PSA_ERROR_NOT_SUPPORTED;
2036 goto exit;
2037 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002038 status = psa_validate_optional_attributes(slot, attributes);
2039 if (status != PSA_SUCCESS) {
Gilles Peskine18017402019-07-24 20:25:59 +02002040 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002041 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002042
Gilles Peskine449bd832023-01-11 14:50:10 +01002043 status = psa_finish_key_creation(slot, driver, key);
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002044exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002045 if (status != PSA_SUCCESS) {
2046 psa_fail_key_creation(slot, driver);
2047 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02002048
Gilles Peskine449bd832023-01-11 14:50:10 +01002049 return status;
Gilles Peskine4747d192019-04-17 15:05:45 +02002050}
2051
Gilles Peskined7729582019-08-05 15:55:54 +02002052#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
2053psa_status_t mbedtls_psa_register_se_key(
Gilles Peskine449bd832023-01-11 14:50:10 +01002054 const psa_key_attributes_t *attributes)
Gilles Peskined7729582019-08-05 15:55:54 +02002055{
2056 psa_status_t status;
2057 psa_key_slot_t *slot = NULL;
2058 psa_se_drv_table_entry_t *driver = NULL;
Ronald Croncf56a0a2020-08-04 09:51:30 +02002059 mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT;
Gilles Peskined7729582019-08-05 15:55:54 +02002060
2061 /* Leaving attributes unspecified is not currently supported.
2062 * It could make sense to query the key type and size from the
2063 * secure element, but not all secure elements support this
2064 * and the driver HAL doesn't currently support it. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002065 if (psa_get_key_type(attributes) == PSA_KEY_TYPE_NONE) {
2066 return PSA_ERROR_NOT_SUPPORTED;
2067 }
2068 if (psa_get_key_bits(attributes) == 0) {
2069 return PSA_ERROR_NOT_SUPPORTED;
2070 }
Gilles Peskined7729582019-08-05 15:55:54 +02002071
Gilles Peskine449bd832023-01-11 14:50:10 +01002072 status = psa_start_key_creation(PSA_KEY_CREATION_REGISTER, attributes,
2073 &slot, &driver);
2074 if (status != PSA_SUCCESS) {
Gilles Peskined7729582019-08-05 15:55:54 +02002075 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002076 }
Gilles Peskined7729582019-08-05 15:55:54 +02002077
Gilles Peskine449bd832023-01-11 14:50:10 +01002078 status = psa_finish_key_creation(slot, driver, &key);
Gilles Peskined7729582019-08-05 15:55:54 +02002079
2080exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002081 if (status != PSA_SUCCESS) {
2082 psa_fail_key_creation(slot, driver);
2083 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02002084
Gilles Peskined7729582019-08-05 15:55:54 +02002085 /* Registration doesn't keep the key in RAM. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002086 psa_close_key(key);
2087 return status;
Gilles Peskined7729582019-08-05 15:55:54 +02002088}
2089#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
2090
Gilles Peskine449bd832023-01-11 14:50:10 +01002091psa_status_t psa_copy_key(mbedtls_svc_key_id_t source_key,
2092 const psa_key_attributes_t *specified_attributes,
2093 mbedtls_svc_key_id_t *target_key)
Gilles Peskinef603c712019-01-19 13:40:11 +01002094{
Ronald Cronf95a2b12020-10-22 15:24:49 +02002095 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01002096 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinef603c712019-01-19 13:40:11 +01002097 psa_key_slot_t *source_slot = NULL;
2098 psa_key_slot_t *target_slot = NULL;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002099 psa_key_attributes_t actual_attributes = *specified_attributes;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02002100 psa_se_drv_table_entry_t *driver = NULL;
Archana8a180362021-07-05 02:18:48 +05302101 size_t storage_size = 0;
Gilles Peskinef603c712019-01-19 13:40:11 +01002102
Ronald Cron81709fc2020-11-14 12:10:32 +01002103 *target_key = MBEDTLS_SVC_KEY_ID_INIT;
2104
Archana8a180362021-07-05 02:18:48 +05302105 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002106 source_key, &source_slot, PSA_KEY_USAGE_COPY, 0);
2107 if (status != PSA_SUCCESS) {
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002108 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002109 }
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002110
Gilles Peskine449bd832023-01-11 14:50:10 +01002111 status = psa_validate_optional_attributes(source_slot,
2112 specified_attributes);
2113 if (status != PSA_SUCCESS) {
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002114 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002115 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002116
Archana9d17bf42021-09-10 06:22:44 +05302117 /* The target key type and number of bits have been validated by
2118 * psa_validate_optional_attributes() to be either equal to zero or
2119 * equal to the ones of the source key. So it is safe to inherit
2120 * them from the source key now."
Archana374fe5b2021-09-08 15:50:28 +05302121 * */
Archana9d17bf42021-09-10 06:22:44 +05302122 actual_attributes.core.bits = source_slot->attr.bits;
2123 actual_attributes.core.type = source_slot->attr.type;
Archana374fe5b2021-09-08 15:50:28 +05302124
2125
Gilles Peskine449bd832023-01-11 14:50:10 +01002126 status = psa_restrict_key_policy(source_slot->attr.type,
2127 &actual_attributes.core.policy,
2128 &source_slot->attr.policy);
2129 if (status != PSA_SUCCESS) {
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002130 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002131 }
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002132
Gilles Peskine449bd832023-01-11 14:50:10 +01002133 status = psa_start_key_creation(PSA_KEY_CREATION_COPY, &actual_attributes,
2134 &target_slot, &driver);
2135 if (status != PSA_SUCCESS) {
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002136 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002137 }
2138 if (PSA_KEY_LIFETIME_GET_LOCATION(target_slot->attr.lifetime) !=
2139 PSA_KEY_LIFETIME_GET_LOCATION(source_slot->attr.lifetime)) {
Archana8a180362021-07-05 02:18:48 +05302140 /*
Archana9d17bf42021-09-10 06:22:44 +05302141 * If the source and target keys are stored in different locations,
Archana8a180362021-07-05 02:18:48 +05302142 * the source key would need to be exported as plaintext and re-imported
2143 * in the other location. This has security implications which have not
Archana449608b2021-09-08 15:36:05 +05302144 * been fully mapped. For now, this can be achieved through
Archana8a180362021-07-05 02:18:48 +05302145 * appropriate API invocations from the application, if needed.
2146 * */
Gilles Peskinef4ee6622019-07-24 13:44:30 +02002147 status = PSA_ERROR_NOT_SUPPORTED;
2148 goto exit;
Gilles Peskinef603c712019-01-19 13:40:11 +01002149 }
Archana8a180362021-07-05 02:18:48 +05302150 /*
2151 * When the source and target keys are within the same location,
Archana449608b2021-09-08 15:36:05 +05302152 * - For transparent keys it is a blind copy without any driver invocation,
Archana8a180362021-07-05 02:18:48 +05302153 * - For opaque keys this translates to an invocation of the drivers'
2154 * copy_key entry point through the dispatch layer.
2155 * */
Gilles Peskine449bd832023-01-11 14:50:10 +01002156 if (psa_key_lifetime_is_external(actual_attributes.core.lifetime)) {
2157 status = psa_driver_wrapper_get_key_buffer_size(&actual_attributes,
2158 &storage_size);
2159 if (status != PSA_SUCCESS) {
Archana8a180362021-07-05 02:18:48 +05302160 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002161 }
Archana374fe5b2021-09-08 15:50:28 +05302162
Gilles Peskine449bd832023-01-11 14:50:10 +01002163 status = psa_allocate_buffer_to_slot(target_slot, storage_size);
2164 if (status != PSA_SUCCESS) {
Archana8a180362021-07-05 02:18:48 +05302165 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002166 }
Archana374fe5b2021-09-08 15:50:28 +05302167
Gilles Peskine449bd832023-01-11 14:50:10 +01002168 status = psa_driver_wrapper_copy_key(&actual_attributes,
2169 source_slot->key.data,
2170 source_slot->key.bytes,
2171 target_slot->key.data,
2172 target_slot->key.bytes,
2173 &target_slot->key.bytes);
2174 if (status != PSA_SUCCESS) {
Archana8a180362021-07-05 02:18:48 +05302175 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002176 }
2177 } else {
2178 status = psa_copy_key_material_into_slot(target_slot,
Archana9d17bf42021-09-10 06:22:44 +05302179 source_slot->key.data,
Gilles Peskine449bd832023-01-11 14:50:10 +01002180 source_slot->key.bytes);
2181 if (status != PSA_SUCCESS) {
Archana8a180362021-07-05 02:18:48 +05302182 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002183 }
Archana8a180362021-07-05 02:18:48 +05302184 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002185 status = psa_finish_key_creation(target_slot, driver, target_key);
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002186exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002187 if (status != PSA_SUCCESS) {
2188 psa_fail_key_creation(target_slot, driver);
2189 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02002190
Gilles Peskine449bd832023-01-11 14:50:10 +01002191 unlock_status = psa_unlock_key_slot(source_slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02002192
Gilles Peskine449bd832023-01-11 14:50:10 +01002193 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskinef603c712019-01-19 13:40:11 +01002194}
2195
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02002196
2197
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01002198/****************************************************************/
Gilles Peskine20035e32018-02-03 22:44:14 +01002199/* Message digests */
2200/****************************************************************/
2201
Gilles Peskine449bd832023-01-11 14:50:10 +01002202psa_status_t psa_hash_abort(psa_hash_operation_t *operation)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002203{
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002204 /* Aborting a non-active operation is allowed */
Gilles Peskine449bd832023-01-11 14:50:10 +01002205 if (operation->id == 0) {
2206 return PSA_SUCCESS;
2207 }
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002208
Gilles Peskine449bd832023-01-11 14:50:10 +01002209 psa_status_t status = psa_driver_wrapper_hash_abort(operation);
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002210 operation->id = 0;
2211
Gilles Peskine449bd832023-01-11 14:50:10 +01002212 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002213}
2214
Gilles Peskine449bd832023-01-11 14:50:10 +01002215psa_status_t psa_hash_setup(psa_hash_operation_t *operation,
2216 psa_algorithm_t alg)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002217{
Dave Rodgman685b6a72021-06-24 11:49:14 +01002218 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002219
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002220 /* A context must be freshly initialized before it can be set up. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002221 if (operation->id != 0) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002222 status = PSA_ERROR_BAD_STATE;
2223 goto exit;
2224 }
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002225
Gilles Peskine449bd832023-01-11 14:50:10 +01002226 if (!PSA_ALG_IS_HASH(alg)) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002227 status = PSA_ERROR_INVALID_ARGUMENT;
2228 goto exit;
2229 }
Jaeden Amero36ee5d02019-02-19 09:25:10 +00002230
Steven Cooremanb6bf4bb2021-03-15 19:00:14 +01002231 /* Ensure all of the context is zeroized, since PSA_HASH_OPERATION_INIT only
2232 * directly zeroes the int-sized dummy member of the context union. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002233 memset(&operation->ctx, 0, sizeof(operation->ctx));
Steven Cooreman893232f2021-03-15 12:23:37 +01002234
Gilles Peskine449bd832023-01-11 14:50:10 +01002235 status = psa_driver_wrapper_hash_setup(operation, alg);
Dave Rodgman685b6a72021-06-24 11:49:14 +01002236
2237exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002238 if (status != PSA_SUCCESS) {
2239 psa_hash_abort(operation);
2240 }
Dave Rodgman685b6a72021-06-24 11:49:14 +01002241
2242 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002243}
2244
Gilles Peskine449bd832023-01-11 14:50:10 +01002245psa_status_t psa_hash_update(psa_hash_operation_t *operation,
2246 const uint8_t *input,
2247 size_t input_length)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002248{
Dave Rodgman685b6a72021-06-24 11:49:14 +01002249 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2250
Gilles Peskine449bd832023-01-11 14:50:10 +01002251 if (operation->id == 0) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002252 status = PSA_ERROR_BAD_STATE;
2253 goto exit;
2254 }
Gilles Peskine94e44542018-07-12 16:58:43 +02002255
Steven Cooremanc8288352021-03-04 14:02:19 +01002256 /* Don't require hash implementations to behave correctly on a
2257 * zero-length input, which may have an invalid pointer. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002258 if (input_length == 0) {
2259 return PSA_SUCCESS;
2260 }
Steven Cooremanc8288352021-03-04 14:02:19 +01002261
Gilles Peskine449bd832023-01-11 14:50:10 +01002262 status = psa_driver_wrapper_hash_update(operation, input, input_length);
Dave Rodgman685b6a72021-06-24 11:49:14 +01002263
2264exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002265 if (status != PSA_SUCCESS) {
2266 psa_hash_abort(operation);
2267 }
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002268
Gilles Peskine449bd832023-01-11 14:50:10 +01002269 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002270}
2271
Gilles Peskine449bd832023-01-11 14:50:10 +01002272psa_status_t psa_hash_finish(psa_hash_operation_t *operation,
2273 uint8_t *hash,
2274 size_t hash_size,
2275 size_t *hash_length)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002276{
Steven Cooremanfbe09282021-03-08 18:41:12 +01002277 *hash_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01002278 if (operation->id == 0) {
2279 return PSA_ERROR_BAD_STATE;
2280 }
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002281
Steven Cooreman1e582352021-02-18 17:24:37 +01002282 psa_status_t status = psa_driver_wrapper_hash_finish(
Gilles Peskine449bd832023-01-11 14:50:10 +01002283 operation, hash, hash_size, hash_length);
2284 psa_hash_abort(operation);
2285 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002286}
2287
Gilles Peskine449bd832023-01-11 14:50:10 +01002288psa_status_t psa_hash_verify(psa_hash_operation_t *operation,
2289 const uint8_t *hash,
2290 size_t hash_length)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002291{
Ronald Cron69a63422021-10-18 09:47:58 +02002292 uint8_t actual_hash[PSA_HASH_MAX_SIZE];
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002293 size_t actual_hash_length;
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002294 psa_status_t status = psa_hash_finish(
Gilles Peskine449bd832023-01-11 14:50:10 +01002295 operation,
2296 actual_hash, sizeof(actual_hash),
2297 &actual_hash_length);
Dave Rodgman685b6a72021-06-24 11:49:14 +01002298
Gilles Peskine449bd832023-01-11 14:50:10 +01002299 if (status != PSA_SUCCESS) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002300 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002301 }
Dave Rodgman685b6a72021-06-24 11:49:14 +01002302
Gilles Peskine449bd832023-01-11 14:50:10 +01002303 if (actual_hash_length != hash_length) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002304 status = PSA_ERROR_INVALID_SIGNATURE;
2305 goto exit;
2306 }
2307
Gilles Peskine449bd832023-01-11 14:50:10 +01002308 if (mbedtls_psa_safer_memcmp(hash, actual_hash, actual_hash_length) != 0) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002309 status = PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskine449bd832023-01-11 14:50:10 +01002310 }
Dave Rodgman685b6a72021-06-24 11:49:14 +01002311
2312exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002313 mbedtls_platform_zeroize(actual_hash, sizeof(actual_hash));
2314 if (status != PSA_SUCCESS) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002315 psa_hash_abort(operation);
Gilles Peskine449bd832023-01-11 14:50:10 +01002316 }
Dave Rodgman685b6a72021-06-24 11:49:14 +01002317
Gilles Peskine449bd832023-01-11 14:50:10 +01002318 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002319}
2320
Gilles Peskine449bd832023-01-11 14:50:10 +01002321psa_status_t psa_hash_compute(psa_algorithm_t alg,
2322 const uint8_t *input, size_t input_length,
2323 uint8_t *hash, size_t hash_size,
2324 size_t *hash_length)
Gilles Peskine0a749c82019-11-28 19:33:58 +01002325{
Steven Cooremanfbe09282021-03-08 18:41:12 +01002326 *hash_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01002327 if (!PSA_ALG_IS_HASH(alg)) {
2328 return PSA_ERROR_INVALID_ARGUMENT;
2329 }
Steven Cooremanf66d5fd2021-03-08 18:40:40 +01002330
Gilles Peskine449bd832023-01-11 14:50:10 +01002331 return psa_driver_wrapper_hash_compute(alg, input, input_length,
2332 hash, hash_size, hash_length);
Gilles Peskine0a749c82019-11-28 19:33:58 +01002333}
2334
Gilles Peskine449bd832023-01-11 14:50:10 +01002335psa_status_t psa_hash_compare(psa_algorithm_t alg,
2336 const uint8_t *input, size_t input_length,
2337 const uint8_t *hash, size_t hash_length)
Gilles Peskine0a749c82019-11-28 19:33:58 +01002338{
Ronald Cron69a63422021-10-18 09:47:58 +02002339 uint8_t actual_hash[PSA_HASH_MAX_SIZE];
Steven Cooreman84d670d2021-02-18 16:22:53 +01002340 size_t actual_hash_length;
Steven Cooremanf66d5fd2021-03-08 18:40:40 +01002341
Gilles Peskine449bd832023-01-11 14:50:10 +01002342 if (!PSA_ALG_IS_HASH(alg)) {
2343 return PSA_ERROR_INVALID_ARGUMENT;
2344 }
Steven Cooremanf66d5fd2021-03-08 18:40:40 +01002345
Steven Cooreman1e582352021-02-18 17:24:37 +01002346 psa_status_t status = psa_driver_wrapper_hash_compute(
Gilles Peskine449bd832023-01-11 14:50:10 +01002347 alg, input, input_length,
2348 actual_hash, sizeof(actual_hash),
2349 &actual_hash_length);
2350 if (status != PSA_SUCCESS) {
Gilles Peskine60aebec2021-12-13 12:33:18 +01002351 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002352 }
2353 if (actual_hash_length != hash_length) {
Gilles Peskine60aebec2021-12-13 12:33:18 +01002354 status = PSA_ERROR_INVALID_SIGNATURE;
2355 goto exit;
2356 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002357 if (mbedtls_psa_safer_memcmp(hash, actual_hash, actual_hash_length) != 0) {
Gilles Peskine60aebec2021-12-13 12:33:18 +01002358 status = PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskine449bd832023-01-11 14:50:10 +01002359 }
Gilles Peskine60aebec2021-12-13 12:33:18 +01002360
2361exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002362 mbedtls_platform_zeroize(actual_hash, sizeof(actual_hash));
2363 return status;
Gilles Peskine0a749c82019-11-28 19:33:58 +01002364}
2365
Gilles Peskine449bd832023-01-11 14:50:10 +01002366psa_status_t psa_hash_clone(const psa_hash_operation_t *source_operation,
2367 psa_hash_operation_t *target_operation)
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002368{
Gilles Peskine449bd832023-01-11 14:50:10 +01002369 if (source_operation->id == 0 ||
2370 target_operation->id != 0) {
2371 return PSA_ERROR_BAD_STATE;
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002372 }
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002373
Gilles Peskine449bd832023-01-11 14:50:10 +01002374 psa_status_t status = psa_driver_wrapper_hash_clone(source_operation,
2375 target_operation);
2376 if (status != PSA_SUCCESS) {
2377 psa_hash_abort(target_operation);
2378 }
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002379
Gilles Peskine449bd832023-01-11 14:50:10 +01002380 return status;
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002381}
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002382
2383
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002384/****************************************************************/
Gilles Peskine8c9def32018-02-08 10:02:12 +01002385/* MAC */
2386/****************************************************************/
2387
Gilles Peskine449bd832023-01-11 14:50:10 +01002388psa_status_t psa_mac_abort(psa_mac_operation_t *operation)
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002389{
Steven Cooremane6804192021-03-19 18:28:56 +01002390 /* Aborting a non-active operation is allowed */
Gilles Peskine449bd832023-01-11 14:50:10 +01002391 if (operation->id == 0) {
2392 return PSA_SUCCESS;
2393 }
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002394
Gilles Peskine449bd832023-01-11 14:50:10 +01002395 psa_status_t status = psa_driver_wrapper_mac_abort(operation);
Steven Cooreman72f736a2021-05-07 14:14:37 +02002396 operation->mac_size = 0;
2397 operation->is_sign = 0;
Steven Cooremane6804192021-03-19 18:28:56 +01002398 operation->id = 0;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002399
Gilles Peskine449bd832023-01-11 14:50:10 +01002400 return status;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002401}
2402
Ronald Cron2dff3b22021-06-17 16:33:22 +02002403static psa_status_t psa_mac_finalize_alg_and_key_validation(
2404 psa_algorithm_t alg,
Ronald Cron79bdd822021-06-17 16:46:44 +02002405 const psa_key_attributes_t *attributes,
Gilles Peskine449bd832023-01-11 14:50:10 +01002406 uint8_t *mac_size)
Gilles Peskine8c9def32018-02-08 10:02:12 +01002407{
Ronald Cronf95a2b12020-10-22 15:24:49 +02002408 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine449bd832023-01-11 14:50:10 +01002409 psa_key_type_t key_type = psa_get_key_type(attributes);
2410 size_t key_bits = psa_get_key_bits(attributes);
Steven Cooreman77e2cc52021-03-19 17:05:52 +01002411
Gilles Peskine449bd832023-01-11 14:50:10 +01002412 if (!PSA_ALG_IS_MAC(alg)) {
2413 return PSA_ERROR_INVALID_ARGUMENT;
2414 }
Steven Cooremane6804192021-03-19 18:28:56 +01002415
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +01002416 /* Validate the combination of key type and algorithm */
Gilles Peskine449bd832023-01-11 14:50:10 +01002417 status = psa_mac_key_can_do(alg, key_type);
2418 if (status != PSA_SUCCESS) {
2419 return status;
2420 }
Steven Cooreman15472f82021-03-02 16:16:22 +01002421
Steven Cooremand1a68f12021-05-10 11:13:41 +02002422 /* Get the output length for the algorithm and key combination */
Gilles Peskine449bd832023-01-11 14:50:10 +01002423 *mac_size = PSA_MAC_LENGTH(key_type, key_bits, alg);
Steven Cooreman15472f82021-03-02 16:16:22 +01002424
Gilles Peskine449bd832023-01-11 14:50:10 +01002425 if (*mac_size < 4) {
Steven Cooreman15472f82021-03-02 16:16:22 +01002426 /* A very short MAC is too short for security since it can be
2427 * brute-forced. Ancient protocols with 32-bit MACs do exist,
2428 * so we make this our minimum, even though 32 bits is still
2429 * too small for security. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002430 return PSA_ERROR_NOT_SUPPORTED;
Steven Cooreman15472f82021-03-02 16:16:22 +01002431 }
Gilles Peskineab1d7ab2018-07-06 16:07:47 +02002432
Gilles Peskine449bd832023-01-11 14:50:10 +01002433 if (*mac_size > PSA_MAC_LENGTH(key_type, key_bits,
2434 PSA_ALG_FULL_LENGTH_MAC(alg))) {
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +01002435 /* It's impossible to "truncate" to a larger length than the full length
2436 * of the algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002437 return PSA_ERROR_INVALID_ARGUMENT;
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +01002438 }
2439
Gilles Peskine449bd832023-01-11 14:50:10 +01002440 if (*mac_size > PSA_MAC_MAX_SIZE) {
Gilles Peskinea9b6c802022-03-16 13:54:49 +01002441 /* PSA_MAC_LENGTH returns the correct length even for a MAC algorithm
2442 * that is disabled in the compile-time configuration. The result can
2443 * therefore be larger than PSA_MAC_MAX_SIZE, which does take the
2444 * configuration into account. In this case, force a return of
2445 * PSA_ERROR_NOT_SUPPORTED here. Otherwise psa_mac_verify(), or
2446 * psa_mac_compute(mac_size=PSA_MAC_MAX_SIZE), would return
2447 * PSA_ERROR_BUFFER_TOO_SMALL for an unsupported algorithm whose MAC size
2448 * is larger than PSA_MAC_MAX_SIZE, which is misleading and which breaks
2449 * systematically generated tests. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002450 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea9b6c802022-03-16 13:54:49 +01002451 }
2452
Gilles Peskine449bd832023-01-11 14:50:10 +01002453 return PSA_SUCCESS;
Ronald Cron2dff3b22021-06-17 16:33:22 +02002454}
2455
Gilles Peskine449bd832023-01-11 14:50:10 +01002456static psa_status_t psa_mac_setup(psa_mac_operation_t *operation,
2457 mbedtls_svc_key_id_t key,
2458 psa_algorithm_t alg,
2459 int is_sign)
Gilles Peskinee59236f2018-01-27 23:32:46 +01002460{
2461 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2462 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Dave Rodgman54648242021-06-24 11:49:45 +01002463 psa_key_slot_t *slot = NULL;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002464
2465 /* A context must be freshly initialized before it can be set up. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002466 if (operation->id != 0) {
Dave Rodgman54648242021-06-24 11:49:45 +01002467 status = PSA_ERROR_BAD_STATE;
2468 goto exit;
2469 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002470
2471 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002472 key,
2473 &slot,
2474 is_sign ? PSA_KEY_USAGE_SIGN_MESSAGE : PSA_KEY_USAGE_VERIFY_MESSAGE,
2475 alg);
2476 if (status != PSA_SUCCESS) {
Dave Rodgman54648242021-06-24 11:49:45 +01002477 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002478 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002479
2480 psa_key_attributes_t attributes = {
2481 .core = slot->attr
2482 };
2483
Gilles Peskine449bd832023-01-11 14:50:10 +01002484 status = psa_mac_finalize_alg_and_key_validation(alg, &attributes,
2485 &operation->mac_size);
2486 if (status != PSA_SUCCESS) {
Gilles Peskine8c9def32018-02-08 10:02:12 +01002487 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002488 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002489
2490 operation->is_sign = is_sign;
Steven Cooremane6804192021-03-19 18:28:56 +01002491 /* Dispatch the MAC setup call with validated input */
Gilles Peskine449bd832023-01-11 14:50:10 +01002492 if (is_sign) {
2493 status = psa_driver_wrapper_mac_sign_setup(operation,
2494 &attributes,
2495 slot->key.data,
2496 slot->key.bytes,
2497 alg);
2498 } else {
2499 status = psa_driver_wrapper_mac_verify_setup(operation,
2500 &attributes,
2501 slot->key.data,
2502 slot->key.bytes,
2503 alg);
Gilles Peskine8c9def32018-02-08 10:02:12 +01002504 }
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002505
Gilles Peskinefbfac682018-07-08 20:51:54 +02002506exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002507 if (status != PSA_SUCCESS) {
2508 psa_mac_abort(operation);
2509 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02002510
Gilles Peskine449bd832023-01-11 14:50:10 +01002511 unlock_status = psa_unlock_key_slot(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02002512
Gilles Peskine449bd832023-01-11 14:50:10 +01002513 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002514}
2515
Gilles Peskine449bd832023-01-11 14:50:10 +01002516psa_status_t psa_mac_sign_setup(psa_mac_operation_t *operation,
2517 mbedtls_svc_key_id_t key,
2518 psa_algorithm_t alg)
Gilles Peskine89167cb2018-07-08 20:12:23 +02002519{
Gilles Peskine449bd832023-01-11 14:50:10 +01002520 return psa_mac_setup(operation, key, alg, 1);
Gilles Peskine89167cb2018-07-08 20:12:23 +02002521}
2522
Gilles Peskine449bd832023-01-11 14:50:10 +01002523psa_status_t psa_mac_verify_setup(psa_mac_operation_t *operation,
2524 mbedtls_svc_key_id_t key,
2525 psa_algorithm_t alg)
Gilles Peskine89167cb2018-07-08 20:12:23 +02002526{
Gilles Peskine449bd832023-01-11 14:50:10 +01002527 return psa_mac_setup(operation, key, alg, 0);
Gilles Peskine89167cb2018-07-08 20:12:23 +02002528}
2529
Gilles Peskine449bd832023-01-11 14:50:10 +01002530psa_status_t psa_mac_update(psa_mac_operation_t *operation,
2531 const uint8_t *input,
2532 size_t input_length)
Gilles Peskine8c9def32018-02-08 10:02:12 +01002533{
Gilles Peskine449bd832023-01-11 14:50:10 +01002534 if (operation->id == 0) {
2535 return PSA_ERROR_BAD_STATE;
2536 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002537
Steven Cooreman6e7f2912021-03-19 18:38:46 +01002538 /* Don't require hash implementations to behave correctly on a
2539 * zero-length input, which may have an invalid pointer. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002540 if (input_length == 0) {
2541 return PSA_SUCCESS;
2542 }
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03002543
Gilles Peskine449bd832023-01-11 14:50:10 +01002544 psa_status_t status = psa_driver_wrapper_mac_update(operation,
2545 input, input_length);
2546 if (status != PSA_SUCCESS) {
2547 psa_mac_abort(operation);
2548 }
Steven Cooreman6e7f2912021-03-19 18:38:46 +01002549
Gilles Peskine449bd832023-01-11 14:50:10 +01002550 return status;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002551}
2552
Gilles Peskine449bd832023-01-11 14:50:10 +01002553psa_status_t psa_mac_sign_finish(psa_mac_operation_t *operation,
2554 uint8_t *mac,
2555 size_t mac_size,
2556 size_t *mac_length)
mohammad16036df908f2018-04-02 08:34:15 -07002557{
Steven Cooremana5b860a2021-03-19 19:04:39 +01002558 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2559 psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED;
Steven Cooreman77e2cc52021-03-19 17:05:52 +01002560
Gilles Peskine449bd832023-01-11 14:50:10 +01002561 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002562 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002563 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002564 }
Jaeden Amero252ef282019-02-15 14:05:35 +00002565
Gilles Peskine449bd832023-01-11 14:50:10 +01002566 if (!operation->is_sign) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002567 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002568 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002569 }
Steven Cooreman72f736a2021-05-07 14:14:37 +02002570
Steven Cooreman8af5c5c2021-05-11 11:09:13 +02002571 /* Sanity check. This will guarantee that mac_size != 0 (and so mac != NULL)
2572 * once all the error checks are done. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002573 if (operation->mac_size == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002574 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002575 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002576 }
Steven Cooreman8af5c5c2021-05-11 11:09:13 +02002577
Gilles Peskine449bd832023-01-11 14:50:10 +01002578 if (mac_size < operation->mac_size) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002579 status = PSA_ERROR_BUFFER_TOO_SMALL;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002580 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002581 }
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002582
Gilles Peskine449bd832023-01-11 14:50:10 +01002583 status = psa_driver_wrapper_mac_sign_finish(operation,
2584 mac, operation->mac_size,
2585 mac_length);
Steven Cooreman72f736a2021-05-07 14:14:37 +02002586
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002587exit:
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002588 /* In case of success, set the potential excess room in the output buffer
2589 * to an invalid value, to avoid potentially leaking a longer MAC.
2590 * In case of error, set the output length and content to a safe default,
2591 * such that in case the caller misses an error check, the output would be
2592 * an unachievable MAC.
2593 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002594 if (status != PSA_SUCCESS) {
Steven Cooreman72f736a2021-05-07 14:14:37 +02002595 *mac_length = mac_size;
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002596 operation->mac_size = 0;
Steven Cooreman72f736a2021-05-07 14:14:37 +02002597 }
mohammad16036df908f2018-04-02 08:34:15 -07002598
Paul Elliottdc42ca82023-02-24 18:11:59 +00002599 psa_wipe_tag_output_buffer(mac, status, mac_size, *mac_length);
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002600
Gilles Peskine449bd832023-01-11 14:50:10 +01002601 abort_status = psa_mac_abort(operation);
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002602
Gilles Peskine449bd832023-01-11 14:50:10 +01002603 return status == PSA_SUCCESS ? abort_status : status;
mohammad16036df908f2018-04-02 08:34:15 -07002604}
2605
Gilles Peskine449bd832023-01-11 14:50:10 +01002606psa_status_t psa_mac_verify_finish(psa_mac_operation_t *operation,
2607 const uint8_t *mac,
2608 size_t mac_length)
Gilles Peskine8c9def32018-02-08 10:02:12 +01002609{
Steven Cooremana5b860a2021-03-19 19:04:39 +01002610 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2611 psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED;
Steven Cooreman77e2cc52021-03-19 17:05:52 +01002612
Gilles Peskine449bd832023-01-11 14:50:10 +01002613 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002614 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002615 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002616 }
Jaeden Amero252ef282019-02-15 14:05:35 +00002617
Gilles Peskine449bd832023-01-11 14:50:10 +01002618 if (operation->is_sign) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002619 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002620 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002621 }
Steven Cooreman72f736a2021-05-07 14:14:37 +02002622
Gilles Peskine449bd832023-01-11 14:50:10 +01002623 if (operation->mac_size != mac_length) {
Steven Cooreman72f736a2021-05-07 14:14:37 +02002624 status = PSA_ERROR_INVALID_SIGNATURE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002625 goto exit;
Steven Cooreman72f736a2021-05-07 14:14:37 +02002626 }
2627
Gilles Peskine449bd832023-01-11 14:50:10 +01002628 status = psa_driver_wrapper_mac_verify_finish(operation,
2629 mac, mac_length);
Steven Cooreman72f736a2021-05-07 14:14:37 +02002630
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002631exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002632 abort_status = psa_mac_abort(operation);
mohammad16036df908f2018-04-02 08:34:15 -07002633
Gilles Peskine449bd832023-01-11 14:50:10 +01002634 return status == PSA_SUCCESS ? abort_status : status;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002635}
2636
Gilles Peskine449bd832023-01-11 14:50:10 +01002637static psa_status_t psa_mac_compute_internal(mbedtls_svc_key_id_t key,
2638 psa_algorithm_t alg,
2639 const uint8_t *input,
2640 size_t input_length,
2641 uint8_t *mac,
2642 size_t mac_size,
2643 size_t *mac_length,
2644 int is_sign)
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002645{
2646 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron51131b52021-06-17 17:17:20 +02002647 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
2648 psa_key_slot_t *slot;
2649 uint8_t operation_mac_size = 0;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002650
Ronald Cron51131b52021-06-17 17:17:20 +02002651 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002652 key,
2653 &slot,
2654 is_sign ? PSA_KEY_USAGE_SIGN_MESSAGE : PSA_KEY_USAGE_VERIFY_MESSAGE,
2655 alg);
2656 if (status != PSA_SUCCESS) {
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002657 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002658 }
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002659
Ronald Cron51131b52021-06-17 17:17:20 +02002660 psa_key_attributes_t attributes = {
2661 .core = slot->attr
2662 };
2663
Gilles Peskine449bd832023-01-11 14:50:10 +01002664 status = psa_mac_finalize_alg_and_key_validation(alg, &attributes,
2665 &operation_mac_size);
2666 if (status != PSA_SUCCESS) {
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002667 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002668 }
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002669
Gilles Peskine449bd832023-01-11 14:50:10 +01002670 if (mac_size < operation_mac_size) {
Ronald Cron51131b52021-06-17 17:17:20 +02002671 status = PSA_ERROR_BUFFER_TOO_SMALL;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002672 goto exit;
Ronald Cron51131b52021-06-17 17:17:20 +02002673 }
2674
2675 status = psa_driver_wrapper_mac_compute(
Gilles Peskine449bd832023-01-11 14:50:10 +01002676 &attributes,
2677 slot->key.data, slot->key.bytes,
2678 alg,
2679 input, input_length,
2680 mac, operation_mac_size, mac_length);
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002681
2682exit:
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002683 /* In case of success, set the potential excess room in the output buffer
2684 * to an invalid value, to avoid potentially leaking a longer MAC.
2685 * In case of error, set the output length and content to a safe default,
2686 * such that in case the caller misses an error check, the output would be
2687 * an unachievable MAC.
2688 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002689 if (status != PSA_SUCCESS) {
Ronald Cron51131b52021-06-17 17:17:20 +02002690 *mac_length = mac_size;
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002691 operation_mac_size = 0;
Ronald Cron51131b52021-06-17 17:17:20 +02002692 }
Paul Elliottdc42ca82023-02-24 18:11:59 +00002693
2694 psa_wipe_tag_output_buffer(mac, status, mac_size, *mac_length);
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002695
Gilles Peskine449bd832023-01-11 14:50:10 +01002696 unlock_status = psa_unlock_key_slot(slot);
Ronald Cron51131b52021-06-17 17:17:20 +02002697
Gilles Peskine449bd832023-01-11 14:50:10 +01002698 return (status == PSA_SUCCESS) ? unlock_status : status;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002699}
2700
Gilles Peskine449bd832023-01-11 14:50:10 +01002701psa_status_t psa_mac_compute(mbedtls_svc_key_id_t key,
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002702 psa_algorithm_t alg,
2703 const uint8_t *input,
2704 size_t input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002705 uint8_t *mac,
2706 size_t mac_size,
2707 size_t *mac_length)
2708{
2709 return psa_mac_compute_internal(key, alg,
2710 input, input_length,
2711 mac, mac_size, mac_length, 1);
2712}
2713
2714psa_status_t psa_mac_verify(mbedtls_svc_key_id_t key,
2715 psa_algorithm_t alg,
2716 const uint8_t *input,
2717 size_t input_length,
2718 const uint8_t *mac,
2719 size_t mac_length)
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002720{
2721 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Crona587cbc2021-06-18 14:51:29 +02002722 uint8_t actual_mac[PSA_MAC_MAX_SIZE];
2723 size_t actual_mac_length;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002724
Gilles Peskine449bd832023-01-11 14:50:10 +01002725 status = psa_mac_compute_internal(key, alg,
2726 input, input_length,
2727 actual_mac, sizeof(actual_mac),
2728 &actual_mac_length, 0);
2729 if (status != PSA_SUCCESS) {
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002730 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002731 }
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002732
Gilles Peskine449bd832023-01-11 14:50:10 +01002733 if (mac_length != actual_mac_length) {
Ronald Crona587cbc2021-06-18 14:51:29 +02002734 status = PSA_ERROR_INVALID_SIGNATURE;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002735 goto exit;
Ronald Crona587cbc2021-06-18 14:51:29 +02002736 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002737 if (mbedtls_psa_safer_memcmp(mac, actual_mac, actual_mac_length) != 0) {
Ronald Crona587cbc2021-06-18 14:51:29 +02002738 status = PSA_ERROR_INVALID_SIGNATURE;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002739 goto exit;
Ronald Crona587cbc2021-06-18 14:51:29 +02002740 }
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002741
2742exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002743 mbedtls_platform_zeroize(actual_mac, sizeof(actual_mac));
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002744
Gilles Peskine449bd832023-01-11 14:50:10 +01002745 return status;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002746}
Gilles Peskinee59236f2018-01-27 23:32:46 +01002747
Gilles Peskinee59236f2018-01-27 23:32:46 +01002748/****************************************************************/
2749/* Asymmetric cryptography */
2750/****************************************************************/
2751
Gilles Peskine449bd832023-01-11 14:50:10 +01002752static psa_status_t psa_sign_verify_check_alg(int input_is_message,
2753 psa_algorithm_t alg)
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002754{
Gilles Peskine449bd832023-01-11 14:50:10 +01002755 if (input_is_message) {
2756 if (!PSA_ALG_IS_SIGN_MESSAGE(alg)) {
2757 return PSA_ERROR_INVALID_ARGUMENT;
2758 }
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002759
Gilles Peskine449bd832023-01-11 14:50:10 +01002760 if (PSA_ALG_IS_SIGN_HASH(alg)) {
2761 if (!PSA_ALG_IS_HASH(PSA_ALG_SIGN_GET_HASH(alg))) {
2762 return PSA_ERROR_INVALID_ARGUMENT;
2763 }
2764 }
2765 } else {
2766 if (!PSA_ALG_IS_SIGN_HASH(alg)) {
2767 return PSA_ERROR_INVALID_ARGUMENT;
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002768 }
2769 }
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002770
Gilles Peskine449bd832023-01-11 14:50:10 +01002771 return PSA_SUCCESS;
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002772}
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002773
Gilles Peskine449bd832023-01-11 14:50:10 +01002774static psa_status_t psa_sign_internal(mbedtls_svc_key_id_t key,
2775 int input_is_message,
2776 psa_algorithm_t alg,
2777 const uint8_t *input,
2778 size_t input_length,
2779 uint8_t *signature,
2780 size_t signature_size,
2781 size_t *signature_length)
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002782{
2783 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2784 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
2785 psa_key_slot_t *slot;
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002786
2787 *signature_length = 0;
2788
Gilles Peskine449bd832023-01-11 14:50:10 +01002789 status = psa_sign_verify_check_alg(input_is_message, alg);
2790 if (status != PSA_SUCCESS) {
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002791 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01002792 }
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002793
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002794 /* Immediately reject a zero-length signature buffer. This guarantees
gabor-mezei-arm12b4f342021-05-05 13:54:55 +02002795 * that signature must be a valid pointer. (On the other hand, the input
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002796 * buffer can in principle be empty since it doesn't actually have
2797 * to be a hash.) */
Gilles Peskine449bd832023-01-11 14:50:10 +01002798 if (signature_size == 0) {
2799 return PSA_ERROR_BUFFER_TOO_SMALL;
2800 }
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002801
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002802 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002803 key, &slot,
2804 input_is_message ? PSA_KEY_USAGE_SIGN_MESSAGE :
2805 PSA_KEY_USAGE_SIGN_HASH,
2806 alg);
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002807
Gilles Peskine449bd832023-01-11 14:50:10 +01002808 if (status != PSA_SUCCESS) {
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002809 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002810 }
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002811
Gilles Peskine449bd832023-01-11 14:50:10 +01002812 if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) {
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002813 status = PSA_ERROR_INVALID_ARGUMENT;
2814 goto exit;
2815 }
2816
2817 psa_key_attributes_t attributes = {
Gilles Peskine449bd832023-01-11 14:50:10 +01002818 .core = slot->attr
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002819 };
2820
Gilles Peskine449bd832023-01-11 14:50:10 +01002821 if (input_is_message) {
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002822 status = psa_driver_wrapper_sign_message(
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002823 &attributes, slot->key.data, slot->key.bytes,
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002824 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002825 signature, signature_size, signature_length);
2826 } else {
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002827
2828 status = psa_driver_wrapper_sign_hash(
2829 &attributes, slot->key.data, slot->key.bytes,
2830 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002831 signature, signature_size, signature_length);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002832 }
2833
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002834
2835exit:
Paul Elliott59200a22023-02-21 15:07:40 +00002836 psa_wipe_tag_output_buffer(signature, status, signature_size,
2837 *signature_length);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002838
Gilles Peskine449bd832023-01-11 14:50:10 +01002839 unlock_status = psa_unlock_key_slot(slot);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002840
Gilles Peskine449bd832023-01-11 14:50:10 +01002841 return (status == PSA_SUCCESS) ? unlock_status : status;
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002842}
2843
Gilles Peskine449bd832023-01-11 14:50:10 +01002844static psa_status_t psa_verify_internal(mbedtls_svc_key_id_t key,
2845 int input_is_message,
2846 psa_algorithm_t alg,
2847 const uint8_t *input,
2848 size_t input_length,
2849 const uint8_t *signature,
2850 size_t signature_length)
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002851{
2852 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2853 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
2854 psa_key_slot_t *slot;
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002855
Gilles Peskine449bd832023-01-11 14:50:10 +01002856 status = psa_sign_verify_check_alg(input_is_message, alg);
2857 if (status != PSA_SUCCESS) {
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002858 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01002859 }
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002860
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002861 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002862 key, &slot,
2863 input_is_message ? PSA_KEY_USAGE_VERIFY_MESSAGE :
2864 PSA_KEY_USAGE_VERIFY_HASH,
2865 alg);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002866
Gilles Peskine449bd832023-01-11 14:50:10 +01002867 if (status != PSA_SUCCESS) {
2868 return status;
2869 }
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002870
2871 psa_key_attributes_t attributes = {
Gilles Peskine449bd832023-01-11 14:50:10 +01002872 .core = slot->attr
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002873 };
2874
Gilles Peskine449bd832023-01-11 14:50:10 +01002875 if (input_is_message) {
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002876 status = psa_driver_wrapper_verify_message(
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002877 &attributes, slot->key.data, slot->key.bytes,
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002878 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002879 signature, signature_length);
2880 } else {
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002881 status = psa_driver_wrapper_verify_hash(
2882 &attributes, slot->key.data, slot->key.bytes,
2883 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002884 signature, signature_length);
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002885 }
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002886
Gilles Peskine449bd832023-01-11 14:50:10 +01002887 unlock_status = psa_unlock_key_slot(slot);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002888
Gilles Peskine449bd832023-01-11 14:50:10 +01002889 return (status == PSA_SUCCESS) ? unlock_status : status;
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002890
2891}
2892
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02002893psa_status_t psa_sign_message_builtin(
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002894 const psa_key_attributes_t *attributes,
2895 const uint8_t *key_buffer,
2896 size_t key_buffer_size,
2897 psa_algorithm_t alg,
2898 const uint8_t *input,
2899 size_t input_length,
2900 uint8_t *signature,
2901 size_t signature_size,
Gilles Peskine449bd832023-01-11 14:50:10 +01002902 size_t *signature_length)
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002903{
2904 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002905
Gilles Peskine449bd832023-01-11 14:50:10 +01002906 if (PSA_ALG_IS_SIGN_HASH(alg)) {
gabor-mezei-armf9820f92021-05-03 16:26:20 +02002907 size_t hash_length;
2908 uint8_t hash[PSA_HASH_MAX_SIZE];
2909
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002910 status = psa_driver_wrapper_hash_compute(
Gilles Peskine449bd832023-01-11 14:50:10 +01002911 PSA_ALG_SIGN_GET_HASH(alg),
2912 input, input_length,
2913 hash, sizeof(hash), &hash_length);
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002914
Gilles Peskine449bd832023-01-11 14:50:10 +01002915 if (status != PSA_SUCCESS) {
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002916 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01002917 }
gabor-mezei-armf9820f92021-05-03 16:26:20 +02002918
2919 return psa_driver_wrapper_sign_hash(
Gilles Peskine449bd832023-01-11 14:50:10 +01002920 attributes, key_buffer, key_buffer_size,
2921 alg, hash, hash_length,
2922 signature, signature_size, signature_length);
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002923 }
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002924
Gilles Peskine449bd832023-01-11 14:50:10 +01002925 return PSA_ERROR_NOT_SUPPORTED;
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002926}
2927
Gilles Peskine449bd832023-01-11 14:50:10 +01002928psa_status_t psa_sign_message(mbedtls_svc_key_id_t key,
2929 psa_algorithm_t alg,
2930 const uint8_t *input,
2931 size_t input_length,
2932 uint8_t *signature,
2933 size_t signature_size,
2934 size_t *signature_length)
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002935{
2936 return psa_sign_internal(
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002937 key, 1, alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002938 signature, signature_size, signature_length);
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002939}
2940
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02002941psa_status_t psa_verify_message_builtin(
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002942 const psa_key_attributes_t *attributes,
2943 const uint8_t *key_buffer,
2944 size_t key_buffer_size,
2945 psa_algorithm_t alg,
2946 const uint8_t *input,
2947 size_t input_length,
2948 const uint8_t *signature,
Gilles Peskine449bd832023-01-11 14:50:10 +01002949 size_t signature_length)
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002950{
2951 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002952
Gilles Peskine449bd832023-01-11 14:50:10 +01002953 if (PSA_ALG_IS_SIGN_HASH(alg)) {
gabor-mezei-armf9820f92021-05-03 16:26:20 +02002954 size_t hash_length;
2955 uint8_t hash[PSA_HASH_MAX_SIZE];
2956
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002957 status = psa_driver_wrapper_hash_compute(
Gilles Peskine449bd832023-01-11 14:50:10 +01002958 PSA_ALG_SIGN_GET_HASH(alg),
2959 input, input_length,
2960 hash, sizeof(hash), &hash_length);
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002961
Gilles Peskine449bd832023-01-11 14:50:10 +01002962 if (status != PSA_SUCCESS) {
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002963 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01002964 }
gabor-mezei-armf9820f92021-05-03 16:26:20 +02002965
2966 return psa_driver_wrapper_verify_hash(
Gilles Peskine449bd832023-01-11 14:50:10 +01002967 attributes, key_buffer, key_buffer_size,
2968 alg, hash, hash_length,
2969 signature, signature_length);
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002970 }
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002971
Gilles Peskine449bd832023-01-11 14:50:10 +01002972 return PSA_ERROR_NOT_SUPPORTED;
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002973}
2974
Gilles Peskine449bd832023-01-11 14:50:10 +01002975psa_status_t psa_verify_message(mbedtls_svc_key_id_t key,
2976 psa_algorithm_t alg,
2977 const uint8_t *input,
2978 size_t input_length,
2979 const uint8_t *signature,
2980 size_t signature_length)
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002981{
2982 return psa_verify_internal(
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002983 key, 1, alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002984 signature, signature_length);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002985}
2986
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02002987psa_status_t psa_sign_hash_builtin(
Ronald Cron18659932020-12-08 16:32:23 +01002988 const psa_key_attributes_t *attributes,
2989 const uint8_t *key_buffer, size_t key_buffer_size,
2990 psa_algorithm_t alg, const uint8_t *hash, size_t hash_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002991 uint8_t *signature, size_t signature_size, size_t *signature_length)
Gilles Peskinee59236f2018-01-27 23:32:46 +01002992{
Gilles Peskine449bd832023-01-11 14:50:10 +01002993 if (attributes->core.type == PSA_KEY_TYPE_RSA_KEY_PAIR) {
2994 if (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) ||
2995 PSA_ALG_IS_RSA_PSS(alg)) {
Ronald Cron4501c982021-03-19 20:09:32 +01002996#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01002997 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
2998 return mbedtls_psa_rsa_sign_hash(
2999 attributes,
3000 key_buffer, key_buffer_size,
3001 alg, hash, hash_length,
3002 signature, signature_size, signature_length);
Ronald Cron4501c982021-03-19 20:09:32 +01003003#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
3004 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
Gilles Peskine449bd832023-01-11 14:50:10 +01003005 } else {
3006 return PSA_ERROR_INVALID_ARGUMENT;
Steven Cooremanacda8342020-07-24 23:09:52 +02003007 }
Gilles Peskine449bd832023-01-11 14:50:10 +01003008 } else if (PSA_KEY_TYPE_IS_ECC(attributes->core.type)) {
3009 if (PSA_ALG_IS_ECDSA(alg)) {
Ronald Cron4501c982021-03-19 20:09:32 +01003010#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01003011 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
3012 return mbedtls_psa_ecdsa_sign_hash(
3013 attributes,
3014 key_buffer, key_buffer_size,
3015 alg, hash, hash_length,
3016 signature, signature_size, signature_length);
Gilles Peskinee59236f2018-01-27 23:32:46 +01003017#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3018 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Gilles Peskine449bd832023-01-11 14:50:10 +01003019 } else {
3020 return PSA_ERROR_INVALID_ARGUMENT;
Ronald Cron4501c982021-03-19 20:09:32 +01003021 }
Ronald Cron8a494f32021-02-17 09:49:51 +01003022 }
Ronald Cron4501c982021-03-19 20:09:32 +01003023
Gilles Peskine449bd832023-01-11 14:50:10 +01003024 (void) key_buffer;
3025 (void) key_buffer_size;
3026 (void) hash;
3027 (void) hash_length;
3028 (void) signature;
3029 (void) signature_size;
3030 (void) signature_length;
Ronald Cron4501c982021-03-19 20:09:32 +01003031
Gilles Peskine449bd832023-01-11 14:50:10 +01003032 return PSA_ERROR_NOT_SUPPORTED;
Ronald Cron18659932020-12-08 16:32:23 +01003033}
Gilles Peskinee59236f2018-01-27 23:32:46 +01003034
Gilles Peskine449bd832023-01-11 14:50:10 +01003035psa_status_t psa_sign_hash(mbedtls_svc_key_id_t key,
3036 psa_algorithm_t alg,
3037 const uint8_t *hash,
3038 size_t hash_length,
3039 uint8_t *signature,
3040 size_t signature_size,
3041 size_t *signature_length)
Gilles Peskinee59236f2018-01-27 23:32:46 +01003042{
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003043 return psa_sign_internal(
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02003044 key, 0, alg, hash, hash_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003045 signature, signature_size, signature_length);
itayzafrir5c753392018-05-08 11:18:38 +03003046}
3047
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02003048psa_status_t psa_verify_hash_builtin(
Ronald Cron18659932020-12-08 16:32:23 +01003049 const psa_key_attributes_t *attributes,
3050 const uint8_t *key_buffer, size_t key_buffer_size,
3051 psa_algorithm_t alg, const uint8_t *hash, size_t hash_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003052 const uint8_t *signature, size_t signature_length)
itayzafrir5c753392018-05-08 11:18:38 +03003053{
Gilles Peskine449bd832023-01-11 14:50:10 +01003054 if (PSA_KEY_TYPE_IS_RSA(attributes->core.type)) {
3055 if (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) ||
3056 PSA_ALG_IS_RSA_PSS(alg)) {
Ronald Cron4501c982021-03-19 20:09:32 +01003057#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01003058 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
3059 return mbedtls_psa_rsa_verify_hash(
3060 attributes,
3061 key_buffer, key_buffer_size,
3062 alg, hash, hash_length,
3063 signature, signature_length);
Ronald Cron4501c982021-03-19 20:09:32 +01003064#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
3065 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
Gilles Peskine449bd832023-01-11 14:50:10 +01003066 } else {
3067 return PSA_ERROR_INVALID_ARGUMENT;
Steven Cooremanacda8342020-07-24 23:09:52 +02003068 }
Gilles Peskine449bd832023-01-11 14:50:10 +01003069 } else if (PSA_KEY_TYPE_IS_ECC(attributes->core.type)) {
3070 if (PSA_ALG_IS_ECDSA(alg)) {
Ronald Cron4501c982021-03-19 20:09:32 +01003071#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01003072 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
3073 return mbedtls_psa_ecdsa_verify_hash(
3074 attributes,
3075 key_buffer, key_buffer_size,
3076 alg, hash, hash_length,
3077 signature, signature_length);
Ronald Cron4501c982021-03-19 20:09:32 +01003078#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3079 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Gilles Peskine449bd832023-01-11 14:50:10 +01003080 } else {
3081 return PSA_ERROR_INVALID_ARGUMENT;
Ronald Cron4501c982021-03-19 20:09:32 +01003082 }
Ronald Cron8a494f32021-02-17 09:49:51 +01003083 }
Ronald Cron4501c982021-03-19 20:09:32 +01003084
Gilles Peskine449bd832023-01-11 14:50:10 +01003085 (void) key_buffer;
3086 (void) key_buffer_size;
3087 (void) hash;
3088 (void) hash_length;
3089 (void) signature;
3090 (void) signature_length;
Ronald Cron4501c982021-03-19 20:09:32 +01003091
Gilles Peskine449bd832023-01-11 14:50:10 +01003092 return PSA_ERROR_NOT_SUPPORTED;
Ronald Cron18659932020-12-08 16:32:23 +01003093}
3094
Gilles Peskine449bd832023-01-11 14:50:10 +01003095psa_status_t psa_verify_hash(mbedtls_svc_key_id_t key,
3096 psa_algorithm_t alg,
3097 const uint8_t *hash,
3098 size_t hash_length,
3099 const uint8_t *signature,
3100 size_t signature_length)
itayzafrir5c753392018-05-08 11:18:38 +03003101{
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003102 return psa_verify_internal(
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02003103 key, 0, alg, hash, hash_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003104 signature, signature_length);
Gilles Peskinee59236f2018-01-27 23:32:46 +01003105}
3106
Gilles Peskine449bd832023-01-11 14:50:10 +01003107psa_status_t psa_asymmetric_encrypt(mbedtls_svc_key_id_t key,
3108 psa_algorithm_t alg,
3109 const uint8_t *input,
3110 size_t input_length,
3111 const uint8_t *salt,
3112 size_t salt_length,
3113 uint8_t *output,
3114 size_t output_size,
3115 size_t *output_length)
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003116{
Ronald Cronf95a2b12020-10-22 15:24:49 +02003117 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01003118 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01003119 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003120
Darryl Green5cc689a2018-07-24 15:34:10 +01003121 (void) input;
3122 (void) input_length;
3123 (void) salt;
3124 (void) output;
3125 (void) output_size;
3126
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03003127 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003128
Gilles Peskine449bd832023-01-11 14:50:10 +01003129 if (!PSA_ALG_IS_RSA_OAEP(alg) && salt_length != 0) {
3130 return PSA_ERROR_INVALID_ARGUMENT;
3131 }
Gilles Peskineb3fc05d2018-06-30 19:04:35 +02003132
Ronald Cron5c522922020-11-14 16:35:34 +01003133 status = psa_get_and_lock_transparent_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01003134 key, &slot, PSA_KEY_USAGE_ENCRYPT, alg);
3135 if (status != PSA_SUCCESS) {
3136 return status;
3137 }
3138 if (!(PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type) ||
3139 PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type))) {
Ronald Cronf95a2b12020-10-22 15:24:49 +02003140 status = PSA_ERROR_INVALID_ARGUMENT;
3141 goto exit;
3142 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003143
Przemyslaw Stekiel19e61422021-12-09 11:09:11 +01003144 psa_key_attributes_t attributes = {
Gilles Peskine449bd832023-01-11 14:50:10 +01003145 .core = slot->attr
Przemyslaw Stekiel19e61422021-12-09 11:09:11 +01003146 };
Steven Cooremana2371e52020-07-28 14:30:39 +02003147
Przemyslaw Stekiel19e61422021-12-09 11:09:11 +01003148 status = psa_driver_wrapper_asymmetric_encrypt(
3149 &attributes, slot->key.data, slot->key.bytes,
3150 alg, input, input_length, salt, salt_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003151 output, output_size, output_length);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003152exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01003153 unlock_status = psa_unlock_key_slot(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003154
Gilles Peskine449bd832023-01-11 14:50:10 +01003155 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine5b051bc2018-05-31 13:25:48 +02003156}
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003157
Gilles Peskine449bd832023-01-11 14:50:10 +01003158psa_status_t psa_asymmetric_decrypt(mbedtls_svc_key_id_t key,
3159 psa_algorithm_t alg,
3160 const uint8_t *input,
3161 size_t input_length,
3162 const uint8_t *salt,
3163 size_t salt_length,
3164 uint8_t *output,
3165 size_t output_size,
3166 size_t *output_length)
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003167{
Ronald Cronf95a2b12020-10-22 15:24:49 +02003168 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01003169 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01003170 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003171
Darryl Green5cc689a2018-07-24 15:34:10 +01003172 (void) input;
3173 (void) input_length;
3174 (void) salt;
3175 (void) output;
3176 (void) output_size;
3177
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03003178 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003179
Gilles Peskine449bd832023-01-11 14:50:10 +01003180 if (!PSA_ALG_IS_RSA_OAEP(alg) && salt_length != 0) {
3181 return PSA_ERROR_INVALID_ARGUMENT;
3182 }
Gilles Peskineb3fc05d2018-06-30 19:04:35 +02003183
Ronald Cron5c522922020-11-14 16:35:34 +01003184 status = psa_get_and_lock_transparent_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01003185 key, &slot, PSA_KEY_USAGE_DECRYPT, alg);
3186 if (status != PSA_SUCCESS) {
3187 return status;
3188 }
3189 if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) {
Ronald Cronf95a2b12020-10-22 15:24:49 +02003190 status = PSA_ERROR_INVALID_ARGUMENT;
3191 goto exit;
3192 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003193
Przemyslaw Stekiel8d45c002021-12-13 08:58:19 +01003194 psa_key_attributes_t attributes = {
Gilles Peskine449bd832023-01-11 14:50:10 +01003195 .core = slot->attr
Przemyslaw Stekiel8d45c002021-12-13 08:58:19 +01003196 };
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003197
Przemyslaw Stekiel8d45c002021-12-13 08:58:19 +01003198 status = psa_driver_wrapper_asymmetric_decrypt(
3199 &attributes, slot->key.data, slot->key.bytes,
3200 alg, input, input_length, salt, salt_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003201 output, output_size, output_length);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003202
3203exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01003204 unlock_status = psa_unlock_key_slot(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003205
Gilles Peskine449bd832023-01-11 14:50:10 +01003206 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine5b051bc2018-05-31 13:25:48 +02003207}
Gilles Peskinee59236f2018-01-27 23:32:46 +01003208
Paul Elliott9fe12f62022-11-30 19:16:02 +00003209/****************************************************************/
3210/* Asymmetric interruptible cryptography */
3211/****************************************************************/
3212
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003213static uint32_t psa_interruptible_max_ops = PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED;
3214
Paul Elliott9fe12f62022-11-30 19:16:02 +00003215void psa_interruptible_set_max_ops(uint32_t max_ops)
3216{
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003217 psa_interruptible_max_ops = max_ops;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003218}
3219
3220uint32_t psa_interruptible_get_max_ops(void)
3221{
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003222 return psa_interruptible_max_ops;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003223}
3224
Paul Elliott9fe12f62022-11-30 19:16:02 +00003225uint32_t psa_sign_hash_get_num_ops(
3226 const psa_sign_hash_interruptible_operation_t *operation)
3227{
Paul Elliott296ede92022-12-15 17:00:30 +00003228 return operation->num_ops;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003229}
3230
3231uint32_t psa_verify_hash_get_num_ops(
3232 const psa_verify_hash_interruptible_operation_t *operation)
3233{
Paul Elliott296ede92022-12-15 17:00:30 +00003234 return operation->num_ops;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003235}
3236
Paul Elliott59ad9452022-12-18 15:09:02 +00003237static psa_status_t psa_sign_hash_abort_internal(
3238 psa_sign_hash_interruptible_operation_t *operation)
3239{
3240 if (operation->id == 0) {
3241 /* The object has (apparently) been initialized but it is not (yet)
3242 * in use. It's ok to call abort on such an object, and there's
3243 * nothing to do. */
3244 return PSA_SUCCESS;
3245 }
3246
3247 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3248
3249 status = psa_driver_wrapper_sign_hash_abort(operation);
3250
3251 operation->id = 0;
3252
Paul Elliotte6145dc2023-02-07 12:51:21 +00003253 /* Do not clear either the error_occurred or num_ops elements here as they
3254 * only want to be cleared by the application calling abort, not by abort
3255 * being called at completion of an operation. */
3256
Paul Elliott59ad9452022-12-18 15:09:02 +00003257 return status;
3258}
3259
Paul Elliott9fe12f62022-11-30 19:16:02 +00003260psa_status_t psa_sign_hash_start(
3261 psa_sign_hash_interruptible_operation_t *operation,
3262 mbedtls_svc_key_id_t key, psa_algorithm_t alg,
3263 const uint8_t *hash, size_t hash_length)
3264{
3265 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3266 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
3267 psa_key_slot_t *slot;
3268
Paul Elliottc9774412023-02-06 15:14:07 +00003269 /* Check that start has not been previously called, or operation has not
3270 * previously errored. */
3271 if (operation->id != 0 || operation->error_occurred) {
Paul Elliott9fe12f62022-11-30 19:16:02 +00003272 return PSA_ERROR_BAD_STATE;
3273 }
3274
Paul Elliott9fe12f62022-11-30 19:16:02 +00003275 status = psa_sign_verify_check_alg(0, alg);
3276 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003277 operation->error_occurred = 1;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003278 return status;
3279 }
3280
3281 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
3282 PSA_KEY_USAGE_SIGN_HASH,
3283 alg);
3284
3285 if (status != PSA_SUCCESS) {
3286 goto exit;
3287 }
3288
3289 if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) {
3290 status = PSA_ERROR_INVALID_ARGUMENT;
3291 goto exit;
3292 }
3293
3294 psa_key_attributes_t attributes = {
3295 .core = slot->attr
3296 };
3297
Paul Elliott296ede92022-12-15 17:00:30 +00003298 /* Ensure ops count gets reset, in case of operation re-use. */
3299 operation->num_ops = 0;
3300
Paul Elliott9fe12f62022-11-30 19:16:02 +00003301 status = psa_driver_wrapper_sign_hash_start(operation, &attributes,
3302 slot->key.data,
3303 slot->key.bytes, alg,
3304 hash, hash_length);
3305exit:
3306
3307 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003308 operation->error_occurred = 1;
Paul Elliott59ad9452022-12-18 15:09:02 +00003309 psa_sign_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003310 }
3311
3312 unlock_status = psa_unlock_key_slot(slot);
3313
Paul Elliottc9774412023-02-06 15:14:07 +00003314 if (unlock_status != PSA_SUCCESS) {
3315 operation->error_occurred = 1;
3316 }
Paul Elliott9fe12f62022-11-30 19:16:02 +00003317
Paul Elliottc9774412023-02-06 15:14:07 +00003318 return (status == PSA_SUCCESS) ? unlock_status : status;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003319}
3320
3321
3322psa_status_t psa_sign_hash_complete(
3323 psa_sign_hash_interruptible_operation_t *operation,
3324 uint8_t *signature, size_t signature_size,
3325 size_t *signature_length)
3326{
3327 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3328
3329 *signature_length = 0;
3330
Paul Elliottc9774412023-02-06 15:14:07 +00003331 /* Check that start has been called first, and that operation has not
3332 * previously errored. */
3333 if (operation->id == 0 || operation->error_occurred) {
Paul Elliott9fe12f62022-11-30 19:16:02 +00003334 status = PSA_ERROR_BAD_STATE;
3335 goto exit;
3336 }
3337
Paul Elliott096abc42023-02-03 18:33:23 +00003338 /* Immediately reject a zero-length signature buffer. This guarantees that
3339 * signature must be a valid pointer. */
Paul Elliott9fe12f62022-11-30 19:16:02 +00003340 if (signature_size == 0) {
3341 status = PSA_ERROR_BUFFER_TOO_SMALL;
3342 goto exit;
3343 }
3344
3345 status = psa_driver_wrapper_sign_hash_complete(operation, signature,
3346 signature_size,
3347 signature_length);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003348
Paul Elliott296ede92022-12-15 17:00:30 +00003349 /* Update ops count with work done. */
Paul Elliottde1114c2023-02-07 12:43:11 +00003350 operation->num_ops = psa_driver_wrapper_sign_hash_get_num_ops(operation);
Paul Elliott296ede92022-12-15 17:00:30 +00003351
Paul Elliottebe225c2023-02-10 14:32:53 +00003352exit:
3353
Paul Elliott59200a22023-02-21 15:07:40 +00003354 psa_wipe_tag_output_buffer(signature, status, signature_size,
3355 *signature_length);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003356
Paul Elliott53bb3122023-02-10 14:22:22 +00003357 if (status != PSA_OPERATION_INCOMPLETE) {
Paul Elliottc9774412023-02-06 15:14:07 +00003358 if (status != PSA_SUCCESS) {
3359 operation->error_occurred = 1;
3360 }
3361
Paul Elliott59ad9452022-12-18 15:09:02 +00003362 psa_sign_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003363 }
3364
3365 return status;
3366}
3367
3368psa_status_t psa_sign_hash_abort(
3369 psa_sign_hash_interruptible_operation_t *operation)
3370{
Paul Elliott59ad9452022-12-18 15:09:02 +00003371 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3372
3373 status = psa_sign_hash_abort_internal(operation);
3374
3375 /* We clear the number of ops done here, so that it is not cleared when
3376 * the operation fails or succeeds, only on manual abort. */
3377 operation->num_ops = 0;
3378
Paul Elliottc9774412023-02-06 15:14:07 +00003379 /* Likewise, failure state. */
3380 operation->error_occurred = 0;
3381
Paul Elliott59ad9452022-12-18 15:09:02 +00003382 return status;
3383}
3384
3385static psa_status_t psa_verify_hash_abort_internal(
3386 psa_verify_hash_interruptible_operation_t *operation)
3387{
Paul Elliott9fe12f62022-11-30 19:16:02 +00003388 if (operation->id == 0) {
3389 /* The object has (apparently) been initialized but it is not (yet)
3390 * in use. It's ok to call abort on such an object, and there's
3391 * nothing to do. */
3392 return PSA_SUCCESS;
3393 }
3394
Paul Elliott59ad9452022-12-18 15:09:02 +00003395 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3396
3397 status = psa_driver_wrapper_verify_hash_abort(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003398
3399 operation->id = 0;
3400
Paul Elliotte6145dc2023-02-07 12:51:21 +00003401 /* Do not clear either the error_occurred or num_ops elements here as they
3402 * only want to be cleared by the application calling abort, not by abort
3403 * being called at completion of an operation. */
3404
Paul Elliott59ad9452022-12-18 15:09:02 +00003405 return status;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003406}
3407
3408psa_status_t psa_verify_hash_start(
3409 psa_verify_hash_interruptible_operation_t *operation,
3410 mbedtls_svc_key_id_t key, psa_algorithm_t alg,
3411 const uint8_t *hash, size_t hash_length,
3412 const uint8_t *signature, size_t signature_length)
3413{
3414 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3415 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
3416 psa_key_slot_t *slot;
3417
Paul Elliottc9774412023-02-06 15:14:07 +00003418 /* Check that start has not been previously called, or operation has not
3419 * previously errored. */
3420 if (operation->id != 0 || operation->error_occurred) {
Paul Elliott9fe12f62022-11-30 19:16:02 +00003421 return PSA_ERROR_BAD_STATE;
3422 }
3423
3424 status = psa_sign_verify_check_alg(0, alg);
3425 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003426 operation->error_occurred = 1;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003427 return status;
3428 }
3429
3430 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
3431 PSA_KEY_USAGE_VERIFY_HASH,
3432 alg);
3433
3434 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003435 operation->error_occurred = 1;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003436 return status;
3437 }
3438
3439 psa_key_attributes_t attributes = {
3440 .core = slot->attr
3441 };
3442
Paul Elliott296ede92022-12-15 17:00:30 +00003443 /* Ensure ops count gets reset, in case of operation re-use. */
3444 operation->num_ops = 0;
3445
Paul Elliott9fe12f62022-11-30 19:16:02 +00003446 status = psa_driver_wrapper_verify_hash_start(operation, &attributes,
3447 slot->key.data,
3448 slot->key.bytes,
3449 alg, hash, hash_length,
3450 signature, signature_length);
3451
3452 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003453 operation->error_occurred = 1;
Paul Elliott59ad9452022-12-18 15:09:02 +00003454 psa_verify_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003455 }
3456
3457 unlock_status = psa_unlock_key_slot(slot);
3458
Paul Elliottc9774412023-02-06 15:14:07 +00003459 if (unlock_status != PSA_SUCCESS) {
3460 operation->error_occurred = 1;
3461 }
Paul Elliott9fe12f62022-11-30 19:16:02 +00003462
Paul Elliottc9774412023-02-06 15:14:07 +00003463 return (status == PSA_SUCCESS) ? unlock_status : status;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003464}
3465
3466psa_status_t psa_verify_hash_complete(
3467 psa_verify_hash_interruptible_operation_t *operation)
3468{
3469 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3470
Paul Elliottc9774412023-02-06 15:14:07 +00003471 /* Check that start has been called first, and that operation has not
3472 * previously errored. */
3473 if (operation->id == 0 || operation->error_occurred) {
Paul Elliott9fe12f62022-11-30 19:16:02 +00003474 status = PSA_ERROR_BAD_STATE;
3475 goto exit;
3476 }
3477
3478 status = psa_driver_wrapper_verify_hash_complete(operation);
3479
Paul Elliott296ede92022-12-15 17:00:30 +00003480 /* Update ops count with work done. */
Paul Elliottde1114c2023-02-07 12:43:11 +00003481 operation->num_ops = psa_driver_wrapper_verify_hash_get_num_ops(
Paul Elliott296ede92022-12-15 17:00:30 +00003482 operation);
3483
Paul Elliottebe225c2023-02-10 14:32:53 +00003484exit:
3485
Paul Elliott9fe12f62022-11-30 19:16:02 +00003486 if (status != PSA_OPERATION_INCOMPLETE) {
Paul Elliottc9774412023-02-06 15:14:07 +00003487 if (status != PSA_SUCCESS) {
3488 operation->error_occurred = 1;
3489 }
3490
Paul Elliott59ad9452022-12-18 15:09:02 +00003491 psa_verify_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003492 }
3493
3494 return status;
3495}
3496
3497psa_status_t psa_verify_hash_abort(
3498 psa_verify_hash_interruptible_operation_t *operation)
3499{
Paul Elliott59ad9452022-12-18 15:09:02 +00003500 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003501
Paul Elliott59ad9452022-12-18 15:09:02 +00003502 status = psa_verify_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003503
Paul Elliott59ad9452022-12-18 15:09:02 +00003504 /* We clear the number of ops done here, so that it is not cleared when
3505 * the operation fails or succeeds, only on manual abort. */
3506 operation->num_ops = 0;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003507
Paul Elliottc9774412023-02-06 15:14:07 +00003508 /* Likewise, failure state. */
3509 operation->error_occurred = 0;
3510
Paul Elliott59ad9452022-12-18 15:09:02 +00003511 return status;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003512}
3513
Paul Elliott588f8ed2022-12-02 18:10:26 +00003514/****************************************************************/
3515/* Asymmetric interruptible cryptography internal */
3516/* implementations */
3517/****************************************************************/
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02003518
Paul Elliott588f8ed2022-12-02 18:10:26 +00003519void mbedtls_psa_interruptible_set_max_ops(uint32_t max_ops)
3520{
Paul Elliott7cc4e812023-01-10 17:14:11 +00003521
Paul Elliott588f8ed2022-12-02 18:10:26 +00003522#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3523 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3524 defined(MBEDTLS_ECP_RESTARTABLE)
3525
3526 /* Internal implementation uses zero to indicate infinite number max ops,
3527 * therefore avoid this value, and set to minimum possible. */
3528 if (max_ops == 0) {
3529 max_ops = 1;
3530 }
3531
Paul Elliott588f8ed2022-12-02 18:10:26 +00003532 mbedtls_ecp_set_max_ops(max_ops);
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003533#else
3534 (void) max_ops;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003535#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3536 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3537 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3538}
3539
Paul Elliott588f8ed2022-12-02 18:10:26 +00003540uint32_t mbedtls_psa_sign_hash_get_num_ops(
Paul Elliottf8e5b562023-02-19 18:43:45 +00003541 const mbedtls_psa_sign_hash_interruptible_operation_t *operation)
Paul Elliott588f8ed2022-12-02 18:10:26 +00003542{
3543#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3544 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3545 defined(MBEDTLS_ECP_RESTARTABLE)
3546
Paul Elliott93d9ca82023-02-15 18:14:21 +00003547 return operation->num_ops;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003548#else
3549 (void) operation;
3550 return 0;
3551#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3552 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3553 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3554}
3555
3556uint32_t mbedtls_psa_verify_hash_get_num_ops(
Paul Elliottf8e5b562023-02-19 18:43:45 +00003557 const mbedtls_psa_verify_hash_interruptible_operation_t *operation)
Paul Elliott588f8ed2022-12-02 18:10:26 +00003558{
3559 #if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3560 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3561 defined(MBEDTLS_ECP_RESTARTABLE)
3562
Paul Elliott93d9ca82023-02-15 18:14:21 +00003563 return operation->num_ops;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003564#else
3565 (void) operation;
3566 return 0;
3567#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3568 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3569 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3570}
3571
3572psa_status_t mbedtls_psa_sign_hash_start(
3573 mbedtls_psa_sign_hash_interruptible_operation_t *operation,
3574 const psa_key_attributes_t *attributes, const uint8_t *key_buffer,
3575 size_t key_buffer_size, psa_algorithm_t alg,
3576 const uint8_t *hash, size_t hash_length)
3577{
3578 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott0290a762023-02-09 14:30:24 +00003579 size_t required_hash_length;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003580
Paul Elliott068fe072023-01-16 13:59:15 +00003581 if (!PSA_KEY_TYPE_IS_ECC(attributes->core.type)) {
3582 return PSA_ERROR_NOT_SUPPORTED;
3583 }
3584
3585 if (!PSA_ALG_IS_ECDSA(alg)) {
Paul Elliott813f9cd2023-02-05 15:28:46 +00003586 return PSA_ERROR_NOT_SUPPORTED;
Paul Elliott068fe072023-01-16 13:59:15 +00003587 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003588
3589#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
Paul Elliott068fe072023-01-16 13:59:15 +00003590 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3591 defined(MBEDTLS_ECP_RESTARTABLE)
Paul Elliott588f8ed2022-12-02 18:10:26 +00003592
Paul Elliotta1c94092023-02-15 16:38:04 +00003593 mbedtls_ecdsa_restart_init(&operation->restart_ctx);
3594
Paul Elliott93d9ca82023-02-15 18:14:21 +00003595 /* Ensure num_ops is zero'ed in case of context re-use. */
3596 operation->num_ops = 0;
3597
Paul Elliott068fe072023-01-16 13:59:15 +00003598 status = mbedtls_psa_ecp_load_representation(attributes->core.type,
3599 attributes->core.bits,
3600 key_buffer,
3601 key_buffer_size,
3602 &operation->ctx);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003603
Paul Elliott068fe072023-01-16 13:59:15 +00003604 if (status != PSA_SUCCESS) {
3605 return status;
3606 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003607
Paul Elliott1bc59df2023-02-05 13:41:57 +00003608 operation->coordinate_bytes = PSA_BITS_TO_BYTES(
Paul Elliottc569fc22023-02-10 13:02:54 +00003609 operation->ctx->grp.nbits);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003610
Paul Elliott068fe072023-01-16 13:59:15 +00003611 psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH(alg);
Manuel Pégourié-Gonnard2d6d9932023-03-28 11:38:08 +02003612 operation->md_alg = mbedtls_md_type_from_psa_alg(hash_alg);
Paul Elliott068fe072023-01-16 13:59:15 +00003613 operation->alg = alg;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003614
Paul Elliott0290a762023-02-09 14:30:24 +00003615 /* We only need to store the same length of hash as the private key size
3616 * here, it would be truncated by the internal implementation anyway. */
3617 required_hash_length = (hash_length < operation->coordinate_bytes ?
3618 hash_length : operation->coordinate_bytes);
3619
Paul Elliottba70ad42023-02-15 18:23:53 +00003620 if (required_hash_length > sizeof(operation->hash)) {
3621 /* Shouldn't happen, but better safe than sorry. */
3622 return PSA_ERROR_CORRUPTION_DETECTED;
3623 }
3624
Paul Elliott0290a762023-02-09 14:30:24 +00003625 memcpy(operation->hash, hash, required_hash_length);
3626 operation->hash_length = required_hash_length;
Paul Elliott068fe072023-01-16 13:59:15 +00003627
3628 return PSA_SUCCESS;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003629
3630#else
Paul Elliott068fe072023-01-16 13:59:15 +00003631 (void) operation;
3632 (void) key_buffer;
3633 (void) key_buffer_size;
3634 (void) alg;
3635 (void) hash;
3636 (void) hash_length;
3637 (void) status;
Paul Elliott0290a762023-02-09 14:30:24 +00003638 (void) required_hash_length;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003639
Paul Elliott068fe072023-01-16 13:59:15 +00003640 return PSA_ERROR_NOT_SUPPORTED;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003641#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3642 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3643 * defined( MBEDTLS_ECP_RESTARTABLE ) */
Paul Elliott588f8ed2022-12-02 18:10:26 +00003644}
3645
3646psa_status_t mbedtls_psa_sign_hash_complete(
3647 mbedtls_psa_sign_hash_interruptible_operation_t *operation,
3648 uint8_t *signature, size_t signature_size,
3649 size_t *signature_length)
3650{
Paul Elliott588f8ed2022-12-02 18:10:26 +00003651#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3652 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3653 defined(MBEDTLS_ECP_RESTARTABLE)
3654
Paul Elliotta1c94092023-02-15 16:38:04 +00003655 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott1243f932023-02-07 11:21:10 +00003656 mbedtls_mpi r;
3657 mbedtls_mpi s;
3658
Paul Elliott46845252023-02-03 14:59:11 +00003659 mbedtls_mpi_init(&r);
3660 mbedtls_mpi_init(&s);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003661
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003662 /* Ensure max_ops is set to the current value (or default). */
3663 mbedtls_psa_interruptible_set_max_ops(psa_interruptible_get_max_ops());
3664
Paul Elliotta1c94092023-02-15 16:38:04 +00003665 if (signature_size < 2 * operation->coordinate_bytes) {
3666 status = PSA_ERROR_BUFFER_TOO_SMALL;
3667 goto exit;
3668 }
3669
Paul Elliott588f8ed2022-12-02 18:10:26 +00003670 if (PSA_ALG_ECDSA_IS_DETERMINISTIC(operation->alg)) {
Paul Elliott46845252023-02-03 14:59:11 +00003671
Paul Elliott588f8ed2022-12-02 18:10:26 +00003672#if defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
3673 status = mbedtls_to_psa_error(
3674 mbedtls_ecdsa_sign_det_restartable(&operation->ctx->grp,
Paul Elliott46845252023-02-03 14:59:11 +00003675 &r,
3676 &s,
Paul Elliott588f8ed2022-12-02 18:10:26 +00003677 &operation->ctx->d,
3678 operation->hash,
3679 operation->hash_length,
3680 operation->md_alg,
3681 mbedtls_psa_get_random,
3682 MBEDTLS_PSA_RANDOM_STATE,
3683 &operation->restart_ctx));
3684#else /* defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Paul Elliott724bd252023-02-08 12:35:08 +00003685 status = PSA_ERROR_NOT_SUPPORTED;
3686 goto exit;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003687#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
3688 } else {
Paul Elliott588f8ed2022-12-02 18:10:26 +00003689 status = mbedtls_to_psa_error(
3690 mbedtls_ecdsa_sign_restartable(&operation->ctx->grp,
Paul Elliott46845252023-02-03 14:59:11 +00003691 &r,
3692 &s,
Paul Elliott588f8ed2022-12-02 18:10:26 +00003693 &operation->ctx->d,
3694 operation->hash,
3695 operation->hash_length,
3696 mbedtls_psa_get_random,
3697 MBEDTLS_PSA_RANDOM_STATE,
3698 mbedtls_psa_get_random,
3699 MBEDTLS_PSA_RANDOM_STATE,
3700 &operation->restart_ctx));
3701 }
3702
Paul Elliottf8e5b562023-02-19 18:43:45 +00003703 /* Hide the fact that the restart context only holds a delta of number of
3704 * ops done during the last operation, not an absolute value. */
3705 operation->num_ops += operation->restart_ctx.ecp.ops_done;
3706
Paul Elliott724bd252023-02-08 12:35:08 +00003707 if (status == PSA_SUCCESS) {
Paul Elliott588f8ed2022-12-02 18:10:26 +00003708 status = mbedtls_to_psa_error(
Paul Elliott46845252023-02-03 14:59:11 +00003709 mbedtls_mpi_write_binary(&r,
Paul Elliott588f8ed2022-12-02 18:10:26 +00003710 signature,
Paul Elliott1bc59df2023-02-05 13:41:57 +00003711 operation->coordinate_bytes)
3712 );
Paul Elliott588f8ed2022-12-02 18:10:26 +00003713
3714 if (status != PSA_SUCCESS) {
Paul Elliott724bd252023-02-08 12:35:08 +00003715 goto exit;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003716 }
3717
3718 status = mbedtls_to_psa_error(
Paul Elliott46845252023-02-03 14:59:11 +00003719 mbedtls_mpi_write_binary(&s,
Paul Elliott588f8ed2022-12-02 18:10:26 +00003720 signature +
Paul Elliott1bc59df2023-02-05 13:41:57 +00003721 operation->coordinate_bytes,
3722 operation->coordinate_bytes)
3723 );
Paul Elliott588f8ed2022-12-02 18:10:26 +00003724
3725 if (status != PSA_SUCCESS) {
Paul Elliott724bd252023-02-08 12:35:08 +00003726 goto exit;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003727 }
3728
Paul Elliott1bc59df2023-02-05 13:41:57 +00003729 *signature_length = operation->coordinate_bytes * 2;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003730
Paul Elliott724bd252023-02-08 12:35:08 +00003731 status = PSA_SUCCESS;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003732 }
Paul Elliott724bd252023-02-08 12:35:08 +00003733
3734exit:
3735
3736 mbedtls_mpi_free(&r);
3737 mbedtls_mpi_free(&s);
3738 return status;
3739
Paul Elliott588f8ed2022-12-02 18:10:26 +00003740 #else
3741
3742 (void) operation;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003743 (void) signature;
3744 (void) signature_size;
3745 (void) signature_length;
3746
3747 return PSA_ERROR_NOT_SUPPORTED;
3748
3749#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3750 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3751 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3752}
3753
3754psa_status_t mbedtls_psa_sign_hash_abort(
3755 mbedtls_psa_sign_hash_interruptible_operation_t *operation)
3756{
3757
3758#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3759 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3760 defined(MBEDTLS_ECP_RESTARTABLE)
3761
3762 if (operation->ctx) {
3763 mbedtls_ecdsa_free(operation->ctx);
3764 mbedtls_free(operation->ctx);
Paul Elliottf9c91a72023-02-05 18:06:38 +00003765 operation->ctx = NULL;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003766 }
3767
3768 mbedtls_ecdsa_restart_free(&operation->restart_ctx);
3769
Paul Elliott93d9ca82023-02-15 18:14:21 +00003770 operation->num_ops = 0;
3771
Paul Elliott588f8ed2022-12-02 18:10:26 +00003772 return PSA_SUCCESS;
3773
3774#else
3775
3776 (void) operation;
3777
3778 return PSA_ERROR_NOT_SUPPORTED;
3779
3780#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3781 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3782 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3783}
3784
3785psa_status_t mbedtls_psa_verify_hash_start(
3786 mbedtls_psa_verify_hash_interruptible_operation_t *operation,
3787 const psa_key_attributes_t *attributes,
3788 const uint8_t *key_buffer, size_t key_buffer_size,
3789 psa_algorithm_t alg,
3790 const uint8_t *hash, size_t hash_length,
3791 const uint8_t *signature, size_t signature_length)
3792{
3793 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott1bc59df2023-02-05 13:41:57 +00003794 size_t coordinate_bytes = 0;
Paul Elliott0290a762023-02-09 14:30:24 +00003795 size_t required_hash_length = 0;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003796
Paul Elliott068fe072023-01-16 13:59:15 +00003797 if (!PSA_KEY_TYPE_IS_ECC(attributes->core.type)) {
3798 return PSA_ERROR_NOT_SUPPORTED;
3799 }
3800
3801 if (!PSA_ALG_IS_ECDSA(alg)) {
Paul Elliott813f9cd2023-02-05 15:28:46 +00003802 return PSA_ERROR_NOT_SUPPORTED;
Paul Elliott068fe072023-01-16 13:59:15 +00003803 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003804
3805#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
Paul Elliott068fe072023-01-16 13:59:15 +00003806 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3807 defined(MBEDTLS_ECP_RESTARTABLE)
Paul Elliott588f8ed2022-12-02 18:10:26 +00003808
Paul Elliotta1c94092023-02-15 16:38:04 +00003809 mbedtls_ecdsa_restart_init(&operation->restart_ctx);
3810 mbedtls_mpi_init(&operation->r);
3811 mbedtls_mpi_init(&operation->s);
3812
Paul Elliott93d9ca82023-02-15 18:14:21 +00003813 /* Ensure num_ops is zero'ed in case of context re-use. */
3814 operation->num_ops = 0;
3815
Paul Elliott068fe072023-01-16 13:59:15 +00003816 status = mbedtls_psa_ecp_load_representation(attributes->core.type,
3817 attributes->core.bits,
3818 key_buffer,
3819 key_buffer_size,
3820 &operation->ctx);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003821
Paul Elliott068fe072023-01-16 13:59:15 +00003822 if (status != PSA_SUCCESS) {
3823 return status;
3824 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003825
Paul Elliottc569fc22023-02-10 13:02:54 +00003826 coordinate_bytes = PSA_BITS_TO_BYTES(operation->ctx->grp.nbits);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003827
Paul Elliott1bc59df2023-02-05 13:41:57 +00003828 if (signature_length != 2 * coordinate_bytes) {
Paul Elliott068fe072023-01-16 13:59:15 +00003829 return PSA_ERROR_INVALID_SIGNATURE;
3830 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003831
Paul Elliott068fe072023-01-16 13:59:15 +00003832 status = mbedtls_to_psa_error(
3833 mbedtls_mpi_read_binary(&operation->r,
3834 signature,
Paul Elliott1bc59df2023-02-05 13:41:57 +00003835 coordinate_bytes));
Paul Elliott588f8ed2022-12-02 18:10:26 +00003836
Paul Elliott068fe072023-01-16 13:59:15 +00003837 if (status != PSA_SUCCESS) {
3838 return status;
3839 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003840
Paul Elliott068fe072023-01-16 13:59:15 +00003841 status = mbedtls_to_psa_error(
3842 mbedtls_mpi_read_binary(&operation->s,
3843 signature +
Paul Elliott1bc59df2023-02-05 13:41:57 +00003844 coordinate_bytes,
3845 coordinate_bytes));
Paul Elliott588f8ed2022-12-02 18:10:26 +00003846
Paul Elliott068fe072023-01-16 13:59:15 +00003847 if (status != PSA_SUCCESS) {
3848 return status;
3849 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003850
Paul Elliott2c9843f2023-02-15 17:32:42 +00003851 status = mbedtls_psa_ecp_load_public_part(operation->ctx);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003852
Paul Elliott2c9843f2023-02-15 17:32:42 +00003853 if (status != PSA_SUCCESS) {
3854 return status;
Paul Elliott068fe072023-01-16 13:59:15 +00003855 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003856
Paul Elliott0290a762023-02-09 14:30:24 +00003857 /* We only need to store the same length of hash as the private key size
3858 * here, it would be truncated by the internal implementation anyway. */
3859 required_hash_length = (hash_length < coordinate_bytes ? hash_length :
3860 coordinate_bytes);
3861
Paul Elliottba70ad42023-02-15 18:23:53 +00003862 if (required_hash_length > sizeof(operation->hash)) {
3863 /* Shouldn't happen, but better safe than sorry. */
3864 return PSA_ERROR_CORRUPTION_DETECTED;
3865 }
3866
Paul Elliott0290a762023-02-09 14:30:24 +00003867 memcpy(operation->hash, hash, required_hash_length);
3868 operation->hash_length = required_hash_length;
Paul Elliott068fe072023-01-16 13:59:15 +00003869
3870 return PSA_SUCCESS;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003871#else
Paul Elliott068fe072023-01-16 13:59:15 +00003872 (void) operation;
3873 (void) key_buffer;
3874 (void) key_buffer_size;
3875 (void) alg;
3876 (void) hash;
3877 (void) hash_length;
3878 (void) signature;
3879 (void) signature_length;
3880 (void) status;
Paul Elliott1243f932023-02-07 11:21:10 +00003881 (void) coordinate_bytes;
Paul Elliott0290a762023-02-09 14:30:24 +00003882 (void) required_hash_length;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003883
Paul Elliott068fe072023-01-16 13:59:15 +00003884 return PSA_ERROR_NOT_SUPPORTED;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003885#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3886 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3887 * defined( MBEDTLS_ECP_RESTARTABLE ) */
Paul Elliott588f8ed2022-12-02 18:10:26 +00003888}
3889
3890psa_status_t mbedtls_psa_verify_hash_complete(
3891 mbedtls_psa_verify_hash_interruptible_operation_t *operation)
3892{
3893
3894#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3895 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3896 defined(MBEDTLS_ECP_RESTARTABLE)
3897
Paul Elliottf8e5b562023-02-19 18:43:45 +00003898 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3899
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003900 /* Ensure max_ops is set to the current value (or default). */
3901 mbedtls_psa_interruptible_set_max_ops(psa_interruptible_get_max_ops());
3902
Paul Elliottf8e5b562023-02-19 18:43:45 +00003903 status = mbedtls_to_psa_error(
Paul Elliott588f8ed2022-12-02 18:10:26 +00003904 mbedtls_ecdsa_verify_restartable(&operation->ctx->grp,
3905 operation->hash,
3906 operation->hash_length,
3907 &operation->ctx->Q,
3908 &operation->r,
3909 &operation->s,
3910 &operation->restart_ctx));
3911
Paul Elliottf8e5b562023-02-19 18:43:45 +00003912 /* Hide the fact that the restart context only holds a delta of number of
3913 * ops done during the last operation, not an absolute value. */
3914 operation->num_ops += operation->restart_ctx.ecp.ops_done;
3915
3916 return status;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003917#else
3918 (void) operation;
3919
3920 return PSA_ERROR_NOT_SUPPORTED;
3921
3922#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3923 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3924 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3925}
3926
3927psa_status_t mbedtls_psa_verify_hash_abort(
3928 mbedtls_psa_verify_hash_interruptible_operation_t *operation)
3929{
3930
3931#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3932 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3933 defined(MBEDTLS_ECP_RESTARTABLE)
3934
3935 if (operation->ctx) {
3936 mbedtls_ecdsa_free(operation->ctx);
3937 mbedtls_free(operation->ctx);
Paul Elliottf9c91a72023-02-05 18:06:38 +00003938 operation->ctx = NULL;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003939 }
3940
3941 mbedtls_ecdsa_restart_free(&operation->restart_ctx);
3942
Paul Elliott93d9ca82023-02-15 18:14:21 +00003943 operation->num_ops = 0;
3944
Paul Elliott588f8ed2022-12-02 18:10:26 +00003945 mbedtls_mpi_free(&operation->r);
3946 mbedtls_mpi_free(&operation->s);
3947
3948 return PSA_SUCCESS;
3949
3950#else
3951 (void) operation;
3952
3953 return PSA_ERROR_NOT_SUPPORTED;
3954
3955#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3956 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3957 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3958}
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02003959
mohammad1603503973b2018-03-12 15:59:30 +02003960/****************************************************************/
3961/* Symmetric cryptography */
3962/****************************************************************/
3963
Gilles Peskine449bd832023-01-11 14:50:10 +01003964static psa_status_t psa_cipher_setup(psa_cipher_operation_t *operation,
3965 mbedtls_svc_key_id_t key,
3966 psa_algorithm_t alg,
3967 mbedtls_operation_t cipher_operation)
Ronald Cronab99ac22020-10-01 16:38:28 +02003968{
3969 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3970 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Dave Rodgman54648242021-06-24 11:49:45 +01003971 psa_key_slot_t *slot = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01003972 psa_key_usage_t usage = (cipher_operation == MBEDTLS_ENCRYPT ?
3973 PSA_KEY_USAGE_ENCRYPT :
3974 PSA_KEY_USAGE_DECRYPT);
Ronald Cronab99ac22020-10-01 16:38:28 +02003975
3976 /* A context must be freshly initialized before it can be set up. */
Gilles Peskine449bd832023-01-11 14:50:10 +01003977 if (operation->id != 0) {
Dave Rodgman54648242021-06-24 11:49:45 +01003978 status = PSA_ERROR_BAD_STATE;
3979 goto exit;
3980 }
Ronald Cronab99ac22020-10-01 16:38:28 +02003981
Gilles Peskine449bd832023-01-11 14:50:10 +01003982 if (!PSA_ALG_IS_CIPHER(alg)) {
Dave Rodgman54648242021-06-24 11:49:45 +01003983 status = PSA_ERROR_INVALID_ARGUMENT;
3984 goto exit;
3985 }
Ronald Cronab99ac22020-10-01 16:38:28 +02003986
Gilles Peskine449bd832023-01-11 14:50:10 +01003987 status = psa_get_and_lock_key_slot_with_policy(key, &slot, usage, alg);
3988 if (status != PSA_SUCCESS) {
Ronald Cronab99ac22020-10-01 16:38:28 +02003989 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01003990 }
Ronald Cronab99ac22020-10-01 16:38:28 +02003991
Ronald Cron49fafa92021-03-10 08:34:23 +01003992 /* Initialize the operation struct members, except for id. The id member
Ronald Cronab99ac22020-10-01 16:38:28 +02003993 * is used to indicate to psa_cipher_abort that there are resources to free,
Ronald Cron49fafa92021-03-10 08:34:23 +01003994 * so we only set it (in the driver wrapper) after resources have been
3995 * allocated/initialized. */
Ronald Cronab99ac22020-10-01 16:38:28 +02003996 operation->iv_set = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01003997 if (alg == PSA_ALG_ECB_NO_PADDING) {
Ronald Cronab99ac22020-10-01 16:38:28 +02003998 operation->iv_required = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01003999 } else {
Ronald Cronab99ac22020-10-01 16:38:28 +02004000 operation->iv_required = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004001 }
4002 operation->default_iv_length = PSA_CIPHER_IV_LENGTH(slot->attr.type, alg);
Ronald Cronab99ac22020-10-01 16:38:28 +02004003
Ronald Crona4af55f2020-12-14 14:36:06 +01004004 psa_key_attributes_t attributes = {
Gilles Peskine449bd832023-01-11 14:50:10 +01004005 .core = slot->attr
Ronald Crona4af55f2020-12-14 14:36:06 +01004006 };
4007
Ronald Cronab99ac22020-10-01 16:38:28 +02004008 /* Try doing the operation through a driver before using software fallback. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004009 if (cipher_operation == MBEDTLS_ENCRYPT) {
4010 status = psa_driver_wrapper_cipher_encrypt_setup(operation,
4011 &attributes,
4012 slot->key.data,
4013 slot->key.bytes,
4014 alg);
4015 } else {
4016 status = psa_driver_wrapper_cipher_decrypt_setup(operation,
4017 &attributes,
4018 slot->key.data,
4019 slot->key.bytes,
4020 alg);
4021 }
Ronald Cronab99ac22020-10-01 16:38:28 +02004022
Gilles Peskine9ab61b62019-02-25 17:43:14 +01004023exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004024 if (status != PSA_SUCCESS) {
4025 psa_cipher_abort(operation);
4026 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02004027
Gilles Peskine449bd832023-01-11 14:50:10 +01004028 unlock_status = psa_unlock_key_slot(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02004029
Gilles Peskine449bd832023-01-11 14:50:10 +01004030 return (status == PSA_SUCCESS) ? unlock_status : status;
mohammad1603503973b2018-03-12 15:59:30 +02004031}
4032
Gilles Peskine449bd832023-01-11 14:50:10 +01004033psa_status_t psa_cipher_encrypt_setup(psa_cipher_operation_t *operation,
4034 mbedtls_svc_key_id_t key,
4035 psa_algorithm_t alg)
mohammad16038481e742018-03-18 13:57:31 +02004036{
Gilles Peskine449bd832023-01-11 14:50:10 +01004037 return psa_cipher_setup(operation, key, alg, MBEDTLS_ENCRYPT);
mohammad16038481e742018-03-18 13:57:31 +02004038}
4039
Gilles Peskine449bd832023-01-11 14:50:10 +01004040psa_status_t psa_cipher_decrypt_setup(psa_cipher_operation_t *operation,
4041 mbedtls_svc_key_id_t key,
4042 psa_algorithm_t alg)
mohammad16038481e742018-03-18 13:57:31 +02004043{
Gilles Peskine449bd832023-01-11 14:50:10 +01004044 return psa_cipher_setup(operation, key, alg, MBEDTLS_DECRYPT);
mohammad16038481e742018-03-18 13:57:31 +02004045}
4046
Gilles Peskine449bd832023-01-11 14:50:10 +01004047psa_status_t psa_cipher_generate_iv(psa_cipher_operation_t *operation,
4048 uint8_t *iv,
4049 size_t iv_size,
4050 size_t *iv_length)
mohammad1603503973b2018-03-12 15:59:30 +02004051{
Ronald Cron6d051732020-10-01 14:10:20 +02004052 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron2fb90522021-07-05 12:31:44 +02004053 uint8_t local_iv[PSA_CIPHER_IV_MAX_SIZE];
4054 size_t default_iv_length;
Ronald Cron5618a392021-03-26 09:52:26 +01004055
Gilles Peskine449bd832023-01-11 14:50:10 +01004056 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004057 status = PSA_ERROR_BAD_STATE;
4058 goto exit;
Ronald Cronc45b4af2020-09-29 16:18:05 +02004059 }
4060
Gilles Peskine449bd832023-01-11 14:50:10 +01004061 if (operation->iv_set || !operation->iv_required) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004062 status = PSA_ERROR_BAD_STATE;
4063 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004064 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004065
Ronald Cron2fb90522021-07-05 12:31:44 +02004066 default_iv_length = operation->default_iv_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01004067 if (iv_size < default_iv_length) {
Ronald Cron5618a392021-03-26 09:52:26 +01004068 status = PSA_ERROR_BUFFER_TOO_SMALL;
4069 goto exit;
4070 }
Gilles Peskinee553c652018-06-04 16:22:46 +02004071
Gilles Peskine449bd832023-01-11 14:50:10 +01004072 if (default_iv_length > PSA_CIPHER_IV_MAX_SIZE) {
Ronald Cron2fb90522021-07-05 12:31:44 +02004073 status = PSA_ERROR_GENERIC_ERROR;
4074 goto exit;
4075 }
4076
Gilles Peskine449bd832023-01-11 14:50:10 +01004077 status = psa_generate_random(local_iv, default_iv_length);
4078 if (status != PSA_SUCCESS) {
Ronald Cron5618a392021-03-26 09:52:26 +01004079 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004080 }
Ronald Cron5618a392021-03-26 09:52:26 +01004081
Gilles Peskine449bd832023-01-11 14:50:10 +01004082 status = psa_driver_wrapper_cipher_set_iv(operation,
4083 local_iv, default_iv_length);
Ronald Cron5618a392021-03-26 09:52:26 +01004084
4085exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004086 if (status == PSA_SUCCESS) {
4087 memcpy(iv, local_iv, default_iv_length);
Ronald Cron2fb90522021-07-05 12:31:44 +02004088 *iv_length = default_iv_length;
Steven Cooreman7df02922020-09-09 15:28:49 +02004089 operation->iv_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004090 } else {
Ronald Cron2fb90522021-07-05 12:31:44 +02004091 *iv_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01004092 psa_cipher_abort(operation);
Ronald Cron2fb90522021-07-05 12:31:44 +02004093 }
Ronald Cron6d051732020-10-01 14:10:20 +02004094
Gilles Peskine449bd832023-01-11 14:50:10 +01004095 return status;
mohammad1603503973b2018-03-12 15:59:30 +02004096}
4097
Gilles Peskine449bd832023-01-11 14:50:10 +01004098psa_status_t psa_cipher_set_iv(psa_cipher_operation_t *operation,
4099 const uint8_t *iv,
4100 size_t iv_length)
mohammad1603503973b2018-03-12 15:59:30 +02004101{
Ronald Cron6d051732020-10-01 14:10:20 +02004102 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cronc45b4af2020-09-29 16:18:05 +02004103
Gilles Peskine449bd832023-01-11 14:50:10 +01004104 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004105 status = PSA_ERROR_BAD_STATE;
4106 goto exit;
4107 }
Ronald Cronc45b4af2020-09-29 16:18:05 +02004108
Gilles Peskine449bd832023-01-11 14:50:10 +01004109 if (operation->iv_set || !operation->iv_required) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004110 status = PSA_ERROR_BAD_STATE;
4111 goto exit;
4112 }
Ronald Crona0d68172021-03-26 10:15:08 +01004113
Gilles Peskine449bd832023-01-11 14:50:10 +01004114 if (iv_length > PSA_CIPHER_IV_MAX_SIZE) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004115 status = PSA_ERROR_INVALID_ARGUMENT;
4116 goto exit;
4117 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004118
Gilles Peskine449bd832023-01-11 14:50:10 +01004119 status = psa_driver_wrapper_cipher_set_iv(operation,
4120 iv,
4121 iv_length);
Steven Cooremand3feccd2020-09-01 15:56:14 +02004122
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004123exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004124 if (status == PSA_SUCCESS) {
itayzafrir534bd7c2018-08-02 13:56:32 +03004125 operation->iv_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004126 } else {
4127 psa_cipher_abort(operation);
4128 }
4129 return status;
mohammad1603503973b2018-03-12 15:59:30 +02004130}
4131
Gilles Peskine449bd832023-01-11 14:50:10 +01004132psa_status_t psa_cipher_update(psa_cipher_operation_t *operation,
4133 const uint8_t *input,
4134 size_t input_length,
4135 uint8_t *output,
4136 size_t output_size,
4137 size_t *output_length)
mohammad1603503973b2018-03-12 15:59:30 +02004138{
Steven Cooremanffecb7b2020-08-25 15:13:13 +02004139 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron6d051732020-10-01 14:10:20 +02004140
Gilles Peskine449bd832023-01-11 14:50:10 +01004141 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004142 status = PSA_ERROR_BAD_STATE;
4143 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004144 }
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004145
Gilles Peskine449bd832023-01-11 14:50:10 +01004146 if (operation->iv_required && !operation->iv_set) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004147 status = PSA_ERROR_BAD_STATE;
4148 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004149 }
Jaeden Ameroab439972019-02-15 14:12:05 +00004150
Gilles Peskine449bd832023-01-11 14:50:10 +01004151 status = psa_driver_wrapper_cipher_update(operation,
4152 input,
4153 input_length,
4154 output,
4155 output_size,
4156 output_length);
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004157
4158exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004159 if (status != PSA_SUCCESS) {
4160 psa_cipher_abort(operation);
4161 }
Ronald Cron6d051732020-10-01 14:10:20 +02004162
Gilles Peskine449bd832023-01-11 14:50:10 +01004163 return status;
mohammad1603503973b2018-03-12 15:59:30 +02004164}
4165
Gilles Peskine449bd832023-01-11 14:50:10 +01004166psa_status_t psa_cipher_finish(psa_cipher_operation_t *operation,
4167 uint8_t *output,
4168 size_t output_size,
4169 size_t *output_length)
mohammad1603503973b2018-03-12 15:59:30 +02004170{
David Saadab4ecc272019-02-14 13:48:10 +02004171 psa_status_t status = PSA_ERROR_GENERIC_ERROR;
Ronald Cron6d051732020-10-01 14:10:20 +02004172
Gilles Peskine449bd832023-01-11 14:50:10 +01004173 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004174 status = PSA_ERROR_BAD_STATE;
4175 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004176 }
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004177
Gilles Peskine449bd832023-01-11 14:50:10 +01004178 if (operation->iv_required && !operation->iv_set) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004179 status = PSA_ERROR_BAD_STATE;
4180 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004181 }
Moran Pekerbed71a22018-04-22 20:19:20 +03004182
Gilles Peskine449bd832023-01-11 14:50:10 +01004183 status = psa_driver_wrapper_cipher_finish(operation,
4184 output,
4185 output_size,
4186 output_length);
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004187
4188exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004189 if (status == PSA_SUCCESS) {
4190 return psa_cipher_abort(operation);
4191 } else {
Steven Cooremanef8575e2020-09-11 11:44:50 +02004192 *output_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01004193 (void) psa_cipher_abort(operation);
Janos Follath315b51c2018-07-09 16:04:51 +01004194
Gilles Peskine449bd832023-01-11 14:50:10 +01004195 return status;
Steven Cooremanef8575e2020-09-11 11:44:50 +02004196 }
mohammad1603503973b2018-03-12 15:59:30 +02004197}
4198
Gilles Peskine449bd832023-01-11 14:50:10 +01004199psa_status_t psa_cipher_abort(psa_cipher_operation_t *operation)
Gilles Peskinee553c652018-06-04 16:22:46 +02004200{
Gilles Peskine449bd832023-01-11 14:50:10 +01004201 if (operation->id == 0) {
Steven Cooremana07b9972020-09-10 14:54:14 +02004202 /* The object has (apparently) been initialized but it is not (yet)
Gilles Peskine81736312018-06-26 15:04:31 +02004203 * in use. It's ok to call abort on such an object, and there's
4204 * nothing to do. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004205 return PSA_SUCCESS;
Gilles Peskine81736312018-06-26 15:04:31 +02004206 }
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02004207
Gilles Peskine449bd832023-01-11 14:50:10 +01004208 psa_driver_wrapper_cipher_abort(operation);
Gilles Peskinee553c652018-06-04 16:22:46 +02004209
Ronald Cron49fafa92021-03-10 08:34:23 +01004210 operation->id = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03004211 operation->iv_set = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03004212 operation->iv_required = 0;
Moran Peker41deec42018-04-04 15:43:05 +03004213
Gilles Peskine449bd832023-01-11 14:50:10 +01004214 return PSA_SUCCESS;
mohammad1603503973b2018-03-12 15:59:30 +02004215}
4216
Gilles Peskine449bd832023-01-11 14:50:10 +01004217psa_status_t psa_cipher_encrypt(mbedtls_svc_key_id_t key,
4218 psa_algorithm_t alg,
4219 const uint8_t *input,
4220 size_t input_length,
4221 uint8_t *output,
4222 size_t output_size,
4223 size_t *output_length)
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004224{
4225 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004226 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron23919522021-07-08 19:00:07 +02004227 psa_key_slot_t *slot = NULL;
Ronald Cronc6e6f502021-07-09 18:44:58 +02004228 uint8_t local_iv[PSA_CIPHER_IV_MAX_SIZE];
4229 size_t default_iv_length = 0;
gabor-mezei-arm6f4e5bb2021-06-25 15:21:11 +02004230
Gilles Peskine449bd832023-01-11 14:50:10 +01004231 if (!PSA_ALG_IS_CIPHER(alg)) {
Ronald Cron23919522021-07-08 19:00:07 +02004232 status = PSA_ERROR_INVALID_ARGUMENT;
4233 goto exit;
4234 }
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004235
Gilles Peskine449bd832023-01-11 14:50:10 +01004236 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
4237 PSA_KEY_USAGE_ENCRYPT,
4238 alg);
4239 if (status != PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004240 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004241 }
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004242
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004243 psa_key_attributes_t attributes = {
Gilles Peskine449bd832023-01-11 14:50:10 +01004244 .core = slot->attr
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004245 };
4246
Gilles Peskine449bd832023-01-11 14:50:10 +01004247 default_iv_length = PSA_CIPHER_IV_LENGTH(slot->attr.type, alg);
4248 if (default_iv_length > PSA_CIPHER_IV_MAX_SIZE) {
Ronald Cronc6e6f502021-07-09 18:44:58 +02004249 status = PSA_ERROR_GENERIC_ERROR;
4250 goto exit;
4251 }
4252
Gilles Peskine449bd832023-01-11 14:50:10 +01004253 if (default_iv_length > 0) {
4254 if (output_size < default_iv_length) {
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004255 status = PSA_ERROR_BUFFER_TOO_SMALL;
4256 goto exit;
4257 }
4258
Gilles Peskine449bd832023-01-11 14:50:10 +01004259 status = psa_generate_random(local_iv, default_iv_length);
4260 if (status != PSA_SUCCESS) {
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004261 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004262 }
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004263 }
4264
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004265 status = psa_driver_wrapper_cipher_encrypt(
4266 &attributes, slot->key.data, slot->key.bytes,
Ronald Cronc6e6f502021-07-09 18:44:58 +02004267 alg, local_iv, default_iv_length, input, input_length,
Ronald Cronafbc7ed2023-01-24 16:02:04 +01004268 psa_crypto_buffer_offset(output, default_iv_length),
Gilles Peskine449bd832023-01-11 14:50:10 +01004269 output_size - default_iv_length, output_length);
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004270
4271exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004272 unlock_status = psa_unlock_key_slot(slot);
4273 if (status == PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004274 status = unlock_status;
Ronald Cronc6e6f502021-07-09 18:44:58 +02004275 }
Ronald Cron23919522021-07-08 19:00:07 +02004276
Gilles Peskine449bd832023-01-11 14:50:10 +01004277 if (status == PSA_SUCCESS) {
4278 if (default_iv_length > 0) {
4279 memcpy(output, local_iv, default_iv_length);
4280 }
4281 *output_length += default_iv_length;
4282 } else {
4283 *output_length = 0;
4284 }
4285
4286 return status;
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004287}
4288
Gilles Peskine449bd832023-01-11 14:50:10 +01004289psa_status_t psa_cipher_decrypt(mbedtls_svc_key_id_t key,
4290 psa_algorithm_t alg,
4291 const uint8_t *input,
4292 size_t input_length,
4293 uint8_t *output,
4294 size_t output_size,
4295 size_t *output_length)
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004296{
4297 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004298 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron23919522021-07-08 19:00:07 +02004299 psa_key_slot_t *slot = NULL;
gabor-mezei-arm6f4e5bb2021-06-25 15:21:11 +02004300
Gilles Peskine449bd832023-01-11 14:50:10 +01004301 if (!PSA_ALG_IS_CIPHER(alg)) {
Ronald Cron23919522021-07-08 19:00:07 +02004302 status = PSA_ERROR_INVALID_ARGUMENT;
4303 goto exit;
4304 }
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004305
Gilles Peskine449bd832023-01-11 14:50:10 +01004306 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
4307 PSA_KEY_USAGE_DECRYPT,
4308 alg);
4309 if (status != PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004310 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004311 }
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004312
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004313 psa_key_attributes_t attributes = {
Gilles Peskine449bd832023-01-11 14:50:10 +01004314 .core = slot->attr
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004315 };
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004316
Gilles Peskine449bd832023-01-11 14:50:10 +01004317 if (alg == PSA_ALG_CCM_STAR_NO_TAG &&
4318 input_length < PSA_BLOCK_CIPHER_BLOCK_LENGTH(slot->attr.type)) {
Mateusz Starzyk594215b2021-10-14 12:23:06 +02004319 status = PSA_ERROR_INVALID_ARGUMENT;
4320 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004321 } else if (input_length < PSA_CIPHER_IV_LENGTH(slot->attr.type, alg)) {
gabor-mezei-arm258ae072021-06-25 15:25:38 +02004322 status = PSA_ERROR_INVALID_ARGUMENT;
4323 goto exit;
4324 }
4325
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004326 status = psa_driver_wrapper_cipher_decrypt(
4327 &attributes, slot->key.data, slot->key.bytes,
4328 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01004329 output, output_size, output_length);
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004330
gabor-mezei-arm258ae072021-06-25 15:25:38 +02004331exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004332 unlock_status = psa_unlock_key_slot(slot);
4333 if (status == PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004334 status = unlock_status;
Gilles Peskine449bd832023-01-11 14:50:10 +01004335 }
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004336
Gilles Peskine449bd832023-01-11 14:50:10 +01004337 if (status != PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004338 *output_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01004339 }
Ronald Cron23919522021-07-08 19:00:07 +02004340
Gilles Peskine449bd832023-01-11 14:50:10 +01004341 return status;
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004342}
4343
4344
mohammad16035955c982018-04-26 00:53:03 +03004345/****************************************************************/
4346/* AEAD */
4347/****************************************************************/
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02004348
Paul Elliottbaff51c2021-09-28 17:44:45 +01004349/* Helper function to get the base algorithm from its variants. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004350static psa_algorithm_t psa_aead_get_base_algorithm(psa_algorithm_t alg)
Paul Elliottbaff51c2021-09-28 17:44:45 +01004351{
Gilles Peskine449bd832023-01-11 14:50:10 +01004352 return PSA_ALG_AEAD_WITH_DEFAULT_LENGTH_TAG(alg);
Paul Elliottbaff51c2021-09-28 17:44:45 +01004353}
4354
4355/* Helper function to perform common nonce length checks. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004356static psa_status_t psa_aead_check_nonce_length(psa_algorithm_t alg,
4357 size_t nonce_length)
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004358{
Gilles Peskine449bd832023-01-11 14:50:10 +01004359 psa_algorithm_t base_alg = psa_aead_get_base_algorithm(alg);
Paul Elliottbaff51c2021-09-28 17:44:45 +01004360
Gilles Peskine449bd832023-01-11 14:50:10 +01004361 switch (base_alg) {
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004362#if defined(PSA_WANT_ALG_GCM)
4363 case PSA_ALG_GCM:
4364 /* Not checking max nonce size here as GCM spec allows almost
Gilles Peskine449bd832023-01-11 14:50:10 +01004365 * arbitrarily large nonces. Please note that we do not generally
4366 * recommend the usage of nonces of greater length than
4367 * PSA_AEAD_NONCE_MAX_SIZE, as large nonces are hashed to a shorter
4368 * size, which can then lead to collisions if you encrypt a very
4369 * large number of messages.*/
4370 if (nonce_length != 0) {
4371 return PSA_SUCCESS;
4372 }
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004373 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004374#endif /* PSA_WANT_ALG_GCM */
4375#if defined(PSA_WANT_ALG_CCM)
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004376 case PSA_ALG_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01004377 if (nonce_length >= 7 && nonce_length <= 13) {
4378 return PSA_SUCCESS;
4379 }
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004380 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004381#endif /* PSA_WANT_ALG_CCM */
4382#if defined(PSA_WANT_ALG_CHACHA20_POLY1305)
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004383 case PSA_ALG_CHACHA20_POLY1305:
Gilles Peskine449bd832023-01-11 14:50:10 +01004384 if (nonce_length == 12) {
4385 return PSA_SUCCESS;
4386 } else if (nonce_length == 8) {
4387 return PSA_ERROR_NOT_SUPPORTED;
4388 }
Bence Szépkúti6d48e202021-11-15 20:04:15 +01004389 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004390#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004391 default:
Przemek Stekiel4c499272022-09-27 13:55:37 +02004392 (void) nonce_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01004393 return PSA_ERROR_NOT_SUPPORTED;
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004394 }
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004395
Gilles Peskine449bd832023-01-11 14:50:10 +01004396 return PSA_ERROR_INVALID_ARGUMENT;
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004397}
4398
Gilles Peskine449bd832023-01-11 14:50:10 +01004399static psa_status_t psa_aead_check_algorithm(psa_algorithm_t alg)
Bence Szépkútiaa3a6e42022-01-13 16:26:03 +01004400{
Gilles Peskine449bd832023-01-11 14:50:10 +01004401 if (!PSA_ALG_IS_AEAD(alg) || PSA_ALG_IS_WILDCARD(alg)) {
4402 return PSA_ERROR_INVALID_ARGUMENT;
4403 }
Bence Szépkúti08f34652021-12-08 21:07:13 +01004404
Gilles Peskine449bd832023-01-11 14:50:10 +01004405 return PSA_SUCCESS;
Bence Szépkúti08f34652021-12-08 21:07:13 +01004406}
4407
Gilles Peskine449bd832023-01-11 14:50:10 +01004408psa_status_t psa_aead_encrypt(mbedtls_svc_key_id_t key,
4409 psa_algorithm_t alg,
4410 const uint8_t *nonce,
4411 size_t nonce_length,
4412 const uint8_t *additional_data,
4413 size_t additional_data_length,
4414 const uint8_t *plaintext,
4415 size_t plaintext_length,
4416 uint8_t *ciphertext,
4417 size_t ciphertext_size,
4418 size_t *ciphertext_length)
mohammad16035955c982018-04-26 00:53:03 +03004419{
Ronald Cron215633c2021-03-16 17:15:37 +01004420 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4421 psa_key_slot_t *slot;
Gilles Peskine2d277862018-06-18 15:41:12 +02004422
mohammad1603f08a5502018-06-03 15:05:47 +03004423 *ciphertext_length = 0;
mohammad1603e58e6842018-05-09 04:58:32 -07004424
Gilles Peskine449bd832023-01-11 14:50:10 +01004425 status = psa_aead_check_algorithm(alg);
4426 if (status != PSA_SUCCESS) {
4427 return status;
4428 }
Steven Cooremanea7ab132021-03-17 16:28:00 +01004429
Ronald Cron9a986162021-03-26 12:40:07 +01004430 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01004431 key, &slot, PSA_KEY_USAGE_ENCRYPT, alg);
4432 if (status != PSA_SUCCESS) {
4433 return status;
4434 }
mohammad16035955c982018-04-26 00:53:03 +03004435
Ronald Cron215633c2021-03-16 17:15:37 +01004436 psa_key_attributes_t attributes = {
Gilles Peskine449bd832023-01-11 14:50:10 +01004437 .core = slot->attr
Ronald Cron215633c2021-03-16 17:15:37 +01004438 };
mohammad16035955c982018-04-26 00:53:03 +03004439
Gilles Peskine449bd832023-01-11 14:50:10 +01004440 status = psa_aead_check_nonce_length(alg, nonce_length);
4441 if (status != PSA_SUCCESS) {
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004442 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004443 }
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004444
Ronald Cronde822812021-03-17 16:08:20 +01004445 status = psa_driver_wrapper_aead_encrypt(
Ronald Cron215633c2021-03-16 17:15:37 +01004446 &attributes, slot->key.data, slot->key.bytes,
4447 alg,
4448 nonce, nonce_length,
4449 additional_data, additional_data_length,
4450 plaintext, plaintext_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01004451 ciphertext, ciphertext_size, ciphertext_length);
Gilles Peskine2d277862018-06-18 15:41:12 +02004452
Gilles Peskine449bd832023-01-11 14:50:10 +01004453 if (status != PSA_SUCCESS && ciphertext_size != 0) {
4454 memset(ciphertext, 0, ciphertext_size);
4455 }
Gilles Peskine2d277862018-06-18 15:41:12 +02004456
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004457exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004458 psa_unlock_key_slot(slot);
mohammad16035955c982018-04-26 00:53:03 +03004459
Gilles Peskine449bd832023-01-11 14:50:10 +01004460 return status;
Gilles Peskineee652a32018-06-01 19:23:52 +02004461}
4462
Gilles Peskine449bd832023-01-11 14:50:10 +01004463psa_status_t psa_aead_decrypt(mbedtls_svc_key_id_t key,
4464 psa_algorithm_t alg,
4465 const uint8_t *nonce,
4466 size_t nonce_length,
4467 const uint8_t *additional_data,
4468 size_t additional_data_length,
4469 const uint8_t *ciphertext,
4470 size_t ciphertext_length,
4471 uint8_t *plaintext,
4472 size_t plaintext_size,
4473 size_t *plaintext_length)
mohammad16035955c982018-04-26 00:53:03 +03004474{
Ronald Cron215633c2021-03-16 17:15:37 +01004475 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4476 psa_key_slot_t *slot;
Gilles Peskine2d277862018-06-18 15:41:12 +02004477
Gilles Peskineee652a32018-06-01 19:23:52 +02004478 *plaintext_length = 0;
mohammad16039e5a5152018-04-26 12:07:35 +03004479
Gilles Peskine449bd832023-01-11 14:50:10 +01004480 status = psa_aead_check_algorithm(alg);
4481 if (status != PSA_SUCCESS) {
4482 return status;
4483 }
Steven Cooremanea7ab132021-03-17 16:28:00 +01004484
Ronald Cron9a986162021-03-26 12:40:07 +01004485 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01004486 key, &slot, PSA_KEY_USAGE_DECRYPT, alg);
4487 if (status != PSA_SUCCESS) {
4488 return status;
4489 }
mohammad16035955c982018-04-26 00:53:03 +03004490
Ronald Cron215633c2021-03-16 17:15:37 +01004491 psa_key_attributes_t attributes = {
Gilles Peskine449bd832023-01-11 14:50:10 +01004492 .core = slot->attr
Ronald Cron215633c2021-03-16 17:15:37 +01004493 };
Gilles Peskinef7e7b012019-05-06 15:27:16 +02004494
Gilles Peskine449bd832023-01-11 14:50:10 +01004495 status = psa_aead_check_nonce_length(alg, nonce_length);
4496 if (status != PSA_SUCCESS) {
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004497 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004498 }
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004499
Ronald Cronde822812021-03-17 16:08:20 +01004500 status = psa_driver_wrapper_aead_decrypt(
Ronald Cron215633c2021-03-16 17:15:37 +01004501 &attributes, slot->key.data, slot->key.bytes,
4502 alg,
4503 nonce, nonce_length,
4504 additional_data, additional_data_length,
4505 ciphertext, ciphertext_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01004506 plaintext, plaintext_size, plaintext_length);
Gilles Peskinea40d7742018-06-01 16:28:30 +02004507
Gilles Peskine449bd832023-01-11 14:50:10 +01004508 if (status != PSA_SUCCESS && plaintext_size != 0) {
4509 memset(plaintext, 0, plaintext_size);
4510 }
mohammad160360a64d02018-06-03 17:20:42 +03004511
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004512exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004513 psa_unlock_key_slot(slot);
Ronald Cron215633c2021-03-16 17:15:37 +01004514
Gilles Peskine449bd832023-01-11 14:50:10 +01004515 return status;
mohammad16035955c982018-04-26 00:53:03 +03004516}
4517
Gilles Peskine449bd832023-01-11 14:50:10 +01004518static psa_status_t psa_validate_tag_length(psa_algorithm_t alg)
4519{
4520 const uint8_t tag_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg);
Andrzej Kurekf8816012021-12-19 17:00:12 +01004521
Gilles Peskine449bd832023-01-11 14:50:10 +01004522 switch (PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg, 0)) {
Przemek Stekiel86679c72022-10-06 17:06:56 +02004523#if defined(PSA_WANT_ALG_CCM)
Gilles Peskine449bd832023-01-11 14:50:10 +01004524 case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, 0):
Andrzej Kurekf8816012021-12-19 17:00:12 +01004525 /* CCM allows the following tag lengths: 4, 6, 8, 10, 12, 14, 16.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01004526 if (tag_len < 4 || tag_len > 16 || tag_len % 2) {
4527 return PSA_ERROR_INVALID_ARGUMENT;
4528 }
Andrzej Kurekf8816012021-12-19 17:00:12 +01004529 break;
Przemek Stekiel86679c72022-10-06 17:06:56 +02004530#endif /* PSA_WANT_ALG_CCM */
Andrzej Kurekf8816012021-12-19 17:00:12 +01004531
Przemek Stekiel86679c72022-10-06 17:06:56 +02004532#if defined(PSA_WANT_ALG_GCM)
Gilles Peskine449bd832023-01-11 14:50:10 +01004533 case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_GCM, 0):
Andrzej Kurekf8816012021-12-19 17:00:12 +01004534 /* GCM allows the following tag lengths: 4, 8, 12, 13, 14, 15, 16. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004535 if (tag_len != 4 && tag_len != 8 && (tag_len < 12 || tag_len > 16)) {
4536 return PSA_ERROR_INVALID_ARGUMENT;
4537 }
Andrzej Kurekf8816012021-12-19 17:00:12 +01004538 break;
Przemek Stekiel86679c72022-10-06 17:06:56 +02004539#endif /* PSA_WANT_ALG_GCM */
Andrzej Kurekf8816012021-12-19 17:00:12 +01004540
Przemek Stekiel86679c72022-10-06 17:06:56 +02004541#if defined(PSA_WANT_ALG_CHACHA20_POLY1305)
Gilles Peskine449bd832023-01-11 14:50:10 +01004542 case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CHACHA20_POLY1305, 0):
Andrzej Kurekf8816012021-12-19 17:00:12 +01004543 /* We only support the default tag length. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004544 if (tag_len != 16) {
4545 return PSA_ERROR_INVALID_ARGUMENT;
4546 }
Andrzej Kurekf8816012021-12-19 17:00:12 +01004547 break;
Przemek Stekiel86679c72022-10-06 17:06:56 +02004548#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */
Andrzej Kurekf8816012021-12-19 17:00:12 +01004549
4550 default:
4551 (void) tag_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01004552 return PSA_ERROR_NOT_SUPPORTED;
Andrzej Kurekf8816012021-12-19 17:00:12 +01004553 }
Gilles Peskine449bd832023-01-11 14:50:10 +01004554 return PSA_SUCCESS;
Andrzej Kurekf8816012021-12-19 17:00:12 +01004555}
4556
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004557/* Set the key for a multipart authenticated operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004558static psa_status_t psa_aead_setup(psa_aead_operation_t *operation,
4559 int is_encrypt,
4560 mbedtls_svc_key_id_t key,
4561 psa_algorithm_t alg)
Paul Elliottc2b71442021-06-24 18:17:52 +01004562{
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004563 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4564 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
4565 psa_key_slot_t *slot = NULL;
4566 psa_key_usage_t key_usage = 0;
4567
Gilles Peskine449bd832023-01-11 14:50:10 +01004568 status = psa_aead_check_algorithm(alg);
4569 if (status != PSA_SUCCESS) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004570 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004571 }
Paul Elliottc2b71442021-06-24 18:17:52 +01004572
Gilles Peskine449bd832023-01-11 14:50:10 +01004573 if (operation->id != 0) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004574 status = PSA_ERROR_BAD_STATE;
4575 goto exit;
Paul Elliottc2b71442021-06-24 18:17:52 +01004576 }
4577
Gilles Peskine449bd832023-01-11 14:50:10 +01004578 if (operation->nonce_set || operation->lengths_set ||
4579 operation->ad_started || operation->body_started) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004580 status = PSA_ERROR_BAD_STATE;
4581 goto exit;
Paul Elliottc2b71442021-06-24 18:17:52 +01004582 }
4583
Gilles Peskine449bd832023-01-11 14:50:10 +01004584 if (is_encrypt) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004585 key_usage = PSA_KEY_USAGE_ENCRYPT;
Gilles Peskine449bd832023-01-11 14:50:10 +01004586 } else {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004587 key_usage = PSA_KEY_USAGE_DECRYPT;
Gilles Peskine449bd832023-01-11 14:50:10 +01004588 }
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004589
Gilles Peskine449bd832023-01-11 14:50:10 +01004590 status = psa_get_and_lock_key_slot_with_policy(key, &slot, key_usage,
4591 alg);
4592 if (status != PSA_SUCCESS) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004593 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004594 }
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004595
4596 psa_key_attributes_t attributes = {
4597 .core = slot->attr
4598 };
4599
Gilles Peskine449bd832023-01-11 14:50:10 +01004600 if ((status = psa_validate_tag_length(alg)) != PSA_SUCCESS) {
Przemek Stekiel6ab50762022-10-08 17:54:30 +02004601 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004602 }
Przemek Stekiel6ab50762022-10-08 17:54:30 +02004603
Gilles Peskine449bd832023-01-11 14:50:10 +01004604 if (is_encrypt) {
4605 status = psa_driver_wrapper_aead_encrypt_setup(operation,
4606 &attributes,
4607 slot->key.data,
4608 slot->key.bytes,
4609 alg);
4610 } else {
4611 status = psa_driver_wrapper_aead_decrypt_setup(operation,
4612 &attributes,
4613 slot->key.data,
4614 slot->key.bytes,
4615 alg);
4616 }
4617 if (status != PSA_SUCCESS) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004618 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004619 }
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004620
Gilles Peskine449bd832023-01-11 14:50:10 +01004621 operation->key_type = psa_get_key_type(&attributes);
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004622
4623exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004624 unlock_status = psa_unlock_key_slot(slot);
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004625
Gilles Peskine449bd832023-01-11 14:50:10 +01004626 if (status == PSA_SUCCESS) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004627 status = unlock_status;
Gilles Peskine449bd832023-01-11 14:50:10 +01004628 operation->alg = psa_aead_get_base_algorithm(alg);
Paul Elliottd9343f22021-08-23 18:59:49 +01004629 operation->is_encrypt = is_encrypt;
Gilles Peskine449bd832023-01-11 14:50:10 +01004630 } else {
4631 psa_aead_abort(operation);
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004632 }
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004633
Gilles Peskine449bd832023-01-11 14:50:10 +01004634 return status;
Paul Elliottc2b71442021-06-24 18:17:52 +01004635}
4636
Paul Elliott302ff6b2021-04-20 18:10:30 +01004637/* Set the key for a multipart authenticated encryption operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004638psa_status_t psa_aead_encrypt_setup(psa_aead_operation_t *operation,
4639 mbedtls_svc_key_id_t key,
4640 psa_algorithm_t alg)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004641{
Gilles Peskine449bd832023-01-11 14:50:10 +01004642 return psa_aead_setup(operation, 1, key, alg);
Paul Elliott302ff6b2021-04-20 18:10:30 +01004643}
4644
4645/* Set the key for a multipart authenticated decryption operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004646psa_status_t psa_aead_decrypt_setup(psa_aead_operation_t *operation,
4647 mbedtls_svc_key_id_t key,
4648 psa_algorithm_t alg)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004649{
Gilles Peskine449bd832023-01-11 14:50:10 +01004650 return psa_aead_setup(operation, 0, key, alg);
Paul Elliott302ff6b2021-04-20 18:10:30 +01004651}
4652
4653/* Generate a random nonce / IV for multipart AEAD operation */
Gilles Peskine449bd832023-01-11 14:50:10 +01004654psa_status_t psa_aead_generate_nonce(psa_aead_operation_t *operation,
4655 uint8_t *nonce,
4656 size_t nonce_size,
4657 size_t *nonce_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004658{
4659 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Croncae59092021-11-26 18:53:58 +01004660 uint8_t local_nonce[PSA_AEAD_NONCE_MAX_SIZE];
Paul Elliottb91da712021-05-20 14:43:47 +01004661 size_t required_nonce_size;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004662
Paul Elliott8eb9daf2021-06-04 16:42:21 +01004663 *nonce_length = 0;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004664
Gilles Peskine449bd832023-01-11 14:50:10 +01004665 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004666 status = PSA_ERROR_BAD_STATE;
4667 goto exit;
4668 }
4669
Gilles Peskine449bd832023-01-11 14:50:10 +01004670 if (operation->nonce_set || !operation->is_encrypt) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004671 status = PSA_ERROR_BAD_STATE;
4672 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004673 }
4674
Paul Elliotte193ea82021-10-01 13:00:16 +01004675 /* For CCM, this size may not be correct according to the PSA
4676 * specification. The PSA Crypto 1.0.1 specification states:
4677 *
4678 * CCM encodes the plaintext length pLen in L octets, with L the smallest
4679 * integer >= 2 where pLen < 2^(8L). The nonce length is then 15 - L bytes.
4680 *
4681 * However this restriction that L has to be the smallest integer is not
4682 * applied in practice, and it is not implementable here since the
4683 * plaintext length may or may not be known at this time. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004684 required_nonce_size = PSA_AEAD_NONCE_LENGTH(operation->key_type,
4685 operation->alg);
4686 if (nonce_size < required_nonce_size) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004687 status = PSA_ERROR_BUFFER_TOO_SMALL;
4688 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004689 }
4690
Gilles Peskine449bd832023-01-11 14:50:10 +01004691 status = psa_generate_random(local_nonce, required_nonce_size);
4692 if (status != PSA_SUCCESS) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004693 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004694 }
Paul Elliott302ff6b2021-04-20 18:10:30 +01004695
Gilles Peskine449bd832023-01-11 14:50:10 +01004696 status = psa_aead_set_nonce(operation, local_nonce, required_nonce_size);
Paul Elliott302ff6b2021-04-20 18:10:30 +01004697
Paul Elliott39dc6b82021-05-11 19:16:09 +01004698exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004699 if (status == PSA_SUCCESS) {
4700 memcpy(nonce, local_nonce, required_nonce_size);
Paul Elliott39dc6b82021-05-11 19:16:09 +01004701 *nonce_length = required_nonce_size;
Gilles Peskine449bd832023-01-11 14:50:10 +01004702 } else {
4703 psa_aead_abort(operation);
Ronald Croncae59092021-11-26 18:53:58 +01004704 }
Paul Elliott39dc6b82021-05-11 19:16:09 +01004705
Gilles Peskine449bd832023-01-11 14:50:10 +01004706 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004707}
4708
4709/* Set the nonce for a multipart authenticated encryption or decryption
4710 operation.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01004711psa_status_t psa_aead_set_nonce(psa_aead_operation_t *operation,
4712 const uint8_t *nonce,
4713 size_t nonce_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004714{
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004715 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4716
Gilles Peskine449bd832023-01-11 14:50:10 +01004717 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004718 status = PSA_ERROR_BAD_STATE;
4719 goto exit;
4720 }
4721
Gilles Peskine449bd832023-01-11 14:50:10 +01004722 if (operation->nonce_set) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004723 status = PSA_ERROR_BAD_STATE;
4724 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004725 }
4726
Gilles Peskine449bd832023-01-11 14:50:10 +01004727 status = psa_aead_check_nonce_length(operation->alg, nonce_length);
4728 if (status != PSA_SUCCESS) {
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004729 status = PSA_ERROR_INVALID_ARGUMENT;
4730 goto exit;
Paul Elliott4ed1ed12021-09-27 18:09:28 +01004731 }
Paul Elliott1a98aca2021-05-20 18:24:07 +01004732
Gilles Peskine449bd832023-01-11 14:50:10 +01004733 status = psa_driver_wrapper_aead_set_nonce(operation, nonce,
4734 nonce_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004735
Paul Elliott39dc6b82021-05-11 19:16:09 +01004736exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004737 if (status == PSA_SUCCESS) {
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004738 operation->nonce_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004739 } else {
4740 psa_aead_abort(operation);
4741 }
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004742
Gilles Peskine449bd832023-01-11 14:50:10 +01004743 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004744}
4745
4746/* Declare the lengths of the message and additional data for multipart AEAD. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004747psa_status_t psa_aead_set_lengths(psa_aead_operation_t *operation,
4748 size_t ad_length,
4749 size_t plaintext_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004750{
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004751 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4752
Gilles Peskine449bd832023-01-11 14:50:10 +01004753 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004754 status = PSA_ERROR_BAD_STATE;
4755 goto exit;
4756 }
4757
Gilles Peskine449bd832023-01-11 14:50:10 +01004758 if (operation->lengths_set || operation->ad_started ||
4759 operation->body_started) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004760 status = PSA_ERROR_BAD_STATE;
4761 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004762 }
4763
Gilles Peskine449bd832023-01-11 14:50:10 +01004764 switch (operation->alg) {
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004765#if defined(PSA_WANT_ALG_GCM)
4766 case PSA_ALG_GCM:
4767 /* Lengths can only be too large for GCM if size_t is bigger than 32
Gilles Peskine449bd832023-01-11 14:50:10 +01004768 * bits. Without the guard this code will generate warnings on 32bit
4769 * builds. */
Paul Elliott325d3742021-09-27 17:56:28 +01004770#if SIZE_MAX > UINT32_MAX
Gilles Peskine449bd832023-01-11 14:50:10 +01004771 if (((uint64_t) ad_length) >> 61 != 0 ||
4772 ((uint64_t) plaintext_length) > 0xFFFFFFFE0ull) {
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004773 status = PSA_ERROR_INVALID_ARGUMENT;
4774 goto exit;
4775 }
Paul Elliott325d3742021-09-27 17:56:28 +01004776#endif
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004777 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004778#endif /* PSA_WANT_ALG_GCM */
4779#if defined(PSA_WANT_ALG_CCM)
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004780 case PSA_ALG_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01004781 if (ad_length > 0xFF00) {
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004782 status = PSA_ERROR_INVALID_ARGUMENT;
4783 goto exit;
4784 }
4785 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004786#endif /* PSA_WANT_ALG_CCM */
4787#if defined(PSA_WANT_ALG_CHACHA20_POLY1305)
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004788 case PSA_ALG_CHACHA20_POLY1305:
4789 /* No length restrictions for ChaChaPoly. */
4790 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004791#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004792 default:
4793 break;
4794 }
Paul Elliott325d3742021-09-27 17:56:28 +01004795
Gilles Peskine449bd832023-01-11 14:50:10 +01004796 status = psa_driver_wrapper_aead_set_lengths(operation, ad_length,
4797 plaintext_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004798
Paul Elliott39dc6b82021-05-11 19:16:09 +01004799exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004800 if (status == PSA_SUCCESS) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01004801 operation->ad_remaining = ad_length;
4802 operation->body_remaining = plaintext_length;
Paul Elliott39dc6b82021-05-11 19:16:09 +01004803 operation->lengths_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004804 } else {
4805 psa_aead_abort(operation);
Paul Elliottee4ffe02021-05-20 17:25:06 +01004806 }
Paul Elliott39dc6b82021-05-11 19:16:09 +01004807
Gilles Peskine449bd832023-01-11 14:50:10 +01004808 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004809}
Paul Elliott3d7d52c2021-09-01 10:33:14 +01004810
4811/* Pass additional data to an active multipart AEAD operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004812psa_status_t psa_aead_update_ad(psa_aead_operation_t *operation,
4813 const uint8_t *input,
4814 size_t input_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004815{
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004816 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4817
Gilles Peskine449bd832023-01-11 14:50:10 +01004818 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004819 status = PSA_ERROR_BAD_STATE;
4820 goto exit;
4821 }
4822
Gilles Peskine449bd832023-01-11 14:50:10 +01004823 if (!operation->nonce_set || operation->body_started) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004824 status = PSA_ERROR_BAD_STATE;
4825 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004826 }
4827
Gilles Peskine449bd832023-01-11 14:50:10 +01004828 if (operation->lengths_set) {
4829 if (operation->ad_remaining < input_length) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01004830 status = PSA_ERROR_INVALID_ARGUMENT;
4831 goto exit;
4832 }
4833
4834 operation->ad_remaining -= input_length;
4835 }
Paul Elliotte193ea82021-10-01 13:00:16 +01004836#if defined(PSA_WANT_ALG_CCM)
Gilles Peskine449bd832023-01-11 14:50:10 +01004837 else if (operation->alg == PSA_ALG_CCM) {
Paul Elliotte193ea82021-10-01 13:00:16 +01004838 status = PSA_ERROR_BAD_STATE;
4839 goto exit;
4840 }
4841#endif /* PSA_WANT_ALG_CCM */
Paul Elliottee4ffe02021-05-20 17:25:06 +01004842
Gilles Peskine449bd832023-01-11 14:50:10 +01004843 status = psa_driver_wrapper_aead_update_ad(operation, input,
4844 input_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004845
Paul Elliott39dc6b82021-05-11 19:16:09 +01004846exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004847 if (status == PSA_SUCCESS) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004848 operation->ad_started = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004849 } else {
4850 psa_aead_abort(operation);
4851 }
Paul Elliott39dc6b82021-05-11 19:16:09 +01004852
Gilles Peskine449bd832023-01-11 14:50:10 +01004853 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004854}
4855
4856/* Encrypt or decrypt a message fragment in an active multipart AEAD
4857 operation.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01004858psa_status_t psa_aead_update(psa_aead_operation_t *operation,
4859 const uint8_t *input,
4860 size_t input_length,
4861 uint8_t *output,
4862 size_t output_size,
4863 size_t *output_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004864{
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004865 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004866
4867 *output_length = 0;
4868
Gilles Peskine449bd832023-01-11 14:50:10 +01004869 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004870 status = PSA_ERROR_BAD_STATE;
4871 goto exit;
4872 }
4873
Gilles Peskine449bd832023-01-11 14:50:10 +01004874 if (!operation->nonce_set) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004875 status = PSA_ERROR_BAD_STATE;
4876 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004877 }
4878
Gilles Peskine449bd832023-01-11 14:50:10 +01004879 if (operation->lengths_set) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01004880 /* Additional data length was supplied, but not all the additional
4881 data was supplied.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01004882 if (operation->ad_remaining != 0) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01004883 status = PSA_ERROR_INVALID_ARGUMENT;
4884 goto exit;
4885 }
4886
4887 /* Too much data provided. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004888 if (operation->body_remaining < input_length) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01004889 status = PSA_ERROR_INVALID_ARGUMENT;
4890 goto exit;
4891 }
4892
4893 operation->body_remaining -= input_length;
4894 }
Paul Elliotte193ea82021-10-01 13:00:16 +01004895#if defined(PSA_WANT_ALG_CCM)
Gilles Peskine449bd832023-01-11 14:50:10 +01004896 else if (operation->alg == PSA_ALG_CCM) {
Paul Elliotte193ea82021-10-01 13:00:16 +01004897 status = PSA_ERROR_BAD_STATE;
4898 goto exit;
4899 }
4900#endif /* PSA_WANT_ALG_CCM */
Paul Elliottee4ffe02021-05-20 17:25:06 +01004901
Gilles Peskine449bd832023-01-11 14:50:10 +01004902 status = psa_driver_wrapper_aead_update(operation, input, input_length,
4903 output, output_size,
4904 output_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004905
Paul Elliott39dc6b82021-05-11 19:16:09 +01004906exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004907 if (status == PSA_SUCCESS) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004908 operation->body_started = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004909 } else {
4910 psa_aead_abort(operation);
4911 }
Paul Elliott39dc6b82021-05-11 19:16:09 +01004912
Gilles Peskine449bd832023-01-11 14:50:10 +01004913 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004914}
4915
Gilles Peskine449bd832023-01-11 14:50:10 +01004916static psa_status_t psa_aead_final_checks(const psa_aead_operation_t *operation)
Paul Elliottad53dcc2021-06-23 08:50:14 +01004917{
Gilles Peskine449bd832023-01-11 14:50:10 +01004918 if (operation->id == 0 || !operation->nonce_set) {
4919 return PSA_ERROR_BAD_STATE;
4920 }
Paul Elliottad53dcc2021-06-23 08:50:14 +01004921
Gilles Peskine449bd832023-01-11 14:50:10 +01004922 if (operation->lengths_set && (operation->ad_remaining != 0 ||
4923 operation->body_remaining != 0)) {
4924 return PSA_ERROR_INVALID_ARGUMENT;
4925 }
Paul Elliottad53dcc2021-06-23 08:50:14 +01004926
Gilles Peskine449bd832023-01-11 14:50:10 +01004927 return PSA_SUCCESS;
Paul Elliottad53dcc2021-06-23 08:50:14 +01004928}
4929
Paul Elliott302ff6b2021-04-20 18:10:30 +01004930/* Finish encrypting a message in a multipart AEAD operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004931psa_status_t psa_aead_finish(psa_aead_operation_t *operation,
4932 uint8_t *ciphertext,
4933 size_t ciphertext_size,
4934 size_t *ciphertext_length,
4935 uint8_t *tag,
4936 size_t tag_size,
4937 size_t *tag_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004938{
Paul Elliott39dc6b82021-05-11 19:16:09 +01004939 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4940
Paul Elliott302ff6b2021-04-20 18:10:30 +01004941 *ciphertext_length = 0;
Paul Elliottf88a5652021-06-22 17:53:45 +01004942 *tag_length = tag_size;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004943
Gilles Peskine449bd832023-01-11 14:50:10 +01004944 status = psa_aead_final_checks(operation);
4945 if (status != PSA_SUCCESS) {
Paul Elliottad53dcc2021-06-23 08:50:14 +01004946 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004947 }
Paul Elliottad53dcc2021-06-23 08:50:14 +01004948
Gilles Peskine449bd832023-01-11 14:50:10 +01004949 if (!operation->is_encrypt) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004950 status = PSA_ERROR_BAD_STATE;
4951 goto exit;
4952 }
4953
Gilles Peskine449bd832023-01-11 14:50:10 +01004954 status = psa_driver_wrapper_aead_finish(operation, ciphertext,
4955 ciphertext_size,
4956 ciphertext_length,
4957 tag, tag_size, tag_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004958
Paul Elliott39dc6b82021-05-11 19:16:09 +01004959exit:
Paul Elliottdc42ca82023-02-24 18:11:59 +00004960
4961
Paul Elliottf47b0952021-05-21 18:02:33 +01004962 /* In case the operation fails and the user fails to check for failure or
Paul Elliott4c916e82021-09-19 18:34:50 +01004963 * the zero tag size, make sure the tag is set to something implausible.
4964 * Even if the operation succeeds, make sure we clear the rest of the
4965 * buffer to prevent potential leakage of anything previously placed in
4966 * the same buffer.*/
Paul Elliottdc42ca82023-02-24 18:11:59 +00004967 psa_wipe_tag_output_buffer(tag, status, tag_size, *tag_length);
Paul Elliottf47b0952021-05-21 18:02:33 +01004968
Gilles Peskine449bd832023-01-11 14:50:10 +01004969 psa_aead_abort(operation);
Paul Elliott39dc6b82021-05-11 19:16:09 +01004970
Gilles Peskine449bd832023-01-11 14:50:10 +01004971 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004972}
4973
4974/* Finish authenticating and decrypting a message in a multipart AEAD
4975 operation.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01004976psa_status_t psa_aead_verify(psa_aead_operation_t *operation,
4977 uint8_t *plaintext,
4978 size_t plaintext_size,
4979 size_t *plaintext_length,
4980 const uint8_t *tag,
4981 size_t tag_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004982{
Paul Elliott39dc6b82021-05-11 19:16:09 +01004983 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4984
Paul Elliott302ff6b2021-04-20 18:10:30 +01004985 *plaintext_length = 0;
4986
Gilles Peskine449bd832023-01-11 14:50:10 +01004987 status = psa_aead_final_checks(operation);
4988 if (status != PSA_SUCCESS) {
Paul Elliottad53dcc2021-06-23 08:50:14 +01004989 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004990 }
Paul Elliottad53dcc2021-06-23 08:50:14 +01004991
Gilles Peskine449bd832023-01-11 14:50:10 +01004992 if (operation->is_encrypt) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004993 status = PSA_ERROR_BAD_STATE;
4994 goto exit;
4995 }
4996
Gilles Peskine449bd832023-01-11 14:50:10 +01004997 status = psa_driver_wrapper_aead_verify(operation, plaintext,
4998 plaintext_size,
4999 plaintext_length,
5000 tag, tag_length);
Paul Elliott39dc6b82021-05-11 19:16:09 +01005001
5002exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01005003 psa_aead_abort(operation);
Paul Elliott39dc6b82021-05-11 19:16:09 +01005004
Gilles Peskine449bd832023-01-11 14:50:10 +01005005 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005006}
5007
5008/* Abort an AEAD operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005009psa_status_t psa_aead_abort(psa_aead_operation_t *operation)
Paul Elliott302ff6b2021-04-20 18:10:30 +01005010{
5011 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
5012
Gilles Peskine449bd832023-01-11 14:50:10 +01005013 if (operation->id == 0) {
Paul Elliott302ff6b2021-04-20 18:10:30 +01005014 /* The object has (apparently) been initialized but it is not (yet)
5015 * in use. It's ok to call abort on such an object, and there's
5016 * nothing to do. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005017 return PSA_SUCCESS;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005018 }
5019
Gilles Peskine449bd832023-01-11 14:50:10 +01005020 status = psa_driver_wrapper_aead_abort(operation);
Paul Elliott302ff6b2021-04-20 18:10:30 +01005021
Gilles Peskine449bd832023-01-11 14:50:10 +01005022 memset(operation, 0, sizeof(*operation));
Paul Elliott302ff6b2021-04-20 18:10:30 +01005023
Gilles Peskine449bd832023-01-11 14:50:10 +01005024 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005025}
5026
Gilles Peskinee59236f2018-01-27 23:32:46 +01005027/****************************************************************/
Gilles Peskineeab56e42018-07-12 17:12:33 +02005028/* Generators */
5029/****************************************************************/
5030
Przemek Stekiel69c46792022-06-10 12:59:51 +02005031#if defined(BUILTIN_ALG_ANY_HKDF) || \
John Durkop07cc04a2020-11-16 22:08:34 -08005032 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005033 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) || \
Kusumit Ghoderaoaf0b5342023-05-03 11:58:46 +05305034 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) || \
5035 defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC)
John Durkop07cc04a2020-11-16 22:08:34 -08005036#define AT_LEAST_ONE_BUILTIN_KDF
Steven Cooreman094a77e2021-05-06 17:58:36 +02005037#endif /* At least one builtin KDF */
5038
Przemek Stekiel69c46792022-06-10 12:59:51 +02005039#if defined(BUILTIN_ALG_ANY_HKDF) || \
Steven Cooreman094a77e2021-05-06 17:58:36 +02005040 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
5041 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
5042static psa_status_t psa_key_derivation_start_hmac(
5043 psa_mac_operation_t *operation,
5044 psa_algorithm_t hash_alg,
5045 const uint8_t *hmac_key,
Gilles Peskine449bd832023-01-11 14:50:10 +01005046 size_t hmac_key_length)
Steven Cooreman094a77e2021-05-06 17:58:36 +02005047{
5048 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
5049 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine449bd832023-01-11 14:50:10 +01005050 psa_set_key_type(&attributes, PSA_KEY_TYPE_HMAC);
5051 psa_set_key_bits(&attributes, PSA_BYTES_TO_BITS(hmac_key_length));
5052 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_HASH);
Steven Cooreman094a77e2021-05-06 17:58:36 +02005053
Steven Cooreman72f736a2021-05-07 14:14:37 +02005054 operation->is_sign = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01005055 operation->mac_size = PSA_HASH_LENGTH(hash_alg);
Steven Cooreman72f736a2021-05-07 14:14:37 +02005056
Gilles Peskine449bd832023-01-11 14:50:10 +01005057 status = psa_driver_wrapper_mac_sign_setup(operation,
5058 &attributes,
5059 hmac_key, hmac_key_length,
5060 PSA_ALG_HMAC(hash_alg));
Steven Cooreman094a77e2021-05-06 17:58:36 +02005061
Gilles Peskine449bd832023-01-11 14:50:10 +01005062 psa_reset_key_attributes(&attributes);
5063 return status;
Steven Cooreman094a77e2021-05-06 17:58:36 +02005064}
5065#endif /* KDF algorithms reliant on HMAC */
John Durkop07cc04a2020-11-16 22:08:34 -08005066
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005067#define HKDF_STATE_INIT 0 /* no input yet */
5068#define HKDF_STATE_STARTED 1 /* got salt */
5069#define HKDF_STATE_KEYED 2 /* got key */
5070#define HKDF_STATE_OUTPUT 3 /* output started */
5071
Gilles Peskinecbe66502019-05-16 16:59:18 +02005072static psa_algorithm_t psa_key_derivation_get_kdf_alg(
Gilles Peskine449bd832023-01-11 14:50:10 +01005073 const psa_key_derivation_operation_t *operation)
Gilles Peskine969c5d62019-01-16 15:53:06 +01005074{
Gilles Peskine449bd832023-01-11 14:50:10 +01005075 if (PSA_ALG_IS_KEY_AGREEMENT(operation->alg)) {
5076 return PSA_ALG_KEY_AGREEMENT_GET_KDF(operation->alg);
5077 } else {
5078 return operation->alg;
5079 }
Gilles Peskine969c5d62019-01-16 15:53:06 +01005080}
5081
Gilles Peskine449bd832023-01-11 14:50:10 +01005082psa_status_t psa_key_derivation_abort(psa_key_derivation_operation_t *operation)
Gilles Peskineeab56e42018-07-12 17:12:33 +02005083{
5084 psa_status_t status = PSA_SUCCESS;
Gilles Peskine449bd832023-01-11 14:50:10 +01005085 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation);
5086 if (kdf_alg == 0) {
Gilles Peskineeab56e42018-07-12 17:12:33 +02005087 /* The object has (apparently) been initialized but it is not
5088 * in use. It's ok to call abort on such an object, and there's
5089 * nothing to do. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005090 } else
Przemek Stekiel69c46792022-06-10 12:59:51 +02005091#if defined(BUILTIN_ALG_ANY_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01005092 if (PSA_ALG_IS_ANY_HKDF(kdf_alg)) {
5093 mbedtls_free(operation->ctx.hkdf.info);
5094 status = psa_mac_abort(&operation->ctx.hkdf.hmac);
5095 } else
Przemek Stekiel69c46792022-06-10 12:59:51 +02005096#endif /* BUILTIN_ALG_ANY_HKDF */
John Durkop07cc04a2020-11-16 22:08:34 -08005097#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
5098 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005099 if (PSA_ALG_IS_TLS12_PRF(kdf_alg) ||
5100 /* TLS-1.2 PSK-to-MS KDF uses the same core as TLS-1.2 PRF */
5101 PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
5102 if (operation->ctx.tls12_prf.secret != NULL) {
5103 mbedtls_platform_zeroize(operation->ctx.tls12_prf.secret,
5104 operation->ctx.tls12_prf.secret_length);
5105 mbedtls_free(operation->ctx.tls12_prf.secret);
Steven Cooremana6df6042021-04-29 19:32:25 +02005106 }
5107
Gilles Peskine449bd832023-01-11 14:50:10 +01005108 if (operation->ctx.tls12_prf.seed != NULL) {
5109 mbedtls_platform_zeroize(operation->ctx.tls12_prf.seed,
5110 operation->ctx.tls12_prf.seed_length);
5111 mbedtls_free(operation->ctx.tls12_prf.seed);
Janos Follath6a1d2622019-06-11 10:37:28 +01005112 }
5113
Gilles Peskine449bd832023-01-11 14:50:10 +01005114 if (operation->ctx.tls12_prf.label != NULL) {
5115 mbedtls_platform_zeroize(operation->ctx.tls12_prf.label,
5116 operation->ctx.tls12_prf.label_length);
5117 mbedtls_free(operation->ctx.tls12_prf.label);
Janos Follath6a1d2622019-06-11 10:37:28 +01005118 }
Przemek Stekiel6c764412022-11-22 14:05:12 +01005119#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005120 if (operation->ctx.tls12_prf.other_secret != NULL) {
5121 mbedtls_platform_zeroize(operation->ctx.tls12_prf.other_secret,
5122 operation->ctx.tls12_prf.other_secret_length);
5123 mbedtls_free(operation->ctx.tls12_prf.other_secret);
Przemek Stekiele3ee2212022-04-07 14:29:56 +02005124 }
Przemek Stekiel6c764412022-11-22 14:05:12 +01005125#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Steven Cooremana6df6042021-04-29 19:32:25 +02005126 status = PSA_SUCCESS;
Janos Follath6a1d2622019-06-11 10:37:28 +01005127
5128 /* We leave the fields Ai and output_block to be erased safely by the
5129 * mbedtls_platform_zeroize() in the end of this function. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005130 } else
John Durkop07cc04a2020-11-16 22:08:34 -08005131#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) ||
5132 * defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) */
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005133#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005134 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
5135 mbedtls_platform_zeroize(operation->ctx.tls12_ecjpake_to_pms.data,
5136 sizeof(operation->ctx.tls12_ecjpake_to_pms.data));
5137 } else
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005138#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) */
Kusumit Ghoderaof5fedf12023-05-03 12:29:48 +05305139#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC)
5140 if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) {
Kusumit Ghoderaof5fedf12023-05-03 12:29:48 +05305141 if (operation->ctx.pbkdf2.salt != NULL) {
5142 mbedtls_platform_zeroize(operation->ctx.pbkdf2.salt,
5143 operation->ctx.pbkdf2.salt_length);
5144 mbedtls_free(operation->ctx.pbkdf2.salt);
5145 }
Kusumit Ghoderaof5fedf12023-05-03 12:29:48 +05305146
5147 status = PSA_SUCCESS;
5148 } else
5149#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC) */
Gilles Peskineeab56e42018-07-12 17:12:33 +02005150 {
5151 status = PSA_ERROR_BAD_STATE;
5152 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005153 mbedtls_platform_zeroize(operation, sizeof(*operation));
5154 return status;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005155}
5156
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005157psa_status_t psa_key_derivation_get_capacity(const psa_key_derivation_operation_t *operation,
Gilles Peskine449bd832023-01-11 14:50:10 +01005158 size_t *capacity)
Gilles Peskineeab56e42018-07-12 17:12:33 +02005159{
Gilles Peskine449bd832023-01-11 14:50:10 +01005160 if (operation->alg == 0) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005161 /* This is a blank key derivation operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005162 return PSA_ERROR_BAD_STATE;
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005163 }
5164
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005165 *capacity = operation->capacity;
Gilles Peskine449bd832023-01-11 14:50:10 +01005166 return PSA_SUCCESS;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005167}
5168
Gilles Peskine449bd832023-01-11 14:50:10 +01005169psa_status_t psa_key_derivation_set_capacity(psa_key_derivation_operation_t *operation,
5170 size_t capacity)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005171{
Gilles Peskine449bd832023-01-11 14:50:10 +01005172 if (operation->alg == 0) {
5173 return PSA_ERROR_BAD_STATE;
5174 }
5175 if (capacity > operation->capacity) {
5176 return PSA_ERROR_INVALID_ARGUMENT;
5177 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005178 operation->capacity = capacity;
Gilles Peskine449bd832023-01-11 14:50:10 +01005179 return PSA_SUCCESS;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005180}
5181
Przemek Stekiel69c46792022-06-10 12:59:51 +02005182#if defined(BUILTIN_ALG_ANY_HKDF)
Przemek Stekiel03d948c2022-05-19 11:45:20 +02005183/* Read some bytes from an HKDF-based operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005184static psa_status_t psa_key_derivation_hkdf_read(psa_hkdf_key_derivation_t *hkdf,
5185 psa_algorithm_t kdf_alg,
5186 uint8_t *output,
5187 size_t output_length)
Gilles Peskinebef7f142018-07-12 17:22:21 +02005188{
Gilles Peskine449bd832023-01-11 14:50:10 +01005189 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(kdf_alg);
5190 uint8_t hash_length = PSA_HASH_LENGTH(hash_alg);
Steven Cooremand1ed1d92021-04-29 19:11:25 +02005191 size_t hmac_output_length;
Gilles Peskinebef7f142018-07-12 17:22:21 +02005192 psa_status_t status;
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02005193#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01005194 const uint8_t last_block = PSA_ALG_IS_HKDF_EXTRACT(kdf_alg) ? 0 : 0xff;
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02005195#else
5196 const uint8_t last_block = 0xff;
5197#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Gilles Peskinebef7f142018-07-12 17:22:21 +02005198
Gilles Peskine449bd832023-01-11 14:50:10 +01005199 if (hkdf->state < HKDF_STATE_KEYED ||
5200 (!hkdf->info_set
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02005201#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01005202 && !PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02005203#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Gilles Peskine449bd832023-01-11 14:50:10 +01005204 )) {
5205 return PSA_ERROR_BAD_STATE;
5206 }
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005207 hkdf->state = HKDF_STATE_OUTPUT;
5208
Gilles Peskine449bd832023-01-11 14:50:10 +01005209 while (output_length != 0) {
Gilles Peskinebef7f142018-07-12 17:22:21 +02005210 /* Copy what remains of the current block */
5211 uint8_t n = hash_length - hkdf->offset_in_block;
Gilles Peskine449bd832023-01-11 14:50:10 +01005212 if (n > output_length) {
Gilles Peskinebef7f142018-07-12 17:22:21 +02005213 n = (uint8_t) output_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01005214 }
5215 memcpy(output, hkdf->output_block + hkdf->offset_in_block, n);
Gilles Peskinebef7f142018-07-12 17:22:21 +02005216 output += n;
5217 output_length -= n;
5218 hkdf->offset_in_block += n;
Gilles Peskine449bd832023-01-11 14:50:10 +01005219 if (output_length == 0) {
Gilles Peskinebef7f142018-07-12 17:22:21 +02005220 break;
Gilles Peskine449bd832023-01-11 14:50:10 +01005221 }
Przemek Stekiel03d948c2022-05-19 11:45:20 +02005222 /* We can't be wanting more output after the last block, otherwise
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02005223 * the capacity check in psa_key_derivation_output_bytes() would have
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005224 * prevented this call. It could happen only if the operation
Gilles Peskined54931c2018-07-17 21:06:59 +02005225 * object was corrupted or if this function is called directly
5226 * inside the library. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005227 if (hkdf->block_number == last_block) {
5228 return PSA_ERROR_BAD_STATE;
5229 }
Gilles Peskinebef7f142018-07-12 17:22:21 +02005230
5231 /* We need a new block */
5232 ++hkdf->block_number;
5233 hkdf->offset_in_block = 0;
Steven Cooremand1ed1d92021-04-29 19:11:25 +02005234
Gilles Peskine449bd832023-01-11 14:50:10 +01005235 status = psa_key_derivation_start_hmac(&hkdf->hmac,
5236 hash_alg,
5237 hkdf->prk,
5238 hash_length);
5239 if (status != PSA_SUCCESS) {
5240 return status;
Gilles Peskinebef7f142018-07-12 17:22:21 +02005241 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005242
5243 if (hkdf->block_number != 1) {
5244 status = psa_mac_update(&hkdf->hmac,
5245 hkdf->output_block,
5246 hash_length);
5247 if (status != PSA_SUCCESS) {
5248 return status;
5249 }
5250 }
5251 status = psa_mac_update(&hkdf->hmac,
5252 hkdf->info,
5253 hkdf->info_length);
5254 if (status != PSA_SUCCESS) {
5255 return status;
5256 }
5257 status = psa_mac_update(&hkdf->hmac,
5258 &hkdf->block_number, 1);
5259 if (status != PSA_SUCCESS) {
5260 return status;
5261 }
5262 status = psa_mac_sign_finish(&hkdf->hmac,
5263 hkdf->output_block,
5264 sizeof(hkdf->output_block),
5265 &hmac_output_length);
5266 if (status != PSA_SUCCESS) {
5267 return status;
5268 }
Gilles Peskinebef7f142018-07-12 17:22:21 +02005269 }
5270
Gilles Peskine449bd832023-01-11 14:50:10 +01005271 return PSA_SUCCESS;
Gilles Peskinebef7f142018-07-12 17:22:21 +02005272}
Przemek Stekiel69c46792022-06-10 12:59:51 +02005273#endif /* BUILTIN_ALG_ANY_HKDF */
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005274
John Durkop07cc04a2020-11-16 22:08:34 -08005275#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
5276 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Janos Follath7742fee2019-06-17 12:58:10 +01005277static psa_status_t psa_key_derivation_tls12_prf_generate_next_block(
5278 psa_tls12_prf_key_derivation_t *tls12_prf,
Gilles Peskine449bd832023-01-11 14:50:10 +01005279 psa_algorithm_t alg)
Janos Follath7742fee2019-06-17 12:58:10 +01005280{
Gilles Peskine449bd832023-01-11 14:50:10 +01005281 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(alg);
5282 uint8_t hash_length = PSA_HASH_LENGTH(hash_alg);
Steven Cooremana6df6042021-04-29 19:32:25 +02005283 psa_mac_operation_t hmac = PSA_MAC_OPERATION_INIT;
5284 size_t hmac_output_length;
Janos Follathea29bfb2019-06-19 12:21:20 +01005285 psa_status_t status, cleanup_status;
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005286
Janos Follath7742fee2019-06-17 12:58:10 +01005287 /* We can't be wanting more output after block 0xff, otherwise
5288 * the capacity check in psa_key_derivation_output_bytes() would have
5289 * prevented this call. It could happen only if the operation
5290 * object was corrupted or if this function is called directly
5291 * inside the library. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005292 if (tls12_prf->block_number == 0xff) {
5293 return PSA_ERROR_CORRUPTION_DETECTED;
5294 }
Janos Follath7742fee2019-06-17 12:58:10 +01005295
5296 /* We need a new block */
5297 ++tls12_prf->block_number;
Janos Follath844eb0e2019-06-19 12:10:49 +01005298 tls12_prf->left_in_block = hash_length;
Janos Follath7742fee2019-06-17 12:58:10 +01005299
5300 /* Recall the definition of the TLS-1.2-PRF from RFC 5246:
5301 *
5302 * PRF(secret, label, seed) = P_<hash>(secret, label + seed)
5303 *
5304 * P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
5305 * HMAC_hash(secret, A(2) + seed) +
5306 * HMAC_hash(secret, A(3) + seed) + ...
5307 *
5308 * A(0) = seed
Janos Follathea29bfb2019-06-19 12:21:20 +01005309 * A(i) = HMAC_hash(secret, A(i-1))
Janos Follath7742fee2019-06-17 12:58:10 +01005310 *
Janos Follathea29bfb2019-06-19 12:21:20 +01005311 * The `psa_tls12_prf_key_derivation` structure saves the block
Janos Follath7742fee2019-06-17 12:58:10 +01005312 * `HMAC_hash(secret, A(i) + seed)` from which the output
Janos Follath76c39842019-06-26 12:50:36 +01005313 * is currently extracted as `output_block` and where i is
5314 * `block_number`.
Janos Follath7742fee2019-06-17 12:58:10 +01005315 */
5316
Gilles Peskine449bd832023-01-11 14:50:10 +01005317 status = psa_key_derivation_start_hmac(&hmac,
5318 hash_alg,
5319 tls12_prf->secret,
5320 tls12_prf->secret_length);
5321 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005322 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005323 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005324
5325 /* Calculate A(i) where i = tls12_prf->block_number. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005326 if (tls12_prf->block_number == 1) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005327 /* A(1) = HMAC_hash(secret, A(0)), where A(0) = seed. (The RFC overloads
5328 * the variable seed and in this instance means it in the context of the
5329 * P_hash function, where seed = label + seed.) */
Gilles Peskine449bd832023-01-11 14:50:10 +01005330 status = psa_mac_update(&hmac,
5331 tls12_prf->label,
5332 tls12_prf->label_length);
5333 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005334 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005335 }
5336 status = psa_mac_update(&hmac,
5337 tls12_prf->seed,
5338 tls12_prf->seed_length);
5339 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005340 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005341 }
5342 } else {
Janos Follathea29bfb2019-06-19 12:21:20 +01005343 /* A(i) = HMAC_hash(secret, A(i-1)) */
Gilles Peskine449bd832023-01-11 14:50:10 +01005344 status = psa_mac_update(&hmac, tls12_prf->Ai, hash_length);
5345 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005346 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005347 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005348 }
5349
Gilles Peskine449bd832023-01-11 14:50:10 +01005350 status = psa_mac_sign_finish(&hmac,
5351 tls12_prf->Ai, hash_length,
5352 &hmac_output_length);
5353 if (hmac_output_length != hash_length) {
Steven Cooremana6df6042021-04-29 19:32:25 +02005354 status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine449bd832023-01-11 14:50:10 +01005355 }
5356 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005357 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005358 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005359
5360 /* Calculate HMAC_hash(secret, A(i) + label + seed). */
Gilles Peskine449bd832023-01-11 14:50:10 +01005361 status = psa_key_derivation_start_hmac(&hmac,
5362 hash_alg,
5363 tls12_prf->secret,
5364 tls12_prf->secret_length);
5365 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005366 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005367 }
5368 status = psa_mac_update(&hmac, tls12_prf->Ai, hash_length);
5369 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005370 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005371 }
5372 status = psa_mac_update(&hmac, tls12_prf->label, tls12_prf->label_length);
5373 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005374 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005375 }
5376 status = psa_mac_update(&hmac, tls12_prf->seed, tls12_prf->seed_length);
5377 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005378 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005379 }
5380 status = psa_mac_sign_finish(&hmac,
5381 tls12_prf->output_block, hash_length,
5382 &hmac_output_length);
5383 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005384 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005385 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005386
Janos Follath7742fee2019-06-17 12:58:10 +01005387
5388cleanup:
Gilles Peskine449bd832023-01-11 14:50:10 +01005389 cleanup_status = psa_mac_abort(&hmac);
5390 if (status == PSA_SUCCESS && cleanup_status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005391 status = cleanup_status;
Gilles Peskine449bd832023-01-11 14:50:10 +01005392 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005393
Gilles Peskine449bd832023-01-11 14:50:10 +01005394 return status;
Janos Follath7742fee2019-06-17 12:58:10 +01005395}
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005396
Janos Follath844eb0e2019-06-19 12:10:49 +01005397static psa_status_t psa_key_derivation_tls12_prf_read(
5398 psa_tls12_prf_key_derivation_t *tls12_prf,
5399 psa_algorithm_t alg,
5400 uint8_t *output,
Gilles Peskine449bd832023-01-11 14:50:10 +01005401 size_t output_length)
Janos Follath844eb0e2019-06-19 12:10:49 +01005402{
Gilles Peskine449bd832023-01-11 14:50:10 +01005403 psa_algorithm_t hash_alg = PSA_ALG_TLS12_PRF_GET_HASH(alg);
5404 uint8_t hash_length = PSA_HASH_LENGTH(hash_alg);
Janos Follath844eb0e2019-06-19 12:10:49 +01005405 psa_status_t status;
5406 uint8_t offset, length;
5407
Gilles Peskine449bd832023-01-11 14:50:10 +01005408 switch (tls12_prf->state) {
Gilles Peskineb1edaec2021-06-11 22:41:46 +02005409 case PSA_TLS12_PRF_STATE_LABEL_SET:
5410 tls12_prf->state = PSA_TLS12_PRF_STATE_OUTPUT;
5411 break;
5412 case PSA_TLS12_PRF_STATE_OUTPUT:
5413 break;
5414 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01005415 return PSA_ERROR_BAD_STATE;
Gilles Peskineb1edaec2021-06-11 22:41:46 +02005416 }
5417
Gilles Peskine449bd832023-01-11 14:50:10 +01005418 while (output_length != 0) {
Janos Follath844eb0e2019-06-19 12:10:49 +01005419 /* Check if we have fully processed the current block. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005420 if (tls12_prf->left_in_block == 0) {
5421 status = psa_key_derivation_tls12_prf_generate_next_block(tls12_prf,
5422 alg);
5423 if (status != PSA_SUCCESS) {
5424 return status;
5425 }
Janos Follath844eb0e2019-06-19 12:10:49 +01005426
5427 continue;
5428 }
5429
Gilles Peskine449bd832023-01-11 14:50:10 +01005430 if (tls12_prf->left_in_block > output_length) {
Janos Follath844eb0e2019-06-19 12:10:49 +01005431 length = (uint8_t) output_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01005432 } else {
Janos Follath844eb0e2019-06-19 12:10:49 +01005433 length = tls12_prf->left_in_block;
Gilles Peskine449bd832023-01-11 14:50:10 +01005434 }
Janos Follath844eb0e2019-06-19 12:10:49 +01005435
5436 offset = hash_length - tls12_prf->left_in_block;
Gilles Peskine449bd832023-01-11 14:50:10 +01005437 memcpy(output, tls12_prf->output_block + offset, length);
Janos Follath844eb0e2019-06-19 12:10:49 +01005438 output += length;
5439 output_length -= length;
5440 tls12_prf->left_in_block -= length;
5441 }
5442
Gilles Peskine449bd832023-01-11 14:50:10 +01005443 return PSA_SUCCESS;
Janos Follath844eb0e2019-06-19 12:10:49 +01005444}
John Durkop07cc04a2020-11-16 22:08:34 -08005445#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF ||
5446 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Gilles Peskinebef7f142018-07-12 17:22:21 +02005447
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005448#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
5449static psa_status_t psa_key_derivation_tls12_ecjpake_to_pms_read(
5450 psa_tls12_ecjpake_to_pms_t *ecjpake,
5451 uint8_t *output,
Gilles Peskine449bd832023-01-11 14:50:10 +01005452 size_t output_length)
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005453{
5454 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Andrzej Kurek5603efd2022-09-26 10:49:16 -04005455 size_t output_size = 0;
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005456
Gilles Peskine449bd832023-01-11 14:50:10 +01005457 if (output_length != 32) {
5458 return PSA_ERROR_INVALID_ARGUMENT;
5459 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005460
Gilles Peskine449bd832023-01-11 14:50:10 +01005461 status = psa_hash_compute(PSA_ALG_SHA_256, ecjpake->data,
5462 PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE, output, output_length,
5463 &output_size);
5464 if (status != PSA_SUCCESS) {
5465 return status;
5466 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005467
Gilles Peskine449bd832023-01-11 14:50:10 +01005468 if (output_size != output_length) {
5469 return PSA_ERROR_GENERIC_ERROR;
5470 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005471
Gilles Peskine449bd832023-01-11 14:50:10 +01005472 return PSA_SUCCESS;
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005473}
5474#endif
5475
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305476#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC)
5477static psa_status_t psa_key_derivation_pbkdf2_generate_block(
5478 psa_pbkdf2_key_derivation_t *pbkdf2,
5479 psa_algorithm_t prf_alg,
5480 uint8_t prf_output_length,
5481 psa_key_attributes_t *attributes)
5482{
5483 psa_status_t status;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305484 psa_mac_operation_t mac_operation = PSA_MAC_OPERATION_INIT;
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305485 size_t mac_output_length;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305486 uint8_t U_i[PSA_MAC_MAX_SIZE];
Kusumit Ghoderao257ea002023-06-14 15:55:11 +05305487 uint8_t *U_accumulator = pbkdf2->output_block;
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305488 uint64_t i;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305489 uint8_t block_counter[4];
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305490
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305491 mac_operation.is_sign = 1;
5492 mac_operation.mac_size = prf_output_length;
5493 MBEDTLS_PUT_UINT32_BE(pbkdf2->block_number, block_counter, 0);
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305494
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305495 status = psa_driver_wrapper_mac_sign_setup(&mac_operation,
5496 attributes,
5497 pbkdf2->password,
5498 pbkdf2->password_length,
5499 prf_alg);
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305500 if (status != PSA_SUCCESS) {
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305501 goto cleanup;
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305502 }
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305503 status = psa_mac_update(&mac_operation, pbkdf2->salt, pbkdf2->salt_length);
5504 if (status != PSA_SUCCESS) {
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305505 goto cleanup;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305506 }
Kusumit Ghoderao257ea002023-06-14 15:55:11 +05305507 status = psa_mac_update(&mac_operation, block_counter, sizeof(block_counter));
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305508 if (status != PSA_SUCCESS) {
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305509 goto cleanup;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305510 }
5511 status = psa_mac_sign_finish(&mac_operation, U_i, sizeof(U_i),
5512 &mac_output_length);
5513 if (status != PSA_SUCCESS) {
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305514 goto cleanup;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305515 }
5516
5517 if (mac_output_length != prf_output_length) {
Kusumit Ghoderao257ea002023-06-14 15:55:11 +05305518 status = PSA_ERROR_CORRUPTION_DETECTED;
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305519 goto cleanup;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305520 }
5521
Kusumit Ghoderao257ea002023-06-14 15:55:11 +05305522 memcpy(U_accumulator, U_i, prf_output_length);
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305523
5524 for (i = 1; i < pbkdf2->input_cost; i++) {
5525 status = psa_driver_wrapper_mac_compute(attributes,
5526 pbkdf2->password,
5527 pbkdf2->password_length,
5528 prf_alg, U_i, prf_output_length,
Kusumit Ghoderao109ee3d2023-06-08 16:36:45 +05305529 U_i, sizeof(U_i),
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305530 &mac_output_length);
5531 if (status != PSA_SUCCESS) {
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305532 goto cleanup;
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305533 }
5534
Kusumit Ghoderao109ee3d2023-06-08 16:36:45 +05305535 mbedtls_xor(U_accumulator, U_accumulator, U_i, prf_output_length);
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305536 }
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305537
5538cleanup:
5539 /* Zeroise buffers to clear sensitive data from memory. */
5540 mbedtls_platform_zeroize(U_i, PSA_MAC_MAX_SIZE);
5541 return status;
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305542}
Kusumit Ghoderaof6a0d572023-06-05 14:55:56 +05305543
5544static psa_status_t psa_key_derivation_pbkdf2_read(
5545 psa_pbkdf2_key_derivation_t *pbkdf2,
5546 psa_algorithm_t kdf_alg,
5547 uint8_t *output,
5548 size_t output_length)
5549{
5550 psa_status_t status;
5551 psa_algorithm_t prf_alg;
5552 uint8_t prf_output_length;
5553 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
5554 psa_set_key_bits(&attributes, PSA_BYTES_TO_BITS(pbkdf2->password_length));
5555 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_MESSAGE);
5556
5557 if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) {
5558 prf_alg = PSA_ALG_HMAC(PSA_ALG_PBKDF2_HMAC_GET_HASH(kdf_alg));
5559 prf_output_length = PSA_HASH_LENGTH(prf_alg);
5560 psa_set_key_type(&attributes, PSA_KEY_TYPE_HMAC);
Kusumit Ghoderaod9ec1af2023-06-08 20:19:51 +05305561 } else {
5562 return PSA_ERROR_INVALID_ARGUMENT;
Kusumit Ghoderaof6a0d572023-06-05 14:55:56 +05305563 }
5564
5565 switch (pbkdf2->state) {
5566 case PSA_PBKDF2_STATE_PASSWORD_SET:
5567 /* Initially we need a new block so bytes_used is equal to block size*/
5568 pbkdf2->bytes_used = prf_output_length;
5569 pbkdf2->state = PSA_PBKDF2_STATE_OUTPUT;
5570 break;
5571 case PSA_PBKDF2_STATE_OUTPUT:
5572 break;
5573 default:
5574 return PSA_ERROR_BAD_STATE;
5575 }
5576
5577 while (output_length != 0) {
5578 uint8_t n = prf_output_length - pbkdf2->bytes_used;
5579 if (n > output_length) {
5580 n = (uint8_t) output_length;
5581 }
5582 memcpy(output, pbkdf2->output_block + pbkdf2->bytes_used, n);
5583 output += n;
5584 output_length -= n;
5585 pbkdf2->bytes_used += n;
5586
5587 if (output_length == 0) {
5588 break;
5589 }
5590
5591 /* We need a new block */
5592 pbkdf2->bytes_used = 0;
5593 pbkdf2->block_number++;
5594
5595 status = psa_key_derivation_pbkdf2_generate_block(pbkdf2, prf_alg,
5596 prf_output_length,
5597 &attributes);
5598 if (status != PSA_SUCCESS) {
5599 return status;
5600 }
5601 }
5602
5603 return PSA_SUCCESS;
5604}
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305605#endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC */
5606
Janos Follath6c6c8fc2019-06-17 12:38:20 +01005607psa_status_t psa_key_derivation_output_bytes(
5608 psa_key_derivation_operation_t *operation,
5609 uint8_t *output,
Gilles Peskine449bd832023-01-11 14:50:10 +01005610 size_t output_length)
Gilles Peskineeab56e42018-07-12 17:12:33 +02005611{
5612 psa_status_t status;
Gilles Peskine449bd832023-01-11 14:50:10 +01005613 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation);
Gilles Peskineeab56e42018-07-12 17:12:33 +02005614
Gilles Peskine449bd832023-01-11 14:50:10 +01005615 if (operation->alg == 0) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005616 /* This is a blank operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005617 return PSA_ERROR_BAD_STATE;
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005618 }
5619
Gilles Peskine449bd832023-01-11 14:50:10 +01005620 if (output_length > operation->capacity) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005621 operation->capacity = 0;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005622 /* Go through the error path to wipe all confidential data now
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005623 * that the operation object is useless. */
David Saadab4ecc272019-02-14 13:48:10 +02005624 status = PSA_ERROR_INSUFFICIENT_DATA;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005625 goto exit;
5626 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005627 if (output_length == 0 && operation->capacity == 0) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005628 /* Edge case: this is a finished operation, and 0 bytes
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005629 * were requested. The right error in this case could
Gilles Peskineeab56e42018-07-12 17:12:33 +02005630 * be either INSUFFICIENT_CAPACITY or BAD_STATE. Return
5631 * INSUFFICIENT_CAPACITY, which is right for a finished
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005632 * operation, for consistency with the case when
Gilles Peskineeab56e42018-07-12 17:12:33 +02005633 * output_length > 0. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005634 return PSA_ERROR_INSUFFICIENT_DATA;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005635 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005636 operation->capacity -= output_length;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005637
Przemek Stekiel69c46792022-06-10 12:59:51 +02005638#if defined(BUILTIN_ALG_ANY_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01005639 if (PSA_ALG_IS_ANY_HKDF(kdf_alg)) {
5640 status = psa_key_derivation_hkdf_read(&operation->ctx.hkdf, kdf_alg,
5641 output, output_length);
5642 } else
Przemek Stekiel69c46792022-06-10 12:59:51 +02005643#endif /* BUILTIN_ALG_ANY_HKDF */
John Durkop07cc04a2020-11-16 22:08:34 -08005644#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
5645 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005646 if (PSA_ALG_IS_TLS12_PRF(kdf_alg) ||
5647 PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
5648 status = psa_key_derivation_tls12_prf_read(&operation->ctx.tls12_prf,
5649 kdf_alg, output,
5650 output_length);
5651 } else
John Durkop07cc04a2020-11-16 22:08:34 -08005652#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF ||
5653 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005654#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005655 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005656 status = psa_key_derivation_tls12_ecjpake_to_pms_read(
Gilles Peskine449bd832023-01-11 14:50:10 +01005657 &operation->ctx.tls12_ecjpake_to_pms, output, output_length);
5658 } else
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005659#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */
Kusumit Ghoderao056f0c52023-05-03 15:58:34 +05305660#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC)
5661 if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) {
Kusumit Ghoderaof6a0d572023-06-05 14:55:56 +05305662 status = psa_key_derivation_pbkdf2_read(&operation->ctx.pbkdf2, kdf_alg,
5663 output, output_length);
Kusumit Ghoderao056f0c52023-05-03 15:58:34 +05305664 } else
5665#endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC */
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005666
Gilles Peskineeab56e42018-07-12 17:12:33 +02005667 {
Steven Cooreman74afe472021-02-10 17:19:22 +01005668 (void) kdf_alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01005669 return PSA_ERROR_BAD_STATE;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005670 }
5671
5672exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01005673 if (status != PSA_SUCCESS) {
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005674 /* Preserve the algorithm upon errors, but clear all sensitive state.
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005675 * This allows us to differentiate between exhausted operations and
5676 * blank operations, so we can return PSA_ERROR_BAD_STATE on blank
5677 * operations. */
5678 psa_algorithm_t alg = operation->alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01005679 psa_key_derivation_abort(operation);
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005680 operation->alg = alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01005681 memset(output, '!', output_length);
Gilles Peskineeab56e42018-07-12 17:12:33 +02005682 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005683 return status;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005684}
5685
David Brown7807bf72021-02-09 16:28:23 -07005686#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Gilles Peskine449bd832023-01-11 14:50:10 +01005687static void psa_des_set_key_parity(uint8_t *data, size_t data_size)
Gilles Peskine08542d82018-07-19 17:05:42 +02005688{
Gilles Peskine449bd832023-01-11 14:50:10 +01005689 if (data_size >= 8) {
5690 mbedtls_des_key_set_parity(data);
5691 }
5692 if (data_size >= 16) {
5693 mbedtls_des_key_set_parity(data + 8);
5694 }
5695 if (data_size >= 24) {
5696 mbedtls_des_key_set_parity(data + 16);
5697 }
Gilles Peskine08542d82018-07-19 17:05:42 +02005698}
David Brown7807bf72021-02-09 16:28:23 -07005699#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */
Gilles Peskine08542d82018-07-19 17:05:42 +02005700
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005701/*
Gilles Peskine449bd832023-01-11 14:50:10 +01005702 * ECC keys on a Weierstrass elliptic curve require the generation
5703 * of a private key which is an integer
5704 * in the range [1, N - 1], where N is the boundary of the private key domain:
5705 * N is the prime p for Diffie-Hellman, or the order of the
5706 * curve’s base point for ECC.
5707 *
5708 * Let m be the bit size of N, such that 2^m > N >= 2^(m-1).
5709 * This function generates the private key using the following process:
5710 *
5711 * 1. Draw a byte string of length ceiling(m/8) bytes.
5712 * 2. If m is not a multiple of 8, set the most significant
5713 * (8 * ceiling(m/8) - m) bits of the first byte in the string to zero.
5714 * 3. Convert the string to integer k by decoding it as a big-endian byte string.
5715 * 4. If k > N - 2, discard the result and return to step 1.
5716 * 5. Output k + 1 as the private key.
5717 *
5718 * This method allows compliance to NIST standards, specifically the methods titled
5719 * Key-Pair Generation by Testing Candidates in the following publications:
5720 * - NIST Special Publication 800-56A: Recommendation for Pair-Wise Key-Establishment
5721 * Schemes Using Discrete Logarithm Cryptography [SP800-56A] §5.6.1.1.4 for
5722 * Diffie-Hellman keys.
5723 *
5724 * - [SP800-56A] §5.6.1.2.2 or FIPS Publication 186-4: Digital Signature
5725 * Standard (DSS) [FIPS186-4] §B.4.2 for elliptic curve keys.
5726 *
5727 * Note: Function allocates memory for *data buffer, so given *data should be
5728 * always NULL.
5729 */
Valerio Setti8bb57632023-05-26 13:48:07 +02005730#if defined(MBEDTLS_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_LEGACY) || \
Joakim Anderssonbb576fe2023-03-01 11:23:02 +01005731 defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) || \
Przemek Stekiel7fc07512022-03-04 14:41:11 +01005732 defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
5733 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) || \
5734 defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01005735static psa_status_t psa_generate_derived_ecc_key_weierstrass_helper(
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005736 psa_key_slot_t *slot,
5737 size_t bits,
5738 psa_key_derivation_operation_t *operation,
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005739 uint8_t **data
5740 )
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005741{
Valerio Setti52789862023-04-07 12:13:11 +02005742#if defined(MBEDTLS_ECP_LIGHT)
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005743 unsigned key_out_of_range = 1;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005744 mbedtls_mpi k;
5745 mbedtls_mpi diff_N_2;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005746 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Przemek Stekiela81aed22022-03-01 15:13:30 +01005747 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005748
Gilles Peskine449bd832023-01-11 14:50:10 +01005749 mbedtls_mpi_init(&k);
5750 mbedtls_mpi_init(&diff_N_2);
Przemyslaw Stekiel1dfd1222021-11-18 13:35:00 +01005751
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005752 psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY(
Gilles Peskine449bd832023-01-11 14:50:10 +01005753 slot->attr.type);
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005754 mbedtls_ecp_group_id grp_id =
Gilles Peskine449bd832023-01-11 14:50:10 +01005755 mbedtls_ecc_group_of_psa(curve, bits, 0);
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005756
Gilles Peskine449bd832023-01-11 14:50:10 +01005757 if (grp_id == MBEDTLS_ECP_DP_NONE) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005758 ret = MBEDTLS_ERR_ASN1_INVALID_DATA;
Przemyslaw Stekiel871a3362021-12-02 08:46:39 +01005759 goto cleanup;
5760 }
5761
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005762 mbedtls_ecp_group ecp_group;
Gilles Peskine449bd832023-01-11 14:50:10 +01005763 mbedtls_ecp_group_init(&ecp_group);
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005764
Gilles Peskine449bd832023-01-11 14:50:10 +01005765 MBEDTLS_MPI_CHK(mbedtls_ecp_group_load(&ecp_group, grp_id));
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005766
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005767 /* N is the boundary of the private key domain (ecp_group.N). */
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005768 /* Let m be the bit size of N. */
5769 size_t m = ecp_group.nbits;
5770
Gilles Peskine449bd832023-01-11 14:50:10 +01005771 size_t m_bytes = PSA_BITS_TO_BYTES(m);
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005772
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005773 /* Calculate N - 2 - it will be needed later. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005774 MBEDTLS_MPI_CHK(mbedtls_mpi_sub_int(&diff_N_2, &ecp_group.N, 2));
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005775
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005776 /* Note: This function is always called with *data == NULL and it
5777 * allocates memory for the data buffer. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005778 *data = mbedtls_calloc(1, m_bytes);
5779 if (*data == NULL) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005780 ret = MBEDTLS_ERR_ASN1_ALLOC_FAILED;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005781 goto cleanup;
5782 }
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005783
Gilles Peskine449bd832023-01-11 14:50:10 +01005784 while (key_out_of_range) {
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005785 /* 1. Draw a byte string of length ceiling(m/8) bytes. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005786 if ((status = psa_key_derivation_output_bytes(operation, *data, m_bytes)) != 0) {
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005787 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005788 }
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005789
5790 /* 2. If m is not a multiple of 8 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005791 if (m % 8 != 0) {
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005792 /* Set the most significant
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005793 * (8 * ceiling(m/8) - m) bits of the first byte in
5794 * the string to zero.
5795 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005796 uint8_t clear_bit_mask = (1 << (m % 8)) - 1;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005797 (*data)[0] &= clear_bit_mask;
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005798 }
5799
5800 /* 3. Convert the string to integer k by decoding it as a
Gilles Peskine449bd832023-01-11 14:50:10 +01005801 * big-endian byte string.
5802 */
5803 MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(&k, *data, m_bytes));
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005804
5805 /* 4. If k > N - 2, discard the result and return to step 1.
Gilles Peskine449bd832023-01-11 14:50:10 +01005806 * Result of comparison is returned. When it indicates error
5807 * then this function is called again.
5808 */
5809 MBEDTLS_MPI_CHK(mbedtls_mpi_lt_mpi_ct(&diff_N_2, &k, &key_out_of_range));
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005810 }
5811
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005812 /* 5. Output k + 1 as the private key. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005813 MBEDTLS_MPI_CHK(mbedtls_mpi_add_int(&k, &k, 1));
5814 MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(&k, *data, m_bytes));
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005815cleanup:
Gilles Peskine449bd832023-01-11 14:50:10 +01005816 if (ret != 0) {
5817 status = mbedtls_to_psa_error(ret);
5818 }
5819 if (status != PSA_SUCCESS) {
5820 mbedtls_free(*data);
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005821 *data = NULL;
5822 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005823 mbedtls_mpi_free(&k);
5824 mbedtls_mpi_free(&diff_N_2);
5825 return status;
Valerio Setti52789862023-04-07 12:13:11 +02005826#else /* MBEDTLS_ECP_LIGHT */
Manuel Pégourié-Gonnard38316372023-03-17 12:18:32 +01005827 (void) slot;
5828 (void) bits;
5829 (void) operation;
5830 (void) data;
5831 return PSA_ERROR_NOT_SUPPORTED;
Valerio Setti52789862023-04-07 12:13:11 +02005832#endif /* MBEDTLS_ECP_LIGHT */
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005833}
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005834
5835/* ECC keys on a Montgomery elliptic curve draws a byte string whose length
5836 * is determined by the curve, and sets the mandatory bits accordingly. That is:
5837 *
5838 * - Curve25519 (PSA_ECC_FAMILY_MONTGOMERY, 255 bits):
5839 * draw a 32-byte string and process it as specified in
5840 * Elliptic Curves for Security [RFC7748] §5.
5841 *
5842 * - Curve448 (PSA_ECC_FAMILY_MONTGOMERY, 448 bits):
5843 * draw a 56-byte string and process it as specified in [RFC7748] §5.
5844 *
5845 * Note: Function allocates memory for *data buffer, so given *data should be
5846 * always NULL.
5847 */
5848
5849static psa_status_t psa_generate_derived_ecc_key_montgomery_helper(
5850 size_t bits,
5851 psa_key_derivation_operation_t *operation,
5852 uint8_t **data
5853 )
5854{
5855 size_t output_length;
Przemek Stekiela81aed22022-03-01 15:13:30 +01005856 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005857
Gilles Peskine449bd832023-01-11 14:50:10 +01005858 switch (bits) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005859 case 255:
5860 output_length = 32;
5861 break;
5862 case 448:
5863 output_length = 56;
5864 break;
5865 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01005866 return PSA_ERROR_INVALID_ARGUMENT;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005867 break;
5868 }
5869
Gilles Peskine449bd832023-01-11 14:50:10 +01005870 *data = mbedtls_calloc(1, output_length);
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005871
Gilles Peskine449bd832023-01-11 14:50:10 +01005872 if (*data == NULL) {
5873 return PSA_ERROR_INSUFFICIENT_MEMORY;
5874 }
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005875
Gilles Peskine449bd832023-01-11 14:50:10 +01005876 status = psa_key_derivation_output_bytes(operation, *data, output_length);
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005877
Gilles Peskine449bd832023-01-11 14:50:10 +01005878 if (status != PSA_SUCCESS) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005879 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01005880 }
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005881
Gilles Peskine449bd832023-01-11 14:50:10 +01005882 switch (bits) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005883 case 255:
5884 (*data)[0] &= 248;
5885 (*data)[31] &= 127;
5886 (*data)[31] |= 64;
5887 break;
5888 case 448:
5889 (*data)[0] &= 252;
5890 (*data)[55] |= 128;
5891 break;
5892 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01005893 return PSA_ERROR_CORRUPTION_DETECTED;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005894 break;
5895 }
5896
5897 return status;
5898}
Valerio Setti8bb57632023-05-26 13:48:07 +02005899#endif /* defined(MBEDTLS_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_LEGACY) ||
Joakim Anderssonbb576fe2023-03-01 11:23:02 +01005900 defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) ||
Przemek Stekiel7fc07512022-03-04 14:41:11 +01005901 defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
5902 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) ||
5903 defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH) */
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005904
Adrian L. Shaw5a5a79a2019-05-03 15:44:28 +01005905static psa_status_t psa_generate_derived_key_internal(
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005906 psa_key_slot_t *slot,
5907 size_t bits,
Gilles Peskine449bd832023-01-11 14:50:10 +01005908 psa_key_derivation_operation_t *operation)
Gilles Peskineeab56e42018-07-12 17:12:33 +02005909{
5910 uint8_t *data = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01005911 size_t bytes = PSA_BITS_TO_BYTES(bits);
Archanad8a83dc2021-06-14 10:04:16 +05305912 size_t storage_size = bytes;
Przemek Stekiela81aed22022-03-01 15:13:30 +01005913 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005914
Gilles Peskine449bd832023-01-11 14:50:10 +01005915 if (PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type)) {
5916 return PSA_ERROR_INVALID_ARGUMENT;
5917 }
Gilles Peskineeab56e42018-07-12 17:12:33 +02005918
Valerio Setti8bb57632023-05-26 13:48:07 +02005919#if defined(MBEDTLS_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_LEGACY) || \
Joakim Anderssonbb576fe2023-03-01 11:23:02 +01005920 defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) || \
Przemek Stekiel7fc07512022-03-04 14:41:11 +01005921 defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
5922 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) || \
5923 defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
Gilles Peskine449bd832023-01-11 14:50:10 +01005924 if (PSA_KEY_TYPE_IS_ECC(slot->attr.type)) {
5925 psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY(slot->attr.type);
5926 if (PSA_ECC_FAMILY_IS_WEIERSTRASS(curve)) {
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01005927 /* Weierstrass elliptic curve */
Gilles Peskine449bd832023-01-11 14:50:10 +01005928 status = psa_generate_derived_ecc_key_weierstrass_helper(slot, bits, operation, &data);
5929 if (status != PSA_SUCCESS) {
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005930 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005931 }
5932 } else {
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01005933 /* Montgomery elliptic curve */
Gilles Peskine449bd832023-01-11 14:50:10 +01005934 status = psa_generate_derived_ecc_key_montgomery_helper(bits, operation, &data);
5935 if (status != PSA_SUCCESS) {
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01005936 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005937 }
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01005938 }
Przemyslaw Stekiel1dfd1222021-11-18 13:35:00 +01005939 } else
Valerio Setti8bb57632023-05-26 13:48:07 +02005940#endif /* defined(MBEDTLS_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_LEGACY) ||
Joakim Anderssonbb576fe2023-03-01 11:23:02 +01005941 defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) ||
Przemek Stekiel7fc07512022-03-04 14:41:11 +01005942 defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
5943 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) ||
5944 defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH) */
Gilles Peskine449bd832023-01-11 14:50:10 +01005945 if (key_type_is_raw_bytes(slot->attr.type)) {
5946 if (bits % 8 != 0) {
5947 return PSA_ERROR_INVALID_ARGUMENT;
5948 }
5949 data = mbedtls_calloc(1, bytes);
5950 if (data == NULL) {
5951 return PSA_ERROR_INSUFFICIENT_MEMORY;
5952 }
Przemyslaw Stekiel1608e332021-11-09 10:46:40 +01005953
Gilles Peskine449bd832023-01-11 14:50:10 +01005954 status = psa_key_derivation_output_bytes(operation, data, bytes);
5955 if (status != PSA_SUCCESS) {
Przemyslaw Stekiel1608e332021-11-09 10:46:40 +01005956 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005957 }
David Brown12ca5032021-02-11 11:02:00 -07005958#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Gilles Peskine449bd832023-01-11 14:50:10 +01005959 if (slot->attr.type == PSA_KEY_TYPE_DES) {
5960 psa_des_set_key_parity(data, bytes);
5961 }
Przemek Stekielf110dc02022-03-01 14:48:05 +01005962#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES) */
Gilles Peskine449bd832023-01-11 14:50:10 +01005963 } else {
5964 return PSA_ERROR_NOT_SUPPORTED;
Przemyslaw Stekiel1608e332021-11-09 10:46:40 +01005965 }
Ronald Crondd04d422020-11-28 15:14:42 +01005966
Ronald Cronbf33c932020-11-28 18:06:53 +01005967 slot->attr.bits = (psa_key_bits_t) bits;
Ronald Cron2ebfdcc2020-11-28 15:54:54 +01005968 psa_key_attributes_t attributes = {
Gilles Peskine449bd832023-01-11 14:50:10 +01005969 .core = slot->attr
Ronald Cron2ebfdcc2020-11-28 15:54:54 +01005970 };
5971
Gilles Peskine449bd832023-01-11 14:50:10 +01005972 if (psa_key_lifetime_is_external(attributes.core.lifetime)) {
5973 status = psa_driver_wrapper_get_key_buffer_size(&attributes,
5974 &storage_size);
5975 if (status != PSA_SUCCESS) {
Archanad8a83dc2021-06-14 10:04:16 +05305976 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005977 }
Archanad8a83dc2021-06-14 10:04:16 +05305978 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005979 status = psa_allocate_buffer_to_slot(slot, storage_size);
5980 if (status != PSA_SUCCESS) {
Archanad8a83dc2021-06-14 10:04:16 +05305981 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005982 }
Archanad8a83dc2021-06-14 10:04:16 +05305983
Gilles Peskine449bd832023-01-11 14:50:10 +01005984 status = psa_driver_wrapper_import_key(&attributes,
5985 data, bytes,
5986 slot->key.data,
5987 slot->key.bytes,
5988 &slot->key.bytes, &bits);
5989 if (bits != slot->attr.bits) {
Ronald Cronbf33c932020-11-28 18:06:53 +01005990 status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine449bd832023-01-11 14:50:10 +01005991 }
Gilles Peskineeab56e42018-07-12 17:12:33 +02005992
5993exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01005994 mbedtls_free(data);
5995 return status;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005996}
5997
Gilles Peskine449bd832023-01-11 14:50:10 +01005998psa_status_t psa_key_derivation_output_key(const psa_key_attributes_t *attributes,
5999 psa_key_derivation_operation_t *operation,
6000 mbedtls_svc_key_id_t *key)
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006001{
6002 psa_status_t status;
6003 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02006004 psa_se_drv_table_entry_t *driver = NULL;
Gilles Peskine0f84d622019-09-12 19:03:13 +02006005
Ronald Cron81709fc2020-11-14 12:10:32 +01006006 *key = MBEDTLS_SVC_KEY_ID_INIT;
6007
Gilles Peskine0f84d622019-09-12 19:03:13 +02006008 /* Reject any attempt to create a zero-length key so that we don't
6009 * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006010 if (psa_get_key_bits(attributes) == 0) {
6011 return PSA_ERROR_INVALID_ARGUMENT;
6012 }
Gilles Peskine0f84d622019-09-12 19:03:13 +02006013
Gilles Peskine449bd832023-01-11 14:50:10 +01006014 if (operation->alg == PSA_ALG_NONE) {
6015 return PSA_ERROR_BAD_STATE;
6016 }
Dave Rodgmand69da6c2021-11-16 10:32:48 +00006017
Gilles Peskine449bd832023-01-11 14:50:10 +01006018 if (!operation->can_output_key) {
6019 return PSA_ERROR_NOT_PERMITTED;
6020 }
Gilles Peskine178c9aa2019-09-24 18:21:06 +02006021
Gilles Peskine449bd832023-01-11 14:50:10 +01006022 status = psa_start_key_creation(PSA_KEY_CREATION_DERIVE, attributes,
6023 &slot, &driver);
Gilles Peskinef4ee6622019-07-24 13:44:30 +02006024#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01006025 if (driver != NULL) {
Gilles Peskinef4ee6622019-07-24 13:44:30 +02006026 /* Deriving a key in a secure element is not implemented yet. */
6027 status = PSA_ERROR_NOT_SUPPORTED;
6028 }
6029#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskine449bd832023-01-11 14:50:10 +01006030 if (status == PSA_SUCCESS) {
6031 status = psa_generate_derived_key_internal(slot,
6032 attributes->core.bits,
6033 operation);
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006034 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006035 if (status == PSA_SUCCESS) {
6036 status = psa_finish_key_creation(slot, driver, key);
6037 }
6038 if (status != PSA_SUCCESS) {
6039 psa_fail_key_creation(slot, driver);
6040 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02006041
Gilles Peskine449bd832023-01-11 14:50:10 +01006042 return status;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006043}
6044
Gilles Peskineeab56e42018-07-12 17:12:33 +02006045
6046
6047/****************************************************************/
Gilles Peskineea0fb492018-07-12 17:17:20 +02006048/* Key derivation */
6049/****************************************************************/
6050
Steven Cooreman932ffb72021-02-15 12:14:32 +01006051#if defined(AT_LEAST_ONE_BUILTIN_KDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006052static int is_kdf_alg_supported(psa_algorithm_t kdf_alg)
Gilles Peskine9efde4f2021-04-29 21:10:00 +02006053{
6054#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006055 if (PSA_ALG_IS_HKDF(kdf_alg)) {
6056 return 1;
6057 }
Gilles Peskine9efde4f2021-04-29 21:10:00 +02006058#endif
Przemek Stekielb57a44b2022-06-06 08:33:45 +02006059#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01006060 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
6061 return 1;
6062 }
Przemek Stekielb57a44b2022-06-06 08:33:45 +02006063#endif
6064#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Gilles Peskine449bd832023-01-11 14:50:10 +01006065 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) {
6066 return 1;
6067 }
Gilles Peskine9efde4f2021-04-29 21:10:00 +02006068#endif
6069#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006070 if (PSA_ALG_IS_TLS12_PRF(kdf_alg)) {
6071 return 1;
6072 }
Gilles Peskine9efde4f2021-04-29 21:10:00 +02006073#endif
6074#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006075 if (PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
6076 return 1;
6077 }
Gilles Peskine9efde4f2021-04-29 21:10:00 +02006078#endif
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006079#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006080 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
6081 return 1;
6082 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006083#endif
Kusumit Ghoderaod132cac2023-05-03 12:00:27 +05306084#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC)
6085 if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) {
6086 return 1;
6087 }
6088#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01006089 return 0;
Gilles Peskine9efde4f2021-04-29 21:10:00 +02006090}
6091
Gilles Peskine449bd832023-01-11 14:50:10 +01006092static psa_status_t psa_hash_try_support(psa_algorithm_t alg)
Gilles Peskine0cc417d2021-04-29 21:18:14 +02006093{
6094 psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT;
Gilles Peskine449bd832023-01-11 14:50:10 +01006095 psa_status_t status = psa_hash_setup(&operation, alg);
6096 psa_hash_abort(&operation);
6097 return status;
Gilles Peskine0cc417d2021-04-29 21:18:14 +02006098}
6099
Gilles Peskine969c5d62019-01-16 15:53:06 +01006100static psa_status_t psa_key_derivation_setup_kdf(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006101 psa_key_derivation_operation_t *operation,
Gilles Peskine449bd832023-01-11 14:50:10 +01006102 psa_algorithm_t kdf_alg)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006103{
Janos Follath5fe19732019-06-20 15:09:30 +01006104 /* Make sure that operation->ctx is properly zero-initialised. (Macro
6105 * initialisers for this union leave some bytes unspecified.) */
Gilles Peskine449bd832023-01-11 14:50:10 +01006106 memset(&operation->ctx, 0, sizeof(operation->ctx));
Janos Follath5fe19732019-06-20 15:09:30 +01006107
Gilles Peskine969c5d62019-01-16 15:53:06 +01006108 /* Make sure that kdf_alg is a supported key derivation algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006109 if (!is_kdf_alg_supported(kdf_alg)) {
6110 return PSA_ERROR_NOT_SUPPORTED;
6111 }
John Durkop07cc04a2020-11-16 22:08:34 -08006112
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006113 /* All currently supported key derivation algorithms (apart from
Andrzej Kurek702776f2022-09-16 06:22:44 -04006114 * ecjpake to pms) are based on a hash algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006115 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(kdf_alg);
6116 size_t hash_size = PSA_HASH_LENGTH(hash_alg);
6117 if (kdf_alg != PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
6118 if (hash_size == 0) {
6119 return PSA_ERROR_NOT_SUPPORTED;
6120 }
Gilles Peskine0cc417d2021-04-29 21:18:14 +02006121
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006122 /* Make sure that hash_alg is a supported hash algorithm. Otherwise
6123 * we might fail later, which is somewhat unfriendly and potentially
6124 * risk-prone. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006125 psa_status_t status = psa_hash_try_support(hash_alg);
6126 if (status != PSA_SUCCESS) {
6127 return status;
6128 }
6129 } else {
6130 hash_size = PSA_HASH_LENGTH(PSA_ALG_SHA_256);
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006131 }
Gilles Peskine0cc417d2021-04-29 21:18:14 +02006132
Gilles Peskine449bd832023-01-11 14:50:10 +01006133 if ((PSA_ALG_IS_TLS12_PRF(kdf_alg) ||
6134 PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) &&
6135 !(hash_alg == PSA_ALG_SHA_256 || hash_alg == PSA_ALG_SHA_384)) {
6136 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006137 }
Andrzej Kurek77638292022-09-16 12:24:52 -04006138#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) || \
Andrzej Kurekb510cd22022-09-26 10:50:22 -04006139 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006140 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg) ||
6141 (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS)) {
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006142 operation->capacity = hash_size;
Gilles Peskine449bd832023-01-11 14:50:10 +01006143 } else
Andrzej Kurekb510cd22022-09-26 10:50:22 -04006144#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT ||
6145 MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */
Gilles Peskine449bd832023-01-11 14:50:10 +01006146 operation->capacity = 255 * hash_size;
6147 return PSA_SUCCESS;
Gilles Peskine969c5d62019-01-16 15:53:06 +01006148}
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006149
Gilles Peskine449bd832023-01-11 14:50:10 +01006150static psa_status_t psa_key_agreement_try_support(psa_algorithm_t alg)
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006151{
6152#if defined(PSA_WANT_ALG_ECDH)
Gilles Peskine449bd832023-01-11 14:50:10 +01006153 if (alg == PSA_ALG_ECDH) {
6154 return PSA_SUCCESS;
6155 }
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006156#endif
Przemek Stekielfb3dd542022-12-01 14:59:15 +01006157#if defined(PSA_WANT_ALG_FFDH)
6158 if (alg == PSA_ALG_FFDH) {
6159 return PSA_SUCCESS;
6160 }
6161#endif
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006162 (void) alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01006163 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006164}
Gilles Peskinebb3814c2022-12-16 01:12:12 +01006165
6166static int psa_key_derivation_allows_free_form_secret_input(
6167 psa_algorithm_t kdf_alg)
6168{
6169#if defined(PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS)
6170 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
6171 return 0;
6172 }
6173#endif
6174 (void) kdf_alg;
6175 return 1;
6176}
John Durkop07cc04a2020-11-16 22:08:34 -08006177#endif /* AT_LEAST_ONE_BUILTIN_KDF */
Gilles Peskine969c5d62019-01-16 15:53:06 +01006178
Gilles Peskine449bd832023-01-11 14:50:10 +01006179psa_status_t psa_key_derivation_setup(psa_key_derivation_operation_t *operation,
6180 psa_algorithm_t alg)
Gilles Peskine969c5d62019-01-16 15:53:06 +01006181{
6182 psa_status_t status;
6183
Gilles Peskine449bd832023-01-11 14:50:10 +01006184 if (operation->alg != 0) {
6185 return PSA_ERROR_BAD_STATE;
Gilles Peskine969c5d62019-01-16 15:53:06 +01006186 }
Gilles Peskine969c5d62019-01-16 15:53:06 +01006187
Gilles Peskine449bd832023-01-11 14:50:10 +01006188 if (PSA_ALG_IS_RAW_KEY_AGREEMENT(alg)) {
6189 return PSA_ERROR_INVALID_ARGUMENT;
6190 } else if (PSA_ALG_IS_KEY_AGREEMENT(alg)) {
6191#if defined(AT_LEAST_ONE_BUILTIN_KDF)
6192 psa_algorithm_t kdf_alg = PSA_ALG_KEY_AGREEMENT_GET_KDF(alg);
6193 psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE(alg);
6194 status = psa_key_agreement_try_support(ka_alg);
6195 if (status != PSA_SUCCESS) {
6196 return status;
6197 }
Gilles Peskinebb3814c2022-12-16 01:12:12 +01006198 if (!psa_key_derivation_allows_free_form_secret_input(kdf_alg)) {
6199 return PSA_ERROR_INVALID_ARGUMENT;
6200 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006201 status = psa_key_derivation_setup_kdf(operation, kdf_alg);
6202#else
6203 return PSA_ERROR_NOT_SUPPORTED;
6204#endif /* AT_LEAST_ONE_BUILTIN_KDF */
6205 } else if (PSA_ALG_IS_KEY_DERIVATION(alg)) {
6206#if defined(AT_LEAST_ONE_BUILTIN_KDF)
6207 status = psa_key_derivation_setup_kdf(operation, alg);
6208#else
6209 return PSA_ERROR_NOT_SUPPORTED;
6210#endif /* AT_LEAST_ONE_BUILTIN_KDF */
6211 } else {
6212 return PSA_ERROR_INVALID_ARGUMENT;
6213 }
6214
6215 if (status == PSA_SUCCESS) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006216 operation->alg = alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01006217 }
6218 return status;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006219}
6220
Przemek Stekiel69c46792022-06-10 12:59:51 +02006221#if defined(BUILTIN_ALG_ANY_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006222static psa_status_t psa_hkdf_input(psa_hkdf_key_derivation_t *hkdf,
6223 psa_algorithm_t kdf_alg,
6224 psa_key_derivation_step_t step,
6225 const uint8_t *data,
6226 size_t data_length)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006227{
Gilles Peskine449bd832023-01-11 14:50:10 +01006228 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(kdf_alg);
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006229 psa_status_t status;
Gilles Peskine449bd832023-01-11 14:50:10 +01006230 switch (step) {
Gilles Peskine03410b52019-05-16 16:05:19 +02006231 case PSA_KEY_DERIVATION_INPUT_SALT:
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006232#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Gilles Peskine449bd832023-01-11 14:50:10 +01006233 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) {
6234 return PSA_ERROR_INVALID_ARGUMENT;
6235 }
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006236#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND */
Gilles Peskine449bd832023-01-11 14:50:10 +01006237 if (hkdf->state != HKDF_STATE_INIT) {
6238 return PSA_ERROR_BAD_STATE;
6239 } else {
6240 status = psa_key_derivation_start_hmac(&hkdf->hmac,
6241 hash_alg,
6242 data, data_length);
6243 if (status != PSA_SUCCESS) {
6244 return status;
6245 }
Steven Cooremand1ed1d92021-04-29 19:11:25 +02006246 hkdf->state = HKDF_STATE_STARTED;
Gilles Peskine449bd832023-01-11 14:50:10 +01006247 return PSA_SUCCESS;
Steven Cooremand1ed1d92021-04-29 19:11:25 +02006248 }
Gilles Peskine03410b52019-05-16 16:05:19 +02006249 case PSA_KEY_DERIVATION_INPUT_SECRET:
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006250#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Gilles Peskine449bd832023-01-11 14:50:10 +01006251 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) {
Przemek Stekiel2fb0dcd2022-05-19 10:34:37 +02006252 /* We shouldn't be in different state as HKDF_EXPAND only allows
6253 * two inputs: SECRET (this case) and INFO which does not modify
6254 * the state. It could happen only if the hkdf
6255 * object was corrupted. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006256 if (hkdf->state != HKDF_STATE_INIT) {
6257 return PSA_ERROR_BAD_STATE;
6258 }
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006259
Przemek Stekiel2fb0dcd2022-05-19 10:34:37 +02006260 /* Allow only input that fits expected prk size */
Gilles Peskine449bd832023-01-11 14:50:10 +01006261 if (data_length != PSA_HASH_LENGTH(hash_alg)) {
6262 return PSA_ERROR_INVALID_ARGUMENT;
6263 }
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006264
Gilles Peskine449bd832023-01-11 14:50:10 +01006265 memcpy(hkdf->prk, data, data_length);
6266 } else
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006267#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND */
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006268 {
Przemek Stekiel0586f4c2022-06-03 16:00:25 +02006269 /* HKDF: If no salt was provided, use an empty salt.
6270 * HKDF-EXTRACT: salt is mandatory. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006271 if (hkdf->state == HKDF_STATE_INIT) {
Przemek Stekiel0586f4c2022-06-03 16:00:25 +02006272#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01006273 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
6274 return PSA_ERROR_BAD_STATE;
6275 }
Przemek Stekiel0586f4c2022-06-03 16:00:25 +02006276#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Gilles Peskine449bd832023-01-11 14:50:10 +01006277 status = psa_key_derivation_start_hmac(&hkdf->hmac,
6278 hash_alg,
6279 NULL, 0);
6280 if (status != PSA_SUCCESS) {
6281 return status;
6282 }
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006283 hkdf->state = HKDF_STATE_STARTED;
6284 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006285 if (hkdf->state != HKDF_STATE_STARTED) {
6286 return PSA_ERROR_BAD_STATE;
6287 }
6288 status = psa_mac_update(&hkdf->hmac,
6289 data, data_length);
6290 if (status != PSA_SUCCESS) {
6291 return status;
6292 }
6293 status = psa_mac_sign_finish(&hkdf->hmac,
6294 hkdf->prk,
6295 sizeof(hkdf->prk),
6296 &data_length);
6297 if (status != PSA_SUCCESS) {
6298 return status;
6299 }
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006300 }
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006301
Gilles Peskine2b522db2019-04-12 15:11:49 +02006302 hkdf->state = HKDF_STATE_KEYED;
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006303 hkdf->block_number = 0;
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006304#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01006305 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006306 /* The only block of output is the PRK. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006307 memcpy(hkdf->output_block, hkdf->prk, PSA_HASH_LENGTH(hash_alg));
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006308 hkdf->offset_in_block = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01006309 } else
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006310#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006311 {
6312 /* Block 0 is empty, and the next block will be
6313 * generated by psa_key_derivation_hkdf_read(). */
Gilles Peskine449bd832023-01-11 14:50:10 +01006314 hkdf->offset_in_block = PSA_HASH_LENGTH(hash_alg);
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006315 }
6316
Gilles Peskine449bd832023-01-11 14:50:10 +01006317 return PSA_SUCCESS;
Gilles Peskine03410b52019-05-16 16:05:19 +02006318 case PSA_KEY_DERIVATION_INPUT_INFO:
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006319#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01006320 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
6321 return PSA_ERROR_INVALID_ARGUMENT;
6322 }
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006323#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Przemek Stekielcde3f782022-06-03 16:12:27 +02006324#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Gilles Peskine449bd832023-01-11 14:50:10 +01006325 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg) &&
6326 hkdf->state == HKDF_STATE_INIT) {
6327 return PSA_ERROR_BAD_STATE;
6328 }
Przemek Stekielcde3f782022-06-03 16:12:27 +02006329#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Gilles Peskine449bd832023-01-11 14:50:10 +01006330 if (hkdf->state == HKDF_STATE_OUTPUT) {
6331 return PSA_ERROR_BAD_STATE;
6332 }
6333 if (hkdf->info_set) {
6334 return PSA_ERROR_BAD_STATE;
6335 }
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006336 hkdf->info_length = data_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01006337 if (data_length != 0) {
6338 hkdf->info = mbedtls_calloc(1, data_length);
6339 if (hkdf->info == NULL) {
6340 return PSA_ERROR_INSUFFICIENT_MEMORY;
6341 }
6342 memcpy(hkdf->info, data, data_length);
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006343 }
6344 hkdf->info_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01006345 return PSA_SUCCESS;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006346 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01006347 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006348 }
6349}
Przemek Stekiel69c46792022-06-10 12:59:51 +02006350#endif /* BUILTIN_ALG_ANY_HKDF */
Janos Follathb03233e2019-06-11 15:30:30 +01006351
John Durkop07cc04a2020-11-16 22:08:34 -08006352#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
6353 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006354static psa_status_t psa_tls12_prf_set_seed(psa_tls12_prf_key_derivation_t *prf,
6355 const uint8_t *data,
6356 size_t data_length)
Janos Follathf08e2652019-06-13 09:05:41 +01006357{
Gilles Peskine449bd832023-01-11 14:50:10 +01006358 if (prf->state != PSA_TLS12_PRF_STATE_INIT) {
6359 return PSA_ERROR_BAD_STATE;
6360 }
Janos Follathf08e2652019-06-13 09:05:41 +01006361
Gilles Peskine449bd832023-01-11 14:50:10 +01006362 if (data_length != 0) {
6363 prf->seed = mbedtls_calloc(1, data_length);
6364 if (prf->seed == NULL) {
6365 return PSA_ERROR_INSUFFICIENT_MEMORY;
6366 }
Janos Follathf08e2652019-06-13 09:05:41 +01006367
Gilles Peskine449bd832023-01-11 14:50:10 +01006368 memcpy(prf->seed, data, data_length);
Janos Follathd6dce9f2019-07-04 09:11:38 +01006369 prf->seed_length = data_length;
6370 }
Janos Follathf08e2652019-06-13 09:05:41 +01006371
Gilles Peskine43f958b2020-12-13 14:55:14 +01006372 prf->state = PSA_TLS12_PRF_STATE_SEED_SET;
Janos Follathf08e2652019-06-13 09:05:41 +01006373
Gilles Peskine449bd832023-01-11 14:50:10 +01006374 return PSA_SUCCESS;
Janos Follathf08e2652019-06-13 09:05:41 +01006375}
6376
Gilles Peskine449bd832023-01-11 14:50:10 +01006377static psa_status_t psa_tls12_prf_set_key(psa_tls12_prf_key_derivation_t *prf,
6378 const uint8_t *data,
6379 size_t data_length)
Janos Follath81550542019-06-13 14:26:34 +01006380{
Gilles Peskine449bd832023-01-11 14:50:10 +01006381 if (prf->state != PSA_TLS12_PRF_STATE_SEED_SET &&
6382 prf->state != PSA_TLS12_PRF_STATE_OTHER_KEY_SET) {
6383 return PSA_ERROR_BAD_STATE;
6384 }
Janos Follath81550542019-06-13 14:26:34 +01006385
Gilles Peskine449bd832023-01-11 14:50:10 +01006386 if (data_length != 0) {
6387 prf->secret = mbedtls_calloc(1, data_length);
6388 if (prf->secret == NULL) {
6389 return PSA_ERROR_INSUFFICIENT_MEMORY;
6390 }
Steven Cooremana6df6042021-04-29 19:32:25 +02006391
Gilles Peskine449bd832023-01-11 14:50:10 +01006392 memcpy(prf->secret, data, data_length);
Steven Cooremana6df6042021-04-29 19:32:25 +02006393 prf->secret_length = data_length;
6394 }
Janos Follath81550542019-06-13 14:26:34 +01006395
Gilles Peskine43f958b2020-12-13 14:55:14 +01006396 prf->state = PSA_TLS12_PRF_STATE_KEY_SET;
Janos Follath81550542019-06-13 14:26:34 +01006397
Gilles Peskine449bd832023-01-11 14:50:10 +01006398 return PSA_SUCCESS;
Janos Follath81550542019-06-13 14:26:34 +01006399}
6400
Gilles Peskine449bd832023-01-11 14:50:10 +01006401static psa_status_t psa_tls12_prf_set_label(psa_tls12_prf_key_derivation_t *prf,
6402 const uint8_t *data,
6403 size_t data_length)
Janos Follath63028dd2019-06-13 09:15:47 +01006404{
Gilles Peskine449bd832023-01-11 14:50:10 +01006405 if (prf->state != PSA_TLS12_PRF_STATE_KEY_SET) {
6406 return PSA_ERROR_BAD_STATE;
6407 }
Janos Follath63028dd2019-06-13 09:15:47 +01006408
Gilles Peskine449bd832023-01-11 14:50:10 +01006409 if (data_length != 0) {
6410 prf->label = mbedtls_calloc(1, data_length);
6411 if (prf->label == NULL) {
6412 return PSA_ERROR_INSUFFICIENT_MEMORY;
6413 }
Janos Follath63028dd2019-06-13 09:15:47 +01006414
Gilles Peskine449bd832023-01-11 14:50:10 +01006415 memcpy(prf->label, data, data_length);
Janos Follathd6dce9f2019-07-04 09:11:38 +01006416 prf->label_length = data_length;
6417 }
Janos Follath63028dd2019-06-13 09:15:47 +01006418
Gilles Peskine43f958b2020-12-13 14:55:14 +01006419 prf->state = PSA_TLS12_PRF_STATE_LABEL_SET;
Janos Follath63028dd2019-06-13 09:15:47 +01006420
Gilles Peskine449bd832023-01-11 14:50:10 +01006421 return PSA_SUCCESS;
Janos Follath63028dd2019-06-13 09:15:47 +01006422}
6423
Gilles Peskine449bd832023-01-11 14:50:10 +01006424static psa_status_t psa_tls12_prf_input(psa_tls12_prf_key_derivation_t *prf,
6425 psa_key_derivation_step_t step,
6426 const uint8_t *data,
6427 size_t data_length)
Janos Follathb03233e2019-06-11 15:30:30 +01006428{
Gilles Peskine449bd832023-01-11 14:50:10 +01006429 switch (step) {
Janos Follathf08e2652019-06-13 09:05:41 +01006430 case PSA_KEY_DERIVATION_INPUT_SEED:
Gilles Peskine449bd832023-01-11 14:50:10 +01006431 return psa_tls12_prf_set_seed(prf, data, data_length);
Janos Follath81550542019-06-13 14:26:34 +01006432 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01006433 return psa_tls12_prf_set_key(prf, data, data_length);
Janos Follath63028dd2019-06-13 09:15:47 +01006434 case PSA_KEY_DERIVATION_INPUT_LABEL:
Gilles Peskine449bd832023-01-11 14:50:10 +01006435 return psa_tls12_prf_set_label(prf, data, data_length);
Janos Follathb03233e2019-06-11 15:30:30 +01006436 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01006437 return PSA_ERROR_INVALID_ARGUMENT;
Janos Follathb03233e2019-06-11 15:30:30 +01006438 }
6439}
John Durkop07cc04a2020-11-16 22:08:34 -08006440#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) ||
6441 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
6442
6443#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
6444static psa_status_t psa_tls12_prf_psk_to_ms_set_key(
6445 psa_tls12_prf_key_derivation_t *prf,
John Durkop07cc04a2020-11-16 22:08:34 -08006446 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01006447 size_t data_length)
John Durkop07cc04a2020-11-16 22:08:34 -08006448{
6449 psa_status_t status;
Gilles Peskine449bd832023-01-11 14:50:10 +01006450 const size_t pms_len = (prf->state == PSA_TLS12_PRF_STATE_OTHER_KEY_SET ?
6451 4 + data_length + prf->other_secret_length :
6452 4 + 2 * data_length);
John Durkop07cc04a2020-11-16 22:08:34 -08006453
Gilles Peskine449bd832023-01-11 14:50:10 +01006454 if (data_length > PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE) {
6455 return PSA_ERROR_INVALID_ARGUMENT;
6456 }
John Durkop07cc04a2020-11-16 22:08:34 -08006457
Gilles Peskine449bd832023-01-11 14:50:10 +01006458 uint8_t *pms = mbedtls_calloc(1, pms_len);
6459 if (pms == NULL) {
6460 return PSA_ERROR_INSUFFICIENT_MEMORY;
6461 }
Przemek Stekielc8fa5a12022-04-07 14:17:13 +02006462 uint8_t *cur = pms;
6463
6464 /* pure-PSK:
6465 * Quoting RFC 4279, Section 2:
John Durkop07cc04a2020-11-16 22:08:34 -08006466 *
6467 * The premaster secret is formed as follows: if the PSK is N octets
6468 * long, concatenate a uint16 with the value N, N zero octets, a second
6469 * uint16 with the value N, and the PSK itself.
Przemek Stekielc8fa5a12022-04-07 14:17:13 +02006470 *
6471 * mixed-PSK:
6472 * In a DHE-PSK, RSA-PSK, ECDHE-PSK the premaster secret is formed as
6473 * follows: concatenate a uint16 with the length of the other secret,
6474 * the other secret itself, uint16 with the length of PSK, and the
6475 * PSK itself.
6476 * For details please check:
6477 * - RFC 4279, Section 4 for the definition of RSA-PSK,
6478 * - RFC 4279, Section 3 for the definition of DHE-PSK,
6479 * - RFC 5489 for the definition of ECDHE-PSK.
John Durkop07cc04a2020-11-16 22:08:34 -08006480 */
6481
Gilles Peskine449bd832023-01-11 14:50:10 +01006482 if (prf->state == PSA_TLS12_PRF_STATE_OTHER_KEY_SET) {
6483 *cur++ = MBEDTLS_BYTE_1(prf->other_secret_length);
6484 *cur++ = MBEDTLS_BYTE_0(prf->other_secret_length);
6485 if (prf->other_secret_length != 0) {
6486 memcpy(cur, prf->other_secret, prf->other_secret_length);
6487 mbedtls_platform_zeroize(prf->other_secret, prf->other_secret_length);
Przemek Stekiel2503f7e2022-04-12 12:08:01 +02006488 cur += prf->other_secret_length;
6489 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006490 } else {
6491 *cur++ = MBEDTLS_BYTE_1(data_length);
6492 *cur++ = MBEDTLS_BYTE_0(data_length);
6493 memset(cur, 0, data_length);
Przemek Stekielc8fa5a12022-04-07 14:17:13 +02006494 cur += data_length;
6495 }
6496
Gilles Peskine449bd832023-01-11 14:50:10 +01006497 *cur++ = MBEDTLS_BYTE_1(data_length);
6498 *cur++ = MBEDTLS_BYTE_0(data_length);
6499 memcpy(cur, data, data_length);
John Durkop07cc04a2020-11-16 22:08:34 -08006500 cur += data_length;
6501
Gilles Peskine449bd832023-01-11 14:50:10 +01006502 status = psa_tls12_prf_set_key(prf, pms, cur - pms);
John Durkop07cc04a2020-11-16 22:08:34 -08006503
Gilles Peskine449bd832023-01-11 14:50:10 +01006504 mbedtls_platform_zeroize(pms, pms_len);
6505 mbedtls_free(pms);
6506 return status;
John Durkop07cc04a2020-11-16 22:08:34 -08006507}
Janos Follath6660f0e2019-06-17 08:44:03 +01006508
Przemek Stekiele47201b2022-04-19 13:53:28 +02006509static psa_status_t psa_tls12_prf_psk_to_ms_set_other_key(
6510 psa_tls12_prf_key_derivation_t *prf,
6511 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01006512 size_t data_length)
Przemek Stekiele47201b2022-04-19 13:53:28 +02006513{
Gilles Peskine449bd832023-01-11 14:50:10 +01006514 if (prf->state != PSA_TLS12_PRF_STATE_SEED_SET) {
6515 return PSA_ERROR_BAD_STATE;
Przemek Stekiele47201b2022-04-19 13:53:28 +02006516 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006517
6518 if (data_length != 0) {
6519 prf->other_secret = mbedtls_calloc(1, data_length);
6520 if (prf->other_secret == NULL) {
6521 return PSA_ERROR_INSUFFICIENT_MEMORY;
6522 }
6523
6524 memcpy(prf->other_secret, data, data_length);
6525 prf->other_secret_length = data_length;
6526 } else {
Przemek Stekiele47201b2022-04-19 13:53:28 +02006527 prf->other_secret_length = 0;
6528 }
6529
6530 prf->state = PSA_TLS12_PRF_STATE_OTHER_KEY_SET;
6531
Gilles Peskine449bd832023-01-11 14:50:10 +01006532 return PSA_SUCCESS;
Przemek Stekiele47201b2022-04-19 13:53:28 +02006533}
6534
Janos Follath6660f0e2019-06-17 08:44:03 +01006535static psa_status_t psa_tls12_prf_psk_to_ms_input(
6536 psa_tls12_prf_key_derivation_t *prf,
Janos Follath6660f0e2019-06-17 08:44:03 +01006537 psa_key_derivation_step_t step,
6538 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01006539 size_t data_length)
Janos Follath6660f0e2019-06-17 08:44:03 +01006540{
Gilles Peskine449bd832023-01-11 14:50:10 +01006541 switch (step) {
Przemek Stekiele47201b2022-04-19 13:53:28 +02006542 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01006543 return psa_tls12_prf_psk_to_ms_set_key(prf,
6544 data, data_length);
Przemek Stekiele47201b2022-04-19 13:53:28 +02006545 break;
6546 case PSA_KEY_DERIVATION_INPUT_OTHER_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01006547 return psa_tls12_prf_psk_to_ms_set_other_key(prf,
6548 data,
6549 data_length);
Przemek Stekiele47201b2022-04-19 13:53:28 +02006550 break;
6551 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01006552 return psa_tls12_prf_input(prf, step, data, data_length);
Przemek Stekiele47201b2022-04-19 13:53:28 +02006553 break;
Janos Follath6660f0e2019-06-17 08:44:03 +01006554
Przemek Stekiele47201b2022-04-19 13:53:28 +02006555 }
Janos Follath6660f0e2019-06-17 08:44:03 +01006556}
John Durkop07cc04a2020-11-16 22:08:34 -08006557#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006558
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006559#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
6560static psa_status_t psa_tls12_ecjpake_to_pms_input(
6561 psa_tls12_ecjpake_to_pms_t *ecjpake,
Andrzej Kurek702776f2022-09-16 06:22:44 -04006562 psa_key_derivation_step_t step,
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006563 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01006564 size_t data_length)
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006565{
Gilles Peskine449bd832023-01-11 14:50:10 +01006566 if (data_length != PSA_TLS12_ECJPAKE_TO_PMS_INPUT_SIZE ||
6567 step != PSA_KEY_DERIVATION_INPUT_SECRET) {
6568 return PSA_ERROR_INVALID_ARGUMENT;
Andrzej Kurek5603efd2022-09-26 10:49:16 -04006569 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006570
6571 /* Check if the passed point is in an uncompressed form */
Gilles Peskine449bd832023-01-11 14:50:10 +01006572 if (data[0] != 0x04) {
6573 return PSA_ERROR_INVALID_ARGUMENT;
6574 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006575
6576 /* Only K.X has to be extracted - bytes 1 to 32 inclusive. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006577 memcpy(ecjpake->data, data + 1, PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE);
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006578
Gilles Peskine449bd832023-01-11 14:50:10 +01006579 return PSA_SUCCESS;
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006580}
6581#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05306582
6583#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC)
6584static psa_status_t psa_pbkdf2_set_input_cost(
6585 psa_pbkdf2_key_derivation_t *pbkdf2,
6586 psa_key_derivation_step_t step,
6587 uint64_t data)
6588{
6589 if (step != PSA_KEY_DERIVATION_INPUT_COST) {
6590 return PSA_ERROR_INVALID_ARGUMENT;
6591 }
6592
6593 if (pbkdf2->state != PSA_PBKDF2_STATE_INIT) {
6594 return PSA_ERROR_BAD_STATE;
6595 }
Kusumit Ghoderao3fc4ca72023-05-08 15:57:41 +05306596
Kusumit Ghoderaoe66a8ad2023-05-24 12:30:43 +05306597 if (data > PSA_VENDOR_PBKDF2_MAX_ITERATIONS) {
Kusumit Ghoderao3fc4ca72023-05-08 15:57:41 +05306598 return PSA_ERROR_NOT_SUPPORTED;
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05306599 }
Kusumit Ghoderao3fc4ca72023-05-08 15:57:41 +05306600
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05306601 if (data == 0) {
6602 return PSA_ERROR_INVALID_ARGUMENT;
6603 }
Kusumit Ghoderaoe66a8ad2023-05-24 12:30:43 +05306604
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05306605 pbkdf2->input_cost = data;
6606 pbkdf2->state = PSA_PBKDF2_STATE_INPUT_COST_SET;
6607
6608 return PSA_SUCCESS;
6609}
Kusumit Ghoderao547a6c62023-05-03 12:18:19 +05306610
6611static psa_status_t psa_pbkdf2_set_salt(psa_pbkdf2_key_derivation_t *pbkdf2,
6612 const uint8_t *data,
6613 size_t data_length)
6614{
Kusumit Ghoderao547a6c62023-05-03 12:18:19 +05306615 if (pbkdf2->state != PSA_PBKDF2_STATE_INPUT_COST_SET &&
6616 pbkdf2->state != PSA_PBKDF2_STATE_SALT_SET) {
6617 return PSA_ERROR_BAD_STATE;
6618 }
6619
Kusumit Ghoderaod0422f32023-05-08 15:56:19 +05306620 if (pbkdf2->state == PSA_PBKDF2_STATE_INPUT_COST_SET) {
6621 pbkdf2->salt = mbedtls_calloc(1, data_length);
6622 if (pbkdf2->salt == NULL) {
6623 return PSA_ERROR_INSUFFICIENT_MEMORY;
Kusumit Ghoderao547a6c62023-05-03 12:18:19 +05306624 }
Kusumit Ghoderaod0422f32023-05-08 15:56:19 +05306625
6626 memcpy(pbkdf2->salt, data, data_length);
6627 pbkdf2->salt_length = data_length;
6628 } else if (pbkdf2->state == PSA_PBKDF2_STATE_SALT_SET) {
Kusumit Ghoderaod7a3f802023-05-24 22:19:47 +05306629 uint8_t *next_salt;
Kusumit Ghoderaob538bb72023-05-24 12:32:14 +05306630
Kusumit Ghoderaod7a3f802023-05-24 22:19:47 +05306631 next_salt = mbedtls_calloc(1, data_length + pbkdf2->salt_length);
6632 if (next_salt == NULL) {
Kusumit Ghoderaod0422f32023-05-08 15:56:19 +05306633 return PSA_ERROR_INSUFFICIENT_MEMORY;
6634 }
6635
Kusumit Ghoderaod7a3f802023-05-24 22:19:47 +05306636 memcpy(next_salt, pbkdf2->salt, pbkdf2->salt_length);
6637 memcpy(next_salt + pbkdf2->salt_length, data, data_length);
Kusumit Ghoderaod0422f32023-05-08 15:56:19 +05306638 pbkdf2->salt_length += data_length;
Kusumit Ghoderaod7a3f802023-05-24 22:19:47 +05306639 mbedtls_free(pbkdf2->salt);
6640 pbkdf2->salt = next_salt;
Kusumit Ghoderao547a6c62023-05-03 12:18:19 +05306641 }
6642
6643 pbkdf2->state = PSA_PBKDF2_STATE_SALT_SET;
6644
6645 return PSA_SUCCESS;
6646}
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05306647
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306648static psa_status_t psa_pbkdf2_hmac_set_password(psa_algorithm_t hash_alg,
Kusumit Ghoderaoaac9a582023-05-24 14:19:17 +05306649 const uint8_t *input,
6650 size_t input_len,
6651 uint8_t *output,
Kusumit Ghoderao91f99f52023-05-24 22:21:48 +05306652 size_t *output_len)
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306653{
6654 psa_status_t status = PSA_SUCCESS;
6655 if (input_len > PSA_HASH_BLOCK_LENGTH(hash_alg)) {
6656 status = psa_hash_compute(hash_alg, input, input_len, output,
Kusumit Ghoderao91f99f52023-05-24 22:21:48 +05306657 PSA_HMAC_MAX_HASH_BLOCK_SIZE, output_len);
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306658 } else {
6659 memcpy(output, input, input_len);
Kusumit Ghoderao91f99f52023-05-24 22:21:48 +05306660 *output_len = PSA_HASH_BLOCK_LENGTH(hash_alg);
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306661 }
6662 return status;
6663}
6664
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05306665static psa_status_t psa_pbkdf2_set_password(psa_pbkdf2_key_derivation_t *pbkdf2,
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306666 psa_algorithm_t kdf_alg,
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05306667 const uint8_t *data,
6668 size_t data_length)
6669{
Kusumit Ghoderaoaac9a582023-05-24 14:19:17 +05306670 psa_status_t status = PSA_SUCCESS;
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05306671 if (pbkdf2->state != PSA_PBKDF2_STATE_SALT_SET) {
6672 return PSA_ERROR_BAD_STATE;
6673 }
6674
6675 if (data_length != 0) {
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306676 if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) {
6677 psa_algorithm_t hash_alg = PSA_ALG_PBKDF2_HMAC_GET_HASH(kdf_alg);
6678 status = psa_pbkdf2_hmac_set_password(hash_alg, data, data_length,
6679 pbkdf2->password,
Kusumit Ghoderao91f99f52023-05-24 22:21:48 +05306680 &pbkdf2->password_length);
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05306681 }
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05306682 }
6683
6684 pbkdf2->state = PSA_PBKDF2_STATE_PASSWORD_SET;
6685
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306686 return status;
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05306687}
Kusumit Ghoderao24b38952023-05-03 12:25:26 +05306688
6689static psa_status_t psa_pbkdf2_input(psa_pbkdf2_key_derivation_t *pbkdf2,
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306690 psa_algorithm_t kdf_alg,
Kusumit Ghoderao24b38952023-05-03 12:25:26 +05306691 psa_key_derivation_step_t step,
6692 const uint8_t *data,
6693 size_t data_length)
6694{
6695 switch (step) {
6696 case PSA_KEY_DERIVATION_INPUT_SALT:
6697 return psa_pbkdf2_set_salt(pbkdf2, data, data_length);
6698 case PSA_KEY_DERIVATION_INPUT_PASSWORD:
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306699 return psa_pbkdf2_set_password(pbkdf2, kdf_alg, data, data_length);
Kusumit Ghoderao24b38952023-05-03 12:25:26 +05306700 default:
6701 return PSA_ERROR_INVALID_ARGUMENT;
6702 }
6703}
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05306704#endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC */
6705
Gilles Peskineb8965192019-09-24 16:21:10 +02006706/** Check whether the given key type is acceptable for the given
6707 * input step of a key derivation.
6708 *
6709 * Secret inputs must have the type #PSA_KEY_TYPE_DERIVE.
6710 * Non-secret inputs must have the type #PSA_KEY_TYPE_RAW_DATA.
6711 * Both secret and non-secret inputs can alternatively have the type
6712 * #PSA_KEY_TYPE_NONE, which is never the type of a key object, meaning
6713 * that the input was passed as a buffer rather than via a key object.
6714 */
Gilles Peskine224b0d62019-09-23 18:13:17 +02006715static int psa_key_derivation_check_input_type(
6716 psa_key_derivation_step_t step,
Gilles Peskine449bd832023-01-11 14:50:10 +01006717 psa_key_type_t key_type)
Gilles Peskine224b0d62019-09-23 18:13:17 +02006718{
Gilles Peskine449bd832023-01-11 14:50:10 +01006719 switch (step) {
Gilles Peskine224b0d62019-09-23 18:13:17 +02006720 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01006721 if (key_type == PSA_KEY_TYPE_DERIVE) {
6722 return PSA_SUCCESS;
6723 }
6724 if (key_type == PSA_KEY_TYPE_NONE) {
6725 return PSA_SUCCESS;
6726 }
Gilles Peskine224b0d62019-09-23 18:13:17 +02006727 break;
Przemek Stekiela7695a22022-04-07 15:39:01 +02006728 case PSA_KEY_DERIVATION_INPUT_OTHER_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01006729 if (key_type == PSA_KEY_TYPE_DERIVE) {
6730 return PSA_SUCCESS;
6731 }
6732 if (key_type == PSA_KEY_TYPE_NONE) {
6733 return PSA_SUCCESS;
6734 }
Przemek Stekiela7695a22022-04-07 15:39:01 +02006735 break;
Gilles Peskine224b0d62019-09-23 18:13:17 +02006736 case PSA_KEY_DERIVATION_INPUT_LABEL:
6737 case PSA_KEY_DERIVATION_INPUT_SALT:
6738 case PSA_KEY_DERIVATION_INPUT_INFO:
6739 case PSA_KEY_DERIVATION_INPUT_SEED:
Gilles Peskine449bd832023-01-11 14:50:10 +01006740 if (key_type == PSA_KEY_TYPE_RAW_DATA) {
6741 return PSA_SUCCESS;
6742 }
6743 if (key_type == PSA_KEY_TYPE_NONE) {
6744 return PSA_SUCCESS;
6745 }
Gilles Peskine224b0d62019-09-23 18:13:17 +02006746 break;
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05306747 case PSA_KEY_DERIVATION_INPUT_PASSWORD:
6748 if (key_type == PSA_KEY_TYPE_PASSWORD) {
6749 return PSA_SUCCESS;
6750 }
6751 if (key_type == PSA_KEY_TYPE_DERIVE) {
6752 return PSA_SUCCESS;
6753 }
6754 if (key_type == PSA_KEY_TYPE_NONE) {
6755 return PSA_SUCCESS;
6756 }
6757 break;
Gilles Peskine224b0d62019-09-23 18:13:17 +02006758 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006759 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine224b0d62019-09-23 18:13:17 +02006760}
6761
Janos Follathb80a94e2019-06-12 15:54:46 +01006762static psa_status_t psa_key_derivation_input_internal(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006763 psa_key_derivation_operation_t *operation,
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01006764 psa_key_derivation_step_t step,
Gilles Peskine224b0d62019-09-23 18:13:17 +02006765 psa_key_type_t key_type,
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01006766 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01006767 size_t data_length)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006768{
Gilles Peskine46d7faf2019-09-23 19:22:55 +02006769 psa_status_t status;
Gilles Peskine449bd832023-01-11 14:50:10 +01006770 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation);
Gilles Peskine46d7faf2019-09-23 19:22:55 +02006771
Gilles Peskine449bd832023-01-11 14:50:10 +01006772 status = psa_key_derivation_check_input_type(step, key_type);
6773 if (status != PSA_SUCCESS) {
Gilles Peskine224b0d62019-09-23 18:13:17 +02006774 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006775 }
Gilles Peskine224b0d62019-09-23 18:13:17 +02006776
Przemek Stekiel69c46792022-06-10 12:59:51 +02006777#if defined(BUILTIN_ALG_ANY_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006778 if (PSA_ALG_IS_ANY_HKDF(kdf_alg)) {
6779 status = psa_hkdf_input(&operation->ctx.hkdf, kdf_alg,
6780 step, data, data_length);
6781 } else
Przemek Stekiel69c46792022-06-10 12:59:51 +02006782#endif /* BUILTIN_ALG_ANY_HKDF */
John Durkop07cc04a2020-11-16 22:08:34 -08006783#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006784 if (PSA_ALG_IS_TLS12_PRF(kdf_alg)) {
6785 status = psa_tls12_prf_input(&operation->ctx.tls12_prf,
6786 step, data, data_length);
6787 } else
John Durkop07cc04a2020-11-16 22:08:34 -08006788#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF */
6789#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006790 if (PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
6791 status = psa_tls12_prf_psk_to_ms_input(&operation->ctx.tls12_prf,
6792 step, data, data_length);
6793 } else
John Durkop07cc04a2020-11-16 22:08:34 -08006794#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006795#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006796 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006797 status = psa_tls12_ecjpake_to_pms_input(
Gilles Peskine449bd832023-01-11 14:50:10 +01006798 &operation->ctx.tls12_ecjpake_to_pms, step, data, data_length);
6799 } else
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006800#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */
Kusumit Ghoderao24b38952023-05-03 12:25:26 +05306801#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC)
6802 if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) {
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306803 status = psa_pbkdf2_input(&operation->ctx.pbkdf2, kdf_alg,
6804 step, data, data_length);
Kusumit Ghoderao24b38952023-05-03 12:25:26 +05306805 } else
6806#endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006807 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006808 /* This can't happen unless the operation object was not initialized */
Steven Cooreman74afe472021-02-10 17:19:22 +01006809 (void) data;
6810 (void) data_length;
6811 (void) kdf_alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01006812 return PSA_ERROR_BAD_STATE;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006813 }
6814
Gilles Peskine224b0d62019-09-23 18:13:17 +02006815exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01006816 if (status != PSA_SUCCESS) {
6817 psa_key_derivation_abort(operation);
6818 }
6819 return status;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006820}
6821
Kusumit Ghoderao50e0e112023-04-06 17:47:25 +05306822static psa_status_t psa_key_derivation_input_integer_internal(
6823 psa_key_derivation_operation_t *operation,
6824 psa_key_derivation_step_t step,
6825 uint64_t value)
6826{
6827 psa_status_t status;
6828 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation);
6829
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05306830#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC)
6831 if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) {
6832 status = psa_pbkdf2_set_input_cost(
6833 &operation->ctx.pbkdf2, step, value);
6834 } else
6835#endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC */
Kusumit Ghoderao50e0e112023-04-06 17:47:25 +05306836 {
Kusumit Ghoderao3a18dee2023-04-07 16:16:27 +05306837 (void) step;
Kusumit Ghoderao50e0e112023-04-06 17:47:25 +05306838 (void) value;
6839 (void) kdf_alg;
Kusumit Ghoderaoa14ae5a2023-04-19 14:16:26 +05306840 status = PSA_ERROR_INVALID_ARGUMENT;
Kusumit Ghoderao50e0e112023-04-06 17:47:25 +05306841 }
6842
6843 if (status != PSA_SUCCESS) {
6844 psa_key_derivation_abort(operation);
6845 }
6846 return status;
6847}
6848
Janos Follath51f4a0f2019-06-14 11:35:55 +01006849psa_status_t psa_key_derivation_input_bytes(
6850 psa_key_derivation_operation_t *operation,
6851 psa_key_derivation_step_t step,
6852 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01006853 size_t data_length)
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01006854{
Gilles Peskine449bd832023-01-11 14:50:10 +01006855 return psa_key_derivation_input_internal(operation, step,
6856 PSA_KEY_TYPE_NONE,
6857 data, data_length);
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01006858}
6859
Kusumit Ghoderao50e0e112023-04-06 17:47:25 +05306860psa_status_t psa_key_derivation_input_integer(
6861 psa_key_derivation_operation_t *operation,
6862 psa_key_derivation_step_t step,
6863 uint64_t value)
6864{
6865 return psa_key_derivation_input_integer_internal(operation, step, value);
6866}
6867
Janos Follath51f4a0f2019-06-14 11:35:55 +01006868psa_status_t psa_key_derivation_input_key(
6869 psa_key_derivation_operation_t *operation,
6870 psa_key_derivation_step_t step,
Gilles Peskine449bd832023-01-11 14:50:10 +01006871 mbedtls_svc_key_id_t key)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006872{
Ronald Cronf95a2b12020-10-22 15:24:49 +02006873 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01006874 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006875 psa_key_slot_t *slot;
Gilles Peskine178c9aa2019-09-24 18:21:06 +02006876
Ronald Cron5c522922020-11-14 16:35:34 +01006877 status = psa_get_and_lock_transparent_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01006878 key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg);
6879 if (status != PSA_SUCCESS) {
6880 psa_key_derivation_abort(operation);
6881 return status;
Gilles Peskine593773d2019-09-23 18:17:40 +02006882 }
Gilles Peskine178c9aa2019-09-24 18:21:06 +02006883
Kusumit Ghoderao3128c5d2023-05-03 12:27:57 +05306884 /* Passing a key object as a SECRET or PASSWORD input unlocks the
6885 * permission to output to a key object. */
6886 if (step == PSA_KEY_DERIVATION_INPUT_SECRET ||
6887 step == PSA_KEY_DERIVATION_INPUT_PASSWORD) {
Gilles Peskine178c9aa2019-09-24 18:21:06 +02006888 operation->can_output_key = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01006889 }
Gilles Peskine178c9aa2019-09-24 18:21:06 +02006890
Gilles Peskine449bd832023-01-11 14:50:10 +01006891 status = psa_key_derivation_input_internal(operation,
6892 step, slot->attr.type,
6893 slot->key.data,
6894 slot->key.bytes);
Ronald Cronf95a2b12020-10-22 15:24:49 +02006895
Gilles Peskine449bd832023-01-11 14:50:10 +01006896 unlock_status = psa_unlock_key_slot(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02006897
Gilles Peskine449bd832023-01-11 14:50:10 +01006898 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006899}
Gilles Peskineea0fb492018-07-12 17:17:20 +02006900
6901
6902
6903/****************************************************************/
Gilles Peskine01d718c2018-09-18 12:01:02 +02006904/* Key agreement */
6905/****************************************************************/
6906
Gilles Peskine449bd832023-01-11 14:50:10 +01006907psa_status_t psa_key_agreement_raw_builtin(const psa_key_attributes_t *attributes,
6908 const uint8_t *key_buffer,
6909 size_t key_buffer_size,
6910 psa_algorithm_t alg,
6911 const uint8_t *peer_key,
6912 size_t peer_key_length,
6913 uint8_t *shared_secret,
6914 size_t shared_secret_size,
6915 size_t *shared_secret_length)
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02006916{
Gilles Peskine449bd832023-01-11 14:50:10 +01006917 switch (alg) {
John Durkop6ba40d12020-11-10 08:50:04 -08006918#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
Gilles Peskine0216fe12019-04-11 21:23:21 +02006919 case PSA_ALG_ECDH:
Gilles Peskine449bd832023-01-11 14:50:10 +01006920 return mbedtls_psa_key_agreement_ecdh(attributes, key_buffer,
6921 key_buffer_size, alg,
6922 peer_key, peer_key_length,
6923 shared_secret,
6924 shared_secret_size,
6925 shared_secret_length);
Gilles Peskine01d718c2018-09-18 12:01:02 +02006926#endif /* MBEDTLS_PSA_BUILTIN_ALG_ECDH */
Przemek Stekielfb3dd542022-12-01 14:59:15 +01006927
6928#if defined(MBEDTLS_PSA_BUILTIN_ALG_FFDH)
6929 case PSA_ALG_FFDH:
Przemek Stekiel359f4622022-12-05 14:11:55 +01006930 return mbedtls_psa_key_agreement_ffdh(attributes,
6931 peer_key,
6932 peer_key_length,
6933 key_buffer,
6934 key_buffer_size,
6935 shared_secret,
6936 shared_secret_size,
6937 shared_secret_length);
Przemek Stekielfb3dd542022-12-01 14:59:15 +01006938#endif /* MBEDTLS_PSA_BUILTIN_ALG_FFDH */
6939
Gilles Peskine01d718c2018-09-18 12:01:02 +02006940 default:
Aditya Deshpande17845b82022-10-13 17:21:01 +01006941 (void) attributes;
6942 (void) key_buffer;
6943 (void) key_buffer_size;
Gilles Peskine93f85002018-11-16 16:43:31 +01006944 (void) peer_key;
6945 (void) peer_key_length;
Gilles Peskine0216fe12019-04-11 21:23:21 +02006946 (void) shared_secret;
6947 (void) shared_secret_size;
6948 (void) shared_secret_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01006949 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine01d718c2018-09-18 12:01:02 +02006950 }
Gilles Peskine0216fe12019-04-11 21:23:21 +02006951}
Gilles Peskine01d718c2018-09-18 12:01:02 +02006952
Aditya Deshpande17845b82022-10-13 17:21:01 +01006953/** Internal function for raw key agreement
6954 * Calls the driver wrapper which will hand off key agreement task
Aditya Deshpande40c05cc2022-10-14 16:41:40 +01006955 * to the driver's implementation if a driver is present.
6956 * Fallback specified in the driver wrapper is built-in raw key agreement
Aditya Deshpande17845b82022-10-13 17:21:01 +01006957 * (psa_key_agreement_raw_builtin).
6958 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006959static psa_status_t psa_key_agreement_raw_internal(psa_algorithm_t alg,
6960 psa_key_slot_t *private_key,
6961 const uint8_t *peer_key,
6962 size_t peer_key_length,
6963 uint8_t *shared_secret,
6964 size_t shared_secret_size,
6965 size_t *shared_secret_length)
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006966{
Gilles Peskine449bd832023-01-11 14:50:10 +01006967 if (!PSA_ALG_IS_RAW_KEY_AGREEMENT(alg)) {
6968 return PSA_ERROR_NOT_SUPPORTED;
6969 }
Aditya Deshpande17845b82022-10-13 17:21:01 +01006970
6971 psa_key_attributes_t attributes = {
Gilles Peskine449bd832023-01-11 14:50:10 +01006972 .core = private_key->attr
Aditya Deshpande17845b82022-10-13 17:21:01 +01006973 };
6974
Gilles Peskine449bd832023-01-11 14:50:10 +01006975 return psa_driver_wrapper_key_agreement(&attributes,
6976 private_key->key.data,
6977 private_key->key.bytes, alg,
6978 peer_key, peer_key_length,
6979 shared_secret,
6980 shared_secret_size,
6981 shared_secret_length);
Gilles Peskine0216fe12019-04-11 21:23:21 +02006982}
6983
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02006984/* Note that if this function fails, you must call psa_key_derivation_abort()
Gilles Peskine01d718c2018-09-18 12:01:02 +02006985 * to potentially free embedded data structures and wipe confidential data.
6986 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006987static psa_status_t psa_key_agreement_internal(psa_key_derivation_operation_t *operation,
6988 psa_key_derivation_step_t step,
6989 psa_key_slot_t *private_key,
6990 const uint8_t *peer_key,
6991 size_t peer_key_length)
Gilles Peskine01d718c2018-09-18 12:01:02 +02006992{
6993 psa_status_t status;
Aditya Deshpande2f7fd762022-11-22 11:10:34 +00006994 uint8_t shared_secret[PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE];
Gilles Peskine01d718c2018-09-18 12:01:02 +02006995 size_t shared_secret_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01006996 psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE(operation->alg);
Gilles Peskine01d718c2018-09-18 12:01:02 +02006997
6998 /* Step 1: run the secret agreement algorithm to generate the shared
6999 * secret. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007000 status = psa_key_agreement_raw_internal(ka_alg,
7001 private_key,
7002 peer_key, peer_key_length,
7003 shared_secret,
7004 sizeof(shared_secret),
7005 &shared_secret_length);
7006 if (status != PSA_SUCCESS) {
Gilles Peskine12313cd2018-06-20 00:20:32 +02007007 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007008 }
Gilles Peskine12313cd2018-06-20 00:20:32 +02007009
Gilles Peskineb0b255c2018-07-06 17:01:38 +02007010 /* Step 2: set up the key derivation to generate key material from
Gilles Peskine224b0d62019-09-23 18:13:17 +02007011 * the shared secret. A shared secret is permitted wherever a key
7012 * of type DERIVE is permitted. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007013 status = psa_key_derivation_input_internal(operation, step,
7014 PSA_KEY_TYPE_DERIVE,
7015 shared_secret,
7016 shared_secret_length);
Gilles Peskine12313cd2018-06-20 00:20:32 +02007017exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01007018 mbedtls_platform_zeroize(shared_secret, shared_secret_length);
7019 return status;
Gilles Peskine12313cd2018-06-20 00:20:32 +02007020}
7021
Gilles Peskine449bd832023-01-11 14:50:10 +01007022psa_status_t psa_key_derivation_key_agreement(psa_key_derivation_operation_t *operation,
7023 psa_key_derivation_step_t step,
7024 mbedtls_svc_key_id_t private_key,
7025 const uint8_t *peer_key,
7026 size_t peer_key_length)
Gilles Peskine12313cd2018-06-20 00:20:32 +02007027{
Ronald Cronf95a2b12020-10-22 15:24:49 +02007028 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01007029 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01007030 psa_key_slot_t *slot;
Ronald Cronf95a2b12020-10-22 15:24:49 +02007031
Gilles Peskine449bd832023-01-11 14:50:10 +01007032 if (!PSA_ALG_IS_KEY_AGREEMENT(operation->alg)) {
7033 return PSA_ERROR_INVALID_ARGUMENT;
7034 }
Ronald Cron5c522922020-11-14 16:35:34 +01007035 status = psa_get_and_lock_transparent_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01007036 private_key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg);
7037 if (status != PSA_SUCCESS) {
7038 return status;
7039 }
7040 status = psa_key_agreement_internal(operation, step,
7041 slot,
7042 peer_key, peer_key_length);
7043 if (status != PSA_SUCCESS) {
7044 psa_key_derivation_abort(operation);
7045 } else {
Steven Cooremanfa5e6312020-10-15 17:07:12 +02007046 /* If a private key has been added as SECRET, we allow the derived
7047 * key material to be used as a key in PSA Crypto. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007048 if (step == PSA_KEY_DERIVATION_INPUT_SECRET) {
Steven Cooremanfa5e6312020-10-15 17:07:12 +02007049 operation->can_output_key = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01007050 }
Steven Cooremanfa5e6312020-10-15 17:07:12 +02007051 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02007052
Gilles Peskine449bd832023-01-11 14:50:10 +01007053 unlock_status = psa_unlock_key_slot(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02007054
Gilles Peskine449bd832023-01-11 14:50:10 +01007055 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskineaf3baab2018-06-27 22:55:52 +02007056}
7057
Gilles Peskine449bd832023-01-11 14:50:10 +01007058psa_status_t psa_raw_key_agreement(psa_algorithm_t alg,
7059 mbedtls_svc_key_id_t private_key,
7060 const uint8_t *peer_key,
7061 size_t peer_key_length,
7062 uint8_t *output,
7063 size_t output_size,
7064 size_t *output_length)
Gilles Peskine0216fe12019-04-11 21:23:21 +02007065{
Ronald Cronf95a2b12020-10-22 15:24:49 +02007066 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01007067 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cronf95a2b12020-10-22 15:24:49 +02007068 psa_key_slot_t *slot = NULL;
Gilles Peskine0216fe12019-04-11 21:23:21 +02007069
Gilles Peskine449bd832023-01-11 14:50:10 +01007070 if (!PSA_ALG_IS_KEY_AGREEMENT(alg)) {
Gilles Peskine0216fe12019-04-11 21:23:21 +02007071 status = PSA_ERROR_INVALID_ARGUMENT;
7072 goto exit;
7073 }
Ronald Cron5c522922020-11-14 16:35:34 +01007074 status = psa_get_and_lock_transparent_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01007075 private_key, &slot, PSA_KEY_USAGE_DERIVE, alg);
7076 if (status != PSA_SUCCESS) {
Gilles Peskine0216fe12019-04-11 21:23:21 +02007077 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007078 }
Gilles Peskine0216fe12019-04-11 21:23:21 +02007079
Gilles Peskine3e561302022-04-14 00:17:15 +02007080 /* PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() is in general an upper bound
7081 * for the output size. The PSA specification only guarantees that this
7082 * function works if output_size >= PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE(...),
7083 * but it might be nice to allow smaller buffers if the output fits.
7084 * At the time of writing this comment, with only ECDH implemented,
7085 * PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() is exact so the point is moot.
7086 * If FFDH is implemented, PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() can easily
7087 * be exact for it as well. */
7088 size_t expected_length =
Gilles Peskine449bd832023-01-11 14:50:10 +01007089 PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE(slot->attr.type, slot->attr.bits);
7090 if (output_size < expected_length) {
Gilles Peskine3e561302022-04-14 00:17:15 +02007091 status = PSA_ERROR_BUFFER_TOO_SMALL;
7092 goto exit;
7093 }
7094
Gilles Peskine449bd832023-01-11 14:50:10 +01007095 status = psa_key_agreement_raw_internal(alg, slot,
7096 peer_key, peer_key_length,
7097 output, output_size,
7098 output_length);
Gilles Peskine0216fe12019-04-11 21:23:21 +02007099
7100exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01007101 if (status != PSA_SUCCESS) {
Gilles Peskine0216fe12019-04-11 21:23:21 +02007102 /* If an error happens and is not handled properly, the output
7103 * may be used as a key to protect sensitive data. Arrange for such
7104 * a key to be random, which is likely to result in decryption or
7105 * verification errors. This is better than filling the buffer with
7106 * some constant data such as zeros, which would result in the data
7107 * being protected with a reproducible, easily knowable key.
7108 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007109 psa_generate_random(output, output_size);
Gilles Peskine0216fe12019-04-11 21:23:21 +02007110 *output_length = output_size;
7111 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02007112
Gilles Peskine449bd832023-01-11 14:50:10 +01007113 unlock_status = psa_unlock_key_slot(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02007114
Gilles Peskine449bd832023-01-11 14:50:10 +01007115 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine0216fe12019-04-11 21:23:21 +02007116}
Gilles Peskine86a440b2018-11-12 18:39:40 +01007117
7118
Gilles Peskine30524eb2020-11-13 17:02:26 +01007119
Gilles Peskine86a440b2018-11-12 18:39:40 +01007120/****************************************************************/
7121/* Random generation */
Gilles Peskine53d991e2018-07-12 01:14:59 +02007122/****************************************************************/
Gilles Peskine12313cd2018-06-20 00:20:32 +02007123
Gilles Peskine30524eb2020-11-13 17:02:26 +01007124/** Initialize the PSA random generator.
7125 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007126static void mbedtls_psa_random_init(mbedtls_psa_random_context_t *rng)
Gilles Peskine30524eb2020-11-13 17:02:26 +01007127{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007128#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
Gilles Peskine449bd832023-01-11 14:50:10 +01007129 memset(rng, 0, sizeof(*rng));
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007130#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
7131
Gilles Peskine30524eb2020-11-13 17:02:26 +01007132 /* Set default configuration if
7133 * mbedtls_psa_crypto_configure_entropy_sources() hasn't been called. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007134 if (rng->entropy_init == NULL) {
Gilles Peskine30524eb2020-11-13 17:02:26 +01007135 rng->entropy_init = mbedtls_entropy_init;
Gilles Peskine449bd832023-01-11 14:50:10 +01007136 }
7137 if (rng->entropy_free == NULL) {
Gilles Peskine30524eb2020-11-13 17:02:26 +01007138 rng->entropy_free = mbedtls_entropy_free;
Gilles Peskine449bd832023-01-11 14:50:10 +01007139 }
Gilles Peskine30524eb2020-11-13 17:02:26 +01007140
Gilles Peskine449bd832023-01-11 14:50:10 +01007141 rng->entropy_init(&rng->entropy);
Gilles Peskine30524eb2020-11-13 17:02:26 +01007142#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \
7143 defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES)
7144 /* The PSA entropy injection feature depends on using NV seed as an entropy
7145 * source. Add NV seed as an entropy source for PSA entropy injection. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007146 mbedtls_entropy_add_source(&rng->entropy,
7147 mbedtls_nv_seed_poll, NULL,
7148 MBEDTLS_ENTROPY_BLOCK_SIZE,
7149 MBEDTLS_ENTROPY_SOURCE_STRONG);
Gilles Peskine30524eb2020-11-13 17:02:26 +01007150#endif
7151
Gilles Peskine449bd832023-01-11 14:50:10 +01007152 mbedtls_psa_drbg_init(MBEDTLS_PSA_RANDOM_STATE);
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007153#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01007154}
7155
7156/** Deinitialize the PSA random generator.
7157 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007158static void mbedtls_psa_random_free(mbedtls_psa_random_context_t *rng)
Gilles Peskine30524eb2020-11-13 17:02:26 +01007159{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007160#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
Gilles Peskine449bd832023-01-11 14:50:10 +01007161 memset(rng, 0, sizeof(*rng));
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007162#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine449bd832023-01-11 14:50:10 +01007163 mbedtls_psa_drbg_free(MBEDTLS_PSA_RANDOM_STATE);
7164 rng->entropy_free(&rng->entropy);
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007165#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01007166}
7167
7168/** Seed the PSA random generator.
7169 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007170static psa_status_t mbedtls_psa_random_seed(mbedtls_psa_random_context_t *rng)
Gilles Peskine30524eb2020-11-13 17:02:26 +01007171{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007172#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
7173 /* Do nothing: the external RNG seeds itself. */
7174 (void) rng;
Gilles Peskine449bd832023-01-11 14:50:10 +01007175 return PSA_SUCCESS;
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007176#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01007177 const unsigned char drbg_seed[] = "PSA";
Gilles Peskine449bd832023-01-11 14:50:10 +01007178 int ret = mbedtls_psa_drbg_seed(&rng->entropy,
7179 drbg_seed, sizeof(drbg_seed) - 1);
7180 return mbedtls_to_psa_error(ret);
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007181#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01007182}
7183
Gilles Peskine449bd832023-01-11 14:50:10 +01007184psa_status_t psa_generate_random(uint8_t *output,
7185 size_t output_size)
Gilles Peskinee59236f2018-01-27 23:32:46 +01007186{
Gilles Peskinee59236f2018-01-27 23:32:46 +01007187 GUARD_MODULE_INITIALIZED;
7188
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007189#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
7190
7191 size_t output_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01007192 psa_status_t status = mbedtls_psa_external_get_random(&global_data.rng,
7193 output, output_size,
7194 &output_length);
7195 if (status != PSA_SUCCESS) {
7196 return status;
7197 }
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007198 /* Breaking up a request into smaller chunks is currently not supported
Tom Cosgrove1797b052022-12-04 17:19:59 +00007199 * for the external RNG interface. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007200 if (output_length != output_size) {
7201 return PSA_ERROR_INSUFFICIENT_ENTROPY;
7202 }
7203 return PSA_SUCCESS;
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007204
7205#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
7206
Gilles Peskine449bd832023-01-11 14:50:10 +01007207 while (output_size > 0) {
Gilles Peskine71ddab92021-01-04 21:01:07 +01007208 size_t request_size =
Gilles Peskine449bd832023-01-11 14:50:10 +01007209 (output_size > MBEDTLS_PSA_RANDOM_MAX_REQUEST ?
7210 MBEDTLS_PSA_RANDOM_MAX_REQUEST :
7211 output_size);
7212 int ret = mbedtls_psa_get_random(MBEDTLS_PSA_RANDOM_STATE,
7213 output, request_size);
7214 if (ret != 0) {
7215 return mbedtls_to_psa_error(ret);
7216 }
Gilles Peskine71ddab92021-01-04 21:01:07 +01007217 output_size -= request_size;
7218 output += request_size;
Gilles Peskinef181eca2019-08-07 13:49:00 +02007219 }
Gilles Peskine449bd832023-01-11 14:50:10 +01007220 return PSA_SUCCESS;
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007221#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskinee59236f2018-01-27 23:32:46 +01007222}
7223
Gilles Peskine8814fc42020-12-14 15:33:44 +01007224/* Wrapper function allowing the classic API to use the PSA RNG.
Gilles Peskine9c3e0602021-01-05 16:03:55 +01007225 *
7226 * `mbedtls_psa_get_random(MBEDTLS_PSA_RANDOM_STATE, ...)` calls
7227 * `psa_generate_random(...)`. The state parameter is ignored since the
7228 * PSA API doesn't support passing an explicit state.
7229 *
7230 * In the non-external case, psa_generate_random() calls an
7231 * `mbedtls_xxx_drbg_random` function which has exactly the same signature
7232 * and semantics as mbedtls_psa_get_random(). As an optimization,
7233 * instead of doing this back-and-forth between the PSA API and the
7234 * classic API, psa_crypto_random_impl.h defines `mbedtls_psa_get_random`
7235 * as a constant function pointer to `mbedtls_xxx_drbg_random`.
Gilles Peskine8814fc42020-12-14 15:33:44 +01007236 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007237#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
7238int mbedtls_psa_get_random(void *p_rng,
7239 unsigned char *output,
7240 size_t output_size)
Gilles Peskine8814fc42020-12-14 15:33:44 +01007241{
Gilles Peskine9c3e0602021-01-05 16:03:55 +01007242 /* This function takes a pointer to the RNG state because that's what
7243 * classic mbedtls functions using an RNG expect. The PSA RNG manages
7244 * its own state internally and doesn't let the caller access that state.
7245 * So we just ignore the state parameter, and in practice we'll pass
7246 * NULL. */
Gilles Peskine8814fc42020-12-14 15:33:44 +01007247 (void) p_rng;
Gilles Peskine449bd832023-01-11 14:50:10 +01007248 psa_status_t status = psa_generate_random(output, output_size);
7249 if (status == PSA_SUCCESS) {
7250 return 0;
7251 } else {
7252 return MBEDTLS_ERR_ENTROPY_SOURCE_FAILED;
7253 }
Gilles Peskine8814fc42020-12-14 15:33:44 +01007254}
7255#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
7256
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01007257#if defined(MBEDTLS_PSA_INJECT_ENTROPY)
Chris Jonesea0a8652021-03-09 19:11:19 +00007258#include "entropy_poll.h"
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01007259
Gilles Peskine449bd832023-01-11 14:50:10 +01007260psa_status_t mbedtls_psa_inject_entropy(const uint8_t *seed,
7261 size_t seed_size)
Netanel Gonen2bcd3122018-11-19 11:53:02 +02007262{
Gilles Peskine449bd832023-01-11 14:50:10 +01007263 if (global_data.initialized) {
7264 return PSA_ERROR_NOT_PERMITTED;
7265 }
Netanel Gonen21f37cb2018-11-19 11:53:55 +02007266
Gilles Peskine449bd832023-01-11 14:50:10 +01007267 if (((seed_size < MBEDTLS_ENTROPY_MIN_PLATFORM) ||
7268 (seed_size < MBEDTLS_ENTROPY_BLOCK_SIZE)) ||
7269 (seed_size > MBEDTLS_ENTROPY_MAX_SEED_SIZE)) {
7270 return PSA_ERROR_INVALID_ARGUMENT;
7271 }
Netanel Gonen21f37cb2018-11-19 11:53:55 +02007272
Gilles Peskine449bd832023-01-11 14:50:10 +01007273 return mbedtls_psa_storage_inject_entropy(seed, seed_size);
Netanel Gonen2bcd3122018-11-19 11:53:02 +02007274}
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01007275#endif /* MBEDTLS_PSA_INJECT_ENTROPY */
Netanel Gonen2bcd3122018-11-19 11:53:02 +02007276
Ronald Cron3772afe2021-02-08 16:10:05 +01007277/** Validate the key type and size for key generation
Ronald Cron01b2aba2020-10-05 09:42:02 +02007278 *
Ronald Cron3772afe2021-02-08 16:10:05 +01007279 * \param type The key type
7280 * \param bits The number of bits of the key
Ronald Cron01b2aba2020-10-05 09:42:02 +02007281 *
7282 * \retval #PSA_SUCCESS
Ronald Cron3772afe2021-02-08 16:10:05 +01007283 * The key type and size are valid.
Ronald Cron01b2aba2020-10-05 09:42:02 +02007284 * \retval #PSA_ERROR_INVALID_ARGUMENT
7285 * The size in bits of the key is not valid.
7286 * \retval #PSA_ERROR_NOT_SUPPORTED
7287 * The type and/or the size in bits of the key or the combination of
7288 * the two is not supported.
7289 */
Ronald Cron3772afe2021-02-08 16:10:05 +01007290static psa_status_t psa_validate_key_type_and_size_for_key_generation(
Gilles Peskine449bd832023-01-11 14:50:10 +01007291 psa_key_type_t type, size_t bits)
Gilles Peskinee59236f2018-01-27 23:32:46 +01007292{
Ronald Cronf3bb7612020-10-02 20:11:59 +02007293 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinee59236f2018-01-27 23:32:46 +01007294
Gilles Peskine449bd832023-01-11 14:50:10 +01007295 if (key_type_is_raw_bytes(type)) {
7296 status = psa_validate_unstructured_key_bit_size(type, bits);
7297 if (status != PSA_SUCCESS) {
7298 return status;
7299 }
7300 } else
Valerio Setti8bb57632023-05-26 13:48:07 +02007301#if defined(MBEDTLS_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_LEGACY)
Gilles Peskine449bd832023-01-11 14:50:10 +01007302 if (PSA_KEY_TYPE_IS_RSA(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
7303 if (bits > PSA_VENDOR_RSA_MAX_KEY_BITS) {
7304 return PSA_ERROR_NOT_SUPPORTED;
7305 }
Steven Cooreman81be2fa2020-07-24 22:04:59 +02007306
Ronald Cron01b2aba2020-10-05 09:42:02 +02007307 /* Accept only byte-aligned keys, for the same reasons as
7308 * in psa_import_rsa_key(). */
Gilles Peskine449bd832023-01-11 14:50:10 +01007309 if (bits % 8 != 0) {
7310 return PSA_ERROR_NOT_SUPPORTED;
7311 }
7312 } else
Valerio Setti8bb57632023-05-26 13:48:07 +02007313#endif /* defined(MBEDTLS_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_LEGACY) */
Ronald Cron01b2aba2020-10-05 09:42:02 +02007314
Valerio Setti8bb57632023-05-26 13:48:07 +02007315#if defined(MBEDTLS_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_LEGACY)
Gilles Peskine449bd832023-01-11 14:50:10 +01007316 if (PSA_KEY_TYPE_IS_ECC(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
Ronald Crond81ab562021-02-16 09:01:16 +01007317 /* To avoid empty block, return successfully here. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007318 return PSA_SUCCESS;
7319 } else
Valerio Setti8bb57632023-05-26 13:48:07 +02007320#endif /* defined(MBEDTLS_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_LEGACY) */
Przemek Stekielfedd1342022-12-01 15:00:02 +01007321
Valerio Setti8bb57632023-05-26 13:48:07 +02007322#if defined(MBEDTLS_PSA_WANT_KEY_TYPE_DH_KEY_PAIR_LEGACY)
Przemek Stekielfedd1342022-12-01 15:00:02 +01007323 if (PSA_KEY_TYPE_IS_DH(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
Przemek Stekield1cf1ba2023-04-27 12:04:21 +02007324 if (psa_is_dh_key_size_valid(bits) == 0) {
Przemek Stekielfedd1342022-12-01 15:00:02 +01007325 return PSA_ERROR_NOT_SUPPORTED;
7326 }
7327 } else
Valerio Setti8bb57632023-05-26 13:48:07 +02007328#endif /* defined(MBEDTLS_PSA_WANT_KEY_TYPE_DH_KEY_PAIR_LEGACY) */
Ronald Cron01b2aba2020-10-05 09:42:02 +02007329 {
Gilles Peskine449bd832023-01-11 14:50:10 +01007330 return PSA_ERROR_NOT_SUPPORTED;
Ronald Cron01b2aba2020-10-05 09:42:02 +02007331 }
7332
Gilles Peskine449bd832023-01-11 14:50:10 +01007333 return PSA_SUCCESS;
Ronald Cron01b2aba2020-10-05 09:42:02 +02007334}
7335
Ronald Cron55ed0592020-10-05 10:30:40 +02007336psa_status_t psa_generate_key_internal(
Ronald Cron2a38a6b2020-10-02 20:02:04 +02007337 const psa_key_attributes_t *attributes,
Gilles Peskine449bd832023-01-11 14:50:10 +01007338 uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length)
Ronald Cron01b2aba2020-10-05 09:42:02 +02007339{
7340 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron2a38a6b2020-10-02 20:02:04 +02007341 psa_key_type_t type = attributes->core.type;
Ronald Cron01b2aba2020-10-05 09:42:02 +02007342
Gilles Peskine449bd832023-01-11 14:50:10 +01007343 if ((attributes->domain_parameters == NULL) &&
7344 (attributes->domain_parameters_size != 0)) {
7345 return PSA_ERROR_INVALID_ARGUMENT;
7346 }
Ronald Cron01b2aba2020-10-05 09:42:02 +02007347
Gilles Peskine449bd832023-01-11 14:50:10 +01007348 if (key_type_is_raw_bytes(type)) {
7349 status = psa_generate_random(key_buffer, key_buffer_size);
7350 if (status != PSA_SUCCESS) {
7351 return status;
7352 }
Steven Cooreman81be2fa2020-07-24 22:04:59 +02007353
David Brown12ca5032021-02-11 11:02:00 -07007354#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Gilles Peskine449bd832023-01-11 14:50:10 +01007355 if (type == PSA_KEY_TYPE_DES) {
7356 psa_des_set_key_parity(key_buffer, key_buffer_size);
7357 }
David Brown8107e312021-02-12 08:08:46 -07007358#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */
Gilles Peskine449bd832023-01-11 14:50:10 +01007359 } else
Gilles Peskinee59236f2018-01-27 23:32:46 +01007360
Valerio Setti8bb57632023-05-26 13:48:07 +02007361#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_LEGACY) && \
Jaeden Amero424fa932021-05-14 08:34:32 +01007362 defined(MBEDTLS_GENPRIME)
Gilles Peskine449bd832023-01-11 14:50:10 +01007363 if (type == PSA_KEY_TYPE_RSA_KEY_PAIR) {
7364 return mbedtls_psa_rsa_generate_key(attributes,
7365 key_buffer,
7366 key_buffer_size,
7367 key_buffer_length);
7368 } else
Valerio Setti8bb57632023-05-26 13:48:07 +02007369#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_LEGACY)
Jaeden Amero424fa932021-05-14 08:34:32 +01007370 * defined(MBEDTLS_GENPRIME) */
Gilles Peskinee59236f2018-01-27 23:32:46 +01007371
Valerio Setti8bb57632023-05-26 13:48:07 +02007372#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_LEGACY)
Gilles Peskine449bd832023-01-11 14:50:10 +01007373 if (PSA_KEY_TYPE_IS_ECC(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
7374 return mbedtls_psa_ecp_generate_key(attributes,
7375 key_buffer,
7376 key_buffer_size,
7377 key_buffer_length);
7378 } else
Valerio Setti8bb57632023-05-26 13:48:07 +02007379#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_LEGACY) */
Przemek Stekielfedd1342022-12-01 15:00:02 +01007380
Valerio Setti8bb57632023-05-26 13:48:07 +02007381#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_LEGACY)
Przemek Stekielfedd1342022-12-01 15:00:02 +01007382 if (PSA_KEY_TYPE_IS_DH(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
7383 return mbedtls_psa_ffdh_generate_key(attributes,
7384 key_buffer,
7385 key_buffer_size,
7386 key_buffer_length);
7387 } else
Valerio Setti8bb57632023-05-26 13:48:07 +02007388#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_LEGACY) */
Steven Cooreman29149862020-08-05 15:43:42 +02007389 {
Gilles Peskine449bd832023-01-11 14:50:10 +01007390 (void) key_buffer_length;
7391 return PSA_ERROR_NOT_SUPPORTED;
Steven Cooreman29149862020-08-05 15:43:42 +02007392 }
Gilles Peskinee59236f2018-01-27 23:32:46 +01007393
Gilles Peskine449bd832023-01-11 14:50:10 +01007394 return PSA_SUCCESS;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02007395}
Darryl Green0c6575a2018-11-07 16:05:30 +00007396
Gilles Peskine449bd832023-01-11 14:50:10 +01007397psa_status_t psa_generate_key(const psa_key_attributes_t *attributes,
7398 mbedtls_svc_key_id_t *key)
Gilles Peskineff5f0e72019-04-18 12:53:30 +02007399{
7400 psa_status_t status;
7401 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02007402 psa_se_drv_table_entry_t *driver = NULL;
Ronald Cron2b56bc82020-10-05 10:02:26 +02007403 size_t key_buffer_size;
Gilles Peskine11792082019-08-06 18:36:36 +02007404
Ronald Cron81709fc2020-11-14 12:10:32 +01007405 *key = MBEDTLS_SVC_KEY_ID_INIT;
7406
Gilles Peskine0f84d622019-09-12 19:03:13 +02007407 /* Reject any attempt to create a zero-length key so that we don't
7408 * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007409 if (psa_get_key_bits(attributes) == 0) {
7410 return PSA_ERROR_INVALID_ARGUMENT;
7411 }
Gilles Peskine0f84d622019-09-12 19:03:13 +02007412
Przemyslaw Stekielc0fe8202021-10-07 11:08:56 +02007413 /* Reject any attempt to create a public key. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007414 if (PSA_KEY_TYPE_IS_PUBLIC_KEY(attributes->core.type)) {
7415 return PSA_ERROR_INVALID_ARGUMENT;
7416 }
Przemyslaw Stekielc0fe8202021-10-07 11:08:56 +02007417
Gilles Peskine449bd832023-01-11 14:50:10 +01007418 status = psa_start_key_creation(PSA_KEY_CREATION_GENERATE, attributes,
7419 &slot, &driver);
7420 if (status != PSA_SUCCESS) {
Gilles Peskine11792082019-08-06 18:36:36 +02007421 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007422 }
Gilles Peskine11792082019-08-06 18:36:36 +02007423
Ronald Cron977c2472020-10-13 08:32:21 +02007424 /* In the case of a transparent key or an opaque key stored in local
Archana449608b2021-09-08 15:36:05 +05307425 * storage ( thus not in the case of generating a key in a secure element
7426 * with storage ( MBEDTLS_PSA_CRYPTO_SE_C ) ),we have to allocate a
7427 * buffer to hold the generated key material. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007428 if (slot->key.data == NULL) {
7429 if (PSA_KEY_LIFETIME_GET_LOCATION(attributes->core.lifetime) ==
7430 PSA_KEY_LOCATION_LOCAL_STORAGE) {
Ronald Cron3772afe2021-02-08 16:10:05 +01007431 status = psa_validate_key_type_and_size_for_key_generation(
Gilles Peskine449bd832023-01-11 14:50:10 +01007432 attributes->core.type, attributes->core.bits);
7433 if (status != PSA_SUCCESS) {
Ronald Cron3772afe2021-02-08 16:10:05 +01007434 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007435 }
Ronald Cron3772afe2021-02-08 16:10:05 +01007436
7437 key_buffer_size = PSA_EXPORT_KEY_OUTPUT_SIZE(
Gilles Peskine449bd832023-01-11 14:50:10 +01007438 attributes->core.type,
7439 attributes->core.bits);
7440 } else {
Ronald Cron977c2472020-10-13 08:32:21 +02007441 status = psa_driver_wrapper_get_key_buffer_size(
Gilles Peskine449bd832023-01-11 14:50:10 +01007442 attributes, &key_buffer_size);
7443 if (status != PSA_SUCCESS) {
Ronald Cron3772afe2021-02-08 16:10:05 +01007444 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007445 }
Ronald Cron977c2472020-10-13 08:32:21 +02007446 }
Ronald Cron977c2472020-10-13 08:32:21 +02007447
Gilles Peskine449bd832023-01-11 14:50:10 +01007448 status = psa_allocate_buffer_to_slot(slot, key_buffer_size);
7449 if (status != PSA_SUCCESS) {
Ronald Cron977c2472020-10-13 08:32:21 +02007450 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007451 }
Ronald Cron977c2472020-10-13 08:32:21 +02007452 }
7453
Gilles Peskine449bd832023-01-11 14:50:10 +01007454 status = psa_driver_wrapper_generate_key(attributes,
7455 slot->key.data, slot->key.bytes, &slot->key.bytes);
Gilles Peskine11792082019-08-06 18:36:36 +02007456
Gilles Peskine449bd832023-01-11 14:50:10 +01007457 if (status != PSA_SUCCESS) {
7458 psa_remove_key_data_from_memory(slot);
7459 }
Ronald Cron2b56bc82020-10-05 10:02:26 +02007460
Gilles Peskine11792082019-08-06 18:36:36 +02007461exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01007462 if (status == PSA_SUCCESS) {
7463 status = psa_finish_key_creation(slot, driver, key);
7464 }
7465 if (status != PSA_SUCCESS) {
7466 psa_fail_key_creation(slot, driver);
7467 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02007468
Gilles Peskine449bd832023-01-11 14:50:10 +01007469 return status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01007470}
7471
Gilles Peskinee59236f2018-01-27 23:32:46 +01007472/****************************************************************/
7473/* Module setup */
7474/****************************************************************/
7475
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007476#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
Gilles Peskine5e769522018-11-20 21:59:56 +01007477psa_status_t mbedtls_psa_crypto_configure_entropy_sources(
Gilles Peskine449bd832023-01-11 14:50:10 +01007478 void (* entropy_init)(mbedtls_entropy_context *ctx),
7479 void (* entropy_free)(mbedtls_entropy_context *ctx))
Gilles Peskine5e769522018-11-20 21:59:56 +01007480{
Gilles Peskine449bd832023-01-11 14:50:10 +01007481 if (global_data.rng_state != RNG_NOT_INITIALIZED) {
7482 return PSA_ERROR_BAD_STATE;
7483 }
Gilles Peskine30524eb2020-11-13 17:02:26 +01007484 global_data.rng.entropy_init = entropy_init;
7485 global_data.rng.entropy_free = entropy_free;
Gilles Peskine449bd832023-01-11 14:50:10 +01007486 return PSA_SUCCESS;
Gilles Peskine5e769522018-11-20 21:59:56 +01007487}
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007488#endif /* !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) */
Gilles Peskine5e769522018-11-20 21:59:56 +01007489
Gilles Peskine449bd832023-01-11 14:50:10 +01007490void mbedtls_psa_crypto_free(void)
Gilles Peskinee59236f2018-01-27 23:32:46 +01007491{
Gilles Peskine449bd832023-01-11 14:50:10 +01007492 psa_wipe_all_key_slots();
7493 if (global_data.rng_state != RNG_NOT_INITIALIZED) {
7494 mbedtls_psa_random_free(&global_data.rng);
Gilles Peskinec6b69072018-11-20 21:42:52 +01007495 }
7496 /* Wipe all remaining data, including configuration.
7497 * In particular, this sets all state indicator to the value
7498 * indicating "uninitialized". */
Gilles Peskine449bd832023-01-11 14:50:10 +01007499 mbedtls_platform_zeroize(&global_data, sizeof(global_data));
Ronald Cron9ba76912021-04-10 16:57:30 +02007500
7501 /* Terminate drivers */
Gilles Peskine449bd832023-01-11 14:50:10 +01007502 psa_driver_wrapper_free();
Gilles Peskinee59236f2018-01-27 23:32:46 +01007503}
7504
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02007505#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
7506/** Recover a transaction that was interrupted by a power failure.
7507 *
7508 * This function is called during initialization, before psa_crypto_init()
7509 * returns. If this function returns a failure status, the initialization
7510 * fails.
7511 */
7512static psa_status_t psa_crypto_recover_transaction(
Gilles Peskine449bd832023-01-11 14:50:10 +01007513 const psa_crypto_transaction_t *transaction)
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02007514{
Gilles Peskine449bd832023-01-11 14:50:10 +01007515 switch (transaction->unknown.type) {
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02007516 case PSA_CRYPTO_TRANSACTION_CREATE_KEY:
7517 case PSA_CRYPTO_TRANSACTION_DESTROY_KEY:
Gilles Peskine449bd832023-01-11 14:50:10 +01007518 /* TODO - fall through to the failure case until this
7519 * is implemented.
7520 * https://github.com/ARMmbed/mbed-crypto/issues/218
7521 */
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02007522 default:
7523 /* We found an unsupported transaction in the storage.
7524 * We don't know what state the storage is in. Give up. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007525 return PSA_ERROR_DATA_INVALID;
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02007526 }
7527}
7528#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
7529
Gilles Peskine449bd832023-01-11 14:50:10 +01007530psa_status_t psa_crypto_init(void)
Gilles Peskinee59236f2018-01-27 23:32:46 +01007531{
Gilles Peskine66fb1262018-12-10 16:29:04 +01007532 psa_status_t status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01007533
Gilles Peskinec6b69072018-11-20 21:42:52 +01007534 /* Double initialization is explicitly allowed. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007535 if (global_data.initialized != 0) {
7536 return PSA_SUCCESS;
7537 }
Gilles Peskinee59236f2018-01-27 23:32:46 +01007538
Manuel Pégourié-Gonnard7abdf7e2023-03-09 11:17:43 +01007539 /* Init drivers */
7540 status = psa_driver_wrapper_init();
7541 if (status != PSA_SUCCESS) {
7542 goto exit;
7543 }
7544 global_data.drivers_initialized = 1;
7545
Gilles Peskine30524eb2020-11-13 17:02:26 +01007546 /* Initialize and seed the random generator. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007547 mbedtls_psa_random_init(&global_data.rng);
Gilles Peskinec6b69072018-11-20 21:42:52 +01007548 global_data.rng_state = RNG_INITIALIZED;
Gilles Peskine449bd832023-01-11 14:50:10 +01007549 status = mbedtls_psa_random_seed(&global_data.rng);
7550 if (status != PSA_SUCCESS) {
Gilles Peskinee59236f2018-01-27 23:32:46 +01007551 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007552 }
Gilles Peskinec6b69072018-11-20 21:42:52 +01007553 global_data.rng_state = RNG_SEEDED;
Gilles Peskinee59236f2018-01-27 23:32:46 +01007554
Gilles Peskine449bd832023-01-11 14:50:10 +01007555 status = psa_initialize_key_slots();
7556 if (status != PSA_SUCCESS) {
Gilles Peskine66fb1262018-12-10 16:29:04 +01007557 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007558 }
Gilles Peskinec6b69072018-11-20 21:42:52 +01007559
Gilles Peskine4b734222019-07-24 15:56:31 +02007560#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
Gilles Peskine449bd832023-01-11 14:50:10 +01007561 status = psa_crypto_load_transaction();
7562 if (status == PSA_SUCCESS) {
7563 status = psa_crypto_recover_transaction(&psa_crypto_transaction);
7564 if (status != PSA_SUCCESS) {
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02007565 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007566 }
7567 status = psa_crypto_stop_transaction();
7568 } else if (status == PSA_ERROR_DOES_NOT_EXIST) {
Gilles Peskinefc762652019-07-22 19:30:34 +02007569 /* There's no transaction to complete. It's all good. */
7570 status = PSA_SUCCESS;
7571 }
Gilles Peskine4b734222019-07-24 15:56:31 +02007572#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
Gilles Peskinefc762652019-07-22 19:30:34 +02007573
Gilles Peskinec6b69072018-11-20 21:42:52 +01007574 /* All done. */
Gilles Peskinee59236f2018-01-27 23:32:46 +01007575 global_data.initialized = 1;
7576
7577exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01007578 if (status != PSA_SUCCESS) {
7579 mbedtls_psa_crypto_free();
7580 }
7581 return status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01007582}
7583
Przemek Stekielca8d2b22023-01-17 16:21:33 +01007584psa_status_t psa_crypto_driver_pake_get_password_len(
7585 const psa_crypto_driver_pake_inputs_t *inputs,
7586 size_t *password_len)
7587{
7588 if (inputs->password_len == 0) {
7589 return PSA_ERROR_BAD_STATE;
7590 }
7591
7592 *password_len = inputs->password_len;
7593
7594 return PSA_SUCCESS;
7595}
7596
7597psa_status_t psa_crypto_driver_pake_get_password(
7598 const psa_crypto_driver_pake_inputs_t *inputs,
7599 uint8_t *buffer, size_t buffer_size, size_t *buffer_length)
7600{
7601 if (inputs->password_len == 0) {
7602 return PSA_ERROR_BAD_STATE;
7603 }
7604
7605 if (buffer_size < inputs->password_len) {
7606 return PSA_ERROR_BUFFER_TOO_SMALL;
7607 }
7608
7609 memcpy(buffer, inputs->password, inputs->password_len);
7610 *buffer_length = inputs->password_len;
7611
7612 return PSA_SUCCESS;
7613}
7614
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007615psa_status_t psa_crypto_driver_pake_get_user_len(
7616 const psa_crypto_driver_pake_inputs_t *inputs,
7617 size_t *user_len)
7618{
7619 if (inputs->user_len == 0) {
7620 return PSA_ERROR_BAD_STATE;
7621 }
7622
7623 *user_len = inputs->user_len;
7624
7625 return PSA_SUCCESS;
7626}
7627
7628psa_status_t psa_crypto_driver_pake_get_user(
7629 const psa_crypto_driver_pake_inputs_t *inputs,
Przemek Stekielc0e62502023-03-14 11:49:36 +01007630 uint8_t *user_id, size_t user_id_size, size_t *user_id_len)
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007631{
7632 if (inputs->user_len == 0) {
7633 return PSA_ERROR_BAD_STATE;
7634 }
7635
Przemek Stekielc0e62502023-03-14 11:49:36 +01007636 if (user_id_size < inputs->user_len) {
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007637 return PSA_ERROR_BUFFER_TOO_SMALL;
7638 }
7639
Przemek Stekielc0e62502023-03-14 11:49:36 +01007640 memcpy(user_id, inputs->user, inputs->user_len);
7641 *user_id_len = inputs->user_len;
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007642
7643 return PSA_SUCCESS;
7644}
7645
7646psa_status_t psa_crypto_driver_pake_get_peer_len(
7647 const psa_crypto_driver_pake_inputs_t *inputs,
7648 size_t *peer_len)
7649{
7650 if (inputs->peer_len == 0) {
7651 return PSA_ERROR_BAD_STATE;
7652 }
7653
7654 *peer_len = inputs->peer_len;
7655
7656 return PSA_SUCCESS;
7657}
7658
7659psa_status_t psa_crypto_driver_pake_get_peer(
7660 const psa_crypto_driver_pake_inputs_t *inputs,
Przemek Stekielc0e62502023-03-14 11:49:36 +01007661 uint8_t *peer_id, size_t peer_id_size, size_t *peer_id_length)
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007662{
7663 if (inputs->peer_len == 0) {
7664 return PSA_ERROR_BAD_STATE;
7665 }
7666
Przemek Stekielc0e62502023-03-14 11:49:36 +01007667 if (peer_id_size < inputs->peer_len) {
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007668 return PSA_ERROR_BUFFER_TOO_SMALL;
7669 }
7670
Przemek Stekielc0e62502023-03-14 11:49:36 +01007671 memcpy(peer_id, inputs->peer, inputs->peer_len);
7672 *peer_id_length = inputs->peer_len;
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007673
7674 return PSA_SUCCESS;
7675}
7676
Przemek Stekielca8d2b22023-01-17 16:21:33 +01007677psa_status_t psa_crypto_driver_pake_get_cipher_suite(
7678 const psa_crypto_driver_pake_inputs_t *inputs,
7679 psa_pake_cipher_suite_t *cipher_suite)
7680{
7681 if (inputs->cipher_suite.algorithm == PSA_ALG_NONE) {
7682 return PSA_ERROR_BAD_STATE;
7683 }
7684
7685 *cipher_suite = inputs->cipher_suite;
7686
7687 return PSA_SUCCESS;
7688}
7689
Tom Cosgrove6d62fac2023-05-10 14:40:05 +01007690#if defined(PSA_WANT_ALG_SOME_PAKE)
Neil Armstronga7d08c32022-06-01 18:21:20 +02007691psa_status_t psa_pake_setup(
7692 psa_pake_operation_t *operation,
7693 const psa_pake_cipher_suite_t *cipher_suite)
7694{
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007695 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007696
Przemek Stekiel1c3cfb42023-01-26 10:35:02 +01007697 if (operation->stage != PSA_PAKE_OPERATION_STAGE_SETUP) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007698 status = PSA_ERROR_BAD_STATE;
7699 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007700 }
7701
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01007702 if (PSA_ALG_IS_PAKE(cipher_suite->algorithm) == 0 ||
Przemek Stekiel51eac532022-12-07 11:04:51 +01007703 PSA_ALG_IS_HASH(cipher_suite->hash) == 0) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007704 status = PSA_ERROR_INVALID_ARGUMENT;
7705 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007706 }
7707
Przemek Stekiel51eac532022-12-07 11:04:51 +01007708 memset(&operation->data.inputs, 0, sizeof(operation->data.inputs));
7709
Przemek Stekiele12ed362022-12-21 12:54:46 +01007710 operation->alg = cipher_suite->algorithm;
Przemek Stekiel656b2592023-03-22 13:15:33 +01007711 operation->primitive = PSA_PAKE_PRIMITIVE(cipher_suite->type,
7712 cipher_suite->family, cipher_suite->bits);
Przemek Stekiel51eac532022-12-07 11:04:51 +01007713 operation->data.inputs.cipher_suite = *cipher_suite;
7714
Przemek Stekiel4aa99402023-02-27 13:00:57 +01007715#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01007716 if (operation->alg == PSA_ALG_JPAKE) {
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01007717 psa_jpake_computation_stage_t *computation_stage =
Przemek Stekieldde6a912023-01-26 08:46:37 +01007718 &operation->computation_stage.jpake;
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01007719
Przemek Stekiele12ed362022-12-21 12:54:46 +01007720 computation_stage->state = PSA_PAKE_STATE_SETUP;
7721 computation_stage->sequence = PSA_PAKE_SEQ_INVALID;
7722 computation_stage->input_step = PSA_PAKE_STEP_X1_X2;
7723 computation_stage->output_step = PSA_PAKE_STEP_X1_X2;
Przemek Stekiel80a88492023-02-20 13:32:22 +01007724 } else
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007725#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiel80a88492023-02-20 13:32:22 +01007726 {
7727 status = PSA_ERROR_NOT_SUPPORTED;
7728 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01007729 }
7730
Przemek Stekiel1c3cfb42023-01-26 10:35:02 +01007731 operation->stage = PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS;
7732
Przemek Stekiel51eac532022-12-07 11:04:51 +01007733 return PSA_SUCCESS;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007734exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007735 psa_pake_abort(operation);
7736 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02007737}
7738
7739psa_status_t psa_pake_set_password_key(
7740 psa_pake_operation_t *operation,
7741 mbedtls_svc_key_id_t password)
7742{
Neil Armstrong5ae60962022-09-15 11:29:46 +02007743 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel6c764412022-11-22 14:05:12 +01007744 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
7745 psa_key_slot_t *slot = NULL;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007746
Przemek Stekiel51eac532022-12-07 11:04:51 +01007747 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007748 status = PSA_ERROR_BAD_STATE;
7749 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007750 }
7751
Przemek Stekiel6c764412022-11-22 14:05:12 +01007752 status = psa_get_and_lock_key_slot_with_policy(password, &slot,
7753 PSA_KEY_USAGE_DERIVE,
Przemek Stekield5d28a22023-01-26 10:46:05 +01007754 operation->alg);
Neil Armstrong5ae60962022-09-15 11:29:46 +02007755 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007756 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007757 }
7758
Przemek Stekiel6c764412022-11-22 14:05:12 +01007759 psa_key_attributes_t attributes = {
7760 .core = slot->attr
7761 };
Neil Armstrong5ae60962022-09-15 11:29:46 +02007762
Przemek Stekiel51eac532022-12-07 11:04:51 +01007763 psa_key_type_t type = psa_get_key_type(&attributes);
Neil Armstrong5ae60962022-09-15 11:29:46 +02007764
Przemek Stekiel51eac532022-12-07 11:04:51 +01007765 if (type != PSA_KEY_TYPE_PASSWORD &&
7766 type != PSA_KEY_TYPE_PASSWORD_HASH) {
7767 status = PSA_ERROR_INVALID_ARGUMENT;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007768 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007769 }
7770
Przemek Stekiel51eac532022-12-07 11:04:51 +01007771 operation->data.inputs.password = mbedtls_calloc(1, slot->key.bytes);
7772 if (operation->data.inputs.password == NULL) {
Przemek Stekiele12ed362022-12-21 12:54:46 +01007773 status = PSA_ERROR_INSUFFICIENT_MEMORY;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007774 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007775 }
7776
7777 memcpy(operation->data.inputs.password, slot->key.data, slot->key.bytes);
7778 operation->data.inputs.password_len = slot->key.bytes;
Przemek Stekiel9dd24402023-01-26 15:06:09 +01007779 operation->data.inputs.attributes = attributes;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007780exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007781 if (status != PSA_SUCCESS) {
7782 psa_pake_abort(operation);
7783 }
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007784 unlock_status = psa_unlock_key_slot(slot);
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007785 return (status == PSA_SUCCESS) ? unlock_status : status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02007786}
7787
7788psa_status_t psa_pake_set_user(
7789 psa_pake_operation_t *operation,
7790 const uint8_t *user_id,
7791 size_t user_id_len)
7792{
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007793 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007794
7795 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007796 status = PSA_ERROR_BAD_STATE;
7797 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007798 }
7799
Przemek Stekiel51eac532022-12-07 11:04:51 +01007800 if (user_id_len == 0) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007801 status = PSA_ERROR_INVALID_ARGUMENT;
7802 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007803 }
7804
Przemek Stekielf309d6b2023-03-10 09:54:45 +01007805 if (operation->data.inputs.user_len != 0) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007806 status = PSA_ERROR_BAD_STATE;
7807 goto exit;
7808 }
7809
Przemek Stekielf309d6b2023-03-10 09:54:45 +01007810 operation->data.inputs.user = mbedtls_calloc(1, user_id_len);
7811 if (operation->data.inputs.user == NULL) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007812 status = PSA_ERROR_INSUFFICIENT_MEMORY;
7813 goto exit;
7814 }
7815
Przemek Stekielf309d6b2023-03-10 09:54:45 +01007816 memcpy(operation->data.inputs.user, user_id, user_id_len);
7817 operation->data.inputs.user_len = user_id_len;
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007818
7819 return PSA_SUCCESS;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007820exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007821 psa_pake_abort(operation);
7822 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02007823}
7824
7825psa_status_t psa_pake_set_peer(
7826 psa_pake_operation_t *operation,
7827 const uint8_t *peer_id,
7828 size_t peer_id_len)
7829{
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007830 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007831
7832 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007833 status = PSA_ERROR_BAD_STATE;
7834 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007835 }
7836
Przemek Stekiel51eac532022-12-07 11:04:51 +01007837 if (peer_id_len == 0) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007838 status = PSA_ERROR_INVALID_ARGUMENT;
7839 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007840 }
7841
Przemek Stekielf309d6b2023-03-10 09:54:45 +01007842 if (operation->data.inputs.peer_len != 0) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007843 status = PSA_ERROR_BAD_STATE;
7844 goto exit;
7845 }
7846
Przemek Stekielf309d6b2023-03-10 09:54:45 +01007847 operation->data.inputs.peer = mbedtls_calloc(1, peer_id_len);
7848 if (operation->data.inputs.peer == NULL) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007849 status = PSA_ERROR_INSUFFICIENT_MEMORY;
7850 goto exit;
7851 }
7852
Przemek Stekielf309d6b2023-03-10 09:54:45 +01007853 memcpy(operation->data.inputs.peer, peer_id, peer_id_len);
7854 operation->data.inputs.peer_len = peer_id_len;
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007855
7856 return PSA_SUCCESS;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007857exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007858 psa_pake_abort(operation);
7859 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02007860}
7861
7862psa_status_t psa_pake_set_role(
7863 psa_pake_operation_t *operation,
7864 psa_pake_role_t role)
7865{
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007866 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007867
Przemek Stekiel51eac532022-12-07 11:04:51 +01007868 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007869 status = PSA_ERROR_BAD_STATE;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007870 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007871 }
7872
Przemek Stekiel09104b82023-03-06 14:11:51 +01007873 switch (operation->alg) {
7874#if defined(PSA_WANT_ALG_JPAKE)
7875 case PSA_ALG_JPAKE:
7876 if (role == PSA_PAKE_ROLE_NONE) {
7877 return PSA_SUCCESS;
7878 }
7879 status = PSA_ERROR_INVALID_ARGUMENT;
7880 break;
7881#endif
7882 default:
7883 (void) role;
7884 status = PSA_ERROR_NOT_SUPPORTED;
7885 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007886 }
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007887exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007888 psa_pake_abort(operation);
7889 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02007890}
7891
Przemek Stekielb09c4872023-01-17 12:05:38 +01007892/* Auxiliary function to convert core computation stage(step, sequence, state) to single driver step. */
Przemek Stekiel4aa99402023-02-27 13:00:57 +01007893#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiel251e86a2023-02-17 14:30:50 +01007894static psa_crypto_driver_pake_step_t convert_jpake_computation_stage_to_driver_step(
Przemek Stekieldde6a912023-01-26 08:46:37 +01007895 psa_jpake_computation_stage_t *stage)
Przemek Stekielb09c4872023-01-17 12:05:38 +01007896{
Przemek Stekieldde6a912023-01-26 08:46:37 +01007897 switch (stage->state) {
Przemek Stekielb09c4872023-01-17 12:05:38 +01007898 case PSA_PAKE_OUTPUT_X1_X2:
7899 case PSA_PAKE_INPUT_X1_X2:
Przemek Stekieldde6a912023-01-26 08:46:37 +01007900 switch (stage->sequence) {
Przemek Stekielb09c4872023-01-17 12:05:38 +01007901 case PSA_PAKE_X1_STEP_KEY_SHARE:
7902 return PSA_JPAKE_X1_STEP_KEY_SHARE;
Przemek Stekielb09c4872023-01-17 12:05:38 +01007903 case PSA_PAKE_X1_STEP_ZK_PUBLIC:
7904 return PSA_JPAKE_X1_STEP_ZK_PUBLIC;
Przemek Stekielb09c4872023-01-17 12:05:38 +01007905 case PSA_PAKE_X1_STEP_ZK_PROOF:
7906 return PSA_JPAKE_X1_STEP_ZK_PROOF;
Przemek Stekielb09c4872023-01-17 12:05:38 +01007907 case PSA_PAKE_X2_STEP_KEY_SHARE:
7908 return PSA_JPAKE_X2_STEP_KEY_SHARE;
Przemek Stekielb09c4872023-01-17 12:05:38 +01007909 case PSA_PAKE_X2_STEP_ZK_PUBLIC:
7910 return PSA_JPAKE_X2_STEP_ZK_PUBLIC;
Przemek Stekielb09c4872023-01-17 12:05:38 +01007911 case PSA_PAKE_X2_STEP_ZK_PROOF:
7912 return PSA_JPAKE_X2_STEP_ZK_PROOF;
Przemek Stekielb09c4872023-01-17 12:05:38 +01007913 default:
7914 return PSA_JPAKE_STEP_INVALID;
7915 }
7916 break;
7917 case PSA_PAKE_OUTPUT_X2S:
Przemek Stekieldde6a912023-01-26 08:46:37 +01007918 switch (stage->sequence) {
Przemek Stekielb09c4872023-01-17 12:05:38 +01007919 case PSA_PAKE_X1_STEP_KEY_SHARE:
7920 return PSA_JPAKE_X2S_STEP_KEY_SHARE;
Przemek Stekielb09c4872023-01-17 12:05:38 +01007921 case PSA_PAKE_X1_STEP_ZK_PUBLIC:
7922 return PSA_JPAKE_X2S_STEP_ZK_PUBLIC;
Przemek Stekielb09c4872023-01-17 12:05:38 +01007923 case PSA_PAKE_X1_STEP_ZK_PROOF:
7924 return PSA_JPAKE_X2S_STEP_ZK_PROOF;
Przemek Stekiel57580f22023-03-01 12:21:26 +01007925 default:
Przemek Stekielb09c4872023-01-17 12:05:38 +01007926 return PSA_JPAKE_STEP_INVALID;
7927 }
7928 break;
7929 case PSA_PAKE_INPUT_X4S:
Przemek Stekieldde6a912023-01-26 08:46:37 +01007930 switch (stage->sequence) {
Przemek Stekielb09c4872023-01-17 12:05:38 +01007931 case PSA_PAKE_X1_STEP_KEY_SHARE:
7932 return PSA_JPAKE_X4S_STEP_KEY_SHARE;
Przemek Stekielb09c4872023-01-17 12:05:38 +01007933 case PSA_PAKE_X1_STEP_ZK_PUBLIC:
7934 return PSA_JPAKE_X4S_STEP_ZK_PUBLIC;
Przemek Stekielb09c4872023-01-17 12:05:38 +01007935 case PSA_PAKE_X1_STEP_ZK_PROOF:
7936 return PSA_JPAKE_X4S_STEP_ZK_PROOF;
Przemek Stekiel57580f22023-03-01 12:21:26 +01007937 default:
Przemek Stekielb09c4872023-01-17 12:05:38 +01007938 return PSA_JPAKE_STEP_INVALID;
7939 }
7940 break;
7941 default:
7942 return PSA_JPAKE_STEP_INVALID;
7943 }
7944 return PSA_JPAKE_STEP_INVALID;
7945}
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007946#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekielb09c4872023-01-17 12:05:38 +01007947
Przemek Stekiel2797d372022-12-22 11:19:22 +01007948static psa_status_t psa_pake_complete_inputs(
7949 psa_pake_operation_t *operation)
7950{
Przemek Stekiel2797d372022-12-22 11:19:22 +01007951 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel18620a32023-01-17 16:34:52 +01007952 /* Create copy of the inputs on stack as inputs share memory
7953 with the driver context which will be setup by the driver. */
7954 psa_crypto_driver_pake_inputs_t inputs = operation->data.inputs;
Przemek Stekiel2797d372022-12-22 11:19:22 +01007955
Przemek Stekielfde11282023-03-13 16:06:09 +01007956 if (inputs.password_len == 0) {
Przemek Stekiel2797d372022-12-22 11:19:22 +01007957 return PSA_ERROR_BAD_STATE;
7958 }
7959
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007960 if (operation->alg == PSA_ALG_JPAKE) {
Przemek Stekielfde11282023-03-13 16:06:09 +01007961 if (inputs.user_len == 0 || inputs.peer_len == 0) {
7962 return PSA_ERROR_BAD_STATE;
7963 }
Przemek Stekieldff21d32023-02-14 20:09:10 +01007964 }
7965
Przemek Stekiel18620a32023-01-17 16:34:52 +01007966 /* Clear driver context */
7967 mbedtls_platform_zeroize(&operation->data, sizeof(operation->data));
7968
7969 status = psa_driver_wrapper_pake_setup(operation, &inputs);
Przemek Stekiel2797d372022-12-22 11:19:22 +01007970
7971 /* Driver is responsible for creating its own copy of the password. */
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01007972 mbedtls_platform_zeroize(inputs.password, inputs.password_len);
7973 mbedtls_free(inputs.password);
Przemek Stekiel2797d372022-12-22 11:19:22 +01007974
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007975 /* User and peer are translated to role. */
7976 mbedtls_free(inputs.user);
7977 mbedtls_free(inputs.peer);
7978
Przemek Stekiel2797d372022-12-22 11:19:22 +01007979 if (status == PSA_SUCCESS) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01007980#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiel2797d372022-12-22 11:19:22 +01007981 if (operation->alg == PSA_ALG_JPAKE) {
Przemek Stekield93de322023-02-24 08:39:04 +01007982 operation->stage = PSA_PAKE_OPERATION_STAGE_COMPUTATION;
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01007983 psa_jpake_computation_stage_t *computation_stage =
7984 &operation->computation_stage.jpake;
Przemek Stekiel2797d372022-12-22 11:19:22 +01007985 computation_stage->state = PSA_PAKE_STATE_READY;
7986 computation_stage->sequence = PSA_PAKE_SEQ_INVALID;
7987 computation_stage->input_step = PSA_PAKE_STEP_X1_X2;
7988 computation_stage->output_step = PSA_PAKE_STEP_X1_X2;
Przemek Stekiel80a88492023-02-20 13:32:22 +01007989 } else
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007990#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiel80a88492023-02-20 13:32:22 +01007991 {
7992 status = PSA_ERROR_NOT_SUPPORTED;
Przemek Stekiel2797d372022-12-22 11:19:22 +01007993 }
Przemek Stekiel2797d372022-12-22 11:19:22 +01007994 }
Przemek Stekiel2797d372022-12-22 11:19:22 +01007995 return status;
7996}
7997
Przemek Stekiel4aa99402023-02-27 13:00:57 +01007998#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01007999static psa_status_t psa_jpake_output_prologue(
8000 psa_pake_operation_t *operation,
8001 psa_pake_step_t step)
8002{
Przemek Stekiele12ed362022-12-21 12:54:46 +01008003 if (step != PSA_PAKE_STEP_KEY_SHARE &&
8004 step != PSA_PAKE_STEP_ZK_PUBLIC &&
8005 step != PSA_PAKE_STEP_ZK_PROOF) {
8006 return PSA_ERROR_INVALID_ARGUMENT;
8007 }
8008
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008009 psa_jpake_computation_stage_t *computation_stage =
8010 &operation->computation_stage.jpake;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008011
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008012 if (computation_stage->state == PSA_PAKE_STATE_INVALID) {
8013 return PSA_ERROR_BAD_STATE;
8014 }
8015
8016 if (computation_stage->state != PSA_PAKE_STATE_READY &&
8017 computation_stage->state != PSA_PAKE_OUTPUT_X1_X2 &&
8018 computation_stage->state != PSA_PAKE_OUTPUT_X2S) {
8019 return PSA_ERROR_BAD_STATE;
8020 }
8021
8022 if (computation_stage->state == PSA_PAKE_STATE_READY) {
8023 if (step != PSA_PAKE_STEP_KEY_SHARE) {
Przemek Stekiele12ed362022-12-21 12:54:46 +01008024 return PSA_ERROR_BAD_STATE;
8025 }
8026
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008027 switch (computation_stage->output_step) {
8028 case PSA_PAKE_STEP_X1_X2:
8029 computation_stage->state = PSA_PAKE_OUTPUT_X1_X2;
Przemek Stekiel80a88492023-02-20 13:32:22 +01008030 break;
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008031 case PSA_PAKE_STEP_X2S:
8032 computation_stage->state = PSA_PAKE_OUTPUT_X2S;
Przemek Stekiel80a88492023-02-20 13:32:22 +01008033 break;
Przemek Stekiel80a88492023-02-20 13:32:22 +01008034 default:
Przemek Stekiele12ed362022-12-21 12:54:46 +01008035 return PSA_ERROR_BAD_STATE;
Przemek Stekiel80a88492023-02-20 13:32:22 +01008036 }
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008037
8038 computation_stage->sequence = PSA_PAKE_X1_STEP_KEY_SHARE;
8039 }
8040
8041 /* Check if step matches current sequence */
8042 switch (computation_stage->sequence) {
8043 case PSA_PAKE_X1_STEP_KEY_SHARE:
8044 case PSA_PAKE_X2_STEP_KEY_SHARE:
8045 if (step != PSA_PAKE_STEP_KEY_SHARE) {
8046 return PSA_ERROR_BAD_STATE;
8047 }
8048 break;
8049
8050 case PSA_PAKE_X1_STEP_ZK_PUBLIC:
8051 case PSA_PAKE_X2_STEP_ZK_PUBLIC:
8052 if (step != PSA_PAKE_STEP_ZK_PUBLIC) {
8053 return PSA_ERROR_BAD_STATE;
8054 }
8055 break;
8056
8057 case PSA_PAKE_X1_STEP_ZK_PROOF:
8058 case PSA_PAKE_X2_STEP_ZK_PROOF:
8059 if (step != PSA_PAKE_STEP_ZK_PROOF) {
8060 return PSA_ERROR_BAD_STATE;
8061 }
8062 break;
8063
8064 default:
8065 return PSA_ERROR_BAD_STATE;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008066 }
8067
8068 return PSA_SUCCESS;
8069}
8070
8071static psa_status_t psa_jpake_output_epilogue(
8072 psa_pake_operation_t *operation)
8073{
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008074 psa_jpake_computation_stage_t *computation_stage =
8075 &operation->computation_stage.jpake;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008076
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008077 if ((computation_stage->state == PSA_PAKE_OUTPUT_X1_X2 &&
Przemek Stekiel083745e2023-02-23 17:28:23 +01008078 computation_stage->sequence == PSA_PAKE_X2_STEP_ZK_PROOF) ||
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008079 (computation_stage->state == PSA_PAKE_OUTPUT_X2S &&
Przemek Stekiel083745e2023-02-23 17:28:23 +01008080 computation_stage->sequence == PSA_PAKE_X1_STEP_ZK_PROOF)) {
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008081 computation_stage->state = PSA_PAKE_STATE_READY;
8082 computation_stage->output_step++;
8083 computation_stage->sequence = PSA_PAKE_SEQ_INVALID;
8084 } else {
8085 computation_stage->sequence++;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008086 }
8087
8088 return PSA_SUCCESS;
8089}
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008090#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008091
Neil Armstronga7d08c32022-06-01 18:21:20 +02008092psa_status_t psa_pake_output(
8093 psa_pake_operation_t *operation,
8094 psa_pake_step_t step,
8095 uint8_t *output,
8096 size_t output_size,
8097 size_t *output_length)
8098{
Przemek Stekiel51eac532022-12-07 11:04:51 +01008099 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008100 psa_crypto_driver_pake_step_t driver_step = PSA_JPAKE_STEP_INVALID;
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01008101 *output_length = 0;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008102
8103 if (operation->stage == PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel2797d372022-12-22 11:19:22 +01008104 status = psa_pake_complete_inputs(operation);
8105 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008106 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008107 }
8108 }
8109
8110 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COMPUTATION) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008111 status = PSA_ERROR_BAD_STATE;
8112 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008113 }
8114
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01008115 if (output_size == 0) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008116 status = PSA_ERROR_INVALID_ARGUMENT;
8117 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008118 }
8119
Przemek Stekiele12ed362022-12-21 12:54:46 +01008120 switch (operation->alg) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008121#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008122 case PSA_ALG_JPAKE:
8123 status = psa_jpake_output_prologue(operation, step);
8124 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008125 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008126 }
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008127 driver_step = convert_jpake_computation_stage_to_driver_step(
8128 &operation->computation_stage.jpake);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008129 break;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008130#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008131 default:
Przemek Stekiel80a88492023-02-20 13:32:22 +01008132 (void) step;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008133 status = PSA_ERROR_NOT_SUPPORTED;
8134 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008135 }
8136
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008137 status = psa_driver_wrapper_pake_output(operation, driver_step,
8138 output, output_size, output_length);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008139
8140 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008141 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008142 }
8143
8144 switch (operation->alg) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008145#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008146 case PSA_ALG_JPAKE:
8147 status = psa_jpake_output_epilogue(operation);
8148 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008149 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008150 }
8151 break;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008152#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008153 default:
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008154 status = PSA_ERROR_NOT_SUPPORTED;
8155 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008156 }
8157
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008158 return PSA_SUCCESS;
8159exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008160 psa_pake_abort(operation);
8161 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008162}
8163
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008164#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008165static psa_status_t psa_jpake_input_prologue(
8166 psa_pake_operation_t *operation,
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008167 psa_pake_step_t step)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008168{
Przemek Stekiele12ed362022-12-21 12:54:46 +01008169 if (step != PSA_PAKE_STEP_KEY_SHARE &&
8170 step != PSA_PAKE_STEP_ZK_PUBLIC &&
8171 step != PSA_PAKE_STEP_ZK_PROOF) {
8172 return PSA_ERROR_INVALID_ARGUMENT;
8173 }
8174
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008175 psa_jpake_computation_stage_t *computation_stage =
8176 &operation->computation_stage.jpake;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008177
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008178 if (computation_stage->state == PSA_PAKE_STATE_INVALID) {
8179 return PSA_ERROR_BAD_STATE;
8180 }
8181
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008182 if (computation_stage->state != PSA_PAKE_STATE_READY &&
8183 computation_stage->state != PSA_PAKE_INPUT_X1_X2 &&
8184 computation_stage->state != PSA_PAKE_INPUT_X4S) {
8185 return PSA_ERROR_BAD_STATE;
8186 }
8187
8188 if (computation_stage->state == PSA_PAKE_STATE_READY) {
8189 if (step != PSA_PAKE_STEP_KEY_SHARE) {
Przemek Stekiele12ed362022-12-21 12:54:46 +01008190 return PSA_ERROR_BAD_STATE;
8191 }
8192
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008193 switch (computation_stage->input_step) {
8194 case PSA_PAKE_STEP_X1_X2:
8195 computation_stage->state = PSA_PAKE_INPUT_X1_X2;
Przemek Stekiel80a88492023-02-20 13:32:22 +01008196 break;
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008197 case PSA_PAKE_STEP_X2S:
8198 computation_stage->state = PSA_PAKE_INPUT_X4S;
Przemek Stekiel80a88492023-02-20 13:32:22 +01008199 break;
Przemek Stekiel80a88492023-02-20 13:32:22 +01008200 default:
Przemek Stekiele12ed362022-12-21 12:54:46 +01008201 return PSA_ERROR_BAD_STATE;
Przemek Stekiel80a88492023-02-20 13:32:22 +01008202 }
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008203
8204 computation_stage->sequence = PSA_PAKE_X1_STEP_KEY_SHARE;
8205 }
8206
8207 /* Check if step matches current sequence */
8208 switch (computation_stage->sequence) {
8209 case PSA_PAKE_X1_STEP_KEY_SHARE:
8210 case PSA_PAKE_X2_STEP_KEY_SHARE:
8211 if (step != PSA_PAKE_STEP_KEY_SHARE) {
8212 return PSA_ERROR_BAD_STATE;
8213 }
8214 break;
8215
8216 case PSA_PAKE_X1_STEP_ZK_PUBLIC:
8217 case PSA_PAKE_X2_STEP_ZK_PUBLIC:
8218 if (step != PSA_PAKE_STEP_ZK_PUBLIC) {
8219 return PSA_ERROR_BAD_STATE;
8220 }
8221 break;
8222
8223 case PSA_PAKE_X1_STEP_ZK_PROOF:
8224 case PSA_PAKE_X2_STEP_ZK_PROOF:
8225 if (step != PSA_PAKE_STEP_ZK_PROOF) {
8226 return PSA_ERROR_BAD_STATE;
8227 }
8228 break;
8229
8230 default:
8231 return PSA_ERROR_BAD_STATE;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008232 }
8233
8234 return PSA_SUCCESS;
8235}
8236
Przemek Stekiele12ed362022-12-21 12:54:46 +01008237static psa_status_t psa_jpake_input_epilogue(
8238 psa_pake_operation_t *operation)
8239{
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008240 psa_jpake_computation_stage_t *computation_stage =
8241 &operation->computation_stage.jpake;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008242
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008243 if ((computation_stage->state == PSA_PAKE_INPUT_X1_X2 &&
Przemek Stekiel083745e2023-02-23 17:28:23 +01008244 computation_stage->sequence == PSA_PAKE_X2_STEP_ZK_PROOF) ||
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008245 (computation_stage->state == PSA_PAKE_INPUT_X4S &&
Przemek Stekiel083745e2023-02-23 17:28:23 +01008246 computation_stage->sequence == PSA_PAKE_X1_STEP_ZK_PROOF)) {
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008247 computation_stage->state = PSA_PAKE_STATE_READY;
8248 computation_stage->input_step++;
8249 computation_stage->sequence = PSA_PAKE_SEQ_INVALID;
8250 } else {
8251 computation_stage->sequence++;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008252 }
8253
8254 return PSA_SUCCESS;
8255}
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008256#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008257
Neil Armstronga7d08c32022-06-01 18:21:20 +02008258psa_status_t psa_pake_input(
8259 psa_pake_operation_t *operation,
8260 psa_pake_step_t step,
8261 const uint8_t *input,
8262 size_t input_length)
8263{
Przemek Stekiel51eac532022-12-07 11:04:51 +01008264 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008265 psa_crypto_driver_pake_step_t driver_step = PSA_JPAKE_STEP_INVALID;
Przemek Stekiel256c75d2023-03-23 14:09:34 +01008266 const size_t max_input_length = (size_t) PSA_PAKE_INPUT_SIZE(operation->alg,
8267 operation->primitive,
8268 step);
Przemek Stekiel51eac532022-12-07 11:04:51 +01008269
8270 if (operation->stage == PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel2797d372022-12-22 11:19:22 +01008271 status = psa_pake_complete_inputs(operation);
8272 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008273 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008274 }
8275 }
8276
8277 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COMPUTATION) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008278 status = PSA_ERROR_BAD_STATE;
8279 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008280 }
8281
Przemek Stekiel256c75d2023-03-23 14:09:34 +01008282 if (input_length == 0 || input_length > max_input_length) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008283 status = PSA_ERROR_INVALID_ARGUMENT;
8284 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008285 }
8286
Przemek Stekiele12ed362022-12-21 12:54:46 +01008287 switch (operation->alg) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008288#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008289 case PSA_ALG_JPAKE:
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008290 status = psa_jpake_input_prologue(operation, step);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008291 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008292 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008293 }
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008294 driver_step = convert_jpake_computation_stage_to_driver_step(
8295 &operation->computation_stage.jpake);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008296 break;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008297#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008298 default:
Przemek Stekiel80a88492023-02-20 13:32:22 +01008299 (void) step;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008300 status = PSA_ERROR_NOT_SUPPORTED;
8301 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008302 }
8303
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008304 status = psa_driver_wrapper_pake_input(operation, driver_step,
8305 input, input_length);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008306
8307 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008308 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008309 }
8310
8311 switch (operation->alg) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008312#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008313 case PSA_ALG_JPAKE:
8314 status = psa_jpake_input_epilogue(operation);
8315 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008316 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008317 }
8318 break;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008319#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008320 default:
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008321 status = PSA_ERROR_NOT_SUPPORTED;
8322 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008323 }
8324
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008325 return PSA_SUCCESS;
8326exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008327 psa_pake_abort(operation);
8328 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008329}
8330
8331psa_status_t psa_pake_get_implicit_key(
8332 psa_pake_operation_t *operation,
8333 psa_key_derivation_operation_t *output)
8334{
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01008335 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008336 psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel251e86a2023-02-17 14:30:50 +01008337 uint8_t shared_key[MBEDTLS_PSA_JPAKE_BUFFER_SIZE];
Przemek Stekiel0c781802022-11-29 14:53:13 +01008338 size_t shared_key_len = 0;
8339
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01008340 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COMPUTATION) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008341 status = PSA_ERROR_BAD_STATE;
8342 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008343 }
8344
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008345#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008346 if (operation->alg == PSA_ALG_JPAKE) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008347 psa_jpake_computation_stage_t *computation_stage =
Przemek Stekiel083745e2023-02-23 17:28:23 +01008348 &operation->computation_stage.jpake;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008349 if (computation_stage->input_step != PSA_PAKE_STEP_DERIVE ||
8350 computation_stage->output_step != PSA_PAKE_STEP_DERIVE) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008351 status = PSA_ERROR_BAD_STATE;
8352 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008353 }
Przemek Stekiel80a88492023-02-20 13:32:22 +01008354 } else
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008355#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiel80a88492023-02-20 13:32:22 +01008356 {
8357 status = PSA_ERROR_NOT_SUPPORTED;
8358 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008359 }
8360
Przemek Stekiel0c781802022-11-29 14:53:13 +01008361 status = psa_driver_wrapper_pake_get_implicit_key(operation,
8362 shared_key,
Przemek Stekiel6b648622023-02-19 22:55:33 +01008363 sizeof(shared_key),
Przemek Stekiel0c781802022-11-29 14:53:13 +01008364 &shared_key_len);
8365
8366 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008367 goto exit;
Przemek Stekiel0c781802022-11-29 14:53:13 +01008368 }
8369
8370 status = psa_key_derivation_input_bytes(output,
8371 PSA_KEY_DERIVATION_INPUT_SECRET,
8372 shared_key,
8373 shared_key_len);
8374
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008375 mbedtls_platform_zeroize(shared_key, sizeof(shared_key));
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008376exit:
8377 abort_status = psa_pake_abort(operation);
8378 return status == PSA_SUCCESS ? abort_status : status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008379}
8380
8381psa_status_t psa_pake_abort(
8382 psa_pake_operation_t *operation)
8383{
Przemek Stekield69dca92023-01-31 19:59:20 +01008384 psa_status_t status = PSA_SUCCESS;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008385
Przemek Stekield69dca92023-01-31 19:59:20 +01008386 if (operation->stage == PSA_PAKE_OPERATION_STAGE_COMPUTATION) {
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01008387 status = psa_driver_wrapper_pake_abort(operation);
Neil Armstrong5ae60962022-09-15 11:29:46 +02008388 }
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01008389
Przemek Stekiel26c909d2023-02-28 12:34:03 +01008390 if (operation->stage == PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
8391 if (operation->data.inputs.password != NULL) {
8392 mbedtls_platform_zeroize(operation->data.inputs.password,
Przemek Stekielaa183422023-03-06 14:21:44 +01008393 operation->data.inputs.password_len);
Przemek Stekiel26c909d2023-02-28 12:34:03 +01008394 mbedtls_free(operation->data.inputs.password);
8395 }
8396 if (operation->data.inputs.user != NULL) {
8397 mbedtls_free(operation->data.inputs.user);
8398 }
8399 if (operation->data.inputs.peer != NULL) {
8400 mbedtls_free(operation->data.inputs.peer);
8401 }
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01008402 }
Przemek Stekield69dca92023-01-31 19:59:20 +01008403 memset(operation, 0, sizeof(psa_pake_operation_t));
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01008404
Przemek Stekield69dca92023-01-31 19:59:20 +01008405 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008406}
Tom Cosgrove6d62fac2023-05-10 14:40:05 +01008407#endif /* PSA_WANT_ALG_SOME_PAKE */
Neil Armstronga7d08c32022-06-01 18:21:20 +02008408
Gilles Peskinee59236f2018-01-27 23:32:46 +01008409#endif /* MBEDTLS_PSA_CRYPTO_C */