blob: 2fd70c6d365002db4e4dd6f5d434405ed8f0c932 [file] [log] [blame]
Gilles Peskinee59236f2018-01-27 23:32:46 +01001/* BEGIN_HEADER */
itayzafrir3e02b3b2018-06-12 17:06:52 +03002#include <stdint.h>
mohammad160327010052018-07-03 13:16:15 +03003
Gilles Peskinedd2f95b2018-08-11 01:22:42 +02004#include "mbedtls/asn1.h"
Gilles Peskine0b352bc2018-06-28 00:16:11 +02005#include "mbedtls/asn1write.h"
Gilles Peskinedd2f95b2018-08-11 01:22:42 +02006#include "mbedtls/oid.h"
7
Gilles Peskinebdc96fd2019-08-07 12:08:04 +02008/* For MBEDTLS_CTR_DRBG_MAX_REQUEST, knowing that psa_generate_random()
9 * uses mbedtls_ctr_drbg internally. */
10#include "mbedtls/ctr_drbg.h"
11
Gilles Peskine1838e822019-06-20 12:40:56 +020012#include "psa_crypto_helpers.h"
itayzafrir3e02b3b2018-06-12 17:06:52 +030013
Gilles Peskinec744d992019-07-30 17:26:54 +020014/* Tests that require more than 128kB of RAM plus change have this symbol
15 * as a dependency. Currently we always define this symbol, so the tests
16 * are always executed. In the future we should make this conditional
17 * so that tests that require a lot of memory are skipped on constrained
18 * platforms. */
Gilles Peskine49232e82019-08-07 11:01:30 +020019#define HAVE_RAM_AVAILABLE_128K
Gilles Peskinec744d992019-07-30 17:26:54 +020020
Gilles Peskinebdc96fd2019-08-07 12:08:04 +020021#include "psa/crypto.h"
22
Jaeden Amerof24c7f82018-06-27 17:20:43 +010023/** An invalid export length that will never be set by psa_export_key(). */
24static const size_t INVALID_EXPORT_LENGTH = ~0U;
25
Gilles Peskinef426e0f2019-02-25 17:42:03 +010026/* A hash algorithm that is known to be supported.
27 *
28 * This is used in some smoke tests.
29 */
30#if defined(MBEDTLS_MD2_C)
31#define KNOWN_SUPPORTED_HASH_ALG PSA_ALG_MD2
32#elif defined(MBEDTLS_MD4_C)
33#define KNOWN_SUPPORTED_HASH_ALG PSA_ALG_MD4
34#elif defined(MBEDTLS_MD5_C)
35#define KNOWN_SUPPORTED_HASH_ALG PSA_ALG_MD5
36/* MBEDTLS_RIPEMD160_C omitted. This is necessary for the sake of
37 * exercise_signature_key() because Mbed TLS doesn't support RIPEMD160
38 * in RSA PKCS#1v1.5 signatures. A RIPEMD160-only configuration would be
39 * implausible anyway. */
40#elif defined(MBEDTLS_SHA1_C)
41#define KNOWN_SUPPORTED_HASH_ALG PSA_ALG_SHA_1
42#elif defined(MBEDTLS_SHA256_C)
43#define KNOWN_SUPPORTED_HASH_ALG PSA_ALG_SHA_256
44#elif defined(MBEDTLS_SHA512_C)
45#define KNOWN_SUPPORTED_HASH_ALG PSA_ALG_SHA_384
46#elif defined(MBEDTLS_SHA3_C)
47#define KNOWN_SUPPORTED_HASH_ALG PSA_ALG_SHA3_256
48#else
49#undef KNOWN_SUPPORTED_HASH_ALG
50#endif
51
52/* A block cipher that is known to be supported.
53 *
54 * For simplicity's sake, stick to block ciphers with 16-byte blocks.
55 */
56#if defined(MBEDTLS_AES_C)
57#define KNOWN_SUPPORTED_BLOCK_CIPHER PSA_KEY_TYPE_AES
58#elif defined(MBEDTLS_ARIA_C)
59#define KNOWN_SUPPORTED_BLOCK_CIPHER PSA_KEY_TYPE_ARIA
60#elif defined(MBEDTLS_CAMELLIA_C)
61#define KNOWN_SUPPORTED_BLOCK_CIPHER PSA_KEY_TYPE_CAMELLIA
62#undef KNOWN_SUPPORTED_BLOCK_CIPHER
63#endif
64
65/* A MAC mode that is known to be supported.
66 *
67 * It must either be HMAC with #KNOWN_SUPPORTED_HASH_ALG or
68 * a block cipher-based MAC with #KNOWN_SUPPORTED_BLOCK_CIPHER.
69 *
70 * This is used in some smoke tests.
71 */
72#if defined(KNOWN_SUPPORTED_HASH_ALG)
73#define KNOWN_SUPPORTED_MAC_ALG ( PSA_ALG_HMAC( KNOWN_SUPPORTED_HASH_ALG ) )
74#define KNOWN_SUPPORTED_MAC_KEY_TYPE PSA_KEY_TYPE_HMAC
75#elif defined(KNOWN_SUPPORTED_BLOCK_CIPHER) && defined(MBEDTLS_CMAC_C)
76#define KNOWN_SUPPORTED_MAC_ALG PSA_ALG_CMAC
77#define KNOWN_SUPPORTED_MAC_KEY_TYPE KNOWN_SUPPORTED_BLOCK_CIPHER
78#else
79#undef KNOWN_SUPPORTED_MAC_ALG
80#undef KNOWN_SUPPORTED_MAC_KEY_TYPE
81#endif
82
83/* A cipher algorithm and key type that are known to be supported.
84 *
85 * This is used in some smoke tests.
86 */
87#if defined(KNOWN_SUPPORTED_BLOCK_CIPHER) && defined(MBEDTLS_CIPHER_MODE_CTR)
88#define KNOWN_SUPPORTED_BLOCK_CIPHER_ALG PSA_ALG_CTR
89#elif defined(KNOWN_SUPPORTED_BLOCK_CIPHER) && defined(MBEDTLS_CIPHER_MODE_CBC)
90#define KNOWN_SUPPORTED_BLOCK_CIPHER_ALG PSA_ALG_CBC_NO_PADDING
91#elif defined(KNOWN_SUPPORTED_BLOCK_CIPHER) && defined(MBEDTLS_CIPHER_MODE_CFB)
92#define KNOWN_SUPPORTED_BLOCK_CIPHER_ALG PSA_ALG_CFB
93#elif defined(KNOWN_SUPPORTED_BLOCK_CIPHER) && defined(MBEDTLS_CIPHER_MODE_OFB)
94#define KNOWN_SUPPORTED_BLOCK_CIPHER_ALG PSA_ALG_OFB
95#else
96#undef KNOWN_SUPPORTED_BLOCK_CIPHER_ALG
97#endif
98#if defined(KNOWN_SUPPORTED_BLOCK_CIPHER_ALG)
99#define KNOWN_SUPPORTED_CIPHER_ALG KNOWN_SUPPORTED_BLOCK_CIPHER_ALG
100#define KNOWN_SUPPORTED_CIPHER_KEY_TYPE KNOWN_SUPPORTED_BLOCK_CIPHER
101#elif defined(MBEDTLS_RC4_C)
102#define KNOWN_SUPPORTED_CIPHER_ALG PSA_ALG_RC4
103#define KNOWN_SUPPORTED_CIPHER_KEY_TYPE PSA_KEY_TYPE_RC4
104#else
105#undef KNOWN_SUPPORTED_CIPHER_ALG
106#undef KNOWN_SUPPORTED_CIPHER_KEY_TYPE
107#endif
108
Gilles Peskinea7aa4422018-08-14 15:17:54 +0200109/** Test if a buffer contains a constant byte value.
110 *
111 * `mem_is_char(buffer, c, size)` is true after `memset(buffer, c, size)`.
Gilles Peskinee66ca3b2018-06-20 00:11:45 +0200112 *
113 * \param buffer Pointer to the beginning of the buffer.
Gilles Peskinea7aa4422018-08-14 15:17:54 +0200114 * \param c Expected value of every byte.
Gilles Peskinee66ca3b2018-06-20 00:11:45 +0200115 * \param size Size of the buffer in bytes.
116 *
Gilles Peskine3f669c32018-06-21 09:21:51 +0200117 * \return 1 if the buffer is all-bits-zero.
118 * \return 0 if there is at least one nonzero byte.
Gilles Peskinee66ca3b2018-06-20 00:11:45 +0200119 */
Gilles Peskinea7aa4422018-08-14 15:17:54 +0200120static int mem_is_char( void *buffer, unsigned char c, size_t size )
Gilles Peskinee66ca3b2018-06-20 00:11:45 +0200121{
122 size_t i;
123 for( i = 0; i < size; i++ )
124 {
Gilles Peskinea7aa4422018-08-14 15:17:54 +0200125 if( ( (unsigned char *) buffer )[i] != c )
Gilles Peskine3f669c32018-06-21 09:21:51 +0200126 return( 0 );
Gilles Peskinee66ca3b2018-06-20 00:11:45 +0200127 }
Gilles Peskine3f669c32018-06-21 09:21:51 +0200128 return( 1 );
Gilles Peskinee66ca3b2018-06-20 00:11:45 +0200129}
Gilles Peskine818ca122018-06-20 18:16:48 +0200130
Gilles Peskine0b352bc2018-06-28 00:16:11 +0200131/* Write the ASN.1 INTEGER with the value 2^(bits-1)+x backwards from *p. */
132static int asn1_write_10x( unsigned char **p,
133 unsigned char *start,
134 size_t bits,
135 unsigned char x )
136{
137 int ret;
138 int len = bits / 8 + 1;
Gilles Peskine480416a2018-06-28 19:04:07 +0200139 if( bits == 0 )
140 return( MBEDTLS_ERR_ASN1_INVALID_DATA );
141 if( bits <= 8 && x >= 1 << ( bits - 1 ) )
Gilles Peskine0b352bc2018-06-28 00:16:11 +0200142 return( MBEDTLS_ERR_ASN1_INVALID_DATA );
Moran Pekercb088e72018-07-17 17:36:59 +0300143 if( *p < start || *p - start < (ptrdiff_t) len )
Gilles Peskine0b352bc2018-06-28 00:16:11 +0200144 return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
145 *p -= len;
146 ( *p )[len-1] = x;
147 if( bits % 8 == 0 )
148 ( *p )[1] |= 1;
149 else
150 ( *p )[0] |= 1 << ( bits % 8 );
151 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( p, start, len ) );
152 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( p, start,
153 MBEDTLS_ASN1_INTEGER ) );
154 return( len );
155}
156
157static int construct_fake_rsa_key( unsigned char *buffer,
158 size_t buffer_size,
159 unsigned char **p,
160 size_t bits,
161 int keypair )
162{
163 size_t half_bits = ( bits + 1 ) / 2;
164 int ret;
165 int len = 0;
166 /* Construct something that looks like a DER encoding of
167 * as defined by PKCS#1 v2.2 (RFC 8017) section A.1.2:
168 * RSAPrivateKey ::= SEQUENCE {
169 * version Version,
170 * modulus INTEGER, -- n
171 * publicExponent INTEGER, -- e
172 * privateExponent INTEGER, -- d
173 * prime1 INTEGER, -- p
174 * prime2 INTEGER, -- q
175 * exponent1 INTEGER, -- d mod (p-1)
176 * exponent2 INTEGER, -- d mod (q-1)
177 * coefficient INTEGER, -- (inverse of q) mod p
178 * otherPrimeInfos OtherPrimeInfos OPTIONAL
179 * }
180 * Or, for a public key, the same structure with only
181 * version, modulus and publicExponent.
182 */
183 *p = buffer + buffer_size;
184 if( keypair )
185 {
186 MBEDTLS_ASN1_CHK_ADD( len, /* pq */
187 asn1_write_10x( p, buffer, half_bits, 1 ) );
188 MBEDTLS_ASN1_CHK_ADD( len, /* dq */
189 asn1_write_10x( p, buffer, half_bits, 1 ) );
190 MBEDTLS_ASN1_CHK_ADD( len, /* dp */
191 asn1_write_10x( p, buffer, half_bits, 1 ) );
192 MBEDTLS_ASN1_CHK_ADD( len, /* q */
193 asn1_write_10x( p, buffer, half_bits, 1 ) );
194 MBEDTLS_ASN1_CHK_ADD( len, /* p != q to pass mbedtls sanity checks */
195 asn1_write_10x( p, buffer, half_bits, 3 ) );
196 MBEDTLS_ASN1_CHK_ADD( len, /* d */
197 asn1_write_10x( p, buffer, bits, 1 ) );
198 }
199 MBEDTLS_ASN1_CHK_ADD( len, /* e = 65537 */
200 asn1_write_10x( p, buffer, 17, 1 ) );
201 MBEDTLS_ASN1_CHK_ADD( len, /* n */
202 asn1_write_10x( p, buffer, bits, 1 ) );
203 if( keypair )
204 MBEDTLS_ASN1_CHK_ADD( len, /* version = 0 */
205 mbedtls_asn1_write_int( p, buffer, 0 ) );
206 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( p, buffer, len ) );
207 {
208 const unsigned char tag =
209 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE;
210 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( p, buffer, tag ) );
211 }
212 return( len );
213}
214
Gilles Peskinef426e0f2019-02-25 17:42:03 +0100215int exercise_mac_setup( psa_key_type_t key_type,
216 const unsigned char *key_bytes,
217 size_t key_length,
218 psa_algorithm_t alg,
219 psa_mac_operation_t *operation,
220 psa_status_t *status )
221{
222 psa_key_handle_t handle = 0;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +0200223 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskinef426e0f2019-02-25 17:42:03 +0100224
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +0200225 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_SIGN );
226 psa_set_key_algorithm( &attributes, alg );
227 psa_set_key_type( &attributes, key_type );
Gilles Peskine049c7532019-05-15 20:22:09 +0200228 PSA_ASSERT( psa_import_key( &attributes, key_bytes, key_length,
229 &handle ) );
Gilles Peskinef426e0f2019-02-25 17:42:03 +0100230
231 *status = psa_mac_sign_setup( operation, handle, alg );
Gilles Peskine9e0a4a52019-02-25 22:11:18 +0100232 /* Whether setup succeeded or failed, abort must succeed. */
233 PSA_ASSERT( psa_mac_abort( operation ) );
234 /* If setup failed, reproduce the failure, so that the caller can
235 * test the resulting state of the operation object. */
236 if( *status != PSA_SUCCESS )
Gilles Peskinef426e0f2019-02-25 17:42:03 +0100237 {
Gilles Peskine9e0a4a52019-02-25 22:11:18 +0100238 TEST_EQUAL( psa_mac_sign_setup( operation, handle, alg ),
239 *status );
Gilles Peskinef426e0f2019-02-25 17:42:03 +0100240 }
241
242 psa_destroy_key( handle );
243 return( 1 );
244
245exit:
246 psa_destroy_key( handle );
247 return( 0 );
248}
249
250int exercise_cipher_setup( psa_key_type_t key_type,
251 const unsigned char *key_bytes,
252 size_t key_length,
253 psa_algorithm_t alg,
254 psa_cipher_operation_t *operation,
255 psa_status_t *status )
256{
257 psa_key_handle_t handle = 0;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +0200258 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskinef426e0f2019-02-25 17:42:03 +0100259
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +0200260 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT );
261 psa_set_key_algorithm( &attributes, alg );
262 psa_set_key_type( &attributes, key_type );
Gilles Peskine049c7532019-05-15 20:22:09 +0200263 PSA_ASSERT( psa_import_key( &attributes, key_bytes, key_length,
264 &handle ) );
Gilles Peskinef426e0f2019-02-25 17:42:03 +0100265
266 *status = psa_cipher_encrypt_setup( operation, handle, alg );
Gilles Peskine9e0a4a52019-02-25 22:11:18 +0100267 /* Whether setup succeeded or failed, abort must succeed. */
268 PSA_ASSERT( psa_cipher_abort( operation ) );
269 /* If setup failed, reproduce the failure, so that the caller can
270 * test the resulting state of the operation object. */
271 if( *status != PSA_SUCCESS )
Gilles Peskinef426e0f2019-02-25 17:42:03 +0100272 {
Gilles Peskine9e0a4a52019-02-25 22:11:18 +0100273 TEST_EQUAL( psa_cipher_encrypt_setup( operation, handle, alg ),
274 *status );
Gilles Peskinef426e0f2019-02-25 17:42:03 +0100275 }
276
277 psa_destroy_key( handle );
278 return( 1 );
279
280exit:
281 psa_destroy_key( handle );
282 return( 0 );
283}
284
Gilles Peskinebdf309c2018-12-03 15:36:32 +0100285static int exercise_mac_key( psa_key_handle_t handle,
Gilles Peskine818ca122018-06-20 18:16:48 +0200286 psa_key_usage_t usage,
287 psa_algorithm_t alg )
288{
Jaeden Amero769ce272019-01-04 11:48:03 +0000289 psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT;
Gilles Peskine818ca122018-06-20 18:16:48 +0200290 const unsigned char input[] = "foo";
Gilles Peskine69c12672018-06-28 00:07:19 +0200291 unsigned char mac[PSA_MAC_MAX_SIZE] = {0};
Gilles Peskine818ca122018-06-20 18:16:48 +0200292 size_t mac_length = sizeof( mac );
293
294 if( usage & PSA_KEY_USAGE_SIGN )
295 {
Gilles Peskine8817f612018-12-18 00:18:46 +0100296 PSA_ASSERT( psa_mac_sign_setup( &operation,
297 handle, alg ) );
298 PSA_ASSERT( psa_mac_update( &operation,
299 input, sizeof( input ) ) );
300 PSA_ASSERT( psa_mac_sign_finish( &operation,
301 mac, sizeof( mac ),
302 &mac_length ) );
Gilles Peskine818ca122018-06-20 18:16:48 +0200303 }
304
305 if( usage & PSA_KEY_USAGE_VERIFY )
306 {
307 psa_status_t verify_status =
308 ( usage & PSA_KEY_USAGE_SIGN ?
309 PSA_SUCCESS :
310 PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskine8817f612018-12-18 00:18:46 +0100311 PSA_ASSERT( psa_mac_verify_setup( &operation,
312 handle, alg ) );
313 PSA_ASSERT( psa_mac_update( &operation,
314 input, sizeof( input ) ) );
Gilles Peskinef812dcf2018-12-18 00:33:25 +0100315 TEST_EQUAL( psa_mac_verify_finish( &operation, mac, mac_length ),
316 verify_status );
Gilles Peskine818ca122018-06-20 18:16:48 +0200317 }
318
319 return( 1 );
320
321exit:
322 psa_mac_abort( &operation );
323 return( 0 );
324}
325
Gilles Peskinebdf309c2018-12-03 15:36:32 +0100326static int exercise_cipher_key( psa_key_handle_t handle,
Gilles Peskine818ca122018-06-20 18:16:48 +0200327 psa_key_usage_t usage,
328 psa_algorithm_t alg )
329{
Jaeden Amero5bae2272019-01-04 11:48:27 +0000330 psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT;
Gilles Peskine818ca122018-06-20 18:16:48 +0200331 unsigned char iv[16] = {0};
332 size_t iv_length = sizeof( iv );
333 const unsigned char plaintext[16] = "Hello, world...";
334 unsigned char ciphertext[32] = "(wabblewebblewibblewobblewubble)";
335 size_t ciphertext_length = sizeof( ciphertext );
336 unsigned char decrypted[sizeof( ciphertext )];
337 size_t part_length;
338
339 if( usage & PSA_KEY_USAGE_ENCRYPT )
340 {
Gilles Peskine8817f612018-12-18 00:18:46 +0100341 PSA_ASSERT( psa_cipher_encrypt_setup( &operation,
342 handle, alg ) );
343 PSA_ASSERT( psa_cipher_generate_iv( &operation,
344 iv, sizeof( iv ),
345 &iv_length ) );
346 PSA_ASSERT( psa_cipher_update( &operation,
347 plaintext, sizeof( plaintext ),
348 ciphertext, sizeof( ciphertext ),
349 &ciphertext_length ) );
350 PSA_ASSERT( psa_cipher_finish( &operation,
351 ciphertext + ciphertext_length,
352 sizeof( ciphertext ) - ciphertext_length,
353 &part_length ) );
Gilles Peskine818ca122018-06-20 18:16:48 +0200354 ciphertext_length += part_length;
355 }
356
357 if( usage & PSA_KEY_USAGE_DECRYPT )
358 {
359 psa_status_t status;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +0200360 int maybe_invalid_padding = 0;
Gilles Peskine818ca122018-06-20 18:16:48 +0200361 if( ! ( usage & PSA_KEY_USAGE_ENCRYPT ) )
362 {
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +0200363 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
364 PSA_ASSERT( psa_get_key_attributes( handle, &attributes ) );
365 /* This should be PSA_CIPHER_GET_IV_SIZE but the API doesn't
366 * have this macro yet. */
367 iv_length = PSA_BLOCK_CIPHER_BLOCK_SIZE(
368 psa_get_key_type( &attributes ) );
369 maybe_invalid_padding = ! PSA_ALG_IS_STREAM_CIPHER( alg );
Gilles Peskine818ca122018-06-20 18:16:48 +0200370 }
Gilles Peskine8817f612018-12-18 00:18:46 +0100371 PSA_ASSERT( psa_cipher_decrypt_setup( &operation,
372 handle, alg ) );
373 PSA_ASSERT( psa_cipher_set_iv( &operation,
374 iv, iv_length ) );
375 PSA_ASSERT( psa_cipher_update( &operation,
376 ciphertext, ciphertext_length,
377 decrypted, sizeof( decrypted ),
378 &part_length ) );
Gilles Peskine818ca122018-06-20 18:16:48 +0200379 status = psa_cipher_finish( &operation,
380 decrypted + part_length,
381 sizeof( decrypted ) - part_length,
382 &part_length );
383 /* For a stream cipher, all inputs are valid. For a block cipher,
384 * if the input is some aribtrary data rather than an actual
385 ciphertext, a padding error is likely. */
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +0200386 if( maybe_invalid_padding )
Gilles Peskine818ca122018-06-20 18:16:48 +0200387 TEST_ASSERT( status == PSA_SUCCESS ||
388 status == PSA_ERROR_INVALID_PADDING );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +0200389 else
390 PSA_ASSERT( status );
Gilles Peskine818ca122018-06-20 18:16:48 +0200391 }
392
393 return( 1 );
394
395exit:
396 psa_cipher_abort( &operation );
397 return( 0 );
398}
399
Gilles Peskinebdf309c2018-12-03 15:36:32 +0100400static int exercise_aead_key( psa_key_handle_t handle,
Gilles Peskine818ca122018-06-20 18:16:48 +0200401 psa_key_usage_t usage,
402 psa_algorithm_t alg )
403{
404 unsigned char nonce[16] = {0};
405 size_t nonce_length = sizeof( nonce );
406 unsigned char plaintext[16] = "Hello, world...";
407 unsigned char ciphertext[48] = "(wabblewebblewibblewobblewubble)";
408 size_t ciphertext_length = sizeof( ciphertext );
409 size_t plaintext_length = sizeof( ciphertext );
410
411 if( usage & PSA_KEY_USAGE_ENCRYPT )
412 {
Gilles Peskine8817f612018-12-18 00:18:46 +0100413 PSA_ASSERT( psa_aead_encrypt( handle, alg,
414 nonce, nonce_length,
415 NULL, 0,
416 plaintext, sizeof( plaintext ),
417 ciphertext, sizeof( ciphertext ),
418 &ciphertext_length ) );
Gilles Peskine818ca122018-06-20 18:16:48 +0200419 }
420
421 if( usage & PSA_KEY_USAGE_DECRYPT )
422 {
423 psa_status_t verify_status =
424 ( usage & PSA_KEY_USAGE_ENCRYPT ?
425 PSA_SUCCESS :
426 PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskinefe11b722018-12-18 00:24:04 +0100427 TEST_EQUAL( psa_aead_decrypt( handle, alg,
428 nonce, nonce_length,
429 NULL, 0,
430 ciphertext, ciphertext_length,
431 plaintext, sizeof( plaintext ),
Gilles Peskinef812dcf2018-12-18 00:33:25 +0100432 &plaintext_length ),
433 verify_status );
Gilles Peskine818ca122018-06-20 18:16:48 +0200434 }
435
436 return( 1 );
437
438exit:
439 return( 0 );
440}
441
Gilles Peskinebdf309c2018-12-03 15:36:32 +0100442static int exercise_signature_key( psa_key_handle_t handle,
Gilles Peskine818ca122018-06-20 18:16:48 +0200443 psa_key_usage_t usage,
444 psa_algorithm_t alg )
445{
Gilles Peskinef969b3a2018-06-30 00:20:25 +0200446 unsigned char payload[PSA_HASH_MAX_SIZE] = {1};
447 size_t payload_length = 16;
Gilles Peskine69c12672018-06-28 00:07:19 +0200448 unsigned char signature[PSA_ASYMMETRIC_SIGNATURE_MAX_SIZE] = {0};
Gilles Peskine818ca122018-06-20 18:16:48 +0200449 size_t signature_length = sizeof( signature );
Gilles Peskine57ab7212019-01-28 13:03:09 +0100450 psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH( alg );
451
452 /* If the policy allows signing with any hash, just pick one. */
453 if( PSA_ALG_IS_HASH_AND_SIGN( alg ) && hash_alg == PSA_ALG_ANY_HASH )
454 {
Gilles Peskinef426e0f2019-02-25 17:42:03 +0100455#if defined(KNOWN_SUPPORTED_HASH_ALG)
456 hash_alg = KNOWN_SUPPORTED_HASH_ALG;
457 alg ^= PSA_ALG_ANY_HASH ^ hash_alg;
Gilles Peskine57ab7212019-01-28 13:03:09 +0100458#else
459 test_fail( "No hash algorithm for hash-and-sign testing", __LINE__, __FILE__ );
Gilles Peskinef426e0f2019-02-25 17:42:03 +0100460 return( 1 );
Gilles Peskine57ab7212019-01-28 13:03:09 +0100461#endif
Gilles Peskine57ab7212019-01-28 13:03:09 +0100462 }
Gilles Peskine818ca122018-06-20 18:16:48 +0200463
464 if( usage & PSA_KEY_USAGE_SIGN )
465 {
Gilles Peskinef969b3a2018-06-30 00:20:25 +0200466 /* Some algorithms require the payload to have the size of
467 * the hash encoded in the algorithm. Use this input size
468 * even for algorithms that allow other input sizes. */
Gilles Peskinef969b3a2018-06-30 00:20:25 +0200469 if( hash_alg != 0 )
470 payload_length = PSA_HASH_SIZE( hash_alg );
Gilles Peskine8817f612018-12-18 00:18:46 +0100471 PSA_ASSERT( psa_asymmetric_sign( handle, alg,
472 payload, payload_length,
473 signature, sizeof( signature ),
474 &signature_length ) );
Gilles Peskine818ca122018-06-20 18:16:48 +0200475 }
476
477 if( usage & PSA_KEY_USAGE_VERIFY )
478 {
479 psa_status_t verify_status =
480 ( usage & PSA_KEY_USAGE_SIGN ?
481 PSA_SUCCESS :
482 PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskinefe11b722018-12-18 00:24:04 +0100483 TEST_EQUAL( psa_asymmetric_verify( handle, alg,
484 payload, payload_length,
485 signature, signature_length ),
486 verify_status );
Gilles Peskine818ca122018-06-20 18:16:48 +0200487 }
488
489 return( 1 );
490
491exit:
492 return( 0 );
493}
494
Gilles Peskinebdf309c2018-12-03 15:36:32 +0100495static int exercise_asymmetric_encryption_key( psa_key_handle_t handle,
Gilles Peskine818ca122018-06-20 18:16:48 +0200496 psa_key_usage_t usage,
497 psa_algorithm_t alg )
498{
499 unsigned char plaintext[256] = "Hello, world...";
500 unsigned char ciphertext[256] = "(wabblewebblewibblewobblewubble)";
501 size_t ciphertext_length = sizeof( ciphertext );
502 size_t plaintext_length = 16;
503
504 if( usage & PSA_KEY_USAGE_ENCRYPT )
505 {
Gilles Peskinef812dcf2018-12-18 00:33:25 +0100506 PSA_ASSERT( psa_asymmetric_encrypt( handle, alg,
507 plaintext, plaintext_length,
508 NULL, 0,
509 ciphertext, sizeof( ciphertext ),
510 &ciphertext_length ) );
Gilles Peskine818ca122018-06-20 18:16:48 +0200511 }
512
513 if( usage & PSA_KEY_USAGE_DECRYPT )
514 {
515 psa_status_t status =
Gilles Peskinebdf309c2018-12-03 15:36:32 +0100516 psa_asymmetric_decrypt( handle, alg,
Gilles Peskine818ca122018-06-20 18:16:48 +0200517 ciphertext, ciphertext_length,
518 NULL, 0,
519 plaintext, sizeof( plaintext ),
520 &plaintext_length );
521 TEST_ASSERT( status == PSA_SUCCESS ||
522 ( ( usage & PSA_KEY_USAGE_ENCRYPT ) == 0 &&
523 ( status == PSA_ERROR_INVALID_ARGUMENT ||
524 status == PSA_ERROR_INVALID_PADDING ) ) );
525 }
526
527 return( 1 );
528
529exit:
530 return( 0 );
531}
Gilles Peskine02b75072018-07-01 22:31:34 +0200532
Janos Follathf2815ea2019-07-03 12:41:36 +0100533static int setup_key_derivation_wrap( psa_key_derivation_operation_t* operation,
534 psa_key_handle_t handle,
535 psa_algorithm_t alg,
536 unsigned char* input1, size_t input1_length,
537 unsigned char* input2, size_t input2_length,
538 size_t capacity )
539{
540 PSA_ASSERT( psa_key_derivation_setup( operation, alg ) );
541 if( PSA_ALG_IS_HKDF( alg ) )
542 {
543 PSA_ASSERT( psa_key_derivation_input_bytes( operation,
544 PSA_KEY_DERIVATION_INPUT_SALT,
545 input1, input1_length ) );
546 PSA_ASSERT( psa_key_derivation_input_key( operation,
547 PSA_KEY_DERIVATION_INPUT_SECRET,
548 handle ) );
549 PSA_ASSERT( psa_key_derivation_input_bytes( operation,
550 PSA_KEY_DERIVATION_INPUT_INFO,
551 input2,
552 input2_length ) );
553 }
554 else if( PSA_ALG_IS_TLS12_PRF( alg ) ||
555 PSA_ALG_IS_TLS12_PSK_TO_MS( alg ) )
556 {
557 PSA_ASSERT( psa_key_derivation_input_bytes( operation,
558 PSA_KEY_DERIVATION_INPUT_SEED,
559 input1, input1_length ) );
560 PSA_ASSERT( psa_key_derivation_input_key( operation,
561 PSA_KEY_DERIVATION_INPUT_SECRET,
562 handle ) );
563 PSA_ASSERT( psa_key_derivation_input_bytes( operation,
564 PSA_KEY_DERIVATION_INPUT_LABEL,
565 input2, input2_length ) );
566 }
567 else
568 {
569 TEST_ASSERT( ! "Key derivation algorithm not supported" );
570 }
571
Gilles Peskinec744d992019-07-30 17:26:54 +0200572 if( capacity != SIZE_MAX )
573 PSA_ASSERT( psa_key_derivation_set_capacity( operation, capacity ) );
Janos Follathf2815ea2019-07-03 12:41:36 +0100574
575 return( 1 );
576
577exit:
578 return( 0 );
579}
580
581
Gilles Peskinebdf309c2018-12-03 15:36:32 +0100582static int exercise_key_derivation_key( psa_key_handle_t handle,
Gilles Peskineea0fb492018-07-12 17:17:20 +0200583 psa_key_usage_t usage,
584 psa_algorithm_t alg )
585{
Gilles Peskine51ae0e42019-05-16 17:31:03 +0200586 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Janos Follathf2815ea2019-07-03 12:41:36 +0100587 unsigned char input1[] = "Input 1";
588 size_t input1_length = sizeof( input1 );
589 unsigned char input2[] = "Input 2";
590 size_t input2_length = sizeof( input2 );
Gilles Peskineea0fb492018-07-12 17:17:20 +0200591 unsigned char output[1];
Janos Follathf2815ea2019-07-03 12:41:36 +0100592 size_t capacity = sizeof( output );
Gilles Peskineea0fb492018-07-12 17:17:20 +0200593
594 if( usage & PSA_KEY_USAGE_DERIVE )
595 {
Janos Follathf2815ea2019-07-03 12:41:36 +0100596 if( !setup_key_derivation_wrap( &operation, handle, alg,
597 input1, input1_length,
598 input2, input2_length, capacity ) )
599 goto exit;
Gilles Peskine7607cd62019-05-29 17:35:00 +0200600
Gilles Peskine51ae0e42019-05-16 17:31:03 +0200601 PSA_ASSERT( psa_key_derivation_output_bytes( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +0200602 output,
Janos Follathf2815ea2019-07-03 12:41:36 +0100603 capacity ) );
Gilles Peskine51ae0e42019-05-16 17:31:03 +0200604 PSA_ASSERT( psa_key_derivation_abort( &operation ) );
Gilles Peskineea0fb492018-07-12 17:17:20 +0200605 }
606
607 return( 1 );
608
609exit:
610 return( 0 );
611}
612
Gilles Peskinec7998b72018-11-07 18:45:02 +0100613/* We need two keys to exercise key agreement. Exercise the
614 * private key against its own public key. */
Gilles Peskinecf7292e2019-05-16 17:53:40 +0200615static psa_status_t key_agreement_with_self(
616 psa_key_derivation_operation_t *operation,
617 psa_key_handle_t handle )
Gilles Peskinec7998b72018-11-07 18:45:02 +0100618{
619 psa_key_type_t private_key_type;
620 psa_key_type_t public_key_type;
621 size_t key_bits;
622 uint8_t *public_key = NULL;
623 size_t public_key_length;
David Saadab4ecc272019-02-14 13:48:10 +0200624 /* Return GENERIC_ERROR if something other than the final call to
Gilles Peskinecf7292e2019-05-16 17:53:40 +0200625 * psa_key_derivation_key_agreement fails. This isn't fully satisfactory,
626 * but it's good enough: callers will report it as a failed test anyway. */
David Saadab4ecc272019-02-14 13:48:10 +0200627 psa_status_t status = PSA_ERROR_GENERIC_ERROR;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +0200628 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskinec7998b72018-11-07 18:45:02 +0100629
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +0200630 PSA_ASSERT( psa_get_key_attributes( handle, &attributes ) );
631 private_key_type = psa_get_key_type( &attributes );
632 key_bits = psa_get_key_bits( &attributes );
Gilles Peskinec93b80c2019-05-16 19:39:54 +0200633 public_key_type = PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR( private_key_type );
Gilles Peskinec7998b72018-11-07 18:45:02 +0100634 public_key_length = PSA_KEY_EXPORT_MAX_SIZE( public_key_type, key_bits );
635 ASSERT_ALLOC( public_key, public_key_length );
Gilles Peskine8817f612018-12-18 00:18:46 +0100636 PSA_ASSERT( psa_export_public_key( handle,
637 public_key, public_key_length,
638 &public_key_length ) );
Gilles Peskinec7998b72018-11-07 18:45:02 +0100639
Gilles Peskinecf7292e2019-05-16 17:53:40 +0200640 status = psa_key_derivation_key_agreement(
641 operation, PSA_KEY_DERIVATION_INPUT_SECRET, handle,
642 public_key, public_key_length );
Gilles Peskinec7998b72018-11-07 18:45:02 +0100643exit:
644 mbedtls_free( public_key );
Gilles Peskinea1ace9c2019-04-26 16:03:33 +0200645 psa_reset_key_attributes( &attributes );
Gilles Peskinec7998b72018-11-07 18:45:02 +0100646 return( status );
647}
648
Gilles Peskine2e46e9c2019-04-11 21:24:55 +0200649/* We need two keys to exercise key agreement. Exercise the
650 * private key against its own public key. */
651static psa_status_t raw_key_agreement_with_self( psa_algorithm_t alg,
652 psa_key_handle_t handle )
653{
654 psa_key_type_t private_key_type;
655 psa_key_type_t public_key_type;
656 size_t key_bits;
657 uint8_t *public_key = NULL;
658 size_t public_key_length;
659 uint8_t output[1024];
660 size_t output_length;
661 /* Return GENERIC_ERROR if something other than the final call to
Gilles Peskinecf7292e2019-05-16 17:53:40 +0200662 * psa_key_derivation_key_agreement fails. This isn't fully satisfactory,
663 * but it's good enough: callers will report it as a failed test anyway. */
Gilles Peskine2e46e9c2019-04-11 21:24:55 +0200664 psa_status_t status = PSA_ERROR_GENERIC_ERROR;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +0200665 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine2e46e9c2019-04-11 21:24:55 +0200666
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +0200667 PSA_ASSERT( psa_get_key_attributes( handle, &attributes ) );
668 private_key_type = psa_get_key_type( &attributes );
669 key_bits = psa_get_key_bits( &attributes );
Gilles Peskinec93b80c2019-05-16 19:39:54 +0200670 public_key_type = PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR( private_key_type );
Gilles Peskine2e46e9c2019-04-11 21:24:55 +0200671 public_key_length = PSA_KEY_EXPORT_MAX_SIZE( public_key_type, key_bits );
672 ASSERT_ALLOC( public_key, public_key_length );
673 PSA_ASSERT( psa_export_public_key( handle,
674 public_key, public_key_length,
675 &public_key_length ) );
676
Gilles Peskinebe697d82019-05-16 18:00:41 +0200677 status = psa_raw_key_agreement( alg, handle,
678 public_key, public_key_length,
679 output, sizeof( output ), &output_length );
Gilles Peskine2e46e9c2019-04-11 21:24:55 +0200680exit:
681 mbedtls_free( public_key );
Gilles Peskinea1ace9c2019-04-26 16:03:33 +0200682 psa_reset_key_attributes( &attributes );
Gilles Peskine2e46e9c2019-04-11 21:24:55 +0200683 return( status );
684}
685
686static int exercise_raw_key_agreement_key( psa_key_handle_t handle,
687 psa_key_usage_t usage,
688 psa_algorithm_t alg )
689{
690 int ok = 0;
691
692 if( usage & PSA_KEY_USAGE_DERIVE )
693 {
694 /* We need two keys to exercise key agreement. Exercise the
695 * private key against its own public key. */
696 PSA_ASSERT( raw_key_agreement_with_self( alg, handle ) );
697 }
698 ok = 1;
699
700exit:
701 return( ok );
702}
703
Gilles Peskinebdf309c2018-12-03 15:36:32 +0100704static int exercise_key_agreement_key( psa_key_handle_t handle,
Gilles Peskine01d718c2018-09-18 12:01:02 +0200705 psa_key_usage_t usage,
706 psa_algorithm_t alg )
707{
Gilles Peskine51ae0e42019-05-16 17:31:03 +0200708 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Gilles Peskine01d718c2018-09-18 12:01:02 +0200709 unsigned char output[1];
710 int ok = 0;
711
712 if( usage & PSA_KEY_USAGE_DERIVE )
713 {
714 /* We need two keys to exercise key agreement. Exercise the
715 * private key against its own public key. */
Gilles Peskine51ae0e42019-05-16 17:31:03 +0200716 PSA_ASSERT( psa_key_derivation_setup( &operation, alg ) );
717 PSA_ASSERT( key_agreement_with_self( &operation, handle ) );
718 PSA_ASSERT( psa_key_derivation_output_bytes( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +0200719 output,
720 sizeof( output ) ) );
Gilles Peskine51ae0e42019-05-16 17:31:03 +0200721 PSA_ASSERT( psa_key_derivation_abort( &operation ) );
Gilles Peskine01d718c2018-09-18 12:01:02 +0200722 }
723 ok = 1;
724
725exit:
Gilles Peskine01d718c2018-09-18 12:01:02 +0200726 return( ok );
727}
728
Jaeden Amerof7dca862019-06-27 17:31:33 +0100729int asn1_skip_integer( unsigned char **p, const unsigned char *end,
730 size_t min_bits, size_t max_bits,
731 int must_be_odd )
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200732{
733 size_t len;
734 size_t actual_bits;
735 unsigned char msb;
Gilles Peskinefe11b722018-12-18 00:24:04 +0100736 TEST_EQUAL( mbedtls_asn1_get_tag( p, end, &len,
Gilles Peskinef812dcf2018-12-18 00:33:25 +0100737 MBEDTLS_ASN1_INTEGER ),
738 0 );
k-stachowiak9b88efc2019-09-13 15:26:53 +0200739
740 /* Check if the retrieved length doesn't extend the actual buffer's size.
741 * It is assumed here, that end >= p, which validates casting to size_t. */
742 TEST_ASSERT( len <= (size_t)( end - *p) );
743
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200744 /* Tolerate a slight departure from DER encoding:
745 * - 0 may be represented by an empty string or a 1-byte string.
746 * - The sign bit may be used as a value bit. */
747 if( ( len == 1 && ( *p )[0] == 0 ) ||
748 ( len > 1 && ( *p )[0] == 0 && ( ( *p )[1] & 0x80 ) != 0 ) )
749 {
750 ++( *p );
751 --len;
752 }
753 if( min_bits == 0 && len == 0 )
754 return( 1 );
755 msb = ( *p )[0];
756 TEST_ASSERT( msb != 0 );
757 actual_bits = 8 * ( len - 1 );
758 while( msb != 0 )
759 {
760 msb >>= 1;
761 ++actual_bits;
762 }
763 TEST_ASSERT( actual_bits >= min_bits );
764 TEST_ASSERT( actual_bits <= max_bits );
765 if( must_be_odd )
766 TEST_ASSERT( ( ( *p )[len-1] & 1 ) != 0 );
767 *p += len;
768 return( 1 );
769exit:
770 return( 0 );
771}
772
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200773static int exported_key_sanity_check( psa_key_type_t type, size_t bits,
774 uint8_t *exported, size_t exported_length )
775{
776 if( PSA_KEY_TYPE_IS_UNSTRUCTURED( type ) )
Gilles Peskinefe11b722018-12-18 00:24:04 +0100777 TEST_EQUAL( exported_length, ( bits + 7 ) / 8 );
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200778 else
779 TEST_ASSERT( exported_length <= PSA_KEY_EXPORT_MAX_SIZE( type, bits ) );
Gilles Peskined14664a2018-08-10 19:07:32 +0200780
781#if defined(MBEDTLS_DES_C)
782 if( type == PSA_KEY_TYPE_DES )
783 {
784 /* Check the parity bits. */
785 unsigned i;
786 for( i = 0; i < bits / 8; i++ )
787 {
788 unsigned bit_count = 0;
789 unsigned m;
790 for( m = 1; m <= 0x100; m <<= 1 )
791 {
792 if( exported[i] & m )
793 ++bit_count;
794 }
795 TEST_ASSERT( bit_count % 2 != 0 );
796 }
797 }
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200798 else
Gilles Peskined14664a2018-08-10 19:07:32 +0200799#endif
800
801#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PK_PARSE_C)
Gilles Peskinec93b80c2019-05-16 19:39:54 +0200802 if( type == PSA_KEY_TYPE_RSA_KEY_PAIR )
Gilles Peskined14664a2018-08-10 19:07:32 +0200803 {
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200804 uint8_t *p = exported;
805 uint8_t *end = exported + exported_length;
806 size_t len;
807 /* RSAPrivateKey ::= SEQUENCE {
Gilles Peskinedea46cf2018-08-21 16:12:54 +0200808 * version INTEGER, -- must be 0
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200809 * modulus INTEGER, -- n
810 * publicExponent INTEGER, -- e
811 * privateExponent INTEGER, -- d
812 * prime1 INTEGER, -- p
813 * prime2 INTEGER, -- q
814 * exponent1 INTEGER, -- d mod (p-1)
815 * exponent2 INTEGER, -- d mod (q-1)
816 * coefficient INTEGER, -- (inverse of q) mod p
817 * }
818 */
Gilles Peskinefe11b722018-12-18 00:24:04 +0100819 TEST_EQUAL( mbedtls_asn1_get_tag( &p, end, &len,
820 MBEDTLS_ASN1_SEQUENCE |
821 MBEDTLS_ASN1_CONSTRUCTED ), 0 );
822 TEST_EQUAL( p + len, end );
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200823 if( ! asn1_skip_integer( &p, end, 0, 0, 0 ) )
824 goto exit;
825 if( ! asn1_skip_integer( &p, end, bits, bits, 1 ) )
826 goto exit;
827 if( ! asn1_skip_integer( &p, end, 2, bits, 1 ) )
828 goto exit;
829 /* Require d to be at least half the size of n. */
830 if( ! asn1_skip_integer( &p, end, bits / 2, bits, 1 ) )
831 goto exit;
832 /* Require p and q to be at most half the size of n, rounded up. */
833 if( ! asn1_skip_integer( &p, end, bits / 2, bits / 2 + 1, 1 ) )
834 goto exit;
835 if( ! asn1_skip_integer( &p, end, bits / 2, bits / 2 + 1, 1 ) )
836 goto exit;
837 if( ! asn1_skip_integer( &p, end, 1, bits / 2 + 1, 0 ) )
838 goto exit;
839 if( ! asn1_skip_integer( &p, end, 1, bits / 2 + 1, 0 ) )
840 goto exit;
841 if( ! asn1_skip_integer( &p, end, 1, bits / 2 + 1, 0 ) )
842 goto exit;
Gilles Peskinefe11b722018-12-18 00:24:04 +0100843 TEST_EQUAL( p, end );
Gilles Peskine0f915f12018-12-17 23:35:42 +0100844 }
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200845 else
Gilles Peskined14664a2018-08-10 19:07:32 +0200846#endif /* MBEDTLS_RSA_C */
847
848#if defined(MBEDTLS_ECP_C)
Gilles Peskinec93b80c2019-05-16 19:39:54 +0200849 if( PSA_KEY_TYPE_IS_ECC_KEY_PAIR( type ) )
Gilles Peskined14664a2018-08-10 19:07:32 +0200850 {
Gilles Peskine5b802a32018-10-29 19:21:41 +0100851 /* Just the secret value */
Gilles Peskinefe11b722018-12-18 00:24:04 +0100852 TEST_EQUAL( exported_length, PSA_BITS_TO_BYTES( bits ) );
Gilles Peskine5b802a32018-10-29 19:21:41 +0100853 }
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200854 else
Gilles Peskined14664a2018-08-10 19:07:32 +0200855#endif /* MBEDTLS_ECP_C */
856
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200857 if( PSA_KEY_TYPE_IS_PUBLIC_KEY( type ) )
858 {
859 uint8_t *p = exported;
860 uint8_t *end = exported + exported_length;
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200861#if defined(MBEDTLS_RSA_C)
862 if( type == PSA_KEY_TYPE_RSA_PUBLIC_KEY )
863 {
Jaeden Amerof7dca862019-06-27 17:31:33 +0100864 size_t len;
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200865 /* RSAPublicKey ::= SEQUENCE {
866 * modulus INTEGER, -- n
867 * publicExponent INTEGER } -- e
868 */
Gilles Peskinefe11b722018-12-18 00:24:04 +0100869 TEST_EQUAL( mbedtls_asn1_get_tag( &p, end, &len,
870 MBEDTLS_ASN1_SEQUENCE |
Gilles Peskinef812dcf2018-12-18 00:33:25 +0100871 MBEDTLS_ASN1_CONSTRUCTED ),
872 0 );
Gilles Peskinefe11b722018-12-18 00:24:04 +0100873 TEST_EQUAL( p + len, end );
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200874 if( ! asn1_skip_integer( &p, end, bits, bits, 1 ) )
875 goto exit;
876 if( ! asn1_skip_integer( &p, end, 2, bits, 1 ) )
877 goto exit;
Gilles Peskinefe11b722018-12-18 00:24:04 +0100878 TEST_EQUAL( p, end );
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200879 }
880 else
881#endif /* MBEDTLS_RSA_C */
882#if defined(MBEDTLS_ECP_C)
883 if( PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY( type ) )
884 {
Jaeden Amero0ae445f2019-01-10 11:42:27 +0000885 /* The representation of an ECC public key is:
886 * - The byte 0x04;
887 * - `x_P` as a `ceiling(m/8)`-byte string, big-endian;
888 * - `y_P` as a `ceiling(m/8)`-byte string, big-endian;
889 * - where m is the bit size associated with the curve.
Jaeden Amero6b196002019-01-10 10:23:21 +0000890 */
Gilles Peskinefe11b722018-12-18 00:24:04 +0100891 TEST_EQUAL( p + 1 + 2 * PSA_BITS_TO_BYTES( bits ), end );
892 TEST_EQUAL( p[0], 4 );
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200893 }
894 else
895#endif /* MBEDTLS_ECP_C */
896 {
Jaeden Amero594a3302018-10-26 17:07:22 +0100897 char message[47];
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200898 mbedtls_snprintf( message, sizeof( message ),
899 "No sanity check for public key type=0x%08lx",
900 (unsigned long) type );
901 test_fail( message, __LINE__, __FILE__ );
902 return( 0 );
903 }
904 }
905 else
906
907 {
908 /* No sanity checks for other types */
909 }
910
911 return( 1 );
Gilles Peskined14664a2018-08-10 19:07:32 +0200912
913exit:
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200914 return( 0 );
Gilles Peskined14664a2018-08-10 19:07:32 +0200915}
916
Gilles Peskinebdf309c2018-12-03 15:36:32 +0100917static int exercise_export_key( psa_key_handle_t handle,
Gilles Peskined14664a2018-08-10 19:07:32 +0200918 psa_key_usage_t usage )
919{
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +0200920 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskined14664a2018-08-10 19:07:32 +0200921 uint8_t *exported = NULL;
922 size_t exported_size = 0;
923 size_t exported_length = 0;
924 int ok = 0;
925
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +0200926 PSA_ASSERT( psa_get_key_attributes( handle, &attributes ) );
Gilles Peskineacec7b6f2018-09-13 20:34:11 +0200927
928 if( ( usage & PSA_KEY_USAGE_EXPORT ) == 0 &&
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +0200929 ! PSA_KEY_TYPE_IS_PUBLIC_KEY( psa_get_key_type( &attributes ) ) )
Gilles Peskined14664a2018-08-10 19:07:32 +0200930 {
Gilles Peskinefe11b722018-12-18 00:24:04 +0100931 TEST_EQUAL( psa_export_key( handle, NULL, 0, &exported_length ),
932 PSA_ERROR_NOT_PERMITTED );
Gilles Peskinea1ace9c2019-04-26 16:03:33 +0200933 ok = 1;
934 goto exit;
Gilles Peskined14664a2018-08-10 19:07:32 +0200935 }
936
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +0200937 exported_size = PSA_KEY_EXPORT_MAX_SIZE( psa_get_key_type( &attributes ),
938 psa_get_key_bits( &attributes ) );
Gilles Peskine8cebbba2018-09-27 13:54:18 +0200939 ASSERT_ALLOC( exported, exported_size );
Gilles Peskined14664a2018-08-10 19:07:32 +0200940
Gilles Peskine8817f612018-12-18 00:18:46 +0100941 PSA_ASSERT( psa_export_key( handle,
942 exported, exported_size,
943 &exported_length ) );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +0200944 ok = exported_key_sanity_check( psa_get_key_type( &attributes ),
945 psa_get_key_bits( &attributes ),
946 exported, exported_length );
Gilles Peskined14664a2018-08-10 19:07:32 +0200947
948exit:
949 mbedtls_free( exported );
Gilles Peskinea1ace9c2019-04-26 16:03:33 +0200950 psa_reset_key_attributes( &attributes );
Gilles Peskined14664a2018-08-10 19:07:32 +0200951 return( ok );
952}
953
Gilles Peskinebdf309c2018-12-03 15:36:32 +0100954static int exercise_export_public_key( psa_key_handle_t handle )
Gilles Peskined14664a2018-08-10 19:07:32 +0200955{
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +0200956 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskined14664a2018-08-10 19:07:32 +0200957 psa_key_type_t public_type;
Gilles Peskined14664a2018-08-10 19:07:32 +0200958 uint8_t *exported = NULL;
959 size_t exported_size = 0;
960 size_t exported_length = 0;
961 int ok = 0;
962
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +0200963 PSA_ASSERT( psa_get_key_attributes( handle, &attributes ) );
964 if( ! PSA_KEY_TYPE_IS_ASYMMETRIC( psa_get_key_type( &attributes ) ) )
Gilles Peskined14664a2018-08-10 19:07:32 +0200965 {
Gilles Peskinef812dcf2018-12-18 00:33:25 +0100966 TEST_EQUAL( psa_export_public_key( handle, NULL, 0, &exported_length ),
Gilles Peskinefe11b722018-12-18 00:24:04 +0100967 PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskined14664a2018-08-10 19:07:32 +0200968 return( 1 );
969 }
970
Gilles Peskinec93b80c2019-05-16 19:39:54 +0200971 public_type = PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +0200972 psa_get_key_type( &attributes ) );
973 exported_size = PSA_KEY_EXPORT_MAX_SIZE( public_type,
974 psa_get_key_bits( &attributes ) );
Gilles Peskine8cebbba2018-09-27 13:54:18 +0200975 ASSERT_ALLOC( exported, exported_size );
Gilles Peskined14664a2018-08-10 19:07:32 +0200976
Gilles Peskine8817f612018-12-18 00:18:46 +0100977 PSA_ASSERT( psa_export_public_key( handle,
978 exported, exported_size,
979 &exported_length ) );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +0200980 ok = exported_key_sanity_check( public_type,
981 psa_get_key_bits( &attributes ),
Gilles Peskined14664a2018-08-10 19:07:32 +0200982 exported, exported_length );
983
984exit:
985 mbedtls_free( exported );
Gilles Peskinea1ace9c2019-04-26 16:03:33 +0200986 psa_reset_key_attributes( &attributes );
Gilles Peskined14664a2018-08-10 19:07:32 +0200987 return( ok );
988}
989
Gilles Peskinec9516fb2019-02-05 20:32:06 +0100990/** Do smoke tests on a key.
991 *
992 * Perform one of each operation indicated by \p alg (decrypt/encrypt,
993 * sign/verify, or derivation) that is permitted according to \p usage.
994 * \p usage and \p alg should correspond to the expected policy on the
995 * key.
996 *
997 * Export the key if permitted by \p usage, and check that the output
998 * looks sensible. If \p usage forbids export, check that
999 * \p psa_export_key correctly rejects the attempt. If the key is
1000 * asymmetric, also check \p psa_export_public_key.
1001 *
1002 * If the key fails the tests, this function calls the test framework's
1003 * `test_fail` function and returns false. Otherwise this function returns
1004 * true. Therefore it should be used as follows:
1005 * ```
1006 * if( ! exercise_key( ... ) ) goto exit;
1007 * ```
1008 *
1009 * \param handle The key to exercise. It should be capable of performing
1010 * \p alg.
1011 * \param usage The usage flags to assume.
1012 * \param alg The algorithm to exercise.
1013 *
1014 * \retval 0 The key failed the smoke tests.
1015 * \retval 1 The key passed the smoke tests.
1016 */
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001017static int exercise_key( psa_key_handle_t handle,
Gilles Peskine02b75072018-07-01 22:31:34 +02001018 psa_key_usage_t usage,
1019 psa_algorithm_t alg )
1020{
1021 int ok;
1022 if( alg == 0 )
1023 ok = 1; /* If no algorihm, do nothing (used for raw data "keys"). */
1024 else if( PSA_ALG_IS_MAC( alg ) )
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001025 ok = exercise_mac_key( handle, usage, alg );
Gilles Peskine02b75072018-07-01 22:31:34 +02001026 else if( PSA_ALG_IS_CIPHER( alg ) )
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001027 ok = exercise_cipher_key( handle, usage, alg );
Gilles Peskine02b75072018-07-01 22:31:34 +02001028 else if( PSA_ALG_IS_AEAD( alg ) )
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001029 ok = exercise_aead_key( handle, usage, alg );
Gilles Peskine02b75072018-07-01 22:31:34 +02001030 else if( PSA_ALG_IS_SIGN( alg ) )
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001031 ok = exercise_signature_key( handle, usage, alg );
Gilles Peskine02b75072018-07-01 22:31:34 +02001032 else if( PSA_ALG_IS_ASYMMETRIC_ENCRYPTION( alg ) )
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001033 ok = exercise_asymmetric_encryption_key( handle, usage, alg );
Gilles Peskineea0fb492018-07-12 17:17:20 +02001034 else if( PSA_ALG_IS_KEY_DERIVATION( alg ) )
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001035 ok = exercise_key_derivation_key( handle, usage, alg );
Gilles Peskine2e46e9c2019-04-11 21:24:55 +02001036 else if( PSA_ALG_IS_RAW_KEY_AGREEMENT( alg ) )
1037 ok = exercise_raw_key_agreement_key( handle, usage, alg );
Gilles Peskine01d718c2018-09-18 12:01:02 +02001038 else if( PSA_ALG_IS_KEY_AGREEMENT( alg ) )
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001039 ok = exercise_key_agreement_key( handle, usage, alg );
Gilles Peskine02b75072018-07-01 22:31:34 +02001040 else
1041 {
1042 char message[40];
1043 mbedtls_snprintf( message, sizeof( message ),
1044 "No code to exercise alg=0x%08lx",
1045 (unsigned long) alg );
1046 test_fail( message, __LINE__, __FILE__ );
1047 ok = 0;
1048 }
Gilles Peskined14664a2018-08-10 19:07:32 +02001049
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001050 ok = ok && exercise_export_key( handle, usage );
1051 ok = ok && exercise_export_public_key( handle );
Gilles Peskined14664a2018-08-10 19:07:32 +02001052
Gilles Peskine02b75072018-07-01 22:31:34 +02001053 return( ok );
1054}
1055
Gilles Peskine10df3412018-10-25 22:35:43 +02001056static psa_key_usage_t usage_to_exercise( psa_key_type_t type,
1057 psa_algorithm_t alg )
1058{
1059 if( PSA_ALG_IS_MAC( alg ) || PSA_ALG_IS_SIGN( alg ) )
1060 {
1061 return( PSA_KEY_TYPE_IS_PUBLIC_KEY( type ) ?
1062 PSA_KEY_USAGE_VERIFY :
1063 PSA_KEY_USAGE_SIGN | PSA_KEY_USAGE_VERIFY );
1064 }
1065 else if( PSA_ALG_IS_CIPHER( alg ) || PSA_ALG_IS_AEAD( alg ) ||
1066 PSA_ALG_IS_ASYMMETRIC_ENCRYPTION( alg ) )
1067 {
1068 return( PSA_KEY_TYPE_IS_PUBLIC_KEY( type ) ?
1069 PSA_KEY_USAGE_ENCRYPT :
1070 PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT );
1071 }
1072 else if( PSA_ALG_IS_KEY_DERIVATION( alg ) ||
1073 PSA_ALG_IS_KEY_AGREEMENT( alg ) )
1074 {
1075 return( PSA_KEY_USAGE_DERIVE );
1076 }
1077 else
1078 {
1079 return( 0 );
1080 }
1081
1082}
Darryl Green0c6575a2018-11-07 16:05:30 +00001083
Gilles Peskine4cf3a432019-04-18 22:28:52 +02001084static int test_operations_on_invalid_handle( psa_key_handle_t handle )
1085{
1086 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
1087 uint8_t buffer[1];
1088 size_t length;
1089 int ok = 0;
1090
Gilles Peskinec87af662019-05-15 16:12:22 +02001091 psa_set_key_id( &attributes, 0x6964 );
Gilles Peskine4cf3a432019-04-18 22:28:52 +02001092 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT );
1093 psa_set_key_algorithm( &attributes, PSA_ALG_CTR );
1094 psa_set_key_type( &attributes, PSA_KEY_TYPE_AES );
1095 TEST_EQUAL( psa_get_key_attributes( handle, &attributes ),
1096 PSA_ERROR_INVALID_HANDLE );
1097 TEST_EQUAL( psa_get_key_id( &attributes ), 0 );
Gilles Peskine5c648ab2019-04-19 14:06:53 +02001098 TEST_EQUAL( psa_get_key_lifetime( &attributes ), 0 );
Gilles Peskine4cf3a432019-04-18 22:28:52 +02001099 TEST_EQUAL( psa_get_key_usage_flags( &attributes ), 0 );
1100 TEST_EQUAL( psa_get_key_algorithm( &attributes ), 0 );
1101 TEST_EQUAL( psa_get_key_type( &attributes ), 0 );
1102 TEST_EQUAL( psa_get_key_bits( &attributes ), 0 );
1103
1104 TEST_EQUAL( psa_export_key( handle,
1105 buffer, sizeof( buffer ), &length ),
1106 PSA_ERROR_INVALID_HANDLE );
1107 TEST_EQUAL( psa_export_public_key( handle,
1108 buffer, sizeof( buffer ), &length ),
1109 PSA_ERROR_INVALID_HANDLE );
1110
Gilles Peskine4cf3a432019-04-18 22:28:52 +02001111 ok = 1;
1112
1113exit:
1114 psa_reset_key_attributes( &attributes );
1115 return( ok );
1116}
1117
Gilles Peskine5fe5e272019-08-02 20:30:01 +02001118/* Assert that a key isn't reported as having a slot number. */
1119#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1120#define ASSERT_NO_SLOT_NUMBER( attributes ) \
1121 do \
1122 { \
1123 psa_key_slot_number_t ASSERT_NO_SLOT_NUMBER_slot_number; \
1124 TEST_EQUAL( psa_get_key_slot_number( \
1125 attributes, \
1126 &ASSERT_NO_SLOT_NUMBER_slot_number ), \
1127 PSA_ERROR_INVALID_ARGUMENT ); \
1128 } \
1129 while( 0 )
1130#else /* MBEDTLS_PSA_CRYPTO_SE_C */
1131#define ASSERT_NO_SLOT_NUMBER( attributes ) \
1132 ( (void) 0 )
1133#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1134
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001135/* An overapproximation of the amount of storage needed for a key of the
1136 * given type and with the given content. The API doesn't make it easy
1137 * to find a good value for the size. The current implementation doesn't
1138 * care about the value anyway. */
1139#define KEY_BITS_FROM_DATA( type, data ) \
1140 ( data )->len
1141
Darryl Green0c6575a2018-11-07 16:05:30 +00001142typedef enum {
1143 IMPORT_KEY = 0,
1144 GENERATE_KEY = 1,
1145 DERIVE_KEY = 2
1146} generate_method;
1147
Gilles Peskinee59236f2018-01-27 23:32:46 +01001148/* END_HEADER */
1149
1150/* BEGIN_DEPENDENCIES
1151 * depends_on:MBEDTLS_PSA_CRYPTO_C
1152 * END_DEPENDENCIES
1153 */
1154
1155/* BEGIN_CASE */
Gilles Peskinee1f2d7d2018-08-21 14:54:54 +02001156void static_checks( )
1157{
1158 size_t max_truncated_mac_size =
1159 PSA_ALG_MAC_TRUNCATION_MASK >> PSA_MAC_TRUNCATION_OFFSET;
1160
1161 /* Check that the length for a truncated MAC always fits in the algorithm
1162 * encoding. The shifted mask is the maximum truncated value. The
1163 * untruncated algorithm may be one byte larger. */
1164 TEST_ASSERT( PSA_MAC_MAX_SIZE <= 1 + max_truncated_mac_size );
1165}
1166/* END_CASE */
1167
1168/* BEGIN_CASE */
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001169void attributes_set_get( int id_arg, int lifetime_arg,
1170 int usage_flags_arg, int alg_arg,
Gilles Peskine3a4f1f82019-04-26 13:49:28 +02001171 int type_arg, int bits_arg )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001172{
Gilles Peskine4747d192019-04-17 15:05:45 +02001173 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001174 psa_key_id_t id = id_arg;
1175 psa_key_lifetime_t lifetime = lifetime_arg;
1176 psa_key_usage_t usage_flags = usage_flags_arg;
1177 psa_algorithm_t alg = alg_arg;
1178 psa_key_type_t type = type_arg;
Gilles Peskine3a4f1f82019-04-26 13:49:28 +02001179 size_t bits = bits_arg;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001180
1181 TEST_EQUAL( psa_get_key_id( &attributes ), 0 );
1182 TEST_EQUAL( psa_get_key_lifetime( &attributes ), 0 );
1183 TEST_EQUAL( psa_get_key_usage_flags( &attributes ), 0 );
1184 TEST_EQUAL( psa_get_key_algorithm( &attributes ), 0 );
1185 TEST_EQUAL( psa_get_key_type( &attributes ), 0 );
Gilles Peskine3a4f1f82019-04-26 13:49:28 +02001186 TEST_EQUAL( psa_get_key_bits( &attributes ), 0 );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001187
Gilles Peskinec87af662019-05-15 16:12:22 +02001188 psa_set_key_id( &attributes, id );
1189 psa_set_key_lifetime( &attributes, lifetime );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001190 psa_set_key_usage_flags( &attributes, usage_flags );
1191 psa_set_key_algorithm( &attributes, alg );
1192 psa_set_key_type( &attributes, type );
Gilles Peskine3a4f1f82019-04-26 13:49:28 +02001193 psa_set_key_bits( &attributes, bits );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001194
1195 TEST_EQUAL( psa_get_key_id( &attributes ), id );
1196 TEST_EQUAL( psa_get_key_lifetime( &attributes ), lifetime );
1197 TEST_EQUAL( psa_get_key_usage_flags( &attributes ), usage_flags );
1198 TEST_EQUAL( psa_get_key_algorithm( &attributes ), alg );
1199 TEST_EQUAL( psa_get_key_type( &attributes ), type );
Gilles Peskine3a4f1f82019-04-26 13:49:28 +02001200 TEST_EQUAL( psa_get_key_bits( &attributes ), bits );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001201
1202 psa_reset_key_attributes( &attributes );
1203
1204 TEST_EQUAL( psa_get_key_id( &attributes ), 0 );
1205 TEST_EQUAL( psa_get_key_lifetime( &attributes ), 0 );
1206 TEST_EQUAL( psa_get_key_usage_flags( &attributes ), 0 );
1207 TEST_EQUAL( psa_get_key_algorithm( &attributes ), 0 );
1208 TEST_EQUAL( psa_get_key_type( &attributes ), 0 );
Gilles Peskine3a4f1f82019-04-26 13:49:28 +02001209 TEST_EQUAL( psa_get_key_bits( &attributes ), 0 );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001210}
1211/* END_CASE */
1212
1213/* BEGIN_CASE */
Gilles Peskinedd835cb2019-05-15 16:14:57 +02001214void persistence_attributes( int id1_arg, int lifetime_arg, int id2_arg,
1215 int expected_id_arg, int expected_lifetime_arg )
1216{
1217 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
1218 psa_key_id_t id1 = id1_arg;
1219 psa_key_lifetime_t lifetime = lifetime_arg;
1220 psa_key_id_t id2 = id2_arg;
1221 psa_key_id_t expected_id = expected_id_arg;
1222 psa_key_lifetime_t expected_lifetime = expected_lifetime_arg;
1223
1224 if( id1_arg != -1 )
1225 psa_set_key_id( &attributes, id1 );
1226 if( lifetime_arg != -1 )
1227 psa_set_key_lifetime( &attributes, lifetime );
1228 if( id2_arg != -1 )
1229 psa_set_key_id( &attributes, id2 );
1230
1231 TEST_EQUAL( psa_get_key_id( &attributes ), expected_id );
1232 TEST_EQUAL( psa_get_key_lifetime( &attributes ), expected_lifetime );
1233}
1234/* END_CASE */
1235
Gilles Peskine5fe5e272019-08-02 20:30:01 +02001236/* BEGIN_CASE depends_on:MBEDTLS_PSA_CRYPTO_SE_C */
1237void slot_number_attribute( )
1238{
1239 psa_key_slot_number_t slot_number = 0xdeadbeef;
1240 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
1241
1242 /* Initially, there is no slot number. */
1243 TEST_EQUAL( psa_get_key_slot_number( &attributes, &slot_number ),
1244 PSA_ERROR_INVALID_ARGUMENT );
1245
1246 /* Test setting a slot number. */
1247 psa_set_key_slot_number( &attributes, 0 );
1248 PSA_ASSERT( psa_get_key_slot_number( &attributes, &slot_number ) );
1249 TEST_EQUAL( slot_number, 0 );
1250
1251 /* Test changing the slot number. */
1252 psa_set_key_slot_number( &attributes, 42 );
1253 PSA_ASSERT( psa_get_key_slot_number( &attributes, &slot_number ) );
1254 TEST_EQUAL( slot_number, 42 );
1255
1256 /* Test clearing the slot number. */
1257 psa_clear_key_slot_number( &attributes );
1258 TEST_EQUAL( psa_get_key_slot_number( &attributes, &slot_number ),
1259 PSA_ERROR_INVALID_ARGUMENT );
1260
1261 /* Clearing again should have no effect. */
1262 psa_clear_key_slot_number( &attributes );
1263 TEST_EQUAL( psa_get_key_slot_number( &attributes, &slot_number ),
1264 PSA_ERROR_INVALID_ARGUMENT );
1265
1266 /* Test that reset clears the slot number. */
1267 psa_set_key_slot_number( &attributes, 42 );
1268 PSA_ASSERT( psa_get_key_slot_number( &attributes, &slot_number ) );
1269 TEST_EQUAL( slot_number, 42 );
1270 psa_reset_key_attributes( &attributes );
1271 TEST_EQUAL( psa_get_key_slot_number( &attributes, &slot_number ),
1272 PSA_ERROR_INVALID_ARGUMENT );
1273}
1274/* END_CASE */
1275
Gilles Peskinedd835cb2019-05-15 16:14:57 +02001276/* BEGIN_CASE */
Gilles Peskine6edfa292019-07-31 15:53:45 +02001277void import_with_policy( int type_arg,
1278 int usage_arg, int alg_arg,
1279 int expected_status_arg )
1280{
1281 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
1282 psa_key_attributes_t got_attributes = PSA_KEY_ATTRIBUTES_INIT;
1283 psa_key_handle_t handle = 0;
1284 psa_key_type_t type = type_arg;
1285 psa_key_usage_t usage = usage_arg;
1286 psa_algorithm_t alg = alg_arg;
1287 psa_status_t expected_status = expected_status_arg;
1288 const uint8_t key_material[16] = {0};
1289 psa_status_t status;
1290
1291 PSA_ASSERT( psa_crypto_init( ) );
1292
1293 psa_set_key_type( &attributes, type );
1294 psa_set_key_usage_flags( &attributes, usage );
1295 psa_set_key_algorithm( &attributes, alg );
1296
1297 status = psa_import_key( &attributes,
1298 key_material, sizeof( key_material ),
1299 &handle );
1300 TEST_EQUAL( status, expected_status );
1301 if( status != PSA_SUCCESS )
1302 goto exit;
1303
1304 PSA_ASSERT( psa_get_key_attributes( handle, &got_attributes ) );
1305 TEST_EQUAL( psa_get_key_type( &got_attributes ), type );
1306 TEST_EQUAL( psa_get_key_usage_flags( &got_attributes ), usage );
1307 TEST_EQUAL( psa_get_key_algorithm( &got_attributes ), alg );
Gilles Peskine5fe5e272019-08-02 20:30:01 +02001308 ASSERT_NO_SLOT_NUMBER( &got_attributes );
Gilles Peskine6edfa292019-07-31 15:53:45 +02001309
1310 PSA_ASSERT( psa_destroy_key( handle ) );
1311 test_operations_on_invalid_handle( handle );
1312
1313exit:
1314 psa_destroy_key( handle );
1315 psa_reset_key_attributes( &got_attributes );
1316 PSA_DONE( );
1317}
1318/* END_CASE */
1319
1320/* BEGIN_CASE */
1321void import_with_data( data_t *data, int type_arg,
1322 int attr_bits_arg,
1323 int expected_status_arg )
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001324{
1325 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
1326 psa_key_attributes_t got_attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001327 psa_key_handle_t handle = 0;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001328 psa_key_type_t type = type_arg;
Gilles Peskine8fb3a9e2019-05-03 16:59:21 +02001329 size_t attr_bits = attr_bits_arg;
Gilles Peskineb866e2b2018-06-21 09:25:10 +02001330 psa_status_t expected_status = expected_status_arg;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001331 psa_status_t status;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001332
Gilles Peskine8817f612018-12-18 00:18:46 +01001333 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001334
Gilles Peskine4747d192019-04-17 15:05:45 +02001335 psa_set_key_type( &attributes, type );
Gilles Peskine8fb3a9e2019-05-03 16:59:21 +02001336 psa_set_key_bits( &attributes, attr_bits );
Gilles Peskine6edfa292019-07-31 15:53:45 +02001337
Gilles Peskine73676cb2019-05-15 20:15:10 +02001338 status = psa_import_key( &attributes, data->x, data->len, &handle );
Gilles Peskinefe11b722018-12-18 00:24:04 +01001339 TEST_EQUAL( status, expected_status );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001340 if( status != PSA_SUCCESS )
1341 goto exit;
1342
1343 PSA_ASSERT( psa_get_key_attributes( handle, &got_attributes ) );
1344 TEST_EQUAL( psa_get_key_type( &got_attributes ), type );
Gilles Peskine8fb3a9e2019-05-03 16:59:21 +02001345 if( attr_bits != 0 )
Gilles Peskine7e0cff92019-07-30 13:48:52 +02001346 TEST_EQUAL( attr_bits, psa_get_key_bits( &got_attributes ) );
Gilles Peskine5fe5e272019-08-02 20:30:01 +02001347 ASSERT_NO_SLOT_NUMBER( &got_attributes );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001348
1349 PSA_ASSERT( psa_destroy_key( handle ) );
Gilles Peskine4cf3a432019-04-18 22:28:52 +02001350 test_operations_on_invalid_handle( handle );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001351
1352exit:
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001353 psa_destroy_key( handle );
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02001354 psa_reset_key_attributes( &got_attributes );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02001355 PSA_DONE( );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001356}
1357/* END_CASE */
1358
1359/* BEGIN_CASE */
Gilles Peskinec744d992019-07-30 17:26:54 +02001360void import_large_key( int type_arg, int byte_size_arg,
1361 int expected_status_arg )
1362{
1363 psa_key_type_t type = type_arg;
1364 size_t byte_size = byte_size_arg;
1365 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
1366 psa_status_t expected_status = expected_status_arg;
1367 psa_key_handle_t handle = 0;
1368 psa_status_t status;
1369 uint8_t *buffer = NULL;
1370 size_t buffer_size = byte_size + 1;
1371 size_t n;
1372
1373 /* It would be better to skip the test than fail it if the allocation
1374 * fails, but the test framework doesn't support this yet. */
1375 ASSERT_ALLOC( buffer, buffer_size );
1376 memset( buffer, 'K', byte_size );
1377
1378 PSA_ASSERT( psa_crypto_init( ) );
1379
1380 /* Try importing the key */
1381 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_EXPORT );
1382 psa_set_key_type( &attributes, type );
1383 status = psa_import_key( &attributes, buffer, byte_size, &handle );
1384 TEST_EQUAL( status, expected_status );
1385
1386 if( status == PSA_SUCCESS )
1387 {
1388 PSA_ASSERT( psa_get_key_attributes( handle, &attributes ) );
1389 TEST_EQUAL( psa_get_key_type( &attributes ), type );
1390 TEST_EQUAL( psa_get_key_bits( &attributes ),
1391 PSA_BYTES_TO_BITS( byte_size ) );
Gilles Peskine5fe5e272019-08-02 20:30:01 +02001392 ASSERT_NO_SLOT_NUMBER( &attributes );
Gilles Peskinec744d992019-07-30 17:26:54 +02001393 memset( buffer, 0, byte_size + 1 );
1394 PSA_ASSERT( psa_export_key( handle, buffer, byte_size, &n ) );
1395 for( n = 0; n < byte_size; n++ )
1396 TEST_EQUAL( buffer[n], 'K' );
1397 for( n = byte_size; n < buffer_size; n++ )
1398 TEST_EQUAL( buffer[n], 0 );
1399 }
1400
1401exit:
1402 psa_destroy_key( handle );
1403 PSA_DONE( );
1404 mbedtls_free( buffer );
1405}
1406/* END_CASE */
1407
1408/* BEGIN_CASE */
Gilles Peskine0b352bc2018-06-28 00:16:11 +02001409void import_rsa_made_up( int bits_arg, int keypair, int expected_status_arg )
1410{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001411 psa_key_handle_t handle = 0;
Gilles Peskine0b352bc2018-06-28 00:16:11 +02001412 size_t bits = bits_arg;
1413 psa_status_t expected_status = expected_status_arg;
1414 psa_status_t status;
1415 psa_key_type_t type =
Gilles Peskinec93b80c2019-05-16 19:39:54 +02001416 keypair ? PSA_KEY_TYPE_RSA_KEY_PAIR : PSA_KEY_TYPE_RSA_PUBLIC_KEY;
Gilles Peskine0b352bc2018-06-28 00:16:11 +02001417 size_t buffer_size = /* Slight overapproximations */
1418 keypair ? bits * 9 / 16 + 80 : bits / 8 + 20;
Gilles Peskine8cebbba2018-09-27 13:54:18 +02001419 unsigned char *buffer = NULL;
Gilles Peskine0b352bc2018-06-28 00:16:11 +02001420 unsigned char *p;
1421 int ret;
1422 size_t length;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02001423 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine0b352bc2018-06-28 00:16:11 +02001424
Gilles Peskine8817f612018-12-18 00:18:46 +01001425 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02001426 ASSERT_ALLOC( buffer, buffer_size );
Gilles Peskine0b352bc2018-06-28 00:16:11 +02001427
1428 TEST_ASSERT( ( ret = construct_fake_rsa_key( buffer, buffer_size, &p,
1429 bits, keypair ) ) >= 0 );
1430 length = ret;
1431
1432 /* Try importing the key */
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02001433 psa_set_key_type( &attributes, type );
Gilles Peskine73676cb2019-05-15 20:15:10 +02001434 status = psa_import_key( &attributes, p, length, &handle );
Gilles Peskinefe11b722018-12-18 00:24:04 +01001435 TEST_EQUAL( status, expected_status );
Gilles Peskine76b29a72019-05-28 14:08:50 +02001436
Gilles Peskine0b352bc2018-06-28 00:16:11 +02001437 if( status == PSA_SUCCESS )
Gilles Peskine8817f612018-12-18 00:18:46 +01001438 PSA_ASSERT( psa_destroy_key( handle ) );
Gilles Peskine0b352bc2018-06-28 00:16:11 +02001439
1440exit:
1441 mbedtls_free( buffer );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02001442 PSA_DONE( );
Gilles Peskine0b352bc2018-06-28 00:16:11 +02001443}
1444/* END_CASE */
1445
1446/* BEGIN_CASE */
itayzafrir3e02b3b2018-06-12 17:06:52 +03001447void import_export( data_t *data,
Moran Pekera964a8f2018-06-04 18:42:36 +03001448 int type_arg,
Gilles Peskine1ecf92c22019-05-24 15:00:06 +02001449 int usage_arg, int alg_arg,
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001450 int expected_bits,
1451 int export_size_delta,
Gilles Peskineb866e2b2018-06-21 09:25:10 +02001452 int expected_export_status_arg,
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001453 int canonical_input )
1454{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001455 psa_key_handle_t handle = 0;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001456 psa_key_type_t type = type_arg;
Gilles Peskine4abf7412018-06-18 16:35:34 +02001457 psa_algorithm_t alg = alg_arg;
Gilles Peskineb866e2b2018-06-21 09:25:10 +02001458 psa_status_t expected_export_status = expected_export_status_arg;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001459 psa_status_t status;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001460 unsigned char *exported = NULL;
1461 unsigned char *reexported = NULL;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001462 size_t export_size;
Jaeden Amerof24c7f82018-06-27 17:20:43 +01001463 size_t exported_length = INVALID_EXPORT_LENGTH;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001464 size_t reexported_length;
Gilles Peskine4747d192019-04-17 15:05:45 +02001465 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001466 psa_key_attributes_t got_attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001467
Moran Pekercb088e72018-07-17 17:36:59 +03001468 export_size = (ptrdiff_t) data->len + export_size_delta;
Gilles Peskine8cebbba2018-09-27 13:54:18 +02001469 ASSERT_ALLOC( exported, export_size );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001470 if( ! canonical_input )
Gilles Peskine8cebbba2018-09-27 13:54:18 +02001471 ASSERT_ALLOC( reexported, export_size );
Gilles Peskine8817f612018-12-18 00:18:46 +01001472 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001473
Gilles Peskine4747d192019-04-17 15:05:45 +02001474 psa_set_key_usage_flags( &attributes, usage_arg );
1475 psa_set_key_algorithm( &attributes, alg );
1476 psa_set_key_type( &attributes, type );
mohammad1603a97cb8c2018-03-28 03:46:26 -07001477
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001478 /* Import the key */
Gilles Peskine73676cb2019-05-15 20:15:10 +02001479 PSA_ASSERT( psa_import_key( &attributes, data->x, data->len, &handle ) );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001480
1481 /* Test the key information */
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001482 PSA_ASSERT( psa_get_key_attributes( handle, &got_attributes ) );
1483 TEST_EQUAL( psa_get_key_type( &got_attributes ), type );
1484 TEST_EQUAL( psa_get_key_bits( &got_attributes ), (size_t) expected_bits );
Gilles Peskine5fe5e272019-08-02 20:30:01 +02001485 ASSERT_NO_SLOT_NUMBER( &got_attributes );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001486
1487 /* Export the key */
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001488 status = psa_export_key( handle,
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001489 exported, export_size,
1490 &exported_length );
Gilles Peskinefe11b722018-12-18 00:24:04 +01001491 TEST_EQUAL( status, expected_export_status );
Jaeden Amerof24c7f82018-06-27 17:20:43 +01001492
1493 /* The exported length must be set by psa_export_key() to a value between 0
1494 * and export_size. On errors, the exported length must be 0. */
1495 TEST_ASSERT( exported_length != INVALID_EXPORT_LENGTH );
1496 TEST_ASSERT( status == PSA_SUCCESS || exported_length == 0 );
1497 TEST_ASSERT( exported_length <= export_size );
1498
Gilles Peskinea7aa4422018-08-14 15:17:54 +02001499 TEST_ASSERT( mem_is_char( exported + exported_length, 0,
Gilles Peskine3f669c32018-06-21 09:21:51 +02001500 export_size - exported_length ) );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001501 if( status != PSA_SUCCESS )
Gilles Peskinee66ca3b2018-06-20 00:11:45 +02001502 {
Gilles Peskinefe11b722018-12-18 00:24:04 +01001503 TEST_EQUAL( exported_length, 0 );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001504 goto destroy;
Gilles Peskinee66ca3b2018-06-20 00:11:45 +02001505 }
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001506
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001507 if( ! exercise_export_key( handle, usage_arg ) )
Gilles Peskine8f609232018-08-11 01:24:55 +02001508 goto exit;
1509
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001510 if( canonical_input )
Gilles Peskinebd7dea92018-09-27 13:57:19 +02001511 ASSERT_COMPARE( data->x, data->len, exported, exported_length );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001512 else
1513 {
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001514 psa_key_handle_t handle2;
Gilles Peskine049c7532019-05-15 20:22:09 +02001515 PSA_ASSERT( psa_import_key( &attributes, exported, exported_length,
1516 &handle2 ) );
Gilles Peskine8817f612018-12-18 00:18:46 +01001517 PSA_ASSERT( psa_export_key( handle2,
1518 reexported,
1519 export_size,
1520 &reexported_length ) );
Gilles Peskinebd7dea92018-09-27 13:57:19 +02001521 ASSERT_COMPARE( exported, exported_length,
1522 reexported, reexported_length );
Gilles Peskine8817f612018-12-18 00:18:46 +01001523 PSA_ASSERT( psa_close_key( handle2 ) );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001524 }
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001525 TEST_ASSERT( exported_length <= PSA_KEY_EXPORT_MAX_SIZE( type, psa_get_key_bits( &got_attributes ) ) );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001526
1527destroy:
1528 /* Destroy the key */
Gilles Peskine8817f612018-12-18 00:18:46 +01001529 PSA_ASSERT( psa_destroy_key( handle ) );
Gilles Peskine4cf3a432019-04-18 22:28:52 +02001530 test_operations_on_invalid_handle( handle );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001531
1532exit:
itayzafrir3e02b3b2018-06-12 17:06:52 +03001533 mbedtls_free( exported );
1534 mbedtls_free( reexported );
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02001535 psa_reset_key_attributes( &got_attributes );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02001536 PSA_DONE( );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001537}
1538/* END_CASE */
Gilles Peskine20035e32018-02-03 22:44:14 +01001539
Moran Pekerf709f4a2018-06-06 17:26:04 +03001540/* BEGIN_CASE */
itayzafrir3e02b3b2018-06-12 17:06:52 +03001541void import_export_public_key( data_t *data,
Gilles Peskine2d277862018-06-18 15:41:12 +02001542 int type_arg,
1543 int alg_arg,
Gilles Peskine49c25912018-10-29 15:15:31 +01001544 int export_size_delta,
1545 int expected_export_status_arg,
1546 data_t *expected_public_key )
Moran Pekerf709f4a2018-06-06 17:26:04 +03001547{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001548 psa_key_handle_t handle = 0;
Moran Pekerf709f4a2018-06-06 17:26:04 +03001549 psa_key_type_t type = type_arg;
Gilles Peskine4abf7412018-06-18 16:35:34 +02001550 psa_algorithm_t alg = alg_arg;
Gilles Peskineb866e2b2018-06-21 09:25:10 +02001551 psa_status_t expected_export_status = expected_export_status_arg;
Moran Pekerf709f4a2018-06-06 17:26:04 +03001552 psa_status_t status;
Moran Pekerf709f4a2018-06-06 17:26:04 +03001553 unsigned char *exported = NULL;
Gilles Peskine49c25912018-10-29 15:15:31 +01001554 size_t export_size = expected_public_key->len + export_size_delta;
Jaeden Amero2a671e92018-06-27 17:47:40 +01001555 size_t exported_length = INVALID_EXPORT_LENGTH;
Gilles Peskine4747d192019-04-17 15:05:45 +02001556 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Moran Pekerf709f4a2018-06-06 17:26:04 +03001557
Gilles Peskine8817f612018-12-18 00:18:46 +01001558 PSA_ASSERT( psa_crypto_init( ) );
Moran Pekerf709f4a2018-06-06 17:26:04 +03001559
Gilles Peskine4747d192019-04-17 15:05:45 +02001560 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_EXPORT );
1561 psa_set_key_algorithm( &attributes, alg );
1562 psa_set_key_type( &attributes, type );
Moran Pekerf709f4a2018-06-06 17:26:04 +03001563
1564 /* Import the key */
Gilles Peskine73676cb2019-05-15 20:15:10 +02001565 PSA_ASSERT( psa_import_key( &attributes, data->x, data->len, &handle ) );
Moran Pekerf709f4a2018-06-06 17:26:04 +03001566
Gilles Peskine49c25912018-10-29 15:15:31 +01001567 /* Export the public key */
1568 ASSERT_ALLOC( exported, export_size );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001569 status = psa_export_public_key( handle,
Gilles Peskine2d277862018-06-18 15:41:12 +02001570 exported, export_size,
1571 &exported_length );
Gilles Peskinefe11b722018-12-18 00:24:04 +01001572 TEST_EQUAL( status, expected_export_status );
Gilles Peskine49c25912018-10-29 15:15:31 +01001573 if( status == PSA_SUCCESS )
Gilles Peskined8b7d4f2018-10-29 15:18:41 +01001574 {
Gilles Peskinec93b80c2019-05-16 19:39:54 +02001575 psa_key_type_t public_type = PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR( type );
Gilles Peskined8b7d4f2018-10-29 15:18:41 +01001576 size_t bits;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001577 PSA_ASSERT( psa_get_key_attributes( handle, &attributes ) );
1578 bits = psa_get_key_bits( &attributes );
Gilles Peskined8b7d4f2018-10-29 15:18:41 +01001579 TEST_ASSERT( expected_public_key->len <=
1580 PSA_KEY_EXPORT_MAX_SIZE( public_type, bits ) );
Gilles Peskine49c25912018-10-29 15:15:31 +01001581 ASSERT_COMPARE( expected_public_key->x, expected_public_key->len,
1582 exported, exported_length );
Gilles Peskined8b7d4f2018-10-29 15:18:41 +01001583 }
Moran Pekerf709f4a2018-06-06 17:26:04 +03001584
1585exit:
itayzafrir3e02b3b2018-06-12 17:06:52 +03001586 mbedtls_free( exported );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001587 psa_destroy_key( handle );
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02001588 psa_reset_key_attributes( &attributes );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02001589 PSA_DONE( );
Moran Pekerf709f4a2018-06-06 17:26:04 +03001590}
1591/* END_CASE */
1592
Gilles Peskine20035e32018-02-03 22:44:14 +01001593/* BEGIN_CASE */
Gilles Peskinea680c7a2018-06-26 16:12:43 +02001594void import_and_exercise_key( data_t *data,
1595 int type_arg,
1596 int bits_arg,
1597 int alg_arg )
1598{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001599 psa_key_handle_t handle = 0;
Gilles Peskinea680c7a2018-06-26 16:12:43 +02001600 psa_key_type_t type = type_arg;
1601 size_t bits = bits_arg;
1602 psa_algorithm_t alg = alg_arg;
Gilles Peskine10df3412018-10-25 22:35:43 +02001603 psa_key_usage_t usage = usage_to_exercise( type, alg );
Gilles Peskine4747d192019-04-17 15:05:45 +02001604 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001605 psa_key_attributes_t got_attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskinea680c7a2018-06-26 16:12:43 +02001606
Gilles Peskine8817f612018-12-18 00:18:46 +01001607 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskinea680c7a2018-06-26 16:12:43 +02001608
Gilles Peskine4747d192019-04-17 15:05:45 +02001609 psa_set_key_usage_flags( &attributes, usage );
1610 psa_set_key_algorithm( &attributes, alg );
1611 psa_set_key_type( &attributes, type );
Gilles Peskinea680c7a2018-06-26 16:12:43 +02001612
1613 /* Import the key */
Gilles Peskine73676cb2019-05-15 20:15:10 +02001614 PSA_ASSERT( psa_import_key( &attributes, data->x, data->len, &handle ) );
Gilles Peskinea680c7a2018-06-26 16:12:43 +02001615
1616 /* Test the key information */
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001617 PSA_ASSERT( psa_get_key_attributes( handle, &got_attributes ) );
1618 TEST_EQUAL( psa_get_key_type( &got_attributes ), type );
1619 TEST_EQUAL( psa_get_key_bits( &got_attributes ), bits );
Gilles Peskinea680c7a2018-06-26 16:12:43 +02001620
1621 /* Do something with the key according to its type and permitted usage. */
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001622 if( ! exercise_key( handle, usage, alg ) )
Gilles Peskine02b75072018-07-01 22:31:34 +02001623 goto exit;
Gilles Peskinea680c7a2018-06-26 16:12:43 +02001624
Gilles Peskine4cf3a432019-04-18 22:28:52 +02001625 PSA_ASSERT( psa_destroy_key( handle ) );
1626 test_operations_on_invalid_handle( handle );
1627
Gilles Peskinea680c7a2018-06-26 16:12:43 +02001628exit:
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001629 psa_destroy_key( handle );
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02001630 psa_reset_key_attributes( &got_attributes );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02001631 PSA_DONE( );
Gilles Peskinea680c7a2018-06-26 16:12:43 +02001632}
1633/* END_CASE */
1634
1635/* BEGIN_CASE */
Gilles Peskined5b33222018-06-18 22:20:03 +02001636void key_policy( int usage_arg, int alg_arg )
1637{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001638 psa_key_handle_t handle = 0;
Gilles Peskined5b33222018-06-18 22:20:03 +02001639 psa_algorithm_t alg = alg_arg;
1640 psa_key_usage_t usage = usage_arg;
1641 psa_key_type_t key_type = PSA_KEY_TYPE_AES;
1642 unsigned char key[32] = {0};
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001643 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskined5b33222018-06-18 22:20:03 +02001644
1645 memset( key, 0x2a, sizeof( key ) );
1646
Gilles Peskine8817f612018-12-18 00:18:46 +01001647 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskined5b33222018-06-18 22:20:03 +02001648
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001649 psa_set_key_usage_flags( &attributes, usage );
1650 psa_set_key_algorithm( &attributes, alg );
1651 psa_set_key_type( &attributes, key_type );
Gilles Peskined5b33222018-06-18 22:20:03 +02001652
Gilles Peskine73676cb2019-05-15 20:15:10 +02001653 PSA_ASSERT( psa_import_key( &attributes, key, sizeof( key ), &handle ) );
Gilles Peskined5b33222018-06-18 22:20:03 +02001654
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001655 PSA_ASSERT( psa_get_key_attributes( handle, &attributes ) );
1656 TEST_EQUAL( psa_get_key_type( &attributes ), key_type );
1657 TEST_EQUAL( psa_get_key_usage_flags( &attributes ), usage );
1658 TEST_EQUAL( psa_get_key_algorithm( &attributes ), alg );
Gilles Peskined5b33222018-06-18 22:20:03 +02001659
1660exit:
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001661 psa_destroy_key( handle );
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02001662 psa_reset_key_attributes( &attributes );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02001663 PSA_DONE( );
Gilles Peskined5b33222018-06-18 22:20:03 +02001664}
1665/* END_CASE */
1666
1667/* BEGIN_CASE */
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02001668void key_attributes_init( )
Jaeden Amero70261c52019-01-04 11:47:20 +00001669{
1670 /* Test each valid way of initializing the object, except for `= {0}`, as
1671 * Clang 5 complains when `-Wmissing-field-initializers` is used, even
1672 * though it's OK by the C standard. We could test for this, but we'd need
1673 * to supress the Clang warning for the test. */
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02001674 psa_key_attributes_t func = psa_key_attributes_init( );
1675 psa_key_attributes_t init = PSA_KEY_ATTRIBUTES_INIT;
1676 psa_key_attributes_t zero;
Jaeden Amero70261c52019-01-04 11:47:20 +00001677
1678 memset( &zero, 0, sizeof( zero ) );
1679
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02001680 TEST_EQUAL( psa_get_key_lifetime( &func ), PSA_KEY_LIFETIME_VOLATILE );
1681 TEST_EQUAL( psa_get_key_lifetime( &init ), PSA_KEY_LIFETIME_VOLATILE );
1682 TEST_EQUAL( psa_get_key_lifetime( &zero ), PSA_KEY_LIFETIME_VOLATILE );
Jaeden Amero5229bbb2019-02-07 16:33:37 +00001683
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02001684 TEST_EQUAL( psa_get_key_type( &func ), 0 );
1685 TEST_EQUAL( psa_get_key_type( &init ), 0 );
1686 TEST_EQUAL( psa_get_key_type( &zero ), 0 );
1687
1688 TEST_EQUAL( psa_get_key_bits( &func ), 0 );
1689 TEST_EQUAL( psa_get_key_bits( &init ), 0 );
1690 TEST_EQUAL( psa_get_key_bits( &zero ), 0 );
1691
1692 TEST_EQUAL( psa_get_key_usage_flags( &func ), 0 );
1693 TEST_EQUAL( psa_get_key_usage_flags( &init ), 0 );
1694 TEST_EQUAL( psa_get_key_usage_flags( &zero ), 0 );
1695
1696 TEST_EQUAL( psa_get_key_algorithm( &func ), 0 );
1697 TEST_EQUAL( psa_get_key_algorithm( &init ), 0 );
1698 TEST_EQUAL( psa_get_key_algorithm( &zero ), 0 );
Jaeden Amero70261c52019-01-04 11:47:20 +00001699}
1700/* END_CASE */
1701
1702/* BEGIN_CASE */
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001703void mac_key_policy( int policy_usage,
1704 int policy_alg,
1705 int key_type,
1706 data_t *key_data,
1707 int exercise_alg )
Gilles Peskined5b33222018-06-18 22:20:03 +02001708{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001709 psa_key_handle_t handle = 0;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02001710 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Jaeden Amero769ce272019-01-04 11:48:03 +00001711 psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT;
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001712 psa_status_t status;
1713 unsigned char mac[PSA_MAC_MAX_SIZE];
Gilles Peskined5b33222018-06-18 22:20:03 +02001714
Gilles Peskine8817f612018-12-18 00:18:46 +01001715 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskined5b33222018-06-18 22:20:03 +02001716
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02001717 psa_set_key_usage_flags( &attributes, policy_usage );
1718 psa_set_key_algorithm( &attributes, policy_alg );
1719 psa_set_key_type( &attributes, key_type );
Gilles Peskined5b33222018-06-18 22:20:03 +02001720
Gilles Peskine049c7532019-05-15 20:22:09 +02001721 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
1722 &handle ) );
Gilles Peskined5b33222018-06-18 22:20:03 +02001723
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001724 status = psa_mac_sign_setup( &operation, handle, exercise_alg );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001725 if( policy_alg == exercise_alg &&
1726 ( policy_usage & PSA_KEY_USAGE_SIGN ) != 0 )
Gilles Peskine8817f612018-12-18 00:18:46 +01001727 PSA_ASSERT( status );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001728 else
Gilles Peskinefe11b722018-12-18 00:24:04 +01001729 TEST_EQUAL( status, PSA_ERROR_NOT_PERMITTED );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001730 psa_mac_abort( &operation );
Gilles Peskined5b33222018-06-18 22:20:03 +02001731
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001732 memset( mac, 0, sizeof( mac ) );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001733 status = psa_mac_verify_setup( &operation, handle, exercise_alg );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001734 if( policy_alg == exercise_alg &&
1735 ( policy_usage & PSA_KEY_USAGE_VERIFY ) != 0 )
Gilles Peskine8817f612018-12-18 00:18:46 +01001736 PSA_ASSERT( status );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001737 else
Gilles Peskinefe11b722018-12-18 00:24:04 +01001738 TEST_EQUAL( status, PSA_ERROR_NOT_PERMITTED );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001739
1740exit:
1741 psa_mac_abort( &operation );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001742 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02001743 PSA_DONE( );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001744}
1745/* END_CASE */
1746
1747/* BEGIN_CASE */
1748void cipher_key_policy( int policy_usage,
1749 int policy_alg,
1750 int key_type,
1751 data_t *key_data,
1752 int exercise_alg )
1753{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001754 psa_key_handle_t handle = 0;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02001755 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Jaeden Amero5bae2272019-01-04 11:48:27 +00001756 psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT;
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001757 psa_status_t status;
1758
Gilles Peskine8817f612018-12-18 00:18:46 +01001759 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001760
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02001761 psa_set_key_usage_flags( &attributes, policy_usage );
1762 psa_set_key_algorithm( &attributes, policy_alg );
1763 psa_set_key_type( &attributes, key_type );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001764
Gilles Peskine049c7532019-05-15 20:22:09 +02001765 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
1766 &handle ) );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001767
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001768 status = psa_cipher_encrypt_setup( &operation, handle, exercise_alg );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001769 if( policy_alg == exercise_alg &&
1770 ( policy_usage & PSA_KEY_USAGE_ENCRYPT ) != 0 )
Gilles Peskine8817f612018-12-18 00:18:46 +01001771 PSA_ASSERT( status );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001772 else
Gilles Peskinefe11b722018-12-18 00:24:04 +01001773 TEST_EQUAL( status, PSA_ERROR_NOT_PERMITTED );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001774 psa_cipher_abort( &operation );
1775
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001776 status = psa_cipher_decrypt_setup( &operation, handle, exercise_alg );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001777 if( policy_alg == exercise_alg &&
1778 ( policy_usage & PSA_KEY_USAGE_DECRYPT ) != 0 )
Gilles Peskine8817f612018-12-18 00:18:46 +01001779 PSA_ASSERT( status );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001780 else
Gilles Peskinefe11b722018-12-18 00:24:04 +01001781 TEST_EQUAL( status, PSA_ERROR_NOT_PERMITTED );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001782
1783exit:
1784 psa_cipher_abort( &operation );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001785 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02001786 PSA_DONE( );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001787}
1788/* END_CASE */
1789
1790/* BEGIN_CASE */
1791void aead_key_policy( int policy_usage,
1792 int policy_alg,
1793 int key_type,
1794 data_t *key_data,
1795 int nonce_length_arg,
1796 int tag_length_arg,
1797 int exercise_alg )
1798{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001799 psa_key_handle_t handle = 0;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02001800 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001801 psa_status_t status;
1802 unsigned char nonce[16] = {0};
1803 size_t nonce_length = nonce_length_arg;
1804 unsigned char tag[16];
1805 size_t tag_length = tag_length_arg;
1806 size_t output_length;
1807
1808 TEST_ASSERT( nonce_length <= sizeof( nonce ) );
1809 TEST_ASSERT( tag_length <= sizeof( tag ) );
1810
Gilles Peskine8817f612018-12-18 00:18:46 +01001811 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001812
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02001813 psa_set_key_usage_flags( &attributes, policy_usage );
1814 psa_set_key_algorithm( &attributes, policy_alg );
1815 psa_set_key_type( &attributes, key_type );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001816
Gilles Peskine049c7532019-05-15 20:22:09 +02001817 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
1818 &handle ) );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001819
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001820 status = psa_aead_encrypt( handle, exercise_alg,
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001821 nonce, nonce_length,
1822 NULL, 0,
1823 NULL, 0,
1824 tag, tag_length,
1825 &output_length );
1826 if( policy_alg == exercise_alg &&
1827 ( policy_usage & PSA_KEY_USAGE_ENCRYPT ) != 0 )
Gilles Peskine8817f612018-12-18 00:18:46 +01001828 PSA_ASSERT( status );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001829 else
Gilles Peskinefe11b722018-12-18 00:24:04 +01001830 TEST_EQUAL( status, PSA_ERROR_NOT_PERMITTED );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001831
1832 memset( tag, 0, sizeof( tag ) );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001833 status = psa_aead_decrypt( handle, exercise_alg,
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001834 nonce, nonce_length,
1835 NULL, 0,
1836 tag, tag_length,
1837 NULL, 0,
1838 &output_length );
1839 if( policy_alg == exercise_alg &&
1840 ( policy_usage & PSA_KEY_USAGE_DECRYPT ) != 0 )
Gilles Peskinefe11b722018-12-18 00:24:04 +01001841 TEST_EQUAL( status, PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001842 else
Gilles Peskinefe11b722018-12-18 00:24:04 +01001843 TEST_EQUAL( status, PSA_ERROR_NOT_PERMITTED );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001844
1845exit:
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001846 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02001847 PSA_DONE( );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001848}
1849/* END_CASE */
1850
1851/* BEGIN_CASE */
1852void asymmetric_encryption_key_policy( int policy_usage,
1853 int policy_alg,
1854 int key_type,
1855 data_t *key_data,
1856 int exercise_alg )
1857{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001858 psa_key_handle_t handle = 0;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02001859 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001860 psa_status_t status;
1861 size_t key_bits;
1862 size_t buffer_length;
1863 unsigned char *buffer = NULL;
1864 size_t output_length;
1865
Gilles Peskine8817f612018-12-18 00:18:46 +01001866 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001867
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02001868 psa_set_key_usage_flags( &attributes, policy_usage );
1869 psa_set_key_algorithm( &attributes, policy_alg );
1870 psa_set_key_type( &attributes, key_type );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001871
Gilles Peskine049c7532019-05-15 20:22:09 +02001872 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
1873 &handle ) );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001874
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001875 PSA_ASSERT( psa_get_key_attributes( handle, &attributes ) );
1876 key_bits = psa_get_key_bits( &attributes );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001877 buffer_length = PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE( key_type, key_bits,
1878 exercise_alg );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02001879 ASSERT_ALLOC( buffer, buffer_length );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001880
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001881 status = psa_asymmetric_encrypt( handle, exercise_alg,
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001882 NULL, 0,
1883 NULL, 0,
1884 buffer, buffer_length,
1885 &output_length );
1886 if( policy_alg == exercise_alg &&
1887 ( policy_usage & PSA_KEY_USAGE_ENCRYPT ) != 0 )
Gilles Peskine8817f612018-12-18 00:18:46 +01001888 PSA_ASSERT( status );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001889 else
Gilles Peskinefe11b722018-12-18 00:24:04 +01001890 TEST_EQUAL( status, PSA_ERROR_NOT_PERMITTED );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001891
Gilles Peskinef7ab5ad2018-09-26 18:19:24 +02001892 if( buffer_length != 0 )
1893 memset( buffer, 0, buffer_length );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001894 status = psa_asymmetric_decrypt( handle, exercise_alg,
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001895 buffer, buffer_length,
1896 NULL, 0,
1897 buffer, buffer_length,
1898 &output_length );
1899 if( policy_alg == exercise_alg &&
1900 ( policy_usage & PSA_KEY_USAGE_DECRYPT ) != 0 )
Gilles Peskinefe11b722018-12-18 00:24:04 +01001901 TEST_EQUAL( status, PSA_ERROR_INVALID_PADDING );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001902 else
Gilles Peskinefe11b722018-12-18 00:24:04 +01001903 TEST_EQUAL( status, PSA_ERROR_NOT_PERMITTED );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001904
1905exit:
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001906 psa_destroy_key( handle );
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02001907 psa_reset_key_attributes( &attributes );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02001908 PSA_DONE( );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001909 mbedtls_free( buffer );
1910}
1911/* END_CASE */
1912
1913/* BEGIN_CASE */
1914void asymmetric_signature_key_policy( int policy_usage,
1915 int policy_alg,
1916 int key_type,
1917 data_t *key_data,
Gilles Peskine30f77cd2019-01-14 16:06:39 +01001918 int exercise_alg,
1919 int payload_length_arg )
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001920{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001921 psa_key_handle_t handle = 0;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02001922 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001923 psa_status_t status;
Gilles Peskine30f77cd2019-01-14 16:06:39 +01001924 unsigned char payload[PSA_HASH_MAX_SIZE] = {1};
1925 /* If `payload_length_arg > 0`, `exercise_alg` is supposed to be
1926 * compatible with the policy and `payload_length_arg` is supposed to be
1927 * a valid input length to sign. If `payload_length_arg <= 0`,
1928 * `exercise_alg` is supposed to be forbidden by the policy. */
1929 int compatible_alg = payload_length_arg > 0;
1930 size_t payload_length = compatible_alg ? payload_length_arg : 0;
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001931 unsigned char signature[PSA_ASYMMETRIC_SIGNATURE_MAX_SIZE] = {0};
1932 size_t signature_length;
1933
Gilles Peskine8817f612018-12-18 00:18:46 +01001934 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001935
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02001936 psa_set_key_usage_flags( &attributes, policy_usage );
1937 psa_set_key_algorithm( &attributes, policy_alg );
1938 psa_set_key_type( &attributes, key_type );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001939
Gilles Peskine049c7532019-05-15 20:22:09 +02001940 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
1941 &handle ) );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001942
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001943 status = psa_asymmetric_sign( handle, exercise_alg,
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001944 payload, payload_length,
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001945 signature, sizeof( signature ),
1946 &signature_length );
Gilles Peskine30f77cd2019-01-14 16:06:39 +01001947 if( compatible_alg && ( policy_usage & PSA_KEY_USAGE_SIGN ) != 0 )
Gilles Peskine8817f612018-12-18 00:18:46 +01001948 PSA_ASSERT( status );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001949 else
Gilles Peskinefe11b722018-12-18 00:24:04 +01001950 TEST_EQUAL( status, PSA_ERROR_NOT_PERMITTED );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001951
1952 memset( signature, 0, sizeof( signature ) );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001953 status = psa_asymmetric_verify( handle, exercise_alg,
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001954 payload, payload_length,
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001955 signature, sizeof( signature ) );
Gilles Peskine30f77cd2019-01-14 16:06:39 +01001956 if( compatible_alg && ( policy_usage & PSA_KEY_USAGE_VERIFY ) != 0 )
Gilles Peskinefe11b722018-12-18 00:24:04 +01001957 TEST_EQUAL( status, PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001958 else
Gilles Peskinefe11b722018-12-18 00:24:04 +01001959 TEST_EQUAL( status, PSA_ERROR_NOT_PERMITTED );
Gilles Peskined5b33222018-06-18 22:20:03 +02001960
1961exit:
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001962 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02001963 PSA_DONE( );
Gilles Peskined5b33222018-06-18 22:20:03 +02001964}
1965/* END_CASE */
1966
Janos Follathba3fab92019-06-11 14:50:16 +01001967/* BEGIN_CASE */
Gilles Peskineea0fb492018-07-12 17:17:20 +02001968void derive_key_policy( int policy_usage,
1969 int policy_alg,
1970 int key_type,
1971 data_t *key_data,
1972 int exercise_alg )
1973{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001974 psa_key_handle_t handle = 0;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02001975 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02001976 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Gilles Peskineea0fb492018-07-12 17:17:20 +02001977 psa_status_t status;
1978
Gilles Peskine8817f612018-12-18 00:18:46 +01001979 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskineea0fb492018-07-12 17:17:20 +02001980
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02001981 psa_set_key_usage_flags( &attributes, policy_usage );
1982 psa_set_key_algorithm( &attributes, policy_alg );
1983 psa_set_key_type( &attributes, key_type );
Gilles Peskineea0fb492018-07-12 17:17:20 +02001984
Gilles Peskine049c7532019-05-15 20:22:09 +02001985 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
1986 &handle ) );
Gilles Peskineea0fb492018-07-12 17:17:20 +02001987
Janos Follathba3fab92019-06-11 14:50:16 +01001988 PSA_ASSERT( psa_key_derivation_setup( &operation, exercise_alg ) );
1989
1990 if( PSA_ALG_IS_TLS12_PRF( exercise_alg ) ||
1991 PSA_ALG_IS_TLS12_PSK_TO_MS( exercise_alg ) )
Janos Follath0c1ed842019-06-28 13:35:36 +01001992 {
Janos Follathba3fab92019-06-11 14:50:16 +01001993 PSA_ASSERT( psa_key_derivation_input_bytes(
1994 &operation,
1995 PSA_KEY_DERIVATION_INPUT_SEED,
1996 (const uint8_t*) "", 0) );
Janos Follath0c1ed842019-06-28 13:35:36 +01001997 }
Janos Follathba3fab92019-06-11 14:50:16 +01001998
1999 status = psa_key_derivation_input_key( &operation,
2000 PSA_KEY_DERIVATION_INPUT_SECRET,
2001 handle );
2002
Gilles Peskineea0fb492018-07-12 17:17:20 +02002003 if( policy_alg == exercise_alg &&
2004 ( policy_usage & PSA_KEY_USAGE_DERIVE ) != 0 )
Gilles Peskine8817f612018-12-18 00:18:46 +01002005 PSA_ASSERT( status );
Gilles Peskineea0fb492018-07-12 17:17:20 +02002006 else
Gilles Peskinefe11b722018-12-18 00:24:04 +01002007 TEST_EQUAL( status, PSA_ERROR_NOT_PERMITTED );
Gilles Peskineea0fb492018-07-12 17:17:20 +02002008
2009exit:
Gilles Peskine51ae0e42019-05-16 17:31:03 +02002010 psa_key_derivation_abort( &operation );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01002011 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002012 PSA_DONE( );
Gilles Peskineea0fb492018-07-12 17:17:20 +02002013}
2014/* END_CASE */
2015
2016/* BEGIN_CASE */
Gilles Peskine01d718c2018-09-18 12:01:02 +02002017void agreement_key_policy( int policy_usage,
2018 int policy_alg,
2019 int key_type_arg,
2020 data_t *key_data,
2021 int exercise_alg )
2022{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01002023 psa_key_handle_t handle = 0;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02002024 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine01d718c2018-09-18 12:01:02 +02002025 psa_key_type_t key_type = key_type_arg;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02002026 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Gilles Peskine01d718c2018-09-18 12:01:02 +02002027 psa_status_t status;
2028
Gilles Peskine8817f612018-12-18 00:18:46 +01002029 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine01d718c2018-09-18 12:01:02 +02002030
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02002031 psa_set_key_usage_flags( &attributes, policy_usage );
2032 psa_set_key_algorithm( &attributes, policy_alg );
2033 psa_set_key_type( &attributes, key_type );
Gilles Peskine01d718c2018-09-18 12:01:02 +02002034
Gilles Peskine049c7532019-05-15 20:22:09 +02002035 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
2036 &handle ) );
Gilles Peskine01d718c2018-09-18 12:01:02 +02002037
Gilles Peskine51ae0e42019-05-16 17:31:03 +02002038 PSA_ASSERT( psa_key_derivation_setup( &operation, exercise_alg ) );
2039 status = key_agreement_with_self( &operation, handle );
Gilles Peskine01d718c2018-09-18 12:01:02 +02002040
Gilles Peskine01d718c2018-09-18 12:01:02 +02002041 if( policy_alg == exercise_alg &&
2042 ( policy_usage & PSA_KEY_USAGE_DERIVE ) != 0 )
Gilles Peskine8817f612018-12-18 00:18:46 +01002043 PSA_ASSERT( status );
Gilles Peskine01d718c2018-09-18 12:01:02 +02002044 else
Gilles Peskinefe11b722018-12-18 00:24:04 +01002045 TEST_EQUAL( status, PSA_ERROR_NOT_PERMITTED );
Gilles Peskine01d718c2018-09-18 12:01:02 +02002046
2047exit:
Gilles Peskine51ae0e42019-05-16 17:31:03 +02002048 psa_key_derivation_abort( &operation );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01002049 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002050 PSA_DONE( );
Gilles Peskine01d718c2018-09-18 12:01:02 +02002051}
2052/* END_CASE */
2053
2054/* BEGIN_CASE */
Gilles Peskine96f0b3b2019-05-10 19:33:38 +02002055void key_policy_alg2( int key_type_arg, data_t *key_data,
2056 int usage_arg, int alg_arg, int alg2_arg )
2057{
2058 psa_key_handle_t handle = 0;
2059 psa_key_type_t key_type = key_type_arg;
2060 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
2061 psa_key_attributes_t got_attributes = PSA_KEY_ATTRIBUTES_INIT;
2062 psa_key_usage_t usage = usage_arg;
2063 psa_algorithm_t alg = alg_arg;
2064 psa_algorithm_t alg2 = alg2_arg;
2065
2066 PSA_ASSERT( psa_crypto_init( ) );
2067
2068 psa_set_key_usage_flags( &attributes, usage );
2069 psa_set_key_algorithm( &attributes, alg );
2070 psa_set_key_enrollment_algorithm( &attributes, alg2 );
2071 psa_set_key_type( &attributes, key_type );
2072 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
2073 &handle ) );
2074
2075 PSA_ASSERT( psa_get_key_attributes( handle, &got_attributes ) );
2076 TEST_EQUAL( psa_get_key_usage_flags( &got_attributes ), usage );
2077 TEST_EQUAL( psa_get_key_algorithm( &got_attributes ), alg );
2078 TEST_EQUAL( psa_get_key_enrollment_algorithm( &got_attributes ), alg2 );
2079
2080 if( ! exercise_key( handle, usage, alg ) )
2081 goto exit;
2082 if( ! exercise_key( handle, usage, alg2 ) )
2083 goto exit;
2084
2085exit:
2086 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002087 PSA_DONE( );
Gilles Peskine96f0b3b2019-05-10 19:33:38 +02002088}
2089/* END_CASE */
2090
2091/* BEGIN_CASE */
Gilles Peskine04ee2d22019-04-11 21:25:46 +02002092void raw_agreement_key_policy( int policy_usage,
2093 int policy_alg,
2094 int key_type_arg,
2095 data_t *key_data,
2096 int exercise_alg )
2097{
2098 psa_key_handle_t handle = 0;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02002099 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine04ee2d22019-04-11 21:25:46 +02002100 psa_key_type_t key_type = key_type_arg;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02002101 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Gilles Peskine04ee2d22019-04-11 21:25:46 +02002102 psa_status_t status;
2103
2104 PSA_ASSERT( psa_crypto_init( ) );
2105
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02002106 psa_set_key_usage_flags( &attributes, policy_usage );
2107 psa_set_key_algorithm( &attributes, policy_alg );
2108 psa_set_key_type( &attributes, key_type );
Gilles Peskine04ee2d22019-04-11 21:25:46 +02002109
Gilles Peskine049c7532019-05-15 20:22:09 +02002110 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
2111 &handle ) );
Gilles Peskine04ee2d22019-04-11 21:25:46 +02002112
2113 status = raw_key_agreement_with_self( exercise_alg, handle );
2114
2115 if( policy_alg == exercise_alg &&
2116 ( policy_usage & PSA_KEY_USAGE_DERIVE ) != 0 )
2117 PSA_ASSERT( status );
2118 else
2119 TEST_EQUAL( status, PSA_ERROR_NOT_PERMITTED );
2120
2121exit:
Gilles Peskine51ae0e42019-05-16 17:31:03 +02002122 psa_key_derivation_abort( &operation );
Gilles Peskine04ee2d22019-04-11 21:25:46 +02002123 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002124 PSA_DONE( );
Gilles Peskine04ee2d22019-04-11 21:25:46 +02002125}
2126/* END_CASE */
2127
2128/* BEGIN_CASE */
Gilles Peskinebcdd44b2019-05-20 17:28:11 +02002129void copy_success( int source_usage_arg,
2130 int source_alg_arg, int source_alg2_arg,
Gilles Peskine4a644642019-05-03 17:14:08 +02002131 int type_arg, data_t *material,
2132 int copy_attributes,
Gilles Peskinebcdd44b2019-05-20 17:28:11 +02002133 int target_usage_arg,
2134 int target_alg_arg, int target_alg2_arg,
2135 int expected_usage_arg,
2136 int expected_alg_arg, int expected_alg2_arg )
Gilles Peskine57ab7212019-01-28 13:03:09 +01002137{
Gilles Peskineca25db92019-04-19 11:43:08 +02002138 psa_key_attributes_t source_attributes = PSA_KEY_ATTRIBUTES_INIT;
2139 psa_key_attributes_t target_attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine57ab7212019-01-28 13:03:09 +01002140 psa_key_usage_t expected_usage = expected_usage_arg;
2141 psa_algorithm_t expected_alg = expected_alg_arg;
Gilles Peskinebcdd44b2019-05-20 17:28:11 +02002142 psa_algorithm_t expected_alg2 = expected_alg2_arg;
Gilles Peskineca25db92019-04-19 11:43:08 +02002143 psa_key_handle_t source_handle = 0;
2144 psa_key_handle_t target_handle = 0;
Gilles Peskine57ab7212019-01-28 13:03:09 +01002145 uint8_t *export_buffer = NULL;
2146
Gilles Peskine57ab7212019-01-28 13:03:09 +01002147 PSA_ASSERT( psa_crypto_init( ) );
2148
Gilles Peskineca25db92019-04-19 11:43:08 +02002149 /* Prepare the source key. */
2150 psa_set_key_usage_flags( &source_attributes, source_usage_arg );
2151 psa_set_key_algorithm( &source_attributes, source_alg_arg );
Gilles Peskinebcdd44b2019-05-20 17:28:11 +02002152 psa_set_key_enrollment_algorithm( &source_attributes, source_alg2_arg );
Gilles Peskineca25db92019-04-19 11:43:08 +02002153 psa_set_key_type( &source_attributes, type_arg );
Gilles Peskine049c7532019-05-15 20:22:09 +02002154 PSA_ASSERT( psa_import_key( &source_attributes,
2155 material->x, material->len,
2156 &source_handle ) );
Gilles Peskineca25db92019-04-19 11:43:08 +02002157 PSA_ASSERT( psa_get_key_attributes( source_handle, &source_attributes ) );
Gilles Peskine57ab7212019-01-28 13:03:09 +01002158
Gilles Peskineca25db92019-04-19 11:43:08 +02002159 /* Prepare the target attributes. */
2160 if( copy_attributes )
2161 target_attributes = source_attributes;
2162 if( target_usage_arg != -1 )
2163 psa_set_key_usage_flags( &target_attributes, target_usage_arg );
2164 if( target_alg_arg != -1 )
2165 psa_set_key_algorithm( &target_attributes, target_alg_arg );
Gilles Peskinebcdd44b2019-05-20 17:28:11 +02002166 if( target_alg2_arg != -1 )
2167 psa_set_key_enrollment_algorithm( &target_attributes, target_alg2_arg );
Gilles Peskine57ab7212019-01-28 13:03:09 +01002168
2169 /* Copy the key. */
Gilles Peskine4a644642019-05-03 17:14:08 +02002170 PSA_ASSERT( psa_copy_key( source_handle,
2171 &target_attributes, &target_handle ) );
Gilles Peskine57ab7212019-01-28 13:03:09 +01002172
2173 /* Destroy the source to ensure that this doesn't affect the target. */
2174 PSA_ASSERT( psa_destroy_key( source_handle ) );
2175
2176 /* Test that the target slot has the expected content and policy. */
Gilles Peskineca25db92019-04-19 11:43:08 +02002177 PSA_ASSERT( psa_get_key_attributes( target_handle, &target_attributes ) );
2178 TEST_EQUAL( psa_get_key_type( &source_attributes ),
2179 psa_get_key_type( &target_attributes ) );
2180 TEST_EQUAL( psa_get_key_bits( &source_attributes ),
2181 psa_get_key_bits( &target_attributes ) );
2182 TEST_EQUAL( expected_usage, psa_get_key_usage_flags( &target_attributes ) );
2183 TEST_EQUAL( expected_alg, psa_get_key_algorithm( &target_attributes ) );
Gilles Peskinebcdd44b2019-05-20 17:28:11 +02002184 TEST_EQUAL( expected_alg2,
2185 psa_get_key_enrollment_algorithm( &target_attributes ) );
Gilles Peskine57ab7212019-01-28 13:03:09 +01002186 if( expected_usage & PSA_KEY_USAGE_EXPORT )
2187 {
2188 size_t length;
2189 ASSERT_ALLOC( export_buffer, material->len );
2190 PSA_ASSERT( psa_export_key( target_handle, export_buffer,
2191 material->len, &length ) );
2192 ASSERT_COMPARE( material->x, material->len,
2193 export_buffer, length );
2194 }
2195 if( ! exercise_key( target_handle, expected_usage, expected_alg ) )
2196 goto exit;
Gilles Peskinebcdd44b2019-05-20 17:28:11 +02002197 if( ! exercise_key( target_handle, expected_usage, expected_alg2 ) )
2198 goto exit;
Gilles Peskine57ab7212019-01-28 13:03:09 +01002199
2200 PSA_ASSERT( psa_close_key( target_handle ) );
2201
2202exit:
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02002203 psa_reset_key_attributes( &source_attributes );
2204 psa_reset_key_attributes( &target_attributes );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002205 PSA_DONE( );
Gilles Peskine57ab7212019-01-28 13:03:09 +01002206 mbedtls_free( export_buffer );
2207}
2208/* END_CASE */
2209
2210/* BEGIN_CASE */
Gilles Peskinebcdd44b2019-05-20 17:28:11 +02002211void copy_fail( int source_usage_arg,
2212 int source_alg_arg, int source_alg2_arg,
Gilles Peskine4a644642019-05-03 17:14:08 +02002213 int type_arg, data_t *material,
2214 int target_type_arg, int target_bits_arg,
Gilles Peskinebcdd44b2019-05-20 17:28:11 +02002215 int target_usage_arg,
2216 int target_alg_arg, int target_alg2_arg,
Gilles Peskine4a644642019-05-03 17:14:08 +02002217 int expected_status_arg )
2218{
2219 psa_key_attributes_t source_attributes = PSA_KEY_ATTRIBUTES_INIT;
2220 psa_key_attributes_t target_attributes = PSA_KEY_ATTRIBUTES_INIT;
2221 psa_key_handle_t source_handle = 0;
2222 psa_key_handle_t target_handle = 0;
2223
2224 PSA_ASSERT( psa_crypto_init( ) );
2225
2226 /* Prepare the source key. */
2227 psa_set_key_usage_flags( &source_attributes, source_usage_arg );
2228 psa_set_key_algorithm( &source_attributes, source_alg_arg );
Gilles Peskinebcdd44b2019-05-20 17:28:11 +02002229 psa_set_key_enrollment_algorithm( &source_attributes, source_alg2_arg );
Gilles Peskine4a644642019-05-03 17:14:08 +02002230 psa_set_key_type( &source_attributes, type_arg );
Gilles Peskine049c7532019-05-15 20:22:09 +02002231 PSA_ASSERT( psa_import_key( &source_attributes,
2232 material->x, material->len,
2233 &source_handle ) );
Gilles Peskine4a644642019-05-03 17:14:08 +02002234
2235 /* Prepare the target attributes. */
2236 psa_set_key_type( &target_attributes, target_type_arg );
2237 psa_set_key_bits( &target_attributes, target_bits_arg );
2238 psa_set_key_usage_flags( &target_attributes, target_usage_arg );
2239 psa_set_key_algorithm( &target_attributes, target_alg_arg );
Gilles Peskinebcdd44b2019-05-20 17:28:11 +02002240 psa_set_key_enrollment_algorithm( &target_attributes, target_alg2_arg );
Gilles Peskine4a644642019-05-03 17:14:08 +02002241
2242 /* Try to copy the key. */
2243 TEST_EQUAL( psa_copy_key( source_handle,
2244 &target_attributes, &target_handle ),
2245 expected_status_arg );
Gilles Peskine76b29a72019-05-28 14:08:50 +02002246
2247 PSA_ASSERT( psa_destroy_key( source_handle ) );
2248
Gilles Peskine4a644642019-05-03 17:14:08 +02002249exit:
2250 psa_reset_key_attributes( &source_attributes );
2251 psa_reset_key_attributes( &target_attributes );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002252 PSA_DONE( );
Gilles Peskine4a644642019-05-03 17:14:08 +02002253}
2254/* END_CASE */
2255
2256/* BEGIN_CASE */
Jaeden Amero6a25b412019-01-04 11:47:44 +00002257void hash_operation_init( )
2258{
Jaeden Ameroa0f625a2019-02-15 13:52:25 +00002259 const uint8_t input[1] = { 0 };
Jaeden Amero6a25b412019-01-04 11:47:44 +00002260 /* Test each valid way of initializing the object, except for `= {0}`, as
2261 * Clang 5 complains when `-Wmissing-field-initializers` is used, even
2262 * though it's OK by the C standard. We could test for this, but we'd need
2263 * to supress the Clang warning for the test. */
2264 psa_hash_operation_t func = psa_hash_operation_init( );
2265 psa_hash_operation_t init = PSA_HASH_OPERATION_INIT;
2266 psa_hash_operation_t zero;
2267
2268 memset( &zero, 0, sizeof( zero ) );
2269
Jaeden Amero11aa7ee2019-02-19 11:44:55 +00002270 /* A freshly-initialized hash operation should not be usable. */
Jaeden Ameroa0f625a2019-02-15 13:52:25 +00002271 TEST_EQUAL( psa_hash_update( &func, input, sizeof( input ) ),
2272 PSA_ERROR_BAD_STATE );
2273 TEST_EQUAL( psa_hash_update( &init, input, sizeof( input ) ),
2274 PSA_ERROR_BAD_STATE );
2275 TEST_EQUAL( psa_hash_update( &zero, input, sizeof( input ) ),
2276 PSA_ERROR_BAD_STATE );
2277
Jaeden Amero5229bbb2019-02-07 16:33:37 +00002278 /* A default hash operation should be abortable without error. */
2279 PSA_ASSERT( psa_hash_abort( &func ) );
2280 PSA_ASSERT( psa_hash_abort( &init ) );
2281 PSA_ASSERT( psa_hash_abort( &zero ) );
Jaeden Amero6a25b412019-01-04 11:47:44 +00002282}
2283/* END_CASE */
2284
2285/* BEGIN_CASE */
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002286void hash_setup( int alg_arg,
2287 int expected_status_arg )
2288{
2289 psa_algorithm_t alg = alg_arg;
Gilles Peskineb866e2b2018-06-21 09:25:10 +02002290 psa_status_t expected_status = expected_status_arg;
Jaeden Amero6a25b412019-01-04 11:47:44 +00002291 psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002292 psa_status_t status;
2293
Gilles Peskine8817f612018-12-18 00:18:46 +01002294 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002295
Gilles Peskineda8191d1c2018-07-08 19:46:38 +02002296 status = psa_hash_setup( &operation, alg );
Gilles Peskinefe11b722018-12-18 00:24:04 +01002297 TEST_EQUAL( status, expected_status );
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002298
Gilles Peskine9e0a4a52019-02-25 22:11:18 +01002299 /* Whether setup succeeded or failed, abort must succeed. */
2300 PSA_ASSERT( psa_hash_abort( &operation ) );
2301
2302 /* If setup failed, reproduce the failure, so as to
2303 * test the resulting state of the operation object. */
2304 if( status != PSA_SUCCESS )
2305 TEST_EQUAL( psa_hash_setup( &operation, alg ), status );
2306
Gilles Peskinef426e0f2019-02-25 17:42:03 +01002307 /* Now the operation object should be reusable. */
2308#if defined(KNOWN_SUPPORTED_HASH_ALG)
2309 PSA_ASSERT( psa_hash_setup( &operation, KNOWN_SUPPORTED_HASH_ALG ) );
2310 PSA_ASSERT( psa_hash_abort( &operation ) );
2311#endif
2312
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002313exit:
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002314 PSA_DONE( );
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002315}
2316/* END_CASE */
2317
2318/* BEGIN_CASE */
itayzafrirf86548d2018-11-01 10:44:32 +02002319void hash_bad_order( )
2320{
Jaeden Amero11aa7ee2019-02-19 11:44:55 +00002321 psa_algorithm_t alg = PSA_ALG_SHA_256;
itayzafrirf86548d2018-11-01 10:44:32 +02002322 unsigned char input[] = "";
2323 /* SHA-256 hash of an empty string */
Jaeden Amero11aa7ee2019-02-19 11:44:55 +00002324 const unsigned char valid_hash[] = {
itayzafrirf86548d2018-11-01 10:44:32 +02002325 0xe3, 0xb0, 0xc4, 0x42, 0x98, 0xfc, 0x1c, 0x14, 0x9a, 0xfb, 0xf4, 0xc8,
2326 0x99, 0x6f, 0xb9, 0x24, 0x27, 0xae, 0x41, 0xe4, 0x64, 0x9b, 0x93, 0x4c,
2327 0xa4, 0x95, 0x99, 0x1b, 0x78, 0x52, 0xb8, 0x55 };
Jaeden Amero11aa7ee2019-02-19 11:44:55 +00002328 unsigned char hash[sizeof(valid_hash)] = { 0 };
itayzafrirf86548d2018-11-01 10:44:32 +02002329 size_t hash_len;
Jaeden Amero6a25b412019-01-04 11:47:44 +00002330 psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT;
itayzafrirf86548d2018-11-01 10:44:32 +02002331
Gilles Peskine8817f612018-12-18 00:18:46 +01002332 PSA_ASSERT( psa_crypto_init( ) );
itayzafrirf86548d2018-11-01 10:44:32 +02002333
Jaeden Amero36ee5d02019-02-19 09:25:10 +00002334 /* Call setup twice in a row. */
2335 PSA_ASSERT( psa_hash_setup( &operation, alg ) );
2336 TEST_EQUAL( psa_hash_setup( &operation, alg ),
2337 PSA_ERROR_BAD_STATE );
2338 PSA_ASSERT( psa_hash_abort( &operation ) );
2339
Jaeden Amero11aa7ee2019-02-19 11:44:55 +00002340 /* Call update without calling setup beforehand. */
Gilles Peskinef812dcf2018-12-18 00:33:25 +01002341 TEST_EQUAL( psa_hash_update( &operation, input, sizeof( input ) ),
Jaeden Ameroa0f625a2019-02-15 13:52:25 +00002342 PSA_ERROR_BAD_STATE );
Jaeden Amero11aa7ee2019-02-19 11:44:55 +00002343 PSA_ASSERT( psa_hash_abort( &operation ) );
itayzafrirf86548d2018-11-01 10:44:32 +02002344
Jaeden Amero11aa7ee2019-02-19 11:44:55 +00002345 /* Call update after finish. */
2346 PSA_ASSERT( psa_hash_setup( &operation, alg ) );
2347 PSA_ASSERT( psa_hash_finish( &operation,
2348 hash, sizeof( hash ), &hash_len ) );
2349 TEST_EQUAL( psa_hash_update( &operation, input, sizeof( input ) ),
Jaeden Ameroa0f625a2019-02-15 13:52:25 +00002350 PSA_ERROR_BAD_STATE );
Jaeden Amero11aa7ee2019-02-19 11:44:55 +00002351 PSA_ASSERT( psa_hash_abort( &operation ) );
itayzafrirf86548d2018-11-01 10:44:32 +02002352
Jaeden Amero11aa7ee2019-02-19 11:44:55 +00002353 /* Call verify without calling setup beforehand. */
2354 TEST_EQUAL( psa_hash_verify( &operation,
2355 valid_hash, sizeof( valid_hash ) ),
2356 PSA_ERROR_BAD_STATE );
2357 PSA_ASSERT( psa_hash_abort( &operation ) );
2358
2359 /* Call verify after finish. */
2360 PSA_ASSERT( psa_hash_setup( &operation, alg ) );
2361 PSA_ASSERT( psa_hash_finish( &operation,
2362 hash, sizeof( hash ), &hash_len ) );
2363 TEST_EQUAL( psa_hash_verify( &operation,
2364 valid_hash, sizeof( valid_hash ) ),
2365 PSA_ERROR_BAD_STATE );
2366 PSA_ASSERT( psa_hash_abort( &operation ) );
2367
2368 /* Call verify twice in a row. */
2369 PSA_ASSERT( psa_hash_setup( &operation, alg ) );
2370 PSA_ASSERT( psa_hash_verify( &operation,
2371 valid_hash, sizeof( valid_hash ) ) );
2372 TEST_EQUAL( psa_hash_verify( &operation,
2373 valid_hash, sizeof( valid_hash ) ),
2374 PSA_ERROR_BAD_STATE );
2375 PSA_ASSERT( psa_hash_abort( &operation ) );
2376
2377 /* Call finish without calling setup beforehand. */
Gilles Peskinefe11b722018-12-18 00:24:04 +01002378 TEST_EQUAL( psa_hash_finish( &operation,
2379 hash, sizeof( hash ), &hash_len ),
Jaeden Ameroa0f625a2019-02-15 13:52:25 +00002380 PSA_ERROR_BAD_STATE );
Jaeden Amero11aa7ee2019-02-19 11:44:55 +00002381 PSA_ASSERT( psa_hash_abort( &operation ) );
2382
2383 /* Call finish twice in a row. */
2384 PSA_ASSERT( psa_hash_setup( &operation, alg ) );
2385 PSA_ASSERT( psa_hash_finish( &operation,
2386 hash, sizeof( hash ), &hash_len ) );
2387 TEST_EQUAL( psa_hash_finish( &operation,
2388 hash, sizeof( hash ), &hash_len ),
2389 PSA_ERROR_BAD_STATE );
2390 PSA_ASSERT( psa_hash_abort( &operation ) );
2391
2392 /* Call finish after calling verify. */
2393 PSA_ASSERT( psa_hash_setup( &operation, alg ) );
2394 PSA_ASSERT( psa_hash_verify( &operation,
2395 valid_hash, sizeof( valid_hash ) ) );
2396 TEST_EQUAL( psa_hash_finish( &operation,
2397 hash, sizeof( hash ), &hash_len ),
2398 PSA_ERROR_BAD_STATE );
2399 PSA_ASSERT( psa_hash_abort( &operation ) );
itayzafrirf86548d2018-11-01 10:44:32 +02002400
2401exit:
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002402 PSA_DONE( );
itayzafrirf86548d2018-11-01 10:44:32 +02002403}
2404/* END_CASE */
2405
itayzafrir27e69452018-11-01 14:26:34 +02002406/* BEGIN_CASE depends_on:MBEDTLS_SHA256_C */
2407void hash_verify_bad_args( )
itayzafrirec93d302018-10-18 18:01:10 +03002408{
2409 psa_algorithm_t alg = PSA_ALG_SHA_256;
itayzafrir27e69452018-11-01 14:26:34 +02002410 /* SHA-256 hash of an empty string with 2 extra bytes (0xaa and 0xbb)
2411 * appended to it */
2412 unsigned char hash[] = {
2413 0xe3, 0xb0, 0xc4, 0x42, 0x98, 0xfc, 0x1c, 0x14, 0x9a, 0xfb, 0xf4, 0xc8,
2414 0x99, 0x6f, 0xb9, 0x24, 0x27, 0xae, 0x41, 0xe4, 0x64, 0x9b, 0x93, 0x4c,
2415 0xa4, 0x95, 0x99, 0x1b, 0x78, 0x52, 0xb8, 0x55, 0xaa, 0xbb };
itayzafrirec93d302018-10-18 18:01:10 +03002416 size_t expected_size = PSA_HASH_SIZE( alg );
Jaeden Amero6a25b412019-01-04 11:47:44 +00002417 psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT;
itayzafrirec93d302018-10-18 18:01:10 +03002418
Gilles Peskine8817f612018-12-18 00:18:46 +01002419 PSA_ASSERT( psa_crypto_init( ) );
itayzafrirec93d302018-10-18 18:01:10 +03002420
itayzafrir27e69452018-11-01 14:26:34 +02002421 /* psa_hash_verify with a smaller hash than expected */
Gilles Peskine8817f612018-12-18 00:18:46 +01002422 PSA_ASSERT( psa_hash_setup( &operation, alg ) );
Gilles Peskinef812dcf2018-12-18 00:33:25 +01002423 TEST_EQUAL( psa_hash_verify( &operation, hash, expected_size - 1 ),
Gilles Peskinefe11b722018-12-18 00:24:04 +01002424 PSA_ERROR_INVALID_SIGNATURE );
itayzafrirec93d302018-10-18 18:01:10 +03002425
itayzafrir27e69452018-11-01 14:26:34 +02002426 /* psa_hash_verify with a non-matching hash */
Gilles Peskine8817f612018-12-18 00:18:46 +01002427 PSA_ASSERT( psa_hash_setup( &operation, alg ) );
Gilles Peskinef812dcf2018-12-18 00:33:25 +01002428 TEST_EQUAL( psa_hash_verify( &operation, hash + 1, expected_size ),
Gilles Peskinefe11b722018-12-18 00:24:04 +01002429 PSA_ERROR_INVALID_SIGNATURE );
itayzafrirec93d302018-10-18 18:01:10 +03002430
itayzafrir27e69452018-11-01 14:26:34 +02002431 /* psa_hash_verify with a hash longer than expected */
Gilles Peskine8817f612018-12-18 00:18:46 +01002432 PSA_ASSERT( psa_hash_setup( &operation, alg ) );
Gilles Peskinef812dcf2018-12-18 00:33:25 +01002433 TEST_EQUAL( psa_hash_verify( &operation, hash, sizeof( hash ) ),
Gilles Peskinefe11b722018-12-18 00:24:04 +01002434 PSA_ERROR_INVALID_SIGNATURE );
itayzafrir4271df92018-10-24 18:16:19 +03002435
itayzafrirec93d302018-10-18 18:01:10 +03002436exit:
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002437 PSA_DONE( );
itayzafrirec93d302018-10-18 18:01:10 +03002438}
2439/* END_CASE */
2440
itayzafrirb2dd5ed2018-11-01 11:58:59 +02002441/* BEGIN_CASE depends_on:MBEDTLS_SHA256_C */
2442void hash_finish_bad_args( )
itayzafrir58028322018-10-25 10:22:01 +03002443{
2444 psa_algorithm_t alg = PSA_ALG_SHA_256;
itayzafrirb2dd5ed2018-11-01 11:58:59 +02002445 unsigned char hash[PSA_HASH_MAX_SIZE];
itayzafrir58028322018-10-25 10:22:01 +03002446 size_t expected_size = PSA_HASH_SIZE( alg );
Jaeden Amero6a25b412019-01-04 11:47:44 +00002447 psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT;
itayzafrir58028322018-10-25 10:22:01 +03002448 size_t hash_len;
2449
Gilles Peskine8817f612018-12-18 00:18:46 +01002450 PSA_ASSERT( psa_crypto_init( ) );
itayzafrir58028322018-10-25 10:22:01 +03002451
itayzafrir58028322018-10-25 10:22:01 +03002452 /* psa_hash_finish with a smaller hash buffer than expected */
Gilles Peskine8817f612018-12-18 00:18:46 +01002453 PSA_ASSERT( psa_hash_setup( &operation, alg ) );
Gilles Peskinefe11b722018-12-18 00:24:04 +01002454 TEST_EQUAL( psa_hash_finish( &operation,
Gilles Peskinef812dcf2018-12-18 00:33:25 +01002455 hash, expected_size - 1, &hash_len ),
2456 PSA_ERROR_BUFFER_TOO_SMALL );
itayzafrir58028322018-10-25 10:22:01 +03002457
2458exit:
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002459 PSA_DONE( );
itayzafrir58028322018-10-25 10:22:01 +03002460}
2461/* END_CASE */
2462
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002463/* BEGIN_CASE depends_on:MBEDTLS_SHA256_C */
2464void hash_clone_source_state( )
2465{
2466 psa_algorithm_t alg = PSA_ALG_SHA_256;
2467 unsigned char hash[PSA_HASH_MAX_SIZE];
2468 psa_hash_operation_t op_source = PSA_HASH_OPERATION_INIT;
2469 psa_hash_operation_t op_init = PSA_HASH_OPERATION_INIT;
2470 psa_hash_operation_t op_setup = PSA_HASH_OPERATION_INIT;
2471 psa_hash_operation_t op_finished = PSA_HASH_OPERATION_INIT;
2472 psa_hash_operation_t op_aborted = PSA_HASH_OPERATION_INIT;
2473 size_t hash_len;
2474
2475 PSA_ASSERT( psa_crypto_init( ) );
2476 PSA_ASSERT( psa_hash_setup( &op_source, alg ) );
2477
2478 PSA_ASSERT( psa_hash_setup( &op_setup, alg ) );
2479 PSA_ASSERT( psa_hash_setup( &op_finished, alg ) );
2480 PSA_ASSERT( psa_hash_finish( &op_finished,
2481 hash, sizeof( hash ), &hash_len ) );
2482 PSA_ASSERT( psa_hash_setup( &op_aborted, alg ) );
2483 PSA_ASSERT( psa_hash_abort( &op_aborted ) );
2484
2485 TEST_EQUAL( psa_hash_clone( &op_source, &op_setup ),
2486 PSA_ERROR_BAD_STATE );
2487
2488 PSA_ASSERT( psa_hash_clone( &op_source, &op_init ) );
2489 PSA_ASSERT( psa_hash_finish( &op_init,
2490 hash, sizeof( hash ), &hash_len ) );
2491 PSA_ASSERT( psa_hash_clone( &op_source, &op_finished ) );
2492 PSA_ASSERT( psa_hash_finish( &op_finished,
2493 hash, sizeof( hash ), &hash_len ) );
2494 PSA_ASSERT( psa_hash_clone( &op_source, &op_aborted ) );
2495 PSA_ASSERT( psa_hash_finish( &op_aborted,
2496 hash, sizeof( hash ), &hash_len ) );
2497
2498exit:
2499 psa_hash_abort( &op_source );
2500 psa_hash_abort( &op_init );
2501 psa_hash_abort( &op_setup );
2502 psa_hash_abort( &op_finished );
2503 psa_hash_abort( &op_aborted );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002504 PSA_DONE( );
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002505}
2506/* END_CASE */
2507
2508/* BEGIN_CASE depends_on:MBEDTLS_SHA256_C */
2509void hash_clone_target_state( )
2510{
2511 psa_algorithm_t alg = PSA_ALG_SHA_256;
2512 unsigned char hash[PSA_HASH_MAX_SIZE];
2513 psa_hash_operation_t op_init = PSA_HASH_OPERATION_INIT;
2514 psa_hash_operation_t op_setup = PSA_HASH_OPERATION_INIT;
2515 psa_hash_operation_t op_finished = PSA_HASH_OPERATION_INIT;
2516 psa_hash_operation_t op_aborted = PSA_HASH_OPERATION_INIT;
2517 psa_hash_operation_t op_target = PSA_HASH_OPERATION_INIT;
2518 size_t hash_len;
2519
2520 PSA_ASSERT( psa_crypto_init( ) );
2521
2522 PSA_ASSERT( psa_hash_setup( &op_setup, alg ) );
2523 PSA_ASSERT( psa_hash_setup( &op_finished, alg ) );
2524 PSA_ASSERT( psa_hash_finish( &op_finished,
2525 hash, sizeof( hash ), &hash_len ) );
2526 PSA_ASSERT( psa_hash_setup( &op_aborted, alg ) );
2527 PSA_ASSERT( psa_hash_abort( &op_aborted ) );
2528
2529 PSA_ASSERT( psa_hash_clone( &op_setup, &op_target ) );
2530 PSA_ASSERT( psa_hash_finish( &op_target,
2531 hash, sizeof( hash ), &hash_len ) );
2532
2533 TEST_EQUAL( psa_hash_clone( &op_init, &op_target ), PSA_ERROR_BAD_STATE );
2534 TEST_EQUAL( psa_hash_clone( &op_finished, &op_target ),
2535 PSA_ERROR_BAD_STATE );
2536 TEST_EQUAL( psa_hash_clone( &op_aborted, &op_target ),
2537 PSA_ERROR_BAD_STATE );
2538
2539exit:
2540 psa_hash_abort( &op_target );
2541 psa_hash_abort( &op_init );
2542 psa_hash_abort( &op_setup );
2543 psa_hash_abort( &op_finished );
2544 psa_hash_abort( &op_aborted );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002545 PSA_DONE( );
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002546}
2547/* END_CASE */
2548
itayzafrir58028322018-10-25 10:22:01 +03002549/* BEGIN_CASE */
Jaeden Amero769ce272019-01-04 11:48:03 +00002550void mac_operation_init( )
2551{
Jaeden Amero252ef282019-02-15 14:05:35 +00002552 const uint8_t input[1] = { 0 };
2553
Jaeden Amero769ce272019-01-04 11:48:03 +00002554 /* Test each valid way of initializing the object, except for `= {0}`, as
2555 * Clang 5 complains when `-Wmissing-field-initializers` is used, even
2556 * though it's OK by the C standard. We could test for this, but we'd need
2557 * to supress the Clang warning for the test. */
2558 psa_mac_operation_t func = psa_mac_operation_init( );
2559 psa_mac_operation_t init = PSA_MAC_OPERATION_INIT;
2560 psa_mac_operation_t zero;
2561
2562 memset( &zero, 0, sizeof( zero ) );
2563
Jaeden Amero252ef282019-02-15 14:05:35 +00002564 /* A freshly-initialized MAC operation should not be usable. */
2565 TEST_EQUAL( psa_mac_update( &func,
2566 input, sizeof( input ) ),
2567 PSA_ERROR_BAD_STATE );
2568 TEST_EQUAL( psa_mac_update( &init,
2569 input, sizeof( input ) ),
2570 PSA_ERROR_BAD_STATE );
2571 TEST_EQUAL( psa_mac_update( &zero,
2572 input, sizeof( input ) ),
2573 PSA_ERROR_BAD_STATE );
2574
Jaeden Amero5229bbb2019-02-07 16:33:37 +00002575 /* A default MAC operation should be abortable without error. */
2576 PSA_ASSERT( psa_mac_abort( &func ) );
2577 PSA_ASSERT( psa_mac_abort( &init ) );
2578 PSA_ASSERT( psa_mac_abort( &zero ) );
Jaeden Amero769ce272019-01-04 11:48:03 +00002579}
2580/* END_CASE */
2581
2582/* BEGIN_CASE */
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002583void mac_setup( int key_type_arg,
2584 data_t *key,
2585 int alg_arg,
2586 int expected_status_arg )
2587{
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002588 psa_key_type_t key_type = key_type_arg;
2589 psa_algorithm_t alg = alg_arg;
Gilles Peskineb866e2b2018-06-21 09:25:10 +02002590 psa_status_t expected_status = expected_status_arg;
Jaeden Amero769ce272019-01-04 11:48:03 +00002591 psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT;
Gilles Peskinef426e0f2019-02-25 17:42:03 +01002592 psa_status_t status = PSA_ERROR_GENERIC_ERROR;
2593#if defined(KNOWN_SUPPORTED_MAC_ALG)
2594 const uint8_t smoke_test_key_data[16] = "kkkkkkkkkkkkkkkk";
2595#endif
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002596
Gilles Peskine8817f612018-12-18 00:18:46 +01002597 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002598
Gilles Peskinef426e0f2019-02-25 17:42:03 +01002599 if( ! exercise_mac_setup( key_type, key->x, key->len, alg,
2600 &operation, &status ) )
2601 goto exit;
Gilles Peskinefe11b722018-12-18 00:24:04 +01002602 TEST_EQUAL( status, expected_status );
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002603
Gilles Peskinef426e0f2019-02-25 17:42:03 +01002604 /* The operation object should be reusable. */
2605#if defined(KNOWN_SUPPORTED_MAC_ALG)
2606 if( ! exercise_mac_setup( KNOWN_SUPPORTED_MAC_KEY_TYPE,
2607 smoke_test_key_data,
2608 sizeof( smoke_test_key_data ),
2609 KNOWN_SUPPORTED_MAC_ALG,
2610 &operation, &status ) )
2611 goto exit;
2612 TEST_EQUAL( status, PSA_SUCCESS );
2613#endif
2614
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002615exit:
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002616 PSA_DONE( );
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002617}
2618/* END_CASE */
2619
2620/* BEGIN_CASE */
Jaeden Amero252ef282019-02-15 14:05:35 +00002621void mac_bad_order( )
2622{
2623 psa_key_handle_t handle = 0;
2624 psa_key_type_t key_type = PSA_KEY_TYPE_HMAC;
2625 psa_algorithm_t alg = PSA_ALG_HMAC(PSA_ALG_SHA_256);
2626 const uint8_t key[] = {
2627 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
2628 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
2629 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa };
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02002630 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Jaeden Amero252ef282019-02-15 14:05:35 +00002631 psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT;
2632 uint8_t sign_mac[PSA_MAC_MAX_SIZE + 10] = { 0 };
2633 size_t sign_mac_length = 0;
2634 const uint8_t input[] = { 0xbb, 0xbb, 0xbb, 0xbb };
2635 const uint8_t verify_mac[] = {
2636 0x74, 0x65, 0x93, 0x8c, 0xeb, 0x1d, 0xb3, 0x76, 0x5a, 0x38, 0xe7, 0xdd,
2637 0x85, 0xc5, 0xad, 0x4f, 0x07, 0xe7, 0xd5, 0xb2, 0x64, 0xf0, 0x1a, 0x1a,
2638 0x2c, 0xf9, 0x18, 0xca, 0x59, 0x7e, 0x5d, 0xf6 };
2639
2640 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02002641 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_SIGN | PSA_KEY_USAGE_VERIFY );
2642 psa_set_key_algorithm( &attributes, alg );
2643 psa_set_key_type( &attributes, key_type );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002644
Gilles Peskine73676cb2019-05-15 20:15:10 +02002645 PSA_ASSERT( psa_import_key( &attributes, key, sizeof( key ), &handle ) );
Gilles Peskine4abf7412018-06-18 16:35:34 +02002646
Jaeden Amero252ef282019-02-15 14:05:35 +00002647 /* Call update without calling setup beforehand. */
2648 TEST_EQUAL( psa_mac_update( &operation, input, sizeof( input ) ),
2649 PSA_ERROR_BAD_STATE );
2650 PSA_ASSERT( psa_mac_abort( &operation ) );
2651
2652 /* Call sign finish without calling setup beforehand. */
2653 TEST_EQUAL( psa_mac_sign_finish( &operation, sign_mac, sizeof( sign_mac ),
2654 &sign_mac_length),
2655 PSA_ERROR_BAD_STATE );
2656 PSA_ASSERT( psa_mac_abort( &operation ) );
2657
2658 /* Call verify finish without calling setup beforehand. */
2659 TEST_EQUAL( psa_mac_verify_finish( &operation,
2660 verify_mac, sizeof( verify_mac ) ),
2661 PSA_ERROR_BAD_STATE );
2662 PSA_ASSERT( psa_mac_abort( &operation ) );
2663
Jaeden Amero36ee5d02019-02-19 09:25:10 +00002664 /* Call setup twice in a row. */
2665 PSA_ASSERT( psa_mac_sign_setup( &operation,
2666 handle, alg ) );
2667 TEST_EQUAL( psa_mac_sign_setup( &operation,
2668 handle, alg ),
2669 PSA_ERROR_BAD_STATE );
2670 PSA_ASSERT( psa_mac_abort( &operation ) );
2671
Jaeden Amero252ef282019-02-15 14:05:35 +00002672 /* Call update after sign finish. */
2673 PSA_ASSERT( psa_mac_sign_setup( &operation,
2674 handle, alg ) );
2675 PSA_ASSERT( psa_mac_update( &operation, input, sizeof( input ) ) );
2676 PSA_ASSERT( psa_mac_sign_finish( &operation,
2677 sign_mac, sizeof( sign_mac ),
2678 &sign_mac_length ) );
2679 TEST_EQUAL( psa_mac_update( &operation, input, sizeof( input ) ),
2680 PSA_ERROR_BAD_STATE );
2681 PSA_ASSERT( psa_mac_abort( &operation ) );
2682
2683 /* Call update after verify finish. */
2684 PSA_ASSERT( psa_mac_verify_setup( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02002685 handle, alg ) );
Jaeden Amero252ef282019-02-15 14:05:35 +00002686 PSA_ASSERT( psa_mac_update( &operation, input, sizeof( input ) ) );
2687 PSA_ASSERT( psa_mac_verify_finish( &operation,
2688 verify_mac, sizeof( verify_mac ) ) );
2689 TEST_EQUAL( psa_mac_update( &operation, input, sizeof( input ) ),
2690 PSA_ERROR_BAD_STATE );
2691 PSA_ASSERT( psa_mac_abort( &operation ) );
2692
2693 /* Call sign finish twice in a row. */
2694 PSA_ASSERT( psa_mac_sign_setup( &operation,
2695 handle, alg ) );
2696 PSA_ASSERT( psa_mac_update( &operation, input, sizeof( input ) ) );
2697 PSA_ASSERT( psa_mac_sign_finish( &operation,
2698 sign_mac, sizeof( sign_mac ),
2699 &sign_mac_length ) );
2700 TEST_EQUAL( psa_mac_sign_finish( &operation,
2701 sign_mac, sizeof( sign_mac ),
2702 &sign_mac_length ),
2703 PSA_ERROR_BAD_STATE );
2704 PSA_ASSERT( psa_mac_abort( &operation ) );
2705
2706 /* Call verify finish twice in a row. */
2707 PSA_ASSERT( psa_mac_verify_setup( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02002708 handle, alg ) );
Jaeden Amero252ef282019-02-15 14:05:35 +00002709 PSA_ASSERT( psa_mac_update( &operation, input, sizeof( input ) ) );
2710 PSA_ASSERT( psa_mac_verify_finish( &operation,
2711 verify_mac, sizeof( verify_mac ) ) );
2712 TEST_EQUAL( psa_mac_verify_finish( &operation,
2713 verify_mac, sizeof( verify_mac ) ),
2714 PSA_ERROR_BAD_STATE );
2715 PSA_ASSERT( psa_mac_abort( &operation ) );
2716
2717 /* Setup sign but try verify. */
2718 PSA_ASSERT( psa_mac_sign_setup( &operation,
2719 handle, alg ) );
2720 PSA_ASSERT( psa_mac_update( &operation, input, sizeof( input ) ) );
2721 TEST_EQUAL( psa_mac_verify_finish( &operation,
2722 verify_mac, sizeof( verify_mac ) ),
2723 PSA_ERROR_BAD_STATE );
2724 PSA_ASSERT( psa_mac_abort( &operation ) );
2725
2726 /* Setup verify but try sign. */
2727 PSA_ASSERT( psa_mac_verify_setup( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02002728 handle, alg ) );
Jaeden Amero252ef282019-02-15 14:05:35 +00002729 PSA_ASSERT( psa_mac_update( &operation, input, sizeof( input ) ) );
2730 TEST_EQUAL( psa_mac_sign_finish( &operation,
2731 sign_mac, sizeof( sign_mac ),
2732 &sign_mac_length ),
2733 PSA_ERROR_BAD_STATE );
2734 PSA_ASSERT( psa_mac_abort( &operation ) );
Gilles Peskine4abf7412018-06-18 16:35:34 +02002735
Gilles Peskine76b29a72019-05-28 14:08:50 +02002736 PSA_ASSERT( psa_destroy_key( handle ) );
2737
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002738exit:
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002739 PSA_DONE( );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002740}
2741/* END_CASE */
2742
2743/* BEGIN_CASE */
Gilles Peskinea7aa4422018-08-14 15:17:54 +02002744void mac_sign( int key_type_arg,
2745 data_t *key,
2746 int alg_arg,
2747 data_t *input,
2748 data_t *expected_mac )
2749{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01002750 psa_key_handle_t handle = 0;
Gilles Peskinea7aa4422018-08-14 15:17:54 +02002751 psa_key_type_t key_type = key_type_arg;
2752 psa_algorithm_t alg = alg_arg;
Jaeden Amero769ce272019-01-04 11:48:03 +00002753 psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02002754 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskinea7aa4422018-08-14 15:17:54 +02002755 /* Leave a little extra room in the output buffer. At the end of the
2756 * test, we'll check that the implementation didn't overwrite onto
2757 * this extra room. */
2758 uint8_t actual_mac[PSA_MAC_MAX_SIZE + 10];
2759 size_t mac_buffer_size =
2760 PSA_MAC_FINAL_SIZE( key_type, PSA_BYTES_TO_BITS( key->len ), alg );
2761 size_t mac_length = 0;
2762
2763 memset( actual_mac, '+', sizeof( actual_mac ) );
2764 TEST_ASSERT( mac_buffer_size <= PSA_MAC_MAX_SIZE );
2765 TEST_ASSERT( expected_mac->len <= mac_buffer_size );
2766
Gilles Peskine8817f612018-12-18 00:18:46 +01002767 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskinea7aa4422018-08-14 15:17:54 +02002768
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02002769 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_SIGN );
2770 psa_set_key_algorithm( &attributes, alg );
2771 psa_set_key_type( &attributes, key_type );
Gilles Peskinea7aa4422018-08-14 15:17:54 +02002772
Gilles Peskine73676cb2019-05-15 20:15:10 +02002773 PSA_ASSERT( psa_import_key( &attributes, key->x, key->len, &handle ) );
Gilles Peskinea7aa4422018-08-14 15:17:54 +02002774
2775 /* Calculate the MAC. */
Gilles Peskine8817f612018-12-18 00:18:46 +01002776 PSA_ASSERT( psa_mac_sign_setup( &operation,
2777 handle, alg ) );
2778 PSA_ASSERT( psa_mac_update( &operation,
2779 input->x, input->len ) );
2780 PSA_ASSERT( psa_mac_sign_finish( &operation,
2781 actual_mac, mac_buffer_size,
2782 &mac_length ) );
Gilles Peskinea7aa4422018-08-14 15:17:54 +02002783
2784 /* Compare with the expected value. */
Gilles Peskine0dfba2d2018-12-18 00:40:50 +01002785 ASSERT_COMPARE( expected_mac->x, expected_mac->len,
2786 actual_mac, mac_length );
Gilles Peskinea7aa4422018-08-14 15:17:54 +02002787
2788 /* Verify that the end of the buffer is untouched. */
2789 TEST_ASSERT( mem_is_char( actual_mac + mac_length, '+',
2790 sizeof( actual_mac ) - mac_length ) );
2791
2792exit:
Gilles Peskinebdf309c2018-12-03 15:36:32 +01002793 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002794 PSA_DONE( );
Gilles Peskinea7aa4422018-08-14 15:17:54 +02002795}
2796/* END_CASE */
2797
2798/* BEGIN_CASE */
Gilles Peskinec0ec9722018-06-18 17:03:37 +02002799void mac_verify( int key_type_arg,
2800 data_t *key,
2801 int alg_arg,
2802 data_t *input,
2803 data_t *expected_mac )
Gilles Peskine8c9def32018-02-08 10:02:12 +01002804{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01002805 psa_key_handle_t handle = 0;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002806 psa_key_type_t key_type = key_type_arg;
2807 psa_algorithm_t alg = alg_arg;
Jaeden Amero769ce272019-01-04 11:48:03 +00002808 psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02002809 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002810
Gilles Peskine69c12672018-06-28 00:07:19 +02002811 TEST_ASSERT( expected_mac->len <= PSA_MAC_MAX_SIZE );
2812
Gilles Peskine8817f612018-12-18 00:18:46 +01002813 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002814
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02002815 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_VERIFY );
2816 psa_set_key_algorithm( &attributes, alg );
2817 psa_set_key_type( &attributes, key_type );
mohammad16036df908f2018-04-02 08:34:15 -07002818
Gilles Peskine73676cb2019-05-15 20:15:10 +02002819 PSA_ASSERT( psa_import_key( &attributes, key->x, key->len, &handle ) );
Gilles Peskinec0ec9722018-06-18 17:03:37 +02002820
Gilles Peskine8817f612018-12-18 00:18:46 +01002821 PSA_ASSERT( psa_mac_verify_setup( &operation,
2822 handle, alg ) );
2823 PSA_ASSERT( psa_destroy_key( handle ) );
2824 PSA_ASSERT( psa_mac_update( &operation,
2825 input->x, input->len ) );
2826 PSA_ASSERT( psa_mac_verify_finish( &operation,
2827 expected_mac->x,
2828 expected_mac->len ) );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002829
2830exit:
Gilles Peskinebdf309c2018-12-03 15:36:32 +01002831 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002832 PSA_DONE( );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002833}
2834/* END_CASE */
2835
2836/* BEGIN_CASE */
Jaeden Amero5bae2272019-01-04 11:48:27 +00002837void cipher_operation_init( )
2838{
Jaeden Ameroab439972019-02-15 14:12:05 +00002839 const uint8_t input[1] = { 0 };
2840 unsigned char output[1] = { 0 };
2841 size_t output_length;
Jaeden Amero5bae2272019-01-04 11:48:27 +00002842 /* Test each valid way of initializing the object, except for `= {0}`, as
2843 * Clang 5 complains when `-Wmissing-field-initializers` is used, even
2844 * though it's OK by the C standard. We could test for this, but we'd need
2845 * to supress the Clang warning for the test. */
2846 psa_cipher_operation_t func = psa_cipher_operation_init( );
2847 psa_cipher_operation_t init = PSA_CIPHER_OPERATION_INIT;
2848 psa_cipher_operation_t zero;
2849
2850 memset( &zero, 0, sizeof( zero ) );
2851
Jaeden Ameroab439972019-02-15 14:12:05 +00002852 /* A freshly-initialized cipher operation should not be usable. */
2853 TEST_EQUAL( psa_cipher_update( &func,
2854 input, sizeof( input ),
2855 output, sizeof( output ),
2856 &output_length ),
2857 PSA_ERROR_BAD_STATE );
2858 TEST_EQUAL( psa_cipher_update( &init,
2859 input, sizeof( input ),
2860 output, sizeof( output ),
2861 &output_length ),
2862 PSA_ERROR_BAD_STATE );
2863 TEST_EQUAL( psa_cipher_update( &zero,
2864 input, sizeof( input ),
2865 output, sizeof( output ),
2866 &output_length ),
2867 PSA_ERROR_BAD_STATE );
2868
Jaeden Amero5229bbb2019-02-07 16:33:37 +00002869 /* A default cipher operation should be abortable without error. */
2870 PSA_ASSERT( psa_cipher_abort( &func ) );
2871 PSA_ASSERT( psa_cipher_abort( &init ) );
2872 PSA_ASSERT( psa_cipher_abort( &zero ) );
Jaeden Amero5bae2272019-01-04 11:48:27 +00002873}
2874/* END_CASE */
2875
2876/* BEGIN_CASE */
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002877void cipher_setup( int key_type_arg,
2878 data_t *key,
2879 int alg_arg,
2880 int expected_status_arg )
2881{
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002882 psa_key_type_t key_type = key_type_arg;
2883 psa_algorithm_t alg = alg_arg;
Gilles Peskineb866e2b2018-06-21 09:25:10 +02002884 psa_status_t expected_status = expected_status_arg;
Jaeden Amero5bae2272019-01-04 11:48:27 +00002885 psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002886 psa_status_t status;
Gilles Peskinef426e0f2019-02-25 17:42:03 +01002887#if defined(KNOWN_SUPPORTED_MAC_ALG)
2888 const uint8_t smoke_test_key_data[16] = "kkkkkkkkkkkkkkkk";
2889#endif
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002890
Gilles Peskine8817f612018-12-18 00:18:46 +01002891 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002892
Gilles Peskinef426e0f2019-02-25 17:42:03 +01002893 if( ! exercise_cipher_setup( key_type, key->x, key->len, alg,
2894 &operation, &status ) )
2895 goto exit;
Gilles Peskinefe11b722018-12-18 00:24:04 +01002896 TEST_EQUAL( status, expected_status );
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002897
Gilles Peskinef426e0f2019-02-25 17:42:03 +01002898 /* The operation object should be reusable. */
2899#if defined(KNOWN_SUPPORTED_CIPHER_ALG)
2900 if( ! exercise_cipher_setup( KNOWN_SUPPORTED_CIPHER_KEY_TYPE,
2901 smoke_test_key_data,
2902 sizeof( smoke_test_key_data ),
2903 KNOWN_SUPPORTED_CIPHER_ALG,
2904 &operation, &status ) )
2905 goto exit;
2906 TEST_EQUAL( status, PSA_SUCCESS );
2907#endif
2908
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002909exit:
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002910 PSA_DONE( );
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002911}
2912/* END_CASE */
2913
2914/* BEGIN_CASE */
Jaeden Ameroab439972019-02-15 14:12:05 +00002915void cipher_bad_order( )
2916{
2917 psa_key_handle_t handle = 0;
2918 psa_key_type_t key_type = PSA_KEY_TYPE_AES;
2919 psa_algorithm_t alg = PSA_ALG_CBC_PKCS7;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02002920 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Jaeden Ameroab439972019-02-15 14:12:05 +00002921 psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT;
2922 unsigned char iv[PSA_BLOCK_CIPHER_BLOCK_SIZE(PSA_KEY_TYPE_AES)] = { 0 };
2923 const uint8_t key[] = {
2924 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
2925 0xaa, 0xaa, 0xaa, 0xaa };
2926 const uint8_t text[] = {
2927 0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0xbb,
2928 0xbb, 0xbb, 0xbb, 0xbb };
2929 uint8_t buffer[PSA_BLOCK_CIPHER_BLOCK_SIZE(PSA_KEY_TYPE_AES)] = { 0 };
2930 size_t length = 0;
2931
2932 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02002933 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT );
2934 psa_set_key_algorithm( &attributes, alg );
2935 psa_set_key_type( &attributes, key_type );
Gilles Peskine73676cb2019-05-15 20:15:10 +02002936 PSA_ASSERT( psa_import_key( &attributes, key, sizeof( key ), &handle ) );
Jaeden Ameroab439972019-02-15 14:12:05 +00002937
2938
Jaeden Amero36ee5d02019-02-19 09:25:10 +00002939 /* Call encrypt setup twice in a row. */
2940 PSA_ASSERT( psa_cipher_encrypt_setup( &operation, handle, alg ) );
2941 TEST_EQUAL( psa_cipher_encrypt_setup( &operation, handle, alg ),
2942 PSA_ERROR_BAD_STATE );
2943 PSA_ASSERT( psa_cipher_abort( &operation ) );
2944
2945 /* Call decrypt setup twice in a row. */
2946 PSA_ASSERT( psa_cipher_decrypt_setup( &operation, handle, alg ) );
2947 TEST_EQUAL( psa_cipher_decrypt_setup( &operation, handle, alg ),
2948 PSA_ERROR_BAD_STATE );
2949 PSA_ASSERT( psa_cipher_abort( &operation ) );
2950
Jaeden Ameroab439972019-02-15 14:12:05 +00002951 /* Generate an IV without calling setup beforehand. */
2952 TEST_EQUAL( psa_cipher_generate_iv( &operation,
2953 buffer, sizeof( buffer ),
2954 &length ),
2955 PSA_ERROR_BAD_STATE );
2956 PSA_ASSERT( psa_cipher_abort( &operation ) );
2957
2958 /* Generate an IV twice in a row. */
2959 PSA_ASSERT( psa_cipher_encrypt_setup( &operation, handle, alg ) );
2960 PSA_ASSERT( psa_cipher_generate_iv( &operation,
2961 buffer, sizeof( buffer ),
2962 &length ) );
2963 TEST_EQUAL( psa_cipher_generate_iv( &operation,
2964 buffer, sizeof( buffer ),
2965 &length ),
2966 PSA_ERROR_BAD_STATE );
2967 PSA_ASSERT( psa_cipher_abort( &operation ) );
2968
2969 /* Generate an IV after it's already set. */
2970 PSA_ASSERT( psa_cipher_encrypt_setup( &operation, handle, alg ) );
2971 PSA_ASSERT( psa_cipher_set_iv( &operation,
2972 iv, sizeof( iv ) ) );
2973 TEST_EQUAL( psa_cipher_generate_iv( &operation,
2974 buffer, sizeof( buffer ),
2975 &length ),
2976 PSA_ERROR_BAD_STATE );
2977 PSA_ASSERT( psa_cipher_abort( &operation ) );
2978
2979 /* Set an IV without calling setup beforehand. */
2980 TEST_EQUAL( psa_cipher_set_iv( &operation,
2981 iv, sizeof( iv ) ),
2982 PSA_ERROR_BAD_STATE );
2983 PSA_ASSERT( psa_cipher_abort( &operation ) );
2984
2985 /* Set an IV after it's already set. */
2986 PSA_ASSERT( psa_cipher_encrypt_setup( &operation, handle, alg ) );
2987 PSA_ASSERT( psa_cipher_set_iv( &operation,
2988 iv, sizeof( iv ) ) );
2989 TEST_EQUAL( psa_cipher_set_iv( &operation,
2990 iv, sizeof( iv ) ),
2991 PSA_ERROR_BAD_STATE );
2992 PSA_ASSERT( psa_cipher_abort( &operation ) );
2993
2994 /* Set an IV after it's already generated. */
2995 PSA_ASSERT( psa_cipher_encrypt_setup( &operation, handle, alg ) );
2996 PSA_ASSERT( psa_cipher_generate_iv( &operation,
2997 buffer, sizeof( buffer ),
2998 &length ) );
2999 TEST_EQUAL( psa_cipher_set_iv( &operation,
3000 iv, sizeof( iv ) ),
3001 PSA_ERROR_BAD_STATE );
3002 PSA_ASSERT( psa_cipher_abort( &operation ) );
3003
3004 /* Call update without calling setup beforehand. */
3005 TEST_EQUAL( psa_cipher_update( &operation,
3006 text, sizeof( text ),
3007 buffer, sizeof( buffer ),
3008 &length ),
3009 PSA_ERROR_BAD_STATE );
3010 PSA_ASSERT( psa_cipher_abort( &operation ) );
3011
3012 /* Call update without an IV where an IV is required. */
3013 TEST_EQUAL( psa_cipher_update( &operation,
3014 text, sizeof( text ),
3015 buffer, sizeof( buffer ),
3016 &length ),
3017 PSA_ERROR_BAD_STATE );
3018 PSA_ASSERT( psa_cipher_abort( &operation ) );
3019
3020 /* Call update after finish. */
3021 PSA_ASSERT( psa_cipher_encrypt_setup( &operation, handle, alg ) );
3022 PSA_ASSERT( psa_cipher_set_iv( &operation,
3023 iv, sizeof( iv ) ) );
3024 PSA_ASSERT( psa_cipher_finish( &operation,
3025 buffer, sizeof( buffer ), &length ) );
3026 TEST_EQUAL( psa_cipher_update( &operation,
3027 text, sizeof( text ),
3028 buffer, sizeof( buffer ),
3029 &length ),
3030 PSA_ERROR_BAD_STATE );
3031 PSA_ASSERT( psa_cipher_abort( &operation ) );
3032
3033 /* Call finish without calling setup beforehand. */
3034 TEST_EQUAL( psa_cipher_finish( &operation,
3035 buffer, sizeof( buffer ), &length ),
3036 PSA_ERROR_BAD_STATE );
3037 PSA_ASSERT( psa_cipher_abort( &operation ) );
3038
3039 /* Call finish without an IV where an IV is required. */
3040 PSA_ASSERT( psa_cipher_encrypt_setup( &operation, handle, alg ) );
3041 /* Not calling update means we are encrypting an empty buffer, which is OK
3042 * for cipher modes with padding. */
3043 TEST_EQUAL( psa_cipher_finish( &operation,
3044 buffer, sizeof( buffer ), &length ),
3045 PSA_ERROR_BAD_STATE );
3046 PSA_ASSERT( psa_cipher_abort( &operation ) );
3047
3048 /* Call finish twice in a row. */
3049 PSA_ASSERT( psa_cipher_encrypt_setup( &operation, handle, alg ) );
3050 PSA_ASSERT( psa_cipher_set_iv( &operation,
3051 iv, sizeof( iv ) ) );
3052 PSA_ASSERT( psa_cipher_finish( &operation,
3053 buffer, sizeof( buffer ), &length ) );
3054 TEST_EQUAL( psa_cipher_finish( &operation,
3055 buffer, sizeof( buffer ), &length ),
3056 PSA_ERROR_BAD_STATE );
3057 PSA_ASSERT( psa_cipher_abort( &operation ) );
3058
Gilles Peskine76b29a72019-05-28 14:08:50 +02003059 PSA_ASSERT( psa_destroy_key( handle ) );
3060
Jaeden Ameroab439972019-02-15 14:12:05 +00003061exit:
Gilles Peskine1153e7b2019-05-28 15:10:21 +02003062 PSA_DONE( );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003063}
3064/* END_CASE */
Gilles Peskine50e586b2018-06-08 14:28:46 +02003065
Gilles Peskine50e586b2018-06-08 14:28:46 +02003066/* BEGIN_CASE */
Gilles Peskine50e586b2018-06-08 14:28:46 +02003067void cipher_encrypt( int alg_arg, int key_type_arg,
Gilles Peskine423005e2019-05-06 15:22:57 +02003068 data_t *key, data_t *iv,
Gilles Peskine50e586b2018-06-08 14:28:46 +02003069 data_t *input, data_t *expected_output,
Gilles Peskineb866e2b2018-06-21 09:25:10 +02003070 int expected_status_arg )
Gilles Peskine50e586b2018-06-08 14:28:46 +02003071{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003072 psa_key_handle_t handle = 0;
Gilles Peskine50e586b2018-06-08 14:28:46 +02003073 psa_status_t status;
3074 psa_key_type_t key_type = key_type_arg;
3075 psa_algorithm_t alg = alg_arg;
Gilles Peskineb866e2b2018-06-21 09:25:10 +02003076 psa_status_t expected_status = expected_status_arg;
Gilles Peskine50e586b2018-06-08 14:28:46 +02003077 unsigned char *output = NULL;
3078 size_t output_buffer_size = 0;
3079 size_t function_output_length = 0;
3080 size_t total_output_length = 0;
Jaeden Amero5bae2272019-01-04 11:48:27 +00003081 psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003082 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine50e586b2018-06-08 14:28:46 +02003083
Gilles Peskine8817f612018-12-18 00:18:46 +01003084 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003085
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003086 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT );
3087 psa_set_key_algorithm( &attributes, alg );
3088 psa_set_key_type( &attributes, key_type );
Moran Pekered346952018-07-05 15:22:45 +03003089
Gilles Peskine73676cb2019-05-15 20:15:10 +02003090 PSA_ASSERT( psa_import_key( &attributes, key->x, key->len, &handle ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003091
Gilles Peskine8817f612018-12-18 00:18:46 +01003092 PSA_ASSERT( psa_cipher_encrypt_setup( &operation,
3093 handle, alg ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003094
Gilles Peskine423005e2019-05-06 15:22:57 +02003095 PSA_ASSERT( psa_cipher_set_iv( &operation, iv->x, iv->len ) );
Gilles Peskine9d8eea72018-12-17 23:34:57 +01003096 output_buffer_size = ( (size_t) input->len +
3097 PSA_BLOCK_CIPHER_BLOCK_SIZE( key_type ) );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02003098 ASSERT_ALLOC( output, output_buffer_size );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003099
Gilles Peskine8817f612018-12-18 00:18:46 +01003100 PSA_ASSERT( psa_cipher_update( &operation,
3101 input->x, input->len,
3102 output, output_buffer_size,
3103 &function_output_length ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003104 total_output_length += function_output_length;
3105 status = psa_cipher_finish( &operation,
Gilles Peskineee46fe72019-02-19 19:05:33 +01003106 output + total_output_length,
3107 output_buffer_size - total_output_length,
Gilles Peskine50e586b2018-06-08 14:28:46 +02003108 &function_output_length );
3109 total_output_length += function_output_length;
3110
Gilles Peskinefe11b722018-12-18 00:24:04 +01003111 TEST_EQUAL( status, expected_status );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003112 if( expected_status == PSA_SUCCESS )
3113 {
Gilles Peskine8817f612018-12-18 00:18:46 +01003114 PSA_ASSERT( psa_cipher_abort( &operation ) );
Gilles Peskinebd7dea92018-09-27 13:57:19 +02003115 ASSERT_COMPARE( expected_output->x, expected_output->len,
3116 output, total_output_length );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003117 }
3118
3119exit:
3120 mbedtls_free( output );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003121 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02003122 PSA_DONE( );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003123}
3124/* END_CASE */
3125
3126/* BEGIN_CASE */
3127void cipher_encrypt_multipart( int alg_arg, int key_type_arg,
Gilles Peskine423005e2019-05-06 15:22:57 +02003128 data_t *key, data_t *iv,
Gilles Peskine50e586b2018-06-08 14:28:46 +02003129 data_t *input,
Gilles Peskinee0866522019-02-19 19:44:00 +01003130 int first_part_size_arg,
3131 int output1_length_arg, int output2_length_arg,
Gilles Peskine50e586b2018-06-08 14:28:46 +02003132 data_t *expected_output )
3133{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003134 psa_key_handle_t handle = 0;
Gilles Peskine50e586b2018-06-08 14:28:46 +02003135 psa_key_type_t key_type = key_type_arg;
3136 psa_algorithm_t alg = alg_arg;
Gilles Peskinee0866522019-02-19 19:44:00 +01003137 size_t first_part_size = first_part_size_arg;
3138 size_t output1_length = output1_length_arg;
3139 size_t output2_length = output2_length_arg;
Gilles Peskine50e586b2018-06-08 14:28:46 +02003140 unsigned char *output = NULL;
3141 size_t output_buffer_size = 0;
3142 size_t function_output_length = 0;
3143 size_t total_output_length = 0;
Jaeden Amero5bae2272019-01-04 11:48:27 +00003144 psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003145 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine50e586b2018-06-08 14:28:46 +02003146
Gilles Peskine8817f612018-12-18 00:18:46 +01003147 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003148
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003149 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT );
3150 psa_set_key_algorithm( &attributes, alg );
3151 psa_set_key_type( &attributes, key_type );
Moran Pekered346952018-07-05 15:22:45 +03003152
Gilles Peskine73676cb2019-05-15 20:15:10 +02003153 PSA_ASSERT( psa_import_key( &attributes, key->x, key->len, &handle ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003154
Gilles Peskine8817f612018-12-18 00:18:46 +01003155 PSA_ASSERT( psa_cipher_encrypt_setup( &operation,
3156 handle, alg ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003157
Gilles Peskine423005e2019-05-06 15:22:57 +02003158 PSA_ASSERT( psa_cipher_set_iv( &operation, iv->x, iv->len ) );
Gilles Peskine9d8eea72018-12-17 23:34:57 +01003159 output_buffer_size = ( (size_t) input->len +
3160 PSA_BLOCK_CIPHER_BLOCK_SIZE( key_type ) );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02003161 ASSERT_ALLOC( output, output_buffer_size );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003162
Gilles Peskinee0866522019-02-19 19:44:00 +01003163 TEST_ASSERT( first_part_size <= input->len );
Gilles Peskine8817f612018-12-18 00:18:46 +01003164 PSA_ASSERT( psa_cipher_update( &operation, input->x, first_part_size,
3165 output, output_buffer_size,
3166 &function_output_length ) );
Gilles Peskinee0866522019-02-19 19:44:00 +01003167 TEST_ASSERT( function_output_length == output1_length );
Gilles Peskinea7ec95f2018-06-08 14:40:59 +02003168 total_output_length += function_output_length;
Gilles Peskine8817f612018-12-18 00:18:46 +01003169 PSA_ASSERT( psa_cipher_update( &operation,
3170 input->x + first_part_size,
3171 input->len - first_part_size,
Gilles Peskineee46fe72019-02-19 19:05:33 +01003172 output + total_output_length,
3173 output_buffer_size - total_output_length,
Gilles Peskine8817f612018-12-18 00:18:46 +01003174 &function_output_length ) );
Gilles Peskinee0866522019-02-19 19:44:00 +01003175 TEST_ASSERT( function_output_length == output2_length );
Gilles Peskinea7ec95f2018-06-08 14:40:59 +02003176 total_output_length += function_output_length;
Gilles Peskine8817f612018-12-18 00:18:46 +01003177 PSA_ASSERT( psa_cipher_finish( &operation,
Gilles Peskineee46fe72019-02-19 19:05:33 +01003178 output + total_output_length,
3179 output_buffer_size - total_output_length,
Gilles Peskine8817f612018-12-18 00:18:46 +01003180 &function_output_length ) );
Gilles Peskinea7ec95f2018-06-08 14:40:59 +02003181 total_output_length += function_output_length;
Gilles Peskine8817f612018-12-18 00:18:46 +01003182 PSA_ASSERT( psa_cipher_abort( &operation ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003183
Gilles Peskinebd7dea92018-09-27 13:57:19 +02003184 ASSERT_COMPARE( expected_output->x, expected_output->len,
3185 output, total_output_length );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003186
3187exit:
itayzafrir3e02b3b2018-06-12 17:06:52 +03003188 mbedtls_free( output );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003189 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02003190 PSA_DONE( );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003191}
3192/* END_CASE */
3193
3194/* BEGIN_CASE */
3195void cipher_decrypt_multipart( int alg_arg, int key_type_arg,
Gilles Peskine423005e2019-05-06 15:22:57 +02003196 data_t *key, data_t *iv,
itayzafrir3e02b3b2018-06-12 17:06:52 +03003197 data_t *input,
Gilles Peskinee0866522019-02-19 19:44:00 +01003198 int first_part_size_arg,
3199 int output1_length_arg, int output2_length_arg,
itayzafrir3e02b3b2018-06-12 17:06:52 +03003200 data_t *expected_output )
Gilles Peskine50e586b2018-06-08 14:28:46 +02003201{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003202 psa_key_handle_t handle = 0;
Gilles Peskine50e586b2018-06-08 14:28:46 +02003203
3204 psa_key_type_t key_type = key_type_arg;
3205 psa_algorithm_t alg = alg_arg;
Gilles Peskinee0866522019-02-19 19:44:00 +01003206 size_t first_part_size = first_part_size_arg;
3207 size_t output1_length = output1_length_arg;
3208 size_t output2_length = output2_length_arg;
itayzafrir3e02b3b2018-06-12 17:06:52 +03003209 unsigned char *output = NULL;
Gilles Peskine50e586b2018-06-08 14:28:46 +02003210 size_t output_buffer_size = 0;
3211 size_t function_output_length = 0;
Gilles Peskinea7ec95f2018-06-08 14:40:59 +02003212 size_t total_output_length = 0;
Jaeden Amero5bae2272019-01-04 11:48:27 +00003213 psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003214 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine50e586b2018-06-08 14:28:46 +02003215
Gilles Peskine8817f612018-12-18 00:18:46 +01003216 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003217
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003218 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DECRYPT );
3219 psa_set_key_algorithm( &attributes, alg );
3220 psa_set_key_type( &attributes, key_type );
Moran Pekered346952018-07-05 15:22:45 +03003221
Gilles Peskine73676cb2019-05-15 20:15:10 +02003222 PSA_ASSERT( psa_import_key( &attributes, key->x, key->len, &handle ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003223
Gilles Peskine8817f612018-12-18 00:18:46 +01003224 PSA_ASSERT( psa_cipher_decrypt_setup( &operation,
3225 handle, alg ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003226
Gilles Peskine423005e2019-05-06 15:22:57 +02003227 PSA_ASSERT( psa_cipher_set_iv( &operation, iv->x, iv->len ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003228
Gilles Peskine9d8eea72018-12-17 23:34:57 +01003229 output_buffer_size = ( (size_t) input->len +
3230 PSA_BLOCK_CIPHER_BLOCK_SIZE( key_type ) );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02003231 ASSERT_ALLOC( output, output_buffer_size );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003232
Gilles Peskinee0866522019-02-19 19:44:00 +01003233 TEST_ASSERT( first_part_size <= input->len );
Gilles Peskine8817f612018-12-18 00:18:46 +01003234 PSA_ASSERT( psa_cipher_update( &operation,
3235 input->x, first_part_size,
3236 output, output_buffer_size,
3237 &function_output_length ) );
Gilles Peskinee0866522019-02-19 19:44:00 +01003238 TEST_ASSERT( function_output_length == output1_length );
Gilles Peskinea7ec95f2018-06-08 14:40:59 +02003239 total_output_length += function_output_length;
Gilles Peskine8817f612018-12-18 00:18:46 +01003240 PSA_ASSERT( psa_cipher_update( &operation,
3241 input->x + first_part_size,
3242 input->len - first_part_size,
Gilles Peskineee46fe72019-02-19 19:05:33 +01003243 output + total_output_length,
3244 output_buffer_size - total_output_length,
Gilles Peskine8817f612018-12-18 00:18:46 +01003245 &function_output_length ) );
Gilles Peskinee0866522019-02-19 19:44:00 +01003246 TEST_ASSERT( function_output_length == output2_length );
Gilles Peskinea7ec95f2018-06-08 14:40:59 +02003247 total_output_length += function_output_length;
Gilles Peskine8817f612018-12-18 00:18:46 +01003248 PSA_ASSERT( psa_cipher_finish( &operation,
Gilles Peskineee46fe72019-02-19 19:05:33 +01003249 output + total_output_length,
3250 output_buffer_size - total_output_length,
Gilles Peskine8817f612018-12-18 00:18:46 +01003251 &function_output_length ) );
Gilles Peskinea7ec95f2018-06-08 14:40:59 +02003252 total_output_length += function_output_length;
Gilles Peskine8817f612018-12-18 00:18:46 +01003253 PSA_ASSERT( psa_cipher_abort( &operation ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003254
Gilles Peskinebd7dea92018-09-27 13:57:19 +02003255 ASSERT_COMPARE( expected_output->x, expected_output->len,
3256 output, total_output_length );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003257
3258exit:
itayzafrir3e02b3b2018-06-12 17:06:52 +03003259 mbedtls_free( output );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003260 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02003261 PSA_DONE( );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003262}
3263/* END_CASE */
3264
Gilles Peskine50e586b2018-06-08 14:28:46 +02003265/* BEGIN_CASE */
3266void cipher_decrypt( int alg_arg, int key_type_arg,
Gilles Peskine423005e2019-05-06 15:22:57 +02003267 data_t *key, data_t *iv,
itayzafrir3e02b3b2018-06-12 17:06:52 +03003268 data_t *input, data_t *expected_output,
Gilles Peskineb866e2b2018-06-21 09:25:10 +02003269 int expected_status_arg )
Gilles Peskine50e586b2018-06-08 14:28:46 +02003270{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003271 psa_key_handle_t handle = 0;
Gilles Peskine50e586b2018-06-08 14:28:46 +02003272 psa_status_t status;
3273 psa_key_type_t key_type = key_type_arg;
3274 psa_algorithm_t alg = alg_arg;
Gilles Peskineb866e2b2018-06-21 09:25:10 +02003275 psa_status_t expected_status = expected_status_arg;
itayzafrir3e02b3b2018-06-12 17:06:52 +03003276 unsigned char *output = NULL;
Gilles Peskine50e586b2018-06-08 14:28:46 +02003277 size_t output_buffer_size = 0;
3278 size_t function_output_length = 0;
Gilles Peskinea7ec95f2018-06-08 14:40:59 +02003279 size_t total_output_length = 0;
Jaeden Amero5bae2272019-01-04 11:48:27 +00003280 psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003281 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine50e586b2018-06-08 14:28:46 +02003282
Gilles Peskine8817f612018-12-18 00:18:46 +01003283 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003284
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003285 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DECRYPT );
3286 psa_set_key_algorithm( &attributes, alg );
3287 psa_set_key_type( &attributes, key_type );
Moran Pekered346952018-07-05 15:22:45 +03003288
Gilles Peskine73676cb2019-05-15 20:15:10 +02003289 PSA_ASSERT( psa_import_key( &attributes, key->x, key->len, &handle ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003290
Gilles Peskine8817f612018-12-18 00:18:46 +01003291 PSA_ASSERT( psa_cipher_decrypt_setup( &operation,
3292 handle, alg ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003293
Gilles Peskine423005e2019-05-06 15:22:57 +02003294 PSA_ASSERT( psa_cipher_set_iv( &operation, iv->x, iv->len ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003295
Gilles Peskine9d8eea72018-12-17 23:34:57 +01003296 output_buffer_size = ( (size_t) input->len +
3297 PSA_BLOCK_CIPHER_BLOCK_SIZE( key_type ) );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02003298 ASSERT_ALLOC( output, output_buffer_size );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003299
Gilles Peskine8817f612018-12-18 00:18:46 +01003300 PSA_ASSERT( psa_cipher_update( &operation,
3301 input->x, input->len,
3302 output, output_buffer_size,
3303 &function_output_length ) );
Gilles Peskinea7ec95f2018-06-08 14:40:59 +02003304 total_output_length += function_output_length;
Gilles Peskine50e586b2018-06-08 14:28:46 +02003305 status = psa_cipher_finish( &operation,
Gilles Peskineee46fe72019-02-19 19:05:33 +01003306 output + total_output_length,
3307 output_buffer_size - total_output_length,
Gilles Peskine50e586b2018-06-08 14:28:46 +02003308 &function_output_length );
Gilles Peskinea7ec95f2018-06-08 14:40:59 +02003309 total_output_length += function_output_length;
Gilles Peskinefe11b722018-12-18 00:24:04 +01003310 TEST_EQUAL( status, expected_status );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003311
3312 if( expected_status == PSA_SUCCESS )
3313 {
Gilles Peskine8817f612018-12-18 00:18:46 +01003314 PSA_ASSERT( psa_cipher_abort( &operation ) );
Gilles Peskinebd7dea92018-09-27 13:57:19 +02003315 ASSERT_COMPARE( expected_output->x, expected_output->len,
3316 output, total_output_length );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003317 }
3318
Gilles Peskine50e586b2018-06-08 14:28:46 +02003319exit:
itayzafrir3e02b3b2018-06-12 17:06:52 +03003320 mbedtls_free( output );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003321 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02003322 PSA_DONE( );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003323}
3324/* END_CASE */
3325
Gilles Peskine50e586b2018-06-08 14:28:46 +02003326/* BEGIN_CASE */
3327void cipher_verify_output( int alg_arg, int key_type_arg,
itayzafrir3e02b3b2018-06-12 17:06:52 +03003328 data_t *key,
3329 data_t *input )
mohammad1603d7d7ba52018-03-12 18:51:53 +02003330{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003331 psa_key_handle_t handle = 0;
mohammad1603d7d7ba52018-03-12 18:51:53 +02003332 psa_key_type_t key_type = key_type_arg;
3333 psa_algorithm_t alg = alg_arg;
mohammad1603e6b67a12018-03-12 10:38:49 -07003334 unsigned char iv[16] = {0};
mohammad1603d7d7ba52018-03-12 18:51:53 +02003335 size_t iv_size = 16;
3336 size_t iv_length = 0;
itayzafrir3e02b3b2018-06-12 17:06:52 +03003337 unsigned char *output1 = NULL;
mohammad1603d7d7ba52018-03-12 18:51:53 +02003338 size_t output1_size = 0;
3339 size_t output1_length = 0;
itayzafrir3e02b3b2018-06-12 17:06:52 +03003340 unsigned char *output2 = NULL;
mohammad1603d7d7ba52018-03-12 18:51:53 +02003341 size_t output2_size = 0;
3342 size_t output2_length = 0;
Gilles Peskine048b7f02018-06-08 14:20:49 +02003343 size_t function_output_length = 0;
Jaeden Amero5bae2272019-01-04 11:48:27 +00003344 psa_cipher_operation_t operation1 = PSA_CIPHER_OPERATION_INIT;
3345 psa_cipher_operation_t operation2 = PSA_CIPHER_OPERATION_INIT;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003346 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
mohammad1603d7d7ba52018-03-12 18:51:53 +02003347
Gilles Peskine8817f612018-12-18 00:18:46 +01003348 PSA_ASSERT( psa_crypto_init( ) );
mohammad1603d7d7ba52018-03-12 18:51:53 +02003349
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003350 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT );
3351 psa_set_key_algorithm( &attributes, alg );
3352 psa_set_key_type( &attributes, key_type );
Moran Pekered346952018-07-05 15:22:45 +03003353
Gilles Peskine73676cb2019-05-15 20:15:10 +02003354 PSA_ASSERT( psa_import_key( &attributes, key->x, key->len, &handle ) );
mohammad1603d7d7ba52018-03-12 18:51:53 +02003355
Gilles Peskine8817f612018-12-18 00:18:46 +01003356 PSA_ASSERT( psa_cipher_encrypt_setup( &operation1,
3357 handle, alg ) );
3358 PSA_ASSERT( psa_cipher_decrypt_setup( &operation2,
3359 handle, alg ) );
mohammad1603d7d7ba52018-03-12 18:51:53 +02003360
Gilles Peskine8817f612018-12-18 00:18:46 +01003361 PSA_ASSERT( psa_cipher_generate_iv( &operation1,
3362 iv, iv_size,
3363 &iv_length ) );
Gilles Peskine9d8eea72018-12-17 23:34:57 +01003364 output1_size = ( (size_t) input->len +
3365 PSA_BLOCK_CIPHER_BLOCK_SIZE( key_type ) );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02003366 ASSERT_ALLOC( output1, output1_size );
Moran Pekerded84402018-06-06 16:36:50 +03003367
Gilles Peskine8817f612018-12-18 00:18:46 +01003368 PSA_ASSERT( psa_cipher_update( &operation1, input->x, input->len,
3369 output1, output1_size,
3370 &output1_length ) );
3371 PSA_ASSERT( psa_cipher_finish( &operation1,
Gilles Peskineee46fe72019-02-19 19:05:33 +01003372 output1 + output1_length,
3373 output1_size - output1_length,
Gilles Peskine8817f612018-12-18 00:18:46 +01003374 &function_output_length ) );
Gilles Peskine4ca9c3f2018-06-06 18:44:09 +02003375
Gilles Peskine048b7f02018-06-08 14:20:49 +02003376 output1_length += function_output_length;
Moran Pekerded84402018-06-06 16:36:50 +03003377
Gilles Peskine8817f612018-12-18 00:18:46 +01003378 PSA_ASSERT( psa_cipher_abort( &operation1 ) );
Moran Pekerded84402018-06-06 16:36:50 +03003379
3380 output2_size = output1_length;
Gilles Peskine8cebbba2018-09-27 13:54:18 +02003381 ASSERT_ALLOC( output2, output2_size );
Moran Pekerded84402018-06-06 16:36:50 +03003382
Gilles Peskine8817f612018-12-18 00:18:46 +01003383 PSA_ASSERT( psa_cipher_set_iv( &operation2,
3384 iv, iv_length ) );
3385 PSA_ASSERT( psa_cipher_update( &operation2, output1, output1_length,
3386 output2, output2_size,
3387 &output2_length ) );
Gilles Peskine048b7f02018-06-08 14:20:49 +02003388 function_output_length = 0;
Gilles Peskine8817f612018-12-18 00:18:46 +01003389 PSA_ASSERT( psa_cipher_finish( &operation2,
3390 output2 + output2_length,
Gilles Peskineee46fe72019-02-19 19:05:33 +01003391 output2_size - output2_length,
Gilles Peskine8817f612018-12-18 00:18:46 +01003392 &function_output_length ) );
Moran Pekerded84402018-06-06 16:36:50 +03003393
Gilles Peskine048b7f02018-06-08 14:20:49 +02003394 output2_length += function_output_length;
Gilles Peskine4ca9c3f2018-06-06 18:44:09 +02003395
Gilles Peskine8817f612018-12-18 00:18:46 +01003396 PSA_ASSERT( psa_cipher_abort( &operation2 ) );
Moran Pekerded84402018-06-06 16:36:50 +03003397
Gilles Peskinebd7dea92018-09-27 13:57:19 +02003398 ASSERT_COMPARE( input->x, input->len, output2, output2_length );
Moran Pekerded84402018-06-06 16:36:50 +03003399
3400exit:
itayzafrir3e02b3b2018-06-12 17:06:52 +03003401 mbedtls_free( output1 );
3402 mbedtls_free( output2 );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003403 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02003404 PSA_DONE( );
Moran Pekerded84402018-06-06 16:36:50 +03003405}
3406/* END_CASE */
3407
3408/* BEGIN_CASE */
Gilles Peskine50e586b2018-06-08 14:28:46 +02003409void cipher_verify_output_multipart( int alg_arg,
3410 int key_type_arg,
itayzafrir3e02b3b2018-06-12 17:06:52 +03003411 data_t *key,
3412 data_t *input,
Gilles Peskinee0866522019-02-19 19:44:00 +01003413 int first_part_size_arg )
Moran Pekerded84402018-06-06 16:36:50 +03003414{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003415 psa_key_handle_t handle = 0;
Moran Pekerded84402018-06-06 16:36:50 +03003416 psa_key_type_t key_type = key_type_arg;
3417 psa_algorithm_t alg = alg_arg;
Gilles Peskinee0866522019-02-19 19:44:00 +01003418 size_t first_part_size = first_part_size_arg;
Moran Pekerded84402018-06-06 16:36:50 +03003419 unsigned char iv[16] = {0};
3420 size_t iv_size = 16;
3421 size_t iv_length = 0;
itayzafrir3e02b3b2018-06-12 17:06:52 +03003422 unsigned char *output1 = NULL;
Gilles Peskine048b7f02018-06-08 14:20:49 +02003423 size_t output1_buffer_size = 0;
Moran Pekerded84402018-06-06 16:36:50 +03003424 size_t output1_length = 0;
itayzafrir3e02b3b2018-06-12 17:06:52 +03003425 unsigned char *output2 = NULL;
Gilles Peskine048b7f02018-06-08 14:20:49 +02003426 size_t output2_buffer_size = 0;
Moran Pekerded84402018-06-06 16:36:50 +03003427 size_t output2_length = 0;
Gilles Peskine048b7f02018-06-08 14:20:49 +02003428 size_t function_output_length;
Jaeden Amero5bae2272019-01-04 11:48:27 +00003429 psa_cipher_operation_t operation1 = PSA_CIPHER_OPERATION_INIT;
3430 psa_cipher_operation_t operation2 = PSA_CIPHER_OPERATION_INIT;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003431 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Moran Pekerded84402018-06-06 16:36:50 +03003432
Gilles Peskine8817f612018-12-18 00:18:46 +01003433 PSA_ASSERT( psa_crypto_init( ) );
Moran Pekerded84402018-06-06 16:36:50 +03003434
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003435 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT );
3436 psa_set_key_algorithm( &attributes, alg );
3437 psa_set_key_type( &attributes, key_type );
Moran Pekered346952018-07-05 15:22:45 +03003438
Gilles Peskine73676cb2019-05-15 20:15:10 +02003439 PSA_ASSERT( psa_import_key( &attributes, key->x, key->len, &handle ) );
Moran Pekerded84402018-06-06 16:36:50 +03003440
Gilles Peskine8817f612018-12-18 00:18:46 +01003441 PSA_ASSERT( psa_cipher_encrypt_setup( &operation1,
3442 handle, alg ) );
3443 PSA_ASSERT( psa_cipher_decrypt_setup( &operation2,
3444 handle, alg ) );
Moran Pekerded84402018-06-06 16:36:50 +03003445
Gilles Peskine8817f612018-12-18 00:18:46 +01003446 PSA_ASSERT( psa_cipher_generate_iv( &operation1,
3447 iv, iv_size,
3448 &iv_length ) );
Gilles Peskine9d8eea72018-12-17 23:34:57 +01003449 output1_buffer_size = ( (size_t) input->len +
3450 PSA_BLOCK_CIPHER_BLOCK_SIZE( key_type ) );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02003451 ASSERT_ALLOC( output1, output1_buffer_size );
Moran Pekerded84402018-06-06 16:36:50 +03003452
Gilles Peskinee0866522019-02-19 19:44:00 +01003453 TEST_ASSERT( first_part_size <= input->len );
Gilles Peskine4ca9c3f2018-06-06 18:44:09 +02003454
Gilles Peskine8817f612018-12-18 00:18:46 +01003455 PSA_ASSERT( psa_cipher_update( &operation1, input->x, first_part_size,
3456 output1, output1_buffer_size,
3457 &function_output_length ) );
Gilles Peskine048b7f02018-06-08 14:20:49 +02003458 output1_length += function_output_length;
Moran Pekerded84402018-06-06 16:36:50 +03003459
Gilles Peskine8817f612018-12-18 00:18:46 +01003460 PSA_ASSERT( psa_cipher_update( &operation1,
3461 input->x + first_part_size,
3462 input->len - first_part_size,
3463 output1, output1_buffer_size,
3464 &function_output_length ) );
Gilles Peskine048b7f02018-06-08 14:20:49 +02003465 output1_length += function_output_length;
Moran Pekerded84402018-06-06 16:36:50 +03003466
Gilles Peskine8817f612018-12-18 00:18:46 +01003467 PSA_ASSERT( psa_cipher_finish( &operation1,
3468 output1 + output1_length,
3469 output1_buffer_size - output1_length,
3470 &function_output_length ) );
Gilles Peskine048b7f02018-06-08 14:20:49 +02003471 output1_length += function_output_length;
mohammad1603d7d7ba52018-03-12 18:51:53 +02003472
Gilles Peskine8817f612018-12-18 00:18:46 +01003473 PSA_ASSERT( psa_cipher_abort( &operation1 ) );
mohammad1603d7d7ba52018-03-12 18:51:53 +02003474
Gilles Peskine048b7f02018-06-08 14:20:49 +02003475 output2_buffer_size = output1_length;
Gilles Peskine8cebbba2018-09-27 13:54:18 +02003476 ASSERT_ALLOC( output2, output2_buffer_size );
mohammad1603d7d7ba52018-03-12 18:51:53 +02003477
Gilles Peskine8817f612018-12-18 00:18:46 +01003478 PSA_ASSERT( psa_cipher_set_iv( &operation2,
3479 iv, iv_length ) );
Moran Pekerded84402018-06-06 16:36:50 +03003480
Gilles Peskine8817f612018-12-18 00:18:46 +01003481 PSA_ASSERT( psa_cipher_update( &operation2, output1, first_part_size,
3482 output2, output2_buffer_size,
3483 &function_output_length ) );
Gilles Peskine048b7f02018-06-08 14:20:49 +02003484 output2_length += function_output_length;
Moran Pekerded84402018-06-06 16:36:50 +03003485
Gilles Peskine8817f612018-12-18 00:18:46 +01003486 PSA_ASSERT( psa_cipher_update( &operation2,
3487 output1 + first_part_size,
3488 output1_length - first_part_size,
3489 output2, output2_buffer_size,
3490 &function_output_length ) );
Gilles Peskine048b7f02018-06-08 14:20:49 +02003491 output2_length += function_output_length;
Moran Pekerded84402018-06-06 16:36:50 +03003492
Gilles Peskine8817f612018-12-18 00:18:46 +01003493 PSA_ASSERT( psa_cipher_finish( &operation2,
3494 output2 + output2_length,
3495 output2_buffer_size - output2_length,
3496 &function_output_length ) );
Gilles Peskine048b7f02018-06-08 14:20:49 +02003497 output2_length += function_output_length;
Gilles Peskine4ca9c3f2018-06-06 18:44:09 +02003498
Gilles Peskine8817f612018-12-18 00:18:46 +01003499 PSA_ASSERT( psa_cipher_abort( &operation2 ) );
mohammad1603d7d7ba52018-03-12 18:51:53 +02003500
Gilles Peskinebd7dea92018-09-27 13:57:19 +02003501 ASSERT_COMPARE( input->x, input->len, output2, output2_length );
mohammad1603d7d7ba52018-03-12 18:51:53 +02003502
3503exit:
itayzafrir3e02b3b2018-06-12 17:06:52 +03003504 mbedtls_free( output1 );
3505 mbedtls_free( output2 );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003506 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02003507 PSA_DONE( );
mohammad1603d7d7ba52018-03-12 18:51:53 +02003508}
3509/* END_CASE */
Gilles Peskine7268afc2018-06-06 15:19:24 +02003510
Gilles Peskine20035e32018-02-03 22:44:14 +01003511/* BEGIN_CASE */
Gilles Peskine7da96b02018-08-17 18:45:42 +02003512void aead_encrypt_decrypt( int key_type_arg, data_t *key_data,
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02003513 int alg_arg,
Gilles Peskine7da96b02018-08-17 18:45:42 +02003514 data_t *nonce,
3515 data_t *additional_data,
3516 data_t *input_data,
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02003517 int expected_result_arg )
Gilles Peskinea1cac842018-06-11 19:33:02 +02003518{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003519 psa_key_handle_t handle = 0;
Gilles Peskinea1cac842018-06-11 19:33:02 +02003520 psa_key_type_t key_type = key_type_arg;
3521 psa_algorithm_t alg = alg_arg;
Gilles Peskinea1cac842018-06-11 19:33:02 +02003522 unsigned char *output_data = NULL;
3523 size_t output_size = 0;
3524 size_t output_length = 0;
3525 unsigned char *output_data2 = NULL;
3526 size_t output_length2 = 0;
Gilles Peskine003a4a92019-05-14 16:09:40 +02003527 size_t tag_length = PSA_AEAD_TAG_LENGTH( alg );
Gilles Peskine4abf7412018-06-18 16:35:34 +02003528 psa_status_t expected_result = expected_result_arg;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003529 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskinea1cac842018-06-11 19:33:02 +02003530
Gilles Peskine4abf7412018-06-18 16:35:34 +02003531 output_size = input_data->len + tag_length;
Gilles Peskine003a4a92019-05-14 16:09:40 +02003532 /* For all currently defined algorithms, PSA_AEAD_ENCRYPT_OUTPUT_SIZE
3533 * should be exact. */
3534 if( expected_result != PSA_ERROR_INVALID_ARGUMENT )
3535 TEST_EQUAL( output_size,
3536 PSA_AEAD_ENCRYPT_OUTPUT_SIZE( alg, input_data->len ) );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02003537 ASSERT_ALLOC( output_data, output_size );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003538
Gilles Peskine8817f612018-12-18 00:18:46 +01003539 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003540
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003541 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT );
3542 psa_set_key_algorithm( &attributes, alg );
3543 psa_set_key_type( &attributes, key_type );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003544
Gilles Peskine049c7532019-05-15 20:22:09 +02003545 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
3546 &handle ) );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003547
Gilles Peskinefe11b722018-12-18 00:24:04 +01003548 TEST_EQUAL( psa_aead_encrypt( handle, alg,
3549 nonce->x, nonce->len,
3550 additional_data->x,
3551 additional_data->len,
3552 input_data->x, input_data->len,
3553 output_data, output_size,
Gilles Peskinef812dcf2018-12-18 00:33:25 +01003554 &output_length ),
3555 expected_result );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003556
3557 if( PSA_SUCCESS == expected_result )
3558 {
Gilles Peskine8cebbba2018-09-27 13:54:18 +02003559 ASSERT_ALLOC( output_data2, output_length );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003560
Gilles Peskine003a4a92019-05-14 16:09:40 +02003561 /* For all currently defined algorithms, PSA_AEAD_DECRYPT_OUTPUT_SIZE
3562 * should be exact. */
3563 TEST_EQUAL( input_data->len,
3564 PSA_AEAD_DECRYPT_OUTPUT_SIZE( alg, output_length ) );
3565
Gilles Peskinefe11b722018-12-18 00:24:04 +01003566 TEST_EQUAL( psa_aead_decrypt( handle, alg,
3567 nonce->x, nonce->len,
3568 additional_data->x,
3569 additional_data->len,
3570 output_data, output_length,
3571 output_data2, output_length,
Gilles Peskinef812dcf2018-12-18 00:33:25 +01003572 &output_length2 ),
3573 expected_result );
Gilles Peskine2d277862018-06-18 15:41:12 +02003574
Gilles Peskinebd7dea92018-09-27 13:57:19 +02003575 ASSERT_COMPARE( input_data->x, input_data->len,
3576 output_data2, output_length2 );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003577 }
Gilles Peskine2d277862018-06-18 15:41:12 +02003578
Gilles Peskinea1cac842018-06-11 19:33:02 +02003579exit:
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003580 psa_destroy_key( handle );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003581 mbedtls_free( output_data );
3582 mbedtls_free( output_data2 );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02003583 PSA_DONE( );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003584}
3585/* END_CASE */
3586
3587/* BEGIN_CASE */
Gilles Peskine7da96b02018-08-17 18:45:42 +02003588void aead_encrypt( int key_type_arg, data_t *key_data,
3589 int alg_arg,
3590 data_t *nonce,
3591 data_t *additional_data,
3592 data_t *input_data,
3593 data_t *expected_result )
Gilles Peskinea1cac842018-06-11 19:33:02 +02003594{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003595 psa_key_handle_t handle = 0;
Gilles Peskinea1cac842018-06-11 19:33:02 +02003596 psa_key_type_t key_type = key_type_arg;
3597 psa_algorithm_t alg = alg_arg;
Gilles Peskinea1cac842018-06-11 19:33:02 +02003598 unsigned char *output_data = NULL;
3599 size_t output_size = 0;
3600 size_t output_length = 0;
Gilles Peskine003a4a92019-05-14 16:09:40 +02003601 size_t tag_length = PSA_AEAD_TAG_LENGTH( alg );
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003602 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskinea1cac842018-06-11 19:33:02 +02003603
Gilles Peskine4abf7412018-06-18 16:35:34 +02003604 output_size = input_data->len + tag_length;
Gilles Peskine003a4a92019-05-14 16:09:40 +02003605 /* For all currently defined algorithms, PSA_AEAD_ENCRYPT_OUTPUT_SIZE
3606 * should be exact. */
3607 TEST_EQUAL( output_size,
3608 PSA_AEAD_ENCRYPT_OUTPUT_SIZE( alg, input_data->len ) );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02003609 ASSERT_ALLOC( output_data, output_size );
Gilles Peskine2d277862018-06-18 15:41:12 +02003610
Gilles Peskine8817f612018-12-18 00:18:46 +01003611 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003612
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003613 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT );
3614 psa_set_key_algorithm( &attributes, alg );
3615 psa_set_key_type( &attributes, key_type );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003616
Gilles Peskine049c7532019-05-15 20:22:09 +02003617 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
3618 &handle ) );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003619
Gilles Peskine8817f612018-12-18 00:18:46 +01003620 PSA_ASSERT( psa_aead_encrypt( handle, alg,
3621 nonce->x, nonce->len,
3622 additional_data->x, additional_data->len,
3623 input_data->x, input_data->len,
3624 output_data, output_size,
3625 &output_length ) );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003626
Gilles Peskinebd7dea92018-09-27 13:57:19 +02003627 ASSERT_COMPARE( expected_result->x, expected_result->len,
3628 output_data, output_length );
Gilles Peskine2d277862018-06-18 15:41:12 +02003629
Gilles Peskinea1cac842018-06-11 19:33:02 +02003630exit:
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003631 psa_destroy_key( handle );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003632 mbedtls_free( output_data );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02003633 PSA_DONE( );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003634}
3635/* END_CASE */
3636
3637/* BEGIN_CASE */
Gilles Peskine7da96b02018-08-17 18:45:42 +02003638void aead_decrypt( int key_type_arg, data_t *key_data,
3639 int alg_arg,
3640 data_t *nonce,
3641 data_t *additional_data,
3642 data_t *input_data,
3643 data_t *expected_data,
3644 int expected_result_arg )
Gilles Peskinea1cac842018-06-11 19:33:02 +02003645{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003646 psa_key_handle_t handle = 0;
Gilles Peskinea1cac842018-06-11 19:33:02 +02003647 psa_key_type_t key_type = key_type_arg;
3648 psa_algorithm_t alg = alg_arg;
Gilles Peskinea1cac842018-06-11 19:33:02 +02003649 unsigned char *output_data = NULL;
3650 size_t output_size = 0;
3651 size_t output_length = 0;
Gilles Peskine003a4a92019-05-14 16:09:40 +02003652 size_t tag_length = PSA_AEAD_TAG_LENGTH( alg );
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003653 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine4abf7412018-06-18 16:35:34 +02003654 psa_status_t expected_result = expected_result_arg;
Gilles Peskinea1cac842018-06-11 19:33:02 +02003655
Gilles Peskine003a4a92019-05-14 16:09:40 +02003656 output_size = input_data->len - tag_length;
3657 /* For all currently defined algorithms, PSA_AEAD_DECRYPT_OUTPUT_SIZE
3658 * should be exact. */
3659 if( expected_result != PSA_ERROR_INVALID_ARGUMENT )
3660 TEST_EQUAL( output_size,
3661 PSA_AEAD_DECRYPT_OUTPUT_SIZE( alg, input_data->len ) );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02003662 ASSERT_ALLOC( output_data, output_size );
Gilles Peskine2d277862018-06-18 15:41:12 +02003663
Gilles Peskine8817f612018-12-18 00:18:46 +01003664 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003665
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003666 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DECRYPT );
3667 psa_set_key_algorithm( &attributes, alg );
3668 psa_set_key_type( &attributes, key_type );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003669
Gilles Peskine049c7532019-05-15 20:22:09 +02003670 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
3671 &handle ) );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003672
Gilles Peskinefe11b722018-12-18 00:24:04 +01003673 TEST_EQUAL( psa_aead_decrypt( handle, alg,
3674 nonce->x, nonce->len,
3675 additional_data->x,
3676 additional_data->len,
3677 input_data->x, input_data->len,
3678 output_data, output_size,
Gilles Peskinef812dcf2018-12-18 00:33:25 +01003679 &output_length ),
3680 expected_result );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003681
Gilles Peskine2d277862018-06-18 15:41:12 +02003682 if( expected_result == PSA_SUCCESS )
Gilles Peskinebd7dea92018-09-27 13:57:19 +02003683 ASSERT_COMPARE( expected_data->x, expected_data->len,
3684 output_data, output_length );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003685
Gilles Peskinea1cac842018-06-11 19:33:02 +02003686exit:
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003687 psa_destroy_key( handle );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003688 mbedtls_free( output_data );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02003689 PSA_DONE( );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003690}
3691/* END_CASE */
3692
3693/* BEGIN_CASE */
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02003694void signature_size( int type_arg,
3695 int bits,
3696 int alg_arg,
3697 int expected_size_arg )
Gilles Peskinee59236f2018-01-27 23:32:46 +01003698{
3699 psa_key_type_t type = type_arg;
3700 psa_algorithm_t alg = alg_arg;
Gilles Peskine2d277862018-06-18 15:41:12 +02003701 size_t actual_size = PSA_ASYMMETRIC_SIGN_OUTPUT_SIZE( type, bits, alg );
Gilles Peskinefe11b722018-12-18 00:24:04 +01003702 TEST_EQUAL( actual_size, (size_t) expected_size_arg );
Gilles Peskinee59236f2018-01-27 23:32:46 +01003703exit:
3704 ;
3705}
3706/* END_CASE */
3707
3708/* BEGIN_CASE */
itayzafrir3e02b3b2018-06-12 17:06:52 +03003709void sign_deterministic( int key_type_arg, data_t *key_data,
3710 int alg_arg, data_t *input_data,
3711 data_t *output_data )
Gilles Peskinee59236f2018-01-27 23:32:46 +01003712{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003713 psa_key_handle_t handle = 0;
Gilles Peskinee59236f2018-01-27 23:32:46 +01003714 psa_key_type_t key_type = key_type_arg;
3715 psa_algorithm_t alg = alg_arg;
Gilles Peskine20035e32018-02-03 22:44:14 +01003716 size_t key_bits;
Gilles Peskine20035e32018-02-03 22:44:14 +01003717 unsigned char *signature = NULL;
3718 size_t signature_size;
3719 size_t signature_length = 0xdeadbeef;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02003720 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine20035e32018-02-03 22:44:14 +01003721
Gilles Peskine8817f612018-12-18 00:18:46 +01003722 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine20035e32018-02-03 22:44:14 +01003723
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003724 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_SIGN );
3725 psa_set_key_algorithm( &attributes, alg );
3726 psa_set_key_type( &attributes, key_type );
mohammad1603a97cb8c2018-03-28 03:46:26 -07003727
Gilles Peskine049c7532019-05-15 20:22:09 +02003728 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
3729 &handle ) );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02003730 PSA_ASSERT( psa_get_key_attributes( handle, &attributes ) );
3731 key_bits = psa_get_key_bits( &attributes );
Gilles Peskine20035e32018-02-03 22:44:14 +01003732
Gilles Peskine860ce9d2018-06-28 12:23:00 +02003733 /* Allocate a buffer which has the size advertized by the
3734 * library. */
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02003735 signature_size = PSA_ASYMMETRIC_SIGN_OUTPUT_SIZE( key_type,
3736 key_bits, alg );
Gilles Peskine20035e32018-02-03 22:44:14 +01003737 TEST_ASSERT( signature_size != 0 );
Gilles Peskine69c12672018-06-28 00:07:19 +02003738 TEST_ASSERT( signature_size <= PSA_ASYMMETRIC_SIGNATURE_MAX_SIZE );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02003739 ASSERT_ALLOC( signature, signature_size );
Gilles Peskine20035e32018-02-03 22:44:14 +01003740
Gilles Peskine860ce9d2018-06-28 12:23:00 +02003741 /* Perform the signature. */
Gilles Peskine8817f612018-12-18 00:18:46 +01003742 PSA_ASSERT( psa_asymmetric_sign( handle, alg,
3743 input_data->x, input_data->len,
3744 signature, signature_size,
3745 &signature_length ) );
Gilles Peskine9911b022018-06-29 17:30:48 +02003746 /* Verify that the signature is what is expected. */
Gilles Peskinebd7dea92018-09-27 13:57:19 +02003747 ASSERT_COMPARE( output_data->x, output_data->len,
3748 signature, signature_length );
Gilles Peskine20035e32018-02-03 22:44:14 +01003749
3750exit:
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02003751 psa_reset_key_attributes( &attributes );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003752 psa_destroy_key( handle );
Gilles Peskine0189e752018-02-03 23:57:22 +01003753 mbedtls_free( signature );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02003754 PSA_DONE( );
Gilles Peskine20035e32018-02-03 22:44:14 +01003755}
3756/* END_CASE */
3757
3758/* BEGIN_CASE */
itayzafrir3e02b3b2018-06-12 17:06:52 +03003759void sign_fail( int key_type_arg, data_t *key_data,
3760 int alg_arg, data_t *input_data,
Gilles Peskine860ce9d2018-06-28 12:23:00 +02003761 int signature_size_arg, int expected_status_arg )
Gilles Peskine20035e32018-02-03 22:44:14 +01003762{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003763 psa_key_handle_t handle = 0;
Gilles Peskine20035e32018-02-03 22:44:14 +01003764 psa_key_type_t key_type = key_type_arg;
3765 psa_algorithm_t alg = alg_arg;
Gilles Peskine860ce9d2018-06-28 12:23:00 +02003766 size_t signature_size = signature_size_arg;
Gilles Peskine20035e32018-02-03 22:44:14 +01003767 psa_status_t actual_status;
3768 psa_status_t expected_status = expected_status_arg;
Gilles Peskine40f68b92018-03-07 16:43:36 +01003769 unsigned char *signature = NULL;
Gilles Peskine93aa0332018-02-03 23:58:03 +01003770 size_t signature_length = 0xdeadbeef;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003771 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine20035e32018-02-03 22:44:14 +01003772
Gilles Peskine8cebbba2018-09-27 13:54:18 +02003773 ASSERT_ALLOC( signature, signature_size );
Gilles Peskine20035e32018-02-03 22:44:14 +01003774
Gilles Peskine8817f612018-12-18 00:18:46 +01003775 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine20035e32018-02-03 22:44:14 +01003776
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003777 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_SIGN );
3778 psa_set_key_algorithm( &attributes, alg );
3779 psa_set_key_type( &attributes, key_type );
mohammad1603a97cb8c2018-03-28 03:46:26 -07003780
Gilles Peskine049c7532019-05-15 20:22:09 +02003781 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
3782 &handle ) );
Gilles Peskine20035e32018-02-03 22:44:14 +01003783
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003784 actual_status = psa_asymmetric_sign( handle, alg,
Gilles Peskine4abf7412018-06-18 16:35:34 +02003785 input_data->x, input_data->len,
Gilles Peskine20035e32018-02-03 22:44:14 +01003786 signature, signature_size,
3787 &signature_length );
Gilles Peskinefe11b722018-12-18 00:24:04 +01003788 TEST_EQUAL( actual_status, expected_status );
Gilles Peskine860ce9d2018-06-28 12:23:00 +02003789 /* The value of *signature_length is unspecified on error, but
3790 * whatever it is, it should be less than signature_size, so that
3791 * if the caller tries to read *signature_length bytes without
3792 * checking the error code then they don't overflow a buffer. */
3793 TEST_ASSERT( signature_length <= signature_size );
Gilles Peskine20035e32018-02-03 22:44:14 +01003794
3795exit:
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02003796 psa_reset_key_attributes( &attributes );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003797 psa_destroy_key( handle );
Gilles Peskine20035e32018-02-03 22:44:14 +01003798 mbedtls_free( signature );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02003799 PSA_DONE( );
Gilles Peskine20035e32018-02-03 22:44:14 +01003800}
3801/* END_CASE */
mohammad16038cc1cee2018-03-28 01:21:33 +03003802
3803/* BEGIN_CASE */
Gilles Peskine9911b022018-06-29 17:30:48 +02003804void sign_verify( int key_type_arg, data_t *key_data,
3805 int alg_arg, data_t *input_data )
3806{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003807 psa_key_handle_t handle = 0;
Gilles Peskine9911b022018-06-29 17:30:48 +02003808 psa_key_type_t key_type = key_type_arg;
3809 psa_algorithm_t alg = alg_arg;
3810 size_t key_bits;
3811 unsigned char *signature = NULL;
3812 size_t signature_size;
3813 size_t signature_length = 0xdeadbeef;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02003814 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine9911b022018-06-29 17:30:48 +02003815
Gilles Peskine8817f612018-12-18 00:18:46 +01003816 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine9911b022018-06-29 17:30:48 +02003817
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003818 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_SIGN | PSA_KEY_USAGE_VERIFY );
3819 psa_set_key_algorithm( &attributes, alg );
3820 psa_set_key_type( &attributes, key_type );
Gilles Peskine9911b022018-06-29 17:30:48 +02003821
Gilles Peskine049c7532019-05-15 20:22:09 +02003822 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
3823 &handle ) );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02003824 PSA_ASSERT( psa_get_key_attributes( handle, &attributes ) );
3825 key_bits = psa_get_key_bits( &attributes );
Gilles Peskine9911b022018-06-29 17:30:48 +02003826
3827 /* Allocate a buffer which has the size advertized by the
3828 * library. */
3829 signature_size = PSA_ASYMMETRIC_SIGN_OUTPUT_SIZE( key_type,
3830 key_bits, alg );
3831 TEST_ASSERT( signature_size != 0 );
3832 TEST_ASSERT( signature_size <= PSA_ASYMMETRIC_SIGNATURE_MAX_SIZE );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02003833 ASSERT_ALLOC( signature, signature_size );
Gilles Peskine9911b022018-06-29 17:30:48 +02003834
3835 /* Perform the signature. */
Gilles Peskine8817f612018-12-18 00:18:46 +01003836 PSA_ASSERT( psa_asymmetric_sign( handle, alg,
3837 input_data->x, input_data->len,
3838 signature, signature_size,
3839 &signature_length ) );
Gilles Peskine9911b022018-06-29 17:30:48 +02003840 /* Check that the signature length looks sensible. */
3841 TEST_ASSERT( signature_length <= signature_size );
3842 TEST_ASSERT( signature_length > 0 );
3843
3844 /* Use the library to verify that the signature is correct. */
Gilles Peskine8817f612018-12-18 00:18:46 +01003845 PSA_ASSERT( psa_asymmetric_verify(
3846 handle, alg,
3847 input_data->x, input_data->len,
3848 signature, signature_length ) );
Gilles Peskine9911b022018-06-29 17:30:48 +02003849
3850 if( input_data->len != 0 )
3851 {
3852 /* Flip a bit in the input and verify that the signature is now
3853 * detected as invalid. Flip a bit at the beginning, not at the end,
3854 * because ECDSA may ignore the last few bits of the input. */
3855 input_data->x[0] ^= 1;
Gilles Peskinef812dcf2018-12-18 00:33:25 +01003856 TEST_EQUAL( psa_asymmetric_verify( handle, alg,
3857 input_data->x, input_data->len,
3858 signature, signature_length ),
3859 PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskine9911b022018-06-29 17:30:48 +02003860 }
3861
3862exit:
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02003863 psa_reset_key_attributes( &attributes );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003864 psa_destroy_key( handle );
Gilles Peskine9911b022018-06-29 17:30:48 +02003865 mbedtls_free( signature );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02003866 PSA_DONE( );
Gilles Peskine9911b022018-06-29 17:30:48 +02003867}
3868/* END_CASE */
3869
3870/* BEGIN_CASE */
itayzafrir3e02b3b2018-06-12 17:06:52 +03003871void asymmetric_verify( int key_type_arg, data_t *key_data,
3872 int alg_arg, data_t *hash_data,
3873 data_t *signature_data )
itayzafrir5c753392018-05-08 11:18:38 +03003874{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003875 psa_key_handle_t handle = 0;
itayzafrir5c753392018-05-08 11:18:38 +03003876 psa_key_type_t key_type = key_type_arg;
3877 psa_algorithm_t alg = alg_arg;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003878 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
itayzafrir5c753392018-05-08 11:18:38 +03003879
Gilles Peskine69c12672018-06-28 00:07:19 +02003880 TEST_ASSERT( signature_data->len <= PSA_ASYMMETRIC_SIGNATURE_MAX_SIZE );
3881
Gilles Peskine8817f612018-12-18 00:18:46 +01003882 PSA_ASSERT( psa_crypto_init( ) );
itayzafrir5c753392018-05-08 11:18:38 +03003883
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003884 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_VERIFY );
3885 psa_set_key_algorithm( &attributes, alg );
3886 psa_set_key_type( &attributes, key_type );
itayzafrir5c753392018-05-08 11:18:38 +03003887
Gilles Peskine049c7532019-05-15 20:22:09 +02003888 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
3889 &handle ) );
itayzafrir5c753392018-05-08 11:18:38 +03003890
Gilles Peskine8817f612018-12-18 00:18:46 +01003891 PSA_ASSERT( psa_asymmetric_verify( handle, alg,
3892 hash_data->x, hash_data->len,
3893 signature_data->x,
3894 signature_data->len ) );
itayzafrir5c753392018-05-08 11:18:38 +03003895exit:
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02003896 psa_reset_key_attributes( &attributes );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003897 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02003898 PSA_DONE( );
itayzafrir5c753392018-05-08 11:18:38 +03003899}
3900/* END_CASE */
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003901
3902/* BEGIN_CASE */
itayzafrir3e02b3b2018-06-12 17:06:52 +03003903void asymmetric_verify_fail( int key_type_arg, data_t *key_data,
3904 int alg_arg, data_t *hash_data,
3905 data_t *signature_data,
3906 int expected_status_arg )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003907{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003908 psa_key_handle_t handle = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003909 psa_key_type_t key_type = key_type_arg;
3910 psa_algorithm_t alg = alg_arg;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003911 psa_status_t actual_status;
3912 psa_status_t expected_status = expected_status_arg;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003913 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003914
Gilles Peskine8817f612018-12-18 00:18:46 +01003915 PSA_ASSERT( psa_crypto_init( ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003916
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003917 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_VERIFY );
3918 psa_set_key_algorithm( &attributes, alg );
3919 psa_set_key_type( &attributes, key_type );
Nir Sonnenscheind7082602018-06-04 16:45:27 +03003920
Gilles Peskine049c7532019-05-15 20:22:09 +02003921 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
3922 &handle ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003923
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003924 actual_status = psa_asymmetric_verify( handle, alg,
Gilles Peskine4abf7412018-06-18 16:35:34 +02003925 hash_data->x, hash_data->len,
Gilles Peskine2d277862018-06-18 15:41:12 +02003926 signature_data->x,
Gilles Peskine4abf7412018-06-18 16:35:34 +02003927 signature_data->len );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003928
Gilles Peskinefe11b722018-12-18 00:24:04 +01003929 TEST_EQUAL( actual_status, expected_status );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003930
3931exit:
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02003932 psa_reset_key_attributes( &attributes );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003933 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02003934 PSA_DONE( );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003935}
3936/* END_CASE */
3937
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003938/* BEGIN_CASE */
Gilles Peskine656896e2018-06-29 19:12:28 +02003939void asymmetric_encrypt( int key_type_arg,
3940 data_t *key_data,
3941 int alg_arg,
3942 data_t *input_data,
Gilles Peskine68428122018-06-30 18:42:41 +02003943 data_t *label,
Gilles Peskine656896e2018-06-29 19:12:28 +02003944 int expected_output_length_arg,
3945 int expected_status_arg )
3946{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003947 psa_key_handle_t handle = 0;
Gilles Peskine656896e2018-06-29 19:12:28 +02003948 psa_key_type_t key_type = key_type_arg;
3949 psa_algorithm_t alg = alg_arg;
3950 size_t expected_output_length = expected_output_length_arg;
3951 size_t key_bits;
3952 unsigned char *output = NULL;
3953 size_t output_size;
3954 size_t output_length = ~0;
3955 psa_status_t actual_status;
3956 psa_status_t expected_status = expected_status_arg;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02003957 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine656896e2018-06-29 19:12:28 +02003958
Gilles Peskine8817f612018-12-18 00:18:46 +01003959 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003960
Gilles Peskine656896e2018-06-29 19:12:28 +02003961 /* Import the key */
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003962 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT );
3963 psa_set_key_algorithm( &attributes, alg );
3964 psa_set_key_type( &attributes, key_type );
Gilles Peskine049c7532019-05-15 20:22:09 +02003965 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
3966 &handle ) );
Gilles Peskine656896e2018-06-29 19:12:28 +02003967
3968 /* Determine the maximum output length */
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02003969 PSA_ASSERT( psa_get_key_attributes( handle, &attributes ) );
3970 key_bits = psa_get_key_bits( &attributes );
Gilles Peskine656896e2018-06-29 19:12:28 +02003971 output_size = PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE( key_type, key_bits, alg );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02003972 ASSERT_ALLOC( output, output_size );
Gilles Peskine656896e2018-06-29 19:12:28 +02003973
3974 /* Encrypt the input */
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003975 actual_status = psa_asymmetric_encrypt( handle, alg,
Gilles Peskine656896e2018-06-29 19:12:28 +02003976 input_data->x, input_data->len,
Gilles Peskine68428122018-06-30 18:42:41 +02003977 label->x, label->len,
Gilles Peskine656896e2018-06-29 19:12:28 +02003978 output, output_size,
3979 &output_length );
Gilles Peskinefe11b722018-12-18 00:24:04 +01003980 TEST_EQUAL( actual_status, expected_status );
3981 TEST_EQUAL( output_length, expected_output_length );
Gilles Peskine656896e2018-06-29 19:12:28 +02003982
Gilles Peskine68428122018-06-30 18:42:41 +02003983 /* If the label is empty, the test framework puts a non-null pointer
3984 * in label->x. Test that a null pointer works as well. */
3985 if( label->len == 0 )
3986 {
3987 output_length = ~0;
Gilles Peskinef7ab5ad2018-09-26 18:19:24 +02003988 if( output_size != 0 )
3989 memset( output, 0, output_size );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003990 actual_status = psa_asymmetric_encrypt( handle, alg,
Gilles Peskine68428122018-06-30 18:42:41 +02003991 input_data->x, input_data->len,
3992 NULL, label->len,
3993 output, output_size,
3994 &output_length );
Gilles Peskinefe11b722018-12-18 00:24:04 +01003995 TEST_EQUAL( actual_status, expected_status );
3996 TEST_EQUAL( output_length, expected_output_length );
Gilles Peskine68428122018-06-30 18:42:41 +02003997 }
3998
Gilles Peskine656896e2018-06-29 19:12:28 +02003999exit:
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02004000 psa_reset_key_attributes( &attributes );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004001 psa_destroy_key( handle );
Gilles Peskine656896e2018-06-29 19:12:28 +02004002 mbedtls_free( output );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02004003 PSA_DONE( );
Gilles Peskine656896e2018-06-29 19:12:28 +02004004}
4005/* END_CASE */
4006
4007/* BEGIN_CASE */
Gilles Peskine68428122018-06-30 18:42:41 +02004008void asymmetric_encrypt_decrypt( int key_type_arg,
4009 data_t *key_data,
4010 int alg_arg,
4011 data_t *input_data,
4012 data_t *label )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004013{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004014 psa_key_handle_t handle = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004015 psa_key_type_t key_type = key_type_arg;
4016 psa_algorithm_t alg = alg_arg;
Gilles Peskine55c94dd2018-06-30 18:54:48 +02004017 size_t key_bits;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004018 unsigned char *output = NULL;
Gilles Peskine55c94dd2018-06-30 18:54:48 +02004019 size_t output_size;
4020 size_t output_length = ~0;
Nir Sonnenschein0f3bdbd2018-05-02 23:56:12 +03004021 unsigned char *output2 = NULL;
Gilles Peskine55c94dd2018-06-30 18:54:48 +02004022 size_t output2_size;
4023 size_t output2_length = ~0;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02004024 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004025
Gilles Peskine8817f612018-12-18 00:18:46 +01004026 PSA_ASSERT( psa_crypto_init( ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004027
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02004028 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT );
4029 psa_set_key_algorithm( &attributes, alg );
4030 psa_set_key_type( &attributes, key_type );
Nir Sonnenscheind7082602018-06-04 16:45:27 +03004031
Gilles Peskine049c7532019-05-15 20:22:09 +02004032 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
4033 &handle ) );
Gilles Peskine55c94dd2018-06-30 18:54:48 +02004034
4035 /* Determine the maximum ciphertext length */
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02004036 PSA_ASSERT( psa_get_key_attributes( handle, &attributes ) );
4037 key_bits = psa_get_key_bits( &attributes );
Gilles Peskine55c94dd2018-06-30 18:54:48 +02004038 output_size = PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE( key_type, key_bits, alg );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02004039 ASSERT_ALLOC( output, output_size );
Gilles Peskine55c94dd2018-06-30 18:54:48 +02004040 output2_size = input_data->len;
Gilles Peskine8cebbba2018-09-27 13:54:18 +02004041 ASSERT_ALLOC( output2, output2_size );
Gilles Peskine55c94dd2018-06-30 18:54:48 +02004042
Gilles Peskineeebd7382018-06-08 18:11:54 +02004043 /* We test encryption by checking that encrypt-then-decrypt gives back
4044 * the original plaintext because of the non-optional random
4045 * part of encryption process which prevents using fixed vectors. */
Gilles Peskine8817f612018-12-18 00:18:46 +01004046 PSA_ASSERT( psa_asymmetric_encrypt( handle, alg,
4047 input_data->x, input_data->len,
4048 label->x, label->len,
4049 output, output_size,
4050 &output_length ) );
Gilles Peskine55c94dd2018-06-30 18:54:48 +02004051 /* We don't know what ciphertext length to expect, but check that
4052 * it looks sensible. */
4053 TEST_ASSERT( output_length <= output_size );
Nir Sonnenschein0f3bdbd2018-05-02 23:56:12 +03004054
Gilles Peskine8817f612018-12-18 00:18:46 +01004055 PSA_ASSERT( psa_asymmetric_decrypt( handle, alg,
4056 output, output_length,
4057 label->x, label->len,
4058 output2, output2_size,
4059 &output2_length ) );
Gilles Peskinebd7dea92018-09-27 13:57:19 +02004060 ASSERT_COMPARE( input_data->x, input_data->len,
4061 output2, output2_length );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004062
4063exit:
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02004064 psa_reset_key_attributes( &attributes );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004065 psa_destroy_key( handle );
itayzafrir3e02b3b2018-06-12 17:06:52 +03004066 mbedtls_free( output );
4067 mbedtls_free( output2 );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02004068 PSA_DONE( );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004069}
4070/* END_CASE */
4071
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004072/* BEGIN_CASE */
Gilles Peskine68428122018-06-30 18:42:41 +02004073void asymmetric_decrypt( int key_type_arg,
4074 data_t *key_data,
4075 int alg_arg,
4076 data_t *input_data,
4077 data_t *label,
Gilles Peskine66763a02018-06-29 21:54:10 +02004078 data_t *expected_data )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004079{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004080 psa_key_handle_t handle = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004081 psa_key_type_t key_type = key_type_arg;
4082 psa_algorithm_t alg = alg_arg;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004083 unsigned char *output = NULL;
Nir Sonnenscheind70bc482018-06-04 16:31:13 +03004084 size_t output_size = 0;
Gilles Peskine55c94dd2018-06-30 18:54:48 +02004085 size_t output_length = ~0;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02004086 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004087
Jaeden Amero412654a2019-02-06 12:57:46 +00004088 output_size = expected_data->len;
Gilles Peskine8cebbba2018-09-27 13:54:18 +02004089 ASSERT_ALLOC( output, output_size );
Gilles Peskine5b051bc2018-05-31 13:25:48 +02004090
Gilles Peskine8817f612018-12-18 00:18:46 +01004091 PSA_ASSERT( psa_crypto_init( ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004092
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02004093 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DECRYPT );
4094 psa_set_key_algorithm( &attributes, alg );
4095 psa_set_key_type( &attributes, key_type );
Nir Sonnenscheind7082602018-06-04 16:45:27 +03004096
Gilles Peskine049c7532019-05-15 20:22:09 +02004097 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
4098 &handle ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004099
Gilles Peskine8817f612018-12-18 00:18:46 +01004100 PSA_ASSERT( psa_asymmetric_decrypt( handle, alg,
4101 input_data->x, input_data->len,
4102 label->x, label->len,
4103 output,
4104 output_size,
4105 &output_length ) );
Gilles Peskinebd7dea92018-09-27 13:57:19 +02004106 ASSERT_COMPARE( expected_data->x, expected_data->len,
4107 output, output_length );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004108
Gilles Peskine68428122018-06-30 18:42:41 +02004109 /* If the label is empty, the test framework puts a non-null pointer
4110 * in label->x. Test that a null pointer works as well. */
4111 if( label->len == 0 )
4112 {
4113 output_length = ~0;
Gilles Peskinef7ab5ad2018-09-26 18:19:24 +02004114 if( output_size != 0 )
4115 memset( output, 0, output_size );
Gilles Peskine8817f612018-12-18 00:18:46 +01004116 PSA_ASSERT( psa_asymmetric_decrypt( handle, alg,
4117 input_data->x, input_data->len,
4118 NULL, label->len,
4119 output,
4120 output_size,
4121 &output_length ) );
Gilles Peskinebd7dea92018-09-27 13:57:19 +02004122 ASSERT_COMPARE( expected_data->x, expected_data->len,
4123 output, output_length );
Gilles Peskine68428122018-06-30 18:42:41 +02004124 }
4125
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004126exit:
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02004127 psa_reset_key_attributes( &attributes );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004128 psa_destroy_key( handle );
itayzafrir3e02b3b2018-06-12 17:06:52 +03004129 mbedtls_free( output );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02004130 PSA_DONE( );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004131}
4132/* END_CASE */
4133
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004134/* BEGIN_CASE */
Gilles Peskine68428122018-06-30 18:42:41 +02004135void asymmetric_decrypt_fail( int key_type_arg,
4136 data_t *key_data,
4137 int alg_arg,
4138 data_t *input_data,
4139 data_t *label,
Jaeden Amerof8daab72019-02-06 12:57:46 +00004140 int output_size_arg,
Gilles Peskine2d277862018-06-18 15:41:12 +02004141 int expected_status_arg )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004142{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004143 psa_key_handle_t handle = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004144 psa_key_type_t key_type = key_type_arg;
4145 psa_algorithm_t alg = alg_arg;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004146 unsigned char *output = NULL;
Jaeden Amerof8daab72019-02-06 12:57:46 +00004147 size_t output_size = output_size_arg;
Gilles Peskine55c94dd2018-06-30 18:54:48 +02004148 size_t output_length = ~0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004149 psa_status_t actual_status;
4150 psa_status_t expected_status = expected_status_arg;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02004151 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004152
Gilles Peskine8cebbba2018-09-27 13:54:18 +02004153 ASSERT_ALLOC( output, output_size );
Gilles Peskine5b051bc2018-05-31 13:25:48 +02004154
Gilles Peskine8817f612018-12-18 00:18:46 +01004155 PSA_ASSERT( psa_crypto_init( ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004156
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02004157 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DECRYPT );
4158 psa_set_key_algorithm( &attributes, alg );
4159 psa_set_key_type( &attributes, key_type );
Nir Sonnenscheind7082602018-06-04 16:45:27 +03004160
Gilles Peskine049c7532019-05-15 20:22:09 +02004161 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
4162 &handle ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004163
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004164 actual_status = psa_asymmetric_decrypt( handle, alg,
Gilles Peskine4abf7412018-06-18 16:35:34 +02004165 input_data->x, input_data->len,
Gilles Peskine68428122018-06-30 18:42:41 +02004166 label->x, label->len,
Gilles Peskine4abf7412018-06-18 16:35:34 +02004167 output, output_size,
Gilles Peskine2d277862018-06-18 15:41:12 +02004168 &output_length );
Gilles Peskinefe11b722018-12-18 00:24:04 +01004169 TEST_EQUAL( actual_status, expected_status );
Gilles Peskine55c94dd2018-06-30 18:54:48 +02004170 TEST_ASSERT( output_length <= output_size );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004171
Gilles Peskine68428122018-06-30 18:42:41 +02004172 /* If the label is empty, the test framework puts a non-null pointer
4173 * in label->x. Test that a null pointer works as well. */
4174 if( label->len == 0 )
4175 {
4176 output_length = ~0;
Gilles Peskinef7ab5ad2018-09-26 18:19:24 +02004177 if( output_size != 0 )
4178 memset( output, 0, output_size );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004179 actual_status = psa_asymmetric_decrypt( handle, alg,
Gilles Peskine68428122018-06-30 18:42:41 +02004180 input_data->x, input_data->len,
4181 NULL, label->len,
4182 output, output_size,
4183 &output_length );
Gilles Peskinefe11b722018-12-18 00:24:04 +01004184 TEST_EQUAL( actual_status, expected_status );
Gilles Peskine55c94dd2018-06-30 18:54:48 +02004185 TEST_ASSERT( output_length <= output_size );
Gilles Peskine68428122018-06-30 18:42:41 +02004186 }
4187
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004188exit:
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02004189 psa_reset_key_attributes( &attributes );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004190 psa_destroy_key( handle );
Gilles Peskine2d277862018-06-18 15:41:12 +02004191 mbedtls_free( output );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02004192 PSA_DONE( );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004193}
Gilles Peskine5b051bc2018-05-31 13:25:48 +02004194/* END_CASE */
Gilles Peskine05d69892018-06-19 22:00:52 +02004195
4196/* BEGIN_CASE */
Gilles Peskinecbe66502019-05-16 16:59:18 +02004197void key_derivation_init( )
Jaeden Amerod94d6712019-01-04 14:11:48 +00004198{
4199 /* Test each valid way of initializing the object, except for `= {0}`, as
4200 * Clang 5 complains when `-Wmissing-field-initializers` is used, even
4201 * though it's OK by the C standard. We could test for this, but we'd need
4202 * to supress the Clang warning for the test. */
Jaeden Amero5229bbb2019-02-07 16:33:37 +00004203 size_t capacity;
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02004204 psa_key_derivation_operation_t func = psa_key_derivation_operation_init( );
4205 psa_key_derivation_operation_t init = PSA_KEY_DERIVATION_OPERATION_INIT;
4206 psa_key_derivation_operation_t zero;
Jaeden Amerod94d6712019-01-04 14:11:48 +00004207
4208 memset( &zero, 0, sizeof( zero ) );
4209
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004210 /* A default operation should not be able to report its capacity. */
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02004211 TEST_EQUAL( psa_key_derivation_get_capacity( &func, &capacity ),
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004212 PSA_ERROR_BAD_STATE );
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02004213 TEST_EQUAL( psa_key_derivation_get_capacity( &init, &capacity ),
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004214 PSA_ERROR_BAD_STATE );
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02004215 TEST_EQUAL( psa_key_derivation_get_capacity( &zero, &capacity ),
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004216 PSA_ERROR_BAD_STATE );
Jaeden Amero5229bbb2019-02-07 16:33:37 +00004217
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004218 /* A default operation should be abortable without error. */
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02004219 PSA_ASSERT( psa_key_derivation_abort(&func) );
4220 PSA_ASSERT( psa_key_derivation_abort(&init) );
4221 PSA_ASSERT( psa_key_derivation_abort(&zero) );
Jaeden Amerod94d6712019-01-04 14:11:48 +00004222}
4223/* END_CASE */
4224
Janos Follath16de4a42019-06-13 16:32:24 +01004225/* BEGIN_CASE */
4226void derive_setup( int alg_arg, int expected_status_arg )
Gilles Peskineea0fb492018-07-12 17:17:20 +02004227{
Gilles Peskineea0fb492018-07-12 17:17:20 +02004228 psa_algorithm_t alg = alg_arg;
Gilles Peskineea0fb492018-07-12 17:17:20 +02004229 psa_status_t expected_status = expected_status_arg;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004230 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Gilles Peskineea0fb492018-07-12 17:17:20 +02004231
Gilles Peskine8817f612018-12-18 00:18:46 +01004232 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskineea0fb492018-07-12 17:17:20 +02004233
Janos Follath16de4a42019-06-13 16:32:24 +01004234 TEST_EQUAL( psa_key_derivation_setup( &operation, alg ),
Gilles Peskinef812dcf2018-12-18 00:33:25 +01004235 expected_status );
Gilles Peskineea0fb492018-07-12 17:17:20 +02004236
4237exit:
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004238 psa_key_derivation_abort( &operation );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02004239 PSA_DONE( );
Gilles Peskineea0fb492018-07-12 17:17:20 +02004240}
4241/* END_CASE */
4242
Janos Follathaf3c2a02019-06-12 12:34:34 +01004243/* BEGIN_CASE */
Janos Follatha27c9272019-06-14 09:59:36 +01004244void derive_set_capacity( int alg_arg, int capacity_arg,
4245 int expected_status_arg )
4246{
4247 psa_algorithm_t alg = alg_arg;
4248 size_t capacity = capacity_arg;
4249 psa_status_t expected_status = expected_status_arg;
4250 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
4251
4252 PSA_ASSERT( psa_crypto_init( ) );
4253
4254 PSA_ASSERT( psa_key_derivation_setup( &operation, alg ) );
4255
4256 TEST_EQUAL( psa_key_derivation_set_capacity( &operation, capacity ),
4257 expected_status );
4258
4259exit:
4260 psa_key_derivation_abort( &operation );
4261 PSA_DONE( );
4262}
4263/* END_CASE */
4264
4265/* BEGIN_CASE */
Janos Follathaf3c2a02019-06-12 12:34:34 +01004266void derive_input( int alg_arg,
Gilles Peskine6842ba42019-09-23 13:49:33 +02004267 int step_arg1, int key_type_arg1, data_t *input1,
Janos Follathaf3c2a02019-06-12 12:34:34 +01004268 int expected_status_arg1,
Gilles Peskine2058c072019-09-24 17:19:33 +02004269 int step_arg2, int key_type_arg2, data_t *input2,
Janos Follathaf3c2a02019-06-12 12:34:34 +01004270 int expected_status_arg2,
Gilles Peskine2058c072019-09-24 17:19:33 +02004271 int step_arg3, int key_type_arg3, data_t *input3,
Gilles Peskine1a2904c2019-09-24 17:45:07 +02004272 int expected_status_arg3,
4273 int output_key_type_arg, int expected_output_status_arg )
Janos Follathaf3c2a02019-06-12 12:34:34 +01004274{
4275 psa_algorithm_t alg = alg_arg;
Gilles Peskine6842ba42019-09-23 13:49:33 +02004276 psa_key_derivation_step_t steps[] = {step_arg1, step_arg2, step_arg3};
4277 psa_key_type_t key_types[] = {key_type_arg1, key_type_arg2, key_type_arg3};
Janos Follathaf3c2a02019-06-12 12:34:34 +01004278 psa_status_t expected_statuses[] = {expected_status_arg1,
4279 expected_status_arg2,
4280 expected_status_arg3};
4281 data_t *inputs[] = {input1, input2, input3};
4282 psa_key_handle_t handles[] = {0, 0, 0};
4283 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
4284 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
4285 size_t i;
Gilles Peskine1a2904c2019-09-24 17:45:07 +02004286 psa_key_type_t output_key_type = output_key_type_arg;
4287 psa_key_handle_t output_handle = 0;
4288 psa_status_t expected_output_status = expected_output_status_arg;
4289 psa_status_t actual_output_status;
Janos Follathaf3c2a02019-06-12 12:34:34 +01004290
4291 PSA_ASSERT( psa_crypto_init( ) );
4292
4293 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DERIVE );
4294 psa_set_key_algorithm( &attributes, alg );
Janos Follathaf3c2a02019-06-12 12:34:34 +01004295
4296 PSA_ASSERT( psa_key_derivation_setup( &operation, alg ) );
4297
4298 for( i = 0; i < ARRAY_LENGTH( steps ); i++ )
4299 {
Gilles Peskineb8965192019-09-24 16:21:10 +02004300 if( key_types[i] != PSA_KEY_TYPE_NONE )
Janos Follathaf3c2a02019-06-12 12:34:34 +01004301 {
Gilles Peskine6842ba42019-09-23 13:49:33 +02004302 psa_set_key_type( &attributes, key_types[i] );
4303 PSA_ASSERT( psa_import_key( &attributes,
4304 inputs[i]->x, inputs[i]->len,
4305 &handles[i] ) );
4306 TEST_EQUAL( psa_key_derivation_input_key( &operation, steps[i],
4307 handles[i] ),
4308 expected_statuses[i] );
4309 }
4310 else
4311 {
4312 TEST_EQUAL( psa_key_derivation_input_bytes(
4313 &operation, steps[i],
4314 inputs[i]->x, inputs[i]->len ),
4315 expected_statuses[i] );
Janos Follathaf3c2a02019-06-12 12:34:34 +01004316 }
4317 }
4318
Gilles Peskine1a2904c2019-09-24 17:45:07 +02004319 if( output_key_type != PSA_KEY_TYPE_NONE )
4320 {
4321 psa_reset_key_attributes( &attributes );
4322 psa_set_key_type( &attributes, PSA_KEY_TYPE_RAW_DATA );
4323 psa_set_key_bits( &attributes, 8 );
4324 actual_output_status =
4325 psa_key_derivation_output_key( &attributes, &operation,
4326 &output_handle );
4327 }
4328 else
4329 {
4330 uint8_t buffer[1];
4331 actual_output_status =
4332 psa_key_derivation_output_bytes( &operation,
4333 buffer, sizeof( buffer ) );
4334 }
4335 TEST_EQUAL( actual_output_status, expected_output_status );
4336
Janos Follathaf3c2a02019-06-12 12:34:34 +01004337exit:
4338 psa_key_derivation_abort( &operation );
4339 for( i = 0; i < ARRAY_LENGTH( handles ); i++ )
4340 psa_destroy_key( handles[i] );
Gilles Peskine1a2904c2019-09-24 17:45:07 +02004341 psa_destroy_key( output_handle );
Janos Follathaf3c2a02019-06-12 12:34:34 +01004342 PSA_DONE( );
4343}
4344/* END_CASE */
4345
Janos Follathd958bb72019-07-03 15:02:16 +01004346/* BEGIN_CASE */
4347void test_derive_invalid_key_derivation_state( int alg_arg )
Nir Sonnenscheine5204c92018-10-22 17:24:55 +03004348{
Janos Follathd958bb72019-07-03 15:02:16 +01004349 psa_algorithm_t alg = alg_arg;
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004350 psa_key_handle_t handle = 0;
Nir Sonnenschein4eda37b2018-10-31 12:15:58 +02004351 size_t key_type = PSA_KEY_TYPE_DERIVE;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004352 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Janos Follathd958bb72019-07-03 15:02:16 +01004353 unsigned char input1[] = "Input 1";
4354 size_t input1_length = sizeof( input1 );
4355 unsigned char input2[] = "Input 2";
4356 size_t input2_length = sizeof( input2 );
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004357 uint8_t buffer[42];
Nir Sonnenschein1caf6d22018-11-01 12:27:20 +02004358 size_t capacity = sizeof( buffer );
Nir Sonnenscheindd69d8b2018-11-01 12:24:23 +02004359 const uint8_t key_data[22] = { 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
4360 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
4361 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b};
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02004362 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Nir Sonnenscheine5204c92018-10-22 17:24:55 +03004363
Gilles Peskine8817f612018-12-18 00:18:46 +01004364 PSA_ASSERT( psa_crypto_init( ) );
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004365
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02004366 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DERIVE );
4367 psa_set_key_algorithm( &attributes, alg );
4368 psa_set_key_type( &attributes, key_type );
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004369
Gilles Peskine73676cb2019-05-15 20:15:10 +02004370 PSA_ASSERT( psa_import_key( &attributes,
4371 key_data, sizeof( key_data ),
4372 &handle ) );
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004373
4374 /* valid key derivation */
Janos Follathd958bb72019-07-03 15:02:16 +01004375 if( !setup_key_derivation_wrap( &operation, handle, alg,
4376 input1, input1_length,
4377 input2, input2_length,
4378 capacity ) )
4379 goto exit;
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004380
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004381 /* state of operation shouldn't allow additional generation */
Janos Follathd958bb72019-07-03 15:02:16 +01004382 TEST_EQUAL( psa_key_derivation_setup( &operation, alg ),
Gilles Peskinef812dcf2018-12-18 00:33:25 +01004383 PSA_ERROR_BAD_STATE );
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004384
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004385 PSA_ASSERT( psa_key_derivation_output_bytes( &operation, buffer, capacity ) );
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004386
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004387 TEST_EQUAL( psa_key_derivation_output_bytes( &operation, buffer, capacity ),
David Saadab4ecc272019-02-14 13:48:10 +02004388 PSA_ERROR_INSUFFICIENT_DATA );
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004389
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004390exit:
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004391 psa_key_derivation_abort( &operation );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004392 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02004393 PSA_DONE( );
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004394}
4395/* END_CASE */
4396
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004397/* BEGIN_CASE */
Gilles Peskinecbe66502019-05-16 16:59:18 +02004398void test_derive_invalid_key_derivation_tests( )
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004399{
4400 uint8_t output_buffer[16];
4401 size_t buffer_size = 16;
4402 size_t capacity = 0;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004403 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004404
Gilles Peskinecf7292e2019-05-16 17:53:40 +02004405 TEST_ASSERT( psa_key_derivation_output_bytes( &operation,
4406 output_buffer, buffer_size )
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004407 == PSA_ERROR_BAD_STATE );
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004408
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004409 TEST_ASSERT( psa_key_derivation_get_capacity( &operation, &capacity )
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004410 == PSA_ERROR_BAD_STATE );
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004411
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004412 PSA_ASSERT( psa_key_derivation_abort( &operation ) );
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004413
Gilles Peskinecf7292e2019-05-16 17:53:40 +02004414 TEST_ASSERT( psa_key_derivation_output_bytes( &operation,
4415 output_buffer, buffer_size )
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004416 == PSA_ERROR_BAD_STATE );
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004417
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004418 TEST_ASSERT( psa_key_derivation_get_capacity( &operation, &capacity )
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004419 == PSA_ERROR_BAD_STATE );
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004420
4421exit:
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004422 psa_key_derivation_abort( &operation );
Nir Sonnenscheine5204c92018-10-22 17:24:55 +03004423}
4424/* END_CASE */
4425
4426/* BEGIN_CASE */
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004427void derive_output( int alg_arg,
Gilles Peskine1468da72019-05-29 17:35:49 +02004428 int step1_arg, data_t *input1,
4429 int step2_arg, data_t *input2,
4430 int step3_arg, data_t *input3,
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004431 int requested_capacity_arg,
4432 data_t *expected_output1,
4433 data_t *expected_output2 )
4434{
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004435 psa_algorithm_t alg = alg_arg;
Gilles Peskine1468da72019-05-29 17:35:49 +02004436 psa_key_derivation_step_t steps[] = {step1_arg, step2_arg, step3_arg};
4437 data_t *inputs[] = {input1, input2, input3};
4438 psa_key_handle_t handles[] = {0, 0, 0};
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004439 size_t requested_capacity = requested_capacity_arg;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004440 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004441 uint8_t *expected_outputs[2] =
4442 {expected_output1->x, expected_output2->x};
4443 size_t output_sizes[2] =
4444 {expected_output1->len, expected_output2->len};
4445 size_t output_buffer_size = 0;
4446 uint8_t *output_buffer = NULL;
4447 size_t expected_capacity;
4448 size_t current_capacity;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004449 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004450 psa_status_t status;
Gilles Peskine1468da72019-05-29 17:35:49 +02004451 size_t i;
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004452
4453 for( i = 0; i < ARRAY_LENGTH( expected_outputs ); i++ )
4454 {
4455 if( output_sizes[i] > output_buffer_size )
4456 output_buffer_size = output_sizes[i];
4457 if( output_sizes[i] == 0 )
4458 expected_outputs[i] = NULL;
4459 }
Gilles Peskine8cebbba2018-09-27 13:54:18 +02004460 ASSERT_ALLOC( output_buffer, output_buffer_size );
Gilles Peskine8817f612018-12-18 00:18:46 +01004461 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004462
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004463 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DERIVE );
4464 psa_set_key_algorithm( &attributes, alg );
4465 psa_set_key_type( &attributes, PSA_KEY_TYPE_DERIVE );
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004466
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004467 /* Extraction phase. */
Gilles Peskine1468da72019-05-29 17:35:49 +02004468 PSA_ASSERT( psa_key_derivation_setup( &operation, alg ) );
4469 PSA_ASSERT( psa_key_derivation_set_capacity( &operation,
4470 requested_capacity ) );
4471 for( i = 0; i < ARRAY_LENGTH( steps ); i++ )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004472 {
Gilles Peskine1468da72019-05-29 17:35:49 +02004473 switch( steps[i] )
4474 {
4475 case 0:
4476 break;
4477 case PSA_KEY_DERIVATION_INPUT_SECRET:
4478 PSA_ASSERT( psa_import_key( &attributes,
4479 inputs[i]->x, inputs[i]->len,
4480 &handles[i] ) );
4481 PSA_ASSERT( psa_key_derivation_input_key(
4482 &operation, steps[i],
4483 handles[i] ) );
4484 break;
4485 default:
4486 PSA_ASSERT( psa_key_derivation_input_bytes(
4487 &operation, steps[i],
4488 inputs[i]->x, inputs[i]->len ) );
4489 break;
4490 }
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004491 }
Gilles Peskine1468da72019-05-29 17:35:49 +02004492
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004493 PSA_ASSERT( psa_key_derivation_get_capacity( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02004494 &current_capacity ) );
Gilles Peskinefe11b722018-12-18 00:24:04 +01004495 TEST_EQUAL( current_capacity, requested_capacity );
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004496 expected_capacity = requested_capacity;
4497
4498 /* Expansion phase. */
4499 for( i = 0; i < ARRAY_LENGTH( expected_outputs ); i++ )
4500 {
4501 /* Read some bytes. */
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004502 status = psa_key_derivation_output_bytes( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02004503 output_buffer, output_sizes[i] );
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004504 if( expected_capacity == 0 && output_sizes[i] == 0 )
4505 {
4506 /* Reading 0 bytes when 0 bytes are available can go either way. */
4507 TEST_ASSERT( status == PSA_SUCCESS ||
David Saadab4ecc272019-02-14 13:48:10 +02004508 status == PSA_ERROR_INSUFFICIENT_DATA );
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004509 continue;
4510 }
4511 else if( expected_capacity == 0 ||
4512 output_sizes[i] > expected_capacity )
4513 {
4514 /* Capacity exceeded. */
David Saadab4ecc272019-02-14 13:48:10 +02004515 TEST_EQUAL( status, PSA_ERROR_INSUFFICIENT_DATA );
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004516 expected_capacity = 0;
4517 continue;
4518 }
4519 /* Success. Check the read data. */
Gilles Peskine8817f612018-12-18 00:18:46 +01004520 PSA_ASSERT( status );
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004521 if( output_sizes[i] != 0 )
Gilles Peskine0dfba2d2018-12-18 00:40:50 +01004522 ASSERT_COMPARE( output_buffer, output_sizes[i],
4523 expected_outputs[i], output_sizes[i] );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004524 /* Check the operation status. */
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004525 expected_capacity -= output_sizes[i];
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004526 PSA_ASSERT( psa_key_derivation_get_capacity( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02004527 &current_capacity ) );
Gilles Peskinefe11b722018-12-18 00:24:04 +01004528 TEST_EQUAL( expected_capacity, current_capacity );
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004529 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004530 PSA_ASSERT( psa_key_derivation_abort( &operation ) );
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004531
4532exit:
4533 mbedtls_free( output_buffer );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004534 psa_key_derivation_abort( &operation );
Gilles Peskine1468da72019-05-29 17:35:49 +02004535 for( i = 0; i < ARRAY_LENGTH( handles ); i++ )
4536 psa_destroy_key( handles[i] );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02004537 PSA_DONE( );
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004538}
4539/* END_CASE */
4540
4541/* BEGIN_CASE */
Gilles Peskined54931c2018-07-17 21:06:59 +02004542void derive_full( int alg_arg,
4543 data_t *key_data,
Janos Follath47f27ed2019-06-25 13:24:52 +01004544 data_t *input1,
4545 data_t *input2,
Gilles Peskined54931c2018-07-17 21:06:59 +02004546 int requested_capacity_arg )
4547{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004548 psa_key_handle_t handle = 0;
Gilles Peskined54931c2018-07-17 21:06:59 +02004549 psa_algorithm_t alg = alg_arg;
4550 size_t requested_capacity = requested_capacity_arg;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004551 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Gilles Peskined54931c2018-07-17 21:06:59 +02004552 unsigned char output_buffer[16];
4553 size_t expected_capacity = requested_capacity;
4554 size_t current_capacity;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004555 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskined54931c2018-07-17 21:06:59 +02004556
Gilles Peskine8817f612018-12-18 00:18:46 +01004557 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskined54931c2018-07-17 21:06:59 +02004558
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004559 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DERIVE );
4560 psa_set_key_algorithm( &attributes, alg );
4561 psa_set_key_type( &attributes, PSA_KEY_TYPE_DERIVE );
Gilles Peskined54931c2018-07-17 21:06:59 +02004562
Gilles Peskine049c7532019-05-15 20:22:09 +02004563 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
4564 &handle ) );
Gilles Peskined54931c2018-07-17 21:06:59 +02004565
Janos Follathf2815ea2019-07-03 12:41:36 +01004566 if( !setup_key_derivation_wrap( &operation, handle, alg,
4567 input1->x, input1->len,
4568 input2->x, input2->len,
4569 requested_capacity ) )
4570 goto exit;
Janos Follath47f27ed2019-06-25 13:24:52 +01004571
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004572 PSA_ASSERT( psa_key_derivation_get_capacity( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02004573 &current_capacity ) );
Gilles Peskinefe11b722018-12-18 00:24:04 +01004574 TEST_EQUAL( current_capacity, expected_capacity );
Gilles Peskined54931c2018-07-17 21:06:59 +02004575
4576 /* Expansion phase. */
4577 while( current_capacity > 0 )
4578 {
4579 size_t read_size = sizeof( output_buffer );
4580 if( read_size > current_capacity )
4581 read_size = current_capacity;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004582 PSA_ASSERT( psa_key_derivation_output_bytes( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02004583 output_buffer,
4584 read_size ) );
Gilles Peskined54931c2018-07-17 21:06:59 +02004585 expected_capacity -= read_size;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004586 PSA_ASSERT( psa_key_derivation_get_capacity( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02004587 &current_capacity ) );
Gilles Peskinefe11b722018-12-18 00:24:04 +01004588 TEST_EQUAL( current_capacity, expected_capacity );
Gilles Peskined54931c2018-07-17 21:06:59 +02004589 }
4590
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004591 /* Check that the operation refuses to go over capacity. */
4592 TEST_EQUAL( psa_key_derivation_output_bytes( &operation, output_buffer, 1 ),
David Saadab4ecc272019-02-14 13:48:10 +02004593 PSA_ERROR_INSUFFICIENT_DATA );
Gilles Peskined54931c2018-07-17 21:06:59 +02004594
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004595 PSA_ASSERT( psa_key_derivation_abort( &operation ) );
Gilles Peskined54931c2018-07-17 21:06:59 +02004596
4597exit:
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004598 psa_key_derivation_abort( &operation );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004599 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02004600 PSA_DONE( );
Gilles Peskined54931c2018-07-17 21:06:59 +02004601}
4602/* END_CASE */
4603
Janos Follathe60c9052019-07-03 13:51:30 +01004604/* BEGIN_CASE */
Gilles Peskine0386fba2018-07-12 17:29:22 +02004605void derive_key_exercise( int alg_arg,
4606 data_t *key_data,
Janos Follathe60c9052019-07-03 13:51:30 +01004607 data_t *input1,
4608 data_t *input2,
Gilles Peskine0386fba2018-07-12 17:29:22 +02004609 int derived_type_arg,
4610 int derived_bits_arg,
4611 int derived_usage_arg,
4612 int derived_alg_arg )
4613{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004614 psa_key_handle_t base_handle = 0;
4615 psa_key_handle_t derived_handle = 0;
Gilles Peskine0386fba2018-07-12 17:29:22 +02004616 psa_algorithm_t alg = alg_arg;
4617 psa_key_type_t derived_type = derived_type_arg;
4618 size_t derived_bits = derived_bits_arg;
4619 psa_key_usage_t derived_usage = derived_usage_arg;
4620 psa_algorithm_t derived_alg = derived_alg_arg;
4621 size_t capacity = PSA_BITS_TO_BYTES( derived_bits );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004622 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004623 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02004624 psa_key_attributes_t got_attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine0386fba2018-07-12 17:29:22 +02004625
Gilles Peskine8817f612018-12-18 00:18:46 +01004626 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine0386fba2018-07-12 17:29:22 +02004627
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004628 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DERIVE );
4629 psa_set_key_algorithm( &attributes, alg );
4630 psa_set_key_type( &attributes, PSA_KEY_TYPE_DERIVE );
Gilles Peskine049c7532019-05-15 20:22:09 +02004631 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
4632 &base_handle ) );
Gilles Peskine0386fba2018-07-12 17:29:22 +02004633
4634 /* Derive a key. */
Janos Follathe60c9052019-07-03 13:51:30 +01004635 if ( setup_key_derivation_wrap( &operation, base_handle, alg,
4636 input1->x, input1->len,
4637 input2->x, input2->len, capacity ) )
4638 goto exit;
4639
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004640 psa_set_key_usage_flags( &attributes, derived_usage );
4641 psa_set_key_algorithm( &attributes, derived_alg );
4642 psa_set_key_type( &attributes, derived_type );
Gilles Peskine3a4f1f82019-04-26 13:49:28 +02004643 psa_set_key_bits( &attributes, derived_bits );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004644 PSA_ASSERT( psa_key_derivation_output_key( &attributes, &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02004645 &derived_handle ) );
Gilles Peskine0386fba2018-07-12 17:29:22 +02004646
4647 /* Test the key information */
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02004648 PSA_ASSERT( psa_get_key_attributes( derived_handle, &got_attributes ) );
4649 TEST_EQUAL( psa_get_key_type( &got_attributes ), derived_type );
4650 TEST_EQUAL( psa_get_key_bits( &got_attributes ), derived_bits );
Gilles Peskine0386fba2018-07-12 17:29:22 +02004651
4652 /* Exercise the derived key. */
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004653 if( ! exercise_key( derived_handle, derived_usage, derived_alg ) )
Gilles Peskine0386fba2018-07-12 17:29:22 +02004654 goto exit;
4655
4656exit:
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004657 psa_key_derivation_abort( &operation );
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02004658 psa_reset_key_attributes( &got_attributes );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004659 psa_destroy_key( base_handle );
4660 psa_destroy_key( derived_handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02004661 PSA_DONE( );
Gilles Peskine0386fba2018-07-12 17:29:22 +02004662}
4663/* END_CASE */
4664
Janos Follath42fd8882019-07-03 14:17:09 +01004665/* BEGIN_CASE */
Gilles Peskine0386fba2018-07-12 17:29:22 +02004666void derive_key_export( int alg_arg,
4667 data_t *key_data,
Janos Follath42fd8882019-07-03 14:17:09 +01004668 data_t *input1,
4669 data_t *input2,
Gilles Peskine0386fba2018-07-12 17:29:22 +02004670 int bytes1_arg,
4671 int bytes2_arg )
4672{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004673 psa_key_handle_t base_handle = 0;
4674 psa_key_handle_t derived_handle = 0;
Gilles Peskine0386fba2018-07-12 17:29:22 +02004675 psa_algorithm_t alg = alg_arg;
4676 size_t bytes1 = bytes1_arg;
4677 size_t bytes2 = bytes2_arg;
4678 size_t capacity = bytes1 + bytes2;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004679 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Gilles Peskine8cebbba2018-09-27 13:54:18 +02004680 uint8_t *output_buffer = NULL;
4681 uint8_t *export_buffer = NULL;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004682 psa_key_attributes_t base_attributes = PSA_KEY_ATTRIBUTES_INIT;
4683 psa_key_attributes_t derived_attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine0386fba2018-07-12 17:29:22 +02004684 size_t length;
4685
Gilles Peskine8cebbba2018-09-27 13:54:18 +02004686 ASSERT_ALLOC( output_buffer, capacity );
4687 ASSERT_ALLOC( export_buffer, capacity );
Gilles Peskine8817f612018-12-18 00:18:46 +01004688 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine0386fba2018-07-12 17:29:22 +02004689
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004690 psa_set_key_usage_flags( &base_attributes, PSA_KEY_USAGE_DERIVE );
4691 psa_set_key_algorithm( &base_attributes, alg );
4692 psa_set_key_type( &base_attributes, PSA_KEY_TYPE_DERIVE );
Gilles Peskine049c7532019-05-15 20:22:09 +02004693 PSA_ASSERT( psa_import_key( &base_attributes, key_data->x, key_data->len,
4694 &base_handle ) );
Gilles Peskine0386fba2018-07-12 17:29:22 +02004695
4696 /* Derive some material and output it. */
Janos Follath42fd8882019-07-03 14:17:09 +01004697 if( !setup_key_derivation_wrap( &operation, base_handle, alg,
4698 input1->x, input1->len,
4699 input2->x, input2->len, capacity ) )
4700 goto exit;
4701
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004702 PSA_ASSERT( psa_key_derivation_output_bytes( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02004703 output_buffer,
4704 capacity ) );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004705 PSA_ASSERT( psa_key_derivation_abort( &operation ) );
Gilles Peskine0386fba2018-07-12 17:29:22 +02004706
4707 /* Derive the same output again, but this time store it in key objects. */
Janos Follath42fd8882019-07-03 14:17:09 +01004708 if( !setup_key_derivation_wrap( &operation, base_handle, alg,
4709 input1->x, input1->len,
4710 input2->x, input2->len, capacity ) )
4711 goto exit;
4712
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004713 psa_set_key_usage_flags( &derived_attributes, PSA_KEY_USAGE_EXPORT );
4714 psa_set_key_algorithm( &derived_attributes, 0 );
4715 psa_set_key_type( &derived_attributes, PSA_KEY_TYPE_RAW_DATA );
Gilles Peskine3a4f1f82019-04-26 13:49:28 +02004716 psa_set_key_bits( &derived_attributes, PSA_BYTES_TO_BITS( bytes1 ) );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004717 PSA_ASSERT( psa_key_derivation_output_key( &derived_attributes, &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02004718 &derived_handle ) );
Gilles Peskine8817f612018-12-18 00:18:46 +01004719 PSA_ASSERT( psa_export_key( derived_handle,
4720 export_buffer, bytes1,
4721 &length ) );
Gilles Peskinefe11b722018-12-18 00:24:04 +01004722 TEST_EQUAL( length, bytes1 );
Gilles Peskine8817f612018-12-18 00:18:46 +01004723 PSA_ASSERT( psa_destroy_key( derived_handle ) );
Gilles Peskine3a4f1f82019-04-26 13:49:28 +02004724 psa_set_key_bits( &derived_attributes, PSA_BYTES_TO_BITS( bytes2 ) );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004725 PSA_ASSERT( psa_key_derivation_output_key( &derived_attributes, &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02004726 &derived_handle ) );
Gilles Peskine8817f612018-12-18 00:18:46 +01004727 PSA_ASSERT( psa_export_key( derived_handle,
4728 export_buffer + bytes1, bytes2,
4729 &length ) );
Gilles Peskinefe11b722018-12-18 00:24:04 +01004730 TEST_EQUAL( length, bytes2 );
Gilles Peskine0386fba2018-07-12 17:29:22 +02004731
4732 /* Compare the outputs from the two runs. */
Gilles Peskine0dfba2d2018-12-18 00:40:50 +01004733 ASSERT_COMPARE( output_buffer, bytes1 + bytes2,
4734 export_buffer, capacity );
Gilles Peskine0386fba2018-07-12 17:29:22 +02004735
4736exit:
4737 mbedtls_free( output_buffer );
4738 mbedtls_free( export_buffer );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004739 psa_key_derivation_abort( &operation );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004740 psa_destroy_key( base_handle );
4741 psa_destroy_key( derived_handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02004742 PSA_DONE( );
Gilles Peskine0386fba2018-07-12 17:29:22 +02004743}
4744/* END_CASE */
4745
4746/* BEGIN_CASE */
Gilles Peskine7c227ae2019-07-31 15:14:44 +02004747void derive_key( int alg_arg,
4748 data_t *key_data, data_t *input1, data_t *input2,
4749 int type_arg, int bits_arg,
4750 int expected_status_arg )
Gilles Peskinec744d992019-07-30 17:26:54 +02004751{
4752 psa_key_handle_t base_handle = 0;
4753 psa_key_handle_t derived_handle = 0;
4754 psa_algorithm_t alg = alg_arg;
Gilles Peskine7c227ae2019-07-31 15:14:44 +02004755 psa_key_type_t type = type_arg;
Gilles Peskinec744d992019-07-30 17:26:54 +02004756 size_t bits = bits_arg;
4757 psa_status_t expected_status = expected_status_arg;
4758 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
4759 psa_key_attributes_t base_attributes = PSA_KEY_ATTRIBUTES_INIT;
4760 psa_key_attributes_t derived_attributes = PSA_KEY_ATTRIBUTES_INIT;
4761
4762 PSA_ASSERT( psa_crypto_init( ) );
4763
4764 psa_set_key_usage_flags( &base_attributes, PSA_KEY_USAGE_DERIVE );
4765 psa_set_key_algorithm( &base_attributes, alg );
4766 psa_set_key_type( &base_attributes, PSA_KEY_TYPE_DERIVE );
4767 PSA_ASSERT( psa_import_key( &base_attributes, key_data->x, key_data->len,
4768 &base_handle ) );
4769
4770 if( !setup_key_derivation_wrap( &operation, base_handle, alg,
4771 input1->x, input1->len,
4772 input2->x, input2->len, SIZE_MAX ) )
4773 goto exit;
4774
4775 psa_set_key_usage_flags( &derived_attributes, PSA_KEY_USAGE_EXPORT );
4776 psa_set_key_algorithm( &derived_attributes, 0 );
Gilles Peskine7c227ae2019-07-31 15:14:44 +02004777 psa_set_key_type( &derived_attributes, type );
Gilles Peskinec744d992019-07-30 17:26:54 +02004778 psa_set_key_bits( &derived_attributes, bits );
4779 TEST_EQUAL( psa_key_derivation_output_key( &derived_attributes, &operation,
4780 &derived_handle ),
4781 expected_status );
4782
4783exit:
4784 psa_key_derivation_abort( &operation );
4785 psa_destroy_key( base_handle );
4786 psa_destroy_key( derived_handle );
4787 PSA_DONE( );
4788}
4789/* END_CASE */
4790
4791/* BEGIN_CASE */
Gilles Peskine01d718c2018-09-18 12:01:02 +02004792void key_agreement_setup( int alg_arg,
4793 int our_key_type_arg, data_t *our_key_data,
4794 data_t *peer_key_data,
4795 int expected_status_arg )
4796{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004797 psa_key_handle_t our_key = 0;
Gilles Peskine01d718c2018-09-18 12:01:02 +02004798 psa_algorithm_t alg = alg_arg;
4799 psa_key_type_t our_key_type = our_key_type_arg;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004800 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004801 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine77f40d82019-04-11 21:27:06 +02004802 psa_status_t expected_status = expected_status_arg;
4803 psa_status_t status;
Gilles Peskine01d718c2018-09-18 12:01:02 +02004804
Gilles Peskine8817f612018-12-18 00:18:46 +01004805 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine01d718c2018-09-18 12:01:02 +02004806
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004807 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DERIVE );
4808 psa_set_key_algorithm( &attributes, alg );
4809 psa_set_key_type( &attributes, our_key_type );
Gilles Peskine049c7532019-05-15 20:22:09 +02004810 PSA_ASSERT( psa_import_key( &attributes,
4811 our_key_data->x, our_key_data->len,
4812 &our_key ) );
Gilles Peskine01d718c2018-09-18 12:01:02 +02004813
Gilles Peskine77f40d82019-04-11 21:27:06 +02004814 /* The tests currently include inputs that should fail at either step.
4815 * Test cases that fail at the setup step should be changed to call
4816 * key_derivation_setup instead, and this function should be renamed
4817 * to key_agreement_fail. */
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004818 status = psa_key_derivation_setup( &operation, alg );
Gilles Peskine77f40d82019-04-11 21:27:06 +02004819 if( status == PSA_SUCCESS )
4820 {
Gilles Peskinecf7292e2019-05-16 17:53:40 +02004821 TEST_EQUAL( psa_key_derivation_key_agreement(
4822 &operation, PSA_KEY_DERIVATION_INPUT_SECRET,
4823 our_key,
4824 peer_key_data->x, peer_key_data->len ),
Gilles Peskine77f40d82019-04-11 21:27:06 +02004825 expected_status );
4826 }
4827 else
4828 {
4829 TEST_ASSERT( status == expected_status );
4830 }
Gilles Peskine01d718c2018-09-18 12:01:02 +02004831
4832exit:
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004833 psa_key_derivation_abort( &operation );
Gilles Peskine01d718c2018-09-18 12:01:02 +02004834 psa_destroy_key( our_key );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02004835 PSA_DONE( );
Gilles Peskine01d718c2018-09-18 12:01:02 +02004836}
4837/* END_CASE */
4838
4839/* BEGIN_CASE */
Gilles Peskinef0cba732019-04-11 22:12:38 +02004840void raw_key_agreement( int alg_arg,
4841 int our_key_type_arg, data_t *our_key_data,
4842 data_t *peer_key_data,
4843 data_t *expected_output )
4844{
4845 psa_key_handle_t our_key = 0;
4846 psa_algorithm_t alg = alg_arg;
4847 psa_key_type_t our_key_type = our_key_type_arg;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004848 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskinef0cba732019-04-11 22:12:38 +02004849 unsigned char *output = NULL;
4850 size_t output_length = ~0;
4851
4852 ASSERT_ALLOC( output, expected_output->len );
4853 PSA_ASSERT( psa_crypto_init( ) );
4854
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004855 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DERIVE );
4856 psa_set_key_algorithm( &attributes, alg );
4857 psa_set_key_type( &attributes, our_key_type );
Gilles Peskine049c7532019-05-15 20:22:09 +02004858 PSA_ASSERT( psa_import_key( &attributes,
4859 our_key_data->x, our_key_data->len,
4860 &our_key ) );
Gilles Peskinef0cba732019-04-11 22:12:38 +02004861
Gilles Peskinebe697d82019-05-16 18:00:41 +02004862 PSA_ASSERT( psa_raw_key_agreement( alg, our_key,
4863 peer_key_data->x, peer_key_data->len,
4864 output, expected_output->len,
4865 &output_length ) );
Gilles Peskinef0cba732019-04-11 22:12:38 +02004866 ASSERT_COMPARE( output, output_length,
4867 expected_output->x, expected_output->len );
4868
4869exit:
4870 mbedtls_free( output );
4871 psa_destroy_key( our_key );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02004872 PSA_DONE( );
Gilles Peskinef0cba732019-04-11 22:12:38 +02004873}
4874/* END_CASE */
4875
4876/* BEGIN_CASE */
Gilles Peskine59685592018-09-18 12:11:34 +02004877void key_agreement_capacity( int alg_arg,
4878 int our_key_type_arg, data_t *our_key_data,
4879 data_t *peer_key_data,
4880 int expected_capacity_arg )
4881{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004882 psa_key_handle_t our_key = 0;
Gilles Peskine59685592018-09-18 12:11:34 +02004883 psa_algorithm_t alg = alg_arg;
4884 psa_key_type_t our_key_type = our_key_type_arg;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004885 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004886 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine59685592018-09-18 12:11:34 +02004887 size_t actual_capacity;
Gilles Peskinebf491972018-10-25 22:36:12 +02004888 unsigned char output[16];
Gilles Peskine59685592018-09-18 12:11:34 +02004889
Gilles Peskine8817f612018-12-18 00:18:46 +01004890 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine59685592018-09-18 12:11:34 +02004891
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004892 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DERIVE );
4893 psa_set_key_algorithm( &attributes, alg );
4894 psa_set_key_type( &attributes, our_key_type );
Gilles Peskine049c7532019-05-15 20:22:09 +02004895 PSA_ASSERT( psa_import_key( &attributes,
4896 our_key_data->x, our_key_data->len,
4897 &our_key ) );
Gilles Peskine59685592018-09-18 12:11:34 +02004898
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004899 PSA_ASSERT( psa_key_derivation_setup( &operation, alg ) );
Gilles Peskinecf7292e2019-05-16 17:53:40 +02004900 PSA_ASSERT( psa_key_derivation_key_agreement(
4901 &operation,
4902 PSA_KEY_DERIVATION_INPUT_SECRET, our_key,
4903 peer_key_data->x, peer_key_data->len ) );
Gilles Peskinef8a9d942019-04-11 22:13:20 +02004904 if( PSA_ALG_IS_HKDF( PSA_ALG_KEY_AGREEMENT_GET_KDF( alg ) ) )
4905 {
4906 /* The test data is for info="" */
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004907 PSA_ASSERT( psa_key_derivation_input_bytes( &operation,
Gilles Peskine03410b52019-05-16 16:05:19 +02004908 PSA_KEY_DERIVATION_INPUT_INFO,
Gilles Peskinef8a9d942019-04-11 22:13:20 +02004909 NULL, 0 ) );
4910 }
Gilles Peskine59685592018-09-18 12:11:34 +02004911
Gilles Peskinebf491972018-10-25 22:36:12 +02004912 /* Test the advertized capacity. */
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02004913 PSA_ASSERT( psa_key_derivation_get_capacity(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004914 &operation, &actual_capacity ) );
Gilles Peskinefe11b722018-12-18 00:24:04 +01004915 TEST_EQUAL( actual_capacity, (size_t) expected_capacity_arg );
Gilles Peskine59685592018-09-18 12:11:34 +02004916
Gilles Peskinebf491972018-10-25 22:36:12 +02004917 /* Test the actual capacity by reading the output. */
4918 while( actual_capacity > sizeof( output ) )
4919 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004920 PSA_ASSERT( psa_key_derivation_output_bytes( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02004921 output, sizeof( output ) ) );
Gilles Peskinebf491972018-10-25 22:36:12 +02004922 actual_capacity -= sizeof( output );
4923 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004924 PSA_ASSERT( psa_key_derivation_output_bytes( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02004925 output, actual_capacity ) );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004926 TEST_EQUAL( psa_key_derivation_output_bytes( &operation, output, 1 ),
David Saadab4ecc272019-02-14 13:48:10 +02004927 PSA_ERROR_INSUFFICIENT_DATA );
Gilles Peskinebf491972018-10-25 22:36:12 +02004928
Gilles Peskine59685592018-09-18 12:11:34 +02004929exit:
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004930 psa_key_derivation_abort( &operation );
Gilles Peskine59685592018-09-18 12:11:34 +02004931 psa_destroy_key( our_key );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02004932 PSA_DONE( );
Gilles Peskine59685592018-09-18 12:11:34 +02004933}
4934/* END_CASE */
4935
4936/* BEGIN_CASE */
4937void key_agreement_output( int alg_arg,
4938 int our_key_type_arg, data_t *our_key_data,
4939 data_t *peer_key_data,
Gilles Peskine3ec8ed82018-10-25 22:37:15 +02004940 data_t *expected_output1, data_t *expected_output2 )
Gilles Peskine59685592018-09-18 12:11:34 +02004941{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004942 psa_key_handle_t our_key = 0;
Gilles Peskine59685592018-09-18 12:11:34 +02004943 psa_algorithm_t alg = alg_arg;
4944 psa_key_type_t our_key_type = our_key_type_arg;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004945 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004946 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine3ec8ed82018-10-25 22:37:15 +02004947 uint8_t *actual_output = NULL;
Gilles Peskine59685592018-09-18 12:11:34 +02004948
Gilles Peskine3ec8ed82018-10-25 22:37:15 +02004949 ASSERT_ALLOC( actual_output, MAX( expected_output1->len,
4950 expected_output2->len ) );
Gilles Peskine59685592018-09-18 12:11:34 +02004951
Gilles Peskine8817f612018-12-18 00:18:46 +01004952 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine59685592018-09-18 12:11:34 +02004953
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004954 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DERIVE );
4955 psa_set_key_algorithm( &attributes, alg );
4956 psa_set_key_type( &attributes, our_key_type );
Gilles Peskine049c7532019-05-15 20:22:09 +02004957 PSA_ASSERT( psa_import_key( &attributes,
4958 our_key_data->x, our_key_data->len,
4959 &our_key ) );
Gilles Peskine59685592018-09-18 12:11:34 +02004960
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004961 PSA_ASSERT( psa_key_derivation_setup( &operation, alg ) );
Gilles Peskinecf7292e2019-05-16 17:53:40 +02004962 PSA_ASSERT( psa_key_derivation_key_agreement(
4963 &operation,
4964 PSA_KEY_DERIVATION_INPUT_SECRET, our_key,
4965 peer_key_data->x, peer_key_data->len ) );
Gilles Peskinef8a9d942019-04-11 22:13:20 +02004966 if( PSA_ALG_IS_HKDF( PSA_ALG_KEY_AGREEMENT_GET_KDF( alg ) ) )
4967 {
4968 /* The test data is for info="" */
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004969 PSA_ASSERT( psa_key_derivation_input_bytes( &operation,
Gilles Peskine03410b52019-05-16 16:05:19 +02004970 PSA_KEY_DERIVATION_INPUT_INFO,
Gilles Peskinef8a9d942019-04-11 22:13:20 +02004971 NULL, 0 ) );
4972 }
Gilles Peskine59685592018-09-18 12:11:34 +02004973
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004974 PSA_ASSERT( psa_key_derivation_output_bytes( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02004975 actual_output,
4976 expected_output1->len ) );
Gilles Peskine0dfba2d2018-12-18 00:40:50 +01004977 ASSERT_COMPARE( actual_output, expected_output1->len,
4978 expected_output1->x, expected_output1->len );
Gilles Peskine3ec8ed82018-10-25 22:37:15 +02004979 if( expected_output2->len != 0 )
4980 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004981 PSA_ASSERT( psa_key_derivation_output_bytes( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02004982 actual_output,
4983 expected_output2->len ) );
Gilles Peskine0dfba2d2018-12-18 00:40:50 +01004984 ASSERT_COMPARE( actual_output, expected_output2->len,
4985 expected_output2->x, expected_output2->len );
Gilles Peskine3ec8ed82018-10-25 22:37:15 +02004986 }
Gilles Peskine59685592018-09-18 12:11:34 +02004987
4988exit:
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004989 psa_key_derivation_abort( &operation );
Gilles Peskine59685592018-09-18 12:11:34 +02004990 psa_destroy_key( our_key );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02004991 PSA_DONE( );
Gilles Peskine59685592018-09-18 12:11:34 +02004992 mbedtls_free( actual_output );
4993}
4994/* END_CASE */
4995
4996/* BEGIN_CASE */
Gilles Peskinea50d7392018-06-21 10:22:13 +02004997void generate_random( int bytes_arg )
Gilles Peskine05d69892018-06-19 22:00:52 +02004998{
Gilles Peskinea50d7392018-06-21 10:22:13 +02004999 size_t bytes = bytes_arg;
5000 const unsigned char trail[] = "don't overwrite me";
Gilles Peskine8cebbba2018-09-27 13:54:18 +02005001 unsigned char *output = NULL;
5002 unsigned char *changed = NULL;
Gilles Peskinea50d7392018-06-21 10:22:13 +02005003 size_t i;
5004 unsigned run;
Gilles Peskine05d69892018-06-19 22:00:52 +02005005
Gilles Peskine8cebbba2018-09-27 13:54:18 +02005006 ASSERT_ALLOC( output, bytes + sizeof( trail ) );
5007 ASSERT_ALLOC( changed, bytes );
Gilles Peskinea50d7392018-06-21 10:22:13 +02005008 memcpy( output + bytes, trail, sizeof( trail ) );
Gilles Peskine05d69892018-06-19 22:00:52 +02005009
Gilles Peskine8817f612018-12-18 00:18:46 +01005010 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine05d69892018-06-19 22:00:52 +02005011
Gilles Peskinea50d7392018-06-21 10:22:13 +02005012 /* Run several times, to ensure that every output byte will be
5013 * nonzero at least once with overwhelming probability
5014 * (2^(-8*number_of_runs)). */
5015 for( run = 0; run < 10; run++ )
Gilles Peskine05d69892018-06-19 22:00:52 +02005016 {
Gilles Peskinef7ab5ad2018-09-26 18:19:24 +02005017 if( bytes != 0 )
5018 memset( output, 0, bytes );
Gilles Peskine8817f612018-12-18 00:18:46 +01005019 PSA_ASSERT( psa_generate_random( output, bytes ) );
Gilles Peskinea50d7392018-06-21 10:22:13 +02005020
5021 /* Check that no more than bytes have been overwritten */
Gilles Peskine0dfba2d2018-12-18 00:40:50 +01005022 ASSERT_COMPARE( output + bytes, sizeof( trail ),
5023 trail, sizeof( trail ) );
Gilles Peskinea50d7392018-06-21 10:22:13 +02005024
5025 for( i = 0; i < bytes; i++ )
5026 {
5027 if( output[i] != 0 )
5028 ++changed[i];
5029 }
Gilles Peskine05d69892018-06-19 22:00:52 +02005030 }
Gilles Peskinea50d7392018-06-21 10:22:13 +02005031
5032 /* Check that every byte was changed to nonzero at least once. This
5033 * validates that psa_generate_random is overwriting every byte of
5034 * the output buffer. */
5035 for( i = 0; i < bytes; i++ )
5036 {
5037 TEST_ASSERT( changed[i] != 0 );
5038 }
Gilles Peskine05d69892018-06-19 22:00:52 +02005039
5040exit:
Gilles Peskine1153e7b2019-05-28 15:10:21 +02005041 PSA_DONE( );
Gilles Peskinea50d7392018-06-21 10:22:13 +02005042 mbedtls_free( output );
5043 mbedtls_free( changed );
Gilles Peskine05d69892018-06-19 22:00:52 +02005044}
5045/* END_CASE */
Gilles Peskine12313cd2018-06-20 00:20:32 +02005046
5047/* BEGIN_CASE */
5048void generate_key( int type_arg,
5049 int bits_arg,
5050 int usage_arg,
5051 int alg_arg,
5052 int expected_status_arg )
5053{
Gilles Peskinebdf309c2018-12-03 15:36:32 +01005054 psa_key_handle_t handle = 0;
Gilles Peskine12313cd2018-06-20 00:20:32 +02005055 psa_key_type_t type = type_arg;
5056 psa_key_usage_t usage = usage_arg;
5057 size_t bits = bits_arg;
5058 psa_algorithm_t alg = alg_arg;
5059 psa_status_t expected_status = expected_status_arg;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005060 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02005061 psa_key_attributes_t got_attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine12313cd2018-06-20 00:20:32 +02005062
Gilles Peskine8817f612018-12-18 00:18:46 +01005063 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine12313cd2018-06-20 00:20:32 +02005064
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005065 psa_set_key_usage_flags( &attributes, usage );
5066 psa_set_key_algorithm( &attributes, alg );
5067 psa_set_key_type( &attributes, type );
Gilles Peskine3a4f1f82019-04-26 13:49:28 +02005068 psa_set_key_bits( &attributes, bits );
Gilles Peskine12313cd2018-06-20 00:20:32 +02005069
5070 /* Generate a key */
Gilles Peskine35ef36b2019-05-16 19:42:05 +02005071 TEST_EQUAL( psa_generate_key( &attributes, &handle ), expected_status );
Gilles Peskinee56e8782019-04-26 17:34:02 +02005072 if( expected_status != PSA_SUCCESS )
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005073 goto exit;
Gilles Peskine12313cd2018-06-20 00:20:32 +02005074
5075 /* Test the key information */
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02005076 PSA_ASSERT( psa_get_key_attributes( handle, &got_attributes ) );
5077 TEST_EQUAL( psa_get_key_type( &got_attributes ), type );
5078 TEST_EQUAL( psa_get_key_bits( &got_attributes ), bits );
Gilles Peskine12313cd2018-06-20 00:20:32 +02005079
Gilles Peskine818ca122018-06-20 18:16:48 +02005080 /* Do something with the key according to its type and permitted usage. */
Gilles Peskinebdf309c2018-12-03 15:36:32 +01005081 if( ! exercise_key( handle, usage, alg ) )
Gilles Peskine02b75072018-07-01 22:31:34 +02005082 goto exit;
Gilles Peskine12313cd2018-06-20 00:20:32 +02005083
5084exit:
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02005085 psa_reset_key_attributes( &got_attributes );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01005086 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02005087 PSA_DONE( );
Gilles Peskine12313cd2018-06-20 00:20:32 +02005088}
5089/* END_CASE */
itayzafrir0adf0fc2018-09-06 16:24:41 +03005090
Gilles Peskinee56e8782019-04-26 17:34:02 +02005091/* BEGIN_CASE depends_on:MBEDTLS_RSA_C:MBEDTLS_GENPRIME:MBEDTLS_PKCS1_V15 */
5092void generate_key_rsa( int bits_arg,
5093 data_t *e_arg,
5094 int expected_status_arg )
5095{
5096 psa_key_handle_t handle = 0;
Gilles Peskinec93b80c2019-05-16 19:39:54 +02005097 psa_key_type_t type = PSA_KEY_TYPE_RSA_KEY_PAIR;
Gilles Peskinee56e8782019-04-26 17:34:02 +02005098 size_t bits = bits_arg;
5099 psa_key_usage_t usage = PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT;
5100 psa_algorithm_t alg = PSA_ALG_RSA_PKCS1V15_SIGN_RAW;
5101 psa_status_t expected_status = expected_status_arg;
5102 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
5103 uint8_t *exported = NULL;
5104 size_t exported_size =
5105 PSA_KEY_EXPORT_MAX_SIZE( PSA_KEY_TYPE_RSA_PUBLIC_KEY, bits );
5106 size_t exported_length = SIZE_MAX;
5107 uint8_t *e_read_buffer = NULL;
5108 int is_default_public_exponent = 0;
Gilles Peskineaa02c172019-04-28 11:44:17 +02005109 size_t e_read_size = PSA_KEY_DOMAIN_PARAMETERS_SIZE( type, bits );
Gilles Peskinee56e8782019-04-26 17:34:02 +02005110 size_t e_read_length = SIZE_MAX;
5111
5112 if( e_arg->len == 0 ||
5113 ( e_arg->len == 3 &&
5114 e_arg->x[0] == 1 && e_arg->x[1] == 0 && e_arg->x[2] == 1 ) )
5115 {
5116 is_default_public_exponent = 1;
5117 e_read_size = 0;
5118 }
5119 ASSERT_ALLOC( e_read_buffer, e_read_size );
5120 ASSERT_ALLOC( exported, exported_size );
5121
5122 PSA_ASSERT( psa_crypto_init( ) );
5123
5124 psa_set_key_usage_flags( &attributes, usage );
5125 psa_set_key_algorithm( &attributes, alg );
5126 PSA_ASSERT( psa_set_key_domain_parameters( &attributes, type,
5127 e_arg->x, e_arg->len ) );
5128 psa_set_key_bits( &attributes, bits );
5129
5130 /* Generate a key */
Gilles Peskine35ef36b2019-05-16 19:42:05 +02005131 TEST_EQUAL( psa_generate_key( &attributes, &handle ), expected_status );
Gilles Peskinee56e8782019-04-26 17:34:02 +02005132 if( expected_status != PSA_SUCCESS )
5133 goto exit;
5134
5135 /* Test the key information */
5136 PSA_ASSERT( psa_get_key_attributes( handle, &attributes ) );
5137 TEST_EQUAL( psa_get_key_type( &attributes ), type );
5138 TEST_EQUAL( psa_get_key_bits( &attributes ), bits );
5139 PSA_ASSERT( psa_get_key_domain_parameters( &attributes,
5140 e_read_buffer, e_read_size,
5141 &e_read_length ) );
5142 if( is_default_public_exponent )
5143 TEST_EQUAL( e_read_length, 0 );
5144 else
5145 ASSERT_COMPARE( e_read_buffer, e_read_length, e_arg->x, e_arg->len );
5146
5147 /* Do something with the key according to its type and permitted usage. */
5148 if( ! exercise_key( handle, usage, alg ) )
5149 goto exit;
5150
5151 /* Export the key and check the public exponent. */
5152 PSA_ASSERT( psa_export_public_key( handle,
5153 exported, exported_size,
5154 &exported_length ) );
5155 {
5156 uint8_t *p = exported;
5157 uint8_t *end = exported + exported_length;
5158 size_t len;
5159 /* RSAPublicKey ::= SEQUENCE {
5160 * modulus INTEGER, -- n
5161 * publicExponent INTEGER } -- e
5162 */
5163 TEST_EQUAL( 0, mbedtls_asn1_get_tag( &p, end, &len,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02005164 MBEDTLS_ASN1_SEQUENCE |
5165 MBEDTLS_ASN1_CONSTRUCTED ) );
Gilles Peskinee56e8782019-04-26 17:34:02 +02005166 TEST_ASSERT( asn1_skip_integer( &p, end, bits, bits, 1 ) );
5167 TEST_EQUAL( 0, mbedtls_asn1_get_tag( &p, end, &len,
5168 MBEDTLS_ASN1_INTEGER ) );
5169 if( len >= 1 && p[0] == 0 )
5170 {
5171 ++p;
5172 --len;
5173 }
5174 if( e_arg->len == 0 )
5175 {
5176 TEST_EQUAL( len, 3 );
5177 TEST_EQUAL( p[0], 1 );
5178 TEST_EQUAL( p[1], 0 );
5179 TEST_EQUAL( p[2], 1 );
5180 }
5181 else
5182 ASSERT_COMPARE( p, len, e_arg->x, e_arg->len );
5183 }
5184
5185exit:
5186 psa_reset_key_attributes( &attributes );
5187 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02005188 PSA_DONE( );
Gilles Peskinee56e8782019-04-26 17:34:02 +02005189 mbedtls_free( e_read_buffer );
5190 mbedtls_free( exported );
5191}
5192/* END_CASE */
5193
Darryl Greend49a4992018-06-18 17:27:26 +01005194/* BEGIN_CASE depends_on:MBEDTLS_PSA_CRYPTO_STORAGE_C */
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005195void persistent_key_load_key_from_storage( data_t *data,
5196 int type_arg, int bits_arg,
5197 int usage_flags_arg, int alg_arg,
5198 int generation_method )
Darryl Greend49a4992018-06-18 17:27:26 +01005199{
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005200 psa_key_id_t key_id = 1;
5201 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskinebdf309c2018-12-03 15:36:32 +01005202 psa_key_handle_t handle = 0;
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005203 psa_key_handle_t base_key = 0;
5204 psa_key_type_t type = type_arg;
5205 size_t bits = bits_arg;
5206 psa_key_usage_t usage_flags = usage_flags_arg;
5207 psa_algorithm_t alg = alg_arg;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005208 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Darryl Greend49a4992018-06-18 17:27:26 +01005209 unsigned char *first_export = NULL;
5210 unsigned char *second_export = NULL;
5211 size_t export_size = PSA_KEY_EXPORT_MAX_SIZE( type, bits );
5212 size_t first_exported_length;
5213 size_t second_exported_length;
5214
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005215 if( usage_flags & PSA_KEY_USAGE_EXPORT )
5216 {
5217 ASSERT_ALLOC( first_export, export_size );
5218 ASSERT_ALLOC( second_export, export_size );
5219 }
Darryl Greend49a4992018-06-18 17:27:26 +01005220
Gilles Peskine8817f612018-12-18 00:18:46 +01005221 PSA_ASSERT( psa_crypto_init() );
Darryl Greend49a4992018-06-18 17:27:26 +01005222
Gilles Peskinec87af662019-05-15 16:12:22 +02005223 psa_set_key_id( &attributes, key_id );
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005224 psa_set_key_usage_flags( &attributes, usage_flags );
5225 psa_set_key_algorithm( &attributes, alg );
5226 psa_set_key_type( &attributes, type );
Gilles Peskine3a4f1f82019-04-26 13:49:28 +02005227 psa_set_key_bits( &attributes, bits );
Darryl Greend49a4992018-06-18 17:27:26 +01005228
Darryl Green0c6575a2018-11-07 16:05:30 +00005229 switch( generation_method )
5230 {
5231 case IMPORT_KEY:
5232 /* Import the key */
Gilles Peskine049c7532019-05-15 20:22:09 +02005233 PSA_ASSERT( psa_import_key( &attributes, data->x, data->len,
5234 &handle ) );
Darryl Green0c6575a2018-11-07 16:05:30 +00005235 break;
Darryl Greend49a4992018-06-18 17:27:26 +01005236
Darryl Green0c6575a2018-11-07 16:05:30 +00005237 case GENERATE_KEY:
5238 /* Generate a key */
Gilles Peskine35ef36b2019-05-16 19:42:05 +02005239 PSA_ASSERT( psa_generate_key( &attributes, &handle ) );
Darryl Green0c6575a2018-11-07 16:05:30 +00005240 break;
5241
5242 case DERIVE_KEY:
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005243 {
5244 /* Create base key */
5245 psa_algorithm_t derive_alg = PSA_ALG_HKDF( PSA_ALG_SHA_256 );
5246 psa_key_attributes_t base_attributes = PSA_KEY_ATTRIBUTES_INIT;
5247 psa_set_key_usage_flags( &base_attributes,
5248 PSA_KEY_USAGE_DERIVE );
5249 psa_set_key_algorithm( &base_attributes, derive_alg );
5250 psa_set_key_type( &base_attributes, PSA_KEY_TYPE_DERIVE );
Gilles Peskine049c7532019-05-15 20:22:09 +02005251 PSA_ASSERT( psa_import_key( &base_attributes,
5252 data->x, data->len,
5253 &base_key ) );
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005254 /* Derive a key. */
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005255 PSA_ASSERT( psa_key_derivation_setup( &operation, derive_alg ) );
Gilles Peskinecf7292e2019-05-16 17:53:40 +02005256 PSA_ASSERT( psa_key_derivation_input_key(
5257 &operation,
5258 PSA_KEY_DERIVATION_INPUT_SECRET, base_key ) );
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005259 PSA_ASSERT( psa_key_derivation_input_bytes(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005260 &operation, PSA_KEY_DERIVATION_INPUT_INFO,
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005261 NULL, 0 ) );
Gilles Peskinecf7292e2019-05-16 17:53:40 +02005262 PSA_ASSERT( psa_key_derivation_output_key( &attributes,
5263 &operation,
5264 &handle ) );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005265 PSA_ASSERT( psa_key_derivation_abort( &operation ) );
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005266 PSA_ASSERT( psa_destroy_key( base_key ) );
5267 base_key = 0;
5268 }
Gilles Peskinecf7292e2019-05-16 17:53:40 +02005269 break;
Darryl Green0c6575a2018-11-07 16:05:30 +00005270 }
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005271 psa_reset_key_attributes( &attributes );
Darryl Greend49a4992018-06-18 17:27:26 +01005272
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005273 /* Export the key if permitted by the key policy. */
5274 if( usage_flags & PSA_KEY_USAGE_EXPORT )
5275 {
5276 PSA_ASSERT( psa_export_key( handle,
5277 first_export, export_size,
5278 &first_exported_length ) );
5279 if( generation_method == IMPORT_KEY )
5280 ASSERT_COMPARE( data->x, data->len,
5281 first_export, first_exported_length );
5282 }
Darryl Greend49a4992018-06-18 17:27:26 +01005283
5284 /* Shutdown and restart */
Gilles Peskine76b29a72019-05-28 14:08:50 +02005285 PSA_ASSERT( psa_close_key( handle ) );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02005286 PSA_DONE();
Gilles Peskine8817f612018-12-18 00:18:46 +01005287 PSA_ASSERT( psa_crypto_init() );
Darryl Greend49a4992018-06-18 17:27:26 +01005288
Darryl Greend49a4992018-06-18 17:27:26 +01005289 /* Check key slot still contains key data */
Gilles Peskine225010f2019-05-06 18:44:55 +02005290 PSA_ASSERT( psa_open_key( key_id, &handle ) );
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005291 PSA_ASSERT( psa_get_key_attributes( handle, &attributes ) );
5292 TEST_EQUAL( psa_get_key_id( &attributes ), key_id );
5293 TEST_EQUAL( psa_get_key_lifetime( &attributes ),
5294 PSA_KEY_LIFETIME_PERSISTENT );
5295 TEST_EQUAL( psa_get_key_type( &attributes ), type );
5296 TEST_EQUAL( psa_get_key_bits( &attributes ), bits );
5297 TEST_EQUAL( psa_get_key_usage_flags( &attributes ), usage_flags );
5298 TEST_EQUAL( psa_get_key_algorithm( &attributes ), alg );
Darryl Greend49a4992018-06-18 17:27:26 +01005299
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005300 /* Export the key again if permitted by the key policy. */
5301 if( usage_flags & PSA_KEY_USAGE_EXPORT )
Darryl Green0c6575a2018-11-07 16:05:30 +00005302 {
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005303 PSA_ASSERT( psa_export_key( handle,
5304 second_export, export_size,
5305 &second_exported_length ) );
Darryl Green0c6575a2018-11-07 16:05:30 +00005306 ASSERT_COMPARE( first_export, first_exported_length,
5307 second_export, second_exported_length );
Darryl Green0c6575a2018-11-07 16:05:30 +00005308 }
5309
5310 /* Do something with the key according to its type and permitted usage. */
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005311 if( ! exercise_key( handle, usage_flags, alg ) )
Darryl Green0c6575a2018-11-07 16:05:30 +00005312 goto exit;
Darryl Greend49a4992018-06-18 17:27:26 +01005313
5314exit:
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02005315 psa_reset_key_attributes( &attributes );
Darryl Greend49a4992018-06-18 17:27:26 +01005316 mbedtls_free( first_export );
5317 mbedtls_free( second_export );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005318 psa_key_derivation_abort( &operation );
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005319 psa_destroy_key( base_key );
5320 if( handle == 0 )
5321 {
5322 /* In case there was a test failure after creating the persistent key
5323 * but while it was not open, try to re-open the persistent key
5324 * to delete it. */
Gilles Peskine225010f2019-05-06 18:44:55 +02005325 psa_open_key( key_id, &handle );
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005326 }
Gilles Peskinebdf309c2018-12-03 15:36:32 +01005327 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02005328 PSA_DONE();
Darryl Greend49a4992018-06-18 17:27:26 +01005329}
5330/* END_CASE */