blob: bb53f81940022ef10e6e3b56196d5e651507ab03 [file] [log] [blame]
Gilles Peskinee59236f2018-01-27 23:32:46 +01001/*
2 * PSA crypto layer on top of Mbed TLS crypto
3 */
4/* Copyright (C) 2018, ARM Limited, All Rights Reserved
5 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 *
19 * This file is part of mbed TLS (https://tls.mbed.org)
20 */
21
22#if !defined(MBEDTLS_CONFIG_FILE)
23#include "mbedtls/config.h"
24#else
25#include MBEDTLS_CONFIG_FILE
26#endif
27
28#if defined(MBEDTLS_PSA_CRYPTO_C)
Mohammad Abo Mokha5c7b7d2018-07-04 15:57:00 +030029/*
30 * In case MBEDTLS_PSA_CRYPTO_SPM is defined the code is built for SPM (Secure
31 * Partition Manager) integration which separate the code into two parts
32 * NSPE (Non-Secure Process Environment) and SPE (Secure Process Environment).
33 * In this mode an additional header file should be included.
34 */
mohammad160327010052018-07-03 13:16:15 +030035#if defined(MBEDTLS_PSA_CRYPTO_SPM)
Mohammad Abo Mokha5c7b7d2018-07-04 15:57:00 +030036/*
37 * PSA_CRYPTO_SECURE means that this file is compiled to the SPE side.
38 * some headers will be affected by this flag.
39 */
mohammad160327010052018-07-03 13:16:15 +030040#define PSA_CRYPTO_SECURE 1
41#include "crypto_spe.h"
42#endif
43
Gilles Peskinee59236f2018-01-27 23:32:46 +010044#include "psa/crypto.h"
45
Gilles Peskine039b90c2018-12-07 18:24:41 +010046#include "psa_crypto_core.h"
Gilles Peskine5e769522018-11-20 21:59:56 +010047#include "psa_crypto_invasive.h"
Gilles Peskine961849f2018-11-30 18:54:54 +010048#include "psa_crypto_slot_management.h"
Darryl Greend49a4992018-06-18 17:27:26 +010049/* Include internal declarations that are useful for implementing persistently
50 * stored keys. */
51#include "psa_crypto_storage.h"
52
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010053#include <stdlib.h>
54#include <string.h>
55#if defined(MBEDTLS_PLATFORM_C)
56#include "mbedtls/platform.h"
57#else
58#define mbedtls_calloc calloc
59#define mbedtls_free free
60#endif
61
Gilles Peskinea5905292018-02-07 20:59:33 +010062#include "mbedtls/arc4.h"
Gilles Peskine9a944802018-06-21 09:35:35 +020063#include "mbedtls/asn1.h"
Jaeden Amero6b196002019-01-10 10:23:21 +000064#include "mbedtls/asn1write.h"
Gilles Peskinea81d85b2018-06-26 16:10:23 +020065#include "mbedtls/bignum.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010066#include "mbedtls/blowfish.h"
67#include "mbedtls/camellia.h"
68#include "mbedtls/cipher.h"
69#include "mbedtls/ccm.h"
70#include "mbedtls/cmac.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010071#include "mbedtls/ctr_drbg.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010072#include "mbedtls/des.h"
Gilles Peskineb7ecdf02018-09-18 12:11:27 +020073#include "mbedtls/ecdh.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010074#include "mbedtls/ecp.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010075#include "mbedtls/entropy.h"
Netanel Gonen2bcd3122018-11-19 11:53:02 +020076#include "mbedtls/entropy_poll.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010077#include "mbedtls/error.h"
78#include "mbedtls/gcm.h"
79#include "mbedtls/md2.h"
80#include "mbedtls/md4.h"
81#include "mbedtls/md5.h"
Gilles Peskine20035e32018-02-03 22:44:14 +010082#include "mbedtls/md.h"
83#include "mbedtls/md_internal.h"
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010084#include "mbedtls/pk.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010085#include "mbedtls/pk_internal.h"
Gilles Peskine3f108122018-12-07 18:14:53 +010086#include "mbedtls/platform_util.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010087#include "mbedtls/ripemd160.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010088#include "mbedtls/rsa.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010089#include "mbedtls/sha1.h"
90#include "mbedtls/sha256.h"
91#include "mbedtls/sha512.h"
92#include "mbedtls/xtea.h"
93
Netanel Gonen2bcd3122018-11-19 11:53:02 +020094#if ( defined(MBEDTLS_ENTROPY_NV_SEED) && defined(MBEDTLS_PSA_HAS_ITS_IO) )
95#include "psa_prot_internal_storage.h"
96#endif
Gilles Peskinee59236f2018-01-27 23:32:46 +010097
Gilles Peskine996deb12018-08-01 15:45:45 +020098#define ARRAY_LENGTH( array ) ( sizeof( array ) / sizeof( *( array ) ) )
99
Gilles Peskine9ef733f2018-02-07 21:05:37 +0100100/* constant-time buffer comparison */
101static inline int safer_memcmp( const uint8_t *a, const uint8_t *b, size_t n )
102{
103 size_t i;
104 unsigned char diff = 0;
105
106 for( i = 0; i < n; i++ )
107 diff |= a[i] ^ b[i];
108
109 return( diff );
110}
111
112
113
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100114/****************************************************************/
115/* Global data, support functions and library management */
116/****************************************************************/
117
Gilles Peskine48c0ea12018-06-21 14:15:31 +0200118static int key_type_is_raw_bytes( psa_key_type_t type )
119{
Gilles Peskine78b3bb62018-08-10 16:03:41 +0200120 return( PSA_KEY_TYPE_IS_UNSTRUCTURED( type ) );
Gilles Peskine48c0ea12018-06-21 14:15:31 +0200121}
122
Gilles Peskine5a3c50e2018-12-04 12:27:09 +0100123/* Values for psa_global_data_t::rng_state */
124#define RNG_NOT_INITIALIZED 0
125#define RNG_INITIALIZED 1
126#define RNG_SEEDED 2
Gilles Peskinec6b69072018-11-20 21:42:52 +0100127
Gilles Peskine2d277862018-06-18 15:41:12 +0200128typedef struct
129{
Gilles Peskine5e769522018-11-20 21:59:56 +0100130 void (* entropy_init )( mbedtls_entropy_context *ctx );
131 void (* entropy_free )( mbedtls_entropy_context *ctx );
Gilles Peskinee59236f2018-01-27 23:32:46 +0100132 mbedtls_entropy_context entropy;
133 mbedtls_ctr_drbg_context ctr_drbg;
Gilles Peskinec6b69072018-11-20 21:42:52 +0100134 unsigned initialized : 1;
Gilles Peskine5a3c50e2018-12-04 12:27:09 +0100135 unsigned rng_state : 2;
Gilles Peskinee59236f2018-01-27 23:32:46 +0100136} psa_global_data_t;
137
138static psa_global_data_t global_data;
139
itayzafrir0adf0fc2018-09-06 16:24:41 +0300140#define GUARD_MODULE_INITIALIZED \
141 if( global_data.initialized == 0 ) \
142 return( PSA_ERROR_BAD_STATE );
143
Gilles Peskinee59236f2018-01-27 23:32:46 +0100144static psa_status_t mbedtls_to_psa_error( int ret )
145{
Gilles Peskinea5905292018-02-07 20:59:33 +0100146 /* If there's both a high-level code and low-level code, dispatch on
147 * the high-level code. */
148 switch( ret < -0x7f ? - ( -ret & 0x7f80 ) : ret )
Gilles Peskinee59236f2018-01-27 23:32:46 +0100149 {
150 case 0:
151 return( PSA_SUCCESS );
Gilles Peskinea5905292018-02-07 20:59:33 +0100152
153 case MBEDTLS_ERR_AES_INVALID_KEY_LENGTH:
154 case MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH:
155 case MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE:
156 return( PSA_ERROR_NOT_SUPPORTED );
157 case MBEDTLS_ERR_AES_HW_ACCEL_FAILED:
158 return( PSA_ERROR_HARDWARE_FAILURE );
159
160 case MBEDTLS_ERR_ARC4_HW_ACCEL_FAILED:
161 return( PSA_ERROR_HARDWARE_FAILURE );
162
Gilles Peskine9a944802018-06-21 09:35:35 +0200163 case MBEDTLS_ERR_ASN1_OUT_OF_DATA:
164 case MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:
165 case MBEDTLS_ERR_ASN1_INVALID_LENGTH:
166 case MBEDTLS_ERR_ASN1_LENGTH_MISMATCH:
167 case MBEDTLS_ERR_ASN1_INVALID_DATA:
168 return( PSA_ERROR_INVALID_ARGUMENT );
169 case MBEDTLS_ERR_ASN1_ALLOC_FAILED:
170 return( PSA_ERROR_INSUFFICIENT_MEMORY );
171 case MBEDTLS_ERR_ASN1_BUF_TOO_SMALL:
172 return( PSA_ERROR_BUFFER_TOO_SMALL );
173
Gilles Peskinea5905292018-02-07 20:59:33 +0100174 case MBEDTLS_ERR_BLOWFISH_INVALID_KEY_LENGTH:
175 case MBEDTLS_ERR_BLOWFISH_INVALID_INPUT_LENGTH:
176 return( PSA_ERROR_NOT_SUPPORTED );
177 case MBEDTLS_ERR_BLOWFISH_HW_ACCEL_FAILED:
178 return( PSA_ERROR_HARDWARE_FAILURE );
179
180 case MBEDTLS_ERR_CAMELLIA_INVALID_KEY_LENGTH:
181 case MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH:
182 return( PSA_ERROR_NOT_SUPPORTED );
183 case MBEDTLS_ERR_CAMELLIA_HW_ACCEL_FAILED:
184 return( PSA_ERROR_HARDWARE_FAILURE );
185
186 case MBEDTLS_ERR_CCM_BAD_INPUT:
187 return( PSA_ERROR_INVALID_ARGUMENT );
188 case MBEDTLS_ERR_CCM_AUTH_FAILED:
189 return( PSA_ERROR_INVALID_SIGNATURE );
190 case MBEDTLS_ERR_CCM_HW_ACCEL_FAILED:
191 return( PSA_ERROR_HARDWARE_FAILURE );
192
193 case MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE:
194 return( PSA_ERROR_NOT_SUPPORTED );
195 case MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA:
196 return( PSA_ERROR_INVALID_ARGUMENT );
197 case MBEDTLS_ERR_CIPHER_ALLOC_FAILED:
198 return( PSA_ERROR_INSUFFICIENT_MEMORY );
199 case MBEDTLS_ERR_CIPHER_INVALID_PADDING:
200 return( PSA_ERROR_INVALID_PADDING );
201 case MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED:
202 return( PSA_ERROR_BAD_STATE );
203 case MBEDTLS_ERR_CIPHER_AUTH_FAILED:
204 return( PSA_ERROR_INVALID_SIGNATURE );
205 case MBEDTLS_ERR_CIPHER_INVALID_CONTEXT:
206 return( PSA_ERROR_TAMPERING_DETECTED );
207 case MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED:
208 return( PSA_ERROR_HARDWARE_FAILURE );
209
210 case MBEDTLS_ERR_CMAC_HW_ACCEL_FAILED:
211 return( PSA_ERROR_HARDWARE_FAILURE );
212
213 case MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED:
214 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
215 case MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG:
216 case MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG:
217 return( PSA_ERROR_NOT_SUPPORTED );
218 case MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR:
219 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
220
221 case MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH:
222 return( PSA_ERROR_NOT_SUPPORTED );
223 case MBEDTLS_ERR_DES_HW_ACCEL_FAILED:
224 return( PSA_ERROR_HARDWARE_FAILURE );
225
Gilles Peskinee59236f2018-01-27 23:32:46 +0100226 case MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED:
227 case MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE:
228 case MBEDTLS_ERR_ENTROPY_SOURCE_FAILED:
229 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
Gilles Peskinea5905292018-02-07 20:59:33 +0100230
231 case MBEDTLS_ERR_GCM_AUTH_FAILED:
232 return( PSA_ERROR_INVALID_SIGNATURE );
233 case MBEDTLS_ERR_GCM_BAD_INPUT:
Gilles Peskine8cac2e62018-08-21 15:07:38 +0200234 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskinea5905292018-02-07 20:59:33 +0100235 case MBEDTLS_ERR_GCM_HW_ACCEL_FAILED:
236 return( PSA_ERROR_HARDWARE_FAILURE );
237
238 case MBEDTLS_ERR_MD2_HW_ACCEL_FAILED:
239 case MBEDTLS_ERR_MD4_HW_ACCEL_FAILED:
240 case MBEDTLS_ERR_MD5_HW_ACCEL_FAILED:
241 return( PSA_ERROR_HARDWARE_FAILURE );
242
243 case MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE:
244 return( PSA_ERROR_NOT_SUPPORTED );
245 case MBEDTLS_ERR_MD_BAD_INPUT_DATA:
246 return( PSA_ERROR_INVALID_ARGUMENT );
247 case MBEDTLS_ERR_MD_ALLOC_FAILED:
248 return( PSA_ERROR_INSUFFICIENT_MEMORY );
249 case MBEDTLS_ERR_MD_FILE_IO_ERROR:
250 return( PSA_ERROR_STORAGE_FAILURE );
251 case MBEDTLS_ERR_MD_HW_ACCEL_FAILED:
252 return( PSA_ERROR_HARDWARE_FAILURE );
253
Gilles Peskinef76aa772018-10-29 19:24:33 +0100254 case MBEDTLS_ERR_MPI_FILE_IO_ERROR:
255 return( PSA_ERROR_STORAGE_FAILURE );
256 case MBEDTLS_ERR_MPI_BAD_INPUT_DATA:
257 return( PSA_ERROR_INVALID_ARGUMENT );
258 case MBEDTLS_ERR_MPI_INVALID_CHARACTER:
259 return( PSA_ERROR_INVALID_ARGUMENT );
260 case MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL:
261 return( PSA_ERROR_BUFFER_TOO_SMALL );
262 case MBEDTLS_ERR_MPI_NEGATIVE_VALUE:
263 return( PSA_ERROR_INVALID_ARGUMENT );
264 case MBEDTLS_ERR_MPI_DIVISION_BY_ZERO:
265 return( PSA_ERROR_INVALID_ARGUMENT );
266 case MBEDTLS_ERR_MPI_NOT_ACCEPTABLE:
267 return( PSA_ERROR_INVALID_ARGUMENT );
268 case MBEDTLS_ERR_MPI_ALLOC_FAILED:
269 return( PSA_ERROR_INSUFFICIENT_MEMORY );
270
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100271 case MBEDTLS_ERR_PK_ALLOC_FAILED:
272 return( PSA_ERROR_INSUFFICIENT_MEMORY );
273 case MBEDTLS_ERR_PK_TYPE_MISMATCH:
274 case MBEDTLS_ERR_PK_BAD_INPUT_DATA:
275 return( PSA_ERROR_INVALID_ARGUMENT );
276 case MBEDTLS_ERR_PK_FILE_IO_ERROR:
Gilles Peskinea5905292018-02-07 20:59:33 +0100277 return( PSA_ERROR_STORAGE_FAILURE );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100278 case MBEDTLS_ERR_PK_KEY_INVALID_VERSION:
279 case MBEDTLS_ERR_PK_KEY_INVALID_FORMAT:
280 return( PSA_ERROR_INVALID_ARGUMENT );
281 case MBEDTLS_ERR_PK_UNKNOWN_PK_ALG:
282 return( PSA_ERROR_NOT_SUPPORTED );
283 case MBEDTLS_ERR_PK_PASSWORD_REQUIRED:
284 case MBEDTLS_ERR_PK_PASSWORD_MISMATCH:
285 return( PSA_ERROR_NOT_PERMITTED );
286 case MBEDTLS_ERR_PK_INVALID_PUBKEY:
287 return( PSA_ERROR_INVALID_ARGUMENT );
288 case MBEDTLS_ERR_PK_INVALID_ALG:
289 case MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE:
290 case MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE:
291 return( PSA_ERROR_NOT_SUPPORTED );
292 case MBEDTLS_ERR_PK_SIG_LEN_MISMATCH:
293 return( PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskinea5905292018-02-07 20:59:33 +0100294 case MBEDTLS_ERR_PK_HW_ACCEL_FAILED:
295 return( PSA_ERROR_HARDWARE_FAILURE );
296
297 case MBEDTLS_ERR_RIPEMD160_HW_ACCEL_FAILED:
298 return( PSA_ERROR_HARDWARE_FAILURE );
299
300 case MBEDTLS_ERR_RSA_BAD_INPUT_DATA:
301 return( PSA_ERROR_INVALID_ARGUMENT );
302 case MBEDTLS_ERR_RSA_INVALID_PADDING:
303 return( PSA_ERROR_INVALID_PADDING );
304 case MBEDTLS_ERR_RSA_KEY_GEN_FAILED:
305 return( PSA_ERROR_HARDWARE_FAILURE );
306 case MBEDTLS_ERR_RSA_KEY_CHECK_FAILED:
307 return( PSA_ERROR_INVALID_ARGUMENT );
308 case MBEDTLS_ERR_RSA_PUBLIC_FAILED:
309 case MBEDTLS_ERR_RSA_PRIVATE_FAILED:
310 return( PSA_ERROR_TAMPERING_DETECTED );
311 case MBEDTLS_ERR_RSA_VERIFY_FAILED:
312 return( PSA_ERROR_INVALID_SIGNATURE );
313 case MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE:
314 return( PSA_ERROR_BUFFER_TOO_SMALL );
315 case MBEDTLS_ERR_RSA_RNG_FAILED:
316 return( PSA_ERROR_INSUFFICIENT_MEMORY );
317 case MBEDTLS_ERR_RSA_UNSUPPORTED_OPERATION:
318 return( PSA_ERROR_NOT_SUPPORTED );
319 case MBEDTLS_ERR_RSA_HW_ACCEL_FAILED:
320 return( PSA_ERROR_HARDWARE_FAILURE );
321
322 case MBEDTLS_ERR_SHA1_HW_ACCEL_FAILED:
323 case MBEDTLS_ERR_SHA256_HW_ACCEL_FAILED:
324 case MBEDTLS_ERR_SHA512_HW_ACCEL_FAILED:
325 return( PSA_ERROR_HARDWARE_FAILURE );
326
327 case MBEDTLS_ERR_XTEA_INVALID_INPUT_LENGTH:
328 return( PSA_ERROR_INVALID_ARGUMENT );
329 case MBEDTLS_ERR_XTEA_HW_ACCEL_FAILED:
330 return( PSA_ERROR_HARDWARE_FAILURE );
331
itayzafrir5c753392018-05-08 11:18:38 +0300332 case MBEDTLS_ERR_ECP_BAD_INPUT_DATA:
itayzafrir7b30f8b2018-05-09 16:07:36 +0300333 case MBEDTLS_ERR_ECP_INVALID_KEY:
itayzafrir5c753392018-05-08 11:18:38 +0300334 return( PSA_ERROR_INVALID_ARGUMENT );
itayzafrir7b30f8b2018-05-09 16:07:36 +0300335 case MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL:
336 return( PSA_ERROR_BUFFER_TOO_SMALL );
337 case MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE:
338 return( PSA_ERROR_NOT_SUPPORTED );
339 case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH:
340 case MBEDTLS_ERR_ECP_VERIFY_FAILED:
341 return( PSA_ERROR_INVALID_SIGNATURE );
342 case MBEDTLS_ERR_ECP_ALLOC_FAILED:
343 return( PSA_ERROR_INSUFFICIENT_MEMORY );
344 case MBEDTLS_ERR_ECP_HW_ACCEL_FAILED:
345 return( PSA_ERROR_HARDWARE_FAILURE );
itayzafrir5c753392018-05-08 11:18:38 +0300346
Gilles Peskinee59236f2018-01-27 23:32:46 +0100347 default:
348 return( PSA_ERROR_UNKNOWN_ERROR );
349 }
350}
351
Gilles Peskineb0b255c2018-07-06 17:01:38 +0200352
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +0200353
354
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100355/****************************************************************/
356/* Key management */
357/****************************************************************/
358
Darryl Green8f8aa8f2018-07-24 15:44:51 +0100359#if defined(MBEDTLS_ECP_C)
Gilles Peskine34ef7f52018-06-18 20:47:51 +0200360static psa_ecc_curve_t mbedtls_ecc_group_to_psa( mbedtls_ecp_group_id grpid )
361{
362 switch( grpid )
363 {
364 case MBEDTLS_ECP_DP_SECP192R1:
365 return( PSA_ECC_CURVE_SECP192R1 );
366 case MBEDTLS_ECP_DP_SECP224R1:
367 return( PSA_ECC_CURVE_SECP224R1 );
368 case MBEDTLS_ECP_DP_SECP256R1:
369 return( PSA_ECC_CURVE_SECP256R1 );
370 case MBEDTLS_ECP_DP_SECP384R1:
371 return( PSA_ECC_CURVE_SECP384R1 );
372 case MBEDTLS_ECP_DP_SECP521R1:
373 return( PSA_ECC_CURVE_SECP521R1 );
374 case MBEDTLS_ECP_DP_BP256R1:
375 return( PSA_ECC_CURVE_BRAINPOOL_P256R1 );
376 case MBEDTLS_ECP_DP_BP384R1:
377 return( PSA_ECC_CURVE_BRAINPOOL_P384R1 );
378 case MBEDTLS_ECP_DP_BP512R1:
379 return( PSA_ECC_CURVE_BRAINPOOL_P512R1 );
380 case MBEDTLS_ECP_DP_CURVE25519:
381 return( PSA_ECC_CURVE_CURVE25519 );
382 case MBEDTLS_ECP_DP_SECP192K1:
383 return( PSA_ECC_CURVE_SECP192K1 );
384 case MBEDTLS_ECP_DP_SECP224K1:
385 return( PSA_ECC_CURVE_SECP224K1 );
386 case MBEDTLS_ECP_DP_SECP256K1:
387 return( PSA_ECC_CURVE_SECP256K1 );
388 case MBEDTLS_ECP_DP_CURVE448:
389 return( PSA_ECC_CURVE_CURVE448 );
390 default:
391 return( 0 );
392 }
393}
394
Gilles Peskine12313cd2018-06-20 00:20:32 +0200395static mbedtls_ecp_group_id mbedtls_ecc_group_of_psa( psa_ecc_curve_t curve )
396{
397 switch( curve )
398 {
399 case PSA_ECC_CURVE_SECP192R1:
400 return( MBEDTLS_ECP_DP_SECP192R1 );
401 case PSA_ECC_CURVE_SECP224R1:
402 return( MBEDTLS_ECP_DP_SECP224R1 );
403 case PSA_ECC_CURVE_SECP256R1:
404 return( MBEDTLS_ECP_DP_SECP256R1 );
405 case PSA_ECC_CURVE_SECP384R1:
406 return( MBEDTLS_ECP_DP_SECP384R1 );
407 case PSA_ECC_CURVE_SECP521R1:
408 return( MBEDTLS_ECP_DP_SECP521R1 );
409 case PSA_ECC_CURVE_BRAINPOOL_P256R1:
410 return( MBEDTLS_ECP_DP_BP256R1 );
411 case PSA_ECC_CURVE_BRAINPOOL_P384R1:
412 return( MBEDTLS_ECP_DP_BP384R1 );
413 case PSA_ECC_CURVE_BRAINPOOL_P512R1:
414 return( MBEDTLS_ECP_DP_BP512R1 );
415 case PSA_ECC_CURVE_CURVE25519:
416 return( MBEDTLS_ECP_DP_CURVE25519 );
417 case PSA_ECC_CURVE_SECP192K1:
418 return( MBEDTLS_ECP_DP_SECP192K1 );
419 case PSA_ECC_CURVE_SECP224K1:
420 return( MBEDTLS_ECP_DP_SECP224K1 );
421 case PSA_ECC_CURVE_SECP256K1:
422 return( MBEDTLS_ECP_DP_SECP256K1 );
423 case PSA_ECC_CURVE_CURVE448:
424 return( MBEDTLS_ECP_DP_CURVE448 );
425 default:
426 return( MBEDTLS_ECP_DP_NONE );
427 }
428}
Darryl Green8f8aa8f2018-07-24 15:44:51 +0100429#endif /* defined(MBEDTLS_ECP_C) */
Gilles Peskine12313cd2018-06-20 00:20:32 +0200430
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200431static psa_status_t prepare_raw_data_slot( psa_key_type_t type,
432 size_t bits,
433 struct raw_data *raw )
434{
435 /* Check that the bit size is acceptable for the key type */
436 switch( type )
437 {
438 case PSA_KEY_TYPE_RAW_DATA:
Gilles Peskine46f1fd72018-06-28 19:31:31 +0200439 if( bits == 0 )
440 {
441 raw->bytes = 0;
442 raw->data = NULL;
443 return( PSA_SUCCESS );
444 }
445 break;
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200446#if defined(MBEDTLS_MD_C)
447 case PSA_KEY_TYPE_HMAC:
Gilles Peskine46f1fd72018-06-28 19:31:31 +0200448#endif
Gilles Peskineea0fb492018-07-12 17:17:20 +0200449 case PSA_KEY_TYPE_DERIVE:
450 break;
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200451#if defined(MBEDTLS_AES_C)
452 case PSA_KEY_TYPE_AES:
453 if( bits != 128 && bits != 192 && bits != 256 )
454 return( PSA_ERROR_INVALID_ARGUMENT );
455 break;
456#endif
457#if defined(MBEDTLS_CAMELLIA_C)
458 case PSA_KEY_TYPE_CAMELLIA:
459 if( bits != 128 && bits != 192 && bits != 256 )
460 return( PSA_ERROR_INVALID_ARGUMENT );
461 break;
462#endif
463#if defined(MBEDTLS_DES_C)
464 case PSA_KEY_TYPE_DES:
465 if( bits != 64 && bits != 128 && bits != 192 )
466 return( PSA_ERROR_INVALID_ARGUMENT );
467 break;
468#endif
469#if defined(MBEDTLS_ARC4_C)
470 case PSA_KEY_TYPE_ARC4:
471 if( bits < 8 || bits > 2048 )
472 return( PSA_ERROR_INVALID_ARGUMENT );
473 break;
474#endif
475 default:
476 return( PSA_ERROR_NOT_SUPPORTED );
477 }
Gilles Peskineb54979a2018-06-21 09:32:47 +0200478 if( bits % 8 != 0 )
479 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200480
481 /* Allocate memory for the key */
482 raw->bytes = PSA_BITS_TO_BYTES( bits );
483 raw->data = mbedtls_calloc( 1, raw->bytes );
484 if( raw->data == NULL )
485 {
486 raw->bytes = 0;
487 return( PSA_ERROR_INSUFFICIENT_MEMORY );
488 }
489 return( PSA_SUCCESS );
490}
491
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200492#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PK_PARSE_C)
Gilles Peskine86a440b2018-11-12 18:39:40 +0100493/* Mbed TLS doesn't support non-byte-aligned key sizes (i.e. key sizes
494 * that are not a multiple of 8) well. For example, there is only
495 * mbedtls_rsa_get_len(), which returns a number of bytes, and no
496 * way to return the exact bit size of a key.
497 * To keep things simple, reject non-byte-aligned key sizes. */
498static psa_status_t psa_check_rsa_key_byte_aligned(
499 const mbedtls_rsa_context *rsa )
500{
501 mbedtls_mpi n;
502 psa_status_t status;
503 mbedtls_mpi_init( &n );
504 status = mbedtls_to_psa_error(
505 mbedtls_rsa_export( rsa, &n, NULL, NULL, NULL, NULL ) );
506 if( status == PSA_SUCCESS )
507 {
508 if( mbedtls_mpi_bitlen( &n ) % 8 != 0 )
509 status = PSA_ERROR_NOT_SUPPORTED;
510 }
511 mbedtls_mpi_free( &n );
512 return( status );
513}
514
Jaeden Ameroec6ff862019-01-11 17:53:05 +0000515static psa_status_t psa_import_rsa_key( psa_key_type_t type,
516 const uint8_t *data,
517 size_t data_length,
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200518 mbedtls_rsa_context **p_rsa )
519{
Jaeden Ameroec6ff862019-01-11 17:53:05 +0000520 psa_status_t status;
521 mbedtls_pk_context pk;
522 mbedtls_rsa_context *rsa;
523 size_t bits;
524
525 mbedtls_pk_init( &pk );
526
527 /* Parse the data. */
528 if( PSA_KEY_TYPE_IS_KEYPAIR( type ) )
529 status = mbedtls_to_psa_error(
530 mbedtls_pk_parse_key( &pk, data, data_length, NULL, 0 ) );
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200531 else
Jaeden Ameroec6ff862019-01-11 17:53:05 +0000532 status = mbedtls_to_psa_error(
533 mbedtls_pk_parse_public_key( &pk, data, data_length ) );
534 if( status != PSA_SUCCESS )
535 goto exit;
536
537 /* We have something that the pkparse module recognizes. If it is a
538 * valid RSA key, store it. */
539 if( mbedtls_pk_get_type( &pk ) != MBEDTLS_PK_RSA )
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200540 {
Jaeden Ameroec6ff862019-01-11 17:53:05 +0000541 status = PSA_ERROR_INVALID_ARGUMENT;
542 goto exit;
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200543 }
Jaeden Ameroec6ff862019-01-11 17:53:05 +0000544
545 rsa = mbedtls_pk_rsa( pk );
546 /* The size of an RSA key doesn't have to be a multiple of 8. Mbed TLS
547 * supports non-byte-aligned key sizes, but not well. For example,
548 * mbedtls_rsa_get_len() returns the key size in bytes, not in bits. */
549 bits = PSA_BYTES_TO_BITS( mbedtls_rsa_get_len( rsa ) );
550 if( bits > PSA_VENDOR_RSA_MAX_KEY_BITS )
551 {
552 status = PSA_ERROR_NOT_SUPPORTED;
553 goto exit;
554 }
555 status = psa_check_rsa_key_byte_aligned( rsa );
556
557exit:
558 /* Free the content of the pk object only on error. */
559 if( status != PSA_SUCCESS )
560 {
561 mbedtls_pk_free( &pk );
562 return( status );
563 }
564
565 /* On success, store the content of the object in the RSA context. */
566 *p_rsa = rsa;
567
568 return( PSA_SUCCESS );
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200569}
570#endif /* defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PK_PARSE_C) */
571
Jaeden Amero0ae445f2019-01-10 11:42:27 +0000572#if defined(MBEDTLS_ECP_C)
573
574/* Import a public key given as the uncompressed representation defined by SEC1
575 * 2.3.3 as the content of an ECPoint. */
576static psa_status_t psa_import_ec_public_key( psa_ecc_curve_t curve,
577 const uint8_t *data,
578 size_t data_length,
579 mbedtls_ecp_keypair **p_ecp )
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200580{
Jaeden Amero0ae445f2019-01-10 11:42:27 +0000581 psa_status_t status = PSA_ERROR_TAMPERING_DETECTED;
582 mbedtls_ecp_keypair *ecp = NULL;
583 mbedtls_ecp_group_id grp_id = mbedtls_ecc_group_of_psa( curve );
584
585 *p_ecp = NULL;
586 ecp = mbedtls_calloc( 1, sizeof( *ecp ) );
587 if( ecp == NULL )
588 return( PSA_ERROR_INSUFFICIENT_MEMORY );
589 mbedtls_ecp_keypair_init( ecp );
590
591 /* Load the group. */
592 status = mbedtls_to_psa_error(
593 mbedtls_ecp_group_load( &ecp->grp, grp_id ) );
594 if( status != PSA_SUCCESS )
595 goto exit;
596 /* Load the public value. */
597 status = mbedtls_to_psa_error(
598 mbedtls_ecp_point_read_binary( &ecp->grp, &ecp->Q,
599 data, data_length ) );
600 if( status != PSA_SUCCESS )
601 goto exit;
602
603 /* Check that the point is on the curve. */
604 status = mbedtls_to_psa_error(
605 mbedtls_ecp_check_pubkey( &ecp->grp, &ecp->Q ) );
606 if( status != PSA_SUCCESS )
607 goto exit;
608
609 *p_ecp = ecp;
610 return( PSA_SUCCESS );
611
612exit:
613 if( ecp != NULL )
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200614 {
Jaeden Amero0ae445f2019-01-10 11:42:27 +0000615 mbedtls_ecp_keypair_free( ecp );
616 mbedtls_free( ecp );
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200617 }
Jaeden Amero0ae445f2019-01-10 11:42:27 +0000618 return( status );
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200619}
Jaeden Amero0ae445f2019-01-10 11:42:27 +0000620#endif /* defined(MBEDTLS_ECP_C) */
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200621
Gilles Peskinef76aa772018-10-29 19:24:33 +0100622#if defined(MBEDTLS_ECP_C)
623/* Import a private key given as a byte string which is the private value
624 * in big-endian order. */
625static psa_status_t psa_import_ec_private_key( psa_ecc_curve_t curve,
626 const uint8_t *data,
627 size_t data_length,
628 mbedtls_ecp_keypair **p_ecp )
629{
630 psa_status_t status = PSA_ERROR_TAMPERING_DETECTED;
631 mbedtls_ecp_keypair *ecp = NULL;
632 mbedtls_ecp_group_id grp_id = mbedtls_ecc_group_of_psa( curve );
633
634 *p_ecp = NULL;
635 ecp = mbedtls_calloc( 1, sizeof( mbedtls_ecp_keypair ) );
636 if( ecp == NULL )
637 return( PSA_ERROR_INSUFFICIENT_MEMORY );
Jaeden Amero83d29392019-01-10 20:17:42 +0000638 mbedtls_ecp_keypair_init( ecp );
Gilles Peskinef76aa772018-10-29 19:24:33 +0100639
640 /* Load the group. */
641 status = mbedtls_to_psa_error(
642 mbedtls_ecp_group_load( &ecp->grp, grp_id ) );
643 if( status != PSA_SUCCESS )
644 goto exit;
645 /* Load the secret value. */
646 status = mbedtls_to_psa_error(
647 mbedtls_mpi_read_binary( &ecp->d, data, data_length ) );
648 if( status != PSA_SUCCESS )
649 goto exit;
650 /* Validate the private key. */
651 status = mbedtls_to_psa_error(
652 mbedtls_ecp_check_privkey( &ecp->grp, &ecp->d ) );
653 if( status != PSA_SUCCESS )
654 goto exit;
655 /* Calculate the public key from the private key. */
656 status = mbedtls_to_psa_error(
657 mbedtls_ecp_mul( &ecp->grp, &ecp->Q, &ecp->d, &ecp->grp.G,
658 mbedtls_ctr_drbg_random, &global_data.ctr_drbg ) );
659 if( status != PSA_SUCCESS )
660 goto exit;
661
662 *p_ecp = ecp;
663 return( PSA_SUCCESS );
664
665exit:
666 if( ecp != NULL )
667 {
668 mbedtls_ecp_keypair_free( ecp );
669 mbedtls_free( ecp );
670 }
671 return( status );
672}
673#endif /* defined(MBEDTLS_ECP_C) */
674
Gilles Peskinef77ed1f2018-12-03 11:58:46 +0100675/** Import key data into a slot. `slot->type` must have been set
676 * previously. This function assumes that the slot does not contain
677 * any key material yet. On failure, the slot content is unchanged. */
Gilles Peskinefa4135b2018-12-10 16:48:53 +0100678psa_status_t psa_import_key_into_slot( psa_key_slot_t *slot,
679 const uint8_t *data,
680 size_t data_length )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100681{
Gilles Peskineb0b255c2018-07-06 17:01:38 +0200682 psa_status_t status = PSA_SUCCESS;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100683
Darryl Green940d72c2018-07-13 13:18:51 +0100684 if( key_type_is_raw_bytes( slot->type ) )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100685 {
Gilles Peskine6d912132018-03-07 16:41:37 +0100686 /* Ensure that a bytes-to-bit conversion won't overflow. */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100687 if( data_length > SIZE_MAX / 8 )
688 return( PSA_ERROR_NOT_SUPPORTED );
Darryl Green940d72c2018-07-13 13:18:51 +0100689 status = prepare_raw_data_slot( slot->type,
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200690 PSA_BYTES_TO_BITS( data_length ),
691 &slot->data.raw );
692 if( status != PSA_SUCCESS )
693 return( status );
Gilles Peskine46f1fd72018-06-28 19:31:31 +0200694 if( data_length != 0 )
695 memcpy( slot->data.raw.data, data, data_length );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100696 }
697 else
Gilles Peskinef76aa772018-10-29 19:24:33 +0100698#if defined(MBEDTLS_ECP_C)
Darryl Green940d72c2018-07-13 13:18:51 +0100699 if( PSA_KEY_TYPE_IS_ECC_KEYPAIR( slot->type ) )
Gilles Peskinef76aa772018-10-29 19:24:33 +0100700 {
Darryl Green940d72c2018-07-13 13:18:51 +0100701 status = psa_import_ec_private_key( PSA_KEY_TYPE_GET_CURVE( slot->type ),
Gilles Peskinef76aa772018-10-29 19:24:33 +0100702 data, data_length,
703 &slot->data.ecp );
Gilles Peskinef76aa772018-10-29 19:24:33 +0100704 }
Jaeden Amero0ae445f2019-01-10 11:42:27 +0000705 else if( PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY( slot->type ) )
706 {
707 status = psa_import_ec_public_key(
708 PSA_KEY_TYPE_GET_CURVE( slot->type ),
709 data, data_length,
710 &slot->data.ecp );
Jaeden Amero0ae445f2019-01-10 11:42:27 +0000711 }
Gilles Peskinef76aa772018-10-29 19:24:33 +0100712 else
713#endif /* MBEDTLS_ECP_C */
Jaeden Amero0ae445f2019-01-10 11:42:27 +0000714#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PK_PARSE_C)
715 if( PSA_KEY_TYPE_IS_RSA( slot->type ) )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100716 {
Jaeden Ameroec6ff862019-01-11 17:53:05 +0000717 status = psa_import_rsa_key( slot->type,
718 data, data_length,
719 &slot->data.rsa );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100720 }
721 else
Jaeden Amero0ae445f2019-01-10 11:42:27 +0000722#endif /* defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PK_PARSE_C) */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100723 {
724 return( PSA_ERROR_NOT_SUPPORTED );
725 }
Jaeden Amero08ad3272019-01-14 13:12:39 +0000726 return( status );
Darryl Green940d72c2018-07-13 13:18:51 +0100727}
728
Darryl Green06fd18d2018-07-16 11:21:11 +0100729/* Retrieve an empty key slot (slot with no key data, but possibly
730 * with some metadata such as a policy). */
Gilles Peskinec5487a82018-12-03 18:08:14 +0100731static psa_status_t psa_get_empty_key_slot( psa_key_handle_t handle,
Gilles Peskine2f060a82018-12-04 17:12:32 +0100732 psa_key_slot_t **p_slot )
Darryl Green06fd18d2018-07-16 11:21:11 +0100733{
734 psa_status_t status;
Gilles Peskine2f060a82018-12-04 17:12:32 +0100735 psa_key_slot_t *slot = NULL;
Darryl Green06fd18d2018-07-16 11:21:11 +0100736
737 *p_slot = NULL;
738
Gilles Peskinec5487a82018-12-03 18:08:14 +0100739 status = psa_get_key_slot( handle, &slot );
Darryl Green06fd18d2018-07-16 11:21:11 +0100740 if( status != PSA_SUCCESS )
741 return( status );
742
743 if( slot->type != PSA_KEY_TYPE_NONE )
744 return( PSA_ERROR_OCCUPIED_SLOT );
745
746 *p_slot = slot;
747 return( status );
748}
749
750/** Retrieve a slot which must contain a key. The key must have allow all the
751 * usage flags set in \p usage. If \p alg is nonzero, the key must allow
752 * operations with this algorithm. */
Gilles Peskinec5487a82018-12-03 18:08:14 +0100753static psa_status_t psa_get_key_from_slot( psa_key_handle_t handle,
Gilles Peskine2f060a82018-12-04 17:12:32 +0100754 psa_key_slot_t **p_slot,
Darryl Green06fd18d2018-07-16 11:21:11 +0100755 psa_key_usage_t usage,
756 psa_algorithm_t alg )
757{
758 psa_status_t status;
Gilles Peskine2f060a82018-12-04 17:12:32 +0100759 psa_key_slot_t *slot = NULL;
Darryl Green06fd18d2018-07-16 11:21:11 +0100760
761 *p_slot = NULL;
762
Gilles Peskinec5487a82018-12-03 18:08:14 +0100763 status = psa_get_key_slot( handle, &slot );
Darryl Green06fd18d2018-07-16 11:21:11 +0100764 if( status != PSA_SUCCESS )
765 return( status );
766 if( slot->type == PSA_KEY_TYPE_NONE )
767 return( PSA_ERROR_EMPTY_SLOT );
768
769 /* Enforce that usage policy for the key slot contains all the flags
770 * required by the usage parameter. There is one exception: public
771 * keys can always be exported, so we treat public key objects as
772 * if they had the export flag. */
773 if( PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->type ) )
774 usage &= ~PSA_KEY_USAGE_EXPORT;
775 if( ( slot->policy.usage & usage ) != usage )
776 return( PSA_ERROR_NOT_PERMITTED );
777 if( alg != 0 && ( alg != slot->policy.alg ) )
778 return( PSA_ERROR_NOT_PERMITTED );
779
780 *p_slot = slot;
781 return( PSA_SUCCESS );
782}
Darryl Green940d72c2018-07-13 13:18:51 +0100783
Gilles Peskinef77ed1f2018-12-03 11:58:46 +0100784/** Wipe key data from a slot. Preserve metadata such as the policy. */
Gilles Peskine2f060a82018-12-04 17:12:32 +0100785static psa_status_t psa_remove_key_data_from_memory( psa_key_slot_t *slot )
Darryl Green40225ba2018-11-15 14:48:15 +0000786{
787 if( slot->type == PSA_KEY_TYPE_NONE )
788 {
789 /* No key material to clean. */
790 }
791 else if( key_type_is_raw_bytes( slot->type ) )
792 {
793 mbedtls_free( slot->data.raw.data );
794 }
795 else
796#if defined(MBEDTLS_RSA_C)
797 if( PSA_KEY_TYPE_IS_RSA( slot->type ) )
798 {
799 mbedtls_rsa_free( slot->data.rsa );
800 mbedtls_free( slot->data.rsa );
801 }
802 else
803#endif /* defined(MBEDTLS_RSA_C) */
804#if defined(MBEDTLS_ECP_C)
805 if( PSA_KEY_TYPE_IS_ECC( slot->type ) )
806 {
807 mbedtls_ecp_keypair_free( slot->data.ecp );
808 mbedtls_free( slot->data.ecp );
809 }
810 else
811#endif /* defined(MBEDTLS_ECP_C) */
812 {
813 /* Shouldn't happen: the key type is not any type that we
814 * put in. */
815 return( PSA_ERROR_TAMPERING_DETECTED );
816 }
817
818 return( PSA_SUCCESS );
819}
820
Gilles Peskinef77ed1f2018-12-03 11:58:46 +0100821/** Completely wipe a slot in memory, including its policy.
822 * Persistent storage is not affected. */
Gilles Peskine66fb1262018-12-10 16:29:04 +0100823psa_status_t psa_wipe_key_slot( psa_key_slot_t *slot )
Gilles Peskinef77ed1f2018-12-03 11:58:46 +0100824{
825 psa_status_t status = psa_remove_key_data_from_memory( slot );
826 /* At this point, key material and other type-specific content has
827 * been wiped. Clear remaining metadata. We can call memset and not
828 * zeroize because the metadata is not particularly sensitive. */
829 memset( slot, 0, sizeof( *slot ) );
830 return( status );
831}
832
Gilles Peskinec5487a82018-12-03 18:08:14 +0100833psa_status_t psa_import_key( psa_key_handle_t handle,
Darryl Green940d72c2018-07-13 13:18:51 +0100834 psa_key_type_t type,
835 const uint8_t *data,
836 size_t data_length )
837{
Gilles Peskine2f060a82018-12-04 17:12:32 +0100838 psa_key_slot_t *slot;
Darryl Green940d72c2018-07-13 13:18:51 +0100839 psa_status_t status;
840
Gilles Peskinec5487a82018-12-03 18:08:14 +0100841 status = psa_get_empty_key_slot( handle, &slot );
Darryl Green940d72c2018-07-13 13:18:51 +0100842 if( status != PSA_SUCCESS )
843 return( status );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100844
845 slot->type = type;
Darryl Green940d72c2018-07-13 13:18:51 +0100846
847 status = psa_import_key_into_slot( slot, data, data_length );
848 if( status != PSA_SUCCESS )
849 {
850 slot->type = PSA_KEY_TYPE_NONE;
851 return( status );
852 }
853
Darryl Greend49a4992018-06-18 17:27:26 +0100854#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
855 if( slot->lifetime == PSA_KEY_LIFETIME_PERSISTENT )
856 {
857 /* Store in file location */
Gilles Peskine69f976b2018-11-30 18:46:56 +0100858 status = psa_save_persistent_key( slot->persistent_storage_id,
859 slot->type, &slot->policy, data,
Darryl Greend49a4992018-06-18 17:27:26 +0100860 data_length );
861 if( status != PSA_SUCCESS )
862 {
863 (void) psa_remove_key_data_from_memory( slot );
864 slot->type = PSA_KEY_TYPE_NONE;
865 }
866 }
867#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
868
869 return( status );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100870}
871
Gilles Peskinec5487a82018-12-03 18:08:14 +0100872psa_status_t psa_destroy_key( psa_key_handle_t handle )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100873{
Gilles Peskine2f060a82018-12-04 17:12:32 +0100874 psa_key_slot_t *slot;
Darryl Greend49a4992018-06-18 17:27:26 +0100875 psa_status_t status = PSA_SUCCESS;
876 psa_status_t storage_status = PSA_SUCCESS;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100877
Gilles Peskinec5487a82018-12-03 18:08:14 +0100878 status = psa_get_key_slot( handle, &slot );
Gilles Peskineb0b255c2018-07-06 17:01:38 +0200879 if( status != PSA_SUCCESS )
880 return( status );
Darryl Greend49a4992018-06-18 17:27:26 +0100881#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
882 if( slot->lifetime == PSA_KEY_LIFETIME_PERSISTENT )
883 {
Gilles Peskine69f976b2018-11-30 18:46:56 +0100884 storage_status =
885 psa_destroy_persistent_key( slot->persistent_storage_id );
Darryl Greend49a4992018-06-18 17:27:26 +0100886 }
887#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
Gilles Peskinef77ed1f2018-12-03 11:58:46 +0100888 status = psa_wipe_key_slot( slot );
Darryl Greend49a4992018-06-18 17:27:26 +0100889 if( status != PSA_SUCCESS )
890 return( status );
891 return( storage_status );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100892}
893
Gilles Peskineb870b182018-07-06 16:02:09 +0200894/* Return the size of the key in the given slot, in bits. */
Gilles Peskine2f060a82018-12-04 17:12:32 +0100895static size_t psa_get_key_bits( const psa_key_slot_t *slot )
Gilles Peskineb870b182018-07-06 16:02:09 +0200896{
897 if( key_type_is_raw_bytes( slot->type ) )
898 return( slot->data.raw.bytes * 8 );
899#if defined(MBEDTLS_RSA_C)
Gilles Peskined8008d62018-06-29 19:51:51 +0200900 if( PSA_KEY_TYPE_IS_RSA( slot->type ) )
Gilles Peskineaac64a22018-11-12 18:37:42 +0100901 return( PSA_BYTES_TO_BITS( mbedtls_rsa_get_len( slot->data.rsa ) ) );
Gilles Peskineb870b182018-07-06 16:02:09 +0200902#endif /* defined(MBEDTLS_RSA_C) */
903#if defined(MBEDTLS_ECP_C)
904 if( PSA_KEY_TYPE_IS_ECC( slot->type ) )
905 return( slot->data.ecp->grp.pbits );
906#endif /* defined(MBEDTLS_ECP_C) */
907 /* Shouldn't happen except on an empty slot. */
908 return( 0 );
909}
910
Gilles Peskinec5487a82018-12-03 18:08:14 +0100911psa_status_t psa_get_key_information( psa_key_handle_t handle,
Gilles Peskine2d277862018-06-18 15:41:12 +0200912 psa_key_type_t *type,
913 size_t *bits )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100914{
Gilles Peskine2f060a82018-12-04 17:12:32 +0100915 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +0200916 psa_status_t status;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100917
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100918 if( type != NULL )
Gilles Peskineb0b255c2018-07-06 17:01:38 +0200919 *type = 0;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100920 if( bits != NULL )
921 *bits = 0;
Gilles Peskinec5487a82018-12-03 18:08:14 +0100922 status = psa_get_key_slot( handle, &slot );
Gilles Peskineb0b255c2018-07-06 17:01:38 +0200923 if( status != PSA_SUCCESS )
924 return( status );
Gilles Peskineb870b182018-07-06 16:02:09 +0200925
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100926 if( slot->type == PSA_KEY_TYPE_NONE )
927 return( PSA_ERROR_EMPTY_SLOT );
Gilles Peskineb0b255c2018-07-06 17:01:38 +0200928 if( type != NULL )
929 *type = slot->type;
Gilles Peskineb870b182018-07-06 16:02:09 +0200930 if( bits != NULL )
931 *bits = psa_get_key_bits( slot );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100932 return( PSA_SUCCESS );
933}
934
Jaeden Amero0ae445f2019-01-10 11:42:27 +0000935#if defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECP_C)
Jaeden Amero6b196002019-01-10 10:23:21 +0000936static int pk_write_pubkey_simple( mbedtls_pk_context *key,
937 unsigned char *buf, size_t size )
938{
939 int ret;
940 unsigned char *c;
941 size_t len = 0;
942
943 c = buf + size;
944
945 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_pk_write_pubkey( &c, buf, key ) );
946
947 return( (int) len );
948}
Jaeden Amero0ae445f2019-01-10 11:42:27 +0000949#endif /* defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECP_C) */
Jaeden Amero6b196002019-01-10 10:23:21 +0000950
Gilles Peskine2f060a82018-12-04 17:12:32 +0100951static psa_status_t psa_internal_export_key( psa_key_slot_t *slot,
Gilles Peskine2d277862018-06-18 15:41:12 +0200952 uint8_t *data,
953 size_t data_size,
954 size_t *data_length,
955 int export_public_key )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100956{
Jaeden Amerof24c7f82018-06-27 17:20:43 +0100957 *data_length = 0;
958
Gilles Peskinec1bb6c82018-06-18 16:04:39 +0200959 if( export_public_key && ! PSA_KEY_TYPE_IS_ASYMMETRIC( slot->type ) )
Moran Pekera998bc62018-04-16 18:16:20 +0300960 return( PSA_ERROR_INVALID_ARGUMENT );
mohammad160306e79202018-03-28 13:17:44 +0300961
Gilles Peskine48c0ea12018-06-21 14:15:31 +0200962 if( key_type_is_raw_bytes( slot->type ) )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100963 {
964 if( slot->data.raw.bytes > data_size )
965 return( PSA_ERROR_BUFFER_TOO_SMALL );
Gilles Peskine52b90182018-10-29 19:26:27 +0100966 if( data_size != 0 )
967 {
Gilles Peskine46f1fd72018-06-28 19:31:31 +0200968 memcpy( data, slot->data.raw.data, slot->data.raw.bytes );
Gilles Peskine52b90182018-10-29 19:26:27 +0100969 memset( data + slot->data.raw.bytes, 0,
970 data_size - slot->data.raw.bytes );
971 }
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100972 *data_length = slot->data.raw.bytes;
973 return( PSA_SUCCESS );
974 }
Gilles Peskine188c71e2018-10-29 19:26:02 +0100975#if defined(MBEDTLS_ECP_C)
976 if( PSA_KEY_TYPE_IS_ECC_KEYPAIR( slot->type ) && !export_public_key )
977 {
Darryl Greendd8fb772018-11-07 16:00:44 +0000978 psa_status_t status;
979
Gilles Peskine188c71e2018-10-29 19:26:02 +0100980 size_t bytes = PSA_BITS_TO_BYTES( psa_get_key_bits( slot ) );
981 if( bytes > data_size )
982 return( PSA_ERROR_BUFFER_TOO_SMALL );
983 status = mbedtls_to_psa_error(
984 mbedtls_mpi_write_binary( &slot->data.ecp->d, data, bytes ) );
985 if( status != PSA_SUCCESS )
986 return( status );
987 memset( data + bytes, 0, data_size - bytes );
988 *data_length = bytes;
989 return( PSA_SUCCESS );
990 }
991#endif
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100992 else
Moran Peker17e36e12018-05-02 12:55:20 +0300993 {
Gilles Peskine969ac722018-01-28 18:16:59 +0100994#if defined(MBEDTLS_PK_WRITE_C)
Gilles Peskined8008d62018-06-29 19:51:51 +0200995 if( PSA_KEY_TYPE_IS_RSA( slot->type ) ||
Moran Pekera998bc62018-04-16 18:16:20 +0300996 PSA_KEY_TYPE_IS_ECC( slot->type ) )
Gilles Peskine969ac722018-01-28 18:16:59 +0100997 {
Moran Pekera998bc62018-04-16 18:16:20 +0300998 mbedtls_pk_context pk;
999 int ret;
Gilles Peskined8008d62018-06-29 19:51:51 +02001000 if( PSA_KEY_TYPE_IS_RSA( slot->type ) )
Moran Pekera998bc62018-04-16 18:16:20 +03001001 {
Darryl Green9e2d7a02018-07-24 16:33:30 +01001002#if defined(MBEDTLS_RSA_C)
1003 mbedtls_pk_init( &pk );
Moran Pekera998bc62018-04-16 18:16:20 +03001004 pk.pk_info = &mbedtls_rsa_info;
1005 pk.pk_ctx = slot->data.rsa;
Darryl Green9e2d7a02018-07-24 16:33:30 +01001006#else
1007 return( PSA_ERROR_NOT_SUPPORTED );
1008#endif
Moran Pekera998bc62018-04-16 18:16:20 +03001009 }
1010 else
1011 {
Darryl Green9e2d7a02018-07-24 16:33:30 +01001012#if defined(MBEDTLS_ECP_C)
1013 mbedtls_pk_init( &pk );
Moran Pekera998bc62018-04-16 18:16:20 +03001014 pk.pk_info = &mbedtls_eckey_info;
1015 pk.pk_ctx = slot->data.ecp;
Darryl Green9e2d7a02018-07-24 16:33:30 +01001016#else
1017 return( PSA_ERROR_NOT_SUPPORTED );
1018#endif
Moran Pekera998bc62018-04-16 18:16:20 +03001019 }
Moran Pekerd7326592018-05-29 16:56:39 +03001020 if( export_public_key || PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->type ) )
Jaeden Amero6b196002019-01-10 10:23:21 +00001021 {
Jaeden Amero0ae445f2019-01-10 11:42:27 +00001022 ret = pk_write_pubkey_simple( &pk, data, data_size );
Jaeden Amero6b196002019-01-10 10:23:21 +00001023 }
Moran Peker17e36e12018-05-02 12:55:20 +03001024 else
Jaeden Amero6b196002019-01-10 10:23:21 +00001025 {
Moran Peker17e36e12018-05-02 12:55:20 +03001026 ret = mbedtls_pk_write_key_der( &pk, data, data_size );
Jaeden Amero6b196002019-01-10 10:23:21 +00001027 }
Moran Peker60364322018-04-29 11:34:58 +03001028 if( ret < 0 )
Gilles Peskinee66ca3b2018-06-20 00:11:45 +02001029 {
Gilles Peskine46f1fd72018-06-28 19:31:31 +02001030 /* If data_size is 0 then data may be NULL and then the
1031 * call to memset would have undefined behavior. */
1032 if( data_size != 0 )
1033 memset( data, 0, data_size );
Moran Pekera998bc62018-04-16 18:16:20 +03001034 return( mbedtls_to_psa_error( ret ) );
Gilles Peskinee66ca3b2018-06-20 00:11:45 +02001035 }
Gilles Peskine0e231582018-06-20 00:11:07 +02001036 /* The mbedtls_pk_xxx functions write to the end of the buffer.
1037 * Move the data to the beginning and erase remaining data
1038 * at the original location. */
1039 if( 2 * (size_t) ret <= data_size )
1040 {
1041 memcpy( data, data + data_size - ret, ret );
Gilles Peskinee66ca3b2018-06-20 00:11:45 +02001042 memset( data + data_size - ret, 0, ret );
Gilles Peskine0e231582018-06-20 00:11:07 +02001043 }
1044 else if( (size_t) ret < data_size )
1045 {
1046 memmove( data, data + data_size - ret, ret );
Gilles Peskinee66ca3b2018-06-20 00:11:45 +02001047 memset( data + ret, 0, data_size - ret );
Gilles Peskine0e231582018-06-20 00:11:07 +02001048 }
Moran Pekera998bc62018-04-16 18:16:20 +03001049 *data_length = ret;
1050 return( PSA_SUCCESS );
Gilles Peskine969ac722018-01-28 18:16:59 +01001051 }
1052 else
Gilles Peskine6d912132018-03-07 16:41:37 +01001053#endif /* defined(MBEDTLS_PK_WRITE_C) */
Moran Pekera998bc62018-04-16 18:16:20 +03001054 {
1055 /* This shouldn't happen in the reference implementation, but
Gilles Peskine785fd552018-06-04 15:08:56 +02001056 it is valid for a special-purpose implementation to omit
1057 support for exporting certain key types. */
Moran Pekera998bc62018-04-16 18:16:20 +03001058 return( PSA_ERROR_NOT_SUPPORTED );
1059 }
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001060 }
1061}
1062
Gilles Peskinec5487a82018-12-03 18:08:14 +01001063psa_status_t psa_export_key( psa_key_handle_t handle,
Gilles Peskine2d277862018-06-18 15:41:12 +02001064 uint8_t *data,
1065 size_t data_size,
1066 size_t *data_length )
Moran Pekera998bc62018-04-16 18:16:20 +03001067{
Gilles Peskine2f060a82018-12-04 17:12:32 +01001068 psa_key_slot_t *slot;
Darryl Greendd8fb772018-11-07 16:00:44 +00001069 psa_status_t status;
1070
1071 /* Set the key to empty now, so that even when there are errors, we always
1072 * set data_length to a value between 0 and data_size. On error, setting
1073 * the key to empty is a good choice because an empty key representation is
1074 * unlikely to be accepted anywhere. */
1075 *data_length = 0;
1076
1077 /* Export requires the EXPORT flag. There is an exception for public keys,
1078 * which don't require any flag, but psa_get_key_from_slot takes
1079 * care of this. */
Gilles Peskinec5487a82018-12-03 18:08:14 +01001080 status = psa_get_key_from_slot( handle, &slot, PSA_KEY_USAGE_EXPORT, 0 );
Darryl Greendd8fb772018-11-07 16:00:44 +00001081 if( status != PSA_SUCCESS )
1082 return( status );
1083 return( psa_internal_export_key( slot, data, data_size,
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001084 data_length, 0 ) );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001085}
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001086
Gilles Peskinec5487a82018-12-03 18:08:14 +01001087psa_status_t psa_export_public_key( psa_key_handle_t handle,
Gilles Peskine2d277862018-06-18 15:41:12 +02001088 uint8_t *data,
1089 size_t data_size,
1090 size_t *data_length )
Moran Pekerdd4ea382018-04-03 15:30:03 +03001091{
Gilles Peskine2f060a82018-12-04 17:12:32 +01001092 psa_key_slot_t *slot;
Darryl Greendd8fb772018-11-07 16:00:44 +00001093 psa_status_t status;
1094
1095 /* Set the key to empty now, so that even when there are errors, we always
1096 * set data_length to a value between 0 and data_size. On error, setting
1097 * the key to empty is a good choice because an empty key representation is
1098 * unlikely to be accepted anywhere. */
1099 *data_length = 0;
1100
1101 /* Exporting a public key doesn't require a usage flag. */
Gilles Peskinec5487a82018-12-03 18:08:14 +01001102 status = psa_get_key_from_slot( handle, &slot, 0, 0 );
Darryl Greendd8fb772018-11-07 16:00:44 +00001103 if( status != PSA_SUCCESS )
1104 return( status );
1105 return( psa_internal_export_key( slot, data, data_size,
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001106 data_length, 1 ) );
Moran Pekerdd4ea382018-04-03 15:30:03 +03001107}
1108
Darryl Green0c6575a2018-11-07 16:05:30 +00001109#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Gilles Peskine2f060a82018-12-04 17:12:32 +01001110static psa_status_t psa_save_generated_persistent_key( psa_key_slot_t *slot,
Darryl Green0c6575a2018-11-07 16:05:30 +00001111 size_t bits )
1112{
1113 psa_status_t status;
1114 uint8_t *data;
1115 size_t key_length;
1116 size_t data_size = PSA_KEY_EXPORT_MAX_SIZE( slot->type, bits );
1117 data = mbedtls_calloc( 1, data_size );
itayzafrir910c76b2018-11-21 16:03:21 +02001118 if( data == NULL )
1119 return( PSA_ERROR_INSUFFICIENT_MEMORY );
Darryl Green0c6575a2018-11-07 16:05:30 +00001120 /* Get key data in export format */
1121 status = psa_internal_export_key( slot, data, data_size, &key_length, 0 );
1122 if( status != PSA_SUCCESS )
1123 {
1124 slot->type = PSA_KEY_TYPE_NONE;
1125 goto exit;
1126 }
1127 /* Store in file location */
Gilles Peskine69f976b2018-11-30 18:46:56 +01001128 status = psa_save_persistent_key( slot->persistent_storage_id,
1129 slot->type, &slot->policy,
Darryl Green0c6575a2018-11-07 16:05:30 +00001130 data, key_length );
1131 if( status != PSA_SUCCESS )
1132 {
1133 slot->type = PSA_KEY_TYPE_NONE;
1134 }
1135exit:
Gilles Peskine3f108122018-12-07 18:14:53 +01001136 mbedtls_platform_zeroize( data, key_length );
Darryl Green0c6575a2018-11-07 16:05:30 +00001137 mbedtls_free( data );
1138 return( status );
1139}
1140#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
1141
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02001142
1143
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001144/****************************************************************/
Gilles Peskine20035e32018-02-03 22:44:14 +01001145/* Message digests */
1146/****************************************************************/
1147
Gilles Peskinedc2fc842018-03-07 16:42:59 +01001148static const mbedtls_md_info_t *mbedtls_md_info_from_psa( psa_algorithm_t alg )
Gilles Peskine20035e32018-02-03 22:44:14 +01001149{
1150 switch( alg )
1151 {
1152#if defined(MBEDTLS_MD2_C)
1153 case PSA_ALG_MD2:
1154 return( &mbedtls_md2_info );
1155#endif
1156#if defined(MBEDTLS_MD4_C)
1157 case PSA_ALG_MD4:
1158 return( &mbedtls_md4_info );
1159#endif
1160#if defined(MBEDTLS_MD5_C)
1161 case PSA_ALG_MD5:
1162 return( &mbedtls_md5_info );
1163#endif
1164#if defined(MBEDTLS_RIPEMD160_C)
1165 case PSA_ALG_RIPEMD160:
1166 return( &mbedtls_ripemd160_info );
1167#endif
1168#if defined(MBEDTLS_SHA1_C)
1169 case PSA_ALG_SHA_1:
1170 return( &mbedtls_sha1_info );
1171#endif
1172#if defined(MBEDTLS_SHA256_C)
1173 case PSA_ALG_SHA_224:
1174 return( &mbedtls_sha224_info );
1175 case PSA_ALG_SHA_256:
1176 return( &mbedtls_sha256_info );
1177#endif
1178#if defined(MBEDTLS_SHA512_C)
1179 case PSA_ALG_SHA_384:
1180 return( &mbedtls_sha384_info );
1181 case PSA_ALG_SHA_512:
1182 return( &mbedtls_sha512_info );
1183#endif
1184 default:
1185 return( NULL );
1186 }
1187}
1188
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001189psa_status_t psa_hash_abort( psa_hash_operation_t *operation )
1190{
1191 switch( operation->alg )
1192 {
Gilles Peskine81736312018-06-26 15:04:31 +02001193 case 0:
1194 /* The object has (apparently) been initialized but it is not
1195 * in use. It's ok to call abort on such an object, and there's
1196 * nothing to do. */
1197 break;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001198#if defined(MBEDTLS_MD2_C)
1199 case PSA_ALG_MD2:
1200 mbedtls_md2_free( &operation->ctx.md2 );
1201 break;
1202#endif
1203#if defined(MBEDTLS_MD4_C)
1204 case PSA_ALG_MD4:
1205 mbedtls_md4_free( &operation->ctx.md4 );
1206 break;
1207#endif
1208#if defined(MBEDTLS_MD5_C)
1209 case PSA_ALG_MD5:
1210 mbedtls_md5_free( &operation->ctx.md5 );
1211 break;
1212#endif
1213#if defined(MBEDTLS_RIPEMD160_C)
1214 case PSA_ALG_RIPEMD160:
1215 mbedtls_ripemd160_free( &operation->ctx.ripemd160 );
1216 break;
1217#endif
1218#if defined(MBEDTLS_SHA1_C)
1219 case PSA_ALG_SHA_1:
1220 mbedtls_sha1_free( &operation->ctx.sha1 );
1221 break;
1222#endif
1223#if defined(MBEDTLS_SHA256_C)
1224 case PSA_ALG_SHA_224:
1225 case PSA_ALG_SHA_256:
1226 mbedtls_sha256_free( &operation->ctx.sha256 );
1227 break;
1228#endif
1229#if defined(MBEDTLS_SHA512_C)
1230 case PSA_ALG_SHA_384:
1231 case PSA_ALG_SHA_512:
1232 mbedtls_sha512_free( &operation->ctx.sha512 );
1233 break;
1234#endif
1235 default:
Gilles Peskinef9c2c092018-06-21 16:57:07 +02001236 return( PSA_ERROR_BAD_STATE );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001237 }
1238 operation->alg = 0;
1239 return( PSA_SUCCESS );
1240}
1241
Gilles Peskineda8191d1c2018-07-08 19:46:38 +02001242psa_status_t psa_hash_setup( psa_hash_operation_t *operation,
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001243 psa_algorithm_t alg )
1244{
1245 int ret;
1246 operation->alg = 0;
1247 switch( alg )
1248 {
1249#if defined(MBEDTLS_MD2_C)
1250 case PSA_ALG_MD2:
1251 mbedtls_md2_init( &operation->ctx.md2 );
1252 ret = mbedtls_md2_starts_ret( &operation->ctx.md2 );
1253 break;
1254#endif
1255#if defined(MBEDTLS_MD4_C)
1256 case PSA_ALG_MD4:
1257 mbedtls_md4_init( &operation->ctx.md4 );
1258 ret = mbedtls_md4_starts_ret( &operation->ctx.md4 );
1259 break;
1260#endif
1261#if defined(MBEDTLS_MD5_C)
1262 case PSA_ALG_MD5:
1263 mbedtls_md5_init( &operation->ctx.md5 );
1264 ret = mbedtls_md5_starts_ret( &operation->ctx.md5 );
1265 break;
1266#endif
1267#if defined(MBEDTLS_RIPEMD160_C)
1268 case PSA_ALG_RIPEMD160:
1269 mbedtls_ripemd160_init( &operation->ctx.ripemd160 );
1270 ret = mbedtls_ripemd160_starts_ret( &operation->ctx.ripemd160 );
1271 break;
1272#endif
1273#if defined(MBEDTLS_SHA1_C)
1274 case PSA_ALG_SHA_1:
1275 mbedtls_sha1_init( &operation->ctx.sha1 );
1276 ret = mbedtls_sha1_starts_ret( &operation->ctx.sha1 );
1277 break;
1278#endif
1279#if defined(MBEDTLS_SHA256_C)
1280 case PSA_ALG_SHA_224:
1281 mbedtls_sha256_init( &operation->ctx.sha256 );
1282 ret = mbedtls_sha256_starts_ret( &operation->ctx.sha256, 1 );
1283 break;
1284 case PSA_ALG_SHA_256:
1285 mbedtls_sha256_init( &operation->ctx.sha256 );
1286 ret = mbedtls_sha256_starts_ret( &operation->ctx.sha256, 0 );
1287 break;
1288#endif
1289#if defined(MBEDTLS_SHA512_C)
1290 case PSA_ALG_SHA_384:
1291 mbedtls_sha512_init( &operation->ctx.sha512 );
1292 ret = mbedtls_sha512_starts_ret( &operation->ctx.sha512, 1 );
1293 break;
1294 case PSA_ALG_SHA_512:
1295 mbedtls_sha512_init( &operation->ctx.sha512 );
1296 ret = mbedtls_sha512_starts_ret( &operation->ctx.sha512, 0 );
1297 break;
1298#endif
1299 default:
Gilles Peskinec06e0712018-06-20 16:21:04 +02001300 return( PSA_ALG_IS_HASH( alg ) ?
1301 PSA_ERROR_NOT_SUPPORTED :
1302 PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001303 }
1304 if( ret == 0 )
1305 operation->alg = alg;
1306 else
1307 psa_hash_abort( operation );
1308 return( mbedtls_to_psa_error( ret ) );
1309}
1310
1311psa_status_t psa_hash_update( psa_hash_operation_t *operation,
1312 const uint8_t *input,
1313 size_t input_length )
1314{
1315 int ret;
Gilles Peskine94e44542018-07-12 16:58:43 +02001316
1317 /* Don't require hash implementations to behave correctly on a
1318 * zero-length input, which may have an invalid pointer. */
1319 if( input_length == 0 )
1320 return( PSA_SUCCESS );
1321
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001322 switch( operation->alg )
1323 {
1324#if defined(MBEDTLS_MD2_C)
1325 case PSA_ALG_MD2:
1326 ret = mbedtls_md2_update_ret( &operation->ctx.md2,
1327 input, input_length );
1328 break;
1329#endif
1330#if defined(MBEDTLS_MD4_C)
1331 case PSA_ALG_MD4:
1332 ret = mbedtls_md4_update_ret( &operation->ctx.md4,
1333 input, input_length );
1334 break;
1335#endif
1336#if defined(MBEDTLS_MD5_C)
1337 case PSA_ALG_MD5:
1338 ret = mbedtls_md5_update_ret( &operation->ctx.md5,
1339 input, input_length );
1340 break;
1341#endif
1342#if defined(MBEDTLS_RIPEMD160_C)
1343 case PSA_ALG_RIPEMD160:
1344 ret = mbedtls_ripemd160_update_ret( &operation->ctx.ripemd160,
1345 input, input_length );
1346 break;
1347#endif
1348#if defined(MBEDTLS_SHA1_C)
1349 case PSA_ALG_SHA_1:
1350 ret = mbedtls_sha1_update_ret( &operation->ctx.sha1,
1351 input, input_length );
1352 break;
1353#endif
1354#if defined(MBEDTLS_SHA256_C)
1355 case PSA_ALG_SHA_224:
1356 case PSA_ALG_SHA_256:
1357 ret = mbedtls_sha256_update_ret( &operation->ctx.sha256,
1358 input, input_length );
1359 break;
1360#endif
1361#if defined(MBEDTLS_SHA512_C)
1362 case PSA_ALG_SHA_384:
1363 case PSA_ALG_SHA_512:
1364 ret = mbedtls_sha512_update_ret( &operation->ctx.sha512,
1365 input, input_length );
1366 break;
1367#endif
1368 default:
1369 ret = MBEDTLS_ERR_MD_BAD_INPUT_DATA;
1370 break;
1371 }
Gilles Peskine94e44542018-07-12 16:58:43 +02001372
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001373 if( ret != 0 )
1374 psa_hash_abort( operation );
1375 return( mbedtls_to_psa_error( ret ) );
1376}
1377
1378psa_status_t psa_hash_finish( psa_hash_operation_t *operation,
1379 uint8_t *hash,
1380 size_t hash_size,
1381 size_t *hash_length )
1382{
itayzafrir40835d42018-08-02 13:14:17 +03001383 psa_status_t status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001384 int ret;
Gilles Peskine71bb7b72018-04-19 08:29:59 +02001385 size_t actual_hash_length = PSA_HASH_SIZE( operation->alg );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001386
1387 /* Fill the output buffer with something that isn't a valid hash
1388 * (barring an attack on the hash and deliberately-crafted input),
1389 * in case the caller doesn't check the return status properly. */
Gilles Peskineaee13332018-07-02 12:15:28 +02001390 *hash_length = hash_size;
Gilles Peskine46f1fd72018-06-28 19:31:31 +02001391 /* If hash_size is 0 then hash may be NULL and then the
1392 * call to memset would have undefined behavior. */
1393 if( hash_size != 0 )
1394 memset( hash, '!', hash_size );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001395
1396 if( hash_size < actual_hash_length )
itayzafrir40835d42018-08-02 13:14:17 +03001397 {
1398 status = PSA_ERROR_BUFFER_TOO_SMALL;
1399 goto exit;
1400 }
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001401
1402 switch( operation->alg )
1403 {
1404#if defined(MBEDTLS_MD2_C)
1405 case PSA_ALG_MD2:
1406 ret = mbedtls_md2_finish_ret( &operation->ctx.md2, hash );
1407 break;
1408#endif
1409#if defined(MBEDTLS_MD4_C)
1410 case PSA_ALG_MD4:
1411 ret = mbedtls_md4_finish_ret( &operation->ctx.md4, hash );
1412 break;
1413#endif
1414#if defined(MBEDTLS_MD5_C)
1415 case PSA_ALG_MD5:
1416 ret = mbedtls_md5_finish_ret( &operation->ctx.md5, hash );
1417 break;
1418#endif
1419#if defined(MBEDTLS_RIPEMD160_C)
1420 case PSA_ALG_RIPEMD160:
1421 ret = mbedtls_ripemd160_finish_ret( &operation->ctx.ripemd160, hash );
1422 break;
1423#endif
1424#if defined(MBEDTLS_SHA1_C)
1425 case PSA_ALG_SHA_1:
1426 ret = mbedtls_sha1_finish_ret( &operation->ctx.sha1, hash );
1427 break;
1428#endif
1429#if defined(MBEDTLS_SHA256_C)
1430 case PSA_ALG_SHA_224:
1431 case PSA_ALG_SHA_256:
1432 ret = mbedtls_sha256_finish_ret( &operation->ctx.sha256, hash );
1433 break;
1434#endif
1435#if defined(MBEDTLS_SHA512_C)
1436 case PSA_ALG_SHA_384:
1437 case PSA_ALG_SHA_512:
1438 ret = mbedtls_sha512_finish_ret( &operation->ctx.sha512, hash );
1439 break;
1440#endif
1441 default:
1442 ret = MBEDTLS_ERR_MD_BAD_INPUT_DATA;
1443 break;
1444 }
itayzafrir40835d42018-08-02 13:14:17 +03001445 status = mbedtls_to_psa_error( ret );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001446
itayzafrir40835d42018-08-02 13:14:17 +03001447exit:
1448 if( status == PSA_SUCCESS )
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001449 {
Gilles Peskineaee13332018-07-02 12:15:28 +02001450 *hash_length = actual_hash_length;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001451 return( psa_hash_abort( operation ) );
1452 }
1453 else
1454 {
1455 psa_hash_abort( operation );
itayzafrir40835d42018-08-02 13:14:17 +03001456 return( status );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001457 }
1458}
1459
Gilles Peskine2d277862018-06-18 15:41:12 +02001460psa_status_t psa_hash_verify( psa_hash_operation_t *operation,
1461 const uint8_t *hash,
1462 size_t hash_length )
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001463{
1464 uint8_t actual_hash[MBEDTLS_MD_MAX_SIZE];
1465 size_t actual_hash_length;
1466 psa_status_t status = psa_hash_finish( operation,
1467 actual_hash, sizeof( actual_hash ),
1468 &actual_hash_length );
1469 if( status != PSA_SUCCESS )
1470 return( status );
1471 if( actual_hash_length != hash_length )
1472 return( PSA_ERROR_INVALID_SIGNATURE );
1473 if( safer_memcmp( hash, actual_hash, actual_hash_length ) != 0 )
1474 return( PSA_ERROR_INVALID_SIGNATURE );
1475 return( PSA_SUCCESS );
1476}
1477
1478
1479
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001480/****************************************************************/
Gilles Peskine8c9def32018-02-08 10:02:12 +01001481/* MAC */
1482/****************************************************************/
1483
Gilles Peskinedc2fc842018-03-07 16:42:59 +01001484static const mbedtls_cipher_info_t *mbedtls_cipher_info_from_psa(
Gilles Peskine8c9def32018-02-08 10:02:12 +01001485 psa_algorithm_t alg,
1486 psa_key_type_t key_type,
Gilles Peskine2d277862018-06-18 15:41:12 +02001487 size_t key_bits,
mohammad1603f4f0d612018-06-03 15:04:51 +03001488 mbedtls_cipher_id_t* cipher_id )
Gilles Peskine8c9def32018-02-08 10:02:12 +01001489{
Gilles Peskine8c9def32018-02-08 10:02:12 +01001490 mbedtls_cipher_mode_t mode;
mohammad1603f4f0d612018-06-03 15:04:51 +03001491 mbedtls_cipher_id_t cipher_id_tmp;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001492
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02001493 if( PSA_ALG_IS_AEAD( alg ) )
Gilles Peskine57fbdb12018-10-17 18:29:17 +02001494 alg = PSA_ALG_AEAD_WITH_TAG_LENGTH( alg, 0 );
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02001495
Gilles Peskine8c9def32018-02-08 10:02:12 +01001496 if( PSA_ALG_IS_CIPHER( alg ) || PSA_ALG_IS_AEAD( alg ) )
1497 {
Nir Sonnenscheine9664c32018-06-17 14:41:30 +03001498 switch( alg )
Gilles Peskine8c9def32018-02-08 10:02:12 +01001499 {
Gilles Peskinedaea26f2018-08-21 14:02:45 +02001500 case PSA_ALG_ARC4:
Gilles Peskine8c9def32018-02-08 10:02:12 +01001501 mode = MBEDTLS_MODE_STREAM;
1502 break;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001503 case PSA_ALG_CTR:
1504 mode = MBEDTLS_MODE_CTR;
1505 break;
Gilles Peskinedaea26f2018-08-21 14:02:45 +02001506 case PSA_ALG_CFB:
1507 mode = MBEDTLS_MODE_CFB;
1508 break;
1509 case PSA_ALG_OFB:
1510 mode = MBEDTLS_MODE_OFB;
1511 break;
1512 case PSA_ALG_CBC_NO_PADDING:
1513 mode = MBEDTLS_MODE_CBC;
1514 break;
1515 case PSA_ALG_CBC_PKCS7:
1516 mode = MBEDTLS_MODE_CBC;
1517 break;
Gilles Peskine57fbdb12018-10-17 18:29:17 +02001518 case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_CCM, 0 ):
Gilles Peskine8c9def32018-02-08 10:02:12 +01001519 mode = MBEDTLS_MODE_CCM;
1520 break;
Gilles Peskine57fbdb12018-10-17 18:29:17 +02001521 case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_GCM, 0 ):
Gilles Peskine8c9def32018-02-08 10:02:12 +01001522 mode = MBEDTLS_MODE_GCM;
1523 break;
1524 default:
1525 return( NULL );
1526 }
1527 }
1528 else if( alg == PSA_ALG_CMAC )
1529 mode = MBEDTLS_MODE_ECB;
1530 else if( alg == PSA_ALG_GMAC )
1531 mode = MBEDTLS_MODE_GCM;
1532 else
1533 return( NULL );
1534
1535 switch( key_type )
1536 {
1537 case PSA_KEY_TYPE_AES:
mohammad1603f4f0d612018-06-03 15:04:51 +03001538 cipher_id_tmp = MBEDTLS_CIPHER_ID_AES;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001539 break;
1540 case PSA_KEY_TYPE_DES:
Gilles Peskine9ad29e22018-06-21 09:40:04 +02001541 /* key_bits is 64 for Single-DES, 128 for two-key Triple-DES,
1542 * and 192 for three-key Triple-DES. */
Gilles Peskine8c9def32018-02-08 10:02:12 +01001543 if( key_bits == 64 )
mohammad1603f4f0d612018-06-03 15:04:51 +03001544 cipher_id_tmp = MBEDTLS_CIPHER_ID_DES;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001545 else
mohammad1603f4f0d612018-06-03 15:04:51 +03001546 cipher_id_tmp = MBEDTLS_CIPHER_ID_3DES;
Gilles Peskine9ad29e22018-06-21 09:40:04 +02001547 /* mbedtls doesn't recognize two-key Triple-DES as an algorithm,
1548 * but two-key Triple-DES is functionally three-key Triple-DES
1549 * with K1=K3, so that's how we present it to mbedtls. */
1550 if( key_bits == 128 )
1551 key_bits = 192;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001552 break;
1553 case PSA_KEY_TYPE_CAMELLIA:
mohammad1603f4f0d612018-06-03 15:04:51 +03001554 cipher_id_tmp = MBEDTLS_CIPHER_ID_CAMELLIA;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001555 break;
1556 case PSA_KEY_TYPE_ARC4:
mohammad1603f4f0d612018-06-03 15:04:51 +03001557 cipher_id_tmp = MBEDTLS_CIPHER_ID_ARC4;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001558 break;
1559 default:
1560 return( NULL );
1561 }
mohammad1603f4f0d612018-06-03 15:04:51 +03001562 if( cipher_id != NULL )
mohammad160360a64d02018-06-03 17:20:42 +03001563 *cipher_id = cipher_id_tmp;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001564
Jaeden Amero23bbb752018-06-26 14:16:54 +01001565 return( mbedtls_cipher_info_from_values( cipher_id_tmp,
1566 (int) key_bits, mode ) );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001567}
1568
Gilles Peskinea05219c2018-11-16 16:02:56 +01001569#if defined(MBEDTLS_MD_C)
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001570static size_t psa_get_hash_block_size( psa_algorithm_t alg )
Nir Sonnenschein96272412018-06-17 14:41:10 +03001571{
Gilles Peskine2d277862018-06-18 15:41:12 +02001572 switch( alg )
Nir Sonnenschein96272412018-06-17 14:41:10 +03001573 {
1574 case PSA_ALG_MD2:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001575 return( 16 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001576 case PSA_ALG_MD4:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001577 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001578 case PSA_ALG_MD5:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001579 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001580 case PSA_ALG_RIPEMD160:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001581 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001582 case PSA_ALG_SHA_1:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001583 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001584 case PSA_ALG_SHA_224:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001585 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001586 case PSA_ALG_SHA_256:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001587 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001588 case PSA_ALG_SHA_384:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001589 return( 128 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001590 case PSA_ALG_SHA_512:
Gilles Peskine2d277862018-06-18 15:41:12 +02001591 return( 128 );
1592 default:
1593 return( 0 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001594 }
1595}
Gilles Peskinea05219c2018-11-16 16:02:56 +01001596#endif /* MBEDTLS_MD_C */
Nir Sonnenschein0c9ec532018-06-07 13:27:47 +03001597
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02001598/* Initialize the MAC operation structure. Once this function has been
1599 * called, psa_mac_abort can run and will do the right thing. */
1600static psa_status_t psa_mac_init( psa_mac_operation_t *operation,
1601 psa_algorithm_t alg )
1602{
1603 psa_status_t status = PSA_ERROR_NOT_SUPPORTED;
1604
1605 operation->alg = alg;
1606 operation->key_set = 0;
1607 operation->iv_set = 0;
1608 operation->iv_required = 0;
1609 operation->has_input = 0;
Gilles Peskine89167cb2018-07-08 20:12:23 +02001610 operation->is_sign = 0;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02001611
1612#if defined(MBEDTLS_CMAC_C)
1613 if( alg == PSA_ALG_CMAC )
1614 {
1615 operation->iv_required = 0;
1616 mbedtls_cipher_init( &operation->ctx.cmac );
1617 status = PSA_SUCCESS;
1618 }
1619 else
1620#endif /* MBEDTLS_CMAC_C */
1621#if defined(MBEDTLS_MD_C)
1622 if( PSA_ALG_IS_HMAC( operation->alg ) )
1623 {
Gilles Peskineff94abd2018-07-12 17:07:52 +02001624 /* We'll set up the hash operation later in psa_hmac_setup_internal. */
1625 operation->ctx.hmac.hash_ctx.alg = 0;
1626 status = PSA_SUCCESS;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02001627 }
1628 else
1629#endif /* MBEDTLS_MD_C */
1630 {
Gilles Peskinec06e0712018-06-20 16:21:04 +02001631 if( ! PSA_ALG_IS_MAC( alg ) )
1632 status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02001633 }
1634
1635 if( status != PSA_SUCCESS )
1636 memset( operation, 0, sizeof( *operation ) );
1637 return( status );
1638}
1639
Gilles Peskine01126fa2018-07-12 17:04:55 +02001640#if defined(MBEDTLS_MD_C)
1641static psa_status_t psa_hmac_abort_internal( psa_hmac_internal_data *hmac )
1642{
Gilles Peskine3f108122018-12-07 18:14:53 +01001643 mbedtls_platform_zeroize( hmac->opad, sizeof( hmac->opad ) );
Gilles Peskine01126fa2018-07-12 17:04:55 +02001644 return( psa_hash_abort( &hmac->hash_ctx ) );
1645}
Hanno Beckerc8a41d72018-10-09 17:33:01 +01001646
1647static void psa_hmac_init_internal( psa_hmac_internal_data *hmac )
1648{
1649 /* Instances of psa_hash_operation_s can be initialized by zeroization. */
1650 memset( hmac, 0, sizeof( *hmac ) );
1651}
Gilles Peskine01126fa2018-07-12 17:04:55 +02001652#endif /* MBEDTLS_MD_C */
1653
Gilles Peskine8c9def32018-02-08 10:02:12 +01001654psa_status_t psa_mac_abort( psa_mac_operation_t *operation )
1655{
Gilles Peskinefbfac682018-07-08 20:51:54 +02001656 if( operation->alg == 0 )
Gilles Peskine8c9def32018-02-08 10:02:12 +01001657 {
Gilles Peskinefbfac682018-07-08 20:51:54 +02001658 /* The object has (apparently) been initialized but it is not
1659 * in use. It's ok to call abort on such an object, and there's
1660 * nothing to do. */
1661 return( PSA_SUCCESS );
1662 }
1663 else
Gilles Peskine8c9def32018-02-08 10:02:12 +01001664#if defined(MBEDTLS_CMAC_C)
Gilles Peskinefbfac682018-07-08 20:51:54 +02001665 if( operation->alg == PSA_ALG_CMAC )
1666 {
1667 mbedtls_cipher_free( &operation->ctx.cmac );
1668 }
1669 else
Gilles Peskine8c9def32018-02-08 10:02:12 +01001670#endif /* MBEDTLS_CMAC_C */
Gilles Peskine8c9def32018-02-08 10:02:12 +01001671#if defined(MBEDTLS_MD_C)
Gilles Peskinefbfac682018-07-08 20:51:54 +02001672 if( PSA_ALG_IS_HMAC( operation->alg ) )
1673 {
Gilles Peskine01126fa2018-07-12 17:04:55 +02001674 psa_hmac_abort_internal( &operation->ctx.hmac );
Gilles Peskinefbfac682018-07-08 20:51:54 +02001675 }
1676 else
Gilles Peskine8c9def32018-02-08 10:02:12 +01001677#endif /* MBEDTLS_MD_C */
Gilles Peskinefbfac682018-07-08 20:51:54 +02001678 {
1679 /* Sanity check (shouldn't happen: operation->alg should
1680 * always have been initialized to a valid value). */
1681 goto bad_state;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001682 }
Moran Peker41deec42018-04-04 15:43:05 +03001683
Gilles Peskine8c9def32018-02-08 10:02:12 +01001684 operation->alg = 0;
1685 operation->key_set = 0;
1686 operation->iv_set = 0;
1687 operation->iv_required = 0;
1688 operation->has_input = 0;
Gilles Peskine89167cb2018-07-08 20:12:23 +02001689 operation->is_sign = 0;
Moran Peker41deec42018-04-04 15:43:05 +03001690
Gilles Peskine8c9def32018-02-08 10:02:12 +01001691 return( PSA_SUCCESS );
Gilles Peskinefbfac682018-07-08 20:51:54 +02001692
1693bad_state:
1694 /* If abort is called on an uninitialized object, we can't trust
1695 * anything. Wipe the object in case it contains confidential data.
1696 * This may result in a memory leak if a pointer gets overwritten,
1697 * but it's too late to do anything about this. */
1698 memset( operation, 0, sizeof( *operation ) );
1699 return( PSA_ERROR_BAD_STATE );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001700}
1701
Gilles Peskinee3b07d82018-06-19 11:57:35 +02001702#if defined(MBEDTLS_CMAC_C)
Gilles Peskine89167cb2018-07-08 20:12:23 +02001703static int psa_cmac_setup( psa_mac_operation_t *operation,
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001704 size_t key_bits,
Gilles Peskine2f060a82018-12-04 17:12:32 +01001705 psa_key_slot_t *slot,
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001706 const mbedtls_cipher_info_t *cipher_info )
1707{
1708 int ret;
1709
1710 operation->mac_size = cipher_info->block_size;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001711
1712 ret = mbedtls_cipher_setup( &operation->ctx.cmac, cipher_info );
1713 if( ret != 0 )
1714 return( ret );
1715
1716 ret = mbedtls_cipher_cmac_starts( &operation->ctx.cmac,
1717 slot->data.raw.data,
1718 key_bits );
1719 return( ret );
1720}
Gilles Peskinee3b07d82018-06-19 11:57:35 +02001721#endif /* MBEDTLS_CMAC_C */
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001722
Gilles Peskine248051a2018-06-20 16:09:38 +02001723#if defined(MBEDTLS_MD_C)
Gilles Peskine01126fa2018-07-12 17:04:55 +02001724static psa_status_t psa_hmac_setup_internal( psa_hmac_internal_data *hmac,
1725 const uint8_t *key,
1726 size_t key_length,
1727 psa_algorithm_t hash_alg )
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001728{
Gilles Peskineb3e6e5d2018-06-18 22:16:43 +02001729 unsigned char ipad[PSA_HMAC_MAX_HASH_BLOCK_SIZE];
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001730 size_t i;
Gilles Peskine9aa369e2018-07-16 00:36:29 +02001731 size_t hash_size = PSA_HASH_SIZE( hash_alg );
Gilles Peskine01126fa2018-07-12 17:04:55 +02001732 size_t block_size = psa_get_hash_block_size( hash_alg );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001733 psa_status_t status;
1734
Gilles Peskine9aa369e2018-07-16 00:36:29 +02001735 /* Sanity checks on block_size, to guarantee that there won't be a buffer
1736 * overflow below. This should never trigger if the hash algorithm
1737 * is implemented correctly. */
1738 /* The size checks against the ipad and opad buffers cannot be written
1739 * `block_size > sizeof( ipad ) || block_size > sizeof( hmac->opad )`
1740 * because that triggers -Wlogical-op on GCC 7.3. */
1741 if( block_size > sizeof( ipad ) )
1742 return( PSA_ERROR_NOT_SUPPORTED );
1743 if( block_size > sizeof( hmac->opad ) )
1744 return( PSA_ERROR_NOT_SUPPORTED );
1745 if( block_size < hash_size )
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001746 return( PSA_ERROR_NOT_SUPPORTED );
1747
Gilles Peskined223b522018-06-11 18:12:58 +02001748 if( key_length > block_size )
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001749 {
Gilles Peskine1e6bfdf2018-07-17 16:22:47 +02001750 status = psa_hash_setup( &hmac->hash_ctx, hash_alg );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001751 if( status != PSA_SUCCESS )
Gilles Peskine1e6bfdf2018-07-17 16:22:47 +02001752 goto cleanup;
Gilles Peskine01126fa2018-07-12 17:04:55 +02001753 status = psa_hash_update( &hmac->hash_ctx, key, key_length );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001754 if( status != PSA_SUCCESS )
Gilles Peskineb8be2882018-07-17 16:24:34 +02001755 goto cleanup;
Gilles Peskine01126fa2018-07-12 17:04:55 +02001756 status = psa_hash_finish( &hmac->hash_ctx,
Gilles Peskined223b522018-06-11 18:12:58 +02001757 ipad, sizeof( ipad ), &key_length );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001758 if( status != PSA_SUCCESS )
Gilles Peskineb8be2882018-07-17 16:24:34 +02001759 goto cleanup;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001760 }
Gilles Peskine96889972018-07-12 17:07:03 +02001761 /* A 0-length key is not commonly used in HMAC when used as a MAC,
1762 * but it is permitted. It is common when HMAC is used in HKDF, for
1763 * example. Don't call `memcpy` in the 0-length because `key` could be
1764 * an invalid pointer which would make the behavior undefined. */
1765 else if( key_length != 0 )
Gilles Peskine01126fa2018-07-12 17:04:55 +02001766 memcpy( ipad, key, key_length );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001767
Gilles Peskined223b522018-06-11 18:12:58 +02001768 /* ipad contains the key followed by garbage. Xor and fill with 0x36
1769 * to create the ipad value. */
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001770 for( i = 0; i < key_length; i++ )
Gilles Peskined223b522018-06-11 18:12:58 +02001771 ipad[i] ^= 0x36;
1772 memset( ipad + key_length, 0x36, block_size - key_length );
1773
1774 /* Copy the key material from ipad to opad, flipping the requisite bits,
1775 * and filling the rest of opad with the requisite constant. */
1776 for( i = 0; i < key_length; i++ )
Gilles Peskine01126fa2018-07-12 17:04:55 +02001777 hmac->opad[i] = ipad[i] ^ 0x36 ^ 0x5C;
1778 memset( hmac->opad + key_length, 0x5C, block_size - key_length );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001779
Gilles Peskine01126fa2018-07-12 17:04:55 +02001780 status = psa_hash_setup( &hmac->hash_ctx, hash_alg );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001781 if( status != PSA_SUCCESS )
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02001782 goto cleanup;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001783
Gilles Peskine01126fa2018-07-12 17:04:55 +02001784 status = psa_hash_update( &hmac->hash_ctx, ipad, block_size );
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02001785
1786cleanup:
Gilles Peskine3f108122018-12-07 18:14:53 +01001787 mbedtls_platform_zeroize( ipad, key_length );
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02001788
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001789 return( status );
1790}
Gilles Peskine248051a2018-06-20 16:09:38 +02001791#endif /* MBEDTLS_MD_C */
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001792
Gilles Peskine89167cb2018-07-08 20:12:23 +02001793static psa_status_t psa_mac_setup( psa_mac_operation_t *operation,
Gilles Peskinec5487a82018-12-03 18:08:14 +01001794 psa_key_handle_t handle,
Gilles Peskine89167cb2018-07-08 20:12:23 +02001795 psa_algorithm_t alg,
1796 int is_sign )
Gilles Peskine8c9def32018-02-08 10:02:12 +01001797{
Gilles Peskine8c9def32018-02-08 10:02:12 +01001798 psa_status_t status;
Gilles Peskine2f060a82018-12-04 17:12:32 +01001799 psa_key_slot_t *slot;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001800 size_t key_bits;
Gilles Peskine89167cb2018-07-08 20:12:23 +02001801 psa_key_usage_t usage =
1802 is_sign ? PSA_KEY_USAGE_SIGN : PSA_KEY_USAGE_VERIFY;
Gilles Peskined911eb72018-08-14 15:18:45 +02001803 unsigned char truncated = PSA_MAC_TRUNCATED_LENGTH( alg );
Gilles Peskinee0e9c7c2018-10-17 18:28:05 +02001804 psa_algorithm_t full_length_alg = PSA_ALG_FULL_LENGTH_MAC( alg );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001805
Gilles Peskined911eb72018-08-14 15:18:45 +02001806 status = psa_mac_init( operation, full_length_alg );
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02001807 if( status != PSA_SUCCESS )
1808 return( status );
Gilles Peskine89167cb2018-07-08 20:12:23 +02001809 if( is_sign )
1810 operation->is_sign = 1;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001811
Gilles Peskinec5487a82018-12-03 18:08:14 +01001812 status = psa_get_key_from_slot( handle, &slot, usage, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02001813 if( status != PSA_SUCCESS )
Gilles Peskinefbfac682018-07-08 20:51:54 +02001814 goto exit;
Gilles Peskineab1d7ab2018-07-06 16:07:47 +02001815 key_bits = psa_get_key_bits( slot );
1816
Gilles Peskine8c9def32018-02-08 10:02:12 +01001817#if defined(MBEDTLS_CMAC_C)
Gilles Peskined911eb72018-08-14 15:18:45 +02001818 if( full_length_alg == PSA_ALG_CMAC )
Gilles Peskinefbfac682018-07-08 20:51:54 +02001819 {
1820 const mbedtls_cipher_info_t *cipher_info =
Gilles Peskined911eb72018-08-14 15:18:45 +02001821 mbedtls_cipher_info_from_psa( full_length_alg,
1822 slot->type, key_bits, NULL );
Gilles Peskinefbfac682018-07-08 20:51:54 +02001823 int ret;
1824 if( cipher_info == NULL )
1825 {
1826 status = PSA_ERROR_NOT_SUPPORTED;
1827 goto exit;
1828 }
1829 operation->mac_size = cipher_info->block_size;
1830 ret = psa_cmac_setup( operation, key_bits, slot, cipher_info );
1831 status = mbedtls_to_psa_error( ret );
1832 }
1833 else
Gilles Peskine8c9def32018-02-08 10:02:12 +01001834#endif /* MBEDTLS_CMAC_C */
Gilles Peskine8c9def32018-02-08 10:02:12 +01001835#if defined(MBEDTLS_MD_C)
Gilles Peskined911eb72018-08-14 15:18:45 +02001836 if( PSA_ALG_IS_HMAC( full_length_alg ) )
Gilles Peskinefbfac682018-07-08 20:51:54 +02001837 {
Gilles Peskine00709fa2018-08-22 18:25:41 +02001838 psa_algorithm_t hash_alg = PSA_ALG_HMAC_GET_HASH( alg );
Gilles Peskine01126fa2018-07-12 17:04:55 +02001839 if( hash_alg == 0 )
1840 {
1841 status = PSA_ERROR_NOT_SUPPORTED;
1842 goto exit;
1843 }
Gilles Peskine9aa369e2018-07-16 00:36:29 +02001844
1845 operation->mac_size = PSA_HASH_SIZE( hash_alg );
1846 /* Sanity check. This shouldn't fail on a valid configuration. */
1847 if( operation->mac_size == 0 ||
1848 operation->mac_size > sizeof( operation->ctx.hmac.opad ) )
1849 {
1850 status = PSA_ERROR_NOT_SUPPORTED;
1851 goto exit;
1852 }
1853
Gilles Peskine01126fa2018-07-12 17:04:55 +02001854 if( slot->type != PSA_KEY_TYPE_HMAC )
1855 {
1856 status = PSA_ERROR_INVALID_ARGUMENT;
1857 goto exit;
1858 }
Gilles Peskine9aa369e2018-07-16 00:36:29 +02001859
Gilles Peskine01126fa2018-07-12 17:04:55 +02001860 status = psa_hmac_setup_internal( &operation->ctx.hmac,
1861 slot->data.raw.data,
1862 slot->data.raw.bytes,
1863 hash_alg );
Gilles Peskinefbfac682018-07-08 20:51:54 +02001864 }
1865 else
Gilles Peskine8c9def32018-02-08 10:02:12 +01001866#endif /* MBEDTLS_MD_C */
Gilles Peskinefbfac682018-07-08 20:51:54 +02001867 {
Jaeden Amero82df32e2018-11-23 15:11:20 +00001868 (void) key_bits;
Gilles Peskinefbfac682018-07-08 20:51:54 +02001869 status = PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001870 }
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001871
Gilles Peskined911eb72018-08-14 15:18:45 +02001872 if( truncated == 0 )
1873 {
1874 /* The "normal" case: untruncated algorithm. Nothing to do. */
1875 }
1876 else if( truncated < 4 )
1877 {
Gilles Peskine6d72ff92018-08-21 14:55:08 +02001878 /* A very short MAC is too short for security since it can be
1879 * brute-forced. Ancient protocols with 32-bit MACs do exist,
1880 * so we make this our minimum, even though 32 bits is still
1881 * too small for security. */
Gilles Peskined911eb72018-08-14 15:18:45 +02001882 status = PSA_ERROR_NOT_SUPPORTED;
1883 }
1884 else if( truncated > operation->mac_size )
1885 {
1886 /* It's impossible to "truncate" to a larger length. */
1887 status = PSA_ERROR_INVALID_ARGUMENT;
1888 }
1889 else
1890 operation->mac_size = truncated;
1891
Gilles Peskinefbfac682018-07-08 20:51:54 +02001892exit:
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001893 if( status != PSA_SUCCESS )
Gilles Peskine8c9def32018-02-08 10:02:12 +01001894 {
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02001895 psa_mac_abort( operation );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001896 }
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001897 else
1898 {
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001899 operation->key_set = 1;
1900 }
1901 return( status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001902}
1903
Gilles Peskine89167cb2018-07-08 20:12:23 +02001904psa_status_t psa_mac_sign_setup( psa_mac_operation_t *operation,
Gilles Peskinec5487a82018-12-03 18:08:14 +01001905 psa_key_handle_t handle,
Gilles Peskine89167cb2018-07-08 20:12:23 +02001906 psa_algorithm_t alg )
1907{
Gilles Peskinec5487a82018-12-03 18:08:14 +01001908 return( psa_mac_setup( operation, handle, alg, 1 ) );
Gilles Peskine89167cb2018-07-08 20:12:23 +02001909}
1910
1911psa_status_t psa_mac_verify_setup( psa_mac_operation_t *operation,
Gilles Peskinec5487a82018-12-03 18:08:14 +01001912 psa_key_handle_t handle,
Gilles Peskine89167cb2018-07-08 20:12:23 +02001913 psa_algorithm_t alg )
1914{
Gilles Peskinec5487a82018-12-03 18:08:14 +01001915 return( psa_mac_setup( operation, handle, alg, 0 ) );
Gilles Peskine89167cb2018-07-08 20:12:23 +02001916}
1917
Gilles Peskine8c9def32018-02-08 10:02:12 +01001918psa_status_t psa_mac_update( psa_mac_operation_t *operation,
1919 const uint8_t *input,
1920 size_t input_length )
1921{
Gilles Peskinefbfac682018-07-08 20:51:54 +02001922 psa_status_t status = PSA_ERROR_BAD_STATE;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001923 if( ! operation->key_set )
Gilles Peskinefbfac682018-07-08 20:51:54 +02001924 goto cleanup;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001925 if( operation->iv_required && ! operation->iv_set )
Gilles Peskinefbfac682018-07-08 20:51:54 +02001926 goto cleanup;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001927 operation->has_input = 1;
1928
Gilles Peskine8c9def32018-02-08 10:02:12 +01001929#if defined(MBEDTLS_CMAC_C)
Gilles Peskinefbfac682018-07-08 20:51:54 +02001930 if( operation->alg == PSA_ALG_CMAC )
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001931 {
Gilles Peskinefbfac682018-07-08 20:51:54 +02001932 int ret = mbedtls_cipher_cmac_update( &operation->ctx.cmac,
1933 input, input_length );
1934 status = mbedtls_to_psa_error( ret );
1935 }
1936 else
1937#endif /* MBEDTLS_CMAC_C */
1938#if defined(MBEDTLS_MD_C)
1939 if( PSA_ALG_IS_HMAC( operation->alg ) )
1940 {
1941 status = psa_hash_update( &operation->ctx.hmac.hash_ctx, input,
1942 input_length );
1943 }
1944 else
1945#endif /* MBEDTLS_MD_C */
1946 {
1947 /* This shouldn't happen if `operation` was initialized by
1948 * a setup function. */
1949 status = PSA_ERROR_BAD_STATE;
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001950 }
1951
Gilles Peskinefbfac682018-07-08 20:51:54 +02001952cleanup:
1953 if( status != PSA_SUCCESS )
1954 psa_mac_abort( operation );
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001955 return( status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001956}
1957
Gilles Peskine01126fa2018-07-12 17:04:55 +02001958#if defined(MBEDTLS_MD_C)
1959static psa_status_t psa_hmac_finish_internal( psa_hmac_internal_data *hmac,
1960 uint8_t *mac,
1961 size_t mac_size )
1962{
1963 unsigned char tmp[MBEDTLS_MD_MAX_SIZE];
1964 psa_algorithm_t hash_alg = hmac->hash_ctx.alg;
1965 size_t hash_size = 0;
1966 size_t block_size = psa_get_hash_block_size( hash_alg );
1967 psa_status_t status;
1968
Gilles Peskine01126fa2018-07-12 17:04:55 +02001969 status = psa_hash_finish( &hmac->hash_ctx, tmp, sizeof( tmp ), &hash_size );
1970 if( status != PSA_SUCCESS )
1971 return( status );
1972 /* From here on, tmp needs to be wiped. */
1973
1974 status = psa_hash_setup( &hmac->hash_ctx, hash_alg );
1975 if( status != PSA_SUCCESS )
1976 goto exit;
1977
1978 status = psa_hash_update( &hmac->hash_ctx, hmac->opad, block_size );
1979 if( status != PSA_SUCCESS )
1980 goto exit;
1981
1982 status = psa_hash_update( &hmac->hash_ctx, tmp, hash_size );
1983 if( status != PSA_SUCCESS )
1984 goto exit;
1985
Gilles Peskined911eb72018-08-14 15:18:45 +02001986 status = psa_hash_finish( &hmac->hash_ctx, tmp, sizeof( tmp ), &hash_size );
1987 if( status != PSA_SUCCESS )
1988 goto exit;
1989
1990 memcpy( mac, tmp, mac_size );
Gilles Peskine01126fa2018-07-12 17:04:55 +02001991
1992exit:
Gilles Peskine3f108122018-12-07 18:14:53 +01001993 mbedtls_platform_zeroize( tmp, hash_size );
Gilles Peskine01126fa2018-07-12 17:04:55 +02001994 return( status );
1995}
1996#endif /* MBEDTLS_MD_C */
1997
mohammad16036df908f2018-04-02 08:34:15 -07001998static psa_status_t psa_mac_finish_internal( psa_mac_operation_t *operation,
Gilles Peskine2d277862018-06-18 15:41:12 +02001999 uint8_t *mac,
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002000 size_t mac_size )
Gilles Peskine8c9def32018-02-08 10:02:12 +01002001{
Gilles Peskine1d96fff2018-07-02 12:15:39 +02002002 if( ! operation->key_set )
2003 return( PSA_ERROR_BAD_STATE );
2004 if( operation->iv_required && ! operation->iv_set )
2005 return( PSA_ERROR_BAD_STATE );
2006
Gilles Peskine8c9def32018-02-08 10:02:12 +01002007 if( mac_size < operation->mac_size )
2008 return( PSA_ERROR_BUFFER_TOO_SMALL );
2009
Gilles Peskine8c9def32018-02-08 10:02:12 +01002010#if defined(MBEDTLS_CMAC_C)
Gilles Peskinefbfac682018-07-08 20:51:54 +02002011 if( operation->alg == PSA_ALG_CMAC )
2012 {
Gilles Peskined911eb72018-08-14 15:18:45 +02002013 uint8_t tmp[PSA_MAX_BLOCK_CIPHER_BLOCK_SIZE];
2014 int ret = mbedtls_cipher_cmac_finish( &operation->ctx.cmac, tmp );
2015 if( ret == 0 )
Gilles Peskine87b0ac42018-08-21 14:55:49 +02002016 memcpy( mac, tmp, operation->mac_size );
Gilles Peskine3f108122018-12-07 18:14:53 +01002017 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
Gilles Peskinefbfac682018-07-08 20:51:54 +02002018 return( mbedtls_to_psa_error( ret ) );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002019 }
Gilles Peskinefbfac682018-07-08 20:51:54 +02002020 else
2021#endif /* MBEDTLS_CMAC_C */
2022#if defined(MBEDTLS_MD_C)
2023 if( PSA_ALG_IS_HMAC( operation->alg ) )
2024 {
Gilles Peskine01126fa2018-07-12 17:04:55 +02002025 return( psa_hmac_finish_internal( &operation->ctx.hmac,
Gilles Peskined911eb72018-08-14 15:18:45 +02002026 mac, operation->mac_size ) );
Gilles Peskinefbfac682018-07-08 20:51:54 +02002027 }
2028 else
2029#endif /* MBEDTLS_MD_C */
2030 {
2031 /* This shouldn't happen if `operation` was initialized by
2032 * a setup function. */
2033 return( PSA_ERROR_BAD_STATE );
2034 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002035}
2036
Gilles Peskineacd4be32018-07-08 19:56:25 +02002037psa_status_t psa_mac_sign_finish( psa_mac_operation_t *operation,
2038 uint8_t *mac,
2039 size_t mac_size,
2040 size_t *mac_length )
mohammad16036df908f2018-04-02 08:34:15 -07002041{
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002042 psa_status_t status;
2043
2044 /* Fill the output buffer with something that isn't a valid mac
2045 * (barring an attack on the mac and deliberately-crafted input),
2046 * in case the caller doesn't check the return status properly. */
2047 *mac_length = mac_size;
2048 /* If mac_size is 0 then mac may be NULL and then the
2049 * call to memset would have undefined behavior. */
2050 if( mac_size != 0 )
2051 memset( mac, '!', mac_size );
2052
Gilles Peskine89167cb2018-07-08 20:12:23 +02002053 if( ! operation->is_sign )
2054 {
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002055 status = PSA_ERROR_BAD_STATE;
2056 goto cleanup;
Gilles Peskine89167cb2018-07-08 20:12:23 +02002057 }
mohammad16036df908f2018-04-02 08:34:15 -07002058
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002059 status = psa_mac_finish_internal( operation, mac, mac_size );
2060
2061cleanup:
2062 if( status == PSA_SUCCESS )
2063 {
2064 status = psa_mac_abort( operation );
2065 if( status == PSA_SUCCESS )
2066 *mac_length = operation->mac_size;
2067 else
2068 memset( mac, '!', mac_size );
2069 }
2070 else
2071 psa_mac_abort( operation );
2072 return( status );
mohammad16036df908f2018-04-02 08:34:15 -07002073}
2074
Gilles Peskineacd4be32018-07-08 19:56:25 +02002075psa_status_t psa_mac_verify_finish( psa_mac_operation_t *operation,
2076 const uint8_t *mac,
2077 size_t mac_length )
Gilles Peskine8c9def32018-02-08 10:02:12 +01002078{
Gilles Peskine828ed142018-06-18 23:25:51 +02002079 uint8_t actual_mac[PSA_MAC_MAX_SIZE];
mohammad16036df908f2018-04-02 08:34:15 -07002080 psa_status_t status;
2081
Gilles Peskine89167cb2018-07-08 20:12:23 +02002082 if( operation->is_sign )
2083 {
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002084 status = PSA_ERROR_BAD_STATE;
2085 goto cleanup;
2086 }
2087 if( operation->mac_size != mac_length )
2088 {
2089 status = PSA_ERROR_INVALID_SIGNATURE;
2090 goto cleanup;
Gilles Peskine89167cb2018-07-08 20:12:23 +02002091 }
mohammad16036df908f2018-04-02 08:34:15 -07002092
2093 status = psa_mac_finish_internal( operation,
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002094 actual_mac, sizeof( actual_mac ) );
2095
2096 if( safer_memcmp( mac, actual_mac, mac_length ) != 0 )
2097 status = PSA_ERROR_INVALID_SIGNATURE;
2098
2099cleanup:
2100 if( status == PSA_SUCCESS )
2101 status = psa_mac_abort( operation );
2102 else
2103 psa_mac_abort( operation );
2104
Gilles Peskine3f108122018-12-07 18:14:53 +01002105 mbedtls_platform_zeroize( actual_mac, sizeof( actual_mac ) );
Gilles Peskined911eb72018-08-14 15:18:45 +02002106
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002107 return( status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002108}
2109
2110
Gilles Peskine20035e32018-02-03 22:44:14 +01002111
Gilles Peskine20035e32018-02-03 22:44:14 +01002112/****************************************************************/
2113/* Asymmetric cryptography */
2114/****************************************************************/
2115
Gilles Peskine2b450e32018-06-27 15:42:46 +02002116#if defined(MBEDTLS_RSA_C)
Gilles Peskine8b18a4f2018-06-08 16:34:46 +02002117/* Decode the hash algorithm from alg and store the mbedtls encoding in
Gilles Peskine71ac7b12018-06-29 23:36:35 +02002118 * md_alg. Verify that the hash length is acceptable. */
Gilles Peskine8b18a4f2018-06-08 16:34:46 +02002119static psa_status_t psa_rsa_decode_md_type( psa_algorithm_t alg,
2120 size_t hash_length,
2121 mbedtls_md_type_t *md_alg )
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03002122{
Gilles Peskine7ed29c52018-06-26 15:50:08 +02002123 psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH( alg );
Gilles Peskine61b91d42018-06-08 16:09:36 +02002124 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
Gilles Peskine71ac7b12018-06-29 23:36:35 +02002125 *md_alg = mbedtls_md_get_type( md_info );
2126
2127 /* The Mbed TLS RSA module uses an unsigned int for hash length
2128 * parameters. Validate that it fits so that we don't risk an
2129 * overflow later. */
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03002130#if SIZE_MAX > UINT_MAX
Gilles Peskine71ac7b12018-06-29 23:36:35 +02002131 if( hash_length > UINT_MAX )
2132 return( PSA_ERROR_INVALID_ARGUMENT );
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03002133#endif
Gilles Peskine71ac7b12018-06-29 23:36:35 +02002134
2135#if defined(MBEDTLS_PKCS1_V15)
2136 /* For PKCS#1 v1.5 signature, if using a hash, the hash length
2137 * must be correct. */
2138 if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) &&
2139 alg != PSA_ALG_RSA_PKCS1V15_SIGN_RAW )
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03002140 {
Gilles Peskine71ac7b12018-06-29 23:36:35 +02002141 if( md_info == NULL )
2142 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine61b91d42018-06-08 16:09:36 +02002143 if( mbedtls_md_get_size( md_info ) != hash_length )
2144 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine71ac7b12018-06-29 23:36:35 +02002145 }
2146#endif /* MBEDTLS_PKCS1_V15 */
2147
2148#if defined(MBEDTLS_PKCS1_V21)
2149 /* PSS requires a hash internally. */
2150 if( PSA_ALG_IS_RSA_PSS( alg ) )
2151 {
Gilles Peskine61b91d42018-06-08 16:09:36 +02002152 if( md_info == NULL )
2153 return( PSA_ERROR_NOT_SUPPORTED );
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03002154 }
Gilles Peskine71ac7b12018-06-29 23:36:35 +02002155#endif /* MBEDTLS_PKCS1_V21 */
2156
Gilles Peskine61b91d42018-06-08 16:09:36 +02002157 return( PSA_SUCCESS );
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03002158}
2159
Gilles Peskine2b450e32018-06-27 15:42:46 +02002160static psa_status_t psa_rsa_sign( mbedtls_rsa_context *rsa,
2161 psa_algorithm_t alg,
2162 const uint8_t *hash,
2163 size_t hash_length,
2164 uint8_t *signature,
2165 size_t signature_size,
2166 size_t *signature_length )
2167{
2168 psa_status_t status;
2169 int ret;
2170 mbedtls_md_type_t md_alg;
2171
2172 status = psa_rsa_decode_md_type( alg, hash_length, &md_alg );
2173 if( status != PSA_SUCCESS )
2174 return( status );
2175
Gilles Peskine630a18a2018-06-29 17:49:35 +02002176 if( signature_size < mbedtls_rsa_get_len( rsa ) )
Gilles Peskine2b450e32018-06-27 15:42:46 +02002177 return( PSA_ERROR_BUFFER_TOO_SMALL );
2178
2179#if defined(MBEDTLS_PKCS1_V15)
2180 if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) )
2181 {
2182 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V15,
2183 MBEDTLS_MD_NONE );
2184 ret = mbedtls_rsa_pkcs1_sign( rsa,
2185 mbedtls_ctr_drbg_random,
2186 &global_data.ctr_drbg,
2187 MBEDTLS_RSA_PRIVATE,
Jaeden Amerobbf97e32018-06-26 14:20:51 +01002188 md_alg,
2189 (unsigned int) hash_length,
2190 hash,
Gilles Peskine2b450e32018-06-27 15:42:46 +02002191 signature );
2192 }
2193 else
2194#endif /* MBEDTLS_PKCS1_V15 */
2195#if defined(MBEDTLS_PKCS1_V21)
2196 if( PSA_ALG_IS_RSA_PSS( alg ) )
2197 {
2198 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
2199 ret = mbedtls_rsa_rsassa_pss_sign( rsa,
2200 mbedtls_ctr_drbg_random,
2201 &global_data.ctr_drbg,
2202 MBEDTLS_RSA_PRIVATE,
Gilles Peskine71ac7b12018-06-29 23:36:35 +02002203 MBEDTLS_MD_NONE,
Jaeden Amerobbf97e32018-06-26 14:20:51 +01002204 (unsigned int) hash_length,
2205 hash,
Gilles Peskine2b450e32018-06-27 15:42:46 +02002206 signature );
2207 }
2208 else
2209#endif /* MBEDTLS_PKCS1_V21 */
2210 {
2211 return( PSA_ERROR_INVALID_ARGUMENT );
2212 }
2213
2214 if( ret == 0 )
Gilles Peskine630a18a2018-06-29 17:49:35 +02002215 *signature_length = mbedtls_rsa_get_len( rsa );
Gilles Peskine2b450e32018-06-27 15:42:46 +02002216 return( mbedtls_to_psa_error( ret ) );
2217}
2218
2219static psa_status_t psa_rsa_verify( mbedtls_rsa_context *rsa,
2220 psa_algorithm_t alg,
2221 const uint8_t *hash,
2222 size_t hash_length,
2223 const uint8_t *signature,
2224 size_t signature_length )
2225{
2226 psa_status_t status;
2227 int ret;
2228 mbedtls_md_type_t md_alg;
2229
2230 status = psa_rsa_decode_md_type( alg, hash_length, &md_alg );
2231 if( status != PSA_SUCCESS )
2232 return( status );
2233
Gilles Peskine630a18a2018-06-29 17:49:35 +02002234 if( signature_length < mbedtls_rsa_get_len( rsa ) )
Gilles Peskine2b450e32018-06-27 15:42:46 +02002235 return( PSA_ERROR_BUFFER_TOO_SMALL );
2236
2237#if defined(MBEDTLS_PKCS1_V15)
2238 if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) )
2239 {
2240 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V15,
2241 MBEDTLS_MD_NONE );
2242 ret = mbedtls_rsa_pkcs1_verify( rsa,
2243 mbedtls_ctr_drbg_random,
2244 &global_data.ctr_drbg,
2245 MBEDTLS_RSA_PUBLIC,
2246 md_alg,
Jaeden Amerobbf97e32018-06-26 14:20:51 +01002247 (unsigned int) hash_length,
Gilles Peskine2b450e32018-06-27 15:42:46 +02002248 hash,
2249 signature );
2250 }
2251 else
2252#endif /* MBEDTLS_PKCS1_V15 */
2253#if defined(MBEDTLS_PKCS1_V21)
2254 if( PSA_ALG_IS_RSA_PSS( alg ) )
2255 {
2256 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
2257 ret = mbedtls_rsa_rsassa_pss_verify( rsa,
2258 mbedtls_ctr_drbg_random,
2259 &global_data.ctr_drbg,
2260 MBEDTLS_RSA_PUBLIC,
Gilles Peskine71ac7b12018-06-29 23:36:35 +02002261 MBEDTLS_MD_NONE,
Jaeden Amerobbf97e32018-06-26 14:20:51 +01002262 (unsigned int) hash_length,
2263 hash,
Gilles Peskine2b450e32018-06-27 15:42:46 +02002264 signature );
2265 }
2266 else
2267#endif /* MBEDTLS_PKCS1_V21 */
2268 {
2269 return( PSA_ERROR_INVALID_ARGUMENT );
2270 }
Gilles Peskineef12c632018-09-13 20:37:48 +02002271
2272 /* Mbed TLS distinguishes "invalid padding" from "valid padding but
2273 * the rest of the signature is invalid". This has little use in
2274 * practice and PSA doesn't report this distinction. */
2275 if( ret == MBEDTLS_ERR_RSA_INVALID_PADDING )
2276 return( PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskine2b450e32018-06-27 15:42:46 +02002277 return( mbedtls_to_psa_error( ret ) );
2278}
2279#endif /* MBEDTLS_RSA_C */
2280
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002281#if defined(MBEDTLS_ECDSA_C)
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002282/* `ecp` cannot be const because `ecp->grp` needs to be non-const
2283 * for mbedtls_ecdsa_sign() and mbedtls_ecdsa_sign_det()
2284 * (even though these functions don't modify it). */
2285static psa_status_t psa_ecdsa_sign( mbedtls_ecp_keypair *ecp,
2286 psa_algorithm_t alg,
2287 const uint8_t *hash,
2288 size_t hash_length,
2289 uint8_t *signature,
2290 size_t signature_size,
2291 size_t *signature_length )
2292{
2293 int ret;
2294 mbedtls_mpi r, s;
Gilles Peskineeae6eee2018-06-28 13:56:01 +02002295 size_t curve_bytes = PSA_BITS_TO_BYTES( ecp->grp.pbits );
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002296 mbedtls_mpi_init( &r );
2297 mbedtls_mpi_init( &s );
2298
Gilles Peskineeae6eee2018-06-28 13:56:01 +02002299 if( signature_size < 2 * curve_bytes )
2300 {
2301 ret = MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL;
2302 goto cleanup;
2303 }
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002304
Gilles Peskinea05219c2018-11-16 16:02:56 +01002305#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002306 if( PSA_ALG_DSA_IS_DETERMINISTIC( alg ) )
2307 {
2308 psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH( alg );
2309 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
2310 mbedtls_md_type_t md_alg = mbedtls_md_get_type( md_info );
2311 MBEDTLS_MPI_CHK( mbedtls_ecdsa_sign_det( &ecp->grp, &r, &s, &ecp->d,
2312 hash, hash_length,
2313 md_alg ) );
2314 }
2315 else
Gilles Peskinea05219c2018-11-16 16:02:56 +01002316#endif /* MBEDTLS_ECDSA_DETERMINISTIC */
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002317 {
Gilles Peskinea05219c2018-11-16 16:02:56 +01002318 (void) alg;
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002319 MBEDTLS_MPI_CHK( mbedtls_ecdsa_sign( &ecp->grp, &r, &s, &ecp->d,
2320 hash, hash_length,
2321 mbedtls_ctr_drbg_random,
2322 &global_data.ctr_drbg ) );
2323 }
Gilles Peskineeae6eee2018-06-28 13:56:01 +02002324
2325 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &r,
2326 signature,
2327 curve_bytes ) );
2328 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &s,
2329 signature + curve_bytes,
2330 curve_bytes ) );
2331
2332cleanup:
2333 mbedtls_mpi_free( &r );
2334 mbedtls_mpi_free( &s );
2335 if( ret == 0 )
2336 *signature_length = 2 * curve_bytes;
Gilles Peskineeae6eee2018-06-28 13:56:01 +02002337 return( mbedtls_to_psa_error( ret ) );
2338}
2339
2340static psa_status_t psa_ecdsa_verify( mbedtls_ecp_keypair *ecp,
2341 const uint8_t *hash,
2342 size_t hash_length,
2343 const uint8_t *signature,
2344 size_t signature_length )
2345{
2346 int ret;
2347 mbedtls_mpi r, s;
2348 size_t curve_bytes = PSA_BITS_TO_BYTES( ecp->grp.pbits );
2349 mbedtls_mpi_init( &r );
2350 mbedtls_mpi_init( &s );
2351
2352 if( signature_length != 2 * curve_bytes )
2353 return( PSA_ERROR_INVALID_SIGNATURE );
2354
2355 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &r,
2356 signature,
2357 curve_bytes ) );
2358 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &s,
2359 signature + curve_bytes,
2360 curve_bytes ) );
2361
2362 ret = mbedtls_ecdsa_verify( &ecp->grp, hash, hash_length,
2363 &ecp->Q, &r, &s );
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002364
2365cleanup:
2366 mbedtls_mpi_free( &r );
2367 mbedtls_mpi_free( &s );
2368 return( mbedtls_to_psa_error( ret ) );
2369}
2370#endif /* MBEDTLS_ECDSA_C */
2371
Gilles Peskinec5487a82018-12-03 18:08:14 +01002372psa_status_t psa_asymmetric_sign( psa_key_handle_t handle,
Gilles Peskine61b91d42018-06-08 16:09:36 +02002373 psa_algorithm_t alg,
2374 const uint8_t *hash,
2375 size_t hash_length,
Gilles Peskine61b91d42018-06-08 16:09:36 +02002376 uint8_t *signature,
2377 size_t signature_size,
2378 size_t *signature_length )
Gilles Peskine20035e32018-02-03 22:44:14 +01002379{
Gilles Peskine2f060a82018-12-04 17:12:32 +01002380 psa_key_slot_t *slot;
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02002381 psa_status_t status;
2382
2383 *signature_length = signature_size;
2384
Gilles Peskinec5487a82018-12-03 18:08:14 +01002385 status = psa_get_key_from_slot( handle, &slot, PSA_KEY_USAGE_SIGN, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02002386 if( status != PSA_SUCCESS )
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02002387 goto exit;
Gilles Peskine20035e32018-02-03 22:44:14 +01002388 if( ! PSA_KEY_TYPE_IS_KEYPAIR( slot->type ) )
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02002389 {
2390 status = PSA_ERROR_INVALID_ARGUMENT;
2391 goto exit;
2392 }
Gilles Peskine20035e32018-02-03 22:44:14 +01002393
Gilles Peskine20035e32018-02-03 22:44:14 +01002394#if defined(MBEDTLS_RSA_C)
2395 if( slot->type == PSA_KEY_TYPE_RSA_KEYPAIR )
2396 {
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02002397 status = psa_rsa_sign( slot->data.rsa,
2398 alg,
2399 hash, hash_length,
2400 signature, signature_size,
2401 signature_length );
Gilles Peskine20035e32018-02-03 22:44:14 +01002402 }
2403 else
2404#endif /* defined(MBEDTLS_RSA_C) */
2405#if defined(MBEDTLS_ECP_C)
2406 if( PSA_KEY_TYPE_IS_ECC( slot->type ) )
2407 {
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002408#if defined(MBEDTLS_ECDSA_C)
Gilles Peskinea05219c2018-11-16 16:02:56 +01002409 if(
2410#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
2411 PSA_ALG_IS_ECDSA( alg )
2412#else
2413 PSA_ALG_IS_RANDOMIZED_ECDSA( alg )
2414#endif
2415 )
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02002416 status = psa_ecdsa_sign( slot->data.ecp,
2417 alg,
2418 hash, hash_length,
2419 signature, signature_size,
2420 signature_length );
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002421 else
2422#endif /* defined(MBEDTLS_ECDSA_C) */
2423 {
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02002424 status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002425 }
itayzafrir5c753392018-05-08 11:18:38 +03002426 }
2427 else
2428#endif /* defined(MBEDTLS_ECP_C) */
2429 {
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02002430 status = PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine20035e32018-02-03 22:44:14 +01002431 }
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02002432
2433exit:
2434 /* Fill the unused part of the output buffer (the whole buffer on error,
2435 * the trailing part on success) with something that isn't a valid mac
2436 * (barring an attack on the mac and deliberately-crafted input),
2437 * in case the caller doesn't check the return status properly. */
2438 if( status == PSA_SUCCESS )
2439 memset( signature + *signature_length, '!',
2440 signature_size - *signature_length );
Gilles Peskine46f1fd72018-06-28 19:31:31 +02002441 else if( signature_size != 0 )
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02002442 memset( signature, '!', signature_size );
Gilles Peskine46f1fd72018-06-28 19:31:31 +02002443 /* If signature_size is 0 then we have nothing to do. We must not call
2444 * memset because signature may be NULL in this case. */
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02002445 return( status );
itayzafrir5c753392018-05-08 11:18:38 +03002446}
2447
Gilles Peskinec5487a82018-12-03 18:08:14 +01002448psa_status_t psa_asymmetric_verify( psa_key_handle_t handle,
itayzafrir5c753392018-05-08 11:18:38 +03002449 psa_algorithm_t alg,
2450 const uint8_t *hash,
2451 size_t hash_length,
Gilles Peskinee9191ff2018-06-27 14:58:41 +02002452 const uint8_t *signature,
Gilles Peskine526fab02018-06-27 18:19:40 +02002453 size_t signature_length )
itayzafrir5c753392018-05-08 11:18:38 +03002454{
Gilles Peskine2f060a82018-12-04 17:12:32 +01002455 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02002456 psa_status_t status;
Gilles Peskine2b450e32018-06-27 15:42:46 +02002457
Gilles Peskinec5487a82018-12-03 18:08:14 +01002458 status = psa_get_key_from_slot( handle, &slot, PSA_KEY_USAGE_VERIFY, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02002459 if( status != PSA_SUCCESS )
2460 return( status );
itayzafrir5c753392018-05-08 11:18:38 +03002461
Gilles Peskine61b91d42018-06-08 16:09:36 +02002462#if defined(MBEDTLS_RSA_C)
Gilles Peskined8008d62018-06-29 19:51:51 +02002463 if( PSA_KEY_TYPE_IS_RSA( slot->type ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002464 {
Gilles Peskine2b450e32018-06-27 15:42:46 +02002465 return( psa_rsa_verify( slot->data.rsa,
2466 alg,
2467 hash, hash_length,
2468 signature, signature_length ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002469 }
2470 else
2471#endif /* defined(MBEDTLS_RSA_C) */
itayzafrir5c753392018-05-08 11:18:38 +03002472#if defined(MBEDTLS_ECP_C)
2473 if( PSA_KEY_TYPE_IS_ECC( slot->type ) )
2474 {
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002475#if defined(MBEDTLS_ECDSA_C)
2476 if( PSA_ALG_IS_ECDSA( alg ) )
Gilles Peskineeae6eee2018-06-28 13:56:01 +02002477 return( psa_ecdsa_verify( slot->data.ecp,
2478 hash, hash_length,
2479 signature, signature_length ) );
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002480 else
2481#endif /* defined(MBEDTLS_ECDSA_C) */
2482 {
2483 return( PSA_ERROR_INVALID_ARGUMENT );
2484 }
itayzafrir5c753392018-05-08 11:18:38 +03002485 }
Gilles Peskine20035e32018-02-03 22:44:14 +01002486 else
2487#endif /* defined(MBEDTLS_ECP_C) */
2488 {
2489 return( PSA_ERROR_NOT_SUPPORTED );
2490 }
2491}
2492
Gilles Peskine072ac562018-06-30 00:21:29 +02002493#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PKCS1_V21)
2494static void psa_rsa_oaep_set_padding_mode( psa_algorithm_t alg,
2495 mbedtls_rsa_context *rsa )
2496{
2497 psa_algorithm_t hash_alg = PSA_ALG_RSA_OAEP_GET_HASH( alg );
2498 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
2499 mbedtls_md_type_t md_alg = mbedtls_md_get_type( md_info );
2500 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
2501}
2502#endif /* defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PKCS1_V21) */
2503
Gilles Peskinec5487a82018-12-03 18:08:14 +01002504psa_status_t psa_asymmetric_encrypt( psa_key_handle_t handle,
Gilles Peskine61b91d42018-06-08 16:09:36 +02002505 psa_algorithm_t alg,
2506 const uint8_t *input,
2507 size_t input_length,
2508 const uint8_t *salt,
2509 size_t salt_length,
2510 uint8_t *output,
2511 size_t output_size,
2512 size_t *output_length )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002513{
Gilles Peskine2f060a82018-12-04 17:12:32 +01002514 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02002515 psa_status_t status;
2516
Darryl Green5cc689a2018-07-24 15:34:10 +01002517 (void) input;
2518 (void) input_length;
2519 (void) salt;
2520 (void) output;
2521 (void) output_size;
2522
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03002523 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002524
Gilles Peskineb3fc05d2018-06-30 19:04:35 +02002525 if( ! PSA_ALG_IS_RSA_OAEP( alg ) && salt_length != 0 )
2526 return( PSA_ERROR_INVALID_ARGUMENT );
2527
Gilles Peskinec5487a82018-12-03 18:08:14 +01002528 status = psa_get_key_from_slot( handle, &slot, PSA_KEY_USAGE_ENCRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02002529 if( status != PSA_SUCCESS )
2530 return( status );
Gilles Peskine35da9a22018-06-29 19:17:49 +02002531 if( ! ( PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->type ) ||
2532 PSA_KEY_TYPE_IS_KEYPAIR( slot->type ) ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002533 return( PSA_ERROR_INVALID_ARGUMENT );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002534
2535#if defined(MBEDTLS_RSA_C)
Gilles Peskined8008d62018-06-29 19:51:51 +02002536 if( PSA_KEY_TYPE_IS_RSA( slot->type ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002537 {
2538 mbedtls_rsa_context *rsa = slot->data.rsa;
2539 int ret;
Gilles Peskine630a18a2018-06-29 17:49:35 +02002540 if( output_size < mbedtls_rsa_get_len( rsa ) )
Gilles Peskine61b91d42018-06-08 16:09:36 +02002541 return( PSA_ERROR_INVALID_ARGUMENT );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002542#if defined(MBEDTLS_PKCS1_V15)
Gilles Peskine6afe7892018-05-31 13:16:08 +02002543 if( alg == PSA_ALG_RSA_PKCS1V15_CRYPT )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002544 {
Gilles Peskine61b91d42018-06-08 16:09:36 +02002545 ret = mbedtls_rsa_pkcs1_encrypt( rsa,
2546 mbedtls_ctr_drbg_random,
2547 &global_data.ctr_drbg,
2548 MBEDTLS_RSA_PUBLIC,
2549 input_length,
2550 input,
2551 output );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002552 }
2553 else
2554#endif /* MBEDTLS_PKCS1_V15 */
2555#if defined(MBEDTLS_PKCS1_V21)
Gilles Peskine55bf3d12018-06-26 15:53:48 +02002556 if( PSA_ALG_IS_RSA_OAEP( alg ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002557 {
Gilles Peskine072ac562018-06-30 00:21:29 +02002558 psa_rsa_oaep_set_padding_mode( alg, rsa );
2559 ret = mbedtls_rsa_rsaes_oaep_encrypt( rsa,
2560 mbedtls_ctr_drbg_random,
2561 &global_data.ctr_drbg,
2562 MBEDTLS_RSA_PUBLIC,
2563 salt, salt_length,
2564 input_length,
2565 input,
2566 output );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002567 }
2568 else
2569#endif /* MBEDTLS_PKCS1_V21 */
2570 {
2571 return( PSA_ERROR_INVALID_ARGUMENT );
2572 }
2573 if( ret == 0 )
Gilles Peskine630a18a2018-06-29 17:49:35 +02002574 *output_length = mbedtls_rsa_get_len( rsa );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002575 return( mbedtls_to_psa_error( ret ) );
2576 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002577 else
Gilles Peskineb75e4f12018-06-08 17:44:47 +02002578#endif /* defined(MBEDTLS_RSA_C) */
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002579 {
2580 return( PSA_ERROR_NOT_SUPPORTED );
2581 }
Gilles Peskine5b051bc2018-05-31 13:25:48 +02002582}
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002583
Gilles Peskinec5487a82018-12-03 18:08:14 +01002584psa_status_t psa_asymmetric_decrypt( psa_key_handle_t handle,
Gilles Peskine61b91d42018-06-08 16:09:36 +02002585 psa_algorithm_t alg,
2586 const uint8_t *input,
2587 size_t input_length,
2588 const uint8_t *salt,
2589 size_t salt_length,
2590 uint8_t *output,
2591 size_t output_size,
2592 size_t *output_length )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002593{
Gilles Peskine2f060a82018-12-04 17:12:32 +01002594 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02002595 psa_status_t status;
2596
Darryl Green5cc689a2018-07-24 15:34:10 +01002597 (void) input;
2598 (void) input_length;
2599 (void) salt;
2600 (void) output;
2601 (void) output_size;
2602
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03002603 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002604
Gilles Peskineb3fc05d2018-06-30 19:04:35 +02002605 if( ! PSA_ALG_IS_RSA_OAEP( alg ) && salt_length != 0 )
2606 return( PSA_ERROR_INVALID_ARGUMENT );
2607
Gilles Peskinec5487a82018-12-03 18:08:14 +01002608 status = psa_get_key_from_slot( handle, &slot, PSA_KEY_USAGE_DECRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02002609 if( status != PSA_SUCCESS )
2610 return( status );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002611 if( ! PSA_KEY_TYPE_IS_KEYPAIR( slot->type ) )
2612 return( PSA_ERROR_INVALID_ARGUMENT );
2613
2614#if defined(MBEDTLS_RSA_C)
2615 if( slot->type == PSA_KEY_TYPE_RSA_KEYPAIR )
2616 {
2617 mbedtls_rsa_context *rsa = slot->data.rsa;
2618 int ret;
2619
Gilles Peskine630a18a2018-06-29 17:49:35 +02002620 if( input_length != mbedtls_rsa_get_len( rsa ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002621 return( PSA_ERROR_INVALID_ARGUMENT );
2622
2623#if defined(MBEDTLS_PKCS1_V15)
Gilles Peskine6afe7892018-05-31 13:16:08 +02002624 if( alg == PSA_ALG_RSA_PKCS1V15_CRYPT )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002625 {
Gilles Peskine61b91d42018-06-08 16:09:36 +02002626 ret = mbedtls_rsa_pkcs1_decrypt( rsa,
2627 mbedtls_ctr_drbg_random,
2628 &global_data.ctr_drbg,
2629 MBEDTLS_RSA_PRIVATE,
2630 output_length,
2631 input,
2632 output,
2633 output_size );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002634 }
2635 else
2636#endif /* MBEDTLS_PKCS1_V15 */
2637#if defined(MBEDTLS_PKCS1_V21)
Gilles Peskine55bf3d12018-06-26 15:53:48 +02002638 if( PSA_ALG_IS_RSA_OAEP( alg ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002639 {
Gilles Peskine072ac562018-06-30 00:21:29 +02002640 psa_rsa_oaep_set_padding_mode( alg, rsa );
2641 ret = mbedtls_rsa_rsaes_oaep_decrypt( rsa,
2642 mbedtls_ctr_drbg_random,
2643 &global_data.ctr_drbg,
2644 MBEDTLS_RSA_PRIVATE,
2645 salt, salt_length,
2646 output_length,
2647 input,
2648 output,
2649 output_size );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002650 }
2651 else
2652#endif /* MBEDTLS_PKCS1_V21 */
2653 {
2654 return( PSA_ERROR_INVALID_ARGUMENT );
2655 }
Nir Sonnenschein717a0402018-06-04 16:36:15 +03002656
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002657 return( mbedtls_to_psa_error( ret ) );
2658 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002659 else
Gilles Peskineb75e4f12018-06-08 17:44:47 +02002660#endif /* defined(MBEDTLS_RSA_C) */
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002661 {
2662 return( PSA_ERROR_NOT_SUPPORTED );
2663 }
Gilles Peskine5b051bc2018-05-31 13:25:48 +02002664}
Gilles Peskine20035e32018-02-03 22:44:14 +01002665
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02002666
2667
mohammad1603503973b2018-03-12 15:59:30 +02002668/****************************************************************/
2669/* Symmetric cryptography */
2670/****************************************************************/
2671
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002672/* Initialize the cipher operation structure. Once this function has been
2673 * called, psa_cipher_abort can run and will do the right thing. */
2674static psa_status_t psa_cipher_init( psa_cipher_operation_t *operation,
2675 psa_algorithm_t alg )
2676{
Gilles Peskinec06e0712018-06-20 16:21:04 +02002677 if( ! PSA_ALG_IS_CIPHER( alg ) )
2678 {
2679 memset( operation, 0, sizeof( *operation ) );
2680 return( PSA_ERROR_INVALID_ARGUMENT );
2681 }
2682
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002683 operation->alg = alg;
2684 operation->key_set = 0;
2685 operation->iv_set = 0;
2686 operation->iv_required = 1;
2687 operation->iv_size = 0;
2688 operation->block_size = 0;
2689 mbedtls_cipher_init( &operation->ctx.cipher );
2690 return( PSA_SUCCESS );
2691}
2692
Gilles Peskinee553c652018-06-04 16:22:46 +02002693static psa_status_t psa_cipher_setup( psa_cipher_operation_t *operation,
Gilles Peskinec5487a82018-12-03 18:08:14 +01002694 psa_key_handle_t handle,
Gilles Peskine7e928852018-06-04 16:23:10 +02002695 psa_algorithm_t alg,
2696 mbedtls_operation_t cipher_operation )
mohammad1603503973b2018-03-12 15:59:30 +02002697{
2698 int ret = MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE;
2699 psa_status_t status;
Gilles Peskine2f060a82018-12-04 17:12:32 +01002700 psa_key_slot_t *slot;
mohammad1603503973b2018-03-12 15:59:30 +02002701 size_t key_bits;
2702 const mbedtls_cipher_info_t *cipher_info = NULL;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02002703 psa_key_usage_t usage = ( cipher_operation == MBEDTLS_ENCRYPT ?
2704 PSA_KEY_USAGE_ENCRYPT :
2705 PSA_KEY_USAGE_DECRYPT );
mohammad1603503973b2018-03-12 15:59:30 +02002706
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002707 status = psa_cipher_init( operation, alg );
2708 if( status != PSA_SUCCESS )
2709 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02002710
Gilles Peskinec5487a82018-12-03 18:08:14 +01002711 status = psa_get_key_from_slot( handle, &slot, usage, alg);
Gilles Peskineb0b255c2018-07-06 17:01:38 +02002712 if( status != PSA_SUCCESS )
2713 return( status );
Gilles Peskineab1d7ab2018-07-06 16:07:47 +02002714 key_bits = psa_get_key_bits( slot );
mohammad1603503973b2018-03-12 15:59:30 +02002715
Gilles Peskineab1d7ab2018-07-06 16:07:47 +02002716 cipher_info = mbedtls_cipher_info_from_psa( alg, slot->type, key_bits, NULL );
mohammad1603503973b2018-03-12 15:59:30 +02002717 if( cipher_info == NULL )
2718 return( PSA_ERROR_NOT_SUPPORTED );
2719
mohammad1603503973b2018-03-12 15:59:30 +02002720 ret = mbedtls_cipher_setup( &operation->ctx.cipher, cipher_info );
Moran Peker41deec42018-04-04 15:43:05 +03002721 if( ret != 0 )
mohammad1603503973b2018-03-12 15:59:30 +02002722 {
2723 psa_cipher_abort( operation );
2724 return( mbedtls_to_psa_error( ret ) );
2725 }
2726
Gilles Peskine9ad29e22018-06-21 09:40:04 +02002727#if defined(MBEDTLS_DES_C)
Gilles Peskineab1d7ab2018-07-06 16:07:47 +02002728 if( slot->type == PSA_KEY_TYPE_DES && key_bits == 128 )
Gilles Peskine9ad29e22018-06-21 09:40:04 +02002729 {
2730 /* Two-key Triple-DES is 3-key Triple-DES with K1=K3 */
2731 unsigned char keys[24];
2732 memcpy( keys, slot->data.raw.data, 16 );
2733 memcpy( keys + 16, slot->data.raw.data, 8 );
2734 ret = mbedtls_cipher_setkey( &operation->ctx.cipher,
2735 keys,
2736 192, cipher_operation );
2737 }
2738 else
2739#endif
2740 {
2741 ret = mbedtls_cipher_setkey( &operation->ctx.cipher,
2742 slot->data.raw.data,
Jaeden Amero23bbb752018-06-26 14:16:54 +01002743 (int) key_bits, cipher_operation );
Gilles Peskine9ad29e22018-06-21 09:40:04 +02002744 }
Moran Peker41deec42018-04-04 15:43:05 +03002745 if( ret != 0 )
mohammad1603503973b2018-03-12 15:59:30 +02002746 {
2747 psa_cipher_abort( operation );
2748 return( mbedtls_to_psa_error( ret ) );
2749 }
2750
mohammad16038481e742018-03-18 13:57:31 +02002751#if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING)
Gilles Peskinedaea26f2018-08-21 14:02:45 +02002752 switch( alg )
mohammad16038481e742018-03-18 13:57:31 +02002753 {
Gilles Peskinedaea26f2018-08-21 14:02:45 +02002754 case PSA_ALG_CBC_NO_PADDING:
2755 ret = mbedtls_cipher_set_padding_mode( &operation->ctx.cipher,
2756 MBEDTLS_PADDING_NONE );
2757 break;
2758 case PSA_ALG_CBC_PKCS7:
2759 ret = mbedtls_cipher_set_padding_mode( &operation->ctx.cipher,
2760 MBEDTLS_PADDING_PKCS7 );
2761 break;
2762 default:
2763 /* The algorithm doesn't involve padding. */
2764 ret = 0;
2765 break;
2766 }
2767 if( ret != 0 )
2768 {
2769 psa_cipher_abort( operation );
2770 return( mbedtls_to_psa_error( ret ) );
mohammad16038481e742018-03-18 13:57:31 +02002771 }
2772#endif //MBEDTLS_CIPHER_MODE_WITH_PADDING
2773
mohammad1603503973b2018-03-12 15:59:30 +02002774 operation->key_set = 1;
Gilles Peskinedaea26f2018-08-21 14:02:45 +02002775 operation->block_size = ( PSA_ALG_IS_STREAM_CIPHER( alg ) ? 1 :
2776 PSA_BLOCK_CIPHER_BLOCK_SIZE( slot->type ) );
2777 if( alg & PSA_ALG_CIPHER_FROM_BLOCK_FLAG )
mohammad16038481e742018-03-18 13:57:31 +02002778 {
Gilles Peskineab1d7ab2018-07-06 16:07:47 +02002779 operation->iv_size = PSA_BLOCK_CIPHER_BLOCK_SIZE( slot->type );
mohammad16038481e742018-03-18 13:57:31 +02002780 }
mohammad1603503973b2018-03-12 15:59:30 +02002781
Moran Peker395db872018-05-31 14:07:14 +03002782 return( PSA_SUCCESS );
mohammad1603503973b2018-03-12 15:59:30 +02002783}
2784
Gilles Peskinefe119512018-07-08 21:39:34 +02002785psa_status_t psa_cipher_encrypt_setup( psa_cipher_operation_t *operation,
Gilles Peskinec5487a82018-12-03 18:08:14 +01002786 psa_key_handle_t handle,
Gilles Peskinefe119512018-07-08 21:39:34 +02002787 psa_algorithm_t alg )
mohammad16038481e742018-03-18 13:57:31 +02002788{
Gilles Peskinec5487a82018-12-03 18:08:14 +01002789 return( psa_cipher_setup( operation, handle, alg, MBEDTLS_ENCRYPT ) );
mohammad16038481e742018-03-18 13:57:31 +02002790}
2791
Gilles Peskinefe119512018-07-08 21:39:34 +02002792psa_status_t psa_cipher_decrypt_setup( psa_cipher_operation_t *operation,
Gilles Peskinec5487a82018-12-03 18:08:14 +01002793 psa_key_handle_t handle,
Gilles Peskinefe119512018-07-08 21:39:34 +02002794 psa_algorithm_t alg )
mohammad16038481e742018-03-18 13:57:31 +02002795{
Gilles Peskinec5487a82018-12-03 18:08:14 +01002796 return( psa_cipher_setup( operation, handle, alg, MBEDTLS_DECRYPT ) );
mohammad16038481e742018-03-18 13:57:31 +02002797}
2798
Gilles Peskinefe119512018-07-08 21:39:34 +02002799psa_status_t psa_cipher_generate_iv( psa_cipher_operation_t *operation,
2800 unsigned char *iv,
2801 size_t iv_size,
2802 size_t *iv_length )
mohammad1603503973b2018-03-12 15:59:30 +02002803{
itayzafrir534bd7c2018-08-02 13:56:32 +03002804 psa_status_t status;
2805 int ret;
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02002806 if( operation->iv_set || ! operation->iv_required )
itayzafrir534bd7c2018-08-02 13:56:32 +03002807 {
2808 status = PSA_ERROR_BAD_STATE;
2809 goto exit;
2810 }
Moran Peker41deec42018-04-04 15:43:05 +03002811 if( iv_size < operation->iv_size )
mohammad1603503973b2018-03-12 15:59:30 +02002812 {
itayzafrir534bd7c2018-08-02 13:56:32 +03002813 status = PSA_ERROR_BUFFER_TOO_SMALL;
Moran Peker41deec42018-04-04 15:43:05 +03002814 goto exit;
2815 }
Gilles Peskine7e928852018-06-04 16:23:10 +02002816 ret = mbedtls_ctr_drbg_random( &global_data.ctr_drbg,
2817 iv, operation->iv_size );
Moran Peker41deec42018-04-04 15:43:05 +03002818 if( ret != 0 )
2819 {
itayzafrir534bd7c2018-08-02 13:56:32 +03002820 status = mbedtls_to_psa_error( ret );
Gilles Peskinee553c652018-06-04 16:22:46 +02002821 goto exit;
mohammad1603503973b2018-03-12 15:59:30 +02002822 }
Gilles Peskinee553c652018-06-04 16:22:46 +02002823
mohammad16038481e742018-03-18 13:57:31 +02002824 *iv_length = operation->iv_size;
itayzafrir534bd7c2018-08-02 13:56:32 +03002825 status = psa_cipher_set_iv( operation, iv, *iv_length );
Moran Peker41deec42018-04-04 15:43:05 +03002826
Moran Peker395db872018-05-31 14:07:14 +03002827exit:
itayzafrir534bd7c2018-08-02 13:56:32 +03002828 if( status != PSA_SUCCESS )
Moran Peker395db872018-05-31 14:07:14 +03002829 psa_cipher_abort( operation );
itayzafrir534bd7c2018-08-02 13:56:32 +03002830 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02002831}
2832
Gilles Peskinefe119512018-07-08 21:39:34 +02002833psa_status_t psa_cipher_set_iv( psa_cipher_operation_t *operation,
2834 const unsigned char *iv,
2835 size_t iv_length )
mohammad1603503973b2018-03-12 15:59:30 +02002836{
itayzafrir534bd7c2018-08-02 13:56:32 +03002837 psa_status_t status;
2838 int ret;
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02002839 if( operation->iv_set || ! operation->iv_required )
itayzafrir534bd7c2018-08-02 13:56:32 +03002840 {
2841 status = PSA_ERROR_BAD_STATE;
2842 goto exit;
2843 }
Moran Pekera28258c2018-05-29 16:25:04 +03002844 if( iv_length != operation->iv_size )
Moran Peker71f19ae2018-04-22 20:23:16 +03002845 {
itayzafrir534bd7c2018-08-02 13:56:32 +03002846 status = PSA_ERROR_INVALID_ARGUMENT;
2847 goto exit;
Moran Peker71f19ae2018-04-22 20:23:16 +03002848 }
itayzafrir534bd7c2018-08-02 13:56:32 +03002849 ret = mbedtls_cipher_set_iv( &operation->ctx.cipher, iv, iv_length );
2850 status = mbedtls_to_psa_error( ret );
2851exit:
2852 if( status == PSA_SUCCESS )
2853 operation->iv_set = 1;
2854 else
mohammad1603503973b2018-03-12 15:59:30 +02002855 psa_cipher_abort( operation );
itayzafrir534bd7c2018-08-02 13:56:32 +03002856 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02002857}
2858
Gilles Peskinee553c652018-06-04 16:22:46 +02002859psa_status_t psa_cipher_update( psa_cipher_operation_t *operation,
2860 const uint8_t *input,
2861 size_t input_length,
2862 unsigned char *output,
2863 size_t output_size,
2864 size_t *output_length )
mohammad1603503973b2018-03-12 15:59:30 +02002865{
itayzafrir534bd7c2018-08-02 13:56:32 +03002866 psa_status_t status;
2867 int ret;
Gilles Peskine89d789c2018-06-04 17:17:16 +02002868 size_t expected_output_size;
Gilles Peskinedaea26f2018-08-21 14:02:45 +02002869 if( ! PSA_ALG_IS_STREAM_CIPHER( operation->alg ) )
Gilles Peskine89d789c2018-06-04 17:17:16 +02002870 {
2871 /* Take the unprocessed partial block left over from previous
2872 * update calls, if any, plus the input to this call. Remove
2873 * the last partial block, if any. You get the data that will be
2874 * output in this call. */
2875 expected_output_size =
2876 ( operation->ctx.cipher.unprocessed_len + input_length )
2877 / operation->block_size * operation->block_size;
2878 }
2879 else
2880 {
2881 expected_output_size = input_length;
2882 }
itayzafrir534bd7c2018-08-02 13:56:32 +03002883
Gilles Peskine89d789c2018-06-04 17:17:16 +02002884 if( output_size < expected_output_size )
itayzafrir534bd7c2018-08-02 13:56:32 +03002885 {
2886 status = PSA_ERROR_BUFFER_TOO_SMALL;
2887 goto exit;
2888 }
mohammad160382759612018-03-12 18:16:40 +02002889
mohammad1603503973b2018-03-12 15:59:30 +02002890 ret = mbedtls_cipher_update( &operation->ctx.cipher, input,
Gilles Peskinee553c652018-06-04 16:22:46 +02002891 input_length, output, output_length );
itayzafrir534bd7c2018-08-02 13:56:32 +03002892 status = mbedtls_to_psa_error( ret );
2893exit:
2894 if( status != PSA_SUCCESS )
mohammad1603503973b2018-03-12 15:59:30 +02002895 psa_cipher_abort( operation );
itayzafrir534bd7c2018-08-02 13:56:32 +03002896 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02002897}
2898
Gilles Peskinee553c652018-06-04 16:22:46 +02002899psa_status_t psa_cipher_finish( psa_cipher_operation_t *operation,
2900 uint8_t *output,
2901 size_t output_size,
2902 size_t *output_length )
mohammad1603503973b2018-03-12 15:59:30 +02002903{
Janos Follath315b51c2018-07-09 16:04:51 +01002904 psa_status_t status = PSA_ERROR_UNKNOWN_ERROR;
2905 int cipher_ret = MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE;
Gilles Peskinee553c652018-06-04 16:22:46 +02002906 uint8_t temp_output_buffer[MBEDTLS_MAX_BLOCK_LENGTH];
Moran Pekerbed71a22018-04-22 20:19:20 +03002907
mohammad1603503973b2018-03-12 15:59:30 +02002908 if( ! operation->key_set )
Moran Pekerdc38ebc2018-04-30 15:45:34 +03002909 {
Janos Follath315b51c2018-07-09 16:04:51 +01002910 status = PSA_ERROR_BAD_STATE;
2911 goto error;
Moran Peker7cb22b82018-06-05 11:40:02 +03002912 }
2913 if( operation->iv_required && ! operation->iv_set )
2914 {
Janos Follath315b51c2018-07-09 16:04:51 +01002915 status = PSA_ERROR_BAD_STATE;
2916 goto error;
Moran Peker7cb22b82018-06-05 11:40:02 +03002917 }
Gilles Peskinedaea26f2018-08-21 14:02:45 +02002918
Gilles Peskine2c5219a2018-06-06 15:12:32 +02002919 if( operation->ctx.cipher.operation == MBEDTLS_ENCRYPT &&
Gilles Peskinedaea26f2018-08-21 14:02:45 +02002920 operation->alg == PSA_ALG_CBC_NO_PADDING &&
2921 operation->ctx.cipher.unprocessed_len != 0 )
Moran Peker7cb22b82018-06-05 11:40:02 +03002922 {
Gilles Peskinedaea26f2018-08-21 14:02:45 +02002923 status = PSA_ERROR_INVALID_ARGUMENT;
Janos Follath315b51c2018-07-09 16:04:51 +01002924 goto error;
Moran Pekerdc38ebc2018-04-30 15:45:34 +03002925 }
2926
Janos Follath315b51c2018-07-09 16:04:51 +01002927 cipher_ret = mbedtls_cipher_finish( &operation->ctx.cipher,
2928 temp_output_buffer,
2929 output_length );
2930 if( cipher_ret != 0 )
mohammad1603503973b2018-03-12 15:59:30 +02002931 {
Janos Follath315b51c2018-07-09 16:04:51 +01002932 status = mbedtls_to_psa_error( cipher_ret );
2933 goto error;
mohammad1603503973b2018-03-12 15:59:30 +02002934 }
Janos Follath315b51c2018-07-09 16:04:51 +01002935
Gilles Peskine46f1fd72018-06-28 19:31:31 +02002936 if( *output_length == 0 )
Janos Follath315b51c2018-07-09 16:04:51 +01002937 ; /* Nothing to copy. Note that output may be NULL in this case. */
Gilles Peskine46f1fd72018-06-28 19:31:31 +02002938 else if( output_size >= *output_length )
Moran Pekerdc38ebc2018-04-30 15:45:34 +03002939 memcpy( output, temp_output_buffer, *output_length );
2940 else
2941 {
Janos Follath315b51c2018-07-09 16:04:51 +01002942 status = PSA_ERROR_BUFFER_TOO_SMALL;
2943 goto error;
Moran Pekerdc38ebc2018-04-30 15:45:34 +03002944 }
mohammad1603503973b2018-03-12 15:59:30 +02002945
Gilles Peskine3f108122018-12-07 18:14:53 +01002946 mbedtls_platform_zeroize( temp_output_buffer, sizeof( temp_output_buffer ) );
Janos Follath315b51c2018-07-09 16:04:51 +01002947 status = psa_cipher_abort( operation );
2948
2949 return( status );
2950
2951error:
2952
2953 *output_length = 0;
2954
Gilles Peskine3f108122018-12-07 18:14:53 +01002955 mbedtls_platform_zeroize( temp_output_buffer, sizeof( temp_output_buffer ) );
Janos Follath315b51c2018-07-09 16:04:51 +01002956 (void) psa_cipher_abort( operation );
2957
2958 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02002959}
2960
Gilles Peskinee553c652018-06-04 16:22:46 +02002961psa_status_t psa_cipher_abort( psa_cipher_operation_t *operation )
2962{
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002963 if( operation->alg == 0 )
Gilles Peskine81736312018-06-26 15:04:31 +02002964 {
2965 /* The object has (apparently) been initialized but it is not
2966 * in use. It's ok to call abort on such an object, and there's
2967 * nothing to do. */
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002968 return( PSA_SUCCESS );
Gilles Peskine81736312018-06-26 15:04:31 +02002969 }
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002970
Gilles Peskinef9c2c092018-06-21 16:57:07 +02002971 /* Sanity check (shouldn't happen: operation->alg should
2972 * always have been initialized to a valid value). */
2973 if( ! PSA_ALG_IS_CIPHER( operation->alg ) )
2974 return( PSA_ERROR_BAD_STATE );
2975
mohammad1603503973b2018-03-12 15:59:30 +02002976 mbedtls_cipher_free( &operation->ctx.cipher );
Gilles Peskinee553c652018-06-04 16:22:46 +02002977
Moran Peker41deec42018-04-04 15:43:05 +03002978 operation->alg = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03002979 operation->key_set = 0;
2980 operation->iv_set = 0;
2981 operation->iv_size = 0;
Moran Peker41deec42018-04-04 15:43:05 +03002982 operation->block_size = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03002983 operation->iv_required = 0;
Moran Peker41deec42018-04-04 15:43:05 +03002984
Moran Peker395db872018-05-31 14:07:14 +03002985 return( PSA_SUCCESS );
mohammad1603503973b2018-03-12 15:59:30 +02002986}
2987
Gilles Peskinea0655c32018-04-30 17:06:50 +02002988
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02002989
mohammad16038cc1cee2018-03-28 01:21:33 +03002990/****************************************************************/
2991/* Key Policy */
2992/****************************************************************/
Mohammad Abo Mokha5c7b7d2018-07-04 15:57:00 +03002993
mohammad160327010052018-07-03 13:16:15 +03002994#if !defined(MBEDTLS_PSA_CRYPTO_SPM)
Gilles Peskine2d277862018-06-18 15:41:12 +02002995void psa_key_policy_set_usage( psa_key_policy_t *policy,
2996 psa_key_usage_t usage,
2997 psa_algorithm_t alg )
mohammad16038cc1cee2018-03-28 01:21:33 +03002998{
mohammad16034eed7572018-03-28 05:14:59 -07002999 policy->usage = usage;
3000 policy->alg = alg;
mohammad16038cc1cee2018-03-28 01:21:33 +03003001}
3002
Gilles Peskineaa7bc472018-07-12 00:54:56 +02003003psa_key_usage_t psa_key_policy_get_usage( const psa_key_policy_t *policy )
mohammad16038cc1cee2018-03-28 01:21:33 +03003004{
mohammad16036df908f2018-04-02 08:34:15 -07003005 return( policy->usage );
mohammad16038cc1cee2018-03-28 01:21:33 +03003006}
3007
Gilles Peskineaa7bc472018-07-12 00:54:56 +02003008psa_algorithm_t psa_key_policy_get_algorithm( const psa_key_policy_t *policy )
mohammad16038cc1cee2018-03-28 01:21:33 +03003009{
mohammad16036df908f2018-04-02 08:34:15 -07003010 return( policy->alg );
mohammad16038cc1cee2018-03-28 01:21:33 +03003011}
mohammad160327010052018-07-03 13:16:15 +03003012#endif /* !defined(MBEDTLS_PSA_CRYPTO_SPM) */
Mohammad Abo Mokha5c7b7d2018-07-04 15:57:00 +03003013
Gilles Peskinec5487a82018-12-03 18:08:14 +01003014psa_status_t psa_set_key_policy( psa_key_handle_t handle,
Gilles Peskine2d277862018-06-18 15:41:12 +02003015 const psa_key_policy_t *policy )
mohammad16038cc1cee2018-03-28 01:21:33 +03003016{
Gilles Peskine2f060a82018-12-04 17:12:32 +01003017 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003018 psa_status_t status;
mohammad16038cc1cee2018-03-28 01:21:33 +03003019
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003020 if( policy == NULL )
mohammad16038cc1cee2018-03-28 01:21:33 +03003021 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine5b051bc2018-05-31 13:25:48 +02003022
Gilles Peskinec5487a82018-12-03 18:08:14 +01003023 status = psa_get_empty_key_slot( handle, &slot );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003024 if( status != PSA_SUCCESS )
3025 return( status );
mohammad16038cc1cee2018-03-28 01:21:33 +03003026
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02003027 if( ( policy->usage & ~( PSA_KEY_USAGE_EXPORT |
3028 PSA_KEY_USAGE_ENCRYPT |
3029 PSA_KEY_USAGE_DECRYPT |
3030 PSA_KEY_USAGE_SIGN |
Gilles Peskineea0fb492018-07-12 17:17:20 +02003031 PSA_KEY_USAGE_VERIFY |
3032 PSA_KEY_USAGE_DERIVE ) ) != 0 )
mohammad16035feda722018-04-16 04:38:57 -07003033 return( PSA_ERROR_INVALID_ARGUMENT );
mohammad16038cc1cee2018-03-28 01:21:33 +03003034
mohammad16036df908f2018-04-02 08:34:15 -07003035 slot->policy = *policy;
mohammad16038cc1cee2018-03-28 01:21:33 +03003036
3037 return( PSA_SUCCESS );
3038}
3039
Gilles Peskinec5487a82018-12-03 18:08:14 +01003040psa_status_t psa_get_key_policy( psa_key_handle_t handle,
Gilles Peskine2d277862018-06-18 15:41:12 +02003041 psa_key_policy_t *policy )
mohammad16038cc1cee2018-03-28 01:21:33 +03003042{
Gilles Peskine2f060a82018-12-04 17:12:32 +01003043 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003044 psa_status_t status;
mohammad16038cc1cee2018-03-28 01:21:33 +03003045
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003046 if( policy == NULL )
mohammad16038cc1cee2018-03-28 01:21:33 +03003047 return( PSA_ERROR_INVALID_ARGUMENT );
3048
Gilles Peskinec5487a82018-12-03 18:08:14 +01003049 status = psa_get_key_slot( handle, &slot );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003050 if( status != PSA_SUCCESS )
3051 return( status );
Gilles Peskine5b051bc2018-05-31 13:25:48 +02003052
mohammad16036df908f2018-04-02 08:34:15 -07003053 *policy = slot->policy;
mohammad16038cc1cee2018-03-28 01:21:33 +03003054
3055 return( PSA_SUCCESS );
3056}
Gilles Peskine20035e32018-02-03 22:44:14 +01003057
Gilles Peskinea0655c32018-04-30 17:06:50 +02003058
3059
mohammad1603804cd712018-03-20 22:44:08 +02003060/****************************************************************/
3061/* Key Lifetime */
3062/****************************************************************/
3063
Gilles Peskinec5487a82018-12-03 18:08:14 +01003064psa_status_t psa_get_key_lifetime( psa_key_handle_t handle,
Gilles Peskine2d277862018-06-18 15:41:12 +02003065 psa_key_lifetime_t *lifetime )
mohammad1603804cd712018-03-20 22:44:08 +02003066{
Gilles Peskine2f060a82018-12-04 17:12:32 +01003067 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003068 psa_status_t status;
mohammad1603804cd712018-03-20 22:44:08 +02003069
Gilles Peskinec5487a82018-12-03 18:08:14 +01003070 status = psa_get_key_slot( handle, &slot );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003071 if( status != PSA_SUCCESS )
3072 return( status );
Gilles Peskine5b051bc2018-05-31 13:25:48 +02003073
mohammad1603804cd712018-03-20 22:44:08 +02003074 *lifetime = slot->lifetime;
3075
3076 return( PSA_SUCCESS );
3077}
3078
Gilles Peskine20035e32018-02-03 22:44:14 +01003079
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02003080
mohammad16035955c982018-04-26 00:53:03 +03003081/****************************************************************/
3082/* AEAD */
3083/****************************************************************/
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02003084
Gilles Peskineedf9a652018-08-17 18:11:56 +02003085typedef struct
3086{
Gilles Peskine2f060a82018-12-04 17:12:32 +01003087 psa_key_slot_t *slot;
Gilles Peskineedf9a652018-08-17 18:11:56 +02003088 const mbedtls_cipher_info_t *cipher_info;
3089 union
3090 {
3091#if defined(MBEDTLS_CCM_C)
3092 mbedtls_ccm_context ccm;
3093#endif /* MBEDTLS_CCM_C */
3094#if defined(MBEDTLS_GCM_C)
3095 mbedtls_gcm_context gcm;
3096#endif /* MBEDTLS_GCM_C */
3097 } ctx;
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02003098 psa_algorithm_t core_alg;
3099 uint8_t full_tag_length;
Gilles Peskineedf9a652018-08-17 18:11:56 +02003100 uint8_t tag_length;
3101} aead_operation_t;
3102
Gilles Peskinef8a8fe62018-08-21 16:38:05 +02003103static void psa_aead_abort( aead_operation_t *operation )
Gilles Peskineedf9a652018-08-17 18:11:56 +02003104{
Gilles Peskinef8a8fe62018-08-21 16:38:05 +02003105 switch( operation->core_alg )
Gilles Peskineedf9a652018-08-17 18:11:56 +02003106 {
3107#if defined(MBEDTLS_CCM_C)
3108 case PSA_ALG_CCM:
3109 mbedtls_ccm_free( &operation->ctx.ccm );
3110 break;
3111#endif /* MBEDTLS_CCM_C */
Gilles Peskineb0b189f2018-11-28 17:30:58 +01003112#if defined(MBEDTLS_GCM_C)
Gilles Peskineedf9a652018-08-17 18:11:56 +02003113 case PSA_ALG_GCM:
3114 mbedtls_gcm_free( &operation->ctx.gcm );
3115 break;
3116#endif /* MBEDTLS_GCM_C */
3117 }
3118}
3119
3120static psa_status_t psa_aead_setup( aead_operation_t *operation,
Gilles Peskinec5487a82018-12-03 18:08:14 +01003121 psa_key_handle_t handle,
Gilles Peskineedf9a652018-08-17 18:11:56 +02003122 psa_key_usage_t usage,
3123 psa_algorithm_t alg )
3124{
3125 psa_status_t status;
3126 size_t key_bits;
3127 mbedtls_cipher_id_t cipher_id;
3128
Gilles Peskinec5487a82018-12-03 18:08:14 +01003129 status = psa_get_key_from_slot( handle, &operation->slot, usage, alg );
Gilles Peskineedf9a652018-08-17 18:11:56 +02003130 if( status != PSA_SUCCESS )
3131 return( status );
3132
3133 key_bits = psa_get_key_bits( operation->slot );
3134
3135 operation->cipher_info =
3136 mbedtls_cipher_info_from_psa( alg, operation->slot->type, key_bits,
3137 &cipher_id );
3138 if( operation->cipher_info == NULL )
3139 return( PSA_ERROR_NOT_SUPPORTED );
3140
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02003141 switch( PSA_ALG_AEAD_WITH_TAG_LENGTH( alg, 0 ) )
Gilles Peskineedf9a652018-08-17 18:11:56 +02003142 {
3143#if defined(MBEDTLS_CCM_C)
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02003144 case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_CCM, 0 ):
3145 operation->core_alg = PSA_ALG_CCM;
3146 operation->full_tag_length = 16;
Gilles Peskineedf9a652018-08-17 18:11:56 +02003147 if( PSA_BLOCK_CIPHER_BLOCK_SIZE( operation->slot->type ) != 16 )
3148 return( PSA_ERROR_INVALID_ARGUMENT );
3149 mbedtls_ccm_init( &operation->ctx.ccm );
3150 status = mbedtls_to_psa_error(
3151 mbedtls_ccm_setkey( &operation->ctx.ccm, cipher_id,
3152 operation->slot->data.raw.data,
3153 (unsigned int) key_bits ) );
3154 if( status != 0 )
3155 goto cleanup;
3156 break;
3157#endif /* MBEDTLS_CCM_C */
3158
3159#if defined(MBEDTLS_GCM_C)
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02003160 case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_GCM, 0 ):
3161 operation->core_alg = PSA_ALG_GCM;
3162 operation->full_tag_length = 16;
Gilles Peskineedf9a652018-08-17 18:11:56 +02003163 if( PSA_BLOCK_CIPHER_BLOCK_SIZE( operation->slot->type ) != 16 )
3164 return( PSA_ERROR_INVALID_ARGUMENT );
3165 mbedtls_gcm_init( &operation->ctx.gcm );
3166 status = mbedtls_to_psa_error(
3167 mbedtls_gcm_setkey( &operation->ctx.gcm, cipher_id,
3168 operation->slot->data.raw.data,
3169 (unsigned int) key_bits ) );
3170 break;
3171#endif /* MBEDTLS_GCM_C */
3172
3173 default:
3174 return( PSA_ERROR_NOT_SUPPORTED );
3175 }
3176
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02003177 if( PSA_AEAD_TAG_LENGTH( alg ) > operation->full_tag_length )
3178 {
3179 status = PSA_ERROR_INVALID_ARGUMENT;
3180 goto cleanup;
3181 }
3182 operation->tag_length = PSA_AEAD_TAG_LENGTH( alg );
3183 /* CCM allows the following tag lengths: 4, 6, 8, 10, 12, 14, 16.
3184 * GCM allows the following tag lengths: 4, 8, 12, 13, 14, 15, 16.
3185 * In both cases, mbedtls_xxx will validate the tag length below. */
3186
Gilles Peskineedf9a652018-08-17 18:11:56 +02003187 return( PSA_SUCCESS );
3188
3189cleanup:
Gilles Peskinef8a8fe62018-08-21 16:38:05 +02003190 psa_aead_abort( operation );
Gilles Peskineedf9a652018-08-17 18:11:56 +02003191 return( status );
3192}
3193
Gilles Peskinec5487a82018-12-03 18:08:14 +01003194psa_status_t psa_aead_encrypt( psa_key_handle_t handle,
mohammad16035955c982018-04-26 00:53:03 +03003195 psa_algorithm_t alg,
3196 const uint8_t *nonce,
3197 size_t nonce_length,
3198 const uint8_t *additional_data,
3199 size_t additional_data_length,
3200 const uint8_t *plaintext,
3201 size_t plaintext_length,
3202 uint8_t *ciphertext,
3203 size_t ciphertext_size,
3204 size_t *ciphertext_length )
3205{
mohammad16035955c982018-04-26 00:53:03 +03003206 psa_status_t status;
Gilles Peskineedf9a652018-08-17 18:11:56 +02003207 aead_operation_t operation;
mohammad160315223a82018-06-03 17:19:55 +03003208 uint8_t *tag;
Gilles Peskine2d277862018-06-18 15:41:12 +02003209
mohammad1603f08a5502018-06-03 15:05:47 +03003210 *ciphertext_length = 0;
mohammad1603e58e6842018-05-09 04:58:32 -07003211
Gilles Peskinec5487a82018-12-03 18:08:14 +01003212 status = psa_aead_setup( &operation, handle, PSA_KEY_USAGE_ENCRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003213 if( status != PSA_SUCCESS )
3214 return( status );
mohammad16035955c982018-04-26 00:53:03 +03003215
Gilles Peskineedf9a652018-08-17 18:11:56 +02003216 /* For all currently supported modes, the tag is at the end of the
3217 * ciphertext. */
3218 if( ciphertext_size < ( plaintext_length + operation.tag_length ) )
3219 {
3220 status = PSA_ERROR_BUFFER_TOO_SMALL;
3221 goto exit;
3222 }
3223 tag = ciphertext + plaintext_length;
mohammad16035955c982018-04-26 00:53:03 +03003224
Gilles Peskineb0b189f2018-11-28 17:30:58 +01003225#if defined(MBEDTLS_GCM_C)
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02003226 if( operation.core_alg == PSA_ALG_GCM )
mohammad16035955c982018-04-26 00:53:03 +03003227 {
Gilles Peskineedf9a652018-08-17 18:11:56 +02003228 status = mbedtls_to_psa_error(
3229 mbedtls_gcm_crypt_and_tag( &operation.ctx.gcm,
3230 MBEDTLS_GCM_ENCRYPT,
3231 plaintext_length,
3232 nonce, nonce_length,
3233 additional_data, additional_data_length,
3234 plaintext, ciphertext,
3235 operation.tag_length, tag ) );
mohammad16035955c982018-04-26 00:53:03 +03003236 }
Gilles Peskineb0b189f2018-11-28 17:30:58 +01003237 else
3238#endif /* MBEDTLS_GCM_C */
3239#if defined(MBEDTLS_CCM_C)
3240 if( operation.core_alg == PSA_ALG_CCM )
mohammad16035955c982018-04-26 00:53:03 +03003241 {
Gilles Peskineedf9a652018-08-17 18:11:56 +02003242 status = mbedtls_to_psa_error(
3243 mbedtls_ccm_encrypt_and_tag( &operation.ctx.ccm,
3244 plaintext_length,
3245 nonce, nonce_length,
3246 additional_data,
3247 additional_data_length,
3248 plaintext, ciphertext,
3249 tag, operation.tag_length ) );
mohammad16035955c982018-04-26 00:53:03 +03003250 }
mohammad16035c8845f2018-05-09 05:40:09 -07003251 else
Gilles Peskineb0b189f2018-11-28 17:30:58 +01003252#endif /* MBEDTLS_CCM_C */
mohammad16035c8845f2018-05-09 05:40:09 -07003253 {
mohammad1603554faad2018-06-03 15:07:38 +03003254 return( PSA_ERROR_NOT_SUPPORTED );
mohammad16035c8845f2018-05-09 05:40:09 -07003255 }
Gilles Peskine2d277862018-06-18 15:41:12 +02003256
Gilles Peskineedf9a652018-08-17 18:11:56 +02003257 if( status != PSA_SUCCESS && ciphertext_size != 0 )
3258 memset( ciphertext, 0, ciphertext_size );
Gilles Peskine2d277862018-06-18 15:41:12 +02003259
Gilles Peskineedf9a652018-08-17 18:11:56 +02003260exit:
Gilles Peskinef8a8fe62018-08-21 16:38:05 +02003261 psa_aead_abort( &operation );
Gilles Peskineedf9a652018-08-17 18:11:56 +02003262 if( status == PSA_SUCCESS )
3263 *ciphertext_length = plaintext_length + operation.tag_length;
3264 return( status );
mohammad16035955c982018-04-26 00:53:03 +03003265}
3266
Gilles Peskineee652a32018-06-01 19:23:52 +02003267/* Locate the tag in a ciphertext buffer containing the encrypted data
3268 * followed by the tag. Return the length of the part preceding the tag in
3269 * *plaintext_length. This is the size of the plaintext in modes where
3270 * the encrypted data has the same size as the plaintext, such as
3271 * CCM and GCM. */
3272static psa_status_t psa_aead_unpadded_locate_tag( size_t tag_length,
3273 const uint8_t *ciphertext,
3274 size_t ciphertext_length,
3275 size_t plaintext_size,
Gilles Peskineee652a32018-06-01 19:23:52 +02003276 const uint8_t **p_tag )
3277{
3278 size_t payload_length;
3279 if( tag_length > ciphertext_length )
3280 return( PSA_ERROR_INVALID_ARGUMENT );
3281 payload_length = ciphertext_length - tag_length;
3282 if( payload_length > plaintext_size )
3283 return( PSA_ERROR_BUFFER_TOO_SMALL );
3284 *p_tag = ciphertext + payload_length;
Gilles Peskineee652a32018-06-01 19:23:52 +02003285 return( PSA_SUCCESS );
3286}
3287
Gilles Peskinec5487a82018-12-03 18:08:14 +01003288psa_status_t psa_aead_decrypt( psa_key_handle_t handle,
mohammad16035955c982018-04-26 00:53:03 +03003289 psa_algorithm_t alg,
3290 const uint8_t *nonce,
3291 size_t nonce_length,
3292 const uint8_t *additional_data,
3293 size_t additional_data_length,
3294 const uint8_t *ciphertext,
3295 size_t ciphertext_length,
3296 uint8_t *plaintext,
3297 size_t plaintext_size,
3298 size_t *plaintext_length )
3299{
mohammad16035955c982018-04-26 00:53:03 +03003300 psa_status_t status;
Gilles Peskineedf9a652018-08-17 18:11:56 +02003301 aead_operation_t operation;
3302 const uint8_t *tag = NULL;
Gilles Peskine2d277862018-06-18 15:41:12 +02003303
Gilles Peskineee652a32018-06-01 19:23:52 +02003304 *plaintext_length = 0;
mohammad16039e5a5152018-04-26 12:07:35 +03003305
Gilles Peskinec5487a82018-12-03 18:08:14 +01003306 status = psa_aead_setup( &operation, handle, PSA_KEY_USAGE_DECRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003307 if( status != PSA_SUCCESS )
3308 return( status );
mohammad16035955c982018-04-26 00:53:03 +03003309
Gilles Peskineb0b189f2018-11-28 17:30:58 +01003310#if defined(MBEDTLS_GCM_C)
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02003311 if( operation.core_alg == PSA_ALG_GCM )
mohammad16035955c982018-04-26 00:53:03 +03003312 {
Gilles Peskineedf9a652018-08-17 18:11:56 +02003313 status = psa_aead_unpadded_locate_tag( operation.tag_length,
Gilles Peskineee652a32018-06-01 19:23:52 +02003314 ciphertext, ciphertext_length,
mohammad160360a64d02018-06-03 17:20:42 +03003315 plaintext_size, &tag );
Gilles Peskineee652a32018-06-01 19:23:52 +02003316 if( status != PSA_SUCCESS )
Gilles Peskineedf9a652018-08-17 18:11:56 +02003317 goto exit;
Gilles Peskineee652a32018-06-01 19:23:52 +02003318
Gilles Peskineedf9a652018-08-17 18:11:56 +02003319 status = mbedtls_to_psa_error(
3320 mbedtls_gcm_auth_decrypt( &operation.ctx.gcm,
3321 ciphertext_length - operation.tag_length,
3322 nonce, nonce_length,
3323 additional_data,
3324 additional_data_length,
3325 tag, operation.tag_length,
3326 ciphertext, plaintext ) );
mohammad16035955c982018-04-26 00:53:03 +03003327 }
Gilles Peskineb0b189f2018-11-28 17:30:58 +01003328 else
3329#endif /* MBEDTLS_GCM_C */
3330#if defined(MBEDTLS_CCM_C)
3331 if( operation.core_alg == PSA_ALG_CCM )
mohammad16035955c982018-04-26 00:53:03 +03003332 {
Gilles Peskineedf9a652018-08-17 18:11:56 +02003333 status = psa_aead_unpadded_locate_tag( operation.tag_length,
mohammad16039375f842018-06-03 14:28:24 +03003334 ciphertext, ciphertext_length,
mohammad160360a64d02018-06-03 17:20:42 +03003335 plaintext_size, &tag );
mohammad16039375f842018-06-03 14:28:24 +03003336 if( status != PSA_SUCCESS )
Gilles Peskineedf9a652018-08-17 18:11:56 +02003337 goto exit;
mohammad16039375f842018-06-03 14:28:24 +03003338
Gilles Peskineedf9a652018-08-17 18:11:56 +02003339 status = mbedtls_to_psa_error(
3340 mbedtls_ccm_auth_decrypt( &operation.ctx.ccm,
3341 ciphertext_length - operation.tag_length,
3342 nonce, nonce_length,
3343 additional_data,
3344 additional_data_length,
3345 ciphertext, plaintext,
3346 tag, operation.tag_length ) );
mohammad16035955c982018-04-26 00:53:03 +03003347 }
mohammad160339574652018-06-01 04:39:53 -07003348 else
Gilles Peskineb0b189f2018-11-28 17:30:58 +01003349#endif /* MBEDTLS_CCM_C */
mohammad160339574652018-06-01 04:39:53 -07003350 {
mohammad1603554faad2018-06-03 15:07:38 +03003351 return( PSA_ERROR_NOT_SUPPORTED );
mohammad160339574652018-06-01 04:39:53 -07003352 }
Gilles Peskinea40d7742018-06-01 16:28:30 +02003353
Gilles Peskineedf9a652018-08-17 18:11:56 +02003354 if( status != PSA_SUCCESS && plaintext_size != 0 )
3355 memset( plaintext, 0, plaintext_size );
mohammad160360a64d02018-06-03 17:20:42 +03003356
Gilles Peskineedf9a652018-08-17 18:11:56 +02003357exit:
Gilles Peskinef8a8fe62018-08-21 16:38:05 +02003358 psa_aead_abort( &operation );
Gilles Peskineedf9a652018-08-17 18:11:56 +02003359 if( status == PSA_SUCCESS )
3360 *plaintext_length = ciphertext_length - operation.tag_length;
3361 return( status );
mohammad16035955c982018-04-26 00:53:03 +03003362}
3363
Gilles Peskinea0655c32018-04-30 17:06:50 +02003364
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02003365
Gilles Peskine20035e32018-02-03 22:44:14 +01003366/****************************************************************/
Gilles Peskineeab56e42018-07-12 17:12:33 +02003367/* Generators */
3368/****************************************************************/
3369
3370psa_status_t psa_generator_abort( psa_crypto_generator_t *generator )
3371{
3372 psa_status_t status = PSA_SUCCESS;
3373 if( generator->alg == 0 )
3374 {
3375 /* The object has (apparently) been initialized but it is not
3376 * in use. It's ok to call abort on such an object, and there's
3377 * nothing to do. */
3378 }
3379 else
Gilles Peskine751d9652018-09-18 12:05:44 +02003380 if( generator->alg == PSA_ALG_SELECT_RAW )
3381 {
3382 if( generator->ctx.buffer.data != NULL )
3383 {
Gilles Peskine3f108122018-12-07 18:14:53 +01003384 mbedtls_platform_zeroize( generator->ctx.buffer.data,
Gilles Peskine751d9652018-09-18 12:05:44 +02003385 generator->ctx.buffer.size );
3386 mbedtls_free( generator->ctx.buffer.data );
3387 }
3388 }
3389 else
Gilles Peskinebef7f142018-07-12 17:22:21 +02003390#if defined(MBEDTLS_MD_C)
3391 if( PSA_ALG_IS_HKDF( generator->alg ) )
3392 {
3393 mbedtls_free( generator->ctx.hkdf.info );
3394 status = psa_hmac_abort_internal( &generator->ctx.hkdf.hmac );
3395 }
Hanno Becker1aaedc02018-11-16 11:35:34 +00003396 else if( PSA_ALG_IS_TLS12_PRF( generator->alg ) ||
3397 /* TLS-1.2 PSK-to-MS KDF uses the same generator as TLS-1.2 PRF */
3398 PSA_ALG_IS_TLS12_PSK_TO_MS( generator->alg ) )
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003399 {
3400 if( generator->ctx.tls12_prf.key != NULL )
3401 {
Gilles Peskine3f108122018-12-07 18:14:53 +01003402 mbedtls_platform_zeroize( generator->ctx.tls12_prf.key,
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003403 generator->ctx.tls12_prf.key_len );
3404 mbedtls_free( generator->ctx.tls12_prf.key );
3405 }
Hanno Becker580fba12018-11-13 20:50:45 +00003406
3407 if( generator->ctx.tls12_prf.Ai_with_seed != NULL )
3408 {
Gilles Peskine3f108122018-12-07 18:14:53 +01003409 mbedtls_platform_zeroize( generator->ctx.tls12_prf.Ai_with_seed,
Hanno Becker580fba12018-11-13 20:50:45 +00003410 generator->ctx.tls12_prf.Ai_with_seed_len );
3411 mbedtls_free( generator->ctx.tls12_prf.Ai_with_seed );
3412 }
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003413 }
Gilles Peskinebef7f142018-07-12 17:22:21 +02003414 else
3415#endif /* MBEDTLS_MD_C */
Gilles Peskineeab56e42018-07-12 17:12:33 +02003416 {
3417 status = PSA_ERROR_BAD_STATE;
3418 }
3419 memset( generator, 0, sizeof( *generator ) );
3420 return( status );
3421}
3422
3423
3424psa_status_t psa_get_generator_capacity(const psa_crypto_generator_t *generator,
3425 size_t *capacity)
3426{
3427 *capacity = generator->capacity;
3428 return( PSA_SUCCESS );
3429}
3430
Gilles Peskinebef7f142018-07-12 17:22:21 +02003431#if defined(MBEDTLS_MD_C)
3432/* Read some bytes from an HKDF-based generator. This performs a chunk
3433 * of the expand phase of the HKDF algorithm. */
3434static psa_status_t psa_generator_hkdf_read( psa_hkdf_generator_t *hkdf,
3435 psa_algorithm_t hash_alg,
3436 uint8_t *output,
3437 size_t output_length )
3438{
3439 uint8_t hash_length = PSA_HASH_SIZE( hash_alg );
3440 psa_status_t status;
3441
3442 while( output_length != 0 )
3443 {
3444 /* Copy what remains of the current block */
3445 uint8_t n = hash_length - hkdf->offset_in_block;
3446 if( n > output_length )
3447 n = (uint8_t) output_length;
3448 memcpy( output, hkdf->output_block + hkdf->offset_in_block, n );
3449 output += n;
3450 output_length -= n;
3451 hkdf->offset_in_block += n;
Gilles Peskined54931c2018-07-17 21:06:59 +02003452 if( output_length == 0 )
Gilles Peskinebef7f142018-07-12 17:22:21 +02003453 break;
Gilles Peskined54931c2018-07-17 21:06:59 +02003454 /* We can't be wanting more output after block 0xff, otherwise
3455 * the capacity check in psa_generator_read() would have
3456 * prevented this call. It could happen only if the generator
3457 * object was corrupted or if this function is called directly
3458 * inside the library. */
3459 if( hkdf->block_number == 0xff )
3460 return( PSA_ERROR_BAD_STATE );
Gilles Peskinebef7f142018-07-12 17:22:21 +02003461
3462 /* We need a new block */
3463 ++hkdf->block_number;
3464 hkdf->offset_in_block = 0;
3465 status = psa_hmac_setup_internal( &hkdf->hmac,
3466 hkdf->prk, hash_length,
3467 hash_alg );
3468 if( status != PSA_SUCCESS )
3469 return( status );
3470 if( hkdf->block_number != 1 )
3471 {
3472 status = psa_hash_update( &hkdf->hmac.hash_ctx,
3473 hkdf->output_block,
3474 hash_length );
3475 if( status != PSA_SUCCESS )
3476 return( status );
3477 }
3478 status = psa_hash_update( &hkdf->hmac.hash_ctx,
3479 hkdf->info,
3480 hkdf->info_length );
3481 if( status != PSA_SUCCESS )
3482 return( status );
3483 status = psa_hash_update( &hkdf->hmac.hash_ctx,
3484 &hkdf->block_number, 1 );
3485 if( status != PSA_SUCCESS )
3486 return( status );
3487 status = psa_hmac_finish_internal( &hkdf->hmac,
3488 hkdf->output_block,
3489 sizeof( hkdf->output_block ) );
3490 if( status != PSA_SUCCESS )
3491 return( status );
3492 }
3493
3494 return( PSA_SUCCESS );
3495}
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003496
3497static psa_status_t psa_generator_tls12_prf_generate_next_block(
3498 psa_tls12_prf_generator_t *tls12_prf,
3499 psa_algorithm_t alg )
3500{
3501 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( alg );
3502 uint8_t hash_length = PSA_HASH_SIZE( hash_alg );
3503 psa_hmac_internal_data hmac;
3504 psa_status_t status, cleanup_status;
3505
Hanno Becker3b339e22018-11-13 20:56:14 +00003506 unsigned char *Ai;
3507 size_t Ai_len;
3508
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003509 /* We can't be wanting more output after block 0xff, otherwise
3510 * the capacity check in psa_generator_read() would have
3511 * prevented this call. It could happen only if the generator
3512 * object was corrupted or if this function is called directly
3513 * inside the library. */
3514 if( tls12_prf->block_number == 0xff )
3515 return( PSA_ERROR_BAD_STATE );
3516
3517 /* We need a new block */
3518 ++tls12_prf->block_number;
3519 tls12_prf->offset_in_block = 0;
3520
3521 /* Recall the definition of the TLS-1.2-PRF from RFC 5246:
3522 *
3523 * PRF(secret, label, seed) = P_<hash>(secret, label + seed)
3524 *
3525 * P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
3526 * HMAC_hash(secret, A(2) + seed) +
3527 * HMAC_hash(secret, A(3) + seed) + ...
3528 *
3529 * A(0) = seed
3530 * A(i) = HMAC_hash( secret, A(i-1) )
3531 *
3532 * The `psa_tls12_prf_generator` structures saves the block
3533 * `HMAC_hash(secret, A(i) + seed)` from which the output
3534 * is currently extracted as `output_block`, while
3535 * `A(i) + seed` is stored in `Ai_with_seed`.
3536 *
3537 * Generating a new block means recalculating `Ai_with_seed`
3538 * from the A(i)-part of it, and afterwards recalculating
3539 * `output_block`.
3540 *
3541 * A(0) is computed at setup time.
3542 *
3543 */
3544
3545 psa_hmac_init_internal( &hmac );
3546
3547 /* We must distinguish the calculation of A(1) from those
3548 * of A(2) and higher, because A(0)=seed has a different
3549 * length than the other A(i). */
3550 if( tls12_prf->block_number == 1 )
3551 {
Hanno Becker3b339e22018-11-13 20:56:14 +00003552 Ai = tls12_prf->Ai_with_seed + hash_length;
3553 Ai_len = tls12_prf->Ai_with_seed_len - hash_length;
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003554 }
3555 else
3556 {
Hanno Becker3b339e22018-11-13 20:56:14 +00003557 Ai = tls12_prf->Ai_with_seed;
3558 Ai_len = hash_length;
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003559 }
3560
Hanno Becker3b339e22018-11-13 20:56:14 +00003561 /* Compute A(i+1) = HMAC_hash(secret, A(i)) */
3562 status = psa_hmac_setup_internal( &hmac,
3563 tls12_prf->key,
3564 tls12_prf->key_len,
3565 hash_alg );
3566 if( status != PSA_SUCCESS )
3567 goto cleanup;
3568
3569 status = psa_hash_update( &hmac.hash_ctx,
3570 Ai, Ai_len );
3571 if( status != PSA_SUCCESS )
3572 goto cleanup;
3573
3574 status = psa_hmac_finish_internal( &hmac,
3575 tls12_prf->Ai_with_seed,
3576 hash_length );
3577 if( status != PSA_SUCCESS )
3578 goto cleanup;
3579
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003580 /* Compute the next block `HMAC_hash(secret, A(i+1) + seed)`. */
3581 status = psa_hmac_setup_internal( &hmac,
3582 tls12_prf->key,
3583 tls12_prf->key_len,
3584 hash_alg );
3585 if( status != PSA_SUCCESS )
3586 goto cleanup;
3587
3588 status = psa_hash_update( &hmac.hash_ctx,
3589 tls12_prf->Ai_with_seed,
Hanno Becker580fba12018-11-13 20:50:45 +00003590 tls12_prf->Ai_with_seed_len );
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003591 if( status != PSA_SUCCESS )
3592 goto cleanup;
3593
3594 status = psa_hmac_finish_internal( &hmac,
3595 tls12_prf->output_block,
3596 hash_length );
3597 if( status != PSA_SUCCESS )
3598 goto cleanup;
3599
3600cleanup:
3601
3602 cleanup_status = psa_hmac_abort_internal( &hmac );
3603 if( status == PSA_SUCCESS && cleanup_status != PSA_SUCCESS )
3604 status = cleanup_status;
3605
3606 return( status );
3607}
3608
3609/* Read some bytes from an TLS-1.2-PRF-based generator.
3610 * See Section 5 of RFC 5246. */
3611static psa_status_t psa_generator_tls12_prf_read(
3612 psa_tls12_prf_generator_t *tls12_prf,
3613 psa_algorithm_t alg,
3614 uint8_t *output,
3615 size_t output_length )
3616{
3617 psa_algorithm_t hash_alg = PSA_ALG_TLS12_PRF_GET_HASH( alg );
3618 uint8_t hash_length = PSA_HASH_SIZE( hash_alg );
3619 psa_status_t status;
3620
3621 while( output_length != 0 )
3622 {
3623 /* Copy what remains of the current block */
3624 uint8_t n = hash_length - tls12_prf->offset_in_block;
3625
3626 /* Check if we have fully processed the current block. */
3627 if( n == 0 )
3628 {
3629 status = psa_generator_tls12_prf_generate_next_block( tls12_prf,
3630 alg );
3631 if( status != PSA_SUCCESS )
3632 return( status );
3633
3634 continue;
3635 }
3636
3637 if( n > output_length )
3638 n = (uint8_t) output_length;
3639 memcpy( output, tls12_prf->output_block + tls12_prf->offset_in_block,
3640 n );
3641 output += n;
3642 output_length -= n;
3643 tls12_prf->offset_in_block += n;
3644 }
3645
3646 return( PSA_SUCCESS );
3647}
Gilles Peskinebef7f142018-07-12 17:22:21 +02003648#endif /* MBEDTLS_MD_C */
3649
Gilles Peskineeab56e42018-07-12 17:12:33 +02003650psa_status_t psa_generator_read( psa_crypto_generator_t *generator,
3651 uint8_t *output,
3652 size_t output_length )
3653{
3654 psa_status_t status;
3655
3656 if( output_length > generator->capacity )
3657 {
3658 generator->capacity = 0;
3659 /* Go through the error path to wipe all confidential data now
3660 * that the generator object is useless. */
3661 status = PSA_ERROR_INSUFFICIENT_CAPACITY;
3662 goto exit;
3663 }
3664 if( output_length == 0 &&
3665 generator->capacity == 0 && generator->alg == 0 )
3666 {
3667 /* Edge case: this is a blank or finished generator, and 0
3668 * bytes were requested. The right error in this case could
3669 * be either INSUFFICIENT_CAPACITY or BAD_STATE. Return
3670 * INSUFFICIENT_CAPACITY, which is right for a finished
3671 * generator, for consistency with the case when
3672 * output_length > 0. */
3673 return( PSA_ERROR_INSUFFICIENT_CAPACITY );
3674 }
3675 generator->capacity -= output_length;
3676
Gilles Peskine751d9652018-09-18 12:05:44 +02003677 if( generator->alg == PSA_ALG_SELECT_RAW )
3678 {
Gilles Peskine211a4362018-10-25 22:22:31 +02003679 /* Initially, the capacity of a selection generator is always
3680 * the size of the buffer, i.e. `generator->ctx.buffer.size`,
3681 * abbreviated in this comment as `size`. When the remaining
3682 * capacity is `c`, the next bytes to serve start `c` bytes
3683 * from the end of the buffer, i.e. `size - c` from the
3684 * beginning of the buffer. Since `generator->capacity` was just
3685 * decremented above, we need to serve the bytes from
3686 * `size - generator->capacity - output_length` to
3687 * `size - generator->capacity`. */
Gilles Peskine751d9652018-09-18 12:05:44 +02003688 size_t offset =
3689 generator->ctx.buffer.size - generator->capacity - output_length;
3690 memcpy( output, generator->ctx.buffer.data + offset, output_length );
3691 status = PSA_SUCCESS;
3692 }
3693 else
Gilles Peskinebef7f142018-07-12 17:22:21 +02003694#if defined(MBEDTLS_MD_C)
3695 if( PSA_ALG_IS_HKDF( generator->alg ) )
3696 {
3697 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( generator->alg );
3698 status = psa_generator_hkdf_read( &generator->ctx.hkdf, hash_alg,
3699 output, output_length );
3700 }
Hanno Becker1aaedc02018-11-16 11:35:34 +00003701 else if( PSA_ALG_IS_TLS12_PRF( generator->alg ) ||
3702 PSA_ALG_IS_TLS12_PSK_TO_MS( generator->alg ) )
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003703 {
3704 status = psa_generator_tls12_prf_read( &generator->ctx.tls12_prf,
3705 generator->alg, output,
3706 output_length );
3707 }
Gilles Peskinebef7f142018-07-12 17:22:21 +02003708 else
3709#endif /* MBEDTLS_MD_C */
Gilles Peskineeab56e42018-07-12 17:12:33 +02003710 {
3711 return( PSA_ERROR_BAD_STATE );
3712 }
3713
3714exit:
3715 if( status != PSA_SUCCESS )
3716 {
3717 psa_generator_abort( generator );
3718 memset( output, '!', output_length );
3719 }
3720 return( status );
3721}
3722
Gilles Peskine08542d82018-07-19 17:05:42 +02003723#if defined(MBEDTLS_DES_C)
3724static void psa_des_set_key_parity( uint8_t *data, size_t data_size )
3725{
3726 if( data_size >= 8 )
3727 mbedtls_des_key_set_parity( data );
3728 if( data_size >= 16 )
3729 mbedtls_des_key_set_parity( data + 8 );
3730 if( data_size >= 24 )
3731 mbedtls_des_key_set_parity( data + 16 );
3732}
3733#endif /* MBEDTLS_DES_C */
3734
Gilles Peskinec5487a82018-12-03 18:08:14 +01003735psa_status_t psa_generator_import_key( psa_key_handle_t handle,
Gilles Peskineeab56e42018-07-12 17:12:33 +02003736 psa_key_type_t type,
3737 size_t bits,
3738 psa_crypto_generator_t *generator )
3739{
3740 uint8_t *data = NULL;
3741 size_t bytes = PSA_BITS_TO_BYTES( bits );
3742 psa_status_t status;
3743
3744 if( ! key_type_is_raw_bytes( type ) )
3745 return( PSA_ERROR_INVALID_ARGUMENT );
3746 if( bits % 8 != 0 )
3747 return( PSA_ERROR_INVALID_ARGUMENT );
3748 data = mbedtls_calloc( 1, bytes );
3749 if( data == NULL )
3750 return( PSA_ERROR_INSUFFICIENT_MEMORY );
3751
3752 status = psa_generator_read( generator, data, bytes );
3753 if( status != PSA_SUCCESS )
3754 goto exit;
Gilles Peskine08542d82018-07-19 17:05:42 +02003755#if defined(MBEDTLS_DES_C)
3756 if( type == PSA_KEY_TYPE_DES )
3757 psa_des_set_key_parity( data, bytes );
3758#endif /* MBEDTLS_DES_C */
Gilles Peskinec5487a82018-12-03 18:08:14 +01003759 status = psa_import_key( handle, type, data, bytes );
Gilles Peskineeab56e42018-07-12 17:12:33 +02003760
3761exit:
3762 mbedtls_free( data );
3763 return( status );
3764}
3765
3766
3767
3768/****************************************************************/
Gilles Peskineea0fb492018-07-12 17:17:20 +02003769/* Key derivation */
3770/****************************************************************/
3771
Gilles Peskinea05219c2018-11-16 16:02:56 +01003772#if defined(MBEDTLS_MD_C)
Gilles Peskinebef7f142018-07-12 17:22:21 +02003773/* Set up an HKDF-based generator. This is exactly the extract phase
Gilles Peskine346797d2018-11-16 16:05:06 +01003774 * of the HKDF algorithm.
3775 *
3776 * Note that if this function fails, you must call psa_generator_abort()
3777 * to potentially free embedded data structures and wipe confidential data.
3778 */
Gilles Peskinebef7f142018-07-12 17:22:21 +02003779static psa_status_t psa_generator_hkdf_setup( psa_hkdf_generator_t *hkdf,
Gilles Peskinecce18ae2018-09-18 12:03:52 +02003780 const uint8_t *secret,
3781 size_t secret_length,
Gilles Peskinebef7f142018-07-12 17:22:21 +02003782 psa_algorithm_t hash_alg,
3783 const uint8_t *salt,
3784 size_t salt_length,
3785 const uint8_t *label,
3786 size_t label_length )
3787{
3788 psa_status_t status;
3789 status = psa_hmac_setup_internal( &hkdf->hmac,
3790 salt, salt_length,
Gilles Peskine00709fa2018-08-22 18:25:41 +02003791 PSA_ALG_HMAC_GET_HASH( hash_alg ) );
Gilles Peskinebef7f142018-07-12 17:22:21 +02003792 if( status != PSA_SUCCESS )
3793 return( status );
Gilles Peskinecce18ae2018-09-18 12:03:52 +02003794 status = psa_hash_update( &hkdf->hmac.hash_ctx, secret, secret_length );
Gilles Peskinebef7f142018-07-12 17:22:21 +02003795 if( status != PSA_SUCCESS )
3796 return( status );
3797 status = psa_hmac_finish_internal( &hkdf->hmac,
3798 hkdf->prk,
3799 sizeof( hkdf->prk ) );
3800 if( status != PSA_SUCCESS )
3801 return( status );
3802 hkdf->offset_in_block = PSA_HASH_SIZE( hash_alg );
3803 hkdf->block_number = 0;
3804 hkdf->info_length = label_length;
3805 if( label_length != 0 )
3806 {
3807 hkdf->info = mbedtls_calloc( 1, label_length );
3808 if( hkdf->info == NULL )
3809 return( PSA_ERROR_INSUFFICIENT_MEMORY );
3810 memcpy( hkdf->info, label, label_length );
3811 }
3812 return( PSA_SUCCESS );
3813}
Gilles Peskinea05219c2018-11-16 16:02:56 +01003814#endif /* MBEDTLS_MD_C */
Gilles Peskinebef7f142018-07-12 17:22:21 +02003815
Gilles Peskinea05219c2018-11-16 16:02:56 +01003816#if defined(MBEDTLS_MD_C)
Gilles Peskine346797d2018-11-16 16:05:06 +01003817/* Set up a TLS-1.2-prf-based generator (see RFC 5246, Section 5).
3818 *
3819 * Note that if this function fails, you must call psa_generator_abort()
3820 * to potentially free embedded data structures and wipe confidential data.
3821 */
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003822static psa_status_t psa_generator_tls12_prf_setup(
3823 psa_tls12_prf_generator_t *tls12_prf,
3824 const unsigned char *key,
3825 size_t key_len,
3826 psa_algorithm_t hash_alg,
3827 const uint8_t *salt,
3828 size_t salt_length,
3829 const uint8_t *label,
3830 size_t label_length )
3831{
3832 uint8_t hash_length = PSA_HASH_SIZE( hash_alg );
Hanno Becker580fba12018-11-13 20:50:45 +00003833 size_t Ai_with_seed_len = hash_length + salt_length + label_length;
3834 int overflow;
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003835
3836 tls12_prf->key = mbedtls_calloc( 1, key_len );
3837 if( tls12_prf->key == NULL )
3838 return( PSA_ERROR_INSUFFICIENT_MEMORY );
3839 tls12_prf->key_len = key_len;
3840 memcpy( tls12_prf->key, key, key_len );
3841
Hanno Becker580fba12018-11-13 20:50:45 +00003842 overflow = ( salt_length + label_length < salt_length ) ||
3843 ( salt_length + label_length + hash_length < hash_length );
3844 if( overflow )
3845 return( PSA_ERROR_INVALID_ARGUMENT );
3846
3847 tls12_prf->Ai_with_seed = mbedtls_calloc( 1, Ai_with_seed_len );
3848 if( tls12_prf->Ai_with_seed == NULL )
3849 return( PSA_ERROR_INSUFFICIENT_MEMORY );
3850 tls12_prf->Ai_with_seed_len = Ai_with_seed_len;
3851
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003852 /* Write `label + seed' at the end of the `A(i) + seed` buffer,
3853 * leaving the initial `hash_length` bytes unspecified for now. */
Hanno Becker353e4532018-11-15 09:53:57 +00003854 if( label_length != 0 )
3855 {
3856 memcpy( tls12_prf->Ai_with_seed + hash_length,
3857 label, label_length );
3858 }
3859
3860 if( salt_length != 0 )
3861 {
3862 memcpy( tls12_prf->Ai_with_seed + hash_length + label_length,
3863 salt, salt_length );
3864 }
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003865
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003866 /* The first block gets generated when
3867 * psa_generator_read() is called. */
3868 tls12_prf->block_number = 0;
3869 tls12_prf->offset_in_block = hash_length;
3870
3871 return( PSA_SUCCESS );
3872}
Hanno Becker1aaedc02018-11-16 11:35:34 +00003873
3874/* Set up a TLS-1.2-PSK-to-MS-based generator. */
3875static psa_status_t psa_generator_tls12_psk_to_ms_setup(
3876 psa_tls12_prf_generator_t *tls12_prf,
3877 const unsigned char *psk,
3878 size_t psk_len,
3879 psa_algorithm_t hash_alg,
3880 const uint8_t *salt,
3881 size_t salt_length,
3882 const uint8_t *label,
3883 size_t label_length )
3884{
3885 psa_status_t status;
3886 unsigned char pms[ 4 + 2 * PSA_ALG_TLS12_PSK_TO_MS_MAX_PSK_LEN ];
3887
3888 if( psk_len > PSA_ALG_TLS12_PSK_TO_MS_MAX_PSK_LEN )
3889 return( PSA_ERROR_INVALID_ARGUMENT );
3890
3891 /* Quoting RFC 4279, Section 2:
3892 *
3893 * The premaster secret is formed as follows: if the PSK is N octets
3894 * long, concatenate a uint16 with the value N, N zero octets, a second
3895 * uint16 with the value N, and the PSK itself.
3896 */
3897
3898 pms[0] = ( psk_len >> 8 ) & 0xff;
3899 pms[1] = ( psk_len >> 0 ) & 0xff;
3900 memset( pms + 2, 0, psk_len );
3901 pms[2 + psk_len + 0] = pms[0];
3902 pms[2 + psk_len + 1] = pms[1];
3903 memcpy( pms + 4 + psk_len, psk, psk_len );
3904
3905 status = psa_generator_tls12_prf_setup( tls12_prf,
3906 pms, 4 + 2 * psk_len,
3907 hash_alg,
3908 salt, salt_length,
3909 label, label_length );
3910
Gilles Peskine3f108122018-12-07 18:14:53 +01003911 mbedtls_platform_zeroize( pms, sizeof( pms ) );
Hanno Becker1aaedc02018-11-16 11:35:34 +00003912 return( status );
3913}
Gilles Peskinea05219c2018-11-16 16:02:56 +01003914#endif /* MBEDTLS_MD_C */
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003915
Gilles Peskine346797d2018-11-16 16:05:06 +01003916/* Note that if this function fails, you must call psa_generator_abort()
3917 * to potentially free embedded data structures and wipe confidential data.
3918 */
Gilles Peskinecce18ae2018-09-18 12:03:52 +02003919static psa_status_t psa_key_derivation_internal(
3920 psa_crypto_generator_t *generator,
3921 const uint8_t *secret, size_t secret_length,
3922 psa_algorithm_t alg,
3923 const uint8_t *salt, size_t salt_length,
3924 const uint8_t *label, size_t label_length,
3925 size_t capacity )
3926{
3927 psa_status_t status;
3928 size_t max_capacity;
3929
3930 /* Set generator->alg even on failure so that abort knows what to do. */
3931 generator->alg = alg;
3932
Gilles Peskine751d9652018-09-18 12:05:44 +02003933 if( alg == PSA_ALG_SELECT_RAW )
3934 {
Gilles Peskinea05219c2018-11-16 16:02:56 +01003935 (void) salt;
Gilles Peskine751d9652018-09-18 12:05:44 +02003936 if( salt_length != 0 )
3937 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskinea05219c2018-11-16 16:02:56 +01003938 (void) label;
Gilles Peskine751d9652018-09-18 12:05:44 +02003939 if( label_length != 0 )
3940 return( PSA_ERROR_INVALID_ARGUMENT );
3941 generator->ctx.buffer.data = mbedtls_calloc( 1, secret_length );
3942 if( generator->ctx.buffer.data == NULL )
3943 return( PSA_ERROR_INSUFFICIENT_MEMORY );
3944 memcpy( generator->ctx.buffer.data, secret, secret_length );
3945 generator->ctx.buffer.size = secret_length;
3946 max_capacity = secret_length;
3947 status = PSA_SUCCESS;
3948 }
3949 else
Gilles Peskinecce18ae2018-09-18 12:03:52 +02003950#if defined(MBEDTLS_MD_C)
3951 if( PSA_ALG_IS_HKDF( alg ) )
3952 {
3953 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( alg );
3954 size_t hash_size = PSA_HASH_SIZE( hash_alg );
3955 if( hash_size == 0 )
3956 return( PSA_ERROR_NOT_SUPPORTED );
3957 max_capacity = 255 * hash_size;
3958 status = psa_generator_hkdf_setup( &generator->ctx.hkdf,
3959 secret, secret_length,
3960 hash_alg,
3961 salt, salt_length,
3962 label, label_length );
3963 }
Hanno Becker1aaedc02018-11-16 11:35:34 +00003964 /* TLS-1.2 PRF and TLS-1.2 PSK-to-MS are very similar, so share code. */
3965 else if( PSA_ALG_IS_TLS12_PRF( alg ) ||
3966 PSA_ALG_IS_TLS12_PSK_TO_MS( alg ) )
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003967 {
3968 psa_algorithm_t hash_alg = PSA_ALG_TLS12_PRF_GET_HASH( alg );
3969 size_t hash_size = PSA_HASH_SIZE( hash_alg );
3970
3971 /* TLS-1.2 PRF supports only SHA-256 and SHA-384. */
3972 if( hash_alg != PSA_ALG_SHA_256 &&
3973 hash_alg != PSA_ALG_SHA_384 )
3974 {
3975 return( PSA_ERROR_NOT_SUPPORTED );
3976 }
3977
3978 max_capacity = 255 * hash_size;
Hanno Becker1aaedc02018-11-16 11:35:34 +00003979
3980 if( PSA_ALG_IS_TLS12_PRF( alg ) )
3981 {
3982 status = psa_generator_tls12_prf_setup( &generator->ctx.tls12_prf,
3983 secret, secret_length,
3984 hash_alg, salt, salt_length,
3985 label, label_length );
3986 }
3987 else
3988 {
3989 status = psa_generator_tls12_psk_to_ms_setup(
3990 &generator->ctx.tls12_prf,
3991 secret, secret_length,
3992 hash_alg, salt, salt_length,
3993 label, label_length );
3994 }
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003995 }
Gilles Peskinecce18ae2018-09-18 12:03:52 +02003996 else
3997#endif
3998 {
3999 return( PSA_ERROR_NOT_SUPPORTED );
4000 }
4001
4002 if( status != PSA_SUCCESS )
4003 return( status );
4004
4005 if( capacity <= max_capacity )
4006 generator->capacity = capacity;
Gilles Peskine8feb3a82018-09-18 12:06:11 +02004007 else if( capacity == PSA_GENERATOR_UNBRIDLED_CAPACITY )
4008 generator->capacity = max_capacity;
Gilles Peskinecce18ae2018-09-18 12:03:52 +02004009 else
4010 return( PSA_ERROR_INVALID_ARGUMENT );
4011
4012 return( PSA_SUCCESS );
4013}
4014
Gilles Peskineea0fb492018-07-12 17:17:20 +02004015psa_status_t psa_key_derivation( psa_crypto_generator_t *generator,
Gilles Peskinec5487a82018-12-03 18:08:14 +01004016 psa_key_handle_t handle,
Gilles Peskineea0fb492018-07-12 17:17:20 +02004017 psa_algorithm_t alg,
4018 const uint8_t *salt,
4019 size_t salt_length,
4020 const uint8_t *label,
4021 size_t label_length,
4022 size_t capacity )
4023{
Gilles Peskine2f060a82018-12-04 17:12:32 +01004024 psa_key_slot_t *slot;
Gilles Peskineea0fb492018-07-12 17:17:20 +02004025 psa_status_t status;
4026
4027 if( generator->alg != 0 )
4028 return( PSA_ERROR_BAD_STATE );
4029
Gilles Peskinecce18ae2018-09-18 12:03:52 +02004030 /* Make sure that alg is a key derivation algorithm. This prevents
4031 * key selection algorithms, which psa_key_derivation_internal
4032 * accepts for the sake of key agreement. */
Gilles Peskineea0fb492018-07-12 17:17:20 +02004033 if( ! PSA_ALG_IS_KEY_DERIVATION( alg ) )
4034 return( PSA_ERROR_INVALID_ARGUMENT );
4035
Gilles Peskinec5487a82018-12-03 18:08:14 +01004036 status = psa_get_key_from_slot( handle, &slot, PSA_KEY_USAGE_DERIVE, alg );
Gilles Peskinecce18ae2018-09-18 12:03:52 +02004037 if( status != PSA_SUCCESS )
4038 return( status );
Gilles Peskineea0fb492018-07-12 17:17:20 +02004039
Gilles Peskinecce18ae2018-09-18 12:03:52 +02004040 if( slot->type != PSA_KEY_TYPE_DERIVE )
4041 return( PSA_ERROR_INVALID_ARGUMENT );
4042
4043 status = psa_key_derivation_internal( generator,
4044 slot->data.raw.data,
4045 slot->data.raw.bytes,
4046 alg,
4047 salt, salt_length,
4048 label, label_length,
4049 capacity );
4050 if( status != PSA_SUCCESS )
Gilles Peskineea0fb492018-07-12 17:17:20 +02004051 psa_generator_abort( generator );
4052 return( status );
4053}
4054
4055
4056
4057/****************************************************************/
Gilles Peskine01d718c2018-09-18 12:01:02 +02004058/* Key agreement */
4059/****************************************************************/
4060
Gilles Peskinea05219c2018-11-16 16:02:56 +01004061#if defined(MBEDTLS_ECDH_C)
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004062static psa_status_t psa_key_agreement_ecdh( const uint8_t *peer_key,
4063 size_t peer_key_length,
4064 const mbedtls_ecp_keypair *our_key,
4065 uint8_t *shared_secret,
4066 size_t shared_secret_size,
4067 size_t *shared_secret_length )
4068{
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004069 mbedtls_ecp_keypair *their_key = NULL;
4070 mbedtls_ecdh_context ecdh;
Jaeden Amero1e5c2bd2019-01-10 19:38:51 +00004071 psa_status_t status;
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004072 mbedtls_ecdh_init( &ecdh );
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004073
Jaeden Amero0ae445f2019-01-10 11:42:27 +00004074 status = psa_import_ec_public_key(
4075 mbedtls_ecc_group_to_psa( our_key->grp.id ),
4076 peer_key, peer_key_length,
4077 &their_key );
Jaeden Amero1e5c2bd2019-01-10 19:38:51 +00004078 if( status != PSA_SUCCESS )
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004079 goto exit;
Gilles Peskineb4086612018-11-14 20:51:23 +01004080
Jaeden Amero1e5c2bd2019-01-10 19:38:51 +00004081 status = mbedtls_to_psa_error(
4082 mbedtls_ecdh_get_params( &ecdh, their_key, MBEDTLS_ECDH_THEIRS ) );
4083 if( status != PSA_SUCCESS )
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004084 goto exit;
Jaeden Amero1e5c2bd2019-01-10 19:38:51 +00004085 status = mbedtls_to_psa_error(
4086 mbedtls_ecdh_get_params( &ecdh, our_key, MBEDTLS_ECDH_OURS ) );
4087 if( status != PSA_SUCCESS )
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004088 goto exit;
4089
Jaeden Amero1e5c2bd2019-01-10 19:38:51 +00004090 status = mbedtls_to_psa_error(
4091 mbedtls_ecdh_calc_secret( &ecdh,
4092 shared_secret_length,
4093 shared_secret, shared_secret_size,
4094 mbedtls_ctr_drbg_random,
4095 &global_data.ctr_drbg ) );
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004096
4097exit:
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004098 mbedtls_ecdh_free( &ecdh );
Jaeden Amero0ae445f2019-01-10 11:42:27 +00004099 mbedtls_ecp_keypair_free( their_key );
4100 mbedtls_free( their_key );
Jaeden Amero1e5c2bd2019-01-10 19:38:51 +00004101 return( status );
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004102}
Gilles Peskinea05219c2018-11-16 16:02:56 +01004103#endif /* MBEDTLS_ECDH_C */
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004104
Gilles Peskine01d718c2018-09-18 12:01:02 +02004105#define PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE MBEDTLS_ECP_MAX_BYTES
4106
Gilles Peskine346797d2018-11-16 16:05:06 +01004107/* Note that if this function fails, you must call psa_generator_abort()
4108 * to potentially free embedded data structures and wipe confidential data.
4109 */
Gilles Peskine01d718c2018-09-18 12:01:02 +02004110static psa_status_t psa_key_agreement_internal( psa_crypto_generator_t *generator,
Gilles Peskine2f060a82018-12-04 17:12:32 +01004111 psa_key_slot_t *private_key,
Gilles Peskine01d718c2018-09-18 12:01:02 +02004112 const uint8_t *peer_key,
4113 size_t peer_key_length,
4114 psa_algorithm_t alg )
4115{
4116 psa_status_t status;
4117 uint8_t shared_secret[PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE];
4118 size_t shared_secret_length = 0;
4119
4120 /* Step 1: run the secret agreement algorithm to generate the shared
4121 * secret. */
4122 switch( PSA_ALG_KEY_AGREEMENT_GET_BASE( alg ) )
4123 {
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004124#if defined(MBEDTLS_ECDH_C)
4125 case PSA_ALG_ECDH_BASE:
4126 if( ! PSA_KEY_TYPE_IS_ECC_KEYPAIR( private_key->type ) )
4127 return( PSA_ERROR_INVALID_ARGUMENT );
4128 status = psa_key_agreement_ecdh( peer_key, peer_key_length,
4129 private_key->data.ecp,
4130 shared_secret,
4131 sizeof( shared_secret ),
4132 &shared_secret_length );
4133 break;
4134#endif /* MBEDTLS_ECDH_C */
Gilles Peskine01d718c2018-09-18 12:01:02 +02004135 default:
Gilles Peskine93f85002018-11-16 16:43:31 +01004136 (void) private_key;
4137 (void) peer_key;
4138 (void) peer_key_length;
Gilles Peskine01d718c2018-09-18 12:01:02 +02004139 return( PSA_ERROR_NOT_SUPPORTED );
4140 }
4141 if( status != PSA_SUCCESS )
4142 goto exit;
4143
4144 /* Step 2: set up the key derivation to generate key material from
4145 * the shared secret. */
4146 status = psa_key_derivation_internal( generator,
4147 shared_secret, shared_secret_length,
4148 PSA_ALG_KEY_AGREEMENT_GET_KDF( alg ),
4149 NULL, 0, NULL, 0,
4150 PSA_GENERATOR_UNBRIDLED_CAPACITY );
4151exit:
Gilles Peskine3f108122018-12-07 18:14:53 +01004152 mbedtls_platform_zeroize( shared_secret, shared_secret_length );
Gilles Peskine01d718c2018-09-18 12:01:02 +02004153 return( status );
4154}
4155
4156psa_status_t psa_key_agreement( psa_crypto_generator_t *generator,
Gilles Peskinec5487a82018-12-03 18:08:14 +01004157 psa_key_handle_t private_key,
Gilles Peskine01d718c2018-09-18 12:01:02 +02004158 const uint8_t *peer_key,
4159 size_t peer_key_length,
4160 psa_algorithm_t alg )
4161{
Gilles Peskine2f060a82018-12-04 17:12:32 +01004162 psa_key_slot_t *slot;
Gilles Peskine01d718c2018-09-18 12:01:02 +02004163 psa_status_t status;
4164 if( ! PSA_ALG_IS_KEY_AGREEMENT( alg ) )
4165 return( PSA_ERROR_INVALID_ARGUMENT );
4166 status = psa_get_key_from_slot( private_key, &slot,
4167 PSA_KEY_USAGE_DERIVE, alg );
4168 if( status != PSA_SUCCESS )
4169 return( status );
Gilles Peskine346797d2018-11-16 16:05:06 +01004170 status = psa_key_agreement_internal( generator,
4171 slot,
4172 peer_key, peer_key_length,
4173 alg );
4174 if( status != PSA_SUCCESS )
4175 psa_generator_abort( generator );
4176 return( status );
Gilles Peskine01d718c2018-09-18 12:01:02 +02004177}
4178
4179
4180
4181/****************************************************************/
Gilles Peskineeab56e42018-07-12 17:12:33 +02004182/* Random generation */
Gilles Peskine05d69892018-06-19 22:00:52 +02004183/****************************************************************/
4184
4185psa_status_t psa_generate_random( uint8_t *output,
4186 size_t output_size )
4187{
itayzafrir0adf0fc2018-09-06 16:24:41 +03004188 int ret;
4189 GUARD_MODULE_INITIALIZED;
4190
4191 ret = mbedtls_ctr_drbg_random( &global_data.ctr_drbg, output, output_size );
Gilles Peskine05d69892018-06-19 22:00:52 +02004192 return( mbedtls_to_psa_error( ret ) );
4193}
4194
Netanel Gonen2bcd3122018-11-19 11:53:02 +02004195#if ( defined(MBEDTLS_ENTROPY_NV_SEED) && defined(MBEDTLS_PSA_HAS_ITS_IO) )
avolinski13beb102018-11-20 16:51:49 +02004196
4197/* Support function for error conversion between psa_its error codes to psa crypto */
4198static psa_status_t its_to_psa_error( psa_its_status_t ret )
4199{
4200 switch( ret )
4201 {
4202 case PSA_ITS_SUCCESS:
4203 return( PSA_SUCCESS );
4204
4205 case PSA_ITS_ERROR_KEY_NOT_FOUND:
4206 return( PSA_ERROR_EMPTY_SLOT );
4207
4208 case PSA_ITS_ERROR_STORAGE_FAILURE:
4209 return( PSA_ERROR_STORAGE_FAILURE );
4210
4211 case PSA_ITS_ERROR_INSUFFICIENT_SPACE:
4212 return( PSA_ERROR_INSUFFICIENT_STORAGE );
4213
4214 case PSA_ITS_ERROR_INVALID_KEY:
Jaeden Amero58600552018-11-30 12:04:38 +00004215 case PSA_ITS_ERROR_OFFSET_INVALID:
avolinski13beb102018-11-20 16:51:49 +02004216 case PSA_ITS_ERROR_INCORRECT_SIZE:
4217 case PSA_ITS_ERROR_BAD_POINTER:
4218 return( PSA_ERROR_INVALID_ARGUMENT );
4219
4220 case PSA_ITS_ERROR_FLAGS_NOT_SUPPORTED:
4221 return( PSA_ERROR_NOT_SUPPORTED );
4222
4223 case PSA_ITS_ERROR_WRITE_ONCE:
4224 return( PSA_ERROR_OCCUPIED_SLOT );
4225
4226 default:
4227 return( PSA_ERROR_UNKNOWN_ERROR );
4228 }
4229}
4230
Netanel Gonen2bcd3122018-11-19 11:53:02 +02004231psa_status_t mbedtls_psa_inject_entropy( const unsigned char *seed,
4232 size_t seed_size )
4233{
4234 psa_status_t status;
avolinski13beb102018-11-20 16:51:49 +02004235 psa_its_status_t its_status;
Netanel Gonen2bcd3122018-11-19 11:53:02 +02004236 struct psa_its_info_t p_info;
4237 if( global_data.initialized )
4238 return( PSA_ERROR_NOT_PERMITTED );
Netanel Gonen21f37cb2018-11-19 11:53:55 +02004239
4240 if( ( ( seed_size < MBEDTLS_ENTROPY_MIN_PLATFORM ) ||
4241 ( seed_size < MBEDTLS_ENTROPY_BLOCK_SIZE ) ) ||
4242 ( seed_size > MBEDTLS_ENTROPY_MAX_SEED_SIZE ) )
4243 return( PSA_ERROR_INVALID_ARGUMENT );
4244
avolinski0d2c2662018-11-21 17:31:07 +02004245 its_status = psa_its_get_info( PSA_CRYPTO_ITS_RANDOM_SEED_UID, &p_info );
avolinski13beb102018-11-20 16:51:49 +02004246 status = its_to_psa_error( its_status );
4247
4248 if( PSA_ITS_ERROR_KEY_NOT_FOUND == its_status ) /* No seed exists */
Netanel Gonen2bcd3122018-11-19 11:53:02 +02004249 {
avolinski0d2c2662018-11-21 17:31:07 +02004250 its_status = psa_its_set( PSA_CRYPTO_ITS_RANDOM_SEED_UID, seed_size, seed, 0 );
avolinski13beb102018-11-20 16:51:49 +02004251 status = its_to_psa_error( its_status );
Netanel Gonen2bcd3122018-11-19 11:53:02 +02004252 }
avolinski13beb102018-11-20 16:51:49 +02004253 else if( PSA_ITS_SUCCESS == its_status )
Netanel Gonen2bcd3122018-11-19 11:53:02 +02004254 {
4255 /* You should not be here. Seed needs to be injected only once */
4256 status = PSA_ERROR_NOT_PERMITTED;
4257 }
4258 return( status );
4259}
4260#endif
4261
Gilles Peskinec5487a82018-12-03 18:08:14 +01004262psa_status_t psa_generate_key( psa_key_handle_t handle,
Gilles Peskine05d69892018-06-19 22:00:52 +02004263 psa_key_type_t type,
4264 size_t bits,
Gilles Peskine53d991e2018-07-12 01:14:59 +02004265 const void *extra,
4266 size_t extra_size )
Gilles Peskine05d69892018-06-19 22:00:52 +02004267{
Gilles Peskine2f060a82018-12-04 17:12:32 +01004268 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02004269 psa_status_t status;
Gilles Peskine12313cd2018-06-20 00:20:32 +02004270
Gilles Peskine53d991e2018-07-12 01:14:59 +02004271 if( extra == NULL && extra_size != 0 )
Gilles Peskine12313cd2018-06-20 00:20:32 +02004272 return( PSA_ERROR_INVALID_ARGUMENT );
4273
Gilles Peskinec5487a82018-12-03 18:08:14 +01004274 status = psa_get_empty_key_slot( handle, &slot );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02004275 if( status != PSA_SUCCESS )
4276 return( status );
4277
Gilles Peskine48c0ea12018-06-21 14:15:31 +02004278 if( key_type_is_raw_bytes( type ) )
Gilles Peskine12313cd2018-06-20 00:20:32 +02004279 {
Gilles Peskineb0b255c2018-07-06 17:01:38 +02004280 status = prepare_raw_data_slot( type, bits, &slot->data.raw );
Gilles Peskine12313cd2018-06-20 00:20:32 +02004281 if( status != PSA_SUCCESS )
4282 return( status );
4283 status = psa_generate_random( slot->data.raw.data,
4284 slot->data.raw.bytes );
4285 if( status != PSA_SUCCESS )
4286 {
4287 mbedtls_free( slot->data.raw.data );
4288 return( status );
4289 }
4290#if defined(MBEDTLS_DES_C)
4291 if( type == PSA_KEY_TYPE_DES )
Gilles Peskine08542d82018-07-19 17:05:42 +02004292 psa_des_set_key_parity( slot->data.raw.data,
4293 slot->data.raw.bytes );
Gilles Peskine12313cd2018-06-20 00:20:32 +02004294#endif /* MBEDTLS_DES_C */
4295 }
4296 else
4297
4298#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_GENPRIME)
4299 if ( type == PSA_KEY_TYPE_RSA_KEYPAIR )
4300 {
4301 mbedtls_rsa_context *rsa;
4302 int ret;
4303 int exponent = 65537;
Gilles Peskineaf3baab2018-06-27 22:55:52 +02004304 if( bits > PSA_VENDOR_RSA_MAX_KEY_BITS )
4305 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine86a440b2018-11-12 18:39:40 +01004306 /* Accept only byte-aligned keys, for the same reasons as
4307 * in psa_import_rsa_key(). */
4308 if( bits % 8 != 0 )
4309 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine53d991e2018-07-12 01:14:59 +02004310 if( extra != NULL )
Gilles Peskine12313cd2018-06-20 00:20:32 +02004311 {
Gilles Peskine4c317f42018-07-12 01:24:09 +02004312 const psa_generate_key_extra_rsa *p = extra;
Gilles Peskine53d991e2018-07-12 01:14:59 +02004313 if( extra_size != sizeof( *p ) )
Gilles Peskine12313cd2018-06-20 00:20:32 +02004314 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine4c317f42018-07-12 01:24:09 +02004315#if INT_MAX < 0xffffffff
4316 /* Check that the uint32_t value passed by the caller fits
4317 * in the range supported by this implementation. */
4318 if( p->e > INT_MAX )
4319 return( PSA_ERROR_NOT_SUPPORTED );
4320#endif
4321 exponent = p->e;
Gilles Peskine12313cd2018-06-20 00:20:32 +02004322 }
4323 rsa = mbedtls_calloc( 1, sizeof( *rsa ) );
4324 if( rsa == NULL )
4325 return( PSA_ERROR_INSUFFICIENT_MEMORY );
4326 mbedtls_rsa_init( rsa, MBEDTLS_RSA_PKCS_V15, MBEDTLS_MD_NONE );
4327 ret = mbedtls_rsa_gen_key( rsa,
4328 mbedtls_ctr_drbg_random,
4329 &global_data.ctr_drbg,
Jaeden Amero23bbb752018-06-26 14:16:54 +01004330 (unsigned int) bits,
Gilles Peskine12313cd2018-06-20 00:20:32 +02004331 exponent );
4332 if( ret != 0 )
4333 {
4334 mbedtls_rsa_free( rsa );
4335 mbedtls_free( rsa );
4336 return( mbedtls_to_psa_error( ret ) );
4337 }
4338 slot->data.rsa = rsa;
4339 }
4340 else
4341#endif /* MBEDTLS_RSA_C && MBEDTLS_GENPRIME */
4342
4343#if defined(MBEDTLS_ECP_C)
4344 if ( PSA_KEY_TYPE_IS_ECC( type ) && PSA_KEY_TYPE_IS_KEYPAIR( type ) )
4345 {
4346 psa_ecc_curve_t curve = PSA_KEY_TYPE_GET_CURVE( type );
4347 mbedtls_ecp_group_id grp_id = mbedtls_ecc_group_of_psa( curve );
4348 const mbedtls_ecp_curve_info *curve_info =
4349 mbedtls_ecp_curve_info_from_grp_id( grp_id );
4350 mbedtls_ecp_keypair *ecp;
4351 int ret;
Gilles Peskine53d991e2018-07-12 01:14:59 +02004352 if( extra != NULL )
Gilles Peskine12313cd2018-06-20 00:20:32 +02004353 return( PSA_ERROR_NOT_SUPPORTED );
4354 if( grp_id == MBEDTLS_ECP_DP_NONE || curve_info == NULL )
4355 return( PSA_ERROR_NOT_SUPPORTED );
4356 if( curve_info->bit_size != bits )
4357 return( PSA_ERROR_INVALID_ARGUMENT );
4358 ecp = mbedtls_calloc( 1, sizeof( *ecp ) );
4359 if( ecp == NULL )
4360 return( PSA_ERROR_INSUFFICIENT_MEMORY );
4361 mbedtls_ecp_keypair_init( ecp );
4362 ret = mbedtls_ecp_gen_key( grp_id, ecp,
4363 mbedtls_ctr_drbg_random,
4364 &global_data.ctr_drbg );
4365 if( ret != 0 )
4366 {
4367 mbedtls_ecp_keypair_free( ecp );
4368 mbedtls_free( ecp );
4369 return( mbedtls_to_psa_error( ret ) );
4370 }
4371 slot->data.ecp = ecp;
4372 }
4373 else
4374#endif /* MBEDTLS_ECP_C */
4375
4376 return( PSA_ERROR_NOT_SUPPORTED );
4377
4378 slot->type = type;
Darryl Green0c6575a2018-11-07 16:05:30 +00004379
4380#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
4381 if( slot->lifetime == PSA_KEY_LIFETIME_PERSISTENT )
4382 {
Gilles Peskine69f976b2018-11-30 18:46:56 +01004383 return( psa_save_generated_persistent_key( slot, bits ) );
Darryl Green0c6575a2018-11-07 16:05:30 +00004384 }
4385#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
4386
4387 return( status );
Gilles Peskine05d69892018-06-19 22:00:52 +02004388}
4389
4390
4391/****************************************************************/
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01004392/* Module setup */
4393/****************************************************************/
4394
Gilles Peskine5e769522018-11-20 21:59:56 +01004395psa_status_t mbedtls_psa_crypto_configure_entropy_sources(
4396 void (* entropy_init )( mbedtls_entropy_context *ctx ),
4397 void (* entropy_free )( mbedtls_entropy_context *ctx ) )
4398{
4399 if( global_data.rng_state != RNG_NOT_INITIALIZED )
4400 return( PSA_ERROR_BAD_STATE );
4401 global_data.entropy_init = entropy_init;
4402 global_data.entropy_free = entropy_free;
4403 return( PSA_SUCCESS );
4404}
4405
Gilles Peskinee59236f2018-01-27 23:32:46 +01004406void mbedtls_psa_crypto_free( void )
4407{
Gilles Peskine66fb1262018-12-10 16:29:04 +01004408 psa_wipe_all_key_slots( );
Gilles Peskinec6b69072018-11-20 21:42:52 +01004409 if( global_data.rng_state != RNG_NOT_INITIALIZED )
4410 {
4411 mbedtls_ctr_drbg_free( &global_data.ctr_drbg );
Gilles Peskine5e769522018-11-20 21:59:56 +01004412 global_data.entropy_free( &global_data.entropy );
Gilles Peskinec6b69072018-11-20 21:42:52 +01004413 }
4414 /* Wipe all remaining data, including configuration.
4415 * In particular, this sets all state indicator to the value
4416 * indicating "uninitialized". */
Gilles Peskine3f108122018-12-07 18:14:53 +01004417 mbedtls_platform_zeroize( &global_data, sizeof( global_data ) );
Gilles Peskinee59236f2018-01-27 23:32:46 +01004418}
4419
4420psa_status_t psa_crypto_init( void )
4421{
Gilles Peskine66fb1262018-12-10 16:29:04 +01004422 psa_status_t status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01004423 const unsigned char drbg_seed[] = "PSA";
4424
Gilles Peskinec6b69072018-11-20 21:42:52 +01004425 /* Double initialization is explicitly allowed. */
Gilles Peskinee59236f2018-01-27 23:32:46 +01004426 if( global_data.initialized != 0 )
4427 return( PSA_SUCCESS );
4428
Gilles Peskine5e769522018-11-20 21:59:56 +01004429 /* Set default configuration if
4430 * mbedtls_psa_crypto_configure_entropy_sources() hasn't been called. */
4431 if( global_data.entropy_init == NULL )
4432 global_data.entropy_init = mbedtls_entropy_init;
4433 if( global_data.entropy_free == NULL )
4434 global_data.entropy_free = mbedtls_entropy_free;
Gilles Peskinee59236f2018-01-27 23:32:46 +01004435
Gilles Peskinec6b69072018-11-20 21:42:52 +01004436 /* Initialize the random generator. */
Gilles Peskine5e769522018-11-20 21:59:56 +01004437 global_data.entropy_init( &global_data.entropy );
Gilles Peskinee59236f2018-01-27 23:32:46 +01004438 mbedtls_ctr_drbg_init( &global_data.ctr_drbg );
Gilles Peskinec6b69072018-11-20 21:42:52 +01004439 global_data.rng_state = RNG_INITIALIZED;
Gilles Peskine66fb1262018-12-10 16:29:04 +01004440 status = mbedtls_to_psa_error(
4441 mbedtls_ctr_drbg_seed( &global_data.ctr_drbg,
4442 mbedtls_entropy_func,
4443 &global_data.entropy,
4444 drbg_seed, sizeof( drbg_seed ) - 1 ) );
4445 if( status != PSA_SUCCESS )
Gilles Peskinee59236f2018-01-27 23:32:46 +01004446 goto exit;
Gilles Peskinec6b69072018-11-20 21:42:52 +01004447 global_data.rng_state = RNG_SEEDED;
Gilles Peskinee59236f2018-01-27 23:32:46 +01004448
Gilles Peskine66fb1262018-12-10 16:29:04 +01004449 status = psa_initialize_key_slots( );
4450 if( status != PSA_SUCCESS )
4451 goto exit;
Gilles Peskinec6b69072018-11-20 21:42:52 +01004452
4453 /* All done. */
Gilles Peskinee4ebc122018-03-07 14:16:44 +01004454 global_data.initialized = 1;
4455
Gilles Peskinee59236f2018-01-27 23:32:46 +01004456exit:
Gilles Peskine66fb1262018-12-10 16:29:04 +01004457 if( status != PSA_SUCCESS )
Gilles Peskinee59236f2018-01-27 23:32:46 +01004458 mbedtls_psa_crypto_free( );
Gilles Peskine66fb1262018-12-10 16:29:04 +01004459 return( status );
Gilles Peskinee59236f2018-01-27 23:32:46 +01004460}
4461
4462#endif /* MBEDTLS_PSA_CRYPTO_C */