blob: 545e02140465053ae2ae92d2591bdba4b6623ef7 [file] [log] [blame]
Gilles Peskinee59236f2018-01-27 23:32:46 +01001/*
2 * PSA crypto layer on top of Mbed TLS crypto
3 */
Bence Szépkúti86974652020-06-15 11:59:37 +02004/*
Bence Szépkúti1e148272020-08-07 13:07:28 +02005 * Copyright The Mbed TLS Contributors
Gilles Peskinee59236f2018-01-27 23:32:46 +01006 * SPDX-License-Identifier: Apache-2.0
7 *
8 * Licensed under the Apache License, Version 2.0 (the "License"); you may
9 * not use this file except in compliance with the License.
10 * You may obtain a copy of the License at
11 *
12 * http://www.apache.org/licenses/LICENSE-2.0
13 *
14 * Unless required by applicable law or agreed to in writing, software
15 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
16 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17 * See the License for the specific language governing permissions and
18 * limitations under the License.
Gilles Peskinee59236f2018-01-27 23:32:46 +010019 */
20
Gilles Peskinedb09ef62020-06-03 01:43:33 +020021#include "common.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010022
23#if defined(MBEDTLS_PSA_CRYPTO_C)
mohammad160327010052018-07-03 13:16:15 +030024
John Durkop07cc04a2020-11-16 22:08:34 -080025#if defined(MBEDTLS_PSA_CRYPTO_CONFIG)
26#include "check_crypto_config.h"
27#endif
28
itayzafrir7723ab12019-02-14 10:28:02 +020029#include "psa_crypto_service_integration.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010030#include "psa/crypto.h"
31
Gilles Peskine039b90c2018-12-07 18:24:41 +010032#include "psa_crypto_core.h"
Gilles Peskine5e769522018-11-20 21:59:56 +010033#include "psa_crypto_invasive.h"
Steven Cooremancd84cb42020-07-16 20:28:36 +020034#include "psa_crypto_driver_wrappers.h"
Gilles Peskinea8ade162019-06-26 11:24:49 +020035#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined0890212019-06-24 14:34:43 +020036#include "psa_crypto_se.h"
Gilles Peskinea8ade162019-06-26 11:24:49 +020037#endif
Gilles Peskine961849f2018-11-30 18:54:54 +010038#include "psa_crypto_slot_management.h"
Darryl Greend49a4992018-06-18 17:27:26 +010039/* Include internal declarations that are useful for implementing persistently
40 * stored keys. */
41#include "psa_crypto_storage.h"
42
Gilles Peskineb2b64d32020-12-14 16:43:58 +010043#include "psa_crypto_random_impl.h"
Gilles Peskine90edc992020-11-13 15:39:19 +010044
Gilles Peskineb46bef22019-07-30 21:32:04 +020045#include <assert.h>
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010046#include <stdlib.h>
47#include <string.h>
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010048#include "mbedtls/platform.h"
Gilles Peskineff2d2002019-05-06 15:26:23 +020049#if !defined(MBEDTLS_PLATFORM_C)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010050#define mbedtls_calloc calloc
51#define mbedtls_free free
52#endif
53
Gilles Peskine1c49f1a2020-11-13 18:46:25 +010054#include "mbedtls/aes.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010055#include "mbedtls/arc4.h"
Gilles Peskine9a944802018-06-21 09:35:35 +020056#include "mbedtls/asn1.h"
Jaeden Amero25384a22019-01-10 10:23:21 +000057#include "mbedtls/asn1write.h"
Gilles Peskinea81d85b2018-06-26 16:10:23 +020058#include "mbedtls/bignum.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010059#include "mbedtls/blowfish.h"
60#include "mbedtls/camellia.h"
Gilles Peskine26869f22019-05-06 15:25:00 +020061#include "mbedtls/chacha20.h"
62#include "mbedtls/chachapoly.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010063#include "mbedtls/cipher.h"
64#include "mbedtls/ccm.h"
65#include "mbedtls/cmac.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010066#include "mbedtls/des.h"
Gilles Peskineb7ecdf02018-09-18 12:11:27 +020067#include "mbedtls/ecdh.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010068#include "mbedtls/ecp.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010069#include "mbedtls/entropy.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010070#include "mbedtls/error.h"
71#include "mbedtls/gcm.h"
72#include "mbedtls/md2.h"
73#include "mbedtls/md4.h"
74#include "mbedtls/md5.h"
Gilles Peskine20035e32018-02-03 22:44:14 +010075#include "mbedtls/md.h"
76#include "mbedtls/md_internal.h"
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010077#include "mbedtls/pk.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010078#include "mbedtls/pk_internal.h"
Gilles Peskine3f108122018-12-07 18:14:53 +010079#include "mbedtls/platform_util.h"
Janos Follath24eed8d2019-11-22 13:21:35 +000080#include "mbedtls/error.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010081#include "mbedtls/ripemd160.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010082#include "mbedtls/rsa.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010083#include "mbedtls/sha1.h"
84#include "mbedtls/sha256.h"
85#include "mbedtls/sha512.h"
86#include "mbedtls/xtea.h"
87
Gilles Peskine996deb12018-08-01 15:45:45 +020088#define ARRAY_LENGTH( array ) ( sizeof( array ) / sizeof( *( array ) ) )
89
Gilles Peskine9ef733f2018-02-07 21:05:37 +010090/* constant-time buffer comparison */
91static inline int safer_memcmp( const uint8_t *a, const uint8_t *b, size_t n )
92{
93 size_t i;
94 unsigned char diff = 0;
95
96 for( i = 0; i < n; i++ )
97 diff |= a[i] ^ b[i];
98
99 return( diff );
100}
101
102
103
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100104/****************************************************************/
105/* Global data, support functions and library management */
106/****************************************************************/
107
Gilles Peskine48c0ea12018-06-21 14:15:31 +0200108static int key_type_is_raw_bytes( psa_key_type_t type )
109{
Gilles Peskine78b3bb62018-08-10 16:03:41 +0200110 return( PSA_KEY_TYPE_IS_UNSTRUCTURED( type ) );
Gilles Peskine48c0ea12018-06-21 14:15:31 +0200111}
112
Gilles Peskine5a3c50e2018-12-04 12:27:09 +0100113/* Values for psa_global_data_t::rng_state */
114#define RNG_NOT_INITIALIZED 0
115#define RNG_INITIALIZED 1
116#define RNG_SEEDED 2
Gilles Peskinec6b69072018-11-20 21:42:52 +0100117
Gilles Peskine2d277862018-06-18 15:41:12 +0200118typedef struct
119{
Gilles Peskine30524eb2020-11-13 17:02:26 +0100120 mbedtls_psa_random_context_t rng;
Gilles Peskinec6b69072018-11-20 21:42:52 +0100121 unsigned initialized : 1;
Gilles Peskine5a3c50e2018-12-04 12:27:09 +0100122 unsigned rng_state : 2;
Gilles Peskinee59236f2018-01-27 23:32:46 +0100123} psa_global_data_t;
124
125static psa_global_data_t global_data;
126
Gilles Peskine5894e8e2020-12-14 14:54:06 +0100127#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
128mbedtls_psa_drbg_context_t *const mbedtls_psa_random_state =
129 &global_data.rng.drbg;
130#endif
131
itayzafrir0adf0fc2018-09-06 16:24:41 +0300132#define GUARD_MODULE_INITIALIZED \
133 if( global_data.initialized == 0 ) \
134 return( PSA_ERROR_BAD_STATE );
135
Steven Cooreman01164162020-07-20 15:31:37 +0200136psa_status_t mbedtls_to_psa_error( int ret )
Gilles Peskinee59236f2018-01-27 23:32:46 +0100137{
Gilles Peskinedbf68962021-01-06 20:04:23 +0100138 /* Mbed TLS error codes can combine a high-level error code and a
139 * low-level error code. The low-level error usually reflects the
140 * root cause better, so dispatch on that preferably. */
141 int low_level_ret = - ( -ret & 0x007f );
142 switch( low_level_ret != 0 ? low_level_ret : ret )
Gilles Peskinee59236f2018-01-27 23:32:46 +0100143 {
144 case 0:
145 return( PSA_SUCCESS );
Gilles Peskinea5905292018-02-07 20:59:33 +0100146
147 case MBEDTLS_ERR_AES_INVALID_KEY_LENGTH:
148 case MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH:
149 case MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE:
150 return( PSA_ERROR_NOT_SUPPORTED );
151 case MBEDTLS_ERR_AES_HW_ACCEL_FAILED:
152 return( PSA_ERROR_HARDWARE_FAILURE );
153
Gilles Peskine9a944802018-06-21 09:35:35 +0200154 case MBEDTLS_ERR_ASN1_OUT_OF_DATA:
155 case MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:
156 case MBEDTLS_ERR_ASN1_INVALID_LENGTH:
157 case MBEDTLS_ERR_ASN1_LENGTH_MISMATCH:
158 case MBEDTLS_ERR_ASN1_INVALID_DATA:
159 return( PSA_ERROR_INVALID_ARGUMENT );
160 case MBEDTLS_ERR_ASN1_ALLOC_FAILED:
161 return( PSA_ERROR_INSUFFICIENT_MEMORY );
162 case MBEDTLS_ERR_ASN1_BUF_TOO_SMALL:
163 return( PSA_ERROR_BUFFER_TOO_SMALL );
164
Jaeden Amero93e21112019-02-20 13:57:28 +0000165#if defined(MBEDTLS_ERR_BLOWFISH_BAD_INPUT_DATA)
Jaeden Amero892cd6d2019-02-11 12:21:12 +0000166 case MBEDTLS_ERR_BLOWFISH_BAD_INPUT_DATA:
Jaeden Amero93e21112019-02-20 13:57:28 +0000167#elif defined(MBEDTLS_ERR_BLOWFISH_INVALID_KEY_LENGTH)
168 case MBEDTLS_ERR_BLOWFISH_INVALID_KEY_LENGTH:
169#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100170 case MBEDTLS_ERR_BLOWFISH_INVALID_INPUT_LENGTH:
171 return( PSA_ERROR_NOT_SUPPORTED );
172 case MBEDTLS_ERR_BLOWFISH_HW_ACCEL_FAILED:
173 return( PSA_ERROR_HARDWARE_FAILURE );
174
Jaeden Amero93e21112019-02-20 13:57:28 +0000175#if defined(MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA)
Jaeden Amero892cd6d2019-02-11 12:21:12 +0000176 case MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA:
Jaeden Amero93e21112019-02-20 13:57:28 +0000177#elif defined(MBEDTLS_ERR_CAMELLIA_INVALID_KEY_LENGTH)
178 case MBEDTLS_ERR_CAMELLIA_INVALID_KEY_LENGTH:
179#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100180 case MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH:
181 return( PSA_ERROR_NOT_SUPPORTED );
182 case MBEDTLS_ERR_CAMELLIA_HW_ACCEL_FAILED:
183 return( PSA_ERROR_HARDWARE_FAILURE );
184
185 case MBEDTLS_ERR_CCM_BAD_INPUT:
186 return( PSA_ERROR_INVALID_ARGUMENT );
187 case MBEDTLS_ERR_CCM_AUTH_FAILED:
188 return( PSA_ERROR_INVALID_SIGNATURE );
189 case MBEDTLS_ERR_CCM_HW_ACCEL_FAILED:
190 return( PSA_ERROR_HARDWARE_FAILURE );
191
Gilles Peskine26869f22019-05-06 15:25:00 +0200192 case MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA:
193 return( PSA_ERROR_INVALID_ARGUMENT );
194
195 case MBEDTLS_ERR_CHACHAPOLY_BAD_STATE:
196 return( PSA_ERROR_BAD_STATE );
197 case MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED:
198 return( PSA_ERROR_INVALID_SIGNATURE );
199
Gilles Peskinea5905292018-02-07 20:59:33 +0100200 case MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE:
201 return( PSA_ERROR_NOT_SUPPORTED );
202 case MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA:
203 return( PSA_ERROR_INVALID_ARGUMENT );
204 case MBEDTLS_ERR_CIPHER_ALLOC_FAILED:
205 return( PSA_ERROR_INSUFFICIENT_MEMORY );
206 case MBEDTLS_ERR_CIPHER_INVALID_PADDING:
207 return( PSA_ERROR_INVALID_PADDING );
208 case MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED:
Fredrik Strupef90e3012020-09-28 16:11:33 +0200209 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskinea5905292018-02-07 20:59:33 +0100210 case MBEDTLS_ERR_CIPHER_AUTH_FAILED:
211 return( PSA_ERROR_INVALID_SIGNATURE );
212 case MBEDTLS_ERR_CIPHER_INVALID_CONTEXT:
Gilles Peskine4b3eb692019-05-16 21:35:18 +0200213 return( PSA_ERROR_CORRUPTION_DETECTED );
Gilles Peskinea5905292018-02-07 20:59:33 +0100214 case MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED:
215 return( PSA_ERROR_HARDWARE_FAILURE );
216
217 case MBEDTLS_ERR_CMAC_HW_ACCEL_FAILED:
218 return( PSA_ERROR_HARDWARE_FAILURE );
219
Gilles Peskine82e57d12020-11-13 21:31:17 +0100220#if !( defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) || \
221 defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE) )
Gilles Peskinebee96c82020-11-23 21:00:09 +0100222 /* Only check CTR_DRBG error codes if underlying mbedtls_xxx
223 * functions are passed a CTR_DRBG instance. */
Gilles Peskinea5905292018-02-07 20:59:33 +0100224 case MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED:
225 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
226 case MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG:
227 case MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG:
228 return( PSA_ERROR_NOT_SUPPORTED );
229 case MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR:
230 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
Gilles Peskine82e57d12020-11-13 21:31:17 +0100231#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100232
233 case MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH:
234 return( PSA_ERROR_NOT_SUPPORTED );
235 case MBEDTLS_ERR_DES_HW_ACCEL_FAILED:
236 return( PSA_ERROR_HARDWARE_FAILURE );
237
Gilles Peskinee59236f2018-01-27 23:32:46 +0100238 case MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED:
239 case MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE:
240 case MBEDTLS_ERR_ENTROPY_SOURCE_FAILED:
241 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
Gilles Peskinea5905292018-02-07 20:59:33 +0100242
243 case MBEDTLS_ERR_GCM_AUTH_FAILED:
244 return( PSA_ERROR_INVALID_SIGNATURE );
245 case MBEDTLS_ERR_GCM_BAD_INPUT:
Gilles Peskine8cac2e62018-08-21 15:07:38 +0200246 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskinea5905292018-02-07 20:59:33 +0100247 case MBEDTLS_ERR_GCM_HW_ACCEL_FAILED:
248 return( PSA_ERROR_HARDWARE_FAILURE );
249
Gilles Peskine82e57d12020-11-13 21:31:17 +0100250#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) && \
251 defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE)
Gilles Peskinebee96c82020-11-23 21:00:09 +0100252 /* Only check HMAC_DRBG error codes if underlying mbedtls_xxx
253 * functions are passed a HMAC_DRBG instance. */
Gilles Peskine82e57d12020-11-13 21:31:17 +0100254 case MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED:
255 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
256 case MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG:
257 case MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG:
258 return( PSA_ERROR_NOT_SUPPORTED );
259 case MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR:
260 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
261#endif
262
Gilles Peskinea5905292018-02-07 20:59:33 +0100263 case MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE:
264 return( PSA_ERROR_NOT_SUPPORTED );
265 case MBEDTLS_ERR_MD_BAD_INPUT_DATA:
266 return( PSA_ERROR_INVALID_ARGUMENT );
267 case MBEDTLS_ERR_MD_ALLOC_FAILED:
268 return( PSA_ERROR_INSUFFICIENT_MEMORY );
269 case MBEDTLS_ERR_MD_FILE_IO_ERROR:
270 return( PSA_ERROR_STORAGE_FAILURE );
Gilles Peskinea5905292018-02-07 20:59:33 +0100271
Gilles Peskinef76aa772018-10-29 19:24:33 +0100272 case MBEDTLS_ERR_MPI_FILE_IO_ERROR:
273 return( PSA_ERROR_STORAGE_FAILURE );
274 case MBEDTLS_ERR_MPI_BAD_INPUT_DATA:
275 return( PSA_ERROR_INVALID_ARGUMENT );
276 case MBEDTLS_ERR_MPI_INVALID_CHARACTER:
277 return( PSA_ERROR_INVALID_ARGUMENT );
278 case MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL:
279 return( PSA_ERROR_BUFFER_TOO_SMALL );
280 case MBEDTLS_ERR_MPI_NEGATIVE_VALUE:
281 return( PSA_ERROR_INVALID_ARGUMENT );
282 case MBEDTLS_ERR_MPI_DIVISION_BY_ZERO:
283 return( PSA_ERROR_INVALID_ARGUMENT );
284 case MBEDTLS_ERR_MPI_NOT_ACCEPTABLE:
285 return( PSA_ERROR_INVALID_ARGUMENT );
286 case MBEDTLS_ERR_MPI_ALLOC_FAILED:
287 return( PSA_ERROR_INSUFFICIENT_MEMORY );
288
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100289 case MBEDTLS_ERR_PK_ALLOC_FAILED:
290 return( PSA_ERROR_INSUFFICIENT_MEMORY );
291 case MBEDTLS_ERR_PK_TYPE_MISMATCH:
292 case MBEDTLS_ERR_PK_BAD_INPUT_DATA:
293 return( PSA_ERROR_INVALID_ARGUMENT );
294 case MBEDTLS_ERR_PK_FILE_IO_ERROR:
Gilles Peskinea5905292018-02-07 20:59:33 +0100295 return( PSA_ERROR_STORAGE_FAILURE );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100296 case MBEDTLS_ERR_PK_KEY_INVALID_VERSION:
297 case MBEDTLS_ERR_PK_KEY_INVALID_FORMAT:
298 return( PSA_ERROR_INVALID_ARGUMENT );
299 case MBEDTLS_ERR_PK_UNKNOWN_PK_ALG:
300 return( PSA_ERROR_NOT_SUPPORTED );
301 case MBEDTLS_ERR_PK_PASSWORD_REQUIRED:
302 case MBEDTLS_ERR_PK_PASSWORD_MISMATCH:
303 return( PSA_ERROR_NOT_PERMITTED );
304 case MBEDTLS_ERR_PK_INVALID_PUBKEY:
305 return( PSA_ERROR_INVALID_ARGUMENT );
306 case MBEDTLS_ERR_PK_INVALID_ALG:
307 case MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE:
308 case MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE:
309 return( PSA_ERROR_NOT_SUPPORTED );
310 case MBEDTLS_ERR_PK_SIG_LEN_MISMATCH:
311 return( PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskinea5905292018-02-07 20:59:33 +0100312 case MBEDTLS_ERR_PK_HW_ACCEL_FAILED:
313 return( PSA_ERROR_HARDWARE_FAILURE );
314
Gilles Peskineff2d2002019-05-06 15:26:23 +0200315 case MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED:
316 return( PSA_ERROR_HARDWARE_FAILURE );
317 case MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
318 return( PSA_ERROR_NOT_SUPPORTED );
319
Gilles Peskinea5905292018-02-07 20:59:33 +0100320 case MBEDTLS_ERR_RSA_BAD_INPUT_DATA:
321 return( PSA_ERROR_INVALID_ARGUMENT );
322 case MBEDTLS_ERR_RSA_INVALID_PADDING:
323 return( PSA_ERROR_INVALID_PADDING );
324 case MBEDTLS_ERR_RSA_KEY_GEN_FAILED:
325 return( PSA_ERROR_HARDWARE_FAILURE );
326 case MBEDTLS_ERR_RSA_KEY_CHECK_FAILED:
327 return( PSA_ERROR_INVALID_ARGUMENT );
328 case MBEDTLS_ERR_RSA_PUBLIC_FAILED:
329 case MBEDTLS_ERR_RSA_PRIVATE_FAILED:
Gilles Peskine4b3eb692019-05-16 21:35:18 +0200330 return( PSA_ERROR_CORRUPTION_DETECTED );
Gilles Peskinea5905292018-02-07 20:59:33 +0100331 case MBEDTLS_ERR_RSA_VERIFY_FAILED:
332 return( PSA_ERROR_INVALID_SIGNATURE );
333 case MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE:
334 return( PSA_ERROR_BUFFER_TOO_SMALL );
335 case MBEDTLS_ERR_RSA_RNG_FAILED:
Gilles Peskine40d81602020-11-25 00:09:47 +0100336 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
Gilles Peskinea5905292018-02-07 20:59:33 +0100337 case MBEDTLS_ERR_RSA_UNSUPPORTED_OPERATION:
338 return( PSA_ERROR_NOT_SUPPORTED );
339 case MBEDTLS_ERR_RSA_HW_ACCEL_FAILED:
340 return( PSA_ERROR_HARDWARE_FAILURE );
341
Gilles Peskinea5905292018-02-07 20:59:33 +0100342 case MBEDTLS_ERR_XTEA_INVALID_INPUT_LENGTH:
343 return( PSA_ERROR_INVALID_ARGUMENT );
344 case MBEDTLS_ERR_XTEA_HW_ACCEL_FAILED:
345 return( PSA_ERROR_HARDWARE_FAILURE );
346
itayzafrir5c753392018-05-08 11:18:38 +0300347 case MBEDTLS_ERR_ECP_BAD_INPUT_DATA:
itayzafrir7b30f8b2018-05-09 16:07:36 +0300348 case MBEDTLS_ERR_ECP_INVALID_KEY:
itayzafrir5c753392018-05-08 11:18:38 +0300349 return( PSA_ERROR_INVALID_ARGUMENT );
itayzafrir7b30f8b2018-05-09 16:07:36 +0300350 case MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL:
351 return( PSA_ERROR_BUFFER_TOO_SMALL );
352 case MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE:
353 return( PSA_ERROR_NOT_SUPPORTED );
354 case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH:
355 case MBEDTLS_ERR_ECP_VERIFY_FAILED:
356 return( PSA_ERROR_INVALID_SIGNATURE );
357 case MBEDTLS_ERR_ECP_ALLOC_FAILED:
358 return( PSA_ERROR_INSUFFICIENT_MEMORY );
Gilles Peskine40d81602020-11-25 00:09:47 +0100359 case MBEDTLS_ERR_ECP_RANDOM_FAILED:
360 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
itayzafrir7b30f8b2018-05-09 16:07:36 +0300361 case MBEDTLS_ERR_ECP_HW_ACCEL_FAILED:
362 return( PSA_ERROR_HARDWARE_FAILURE );
Gilles Peskine40d81602020-11-25 00:09:47 +0100363
Janos Follatha13b9052019-11-22 12:48:59 +0000364 case MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED:
365 return( PSA_ERROR_CORRUPTION_DETECTED );
itayzafrir5c753392018-05-08 11:18:38 +0300366
Gilles Peskinee59236f2018-01-27 23:32:46 +0100367 default:
David Saadab4ecc272019-02-14 13:48:10 +0200368 return( PSA_ERROR_GENERIC_ERROR );
Gilles Peskinee59236f2018-01-27 23:32:46 +0100369 }
370}
371
Gilles Peskineb0b255c2018-07-06 17:01:38 +0200372
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +0200373
374
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100375/****************************************************************/
376/* Key management */
377/****************************************************************/
378
Gilles Peskine73167e12019-07-12 23:44:37 +0200379#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
380static inline int psa_key_slot_is_external( const psa_key_slot_t *slot )
381{
Gilles Peskine8e338702019-07-30 20:06:31 +0200382 return( psa_key_lifetime_is_external( slot->attr.lifetime ) );
Gilles Peskine73167e12019-07-12 23:44:37 +0200383}
384#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
385
John Durkop07cc04a2020-11-16 22:08:34 -0800386/* For now the MBEDTLS_PSA_ACCEL_ guards are also used here since the
387 * current test driver in key_management.c is using this function
388 * when accelerators are used for ECC key pair and public key.
389 * Once that dependency is resolved these guards can be removed.
390 */
John Durkop9814fa22020-11-04 12:28:15 -0800391#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
John Durkop6ba40d12020-11-10 08:50:04 -0800392 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) || \
393 defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR) || \
394 defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY)
Paul Elliott8ff510a2020-06-02 17:19:28 +0100395mbedtls_ecp_group_id mbedtls_ecc_group_of_psa( psa_ecc_family_t curve,
Gilles Peskine5055b232019-12-12 17:49:31 +0100396 size_t byte_length )
Gilles Peskine12313cd2018-06-20 00:20:32 +0200397{
398 switch( curve )
399 {
Paul Elliott8ff510a2020-06-02 17:19:28 +0100400 case PSA_ECC_FAMILY_SECP_R1:
Gilles Peskine228abc52019-12-03 17:24:19 +0100401 switch( byte_length )
402 {
403 case PSA_BITS_TO_BYTES( 192 ):
404 return( MBEDTLS_ECP_DP_SECP192R1 );
405 case PSA_BITS_TO_BYTES( 224 ):
406 return( MBEDTLS_ECP_DP_SECP224R1 );
407 case PSA_BITS_TO_BYTES( 256 ):
408 return( MBEDTLS_ECP_DP_SECP256R1 );
409 case PSA_BITS_TO_BYTES( 384 ):
410 return( MBEDTLS_ECP_DP_SECP384R1 );
411 case PSA_BITS_TO_BYTES( 521 ):
412 return( MBEDTLS_ECP_DP_SECP521R1 );
413 default:
414 return( MBEDTLS_ECP_DP_NONE );
415 }
416 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100417
Paul Elliott8ff510a2020-06-02 17:19:28 +0100418 case PSA_ECC_FAMILY_BRAINPOOL_P_R1:
Gilles Peskine228abc52019-12-03 17:24:19 +0100419 switch( byte_length )
420 {
421 case PSA_BITS_TO_BYTES( 256 ):
422 return( MBEDTLS_ECP_DP_BP256R1 );
423 case PSA_BITS_TO_BYTES( 384 ):
424 return( MBEDTLS_ECP_DP_BP384R1 );
425 case PSA_BITS_TO_BYTES( 512 ):
426 return( MBEDTLS_ECP_DP_BP512R1 );
427 default:
428 return( MBEDTLS_ECP_DP_NONE );
429 }
430 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100431
Paul Elliott8ff510a2020-06-02 17:19:28 +0100432 case PSA_ECC_FAMILY_MONTGOMERY:
Gilles Peskine228abc52019-12-03 17:24:19 +0100433 switch( byte_length )
434 {
435 case PSA_BITS_TO_BYTES( 255 ):
436 return( MBEDTLS_ECP_DP_CURVE25519 );
437 case PSA_BITS_TO_BYTES( 448 ):
438 return( MBEDTLS_ECP_DP_CURVE448 );
439 default:
440 return( MBEDTLS_ECP_DP_NONE );
441 }
442 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100443
Paul Elliott8ff510a2020-06-02 17:19:28 +0100444 case PSA_ECC_FAMILY_SECP_K1:
Gilles Peskine228abc52019-12-03 17:24:19 +0100445 switch( byte_length )
446 {
447 case PSA_BITS_TO_BYTES( 192 ):
448 return( MBEDTLS_ECP_DP_SECP192K1 );
449 case PSA_BITS_TO_BYTES( 224 ):
450 return( MBEDTLS_ECP_DP_SECP224K1 );
451 case PSA_BITS_TO_BYTES( 256 ):
452 return( MBEDTLS_ECP_DP_SECP256K1 );
453 default:
454 return( MBEDTLS_ECP_DP_NONE );
455 }
456 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100457
Gilles Peskine12313cd2018-06-20 00:20:32 +0200458 default:
459 return( MBEDTLS_ECP_DP_NONE );
460 }
461}
John Durkop9814fa22020-11-04 12:28:15 -0800462#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
John Durkop6ba40d12020-11-10 08:50:04 -0800463 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) ||
464 * defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR) ||
465 * defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY) */
Gilles Peskine12313cd2018-06-20 00:20:32 +0200466
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200467static psa_status_t validate_unstructured_key_bit_size( psa_key_type_t type,
468 size_t bits )
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200469{
470 /* Check that the bit size is acceptable for the key type */
471 switch( type )
472 {
473 case PSA_KEY_TYPE_RAW_DATA:
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200474 case PSA_KEY_TYPE_HMAC:
Gilles Peskineea0fb492018-07-12 17:17:20 +0200475 case PSA_KEY_TYPE_DERIVE:
476 break;
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200477#if defined(MBEDTLS_AES_C)
478 case PSA_KEY_TYPE_AES:
479 if( bits != 128 && bits != 192 && bits != 256 )
480 return( PSA_ERROR_INVALID_ARGUMENT );
481 break;
482#endif
483#if defined(MBEDTLS_CAMELLIA_C)
484 case PSA_KEY_TYPE_CAMELLIA:
485 if( bits != 128 && bits != 192 && bits != 256 )
486 return( PSA_ERROR_INVALID_ARGUMENT );
487 break;
488#endif
489#if defined(MBEDTLS_DES_C)
490 case PSA_KEY_TYPE_DES:
491 if( bits != 64 && bits != 128 && bits != 192 )
492 return( PSA_ERROR_INVALID_ARGUMENT );
493 break;
494#endif
495#if defined(MBEDTLS_ARC4_C)
496 case PSA_KEY_TYPE_ARC4:
497 if( bits < 8 || bits > 2048 )
498 return( PSA_ERROR_INVALID_ARGUMENT );
499 break;
500#endif
Gilles Peskine26869f22019-05-06 15:25:00 +0200501#if defined(MBEDTLS_CHACHA20_C)
502 case PSA_KEY_TYPE_CHACHA20:
503 if( bits != 256 )
504 return( PSA_ERROR_INVALID_ARGUMENT );
505 break;
506#endif
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200507 default:
508 return( PSA_ERROR_NOT_SUPPORTED );
509 }
Gilles Peskineb54979a2018-06-21 09:32:47 +0200510 if( bits % 8 != 0 )
511 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200512
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200513 return( PSA_SUCCESS );
514}
515
John Durkop0e005192020-10-31 22:06:54 -0700516#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \
517 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
518 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) || \
John Durkop9814fa22020-11-04 12:28:15 -0800519 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) || \
520 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
521 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Steven Cooremana01795d2020-07-24 22:48:15 +0200522
Gilles Peskine86a440b2018-11-12 18:39:40 +0100523/* Mbed TLS doesn't support non-byte-aligned key sizes (i.e. key sizes
524 * that are not a multiple of 8) well. For example, there is only
525 * mbedtls_rsa_get_len(), which returns a number of bytes, and no
526 * way to return the exact bit size of a key.
527 * To keep things simple, reject non-byte-aligned key sizes. */
528static psa_status_t psa_check_rsa_key_byte_aligned(
529 const mbedtls_rsa_context *rsa )
530{
531 mbedtls_mpi n;
532 psa_status_t status;
533 mbedtls_mpi_init( &n );
534 status = mbedtls_to_psa_error(
535 mbedtls_rsa_export( rsa, &n, NULL, NULL, NULL, NULL ) );
536 if( status == PSA_SUCCESS )
537 {
538 if( mbedtls_mpi_bitlen( &n ) % 8 != 0 )
539 status = PSA_ERROR_NOT_SUPPORTED;
540 }
541 mbedtls_mpi_free( &n );
542 return( status );
543}
544
Steven Cooreman7f391872020-07-30 14:57:44 +0200545/** Load the contents of a key buffer into an internal RSA representation
Steven Cooremana01795d2020-07-24 22:48:15 +0200546 *
Steven Cooreman4fed4552020-08-03 14:46:03 +0200547 * \param[in] type The type of key contained in \p data.
548 * \param[in] data The buffer from which to load the representation.
549 * \param[in] data_length The size in bytes of \p data.
550 * \param[out] p_rsa Returns a pointer to an RSA context on success.
551 * The caller is responsible for freeing both the
552 * contents of the context and the context itself
553 * when done.
Steven Cooremana01795d2020-07-24 22:48:15 +0200554 */
Steven Cooreman4fed4552020-08-03 14:46:03 +0200555static psa_status_t psa_load_rsa_representation( psa_key_type_t type,
556 const uint8_t *data,
557 size_t data_length,
Steven Cooremana2371e52020-07-28 14:30:39 +0200558 mbedtls_rsa_context **p_rsa )
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200559{
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000560 psa_status_t status;
Steven Cooremana01795d2020-07-24 22:48:15 +0200561 mbedtls_pk_context ctx;
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000562 size_t bits;
Steven Cooremana01795d2020-07-24 22:48:15 +0200563 mbedtls_pk_init( &ctx );
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000564
565 /* Parse the data. */
Steven Cooreman7f391872020-07-30 14:57:44 +0200566 if( PSA_KEY_TYPE_IS_KEY_PAIR( type ) )
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000567 status = mbedtls_to_psa_error(
Steven Cooreman4fed4552020-08-03 14:46:03 +0200568 mbedtls_pk_parse_key( &ctx, data, data_length, NULL, 0 ) );
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200569 else
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000570 status = mbedtls_to_psa_error(
Steven Cooreman4fed4552020-08-03 14:46:03 +0200571 mbedtls_pk_parse_public_key( &ctx, data, data_length ) );
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000572 if( status != PSA_SUCCESS )
573 goto exit;
574
575 /* We have something that the pkparse module recognizes. If it is a
576 * valid RSA key, store it. */
Steven Cooremana01795d2020-07-24 22:48:15 +0200577 if( mbedtls_pk_get_type( &ctx ) != MBEDTLS_PK_RSA )
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200578 {
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000579 status = PSA_ERROR_INVALID_ARGUMENT;
580 goto exit;
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200581 }
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000582
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000583 /* The size of an RSA key doesn't have to be a multiple of 8. Mbed TLS
584 * supports non-byte-aligned key sizes, but not well. For example,
585 * mbedtls_rsa_get_len() returns the key size in bytes, not in bits. */
Steven Cooremana01795d2020-07-24 22:48:15 +0200586 bits = PSA_BYTES_TO_BITS( mbedtls_rsa_get_len( mbedtls_pk_rsa( ctx ) ) );
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000587 if( bits > PSA_VENDOR_RSA_MAX_KEY_BITS )
588 {
589 status = PSA_ERROR_NOT_SUPPORTED;
590 goto exit;
591 }
Steven Cooremana01795d2020-07-24 22:48:15 +0200592 status = psa_check_rsa_key_byte_aligned( mbedtls_pk_rsa( ctx ) );
Steven Cooremana01795d2020-07-24 22:48:15 +0200593 if( status != PSA_SUCCESS )
594 goto exit;
595
Steven Cooremana2371e52020-07-28 14:30:39 +0200596 /* Copy out the pointer to the RSA context, and reset the PK context
597 * such that pk_free doesn't free the RSA context we just grabbed. */
598 *p_rsa = mbedtls_pk_rsa( ctx );
599 ctx.pk_info = NULL;
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000600
601exit:
Steven Cooremana01795d2020-07-24 22:48:15 +0200602 mbedtls_pk_free( &ctx );
603 return( status );
Steven Cooremana01795d2020-07-24 22:48:15 +0200604}
605
John Durkop6ba40d12020-11-10 08:50:04 -0800606#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) ||
607 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
608 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) ||
609 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) ||
610 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
611 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
612
613#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
614 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
615
Steven Cooremana01795d2020-07-24 22:48:15 +0200616/** Export an RSA key to export representation
617 *
618 * \param[in] type The type of key (public/private) to export
619 * \param[in] rsa The internal RSA representation from which to export
620 * \param[out] data The buffer to export to
621 * \param[in] data_size The length of the buffer to export to
622 * \param[out] data_length The amount of bytes written to \p data
623 */
624static psa_status_t psa_export_rsa_key( psa_key_type_t type,
625 mbedtls_rsa_context *rsa,
626 uint8_t *data,
627 size_t data_size,
628 size_t *data_length )
629{
630#if defined(MBEDTLS_PK_WRITE_C)
631 int ret;
632 mbedtls_pk_context pk;
633 uint8_t *pos = data + data_size;
634
635 mbedtls_pk_init( &pk );
636 pk.pk_info = &mbedtls_rsa_info;
637 pk.pk_ctx = rsa;
638
639 /* PSA Crypto API defines the format of an RSA key as a DER-encoded
Steven Cooreman75b74362020-07-28 14:30:13 +0200640 * representation of the non-encrypted PKCS#1 RSAPrivateKey for a
641 * private key and of the RFC3279 RSAPublicKey for a public key. */
Steven Cooremana01795d2020-07-24 22:48:15 +0200642 if( PSA_KEY_TYPE_IS_KEY_PAIR( type ) )
643 ret = mbedtls_pk_write_key_der( &pk, data, data_size );
644 else
645 ret = mbedtls_pk_write_pubkey( &pos, data, &pk );
646
647 if( ret < 0 )
Steven Cooreman4fed4552020-08-03 14:46:03 +0200648 {
649 /* Clean up in case pk_write failed halfway through. */
650 memset( data, 0, data_size );
Steven Cooreman29149862020-08-05 15:43:42 +0200651 return( mbedtls_to_psa_error( ret ) );
Steven Cooreman4fed4552020-08-03 14:46:03 +0200652 }
Steven Cooremana01795d2020-07-24 22:48:15 +0200653
654 /* The mbedtls_pk_xxx functions write to the end of the buffer.
655 * Move the data to the beginning and erase remaining data
656 * at the original location. */
657 if( 2 * (size_t) ret <= data_size )
658 {
659 memcpy( data, data + data_size - ret, ret );
660 memset( data + data_size - ret, 0, ret );
661 }
662 else if( (size_t) ret < data_size )
663 {
664 memmove( data, data + data_size - ret, ret );
665 memset( data + ret, 0, data_size - ret );
666 }
667
668 *data_length = ret;
669 return( PSA_SUCCESS );
670#else
671 (void) type;
672 (void) rsa;
673 (void) data;
674 (void) data_size;
675 (void) data_length;
676 return( PSA_ERROR_NOT_SUPPORTED );
677#endif /* MBEDTLS_PK_WRITE_C */
678}
679
680/** Import an RSA key from import representation to a slot
681 *
682 * \param[in,out] slot The slot where to store the export representation to
683 * \param[in] data The buffer containing the import representation
684 * \param[in] data_length The amount of bytes in \p data
685 */
686static psa_status_t psa_import_rsa_key( psa_key_slot_t *slot,
687 const uint8_t *data,
688 size_t data_length )
689{
690 psa_status_t status;
691 uint8_t* output = NULL;
Steven Cooremana2371e52020-07-28 14:30:39 +0200692 mbedtls_rsa_context *rsa = NULL;
Steven Cooremana01795d2020-07-24 22:48:15 +0200693
Steven Cooremana01795d2020-07-24 22:48:15 +0200694 /* Parse input */
Steven Cooreman4fed4552020-08-03 14:46:03 +0200695 status = psa_load_rsa_representation( slot->attr.type,
696 data,
Steven Cooreman7f391872020-07-30 14:57:44 +0200697 data_length,
Steven Cooreman7f391872020-07-30 14:57:44 +0200698 &rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +0200699 if( status != PSA_SUCCESS )
700 goto exit;
701
702 slot->attr.bits = (psa_key_bits_t) PSA_BYTES_TO_BITS(
Steven Cooremana2371e52020-07-28 14:30:39 +0200703 mbedtls_rsa_get_len( rsa ) );
Steven Cooremana01795d2020-07-24 22:48:15 +0200704
Steven Cooreman75b74362020-07-28 14:30:13 +0200705 /* Re-export the data to PSA export format, such that we can store export
706 * representation in the key slot. Export representation in case of RSA is
707 * the smallest representation that's allowed as input, so a straight-up
708 * allocation of the same size as the input buffer will be large enough. */
Steven Cooremana01795d2020-07-24 22:48:15 +0200709 output = mbedtls_calloc( 1, data_length );
Steven Cooremana01795d2020-07-24 22:48:15 +0200710 if( output == NULL )
711 {
712 status = PSA_ERROR_INSUFFICIENT_MEMORY;
713 goto exit;
714 }
715
Steven Cooremana01795d2020-07-24 22:48:15 +0200716 status = psa_export_rsa_key( slot->attr.type,
Steven Cooremana2371e52020-07-28 14:30:39 +0200717 rsa,
Steven Cooremana01795d2020-07-24 22:48:15 +0200718 output,
719 data_length,
720 &data_length);
Steven Cooremana01795d2020-07-24 22:48:15 +0200721exit:
722 /* Always free the RSA object */
Steven Cooremana2371e52020-07-28 14:30:39 +0200723 mbedtls_rsa_free( rsa );
Steven Cooreman6d839f02020-07-30 11:36:45 +0200724 mbedtls_free( rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +0200725
726 /* Free the allocated buffer only on error. */
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000727 if( status != PSA_SUCCESS )
728 {
Steven Cooremana01795d2020-07-24 22:48:15 +0200729 mbedtls_free( output );
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000730 return( status );
731 }
732
Steven Cooremana01795d2020-07-24 22:48:15 +0200733 /* On success, store the allocated export-formatted key. */
734 slot->data.key.data = output;
735 slot->data.key.bytes = data_length;
Jaeden Amerocd09d8c2019-01-11 17:53:05 +0000736
737 return( PSA_SUCCESS );
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200738}
John Durkop6ba40d12020-11-10 08:50:04 -0800739
740#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
John Durkop9814fa22020-11-04 12:28:15 -0800741 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200742
John Durkop9814fa22020-11-04 12:28:15 -0800743#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
John Durkop6ba40d12020-11-10 08:50:04 -0800744 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) || \
745 defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
746 defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH) || \
747 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
Steven Cooreman7f391872020-07-30 14:57:44 +0200748/** Load the contents of a key buffer into an internal ECP representation
Steven Cooremana2371e52020-07-28 14:30:39 +0200749 *
Steven Cooreman4fed4552020-08-03 14:46:03 +0200750 * \param[in] type The type of key contained in \p data.
751 * \param[in] data The buffer from which to load the representation.
752 * \param[in] data_length The size in bytes of \p data.
753 * \param[out] p_ecp Returns a pointer to an ECP context on success.
754 * The caller is responsible for freeing both the
755 * contents of the context and the context itself
756 * when done.
Steven Cooremana2371e52020-07-28 14:30:39 +0200757 */
Steven Cooreman4fed4552020-08-03 14:46:03 +0200758static psa_status_t psa_load_ecp_representation( psa_key_type_t type,
759 const uint8_t *data,
760 size_t data_length,
Steven Cooremana2371e52020-07-28 14:30:39 +0200761 mbedtls_ecp_keypair **p_ecp )
Gilles Peskine4cd32772019-12-02 20:49:42 +0100762{
763 mbedtls_ecp_group_id grp_id = MBEDTLS_ECP_DP_NONE;
Steven Cooremanacda8342020-07-24 23:09:52 +0200764 psa_status_t status;
Steven Cooreman6d839f02020-07-30 11:36:45 +0200765 mbedtls_ecp_keypair *ecp = NULL;
Steven Cooreman4fed4552020-08-03 14:46:03 +0200766 size_t curve_size = data_length;
Gilles Peskine4cd32772019-12-02 20:49:42 +0100767
Steven Cooreman4fed4552020-08-03 14:46:03 +0200768 if( PSA_KEY_TYPE_IS_PUBLIC_KEY( type ) &&
769 PSA_KEY_TYPE_ECC_GET_FAMILY( type ) != PSA_ECC_FAMILY_MONTGOMERY )
Gilles Peskine4295e8b2019-12-02 21:39:10 +0100770 {
Steven Cooreman4fed4552020-08-03 14:46:03 +0200771 /* A Weierstrass public key is represented as:
772 * - The byte 0x04;
773 * - `x_P` as a `ceiling(m/8)`-byte string, big-endian;
774 * - `y_P` as a `ceiling(m/8)`-byte string, big-endian.
Steven Cooreman3ea0ce42020-10-23 11:37:05 +0200775 * So its data length is 2m+1 where m is the curve size in bits.
Steven Cooreman4fed4552020-08-03 14:46:03 +0200776 */
777 if( ( data_length & 1 ) == 0 )
778 return( PSA_ERROR_INVALID_ARGUMENT );
779 curve_size = data_length / 2;
780
781 /* Montgomery public keys are represented in compressed format, meaning
782 * their curve_size is equal to the amount of input. */
783
784 /* Private keys are represented in uncompressed private random integer
785 * format, meaning their curve_size is equal to the amount of input. */
Gilles Peskine4295e8b2019-12-02 21:39:10 +0100786 }
787
Steven Cooreman6d839f02020-07-30 11:36:45 +0200788 /* Allocate and initialize a key representation. */
Steven Cooreman29149862020-08-05 15:43:42 +0200789 ecp = mbedtls_calloc( 1, sizeof( mbedtls_ecp_keypair ) );
Steven Cooreman6d839f02020-07-30 11:36:45 +0200790 if( ecp == NULL )
Steven Cooreman29149862020-08-05 15:43:42 +0200791 return( PSA_ERROR_INSUFFICIENT_MEMORY );
Steven Cooremana2371e52020-07-28 14:30:39 +0200792 mbedtls_ecp_keypair_init( ecp );
793
Gilles Peskine4cd32772019-12-02 20:49:42 +0100794 /* Load the group. */
Steven Cooreman7f391872020-07-30 14:57:44 +0200795 grp_id = mbedtls_ecc_group_of_psa( PSA_KEY_TYPE_ECC_GET_FAMILY( type ),
796 curve_size );
Gilles Peskine4295e8b2019-12-02 21:39:10 +0100797 if( grp_id == MBEDTLS_ECP_DP_NONE )
Steven Cooreman6d839f02020-07-30 11:36:45 +0200798 {
799 status = PSA_ERROR_INVALID_ARGUMENT;
800 goto exit;
801 }
802
Steven Cooremanacda8342020-07-24 23:09:52 +0200803 status = mbedtls_to_psa_error(
804 mbedtls_ecp_group_load( &ecp->grp, grp_id ) );
805 if( status != PSA_SUCCESS )
Steven Cooreman6d839f02020-07-30 11:36:45 +0200806 goto exit;
Steven Cooremanacda8342020-07-24 23:09:52 +0200807
Steven Cooreman6d839f02020-07-30 11:36:45 +0200808 /* Load the key material. */
Steven Cooreman7f391872020-07-30 14:57:44 +0200809 if( PSA_KEY_TYPE_IS_PUBLIC_KEY( type ) )
Steven Cooremanacda8342020-07-24 23:09:52 +0200810 {
811 /* Load the public value. */
812 status = mbedtls_to_psa_error(
813 mbedtls_ecp_point_read_binary( &ecp->grp, &ecp->Q,
Steven Cooreman4fed4552020-08-03 14:46:03 +0200814 data,
815 data_length ) );
Steven Cooremanacda8342020-07-24 23:09:52 +0200816 if( status != PSA_SUCCESS )
817 goto exit;
818
819 /* Check that the point is on the curve. */
820 status = mbedtls_to_psa_error(
821 mbedtls_ecp_check_pubkey( &ecp->grp, &ecp->Q ) );
822 if( status != PSA_SUCCESS )
823 goto exit;
824 }
825 else
826 {
Steven Cooreman6d839f02020-07-30 11:36:45 +0200827 /* Load and validate the secret value. */
Steven Cooremanacda8342020-07-24 23:09:52 +0200828 status = mbedtls_to_psa_error(
829 mbedtls_ecp_read_key( ecp->grp.id,
830 ecp,
Steven Cooreman4fed4552020-08-03 14:46:03 +0200831 data,
832 data_length ) );
Steven Cooremanacda8342020-07-24 23:09:52 +0200833 if( status != PSA_SUCCESS )
834 goto exit;
Steven Cooremanacda8342020-07-24 23:09:52 +0200835 }
Steven Cooremana2371e52020-07-28 14:30:39 +0200836
837 *p_ecp = ecp;
Steven Cooremanacda8342020-07-24 23:09:52 +0200838exit:
839 if( status != PSA_SUCCESS )
Steven Cooremana2371e52020-07-28 14:30:39 +0200840 {
Steven Cooremanacda8342020-07-24 23:09:52 +0200841 mbedtls_ecp_keypair_free( ecp );
Steven Cooremana2371e52020-07-28 14:30:39 +0200842 mbedtls_free( ecp );
843 }
844
Steven Cooreman29149862020-08-05 15:43:42 +0200845 return( status );
Gilles Peskine4cd32772019-12-02 20:49:42 +0100846}
John Durkop6ba40d12020-11-10 08:50:04 -0800847#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
848 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) ||
849 * defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
850 * defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH) ||
851 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Jaeden Ameroccdce902019-01-10 11:42:27 +0000852
John Durkop6ba40d12020-11-10 08:50:04 -0800853#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
854 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
Steven Cooreman4fed4552020-08-03 14:46:03 +0200855/** Export an ECP key to export representation
856 *
857 * \param[in] type The type of key (public/private) to export
858 * \param[in] ecp The internal ECP representation from which to export
859 * \param[out] data The buffer to export to
860 * \param[in] data_size The length of the buffer to export to
861 * \param[out] data_length The amount of bytes written to \p data
862 */
Steven Cooremanacda8342020-07-24 23:09:52 +0200863static psa_status_t psa_export_ecp_key( psa_key_type_t type,
864 mbedtls_ecp_keypair *ecp,
865 uint8_t *data,
866 size_t data_size,
867 size_t *data_length )
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200868{
Steven Cooremanacda8342020-07-24 23:09:52 +0200869 psa_status_t status;
Jaeden Ameroccdce902019-01-10 11:42:27 +0000870
Steven Cooremanacda8342020-07-24 23:09:52 +0200871 if( PSA_KEY_TYPE_IS_PUBLIC_KEY( type ) )
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200872 {
Steven Cooremanacda8342020-07-24 23:09:52 +0200873 /* Check whether the public part is loaded */
874 if( mbedtls_ecp_is_zero( &ecp->Q ) )
875 {
876 /* Calculate the public key */
877 status = mbedtls_to_psa_error(
878 mbedtls_ecp_mul( &ecp->grp, &ecp->Q, &ecp->d, &ecp->grp.G,
Gilles Peskine5894e8e2020-12-14 14:54:06 +0100879 mbedtls_psa_get_random, MBEDTLS_PSA_RANDOM_STATE ) );
Steven Cooremanacda8342020-07-24 23:09:52 +0200880 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +0200881 return( status );
Steven Cooremanacda8342020-07-24 23:09:52 +0200882 }
883
Steven Cooreman4fed4552020-08-03 14:46:03 +0200884 status = mbedtls_to_psa_error(
Steven Cooremanacda8342020-07-24 23:09:52 +0200885 mbedtls_ecp_point_write_binary( &ecp->grp, &ecp->Q,
886 MBEDTLS_ECP_PF_UNCOMPRESSED,
887 data_length,
888 data,
Steven Cooreman4fed4552020-08-03 14:46:03 +0200889 data_size ) );
Steven Cooreman4fed4552020-08-03 14:46:03 +0200890 if( status != PSA_SUCCESS )
891 memset( data, 0, data_size );
892
Steven Cooreman29149862020-08-05 15:43:42 +0200893 return( status );
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200894 }
Steven Cooremanacda8342020-07-24 23:09:52 +0200895 else
896 {
Steven Cooreman29149862020-08-05 15:43:42 +0200897 if( data_size < PSA_BITS_TO_BYTES( ecp->grp.nbits ) )
Steven Cooremanacda8342020-07-24 23:09:52 +0200898 return( PSA_ERROR_BUFFER_TOO_SMALL );
899
900 status = mbedtls_to_psa_error(
901 mbedtls_ecp_write_key( ecp,
902 data,
Steven Cooreman29149862020-08-05 15:43:42 +0200903 PSA_BITS_TO_BYTES( ecp->grp.nbits ) ) );
Steven Cooremanacda8342020-07-24 23:09:52 +0200904 if( status == PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +0200905 *data_length = PSA_BITS_TO_BYTES( ecp->grp.nbits );
Steven Cooremanb7f6dea2020-08-05 16:07:20 +0200906 else
907 memset( data, 0, data_size );
Steven Cooremanacda8342020-07-24 23:09:52 +0200908
909 return( status );
910 }
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200911}
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200912
Steven Cooreman4fed4552020-08-03 14:46:03 +0200913/** Import an ECP key from import representation to a slot
914 *
915 * \param[in,out] slot The slot where to store the export representation to
916 * \param[in] data The buffer containing the import representation
917 * \param[in] data_length The amount of bytes in \p data
918 */
Steven Cooremanacda8342020-07-24 23:09:52 +0200919static psa_status_t psa_import_ecp_key( psa_key_slot_t *slot,
920 const uint8_t *data,
921 size_t data_length )
Gilles Peskinef76aa772018-10-29 19:24:33 +0100922{
Steven Cooremanacda8342020-07-24 23:09:52 +0200923 psa_status_t status;
924 uint8_t* output = NULL;
Steven Cooremana2371e52020-07-28 14:30:39 +0200925 mbedtls_ecp_keypair *ecp = NULL;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100926
Steven Cooremanacda8342020-07-24 23:09:52 +0200927 /* Parse input */
Steven Cooreman4fed4552020-08-03 14:46:03 +0200928 status = psa_load_ecp_representation( slot->attr.type,
929 data,
Steven Cooreman7f391872020-07-30 14:57:44 +0200930 data_length,
Steven Cooreman7f391872020-07-30 14:57:44 +0200931 &ecp );
Gilles Peskinef76aa772018-10-29 19:24:33 +0100932 if( status != PSA_SUCCESS )
933 goto exit;
Gilles Peskine4cd32772019-12-02 20:49:42 +0100934
Steven Cooremanacda8342020-07-24 23:09:52 +0200935 if( PSA_KEY_TYPE_ECC_GET_FAMILY( slot->attr.type ) == PSA_ECC_FAMILY_MONTGOMERY)
Steven Cooremana2371e52020-07-28 14:30:39 +0200936 slot->attr.bits = (psa_key_bits_t) ecp->grp.nbits + 1;
Steven Cooremanacda8342020-07-24 23:09:52 +0200937 else
Steven Cooremana2371e52020-07-28 14:30:39 +0200938 slot->attr.bits = (psa_key_bits_t) ecp->grp.nbits;
Steven Cooremane3fd3922020-06-11 16:50:36 +0200939
Steven Cooremanacda8342020-07-24 23:09:52 +0200940 /* Re-export the data to PSA export format. There is currently no support
941 * for other input formats then the export format, so this is a 1-1
942 * copy operation. */
943 output = mbedtls_calloc( 1, data_length );
Steven Cooremanacda8342020-07-24 23:09:52 +0200944 if( output == NULL )
945 {
946 status = PSA_ERROR_INSUFFICIENT_MEMORY;
947 goto exit;
948 }
949
950 status = psa_export_ecp_key( slot->attr.type,
Steven Cooremana2371e52020-07-28 14:30:39 +0200951 ecp,
Steven Cooremanacda8342020-07-24 23:09:52 +0200952 output,
953 data_length,
954 &data_length);
Gilles Peskinef76aa772018-10-29 19:24:33 +0100955exit:
Steven Cooremana2371e52020-07-28 14:30:39 +0200956 /* Always free the PK object (will also free contained ECP context) */
957 mbedtls_ecp_keypair_free( ecp );
Steven Cooreman6d839f02020-07-30 11:36:45 +0200958 mbedtls_free( ecp );
Steven Cooremanacda8342020-07-24 23:09:52 +0200959
960 /* Free the allocated buffer only on error. */
961 if( status != PSA_SUCCESS )
Gilles Peskinef76aa772018-10-29 19:24:33 +0100962 {
Steven Cooremanacda8342020-07-24 23:09:52 +0200963 mbedtls_free( output );
Steven Cooremanacda8342020-07-24 23:09:52 +0200964 return( status );
Gilles Peskinef76aa772018-10-29 19:24:33 +0100965 }
Steven Cooremanacda8342020-07-24 23:09:52 +0200966
967 /* On success, store the allocated export-formatted key. */
968 slot->data.key.data = output;
969 slot->data.key.bytes = data_length;
970
971 return( PSA_SUCCESS );
Gilles Peskinef76aa772018-10-29 19:24:33 +0100972}
John Durkop9814fa22020-11-04 12:28:15 -0800973#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
974 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
Gilles Peskinef76aa772018-10-29 19:24:33 +0100975
Gilles Peskineb46bef22019-07-30 21:32:04 +0200976/** Return the size of the key in the given slot, in bits.
977 *
978 * \param[in] slot A key slot.
979 *
980 * \return The key size in bits, read from the metadata in the slot.
981 */
982static inline size_t psa_get_key_slot_bits( const psa_key_slot_t *slot )
983{
984 return( slot->attr.bits );
985}
986
Steven Cooreman75b74362020-07-28 14:30:13 +0200987/** Try to allocate a buffer to an empty key slot.
988 *
989 * \param[in,out] slot Key slot to attach buffer to.
990 * \param[in] buffer_length Requested size of the buffer.
991 *
992 * \retval #PSA_SUCCESS
993 * The buffer has been successfully allocated.
994 * \retval #PSA_ERROR_INSUFFICIENT_MEMORY
995 * Not enough memory was available for allocation.
996 * \retval #PSA_ERROR_ALREADY_EXISTS
997 * Trying to allocate a buffer to a non-empty key slot.
998 */
999static psa_status_t psa_allocate_buffer_to_slot( psa_key_slot_t *slot,
1000 size_t buffer_length )
1001{
1002 if( slot->data.key.data != NULL )
Steven Cooreman29149862020-08-05 15:43:42 +02001003 return( PSA_ERROR_ALREADY_EXISTS );
Steven Cooreman75b74362020-07-28 14:30:13 +02001004
1005 slot->data.key.data = mbedtls_calloc( 1, buffer_length );
1006 if( slot->data.key.data == NULL )
Steven Cooreman29149862020-08-05 15:43:42 +02001007 return( PSA_ERROR_INSUFFICIENT_MEMORY );
Steven Cooreman75b74362020-07-28 14:30:13 +02001008
1009 slot->data.key.bytes = buffer_length;
Steven Cooreman29149862020-08-05 15:43:42 +02001010 return( PSA_SUCCESS );
Steven Cooreman75b74362020-07-28 14:30:13 +02001011}
1012
Steven Cooremanf7cebd42020-10-13 20:27:40 +02001013psa_status_t psa_copy_key_material_into_slot( psa_key_slot_t *slot,
1014 const uint8_t* data,
1015 size_t data_length )
1016{
1017 psa_status_t status = psa_allocate_buffer_to_slot( slot,
1018 data_length );
1019 if( status != PSA_SUCCESS )
1020 return( status );
1021
1022 memcpy( slot->data.key.data, data, data_length );
1023 return( PSA_SUCCESS );
1024}
1025
Steven Cooreman3ea0ce42020-10-23 11:37:05 +02001026/** Import key data into a slot.
1027 *
1028 * `slot->type` must have been set previously.
1029 * This function assumes that the slot does not contain any key material yet.
1030 * On failure, the slot content is unchanged.
1031 *
1032 * Persistent storage is not affected.
1033 *
1034 * \param[in,out] slot The key slot to import data into.
1035 * Its `type` field must have previously been set to
1036 * the desired key type.
1037 * It must not contain any key material yet.
1038 * \param[in] data Buffer containing the key material to parse and import.
1039 * \param data_length Size of \p data in bytes.
1040 *
1041 * \retval #PSA_SUCCESS
1042 * \retval #PSA_ERROR_INVALID_ARGUMENT
1043 * \retval #PSA_ERROR_NOT_SUPPORTED
1044 * \retval #PSA_ERROR_INSUFFICIENT_MEMORY
1045 */
1046static psa_status_t psa_import_key_into_slot( psa_key_slot_t *slot,
1047 const uint8_t *data,
1048 size_t data_length )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001049{
Gilles Peskineb0b255c2018-07-06 17:01:38 +02001050 psa_status_t status = PSA_SUCCESS;
Steven Cooreman04524762020-10-13 17:43:44 +02001051 size_t bit_size;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001052
Steven Cooreman81be2fa2020-07-24 22:04:59 +02001053 /* zero-length keys are never supported. */
1054 if( data_length == 0 )
1055 return( PSA_ERROR_NOT_SUPPORTED );
1056
Gilles Peskine8e338702019-07-30 20:06:31 +02001057 if( key_type_is_raw_bytes( slot->attr.type ) )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001058 {
Steven Cooreman04524762020-10-13 17:43:44 +02001059 bit_size = PSA_BYTES_TO_BITS( data_length );
Steven Cooreman81be2fa2020-07-24 22:04:59 +02001060
Steven Cooreman75b74362020-07-28 14:30:13 +02001061 /* Ensure that the bytes-to-bits conversion hasn't overflown. */
1062 if( data_length > SIZE_MAX / 8 )
1063 return( PSA_ERROR_NOT_SUPPORTED );
1064
Gilles Peskine1b9505c2019-08-07 10:59:45 +02001065 /* Enforce a size limit, and in particular ensure that the bit
1066 * size fits in its representation type. */
Gilles Peskinec744d992019-07-30 17:26:54 +02001067 if( bit_size > PSA_MAX_KEY_BITS )
1068 return( PSA_ERROR_NOT_SUPPORTED );
Steven Cooreman81be2fa2020-07-24 22:04:59 +02001069
1070 status = validate_unstructured_key_bit_size( slot->attr.type, bit_size );
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +02001071 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02001072 return( status );
Steven Cooreman81be2fa2020-07-24 22:04:59 +02001073
1074 /* Allocate memory for the key */
Steven Cooremanf7cebd42020-10-13 20:27:40 +02001075 status = psa_copy_key_material_into_slot( slot, data, data_length );
Steven Cooreman75b74362020-07-28 14:30:13 +02001076 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02001077 return( status );
Steven Cooreman81be2fa2020-07-24 22:04:59 +02001078
Steven Cooreman81be2fa2020-07-24 22:04:59 +02001079 /* Write the actual key size to the slot.
1080 * psa_start_key_creation() wrote the size declared by the
1081 * caller, which may be 0 (meaning unspecified) or wrong. */
1082 slot->attr.bits = (psa_key_bits_t) bit_size;
Steven Cooreman40120f62020-10-29 11:42:22 +01001083
1084 return( PSA_SUCCESS );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001085 }
Steven Cooreman3ea0ce42020-10-23 11:37:05 +02001086 else if( PSA_KEY_TYPE_IS_ASYMMETRIC( slot->attr.type ) )
Steven Cooreman19fd5742020-07-24 23:31:01 +02001087 {
Steven Cooreman3ea0ce42020-10-23 11:37:05 +02001088 /* Try validation through accelerators first. */
1089 bit_size = slot->attr.bits;
1090 psa_key_attributes_t attributes = {
1091 .core = slot->attr
1092 };
1093 status = psa_driver_wrapper_validate_key( &attributes,
1094 data,
1095 data_length,
1096 &bit_size );
1097 if( status == PSA_SUCCESS )
1098 {
1099 /* Key has been validated successfully by an accelerator.
1100 * Copy key material into slot. */
1101 status = psa_copy_key_material_into_slot( slot, data, data_length );
1102 if( status != PSA_SUCCESS )
1103 return( status );
1104
1105 slot->attr.bits = (psa_key_bits_t) bit_size;
1106 return( PSA_SUCCESS );
1107 }
1108 else if( status != PSA_ERROR_NOT_SUPPORTED )
1109 return( status );
1110
1111 /* Key format is not supported by any accelerator, try software fallback
1112 * if present. */
John Durkop9814fa22020-11-04 12:28:15 -08001113#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
1114 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
Steven Cooreman3ea0ce42020-10-23 11:37:05 +02001115 if( PSA_KEY_TYPE_IS_ECC( slot->attr.type ) )
1116 {
Steven Cooreman40120f62020-10-29 11:42:22 +01001117 return( psa_import_ecp_key( slot, data, data_length ) );
1118 }
John Durkop9814fa22020-11-04 12:28:15 -08001119#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
1120 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
John Durkop0e005192020-10-31 22:06:54 -07001121#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
1122 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Steven Cooreman40120f62020-10-29 11:42:22 +01001123 if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
Steven Cooreman3ea0ce42020-10-23 11:37:05 +02001124 {
Steven Cooreman40120f62020-10-29 11:42:22 +01001125 return( psa_import_rsa_key( slot, data, data_length ) );
Steven Cooreman3ea0ce42020-10-23 11:37:05 +02001126 }
John Durkop9814fa22020-11-04 12:28:15 -08001127#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
1128 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Steven Cooreman40120f62020-10-29 11:42:22 +01001129
1130 /* Fell through the fallback as well, so have nothing else to try. */
1131 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001132 }
1133 else
Gilles Peskinec66ea6a2018-02-03 22:43:28 +01001134 {
Steven Cooreman19fd5742020-07-24 23:31:01 +02001135 /* Unknown key type */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001136 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine969ac722018-01-28 18:16:59 +01001137 }
Darryl Green06fd18d2018-07-16 11:21:11 +01001138}
1139
Gilles Peskinef603c712019-01-19 13:40:11 +01001140/** Calculate the intersection of two algorithm usage policies.
1141 *
1142 * Return 0 (which allows no operation) on incompatibility.
1143 */
1144static psa_algorithm_t psa_key_policy_algorithm_intersection(
1145 psa_algorithm_t alg1,
1146 psa_algorithm_t alg2 )
1147{
Gilles Peskine549ea862019-05-22 11:45:59 +02001148 /* Common case: both sides actually specify the same policy. */
Gilles Peskinef603c712019-01-19 13:40:11 +01001149 if( alg1 == alg2 )
1150 return( alg1 );
1151 /* If the policies are from the same hash-and-sign family, check
1152 * if one is a wildcard. If so the other has the specific algorithm. */
1153 if( PSA_ALG_IS_HASH_AND_SIGN( alg1 ) &&
1154 PSA_ALG_IS_HASH_AND_SIGN( alg2 ) &&
1155 ( alg1 & ~PSA_ALG_HASH_MASK ) == ( alg2 & ~PSA_ALG_HASH_MASK ) )
1156 {
1157 if( PSA_ALG_SIGN_GET_HASH( alg1 ) == PSA_ALG_ANY_HASH )
1158 return( alg2 );
1159 if( PSA_ALG_SIGN_GET_HASH( alg2 ) == PSA_ALG_ANY_HASH )
1160 return( alg1 );
1161 }
1162 /* If the policies are incompatible, allow nothing. */
1163 return( 0 );
1164}
1165
Gilles Peskined6f371b2019-05-10 19:33:38 +02001166static int psa_key_algorithm_permits( psa_algorithm_t policy_alg,
1167 psa_algorithm_t requested_alg )
1168{
Gilles Peskine549ea862019-05-22 11:45:59 +02001169 /* Common case: the policy only allows requested_alg. */
Gilles Peskined6f371b2019-05-10 19:33:38 +02001170 if( requested_alg == policy_alg )
1171 return( 1 );
1172 /* If policy_alg is a hash-and-sign with a wildcard for the hash,
Gilles Peskine549ea862019-05-22 11:45:59 +02001173 * and requested_alg is the same hash-and-sign family with any hash,
1174 * then requested_alg is compliant with policy_alg. */
Gilles Peskined6f371b2019-05-10 19:33:38 +02001175 if( PSA_ALG_IS_HASH_AND_SIGN( requested_alg ) &&
1176 PSA_ALG_SIGN_GET_HASH( policy_alg ) == PSA_ALG_ANY_HASH )
1177 {
1178 return( ( policy_alg & ~PSA_ALG_HASH_MASK ) ==
1179 ( requested_alg & ~PSA_ALG_HASH_MASK ) );
1180 }
Steven Cooremance48e852020-10-05 16:02:45 +02001181 /* If policy_alg is a generic key agreement operation, then using it for
Steven Cooremanfa5e6312020-10-15 17:07:12 +02001182 * a key derivation with that key agreement should also be allowed. This
1183 * behaviour is expected to be defined in a future specification version. */
Steven Cooremance48e852020-10-05 16:02:45 +02001184 if( PSA_ALG_IS_RAW_KEY_AGREEMENT( policy_alg ) &&
1185 PSA_ALG_IS_KEY_AGREEMENT( requested_alg ) )
1186 {
1187 return( PSA_ALG_KEY_AGREEMENT_GET_BASE( requested_alg ) ==
1188 policy_alg );
1189 }
Gilles Peskined6f371b2019-05-10 19:33:38 +02001190 /* If it isn't permitted, it's forbidden. */
1191 return( 0 );
1192}
1193
Gilles Peskine30f77cd2019-01-14 16:06:39 +01001194/** Test whether a policy permits an algorithm.
1195 *
1196 * The caller must test usage flags separately.
1197 */
1198static int psa_key_policy_permits( const psa_key_policy_t *policy,
1199 psa_algorithm_t alg )
1200{
Gilles Peskined6f371b2019-05-10 19:33:38 +02001201 return( psa_key_algorithm_permits( policy->alg, alg ) ||
1202 psa_key_algorithm_permits( policy->alg2, alg ) );
Gilles Peskine30f77cd2019-01-14 16:06:39 +01001203}
1204
Gilles Peskinef603c712019-01-19 13:40:11 +01001205/** Restrict a key policy based on a constraint.
1206 *
1207 * \param[in,out] policy The policy to restrict.
1208 * \param[in] constraint The policy constraint to apply.
1209 *
1210 * \retval #PSA_SUCCESS
1211 * \c *policy contains the intersection of the original value of
1212 * \c *policy and \c *constraint.
1213 * \retval #PSA_ERROR_INVALID_ARGUMENT
1214 * \c *policy and \c *constraint are incompatible.
1215 * \c *policy is unchanged.
1216 */
1217static psa_status_t psa_restrict_key_policy(
1218 psa_key_policy_t *policy,
1219 const psa_key_policy_t *constraint )
1220{
1221 psa_algorithm_t intersection_alg =
1222 psa_key_policy_algorithm_intersection( policy->alg, constraint->alg );
Gilles Peskined6f371b2019-05-10 19:33:38 +02001223 psa_algorithm_t intersection_alg2 =
1224 psa_key_policy_algorithm_intersection( policy->alg2, constraint->alg2 );
Gilles Peskinef603c712019-01-19 13:40:11 +01001225 if( intersection_alg == 0 && policy->alg != 0 && constraint->alg != 0 )
1226 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskined6f371b2019-05-10 19:33:38 +02001227 if( intersection_alg2 == 0 && policy->alg2 != 0 && constraint->alg2 != 0 )
1228 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskinef603c712019-01-19 13:40:11 +01001229 policy->usage &= constraint->usage;
1230 policy->alg = intersection_alg;
Gilles Peskined6f371b2019-05-10 19:33:38 +02001231 policy->alg2 = intersection_alg2;
Gilles Peskinef603c712019-01-19 13:40:11 +01001232 return( PSA_SUCCESS );
1233}
1234
Ronald Cron5c522922020-11-14 16:35:34 +01001235/** Get the description of a key given its identifier and policy constraints
1236 * and lock it.
Ronald Cronf95a2b12020-10-22 15:24:49 +02001237 *
Ronald Cron5c522922020-11-14 16:35:34 +01001238 * The key must have allow all the usage flags set in \p usage. If \p alg is
1239 * nonzero, the key must allow operations with this algorithm.
Ronald Cron7587ae42020-11-11 15:04:25 +01001240 *
Ronald Cron5c522922020-11-14 16:35:34 +01001241 * In case of a persistent key, the function loads the description of the key
1242 * into a key slot if not already done.
1243 *
1244 * On success, the returned key slot is locked. It is the responsibility of
1245 * the caller to unlock the key slot when it does not access it anymore.
Ronald Cronf95a2b12020-10-22 15:24:49 +02001246 */
Ronald Cron5c522922020-11-14 16:35:34 +01001247static psa_status_t psa_get_and_lock_key_slot_with_policy(
1248 mbedtls_svc_key_id_t key,
1249 psa_key_slot_t **p_slot,
1250 psa_key_usage_t usage,
1251 psa_algorithm_t alg )
Darryl Green06fd18d2018-07-16 11:21:11 +01001252{
Ronald Cronf95a2b12020-10-22 15:24:49 +02001253 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
1254 psa_key_slot_t *slot;
Darryl Green06fd18d2018-07-16 11:21:11 +01001255
Ronald Cron5c522922020-11-14 16:35:34 +01001256 status = psa_get_and_lock_key_slot( key, p_slot );
Darryl Green06fd18d2018-07-16 11:21:11 +01001257 if( status != PSA_SUCCESS )
1258 return( status );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001259 slot = *p_slot;
Darryl Green06fd18d2018-07-16 11:21:11 +01001260
1261 /* Enforce that usage policy for the key slot contains all the flags
1262 * required by the usage parameter. There is one exception: public
1263 * keys can always be exported, so we treat public key objects as
1264 * if they had the export flag. */
Gilles Peskine8e338702019-07-30 20:06:31 +02001265 if( PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->attr.type ) )
Darryl Green06fd18d2018-07-16 11:21:11 +01001266 usage &= ~PSA_KEY_USAGE_EXPORT;
Ronald Cronf95a2b12020-10-22 15:24:49 +02001267
1268 status = PSA_ERROR_NOT_PERMITTED;
Gilles Peskine8e338702019-07-30 20:06:31 +02001269 if( ( slot->attr.policy.usage & usage ) != usage )
Ronald Cronf95a2b12020-10-22 15:24:49 +02001270 goto error;
Gilles Peskine30f77cd2019-01-14 16:06:39 +01001271
1272 /* Enforce that the usage policy permits the requested algortihm. */
Gilles Peskine8e338702019-07-30 20:06:31 +02001273 if( alg != 0 && ! psa_key_policy_permits( &slot->attr.policy, alg ) )
Ronald Cronf95a2b12020-10-22 15:24:49 +02001274 goto error;
Darryl Green06fd18d2018-07-16 11:21:11 +01001275
Darryl Green06fd18d2018-07-16 11:21:11 +01001276 return( PSA_SUCCESS );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001277
1278error:
1279 *p_slot = NULL;
Ronald Cron5c522922020-11-14 16:35:34 +01001280 psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001281
1282 return( status );
Darryl Green06fd18d2018-07-16 11:21:11 +01001283}
Darryl Green940d72c2018-07-13 13:18:51 +01001284
Ronald Cron5c522922020-11-14 16:35:34 +01001285/** Get a key slot containing a transparent key and lock it.
Gilles Peskine28f8f302019-07-24 13:30:31 +02001286 *
1287 * A transparent key is a key for which the key material is directly
1288 * available, as opposed to a key in a secure element.
1289 *
Ronald Cron5c522922020-11-14 16:35:34 +01001290 * This is a temporary function to use instead of
1291 * psa_get_and_lock_key_slot_with_policy() until secure element support is
1292 * fully implemented.
Ronald Cronf95a2b12020-10-22 15:24:49 +02001293 *
Ronald Cron5c522922020-11-14 16:35:34 +01001294 * On success, the returned key slot is locked. It is the responsibility of the
1295 * caller to unlock the key slot when it does not access it anymore.
Gilles Peskine28f8f302019-07-24 13:30:31 +02001296 */
1297#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Ronald Cron5c522922020-11-14 16:35:34 +01001298static psa_status_t psa_get_and_lock_transparent_key_slot_with_policy(
1299 mbedtls_svc_key_id_t key,
1300 psa_key_slot_t **p_slot,
1301 psa_key_usage_t usage,
1302 psa_algorithm_t alg )
Gilles Peskine28f8f302019-07-24 13:30:31 +02001303{
Ronald Cron5c522922020-11-14 16:35:34 +01001304 psa_status_t status = psa_get_and_lock_key_slot_with_policy( key, p_slot,
1305 usage, alg );
Gilles Peskine28f8f302019-07-24 13:30:31 +02001306 if( status != PSA_SUCCESS )
1307 return( status );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001308
Gilles Peskineadad8132019-07-25 11:31:23 +02001309 if( psa_key_slot_is_external( *p_slot ) )
Gilles Peskine28f8f302019-07-24 13:30:31 +02001310 {
Ronald Cron5c522922020-11-14 16:35:34 +01001311 psa_unlock_key_slot( *p_slot );
Gilles Peskine28f8f302019-07-24 13:30:31 +02001312 *p_slot = NULL;
1313 return( PSA_ERROR_NOT_SUPPORTED );
1314 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02001315
Gilles Peskine28f8f302019-07-24 13:30:31 +02001316 return( PSA_SUCCESS );
1317}
1318#else /* MBEDTLS_PSA_CRYPTO_SE_C */
1319/* With no secure element support, all keys are transparent. */
Ronald Cron5c522922020-11-14 16:35:34 +01001320#define psa_get_and_lock_transparent_key_slot_with_policy( key, p_slot, usage, alg ) \
1321 psa_get_and_lock_key_slot_with_policy( key, p_slot, usage, alg )
Gilles Peskine28f8f302019-07-24 13:30:31 +02001322#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1323
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001324/** Wipe key data from a slot. Preserve metadata such as the policy. */
Gilles Peskine2f060a82018-12-04 17:12:32 +01001325static psa_status_t psa_remove_key_data_from_memory( psa_key_slot_t *slot )
Darryl Green40225ba2018-11-15 14:48:15 +00001326{
Gilles Peskine73167e12019-07-12 23:44:37 +02001327#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Fredrik Strupe462aa572020-12-17 10:44:38 +01001328 if( psa_get_se_driver( slot->attr.lifetime, NULL, NULL ) &&
1329 psa_key_slot_is_external( slot ) )
Darryl Green40225ba2018-11-15 14:48:15 +00001330 {
1331 /* No key material to clean. */
1332 }
Gilles Peskine73167e12019-07-12 23:44:37 +02001333 else
1334#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Darryl Green40225ba2018-11-15 14:48:15 +00001335 {
Steven Cooremanfd4d69a2020-08-05 15:46:33 +02001336 /* Data pointer will always be either a valid pointer or NULL in an
1337 * initialized slot, so we can just free it. */
1338 if( slot->data.key.data != NULL )
1339 mbedtls_platform_zeroize( slot->data.key.data, slot->data.key.bytes);
Steven Cooremana01795d2020-07-24 22:48:15 +02001340 mbedtls_free( slot->data.key.data );
1341 slot->data.key.data = NULL;
1342 slot->data.key.bytes = 0;
Darryl Green40225ba2018-11-15 14:48:15 +00001343 }
Darryl Green40225ba2018-11-15 14:48:15 +00001344
1345 return( PSA_SUCCESS );
1346}
1347
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001348/** Completely wipe a slot in memory, including its policy.
1349 * Persistent storage is not affected. */
Gilles Peskine66fb1262018-12-10 16:29:04 +01001350psa_status_t psa_wipe_key_slot( psa_key_slot_t *slot )
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001351{
1352 psa_status_t status = psa_remove_key_data_from_memory( slot );
Ronald Cronddd3d052020-10-30 14:07:07 +01001353
1354 /*
1355 * As the return error code may not be handled in case of multiple errors,
Ronald Cron5c522922020-11-14 16:35:34 +01001356 * do our best to report an unexpected lock counter: if available
Ronald Cronddd3d052020-10-30 14:07:07 +01001357 * call MBEDTLS_PARAM_FAILED that may terminate execution (if called as
1358 * part of the execution of a test suite this will stop the test suite
Ronald Cron4640c152020-11-13 10:11:01 +01001359 * execution).
Ronald Cronddd3d052020-10-30 14:07:07 +01001360 */
Ronald Cron5c522922020-11-14 16:35:34 +01001361 if( slot->lock_count != 1 )
Ronald Cronddd3d052020-10-30 14:07:07 +01001362 {
1363#ifdef MBEDTLS_CHECK_PARAMS
Ronald Cron5c522922020-11-14 16:35:34 +01001364 MBEDTLS_PARAM_FAILED( slot->lock_count == 1 );
Ronald Cronddd3d052020-10-30 14:07:07 +01001365#endif
Ronald Cronddd3d052020-10-30 14:07:07 +01001366 status = PSA_ERROR_CORRUPTION_DETECTED;
1367 }
1368
Gilles Peskine3f7cd622019-08-13 15:01:08 +02001369 /* Multipart operations may still be using the key. This is safe
1370 * because all multipart operation objects are independent from
1371 * the key slot: if they need to access the key after the setup
1372 * phase, they have a copy of the key. Note that this means that
1373 * key material can linger until all operations are completed. */
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001374 /* At this point, key material and other type-specific content has
1375 * been wiped. Clear remaining metadata. We can call memset and not
1376 * zeroize because the metadata is not particularly sensitive. */
1377 memset( slot, 0, sizeof( *slot ) );
1378 return( status );
1379}
1380
Ronald Croncf56a0a2020-08-04 09:51:30 +02001381psa_status_t psa_destroy_key( mbedtls_svc_key_id_t key )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001382{
Gilles Peskine2f060a82018-12-04 17:12:32 +01001383 psa_key_slot_t *slot;
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001384 psa_status_t status; /* status of the last operation */
1385 psa_status_t overall_status = PSA_SUCCESS;
Gilles Peskine354f7672019-07-12 23:46:38 +02001386#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1387 psa_se_drv_table_entry_t *driver;
1388#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001389
Ronald Croncf56a0a2020-08-04 09:51:30 +02001390 if( mbedtls_svc_key_id_is_null( key ) )
Gilles Peskine1841cf42019-10-08 15:48:25 +02001391 return( PSA_SUCCESS );
1392
Ronald Cronf2911112020-10-29 17:51:10 +01001393 /*
Ronald Cron19daca92020-11-10 18:08:03 +01001394 * Get the description of the key in a key slot. In case of a persistent
Ronald Cronf2911112020-10-29 17:51:10 +01001395 * key, this will load the key description from persistent memory if not
1396 * done yet. We cannot avoid this loading as without it we don't know if
1397 * the key is operated by an SE or not and this information is needed by
1398 * the current implementation.
1399 */
Ronald Cron5c522922020-11-14 16:35:34 +01001400 status = psa_get_and_lock_key_slot( key, &slot );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02001401 if( status != PSA_SUCCESS )
1402 return( status );
Gilles Peskine354f7672019-07-12 23:46:38 +02001403
Ronald Cronf2911112020-10-29 17:51:10 +01001404 /*
1405 * If the key slot containing the key description is under access by the
1406 * library (apart from the present access), the key cannot be destroyed
1407 * yet. For the time being, just return in error. Eventually (to be
1408 * implemented), the key should be destroyed when all accesses have
1409 * stopped.
1410 */
Ronald Cron5c522922020-11-14 16:35:34 +01001411 if( slot->lock_count > 1 )
Ronald Cronf2911112020-10-29 17:51:10 +01001412 {
Ronald Cron5c522922020-11-14 16:35:34 +01001413 psa_unlock_key_slot( slot );
Ronald Cronf2911112020-10-29 17:51:10 +01001414 return( PSA_ERROR_GENERIC_ERROR );
1415 }
1416
Gilles Peskine354f7672019-07-12 23:46:38 +02001417#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine8e338702019-07-30 20:06:31 +02001418 driver = psa_get_se_driver_entry( slot->attr.lifetime );
Gilles Peskine354f7672019-07-12 23:46:38 +02001419 if( driver != NULL )
Gilles Peskinefc762652019-07-22 19:30:34 +02001420 {
Gilles Peskine60450a42019-07-25 11:32:45 +02001421 /* For a key in a secure element, we need to do three things:
1422 * remove the key file in internal storage, destroy the
1423 * key inside the secure element, and update the driver's
1424 * persistent data. Start a transaction that will encompass these
1425 * three actions. */
Gilles Peskinefc762652019-07-22 19:30:34 +02001426 psa_crypto_prepare_transaction( PSA_CRYPTO_TRANSACTION_DESTROY_KEY );
Gilles Peskine8e338702019-07-30 20:06:31 +02001427 psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
Gilles Peskinefc762652019-07-22 19:30:34 +02001428 psa_crypto_transaction.key.slot = slot->data.se.slot_number;
Gilles Peskine8e338702019-07-30 20:06:31 +02001429 psa_crypto_transaction.key.id = slot->attr.id;
Gilles Peskinefc762652019-07-22 19:30:34 +02001430 status = psa_crypto_save_transaction( );
1431 if( status != PSA_SUCCESS )
1432 {
Gilles Peskine66be51c2019-07-25 18:02:52 +02001433 (void) psa_crypto_stop_transaction( );
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001434 /* We should still try to destroy the key in the secure
1435 * element and the key metadata in storage. This is especially
1436 * important if the error is that the storage is full.
1437 * But how to do it exactly without risking an inconsistent
1438 * state after a reset?
1439 * https://github.com/ARMmbed/mbed-crypto/issues/215
1440 */
1441 overall_status = status;
1442 goto exit;
Gilles Peskinefc762652019-07-22 19:30:34 +02001443 }
1444
Gilles Peskine354f7672019-07-12 23:46:38 +02001445 status = psa_destroy_se_key( driver, slot->data.se.slot_number );
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001446 if( overall_status == PSA_SUCCESS )
1447 overall_status = status;
Gilles Peskinefc762652019-07-22 19:30:34 +02001448 }
Gilles Peskine354f7672019-07-12 23:46:38 +02001449#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1450
Darryl Greend49a4992018-06-18 17:27:26 +01001451#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Ronald Crond98059d2020-10-23 18:00:55 +02001452 if( ! PSA_KEY_LIFETIME_IS_VOLATILE( slot->attr.lifetime ) )
Darryl Greend49a4992018-06-18 17:27:26 +01001453 {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001454 status = psa_destroy_persistent_key( slot->attr.id );
1455 if( overall_status == PSA_SUCCESS )
1456 overall_status = status;
1457
Gilles Peskine9ce31c42019-08-13 15:14:20 +02001458 /* TODO: other slots may have a copy of the same key. We should
1459 * invalidate them.
1460 * https://github.com/ARMmbed/mbed-crypto/issues/214
1461 */
Darryl Greend49a4992018-06-18 17:27:26 +01001462 }
1463#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
Gilles Peskine354f7672019-07-12 23:46:38 +02001464
Gilles Peskinefc762652019-07-22 19:30:34 +02001465#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1466 if( driver != NULL )
1467 {
Gilles Peskine725f22a2019-07-25 11:31:48 +02001468 status = psa_save_se_persistent_data( driver );
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001469 if( overall_status == PSA_SUCCESS )
1470 overall_status = status;
1471 status = psa_crypto_stop_transaction( );
1472 if( overall_status == PSA_SUCCESS )
1473 overall_status = status;
Gilles Peskinefc762652019-07-22 19:30:34 +02001474 }
1475#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1476
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001477#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1478exit:
1479#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001480 status = psa_wipe_key_slot( slot );
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001481 /* Prioritize CORRUPTION_DETECTED from wiping over a storage error */
1482 if( overall_status == PSA_SUCCESS )
1483 overall_status = status;
1484 return( overall_status );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001485}
1486
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001487void psa_reset_key_attributes( psa_key_attributes_t *attributes )
Gilles Peskineb870b182018-07-06 16:02:09 +02001488{
Gilles Peskineb699f072019-04-26 16:06:02 +02001489 mbedtls_free( attributes->domain_parameters );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001490 memset( attributes, 0, sizeof( *attributes ) );
Gilles Peskineb870b182018-07-06 16:02:09 +02001491}
1492
Gilles Peskineb699f072019-04-26 16:06:02 +02001493psa_status_t psa_set_key_domain_parameters( psa_key_attributes_t *attributes,
1494 psa_key_type_t type,
1495 const uint8_t *data,
1496 size_t data_length )
1497{
1498 uint8_t *copy = NULL;
1499
1500 if( data_length != 0 )
1501 {
1502 copy = mbedtls_calloc( 1, data_length );
1503 if( copy == NULL )
1504 return( PSA_ERROR_INSUFFICIENT_MEMORY );
1505 memcpy( copy, data, data_length );
1506 }
1507 /* After this point, this function is guaranteed to succeed, so it
1508 * can start modifying `*attributes`. */
1509
1510 if( attributes->domain_parameters != NULL )
1511 {
1512 mbedtls_free( attributes->domain_parameters );
1513 attributes->domain_parameters = NULL;
1514 attributes->domain_parameters_size = 0;
1515 }
1516
1517 attributes->domain_parameters = copy;
1518 attributes->domain_parameters_size = data_length;
Gilles Peskine7e0cff92019-07-30 13:48:52 +02001519 attributes->core.type = type;
Gilles Peskineb699f072019-04-26 16:06:02 +02001520 return( PSA_SUCCESS );
1521}
1522
1523psa_status_t psa_get_key_domain_parameters(
1524 const psa_key_attributes_t *attributes,
1525 uint8_t *data, size_t data_size, size_t *data_length )
1526{
1527 if( attributes->domain_parameters_size > data_size )
1528 return( PSA_ERROR_BUFFER_TOO_SMALL );
1529 *data_length = attributes->domain_parameters_size;
1530 if( attributes->domain_parameters_size != 0 )
1531 memcpy( data, attributes->domain_parameters,
1532 attributes->domain_parameters_size );
1533 return( PSA_SUCCESS );
1534}
1535
John Durkop07cc04a2020-11-16 22:08:34 -08001536#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
John Durkop0e005192020-10-31 22:06:54 -07001537 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Gilles Peskineb699f072019-04-26 16:06:02 +02001538static psa_status_t psa_get_rsa_public_exponent(
1539 const mbedtls_rsa_context *rsa,
1540 psa_key_attributes_t *attributes )
1541{
1542 mbedtls_mpi mpi;
Janos Follath24eed8d2019-11-22 13:21:35 +00001543 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskineb699f072019-04-26 16:06:02 +02001544 uint8_t *buffer = NULL;
1545 size_t buflen;
1546 mbedtls_mpi_init( &mpi );
1547
1548 ret = mbedtls_rsa_export( rsa, NULL, NULL, NULL, NULL, &mpi );
1549 if( ret != 0 )
1550 goto exit;
Gilles Peskine772c8b12019-04-26 17:37:21 +02001551 if( mbedtls_mpi_cmp_int( &mpi, 65537 ) == 0 )
1552 {
1553 /* It's the default value, which is reported as an empty string,
1554 * so there's nothing to do. */
1555 goto exit;
1556 }
Gilles Peskineb699f072019-04-26 16:06:02 +02001557
1558 buflen = mbedtls_mpi_size( &mpi );
1559 buffer = mbedtls_calloc( 1, buflen );
1560 if( buffer == NULL )
1561 {
1562 ret = MBEDTLS_ERR_MPI_ALLOC_FAILED;
1563 goto exit;
1564 }
1565 ret = mbedtls_mpi_write_binary( &mpi, buffer, buflen );
1566 if( ret != 0 )
1567 goto exit;
1568 attributes->domain_parameters = buffer;
1569 attributes->domain_parameters_size = buflen;
1570
1571exit:
1572 mbedtls_mpi_free( &mpi );
1573 if( ret != 0 )
1574 mbedtls_free( buffer );
1575 return( mbedtls_to_psa_error( ret ) );
1576}
John Durkop07cc04a2020-11-16 22:08:34 -08001577#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
John Durkop9814fa22020-11-04 12:28:15 -08001578 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Gilles Peskineb699f072019-04-26 16:06:02 +02001579
Gilles Peskinebfd322f2019-07-23 11:58:03 +02001580/** Retrieve all the publicly-accessible attributes of a key.
1581 */
Ronald Croncf56a0a2020-08-04 09:51:30 +02001582psa_status_t psa_get_key_attributes( mbedtls_svc_key_id_t key,
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001583 psa_key_attributes_t *attributes )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001584{
Ronald Cronf95a2b12020-10-22 15:24:49 +02001585 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01001586 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01001587 psa_key_slot_t *slot;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001588
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001589 psa_reset_key_attributes( attributes );
1590
Ronald Cron5c522922020-11-14 16:35:34 +01001591 status = psa_get_and_lock_key_slot_with_policy( key, &slot, 0, 0 );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02001592 if( status != PSA_SUCCESS )
1593 return( status );
Gilles Peskineb870b182018-07-06 16:02:09 +02001594
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001595 attributes->core = slot->attr;
Gilles Peskinec8000c02019-08-02 20:15:51 +02001596 attributes->core.flags &= ( MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY |
1597 MBEDTLS_PSA_KA_MASK_DUAL_USE );
1598
1599#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1600 if( psa_key_slot_is_external( slot ) )
1601 psa_set_key_slot_number( attributes, slot->data.se.slot_number );
1602#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskineb699f072019-04-26 16:06:02 +02001603
Gilles Peskine8e338702019-07-30 20:06:31 +02001604 switch( slot->attr.type )
Gilles Peskineb699f072019-04-26 16:06:02 +02001605 {
John Durkop07cc04a2020-11-16 22:08:34 -08001606#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
John Durkop0e005192020-10-31 22:06:54 -07001607 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Gilles Peskinec93b80c2019-05-16 19:39:54 +02001608 case PSA_KEY_TYPE_RSA_KEY_PAIR:
Gilles Peskineb699f072019-04-26 16:06:02 +02001609 case PSA_KEY_TYPE_RSA_PUBLIC_KEY:
Gilles Peskinedc5bfe92019-07-24 19:09:30 +02001610#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Janos Follath1d57a202019-08-13 12:15:34 +01001611 /* TODO: reporting the public exponent for opaque keys
Gilles Peskinec9d7f942019-08-13 16:17:16 +02001612 * is not yet implemented.
1613 * https://github.com/ARMmbed/mbed-crypto/issues/216
1614 */
Gilles Peskinec8000c02019-08-02 20:15:51 +02001615 if( psa_key_slot_is_external( slot ) )
Gilles Peskinedc5bfe92019-07-24 19:09:30 +02001616 break;
1617#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Steven Cooremana01795d2020-07-24 22:48:15 +02001618 {
Steven Cooremana2371e52020-07-28 14:30:39 +02001619 mbedtls_rsa_context *rsa = NULL;
Steven Cooremana01795d2020-07-24 22:48:15 +02001620
Steven Cooreman4fed4552020-08-03 14:46:03 +02001621 status = psa_load_rsa_representation( slot->attr.type,
1622 slot->data.key.data,
Steven Cooreman7f391872020-07-30 14:57:44 +02001623 slot->data.key.bytes,
Steven Cooreman7f391872020-07-30 14:57:44 +02001624 &rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02001625 if( status != PSA_SUCCESS )
1626 break;
1627
Steven Cooremana2371e52020-07-28 14:30:39 +02001628 status = psa_get_rsa_public_exponent( rsa,
Steven Cooremana01795d2020-07-24 22:48:15 +02001629 attributes );
Steven Cooremana2371e52020-07-28 14:30:39 +02001630 mbedtls_rsa_free( rsa );
1631 mbedtls_free( rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02001632 }
Gilles Peskineb699f072019-04-26 16:06:02 +02001633 break;
John Durkop07cc04a2020-11-16 22:08:34 -08001634#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
John Durkop9814fa22020-11-04 12:28:15 -08001635 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Gilles Peskineb699f072019-04-26 16:06:02 +02001636 default:
1637 /* Nothing else to do. */
1638 break;
1639 }
1640
1641 if( status != PSA_SUCCESS )
1642 psa_reset_key_attributes( attributes );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001643
Ronald Cron5c522922020-11-14 16:35:34 +01001644 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001645
Ronald Cron5c522922020-11-14 16:35:34 +01001646 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001647}
1648
Gilles Peskinec8000c02019-08-02 20:15:51 +02001649#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1650psa_status_t psa_get_key_slot_number(
1651 const psa_key_attributes_t *attributes,
1652 psa_key_slot_number_t *slot_number )
1653{
1654 if( attributes->core.flags & MBEDTLS_PSA_KA_FLAG_HAS_SLOT_NUMBER )
1655 {
1656 *slot_number = attributes->slot_number;
1657 return( PSA_SUCCESS );
1658 }
1659 else
1660 return( PSA_ERROR_INVALID_ARGUMENT );
1661}
1662#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1663
Steven Cooremana01795d2020-07-24 22:48:15 +02001664static psa_status_t psa_internal_export_key_buffer( const psa_key_slot_t *slot,
1665 uint8_t *data,
1666 size_t data_size,
1667 size_t *data_length )
1668{
1669 if( slot->data.key.bytes > data_size )
1670 return( PSA_ERROR_BUFFER_TOO_SMALL );
1671 memcpy( data, slot->data.key.data, slot->data.key.bytes );
1672 memset( data + slot->data.key.bytes, 0,
1673 data_size - slot->data.key.bytes );
1674 *data_length = slot->data.key.bytes;
1675 return( PSA_SUCCESS );
1676}
1677
Gilles Peskinef603c712019-01-19 13:40:11 +01001678static psa_status_t psa_internal_export_key( const psa_key_slot_t *slot,
1679 uint8_t *data,
1680 size_t data_size,
1681 size_t *data_length,
1682 int export_public_key )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001683{
Gilles Peskine5d309672019-07-12 23:47:28 +02001684#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1685 const psa_drv_se_t *drv;
1686 psa_drv_se_context_t *drv_context;
1687#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1688
Jaeden Amerof24c7f82018-06-27 17:20:43 +01001689 *data_length = 0;
1690
Gilles Peskine8e338702019-07-30 20:06:31 +02001691 if( export_public_key && ! PSA_KEY_TYPE_IS_ASYMMETRIC( slot->attr.type ) )
Moran Pekera998bc62018-04-16 18:16:20 +03001692 return( PSA_ERROR_INVALID_ARGUMENT );
mohammad160306e79202018-03-28 13:17:44 +03001693
Gilles Peskinef9168942019-09-12 19:20:29 +02001694 /* Reject a zero-length output buffer now, since this can never be a
1695 * valid key representation. This way we know that data must be a valid
1696 * pointer and we can do things like memset(data, ..., data_size). */
1697 if( data_size == 0 )
1698 return( PSA_ERROR_BUFFER_TOO_SMALL );
1699
Gilles Peskine5d309672019-07-12 23:47:28 +02001700#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine8e338702019-07-30 20:06:31 +02001701 if( psa_get_se_driver( slot->attr.lifetime, &drv, &drv_context ) )
Gilles Peskine5d309672019-07-12 23:47:28 +02001702 {
1703 psa_drv_se_export_key_t method;
1704 if( drv->key_management == NULL )
1705 return( PSA_ERROR_NOT_SUPPORTED );
1706 method = ( export_public_key ?
1707 drv->key_management->p_export_public :
1708 drv->key_management->p_export );
1709 if( method == NULL )
1710 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine2e0f3882019-07-25 11:34:33 +02001711 return( method( drv_context,
1712 slot->data.se.slot_number,
1713 data, data_size, data_length ) );
Gilles Peskine5d309672019-07-12 23:47:28 +02001714 }
1715#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1716
Gilles Peskine8e338702019-07-30 20:06:31 +02001717 if( key_type_is_raw_bytes( slot->attr.type ) )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001718 {
Steven Cooremanacda8342020-07-24 23:09:52 +02001719 return( psa_internal_export_key_buffer( slot, data, data_size, data_length ) );
Gilles Peskine188c71e2018-10-29 19:26:02 +01001720 }
Steven Cooreman560c28a2020-07-24 23:20:24 +02001721 else if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) ||
1722 PSA_KEY_TYPE_IS_ECC( slot->attr.type ) )
Moran Peker17e36e12018-05-02 12:55:20 +03001723 {
Steven Cooreman560c28a2020-07-24 23:20:24 +02001724 if( PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->attr.type ) )
Gilles Peskine969ac722018-01-28 18:16:59 +01001725 {
Steven Cooreman560c28a2020-07-24 23:20:24 +02001726 /* Exporting public -> public */
1727 return( psa_internal_export_key_buffer( slot, data, data_size, data_length ) );
1728 }
1729 else if( !export_public_key )
1730 {
1731 /* Exporting private -> private */
1732 return( psa_internal_export_key_buffer( slot, data, data_size, data_length ) );
1733 }
Steven Cooremanb9b84422020-10-14 14:39:20 +02001734
Steven Cooreman560c28a2020-07-24 23:20:24 +02001735 /* Need to export the public part of a private key,
Steven Cooremanb9b84422020-10-14 14:39:20 +02001736 * so conversion is needed. Try the accelerators first. */
1737 psa_status_t status = psa_driver_wrapper_export_public_key( slot,
1738 data,
1739 data_size,
1740 data_length );
1741
1742 if( status != PSA_ERROR_NOT_SUPPORTED ||
1743 psa_key_lifetime_is_external( slot->attr.lifetime ) )
1744 return( status );
1745
Steven Cooreman560c28a2020-07-24 23:20:24 +02001746 if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
1747 {
John Durkop0e005192020-10-31 22:06:54 -07001748#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
1749 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Steven Cooremana2371e52020-07-28 14:30:39 +02001750 mbedtls_rsa_context *rsa = NULL;
Steven Cooremanb9b84422020-10-14 14:39:20 +02001751 status = psa_load_rsa_representation(
Steven Cooreman4fed4552020-08-03 14:46:03 +02001752 slot->attr.type,
Steven Cooreman7f391872020-07-30 14:57:44 +02001753 slot->data.key.data,
1754 slot->data.key.bytes,
Steven Cooreman7f391872020-07-30 14:57:44 +02001755 &rsa );
Steven Cooreman560c28a2020-07-24 23:20:24 +02001756 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02001757 return( status );
Steven Cooremana01795d2020-07-24 22:48:15 +02001758
Steven Cooreman560c28a2020-07-24 23:20:24 +02001759 status = psa_export_rsa_key( PSA_KEY_TYPE_RSA_PUBLIC_KEY,
Steven Cooremana2371e52020-07-28 14:30:39 +02001760 rsa,
Steven Cooreman560c28a2020-07-24 23:20:24 +02001761 data,
1762 data_size,
1763 data_length );
Steven Cooremana01795d2020-07-24 22:48:15 +02001764
Steven Cooremana2371e52020-07-28 14:30:39 +02001765 mbedtls_rsa_free( rsa );
1766 mbedtls_free( rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02001767
Steven Cooreman560c28a2020-07-24 23:20:24 +02001768 return( status );
Darryl Green9e2d7a02018-07-24 16:33:30 +01001769#else
Steven Cooreman560c28a2020-07-24 23:20:24 +02001770 /* We don't know how to convert a private RSA key to public. */
1771 return( PSA_ERROR_NOT_SUPPORTED );
John Durkop9814fa22020-11-04 12:28:15 -08001772#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
1773 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Gilles Peskine969ac722018-01-28 18:16:59 +01001774 }
1775 else
Moran Pekera998bc62018-04-16 18:16:20 +03001776 {
John Durkop6ba40d12020-11-10 08:50:04 -08001777#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
1778 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
Steven Cooremana2371e52020-07-28 14:30:39 +02001779 mbedtls_ecp_keypair *ecp = NULL;
Steven Cooremanb9b84422020-10-14 14:39:20 +02001780 status = psa_load_ecp_representation(
Steven Cooreman4fed4552020-08-03 14:46:03 +02001781 slot->attr.type,
Steven Cooreman7f391872020-07-30 14:57:44 +02001782 slot->data.key.data,
1783 slot->data.key.bytes,
Steven Cooreman7f391872020-07-30 14:57:44 +02001784 &ecp );
Steven Cooreman560c28a2020-07-24 23:20:24 +02001785 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02001786 return( status );
Steven Cooreman560c28a2020-07-24 23:20:24 +02001787
1788 status = psa_export_ecp_key( PSA_KEY_TYPE_ECC_PUBLIC_KEY(
1789 PSA_KEY_TYPE_ECC_GET_FAMILY(
1790 slot->attr.type ) ),
Steven Cooremana2371e52020-07-28 14:30:39 +02001791 ecp,
Steven Cooreman560c28a2020-07-24 23:20:24 +02001792 data,
1793 data_size,
1794 data_length );
1795
Steven Cooremana2371e52020-07-28 14:30:39 +02001796 mbedtls_ecp_keypair_free( ecp );
1797 mbedtls_free( ecp );
Steven Cooreman560c28a2020-07-24 23:20:24 +02001798 return( status );
1799#else
1800 /* We don't know how to convert a private ECC key to public */
Moran Pekera998bc62018-04-16 18:16:20 +03001801 return( PSA_ERROR_NOT_SUPPORTED );
John Durkop9814fa22020-11-04 12:28:15 -08001802#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
1803 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
Moran Pekera998bc62018-04-16 18:16:20 +03001804 }
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001805 }
Steven Cooreman560c28a2020-07-24 23:20:24 +02001806 else
1807 {
1808 /* This shouldn't happen in the reference implementation, but
1809 it is valid for a special-purpose implementation to omit
1810 support for exporting certain key types. */
1811 return( PSA_ERROR_NOT_SUPPORTED );
1812 }
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001813}
1814
Ronald Croncf56a0a2020-08-04 09:51:30 +02001815psa_status_t psa_export_key( mbedtls_svc_key_id_t key,
Gilles Peskine2d277862018-06-18 15:41:12 +02001816 uint8_t *data,
1817 size_t data_size,
1818 size_t *data_length )
Moran Pekera998bc62018-04-16 18:16:20 +03001819{
Ronald Cronf95a2b12020-10-22 15:24:49 +02001820 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01001821 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01001822 psa_key_slot_t *slot;
Darryl Greendd8fb772018-11-07 16:00:44 +00001823
1824 /* Set the key to empty now, so that even when there are errors, we always
1825 * set data_length to a value between 0 and data_size. On error, setting
1826 * the key to empty is a good choice because an empty key representation is
1827 * unlikely to be accepted anywhere. */
1828 *data_length = 0;
1829
1830 /* Export requires the EXPORT flag. There is an exception for public keys,
Ronald Cron5c522922020-11-14 16:35:34 +01001831 * which don't require any flag, but
1832 * psa_get_and_lock_key_slot_with_policy() takes care of this.
1833 */
1834 status = psa_get_and_lock_key_slot_with_policy( key, &slot,
1835 PSA_KEY_USAGE_EXPORT, 0 );
Darryl Greendd8fb772018-11-07 16:00:44 +00001836 if( status != PSA_SUCCESS )
1837 return( status );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001838
1839 status = psa_internal_export_key( slot, data, data_size, data_length, 0 );
Ronald Cron5c522922020-11-14 16:35:34 +01001840 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001841
Ronald Cron5c522922020-11-14 16:35:34 +01001842 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001843}
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001844
Ronald Croncf56a0a2020-08-04 09:51:30 +02001845psa_status_t psa_export_public_key( mbedtls_svc_key_id_t key,
Gilles Peskine2d277862018-06-18 15:41:12 +02001846 uint8_t *data,
1847 size_t data_size,
1848 size_t *data_length )
Moran Pekerdd4ea382018-04-03 15:30:03 +03001849{
Ronald Cronf95a2b12020-10-22 15:24:49 +02001850 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01001851 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01001852 psa_key_slot_t *slot;
Darryl Greendd8fb772018-11-07 16:00:44 +00001853
1854 /* Set the key to empty now, so that even when there are errors, we always
1855 * set data_length to a value between 0 and data_size. On error, setting
1856 * the key to empty is a good choice because an empty key representation is
1857 * unlikely to be accepted anywhere. */
1858 *data_length = 0;
1859
1860 /* Exporting a public key doesn't require a usage flag. */
Ronald Cron5c522922020-11-14 16:35:34 +01001861 status = psa_get_and_lock_key_slot_with_policy( key, &slot, 0, 0 );
Darryl Greendd8fb772018-11-07 16:00:44 +00001862 if( status != PSA_SUCCESS )
1863 return( status );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001864
1865 status = psa_internal_export_key( slot, data, data_size, data_length, 1 );
Ronald Cron5c522922020-11-14 16:35:34 +01001866 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02001867
Ronald Cron5c522922020-11-14 16:35:34 +01001868 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Moran Pekerdd4ea382018-04-03 15:30:03 +03001869}
1870
Gilles Peskine91e8c332019-08-02 19:19:39 +02001871#if defined(static_assert)
1872static_assert( ( MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE ) == 0,
1873 "One or more key attribute flag is listed as both external-only and dual-use" );
Gilles Peskine5a680562019-08-05 17:32:13 +02001874static_assert( ( PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE ) == 0,
Gilles Peskine094dac12019-08-07 18:19:46 +02001875 "One or more key attribute flag is listed as both internal-only and dual-use" );
Gilles Peskine5a680562019-08-05 17:32:13 +02001876static_assert( ( PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY ) == 0,
Gilles Peskine91e8c332019-08-02 19:19:39 +02001877 "One or more key attribute flag is listed as both internal-only and external-only" );
1878#endif
1879
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001880/** Validate that a key policy is internally well-formed.
1881 *
1882 * This function only rejects invalid policies. It does not validate the
1883 * consistency of the policy with respect to other attributes of the key
1884 * such as the key type.
1885 */
1886static psa_status_t psa_validate_key_policy( const psa_key_policy_t *policy )
Gilles Peskine4747d192019-04-17 15:05:45 +02001887{
1888 if( ( policy->usage & ~( PSA_KEY_USAGE_EXPORT |
Gilles Peskine8e0206a2019-05-14 14:24:28 +02001889 PSA_KEY_USAGE_COPY |
Gilles Peskine4747d192019-04-17 15:05:45 +02001890 PSA_KEY_USAGE_ENCRYPT |
1891 PSA_KEY_USAGE_DECRYPT |
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01001892 PSA_KEY_USAGE_SIGN_HASH |
1893 PSA_KEY_USAGE_VERIFY_HASH |
Gilles Peskine4747d192019-04-17 15:05:45 +02001894 PSA_KEY_USAGE_DERIVE ) ) != 0 )
1895 return( PSA_ERROR_INVALID_ARGUMENT );
1896
Gilles Peskine4747d192019-04-17 15:05:45 +02001897 return( PSA_SUCCESS );
1898}
1899
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001900/** Validate the internal consistency of key attributes.
1901 *
1902 * This function only rejects invalid attribute values. If does not
1903 * validate the consistency of the attributes with any key data that may
1904 * be involved in the creation of the key.
1905 *
1906 * Call this function early in the key creation process.
1907 *
1908 * \param[in] attributes Key attributes for the new key.
1909 * \param[out] p_drv On any return, the driver for the key, if any.
1910 * NULL for a transparent key.
1911 *
1912 */
1913static psa_status_t psa_validate_key_attributes(
1914 const psa_key_attributes_t *attributes,
1915 psa_se_drv_table_entry_t **p_drv )
Darryl Green0c6575a2018-11-07 16:05:30 +00001916{
Steven Cooreman81fe7c32020-06-08 18:37:19 +02001917 psa_status_t status = PSA_ERROR_INVALID_ARGUMENT;
Ronald Crond2ed4812020-07-17 16:11:30 +02001918 psa_key_lifetime_t lifetime = psa_get_key_lifetime( attributes );
Ronald Cron65f38a32020-10-23 17:11:13 +02001919 mbedtls_svc_key_id_t key = psa_get_key_id( attributes );
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001920
Ronald Cron54b90082020-10-29 15:26:43 +01001921 status = psa_validate_key_location( lifetime, p_drv );
Steven Cooreman81fe7c32020-06-08 18:37:19 +02001922 if( status != PSA_SUCCESS )
1923 return( status );
1924
Ronald Crond2ed4812020-07-17 16:11:30 +02001925 status = psa_validate_key_persistence( lifetime );
Steven Cooreman81fe7c32020-06-08 18:37:19 +02001926 if( status != PSA_SUCCESS )
1927 return( status );
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001928
Ronald Cron65f38a32020-10-23 17:11:13 +02001929 if ( PSA_KEY_LIFETIME_IS_VOLATILE( lifetime ) )
1930 {
1931 if( MBEDTLS_SVC_KEY_ID_GET_KEY_ID( key ) != 0 )
1932 return( PSA_ERROR_INVALID_ARGUMENT );
1933 }
1934 else
Ronald Crond2ed4812020-07-17 16:11:30 +02001935 {
Ronald Croncbd7bea2020-11-11 14:57:44 +01001936 status = psa_validate_key_id( psa_get_key_id( attributes ), 0 );
Ronald Crond2ed4812020-07-17 16:11:30 +02001937 if( status != PSA_SUCCESS )
1938 return( status );
1939 }
1940
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001941 status = psa_validate_key_policy( &attributes->core.policy );
Darryl Green0c6575a2018-11-07 16:05:30 +00001942 if( status != PSA_SUCCESS )
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001943 return( status );
1944
1945 /* Refuse to create overly large keys.
1946 * Note that this doesn't trigger on import if the attributes don't
1947 * explicitly specify a size (so psa_get_key_bits returns 0), so
1948 * psa_import_key() needs its own checks. */
1949 if( psa_get_key_bits( attributes ) > PSA_MAX_KEY_BITS )
1950 return( PSA_ERROR_NOT_SUPPORTED );
1951
Gilles Peskine91e8c332019-08-02 19:19:39 +02001952 /* Reject invalid flags. These should not be reachable through the API. */
1953 if( attributes->core.flags & ~ ( MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY |
1954 MBEDTLS_PSA_KA_MASK_DUAL_USE ) )
1955 return( PSA_ERROR_INVALID_ARGUMENT );
1956
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001957 return( PSA_SUCCESS );
1958}
1959
Gilles Peskine4747d192019-04-17 15:05:45 +02001960/** Prepare a key slot to receive key material.
1961 *
1962 * This function allocates a key slot and sets its metadata.
1963 *
1964 * If this function fails, call psa_fail_key_creation().
1965 *
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001966 * This function is intended to be used as follows:
1967 * -# Call psa_start_key_creation() to allocate a key slot, prepare
Ronald Croncf56a0a2020-08-04 09:51:30 +02001968 * it with the specified attributes, and in case of a volatile key assign it
1969 * a volatile key identifier.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001970 * -# Populate the slot with the key material.
1971 * -# Call psa_finish_key_creation() to finalize the creation of the slot.
1972 * In case of failure at any step, stop the sequence and call
1973 * psa_fail_key_creation().
1974 *
Ronald Cron5c522922020-11-14 16:35:34 +01001975 * On success, the key slot is locked. It is the responsibility of the caller
1976 * to unlock the key slot when it does not access it anymore.
Ronald Cronf95a2b12020-10-22 15:24:49 +02001977 *
Gilles Peskinedf179142019-07-15 22:02:14 +02001978 * \param method An identification of the calling function.
Gilles Peskine011e4282019-06-26 18:34:38 +02001979 * \param[in] attributes Key attributes for the new key.
Gilles Peskine011e4282019-06-26 18:34:38 +02001980 * \param[out] p_slot On success, a pointer to the prepared slot.
1981 * \param[out] p_drv On any return, the driver for the key, if any.
1982 * NULL for a transparent key.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001983 *
1984 * \retval #PSA_SUCCESS
1985 * The key slot is ready to receive key material.
1986 * \return If this function fails, the key slot is an invalid state.
1987 * You must call psa_fail_key_creation() to wipe and free the slot.
Gilles Peskine4747d192019-04-17 15:05:45 +02001988 */
1989static psa_status_t psa_start_key_creation(
Gilles Peskinedf179142019-07-15 22:02:14 +02001990 psa_key_creation_method_t method,
Gilles Peskine4747d192019-04-17 15:05:45 +02001991 const psa_key_attributes_t *attributes,
Gilles Peskine011e4282019-06-26 18:34:38 +02001992 psa_key_slot_t **p_slot,
Gilles Peskine8abe6a22019-07-12 23:40:35 +02001993 psa_se_drv_table_entry_t **p_drv )
Gilles Peskine4747d192019-04-17 15:05:45 +02001994{
1995 psa_status_t status;
Ronald Cron2a993152020-07-17 14:13:26 +02001996 psa_key_id_t volatile_key_id;
Gilles Peskine4747d192019-04-17 15:05:45 +02001997 psa_key_slot_t *slot;
1998
Gilles Peskinedf179142019-07-15 22:02:14 +02001999 (void) method;
Gilles Peskine011e4282019-06-26 18:34:38 +02002000 *p_drv = NULL;
2001
Gilles Peskine1b8594a2019-07-31 17:21:46 +02002002 status = psa_validate_key_attributes( attributes, p_drv );
2003 if( status != PSA_SUCCESS )
2004 return( status );
2005
Ronald Cronc4d1b512020-07-31 11:26:37 +02002006 status = psa_get_empty_key_slot( &volatile_key_id, p_slot );
Gilles Peskine4747d192019-04-17 15:05:45 +02002007 if( status != PSA_SUCCESS )
2008 return( status );
2009 slot = *p_slot;
2010
Gilles Peskine76aa09c2019-07-31 14:15:34 +02002011 /* We're storing the declared bit-size of the key. It's up to each
2012 * creation mechanism to verify that this information is correct.
2013 * It's automatically correct for mechanisms that use the bit-size as
Gilles Peskineb46bef22019-07-30 21:32:04 +02002014 * an input (generate, device) but not for those where the bit-size
Ronald Cronc4d1b512020-07-31 11:26:37 +02002015 * is optional (import, copy). In case of a volatile key, assign it the
2016 * volatile key identifier associated to the slot returned to contain its
2017 * definition. */
Gilles Peskine76aa09c2019-07-31 14:15:34 +02002018
2019 slot->attr = attributes->core;
Ronald Cronc4d1b512020-07-31 11:26:37 +02002020 if( PSA_KEY_LIFETIME_IS_VOLATILE( slot->attr.lifetime ) )
2021 {
2022#if !defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER)
2023 slot->attr.id = volatile_key_id;
2024#else
2025 slot->attr.id.key_id = volatile_key_id;
2026#endif
2027 }
Gilles Peskinec744d992019-07-30 17:26:54 +02002028
Gilles Peskine91e8c332019-08-02 19:19:39 +02002029 /* Erase external-only flags from the internal copy. To access
Gilles Peskine013f5472019-08-07 15:42:14 +02002030 * external-only flags, query `attributes`. Thanks to the check
2031 * in psa_validate_key_attributes(), this leaves the dual-use
Gilles Peskineedbed562019-08-07 18:19:59 +02002032 * flags and any internal flag that psa_get_empty_key_slot()
Gilles Peskine013f5472019-08-07 15:42:14 +02002033 * may have set. */
2034 slot->attr.flags &= ~MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY;
Gilles Peskine91e8c332019-08-02 19:19:39 +02002035
Gilles Peskinecbaff462019-07-12 23:46:04 +02002036#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined7729582019-08-05 15:55:54 +02002037 /* For a key in a secure element, we need to do three things
Steven Cooremanbbeaf182020-06-08 18:29:44 +02002038 * when creating or registering a persistent key:
Gilles Peskine60450a42019-07-25 11:32:45 +02002039 * create the key file in internal storage, create the
2040 * key inside the secure element, and update the driver's
Steven Cooremanbbeaf182020-06-08 18:29:44 +02002041 * persistent data. This is done by starting a transaction that will
2042 * encompass these three actions.
2043 * For registering a volatile key, we just need to find an appropriate
2044 * slot number inside the SE. Since the key is designated volatile, creating
2045 * a transaction is not required. */
Gilles Peskine60450a42019-07-25 11:32:45 +02002046 /* The first thing to do is to find a slot number for the new key.
2047 * We save the slot number in persistent storage as part of the
2048 * transaction data. It will be needed to recover if the power
2049 * fails during the key creation process, to clean up on the secure
2050 * element side after restarting. Obtaining a slot number from the
2051 * secure element driver updates its persistent state, but we do not yet
2052 * save the driver's persistent state, so that if the power fails,
Gilles Peskinefc762652019-07-22 19:30:34 +02002053 * we can roll back to a state where the key doesn't exist. */
Gilles Peskine3efcebb2019-10-01 14:18:35 +02002054 if( *p_drv != NULL )
Darryl Green0c6575a2018-11-07 16:05:30 +00002055 {
Gilles Peskinee88c2c12019-08-05 16:44:14 +02002056 status = psa_find_se_slot_for_key( attributes, method, *p_drv,
Gilles Peskinecbaff462019-07-12 23:46:04 +02002057 &slot->data.se.slot_number );
2058 if( status != PSA_SUCCESS )
2059 return( status );
Steven Cooremanbbeaf182020-06-08 18:29:44 +02002060
2061 if( ! PSA_KEY_LIFETIME_IS_VOLATILE( attributes->core.lifetime ) )
Gilles Peskine66be51c2019-07-25 18:02:52 +02002062 {
Steven Cooremanbbeaf182020-06-08 18:29:44 +02002063 psa_crypto_prepare_transaction( PSA_CRYPTO_TRANSACTION_CREATE_KEY );
2064 psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
2065 psa_crypto_transaction.key.slot = slot->data.se.slot_number;
2066 psa_crypto_transaction.key.id = slot->attr.id;
2067 status = psa_crypto_save_transaction( );
2068 if( status != PSA_SUCCESS )
2069 {
2070 (void) psa_crypto_stop_transaction( );
2071 return( status );
2072 }
Gilles Peskine66be51c2019-07-25 18:02:52 +02002073 }
Darryl Green0c6575a2018-11-07 16:05:30 +00002074 }
Gilles Peskine3efcebb2019-10-01 14:18:35 +02002075
2076 if( *p_drv == NULL && method == PSA_KEY_CREATION_REGISTER )
2077 {
2078 /* Key registration only makes sense with a secure element. */
2079 return( PSA_ERROR_INVALID_ARGUMENT );
2080 }
Gilles Peskinecbaff462019-07-12 23:46:04 +02002081#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
2082
Ronald Cronc4d1b512020-07-31 11:26:37 +02002083 return( PSA_SUCCESS );
Darryl Green0c6575a2018-11-07 16:05:30 +00002084}
Gilles Peskine4747d192019-04-17 15:05:45 +02002085
2086/** Finalize the creation of a key once its key material has been set.
2087 *
2088 * This entails writing the key to persistent storage.
2089 *
2090 * If this function fails, call psa_fail_key_creation().
Gilles Peskine9bc88c62019-04-28 11:37:03 +02002091 * See the documentation of psa_start_key_creation() for the intended use
2092 * of this function.
Gilles Peskine4747d192019-04-17 15:05:45 +02002093 *
Ronald Cron5c522922020-11-14 16:35:34 +01002094 * If the finalization succeeds, the function unlocks the key slot (it was
2095 * locked by psa_start_key_creation()) and the key slot cannot be accessed
2096 * anymore as part of the key creation process.
Ronald Cron50972942020-11-14 11:28:25 +01002097 *
Gilles Peskine011e4282019-06-26 18:34:38 +02002098 * \param[in,out] slot Pointer to the slot with key material.
2099 * \param[in] driver The secure element driver for the key,
2100 * or NULL for a transparent key.
Ronald Cron81709fc2020-11-14 12:10:32 +01002101 * \param[out] key On success, identifier of the key. Note that the
2102 * key identifier is also stored in the key slot.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02002103 *
2104 * \retval #PSA_SUCCESS
Ronald Croncf56a0a2020-08-04 09:51:30 +02002105 * The key was successfully created.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02002106 * \return If this function fails, the key slot is an invalid state.
2107 * You must call psa_fail_key_creation() to wipe and free the slot.
Gilles Peskine4747d192019-04-17 15:05:45 +02002108 */
Gilles Peskine011e4282019-06-26 18:34:38 +02002109static psa_status_t psa_finish_key_creation(
2110 psa_key_slot_t *slot,
Ronald Cron81709fc2020-11-14 12:10:32 +01002111 psa_se_drv_table_entry_t *driver,
2112 mbedtls_svc_key_id_t *key)
Gilles Peskine4747d192019-04-17 15:05:45 +02002113{
2114 psa_status_t status = PSA_SUCCESS;
Gilles Peskine30afafd2019-04-25 13:47:40 +02002115 (void) slot;
Gilles Peskine011e4282019-06-26 18:34:38 +02002116 (void) driver;
Gilles Peskine4747d192019-04-17 15:05:45 +02002117
2118#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Steven Cooremanc59de6a2020-06-08 18:28:25 +02002119 if( ! PSA_KEY_LIFETIME_IS_VOLATILE( slot->attr.lifetime ) )
Gilles Peskine4747d192019-04-17 15:05:45 +02002120 {
Gilles Peskine1df83d42019-07-23 16:13:14 +02002121#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
2122 if( driver != NULL )
2123 {
Gilles Peskineb46bef22019-07-30 21:32:04 +02002124 psa_se_key_data_storage_t data;
2125#if defined(static_assert)
2126 static_assert( sizeof( slot->data.se.slot_number ) ==
2127 sizeof( data.slot_number ),
2128 "Slot number size does not match psa_se_key_data_storage_t" );
Gilles Peskineb46bef22019-07-30 21:32:04 +02002129#endif
2130 memcpy( &data.slot_number, &slot->data.se.slot_number,
2131 sizeof( slot->data.se.slot_number ) );
Gilles Peskine76aa09c2019-07-31 14:15:34 +02002132 status = psa_save_persistent_key( &slot->attr,
Gilles Peskineb46bef22019-07-30 21:32:04 +02002133 (uint8_t*) &data,
2134 sizeof( data ) );
Gilles Peskine1df83d42019-07-23 16:13:14 +02002135 }
2136 else
2137#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
2138 {
Steven Cooreman40120f62020-10-29 11:42:22 +01002139 /* Key material is saved in export representation in the slot, so
2140 * just pass the slot buffer for storage. */
2141 status = psa_save_persistent_key( &slot->attr,
2142 slot->data.key.data,
2143 slot->data.key.bytes );
Gilles Peskine1df83d42019-07-23 16:13:14 +02002144 }
Gilles Peskine4747d192019-04-17 15:05:45 +02002145 }
Darryl Green0c6575a2018-11-07 16:05:30 +00002146#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
2147
Gilles Peskinecbaff462019-07-12 23:46:04 +02002148#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined7729582019-08-05 15:55:54 +02002149 /* Finish the transaction for a key creation. This does not
2150 * happen when registering an existing key. Detect this case
2151 * by checking whether a transaction is in progress (actual
Steven Cooremanbbeaf182020-06-08 18:29:44 +02002152 * creation of a persistent key in a secure element requires a transaction,
2153 * but registration or volatile key creation doesn't use one). */
Gilles Peskined7729582019-08-05 15:55:54 +02002154 if( driver != NULL &&
2155 psa_crypto_transaction.unknown.type == PSA_CRYPTO_TRANSACTION_CREATE_KEY )
Gilles Peskinecbaff462019-07-12 23:46:04 +02002156 {
2157 status = psa_save_se_persistent_data( driver );
2158 if( status != PSA_SUCCESS )
2159 {
Gilles Peskine8e338702019-07-30 20:06:31 +02002160 psa_destroy_persistent_key( slot->attr.id );
Gilles Peskinecbaff462019-07-12 23:46:04 +02002161 return( status );
2162 }
Gilles Peskinefc762652019-07-22 19:30:34 +02002163 status = psa_crypto_stop_transaction( );
Gilles Peskinecbaff462019-07-12 23:46:04 +02002164 }
2165#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
2166
Ronald Cron50972942020-11-14 11:28:25 +01002167 if( status == PSA_SUCCESS )
Ronald Cron81709fc2020-11-14 12:10:32 +01002168 {
2169 *key = slot->attr.id;
Ronald Cron5c522922020-11-14 16:35:34 +01002170 status = psa_unlock_key_slot( slot );
Ronald Cron81709fc2020-11-14 12:10:32 +01002171 if( status != PSA_SUCCESS )
2172 *key = MBEDTLS_SVC_KEY_ID_INIT;
2173 }
Ronald Cron50972942020-11-14 11:28:25 +01002174
Gilles Peskine4747d192019-04-17 15:05:45 +02002175 return( status );
2176}
2177
2178/** Abort the creation of a key.
2179 *
2180 * You may call this function after calling psa_start_key_creation(),
2181 * or after psa_finish_key_creation() fails. In other circumstances, this
2182 * function may not clean up persistent storage.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02002183 * See the documentation of psa_start_key_creation() for the intended use
2184 * of this function.
Gilles Peskine4747d192019-04-17 15:05:45 +02002185 *
Gilles Peskine011e4282019-06-26 18:34:38 +02002186 * \param[in,out] slot Pointer to the slot with key material.
2187 * \param[in] driver The secure element driver for the key,
2188 * or NULL for a transparent key.
Gilles Peskine4747d192019-04-17 15:05:45 +02002189 */
Gilles Peskine011e4282019-06-26 18:34:38 +02002190static void psa_fail_key_creation( psa_key_slot_t *slot,
Gilles Peskine8abe6a22019-07-12 23:40:35 +02002191 psa_se_drv_table_entry_t *driver )
Gilles Peskine4747d192019-04-17 15:05:45 +02002192{
Gilles Peskine011e4282019-06-26 18:34:38 +02002193 (void) driver;
2194
Gilles Peskine4747d192019-04-17 15:05:45 +02002195 if( slot == NULL )
2196 return;
Gilles Peskine011e4282019-06-26 18:34:38 +02002197
2198#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Janos Follath1d57a202019-08-13 12:15:34 +01002199 /* TODO: If the key has already been created in the secure
Gilles Peskine011e4282019-06-26 18:34:38 +02002200 * element, and the failure happened later (when saving metadata
2201 * to internal storage), we need to destroy the key in the secure
Gilles Peskinec9d7f942019-08-13 16:17:16 +02002202 * element.
2203 * https://github.com/ARMmbed/mbed-crypto/issues/217
2204 */
Gilles Peskinefc762652019-07-22 19:30:34 +02002205
Gilles Peskined7729582019-08-05 15:55:54 +02002206 /* Abort the ongoing transaction if any (there may not be one if
2207 * the creation process failed before starting one, or if the
2208 * key creation is a registration of a key in a secure element).
2209 * Earlier functions must already have done what it takes to undo any
2210 * partial creation. All that's left is to update the transaction data
2211 * itself. */
Gilles Peskinefc762652019-07-22 19:30:34 +02002212 (void) psa_crypto_stop_transaction( );
Gilles Peskine011e4282019-06-26 18:34:38 +02002213#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
2214
Gilles Peskine4747d192019-04-17 15:05:45 +02002215 psa_wipe_key_slot( slot );
2216}
2217
Gilles Peskine1b8594a2019-07-31 17:21:46 +02002218/** Validate optional attributes during key creation.
2219 *
2220 * Some key attributes are optional during key creation. If they are
2221 * specified in the attributes structure, check that they are consistent
2222 * with the data in the slot.
2223 *
2224 * This function should be called near the end of key creation, after
2225 * the slot in memory is fully populated but before saving persistent data.
2226 */
2227static psa_status_t psa_validate_optional_attributes(
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002228 const psa_key_slot_t *slot,
2229 const psa_key_attributes_t *attributes )
2230{
Gilles Peskine7e0cff92019-07-30 13:48:52 +02002231 if( attributes->core.type != 0 )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002232 {
Gilles Peskine8e338702019-07-30 20:06:31 +02002233 if( attributes->core.type != slot->attr.type )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002234 return( PSA_ERROR_INVALID_ARGUMENT );
2235 }
2236
2237 if( attributes->domain_parameters_size != 0 )
2238 {
John Durkop0e005192020-10-31 22:06:54 -07002239#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
2240 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Gilles Peskine8e338702019-07-30 20:06:31 +02002241 if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002242 {
Steven Cooremana2371e52020-07-28 14:30:39 +02002243 mbedtls_rsa_context *rsa = NULL;
Steven Cooreman75b74362020-07-28 14:30:13 +02002244 mbedtls_mpi actual, required;
Steven Cooreman6d839f02020-07-30 11:36:45 +02002245 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Steven Cooremana01795d2020-07-24 22:48:15 +02002246
Steven Cooreman7f391872020-07-30 14:57:44 +02002247 psa_status_t status = psa_load_rsa_representation(
Steven Cooreman4fed4552020-08-03 14:46:03 +02002248 slot->attr.type,
Steven Cooreman7f391872020-07-30 14:57:44 +02002249 slot->data.key.data,
2250 slot->data.key.bytes,
Steven Cooreman7f391872020-07-30 14:57:44 +02002251 &rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02002252 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02002253 return( status );
Steven Cooreman75b74362020-07-28 14:30:13 +02002254
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002255 mbedtls_mpi_init( &actual );
2256 mbedtls_mpi_init( &required );
Steven Cooremana2371e52020-07-28 14:30:39 +02002257 ret = mbedtls_rsa_export( rsa,
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002258 NULL, NULL, NULL, NULL, &actual );
Steven Cooremana2371e52020-07-28 14:30:39 +02002259 mbedtls_rsa_free( rsa );
2260 mbedtls_free( rsa );
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002261 if( ret != 0 )
2262 goto rsa_exit;
2263 ret = mbedtls_mpi_read_binary( &required,
2264 attributes->domain_parameters,
2265 attributes->domain_parameters_size );
2266 if( ret != 0 )
2267 goto rsa_exit;
2268 if( mbedtls_mpi_cmp_mpi( &actual, &required ) != 0 )
2269 ret = MBEDTLS_ERR_RSA_BAD_INPUT_DATA;
2270 rsa_exit:
2271 mbedtls_mpi_free( &actual );
2272 mbedtls_mpi_free( &required );
2273 if( ret != 0)
2274 return( mbedtls_to_psa_error( ret ) );
2275 }
2276 else
John Durkop9814fa22020-11-04 12:28:15 -08002277#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
2278 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002279 {
2280 return( PSA_ERROR_INVALID_ARGUMENT );
2281 }
2282 }
2283
Gilles Peskine7e0cff92019-07-30 13:48:52 +02002284 if( attributes->core.bits != 0 )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002285 {
Gilles Peskineb46bef22019-07-30 21:32:04 +02002286 if( attributes->core.bits != slot->attr.bits )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002287 return( PSA_ERROR_INVALID_ARGUMENT );
2288 }
2289
2290 return( PSA_SUCCESS );
2291}
2292
Gilles Peskine4747d192019-04-17 15:05:45 +02002293psa_status_t psa_import_key( const psa_key_attributes_t *attributes,
Gilles Peskine4747d192019-04-17 15:05:45 +02002294 const uint8_t *data,
Gilles Peskine73676cb2019-05-15 20:15:10 +02002295 size_t data_length,
Ronald Croncf56a0a2020-08-04 09:51:30 +02002296 mbedtls_svc_key_id_t *key )
Gilles Peskine4747d192019-04-17 15:05:45 +02002297{
2298 psa_status_t status;
2299 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02002300 psa_se_drv_table_entry_t *driver = NULL;
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002301
Ronald Cron81709fc2020-11-14 12:10:32 +01002302 *key = MBEDTLS_SVC_KEY_ID_INIT;
2303
Gilles Peskine0f84d622019-09-12 19:03:13 +02002304 /* Reject zero-length symmetric keys (including raw data key objects).
2305 * This also rejects any key which might be encoded as an empty string,
2306 * which is never valid. */
2307 if( data_length == 0 )
2308 return( PSA_ERROR_INVALID_ARGUMENT );
2309
Gilles Peskinedf179142019-07-15 22:02:14 +02002310 status = psa_start_key_creation( PSA_KEY_CREATION_IMPORT, attributes,
Ronald Cron81709fc2020-11-14 12:10:32 +01002311 &slot, &driver );
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002312 if( status != PSA_SUCCESS )
2313 goto exit;
2314
Gilles Peskine5d309672019-07-12 23:47:28 +02002315#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
2316 if( driver != NULL )
2317 {
2318 const psa_drv_se_t *drv = psa_get_se_driver_methods( driver );
Darryl Green0892d0f2019-08-20 09:50:14 +01002319 /* The driver should set the number of key bits, however in
2320 * case it doesn't, we initialize bits to an invalid value. */
2321 size_t bits = PSA_MAX_KEY_BITS + 1;
Gilles Peskine5d309672019-07-12 23:47:28 +02002322 if( drv->key_management == NULL ||
2323 drv->key_management->p_import == NULL )
2324 {
2325 status = PSA_ERROR_NOT_SUPPORTED;
2326 goto exit;
2327 }
2328 status = drv->key_management->p_import(
2329 psa_get_se_driver_context( driver ),
Gilles Peskinef3801ff2019-08-06 17:32:04 +02002330 slot->data.se.slot_number, attributes, data, data_length,
Gilles Peskineb46bef22019-07-30 21:32:04 +02002331 &bits );
2332 if( status != PSA_SUCCESS )
2333 goto exit;
2334 if( bits > PSA_MAX_KEY_BITS )
2335 {
2336 status = PSA_ERROR_NOT_SUPPORTED;
2337 goto exit;
2338 }
2339 slot->attr.bits = (psa_key_bits_t) bits;
Gilles Peskine5d309672019-07-12 23:47:28 +02002340 }
2341 else
2342#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
2343 {
2344 status = psa_import_key_into_slot( slot, data, data_length );
2345 if( status != PSA_SUCCESS )
2346 goto exit;
Gilles Peskine5d309672019-07-12 23:47:28 +02002347 }
Gilles Peskine1b8594a2019-07-31 17:21:46 +02002348 status = psa_validate_optional_attributes( slot, attributes );
Gilles Peskine18017402019-07-24 20:25:59 +02002349 if( status != PSA_SUCCESS )
2350 goto exit;
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002351
Ronald Cron81709fc2020-11-14 12:10:32 +01002352 status = psa_finish_key_creation( slot, driver, key );
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002353exit:
Gilles Peskine4747d192019-04-17 15:05:45 +02002354 if( status != PSA_SUCCESS )
Gilles Peskine011e4282019-06-26 18:34:38 +02002355 psa_fail_key_creation( slot, driver );
Ronald Cronf95a2b12020-10-22 15:24:49 +02002356
Gilles Peskine4747d192019-04-17 15:05:45 +02002357 return( status );
2358}
2359
Gilles Peskined7729582019-08-05 15:55:54 +02002360#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
2361psa_status_t mbedtls_psa_register_se_key(
2362 const psa_key_attributes_t *attributes )
2363{
2364 psa_status_t status;
2365 psa_key_slot_t *slot = NULL;
2366 psa_se_drv_table_entry_t *driver = NULL;
Ronald Croncf56a0a2020-08-04 09:51:30 +02002367 mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT;
Gilles Peskined7729582019-08-05 15:55:54 +02002368
2369 /* Leaving attributes unspecified is not currently supported.
2370 * It could make sense to query the key type and size from the
2371 * secure element, but not all secure elements support this
2372 * and the driver HAL doesn't currently support it. */
2373 if( psa_get_key_type( attributes ) == PSA_KEY_TYPE_NONE )
2374 return( PSA_ERROR_NOT_SUPPORTED );
2375 if( psa_get_key_bits( attributes ) == 0 )
2376 return( PSA_ERROR_NOT_SUPPORTED );
2377
2378 status = psa_start_key_creation( PSA_KEY_CREATION_REGISTER, attributes,
Ronald Cron81709fc2020-11-14 12:10:32 +01002379 &slot, &driver );
Gilles Peskined7729582019-08-05 15:55:54 +02002380 if( status != PSA_SUCCESS )
2381 goto exit;
2382
Ronald Cron81709fc2020-11-14 12:10:32 +01002383 status = psa_finish_key_creation( slot, driver, &key );
Gilles Peskined7729582019-08-05 15:55:54 +02002384
2385exit:
2386 if( status != PSA_SUCCESS )
Gilles Peskined7729582019-08-05 15:55:54 +02002387 psa_fail_key_creation( slot, driver );
Ronald Cronf95a2b12020-10-22 15:24:49 +02002388
Gilles Peskined7729582019-08-05 15:55:54 +02002389 /* Registration doesn't keep the key in RAM. */
Ronald Croncf56a0a2020-08-04 09:51:30 +02002390 psa_close_key( key );
Gilles Peskined7729582019-08-05 15:55:54 +02002391 return( status );
2392}
2393#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
2394
Gilles Peskinef603c712019-01-19 13:40:11 +01002395static psa_status_t psa_copy_key_material( const psa_key_slot_t *source,
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002396 psa_key_slot_t *target )
Gilles Peskinef603c712019-01-19 13:40:11 +01002397{
Steven Cooremanf7cebd42020-10-13 20:27:40 +02002398 psa_status_t status = psa_copy_key_material_into_slot( target,
2399 source->data.key.data,
2400 source->data.key.bytes );
Gilles Peskinef603c712019-01-19 13:40:11 +01002401 if( status != PSA_SUCCESS )
Steven Cooreman398aee52020-10-13 14:35:45 +02002402 return( status );
Gilles Peskinef603c712019-01-19 13:40:11 +01002403
Steven Cooreman398aee52020-10-13 14:35:45 +02002404 target->attr.type = source->attr.type;
2405 target->attr.bits = source->attr.bits;
2406
2407 return( PSA_SUCCESS );
Gilles Peskinef603c712019-01-19 13:40:11 +01002408}
2409
Ronald Croncf56a0a2020-08-04 09:51:30 +02002410psa_status_t psa_copy_key( mbedtls_svc_key_id_t source_key,
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002411 const psa_key_attributes_t *specified_attributes,
Ronald Croncf56a0a2020-08-04 09:51:30 +02002412 mbedtls_svc_key_id_t *target_key )
Gilles Peskinef603c712019-01-19 13:40:11 +01002413{
Ronald Cronf95a2b12020-10-22 15:24:49 +02002414 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01002415 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinef603c712019-01-19 13:40:11 +01002416 psa_key_slot_t *source_slot = NULL;
2417 psa_key_slot_t *target_slot = NULL;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002418 psa_key_attributes_t actual_attributes = *specified_attributes;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02002419 psa_se_drv_table_entry_t *driver = NULL;
Gilles Peskinef603c712019-01-19 13:40:11 +01002420
Ronald Cron81709fc2020-11-14 12:10:32 +01002421 *target_key = MBEDTLS_SVC_KEY_ID_INIT;
2422
Ronald Cron5c522922020-11-14 16:35:34 +01002423 status = psa_get_and_lock_transparent_key_slot_with_policy(
2424 source_key, &source_slot, PSA_KEY_USAGE_COPY, 0 );
Gilles Peskinef603c712019-01-19 13:40:11 +01002425 if( status != PSA_SUCCESS )
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002426 goto exit;
2427
Gilles Peskine1b8594a2019-07-31 17:21:46 +02002428 status = psa_validate_optional_attributes( source_slot,
2429 specified_attributes );
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002430 if( status != PSA_SUCCESS )
2431 goto exit;
2432
Gilles Peskine7e0cff92019-07-30 13:48:52 +02002433 status = psa_restrict_key_policy( &actual_attributes.core.policy,
Gilles Peskine8e338702019-07-30 20:06:31 +02002434 &source_slot->attr.policy );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002435 if( status != PSA_SUCCESS )
2436 goto exit;
2437
Ronald Cron81709fc2020-11-14 12:10:32 +01002438 status = psa_start_key_creation( PSA_KEY_CREATION_COPY, &actual_attributes,
2439 &target_slot, &driver );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002440 if( status != PSA_SUCCESS )
2441 goto exit;
2442
Gilles Peskinef4ee6622019-07-24 13:44:30 +02002443#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
2444 if( driver != NULL )
Gilles Peskinef603c712019-01-19 13:40:11 +01002445 {
Gilles Peskinef4ee6622019-07-24 13:44:30 +02002446 /* Copying to a secure element is not implemented yet. */
2447 status = PSA_ERROR_NOT_SUPPORTED;
2448 goto exit;
Gilles Peskinef603c712019-01-19 13:40:11 +01002449 }
Gilles Peskinef4ee6622019-07-24 13:44:30 +02002450#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskinef603c712019-01-19 13:40:11 +01002451
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002452 status = psa_copy_key_material( source_slot, target_slot );
Gilles Peskinef603c712019-01-19 13:40:11 +01002453 if( status != PSA_SUCCESS )
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002454 goto exit;
Gilles Peskinef603c712019-01-19 13:40:11 +01002455
Ronald Cron81709fc2020-11-14 12:10:32 +01002456 status = psa_finish_key_creation( target_slot, driver, target_key );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002457exit:
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002458 if( status != PSA_SUCCESS )
Gilles Peskine011e4282019-06-26 18:34:38 +02002459 psa_fail_key_creation( target_slot, driver );
Ronald Cronf95a2b12020-10-22 15:24:49 +02002460
Ronald Cron5c522922020-11-14 16:35:34 +01002461 unlock_status = psa_unlock_key_slot( source_slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02002462
Ronald Cron5c522922020-11-14 16:35:34 +01002463 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskinef603c712019-01-19 13:40:11 +01002464}
2465
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02002466
2467
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01002468/****************************************************************/
Gilles Peskine20035e32018-02-03 22:44:14 +01002469/* Message digests */
2470/****************************************************************/
2471
John Durkop07cc04a2020-11-16 22:08:34 -08002472#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
John Durkop0e005192020-10-31 22:06:54 -07002473 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) || \
2474 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) || \
John Durkop9814fa22020-11-04 12:28:15 -08002475 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
Gilles Peskinedc2fc842018-03-07 16:42:59 +01002476static const mbedtls_md_info_t *mbedtls_md_info_from_psa( psa_algorithm_t alg )
Gilles Peskine20035e32018-02-03 22:44:14 +01002477{
2478 switch( alg )
2479 {
John Durkopee4e6602020-11-27 08:48:46 -08002480#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD2)
Gilles Peskine20035e32018-02-03 22:44:14 +01002481 case PSA_ALG_MD2:
2482 return( &mbedtls_md2_info );
2483#endif
John Durkopee4e6602020-11-27 08:48:46 -08002484#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD4)
Gilles Peskine20035e32018-02-03 22:44:14 +01002485 case PSA_ALG_MD4:
2486 return( &mbedtls_md4_info );
2487#endif
John Durkopee4e6602020-11-27 08:48:46 -08002488#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD5)
Gilles Peskine20035e32018-02-03 22:44:14 +01002489 case PSA_ALG_MD5:
2490 return( &mbedtls_md5_info );
2491#endif
John Durkopee4e6602020-11-27 08:48:46 -08002492#if defined(MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160)
Gilles Peskine20035e32018-02-03 22:44:14 +01002493 case PSA_ALG_RIPEMD160:
2494 return( &mbedtls_ripemd160_info );
2495#endif
John Durkopee4e6602020-11-27 08:48:46 -08002496#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_1)
Gilles Peskine20035e32018-02-03 22:44:14 +01002497 case PSA_ALG_SHA_1:
2498 return( &mbedtls_sha1_info );
2499#endif
John Durkopee4e6602020-11-27 08:48:46 -08002500#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_224)
Gilles Peskine20035e32018-02-03 22:44:14 +01002501 case PSA_ALG_SHA_224:
2502 return( &mbedtls_sha224_info );
John Durkopee4e6602020-11-27 08:48:46 -08002503#endif
2504#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256)
Gilles Peskine20035e32018-02-03 22:44:14 +01002505 case PSA_ALG_SHA_256:
2506 return( &mbedtls_sha256_info );
2507#endif
John Durkopee4e6602020-11-27 08:48:46 -08002508#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_384)
Gilles Peskine20035e32018-02-03 22:44:14 +01002509 case PSA_ALG_SHA_384:
2510 return( &mbedtls_sha384_info );
Manuel Pégourié-Gonnardd6020842019-07-17 16:28:21 +02002511#endif
John Durkopee4e6602020-11-27 08:48:46 -08002512#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_512)
Gilles Peskine20035e32018-02-03 22:44:14 +01002513 case PSA_ALG_SHA_512:
2514 return( &mbedtls_sha512_info );
2515#endif
2516 default:
2517 return( NULL );
2518 }
2519}
John Durkop07cc04a2020-11-16 22:08:34 -08002520#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
John Durkop9814fa22020-11-04 12:28:15 -08002521 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) ||
2522 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) ||
2523 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Gilles Peskine20035e32018-02-03 22:44:14 +01002524
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002525psa_status_t psa_hash_abort( psa_hash_operation_t *operation )
2526{
2527 switch( operation->alg )
2528 {
Gilles Peskine81736312018-06-26 15:04:31 +02002529 case 0:
2530 /* The object has (apparently) been initialized but it is not
2531 * in use. It's ok to call abort on such an object, and there's
2532 * nothing to do. */
2533 break;
John Durkopee4e6602020-11-27 08:48:46 -08002534#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD2)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002535 case PSA_ALG_MD2:
2536 mbedtls_md2_free( &operation->ctx.md2 );
2537 break;
2538#endif
John Durkopee4e6602020-11-27 08:48:46 -08002539#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD4)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002540 case PSA_ALG_MD4:
2541 mbedtls_md4_free( &operation->ctx.md4 );
2542 break;
2543#endif
John Durkopee4e6602020-11-27 08:48:46 -08002544#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD5)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002545 case PSA_ALG_MD5:
2546 mbedtls_md5_free( &operation->ctx.md5 );
2547 break;
2548#endif
John Durkopee4e6602020-11-27 08:48:46 -08002549#if defined(MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002550 case PSA_ALG_RIPEMD160:
2551 mbedtls_ripemd160_free( &operation->ctx.ripemd160 );
2552 break;
2553#endif
John Durkopee4e6602020-11-27 08:48:46 -08002554#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_1)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002555 case PSA_ALG_SHA_1:
2556 mbedtls_sha1_free( &operation->ctx.sha1 );
2557 break;
2558#endif
John Durkop6ca23272020-12-03 06:01:32 -08002559#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_224)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002560 case PSA_ALG_SHA_224:
John Durkop6ca23272020-12-03 06:01:32 -08002561 mbedtls_sha256_free( &operation->ctx.sha256 );
2562 break;
2563#endif
2564#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002565 case PSA_ALG_SHA_256:
2566 mbedtls_sha256_free( &operation->ctx.sha256 );
2567 break;
2568#endif
John Durkop6ca23272020-12-03 06:01:32 -08002569#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_384)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002570 case PSA_ALG_SHA_384:
John Durkop6ca23272020-12-03 06:01:32 -08002571 mbedtls_sha512_free( &operation->ctx.sha512 );
2572 break;
2573#endif
2574#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_512)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002575 case PSA_ALG_SHA_512:
2576 mbedtls_sha512_free( &operation->ctx.sha512 );
2577 break;
2578#endif
2579 default:
Gilles Peskinef9c2c092018-06-21 16:57:07 +02002580 return( PSA_ERROR_BAD_STATE );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002581 }
2582 operation->alg = 0;
2583 return( PSA_SUCCESS );
2584}
2585
Gilles Peskineda8191d1c2018-07-08 19:46:38 +02002586psa_status_t psa_hash_setup( psa_hash_operation_t *operation,
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002587 psa_algorithm_t alg )
2588{
Janos Follath24eed8d2019-11-22 13:21:35 +00002589 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jaeden Amero36ee5d02019-02-19 09:25:10 +00002590
2591 /* A context must be freshly initialized before it can be set up. */
2592 if( operation->alg != 0 )
2593 {
2594 return( PSA_ERROR_BAD_STATE );
2595 }
2596
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002597 switch( alg )
2598 {
John Durkopee4e6602020-11-27 08:48:46 -08002599#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD2)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002600 case PSA_ALG_MD2:
2601 mbedtls_md2_init( &operation->ctx.md2 );
2602 ret = mbedtls_md2_starts_ret( &operation->ctx.md2 );
2603 break;
2604#endif
John Durkopee4e6602020-11-27 08:48:46 -08002605#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD4)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002606 case PSA_ALG_MD4:
2607 mbedtls_md4_init( &operation->ctx.md4 );
2608 ret = mbedtls_md4_starts_ret( &operation->ctx.md4 );
2609 break;
2610#endif
John Durkopee4e6602020-11-27 08:48:46 -08002611#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD5)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002612 case PSA_ALG_MD5:
2613 mbedtls_md5_init( &operation->ctx.md5 );
2614 ret = mbedtls_md5_starts_ret( &operation->ctx.md5 );
2615 break;
2616#endif
John Durkopee4e6602020-11-27 08:48:46 -08002617#if defined(MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002618 case PSA_ALG_RIPEMD160:
2619 mbedtls_ripemd160_init( &operation->ctx.ripemd160 );
2620 ret = mbedtls_ripemd160_starts_ret( &operation->ctx.ripemd160 );
2621 break;
2622#endif
John Durkopee4e6602020-11-27 08:48:46 -08002623#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_1)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002624 case PSA_ALG_SHA_1:
2625 mbedtls_sha1_init( &operation->ctx.sha1 );
2626 ret = mbedtls_sha1_starts_ret( &operation->ctx.sha1 );
2627 break;
2628#endif
John Durkopee4e6602020-11-27 08:48:46 -08002629#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_224)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002630 case PSA_ALG_SHA_224:
2631 mbedtls_sha256_init( &operation->ctx.sha256 );
2632 ret = mbedtls_sha256_starts_ret( &operation->ctx.sha256, 1 );
2633 break;
John Durkopee4e6602020-11-27 08:48:46 -08002634#endif
2635#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002636 case PSA_ALG_SHA_256:
2637 mbedtls_sha256_init( &operation->ctx.sha256 );
2638 ret = mbedtls_sha256_starts_ret( &operation->ctx.sha256, 0 );
2639 break;
2640#endif
John Durkopee4e6602020-11-27 08:48:46 -08002641#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_384)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002642 case PSA_ALG_SHA_384:
2643 mbedtls_sha512_init( &operation->ctx.sha512 );
2644 ret = mbedtls_sha512_starts_ret( &operation->ctx.sha512, 1 );
2645 break;
Manuel Pégourié-Gonnard792b16d2020-01-07 10:13:18 +01002646#endif
John Durkopee4e6602020-11-27 08:48:46 -08002647#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_512)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002648 case PSA_ALG_SHA_512:
2649 mbedtls_sha512_init( &operation->ctx.sha512 );
2650 ret = mbedtls_sha512_starts_ret( &operation->ctx.sha512, 0 );
2651 break;
2652#endif
2653 default:
Gilles Peskinec06e0712018-06-20 16:21:04 +02002654 return( PSA_ALG_IS_HASH( alg ) ?
2655 PSA_ERROR_NOT_SUPPORTED :
2656 PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002657 }
2658 if( ret == 0 )
2659 operation->alg = alg;
2660 else
2661 psa_hash_abort( operation );
2662 return( mbedtls_to_psa_error( ret ) );
2663}
2664
2665psa_status_t psa_hash_update( psa_hash_operation_t *operation,
2666 const uint8_t *input,
2667 size_t input_length )
2668{
Janos Follath24eed8d2019-11-22 13:21:35 +00002669 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine94e44542018-07-12 16:58:43 +02002670
2671 /* Don't require hash implementations to behave correctly on a
2672 * zero-length input, which may have an invalid pointer. */
2673 if( input_length == 0 )
2674 return( PSA_SUCCESS );
2675
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002676 switch( operation->alg )
2677 {
John Durkopee4e6602020-11-27 08:48:46 -08002678#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD2)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002679 case PSA_ALG_MD2:
2680 ret = mbedtls_md2_update_ret( &operation->ctx.md2,
2681 input, input_length );
2682 break;
2683#endif
John Durkopee4e6602020-11-27 08:48:46 -08002684#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD4)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002685 case PSA_ALG_MD4:
2686 ret = mbedtls_md4_update_ret( &operation->ctx.md4,
2687 input, input_length );
2688 break;
2689#endif
John Durkopee4e6602020-11-27 08:48:46 -08002690#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD5)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002691 case PSA_ALG_MD5:
2692 ret = mbedtls_md5_update_ret( &operation->ctx.md5,
2693 input, input_length );
2694 break;
2695#endif
John Durkopee4e6602020-11-27 08:48:46 -08002696#if defined(MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002697 case PSA_ALG_RIPEMD160:
2698 ret = mbedtls_ripemd160_update_ret( &operation->ctx.ripemd160,
2699 input, input_length );
2700 break;
2701#endif
John Durkopee4e6602020-11-27 08:48:46 -08002702#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_1)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002703 case PSA_ALG_SHA_1:
2704 ret = mbedtls_sha1_update_ret( &operation->ctx.sha1,
2705 input, input_length );
2706 break;
2707#endif
John Durkop6ca23272020-12-03 06:01:32 -08002708#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_224)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002709 case PSA_ALG_SHA_224:
John Durkop6ca23272020-12-03 06:01:32 -08002710 ret = mbedtls_sha256_update_ret( &operation->ctx.sha256,
2711 input, input_length );
2712 break;
2713#endif
2714#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002715 case PSA_ALG_SHA_256:
2716 ret = mbedtls_sha256_update_ret( &operation->ctx.sha256,
2717 input, input_length );
2718 break;
2719#endif
John Durkop6ca23272020-12-03 06:01:32 -08002720#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_384)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002721 case PSA_ALG_SHA_384:
John Durkop6ca23272020-12-03 06:01:32 -08002722 ret = mbedtls_sha512_update_ret( &operation->ctx.sha512,
2723 input, input_length );
2724 break;
2725#endif
2726#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_512)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002727 case PSA_ALG_SHA_512:
2728 ret = mbedtls_sha512_update_ret( &operation->ctx.sha512,
2729 input, input_length );
2730 break;
2731#endif
2732 default:
John Durkopee4e6602020-11-27 08:48:46 -08002733 (void)input;
Jaeden Ameroa0f625a2019-02-15 13:52:25 +00002734 return( PSA_ERROR_BAD_STATE );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002735 }
Gilles Peskine94e44542018-07-12 16:58:43 +02002736
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002737 if( ret != 0 )
2738 psa_hash_abort( operation );
2739 return( mbedtls_to_psa_error( ret ) );
2740}
2741
2742psa_status_t psa_hash_finish( psa_hash_operation_t *operation,
2743 uint8_t *hash,
2744 size_t hash_size,
2745 size_t *hash_length )
2746{
itayzafrir40835d42018-08-02 13:14:17 +03002747 psa_status_t status;
Janos Follath24eed8d2019-11-22 13:21:35 +00002748 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine71bb7b72018-04-19 08:29:59 +02002749 size_t actual_hash_length = PSA_HASH_SIZE( operation->alg );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002750
2751 /* Fill the output buffer with something that isn't a valid hash
2752 * (barring an attack on the hash and deliberately-crafted input),
2753 * in case the caller doesn't check the return status properly. */
Gilles Peskineaee13332018-07-02 12:15:28 +02002754 *hash_length = hash_size;
Gilles Peskine46f1fd72018-06-28 19:31:31 +02002755 /* If hash_size is 0 then hash may be NULL and then the
2756 * call to memset would have undefined behavior. */
2757 if( hash_size != 0 )
2758 memset( hash, '!', hash_size );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002759
2760 if( hash_size < actual_hash_length )
itayzafrir40835d42018-08-02 13:14:17 +03002761 {
2762 status = PSA_ERROR_BUFFER_TOO_SMALL;
2763 goto exit;
2764 }
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002765
2766 switch( operation->alg )
2767 {
John Durkopee4e6602020-11-27 08:48:46 -08002768#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD2)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002769 case PSA_ALG_MD2:
2770 ret = mbedtls_md2_finish_ret( &operation->ctx.md2, hash );
2771 break;
2772#endif
John Durkopee4e6602020-11-27 08:48:46 -08002773#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD4)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002774 case PSA_ALG_MD4:
2775 ret = mbedtls_md4_finish_ret( &operation->ctx.md4, hash );
2776 break;
2777#endif
John Durkopee4e6602020-11-27 08:48:46 -08002778#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD5)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002779 case PSA_ALG_MD5:
2780 ret = mbedtls_md5_finish_ret( &operation->ctx.md5, hash );
2781 break;
2782#endif
John Durkopee4e6602020-11-27 08:48:46 -08002783#if defined(MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002784 case PSA_ALG_RIPEMD160:
2785 ret = mbedtls_ripemd160_finish_ret( &operation->ctx.ripemd160, hash );
2786 break;
2787#endif
John Durkopee4e6602020-11-27 08:48:46 -08002788#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_1)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002789 case PSA_ALG_SHA_1:
2790 ret = mbedtls_sha1_finish_ret( &operation->ctx.sha1, hash );
2791 break;
2792#endif
John Durkop6ca23272020-12-03 06:01:32 -08002793#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_224)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002794 case PSA_ALG_SHA_224:
John Durkop6ca23272020-12-03 06:01:32 -08002795 ret = mbedtls_sha256_finish_ret( &operation->ctx.sha256, hash );
2796 break;
2797#endif
2798#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002799 case PSA_ALG_SHA_256:
2800 ret = mbedtls_sha256_finish_ret( &operation->ctx.sha256, hash );
2801 break;
2802#endif
John Durkop6ca23272020-12-03 06:01:32 -08002803#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_384)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002804 case PSA_ALG_SHA_384:
John Durkop6ca23272020-12-03 06:01:32 -08002805 ret = mbedtls_sha512_finish_ret( &operation->ctx.sha512, hash );
2806 break;
2807#endif
2808#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_512)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002809 case PSA_ALG_SHA_512:
2810 ret = mbedtls_sha512_finish_ret( &operation->ctx.sha512, hash );
2811 break;
2812#endif
2813 default:
Jaeden Ameroa0f625a2019-02-15 13:52:25 +00002814 return( PSA_ERROR_BAD_STATE );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002815 }
itayzafrir40835d42018-08-02 13:14:17 +03002816 status = mbedtls_to_psa_error( ret );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002817
itayzafrir40835d42018-08-02 13:14:17 +03002818exit:
2819 if( status == PSA_SUCCESS )
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002820 {
Gilles Peskineaee13332018-07-02 12:15:28 +02002821 *hash_length = actual_hash_length;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002822 return( psa_hash_abort( operation ) );
2823 }
2824 else
2825 {
2826 psa_hash_abort( operation );
itayzafrir40835d42018-08-02 13:14:17 +03002827 return( status );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002828 }
2829}
2830
Gilles Peskine2d277862018-06-18 15:41:12 +02002831psa_status_t psa_hash_verify( psa_hash_operation_t *operation,
2832 const uint8_t *hash,
2833 size_t hash_length )
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002834{
2835 uint8_t actual_hash[MBEDTLS_MD_MAX_SIZE];
2836 size_t actual_hash_length;
2837 psa_status_t status = psa_hash_finish( operation,
2838 actual_hash, sizeof( actual_hash ),
2839 &actual_hash_length );
2840 if( status != PSA_SUCCESS )
2841 return( status );
2842 if( actual_hash_length != hash_length )
2843 return( PSA_ERROR_INVALID_SIGNATURE );
2844 if( safer_memcmp( hash, actual_hash, actual_hash_length ) != 0 )
2845 return( PSA_ERROR_INVALID_SIGNATURE );
2846 return( PSA_SUCCESS );
2847}
2848
Gilles Peskine0a749c82019-11-28 19:33:58 +01002849psa_status_t psa_hash_compute( psa_algorithm_t alg,
2850 const uint8_t *input, size_t input_length,
2851 uint8_t *hash, size_t hash_size,
2852 size_t *hash_length )
2853{
2854 psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT;
2855 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2856
2857 *hash_length = hash_size;
2858 status = psa_hash_setup( &operation, alg );
2859 if( status != PSA_SUCCESS )
2860 goto exit;
2861 status = psa_hash_update( &operation, input, input_length );
2862 if( status != PSA_SUCCESS )
2863 goto exit;
2864 status = psa_hash_finish( &operation, hash, hash_size, hash_length );
2865 if( status != PSA_SUCCESS )
2866 goto exit;
2867
2868exit:
2869 if( status == PSA_SUCCESS )
2870 status = psa_hash_abort( &operation );
2871 else
2872 psa_hash_abort( &operation );
2873 return( status );
2874}
2875
2876psa_status_t psa_hash_compare( psa_algorithm_t alg,
2877 const uint8_t *input, size_t input_length,
2878 const uint8_t *hash, size_t hash_length )
2879{
2880 psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT;
2881 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2882
2883 status = psa_hash_setup( &operation, alg );
2884 if( status != PSA_SUCCESS )
2885 goto exit;
2886 status = psa_hash_update( &operation, input, input_length );
2887 if( status != PSA_SUCCESS )
2888 goto exit;
2889 status = psa_hash_verify( &operation, hash, hash_length );
2890 if( status != PSA_SUCCESS )
2891 goto exit;
2892
2893exit:
2894 if( status == PSA_SUCCESS )
2895 status = psa_hash_abort( &operation );
2896 else
2897 psa_hash_abort( &operation );
2898 return( status );
2899}
2900
Gilles Peskineeb35d782019-01-22 17:56:16 +01002901psa_status_t psa_hash_clone( const psa_hash_operation_t *source_operation,
2902 psa_hash_operation_t *target_operation )
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002903{
2904 if( target_operation->alg != 0 )
2905 return( PSA_ERROR_BAD_STATE );
2906
2907 switch( source_operation->alg )
2908 {
2909 case 0:
2910 return( PSA_ERROR_BAD_STATE );
John Durkopee4e6602020-11-27 08:48:46 -08002911#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD2)
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002912 case PSA_ALG_MD2:
2913 mbedtls_md2_clone( &target_operation->ctx.md2,
2914 &source_operation->ctx.md2 );
2915 break;
2916#endif
John Durkopee4e6602020-11-27 08:48:46 -08002917#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD4)
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002918 case PSA_ALG_MD4:
2919 mbedtls_md4_clone( &target_operation->ctx.md4,
2920 &source_operation->ctx.md4 );
2921 break;
2922#endif
John Durkopee4e6602020-11-27 08:48:46 -08002923#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD5)
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002924 case PSA_ALG_MD5:
2925 mbedtls_md5_clone( &target_operation->ctx.md5,
2926 &source_operation->ctx.md5 );
2927 break;
2928#endif
John Durkopee4e6602020-11-27 08:48:46 -08002929#if defined(MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160)
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002930 case PSA_ALG_RIPEMD160:
2931 mbedtls_ripemd160_clone( &target_operation->ctx.ripemd160,
2932 &source_operation->ctx.ripemd160 );
2933 break;
2934#endif
John Durkopee4e6602020-11-27 08:48:46 -08002935#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_1)
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002936 case PSA_ALG_SHA_1:
2937 mbedtls_sha1_clone( &target_operation->ctx.sha1,
2938 &source_operation->ctx.sha1 );
2939 break;
2940#endif
John Durkop6ca23272020-12-03 06:01:32 -08002941#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_224)
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002942 case PSA_ALG_SHA_224:
John Durkop6ca23272020-12-03 06:01:32 -08002943 mbedtls_sha256_clone( &target_operation->ctx.sha256,
2944 &source_operation->ctx.sha256 );
2945 break;
2946#endif
2947#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256)
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002948 case PSA_ALG_SHA_256:
2949 mbedtls_sha256_clone( &target_operation->ctx.sha256,
2950 &source_operation->ctx.sha256 );
2951 break;
2952#endif
John Durkop6ca23272020-12-03 06:01:32 -08002953#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_384)
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002954 case PSA_ALG_SHA_384:
John Durkop6ca23272020-12-03 06:01:32 -08002955 mbedtls_sha512_clone( &target_operation->ctx.sha512,
2956 &source_operation->ctx.sha512 );
2957 break;
2958#endif
2959#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_512)
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002960 case PSA_ALG_SHA_512:
2961 mbedtls_sha512_clone( &target_operation->ctx.sha512,
2962 &source_operation->ctx.sha512 );
2963 break;
2964#endif
2965 default:
2966 return( PSA_ERROR_NOT_SUPPORTED );
2967 }
2968
2969 target_operation->alg = source_operation->alg;
2970 return( PSA_SUCCESS );
2971}
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002972
2973
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002974/****************************************************************/
Gilles Peskine8c9def32018-02-08 10:02:12 +01002975/* MAC */
2976/****************************************************************/
2977
Gilles Peskinedc2fc842018-03-07 16:42:59 +01002978static const mbedtls_cipher_info_t *mbedtls_cipher_info_from_psa(
Gilles Peskine8c9def32018-02-08 10:02:12 +01002979 psa_algorithm_t alg,
2980 psa_key_type_t key_type,
Gilles Peskine2d277862018-06-18 15:41:12 +02002981 size_t key_bits,
mohammad1603f4f0d612018-06-03 15:04:51 +03002982 mbedtls_cipher_id_t* cipher_id )
Gilles Peskine8c9def32018-02-08 10:02:12 +01002983{
Gilles Peskine8c9def32018-02-08 10:02:12 +01002984 mbedtls_cipher_mode_t mode;
mohammad1603f4f0d612018-06-03 15:04:51 +03002985 mbedtls_cipher_id_t cipher_id_tmp;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002986
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02002987 if( PSA_ALG_IS_AEAD( alg ) )
Gilles Peskine57fbdb12018-10-17 18:29:17 +02002988 alg = PSA_ALG_AEAD_WITH_TAG_LENGTH( alg, 0 );
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02002989
Gilles Peskine8c9def32018-02-08 10:02:12 +01002990 if( PSA_ALG_IS_CIPHER( alg ) || PSA_ALG_IS_AEAD( alg ) )
2991 {
Nir Sonnenscheine9664c32018-06-17 14:41:30 +03002992 switch( alg )
Gilles Peskine8c9def32018-02-08 10:02:12 +01002993 {
Bence Szépkúti1de907d2020-12-07 18:20:28 +01002994 case PSA_ALG_STREAM_CIPHER:
Gilles Peskine8c9def32018-02-08 10:02:12 +01002995 mode = MBEDTLS_MODE_STREAM;
2996 break;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002997 case PSA_ALG_CTR:
2998 mode = MBEDTLS_MODE_CTR;
2999 break;
Gilles Peskinedaea26f2018-08-21 14:02:45 +02003000 case PSA_ALG_CFB:
3001 mode = MBEDTLS_MODE_CFB;
3002 break;
3003 case PSA_ALG_OFB:
3004 mode = MBEDTLS_MODE_OFB;
3005 break;
Steven Cooremaned3c9ec2020-07-06 14:08:59 +02003006 case PSA_ALG_ECB_NO_PADDING:
3007 mode = MBEDTLS_MODE_ECB;
3008 break;
Gilles Peskinedaea26f2018-08-21 14:02:45 +02003009 case PSA_ALG_CBC_NO_PADDING:
3010 mode = MBEDTLS_MODE_CBC;
3011 break;
3012 case PSA_ALG_CBC_PKCS7:
3013 mode = MBEDTLS_MODE_CBC;
3014 break;
Gilles Peskine57fbdb12018-10-17 18:29:17 +02003015 case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_CCM, 0 ):
Gilles Peskine8c9def32018-02-08 10:02:12 +01003016 mode = MBEDTLS_MODE_CCM;
3017 break;
Gilles Peskine57fbdb12018-10-17 18:29:17 +02003018 case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_GCM, 0 ):
Gilles Peskine8c9def32018-02-08 10:02:12 +01003019 mode = MBEDTLS_MODE_GCM;
3020 break;
Gilles Peskine26869f22019-05-06 15:25:00 +02003021 case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_CHACHA20_POLY1305, 0 ):
3022 mode = MBEDTLS_MODE_CHACHAPOLY;
3023 break;
Gilles Peskine8c9def32018-02-08 10:02:12 +01003024 default:
3025 return( NULL );
3026 }
3027 }
3028 else if( alg == PSA_ALG_CMAC )
3029 mode = MBEDTLS_MODE_ECB;
Gilles Peskine8c9def32018-02-08 10:02:12 +01003030 else
3031 return( NULL );
3032
3033 switch( key_type )
3034 {
3035 case PSA_KEY_TYPE_AES:
mohammad1603f4f0d612018-06-03 15:04:51 +03003036 cipher_id_tmp = MBEDTLS_CIPHER_ID_AES;
Gilles Peskine8c9def32018-02-08 10:02:12 +01003037 break;
3038 case PSA_KEY_TYPE_DES:
Gilles Peskine9ad29e22018-06-21 09:40:04 +02003039 /* key_bits is 64 for Single-DES, 128 for two-key Triple-DES,
3040 * and 192 for three-key Triple-DES. */
Gilles Peskine8c9def32018-02-08 10:02:12 +01003041 if( key_bits == 64 )
mohammad1603f4f0d612018-06-03 15:04:51 +03003042 cipher_id_tmp = MBEDTLS_CIPHER_ID_DES;
Gilles Peskine8c9def32018-02-08 10:02:12 +01003043 else
mohammad1603f4f0d612018-06-03 15:04:51 +03003044 cipher_id_tmp = MBEDTLS_CIPHER_ID_3DES;
Gilles Peskine9ad29e22018-06-21 09:40:04 +02003045 /* mbedtls doesn't recognize two-key Triple-DES as an algorithm,
3046 * but two-key Triple-DES is functionally three-key Triple-DES
3047 * with K1=K3, so that's how we present it to mbedtls. */
3048 if( key_bits == 128 )
3049 key_bits = 192;
Gilles Peskine8c9def32018-02-08 10:02:12 +01003050 break;
3051 case PSA_KEY_TYPE_CAMELLIA:
mohammad1603f4f0d612018-06-03 15:04:51 +03003052 cipher_id_tmp = MBEDTLS_CIPHER_ID_CAMELLIA;
Gilles Peskine8c9def32018-02-08 10:02:12 +01003053 break;
3054 case PSA_KEY_TYPE_ARC4:
mohammad1603f4f0d612018-06-03 15:04:51 +03003055 cipher_id_tmp = MBEDTLS_CIPHER_ID_ARC4;
Gilles Peskine8c9def32018-02-08 10:02:12 +01003056 break;
Gilles Peskine26869f22019-05-06 15:25:00 +02003057 case PSA_KEY_TYPE_CHACHA20:
3058 cipher_id_tmp = MBEDTLS_CIPHER_ID_CHACHA20;
3059 break;
Gilles Peskine8c9def32018-02-08 10:02:12 +01003060 default:
3061 return( NULL );
3062 }
mohammad1603f4f0d612018-06-03 15:04:51 +03003063 if( cipher_id != NULL )
mohammad160360a64d02018-06-03 17:20:42 +03003064 *cipher_id = cipher_id_tmp;
Gilles Peskine8c9def32018-02-08 10:02:12 +01003065
Jaeden Amero23bbb752018-06-26 14:16:54 +01003066 return( mbedtls_cipher_info_from_values( cipher_id_tmp,
3067 (int) key_bits, mode ) );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003068}
3069
John Durkop6ba40d12020-11-10 08:50:04 -08003070#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03003071static size_t psa_get_hash_block_size( psa_algorithm_t alg )
Nir Sonnenschein96272412018-06-17 14:41:10 +03003072{
Gilles Peskine2d277862018-06-18 15:41:12 +02003073 switch( alg )
Nir Sonnenschein96272412018-06-17 14:41:10 +03003074 {
3075 case PSA_ALG_MD2:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03003076 return( 16 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03003077 case PSA_ALG_MD4:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03003078 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03003079 case PSA_ALG_MD5:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03003080 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03003081 case PSA_ALG_RIPEMD160:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03003082 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03003083 case PSA_ALG_SHA_1:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03003084 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03003085 case PSA_ALG_SHA_224:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03003086 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03003087 case PSA_ALG_SHA_256:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03003088 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03003089 case PSA_ALG_SHA_384:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03003090 return( 128 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03003091 case PSA_ALG_SHA_512:
Gilles Peskine2d277862018-06-18 15:41:12 +02003092 return( 128 );
3093 default:
3094 return( 0 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03003095 }
3096}
John Durkop07cc04a2020-11-16 22:08:34 -08003097#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC) */
Nir Sonnenschein0c9ec532018-06-07 13:27:47 +03003098
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02003099/* Initialize the MAC operation structure. Once this function has been
3100 * called, psa_mac_abort can run and will do the right thing. */
3101static psa_status_t psa_mac_init( psa_mac_operation_t *operation,
3102 psa_algorithm_t alg )
3103{
3104 psa_status_t status = PSA_ERROR_NOT_SUPPORTED;
3105
3106 operation->alg = alg;
3107 operation->key_set = 0;
3108 operation->iv_set = 0;
3109 operation->iv_required = 0;
3110 operation->has_input = 0;
Gilles Peskine89167cb2018-07-08 20:12:23 +02003111 operation->is_sign = 0;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02003112
3113#if defined(MBEDTLS_CMAC_C)
3114 if( alg == PSA_ALG_CMAC )
3115 {
3116 operation->iv_required = 0;
3117 mbedtls_cipher_init( &operation->ctx.cmac );
3118 status = PSA_SUCCESS;
3119 }
3120 else
3121#endif /* MBEDTLS_CMAC_C */
John Durkopd0321952020-10-29 21:37:36 -07003122#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02003123 if( PSA_ALG_IS_HMAC( operation->alg ) )
3124 {
Gilles Peskineff94abd2018-07-12 17:07:52 +02003125 /* We'll set up the hash operation later in psa_hmac_setup_internal. */
3126 operation->ctx.hmac.hash_ctx.alg = 0;
3127 status = PSA_SUCCESS;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02003128 }
3129 else
John Durkopd0321952020-10-29 21:37:36 -07003130#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02003131 {
Gilles Peskinec06e0712018-06-20 16:21:04 +02003132 if( ! PSA_ALG_IS_MAC( alg ) )
3133 status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02003134 }
3135
3136 if( status != PSA_SUCCESS )
3137 memset( operation, 0, sizeof( *operation ) );
3138 return( status );
3139}
3140
John Durkop6ba40d12020-11-10 08:50:04 -08003141#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Gilles Peskine01126fa2018-07-12 17:04:55 +02003142static psa_status_t psa_hmac_abort_internal( psa_hmac_internal_data *hmac )
3143{
Gilles Peskine3f108122018-12-07 18:14:53 +01003144 mbedtls_platform_zeroize( hmac->opad, sizeof( hmac->opad ) );
Gilles Peskine01126fa2018-07-12 17:04:55 +02003145 return( psa_hash_abort( &hmac->hash_ctx ) );
3146}
John Durkop6ba40d12020-11-10 08:50:04 -08003147#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Gilles Peskine01126fa2018-07-12 17:04:55 +02003148
Gilles Peskine8c9def32018-02-08 10:02:12 +01003149psa_status_t psa_mac_abort( psa_mac_operation_t *operation )
3150{
Gilles Peskinefbfac682018-07-08 20:51:54 +02003151 if( operation->alg == 0 )
Gilles Peskine8c9def32018-02-08 10:02:12 +01003152 {
Gilles Peskinefbfac682018-07-08 20:51:54 +02003153 /* The object has (apparently) been initialized but it is not
3154 * in use. It's ok to call abort on such an object, and there's
3155 * nothing to do. */
3156 return( PSA_SUCCESS );
3157 }
3158 else
Gilles Peskine8c9def32018-02-08 10:02:12 +01003159#if defined(MBEDTLS_CMAC_C)
Gilles Peskinefbfac682018-07-08 20:51:54 +02003160 if( operation->alg == PSA_ALG_CMAC )
3161 {
3162 mbedtls_cipher_free( &operation->ctx.cmac );
3163 }
3164 else
Gilles Peskine8c9def32018-02-08 10:02:12 +01003165#endif /* MBEDTLS_CMAC_C */
John Durkopd0321952020-10-29 21:37:36 -07003166#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Gilles Peskinefbfac682018-07-08 20:51:54 +02003167 if( PSA_ALG_IS_HMAC( operation->alg ) )
3168 {
Gilles Peskine01126fa2018-07-12 17:04:55 +02003169 psa_hmac_abort_internal( &operation->ctx.hmac );
Gilles Peskinefbfac682018-07-08 20:51:54 +02003170 }
3171 else
John Durkopd0321952020-10-29 21:37:36 -07003172#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Gilles Peskinefbfac682018-07-08 20:51:54 +02003173 {
3174 /* Sanity check (shouldn't happen: operation->alg should
3175 * always have been initialized to a valid value). */
3176 goto bad_state;
Gilles Peskine8c9def32018-02-08 10:02:12 +01003177 }
Moran Peker41deec42018-04-04 15:43:05 +03003178
Gilles Peskine8c9def32018-02-08 10:02:12 +01003179 operation->alg = 0;
3180 operation->key_set = 0;
3181 operation->iv_set = 0;
3182 operation->iv_required = 0;
3183 operation->has_input = 0;
Gilles Peskine89167cb2018-07-08 20:12:23 +02003184 operation->is_sign = 0;
Moran Peker41deec42018-04-04 15:43:05 +03003185
Gilles Peskine8c9def32018-02-08 10:02:12 +01003186 return( PSA_SUCCESS );
Gilles Peskinefbfac682018-07-08 20:51:54 +02003187
3188bad_state:
3189 /* If abort is called on an uninitialized object, we can't trust
3190 * anything. Wipe the object in case it contains confidential data.
3191 * This may result in a memory leak if a pointer gets overwritten,
3192 * but it's too late to do anything about this. */
3193 memset( operation, 0, sizeof( *operation ) );
3194 return( PSA_ERROR_BAD_STATE );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003195}
3196
Gilles Peskinee3b07d82018-06-19 11:57:35 +02003197#if defined(MBEDTLS_CMAC_C)
Gilles Peskine89167cb2018-07-08 20:12:23 +02003198static int psa_cmac_setup( psa_mac_operation_t *operation,
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003199 size_t key_bits,
Gilles Peskine2f060a82018-12-04 17:12:32 +01003200 psa_key_slot_t *slot,
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003201 const mbedtls_cipher_info_t *cipher_info )
3202{
Janos Follath24eed8d2019-11-22 13:21:35 +00003203 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003204
3205 operation->mac_size = cipher_info->block_size;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003206
3207 ret = mbedtls_cipher_setup( &operation->ctx.cmac, cipher_info );
3208 if( ret != 0 )
3209 return( ret );
3210
3211 ret = mbedtls_cipher_cmac_starts( &operation->ctx.cmac,
Steven Cooreman71fd80d2020-07-07 21:12:27 +02003212 slot->data.key.data,
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003213 key_bits );
3214 return( ret );
3215}
Gilles Peskinee3b07d82018-06-19 11:57:35 +02003216#endif /* MBEDTLS_CMAC_C */
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003217
John Durkop6ba40d12020-11-10 08:50:04 -08003218#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Gilles Peskine01126fa2018-07-12 17:04:55 +02003219static psa_status_t psa_hmac_setup_internal( psa_hmac_internal_data *hmac,
3220 const uint8_t *key,
3221 size_t key_length,
3222 psa_algorithm_t hash_alg )
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003223{
Gilles Peskinec11c4dc2019-07-15 11:06:38 +02003224 uint8_t ipad[PSA_HMAC_MAX_HASH_BLOCK_SIZE];
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003225 size_t i;
Gilles Peskine9aa369e2018-07-16 00:36:29 +02003226 size_t hash_size = PSA_HASH_SIZE( hash_alg );
Gilles Peskine01126fa2018-07-12 17:04:55 +02003227 size_t block_size = psa_get_hash_block_size( hash_alg );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003228 psa_status_t status;
3229
Gilles Peskine9aa369e2018-07-16 00:36:29 +02003230 /* Sanity checks on block_size, to guarantee that there won't be a buffer
3231 * overflow below. This should never trigger if the hash algorithm
3232 * is implemented correctly. */
3233 /* The size checks against the ipad and opad buffers cannot be written
3234 * `block_size > sizeof( ipad ) || block_size > sizeof( hmac->opad )`
3235 * because that triggers -Wlogical-op on GCC 7.3. */
3236 if( block_size > sizeof( ipad ) )
3237 return( PSA_ERROR_NOT_SUPPORTED );
3238 if( block_size > sizeof( hmac->opad ) )
3239 return( PSA_ERROR_NOT_SUPPORTED );
3240 if( block_size < hash_size )
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003241 return( PSA_ERROR_NOT_SUPPORTED );
3242
Gilles Peskined223b522018-06-11 18:12:58 +02003243 if( key_length > block_size )
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003244 {
Gilles Peskine84b8fc82019-11-28 20:07:20 +01003245 status = psa_hash_compute( hash_alg, key, key_length,
3246 ipad, sizeof( ipad ), &key_length );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003247 if( status != PSA_SUCCESS )
Gilles Peskineb8be2882018-07-17 16:24:34 +02003248 goto cleanup;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003249 }
Gilles Peskine96889972018-07-12 17:07:03 +02003250 /* A 0-length key is not commonly used in HMAC when used as a MAC,
3251 * but it is permitted. It is common when HMAC is used in HKDF, for
3252 * example. Don't call `memcpy` in the 0-length because `key` could be
3253 * an invalid pointer which would make the behavior undefined. */
3254 else if( key_length != 0 )
Gilles Peskine01126fa2018-07-12 17:04:55 +02003255 memcpy( ipad, key, key_length );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003256
Gilles Peskined223b522018-06-11 18:12:58 +02003257 /* ipad contains the key followed by garbage. Xor and fill with 0x36
3258 * to create the ipad value. */
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003259 for( i = 0; i < key_length; i++ )
Gilles Peskined223b522018-06-11 18:12:58 +02003260 ipad[i] ^= 0x36;
3261 memset( ipad + key_length, 0x36, block_size - key_length );
3262
3263 /* Copy the key material from ipad to opad, flipping the requisite bits,
3264 * and filling the rest of opad with the requisite constant. */
3265 for( i = 0; i < key_length; i++ )
Gilles Peskine01126fa2018-07-12 17:04:55 +02003266 hmac->opad[i] = ipad[i] ^ 0x36 ^ 0x5C;
3267 memset( hmac->opad + key_length, 0x5C, block_size - key_length );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003268
Gilles Peskine01126fa2018-07-12 17:04:55 +02003269 status = psa_hash_setup( &hmac->hash_ctx, hash_alg );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003270 if( status != PSA_SUCCESS )
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02003271 goto cleanup;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003272
Gilles Peskine01126fa2018-07-12 17:04:55 +02003273 status = psa_hash_update( &hmac->hash_ctx, ipad, block_size );
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02003274
3275cleanup:
Steven Cooreman29149862020-08-05 15:43:42 +02003276 mbedtls_platform_zeroize( ipad, sizeof( ipad ) );
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02003277
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003278 return( status );
3279}
John Durkop6ba40d12020-11-10 08:50:04 -08003280#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003281
Gilles Peskine89167cb2018-07-08 20:12:23 +02003282static psa_status_t psa_mac_setup( psa_mac_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02003283 mbedtls_svc_key_id_t key,
Gilles Peskine89167cb2018-07-08 20:12:23 +02003284 psa_algorithm_t alg,
3285 int is_sign )
Gilles Peskine8c9def32018-02-08 10:02:12 +01003286{
Ronald Cronf95a2b12020-10-22 15:24:49 +02003287 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01003288 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01003289 psa_key_slot_t *slot;
Gilles Peskine8c9def32018-02-08 10:02:12 +01003290 size_t key_bits;
Gilles Peskine89167cb2018-07-08 20:12:23 +02003291 psa_key_usage_t usage =
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01003292 is_sign ? PSA_KEY_USAGE_SIGN_HASH : PSA_KEY_USAGE_VERIFY_HASH;
Gilles Peskinec11c4dc2019-07-15 11:06:38 +02003293 uint8_t truncated = PSA_MAC_TRUNCATED_LENGTH( alg );
Gilles Peskinee0e9c7c2018-10-17 18:28:05 +02003294 psa_algorithm_t full_length_alg = PSA_ALG_FULL_LENGTH_MAC( alg );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003295
Jaeden Amero36ee5d02019-02-19 09:25:10 +00003296 /* A context must be freshly initialized before it can be set up. */
3297 if( operation->alg != 0 )
3298 {
3299 return( PSA_ERROR_BAD_STATE );
3300 }
3301
Gilles Peskined911eb72018-08-14 15:18:45 +02003302 status = psa_mac_init( operation, full_length_alg );
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02003303 if( status != PSA_SUCCESS )
3304 return( status );
Gilles Peskine89167cb2018-07-08 20:12:23 +02003305 if( is_sign )
3306 operation->is_sign = 1;
Gilles Peskine8c9def32018-02-08 10:02:12 +01003307
Ronald Cron5c522922020-11-14 16:35:34 +01003308 status = psa_get_and_lock_transparent_key_slot_with_policy(
3309 key, &slot, usage, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003310 if( status != PSA_SUCCESS )
Gilles Peskinefbfac682018-07-08 20:51:54 +02003311 goto exit;
Gilles Peskinedb4b3ab2019-04-18 12:53:01 +02003312 key_bits = psa_get_key_slot_bits( slot );
Gilles Peskineab1d7ab2018-07-06 16:07:47 +02003313
Gilles Peskine8c9def32018-02-08 10:02:12 +01003314#if defined(MBEDTLS_CMAC_C)
Gilles Peskined911eb72018-08-14 15:18:45 +02003315 if( full_length_alg == PSA_ALG_CMAC )
Gilles Peskinefbfac682018-07-08 20:51:54 +02003316 {
3317 const mbedtls_cipher_info_t *cipher_info =
Gilles Peskined911eb72018-08-14 15:18:45 +02003318 mbedtls_cipher_info_from_psa( full_length_alg,
Gilles Peskine8e338702019-07-30 20:06:31 +02003319 slot->attr.type, key_bits, NULL );
Janos Follath24eed8d2019-11-22 13:21:35 +00003320 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskinefbfac682018-07-08 20:51:54 +02003321 if( cipher_info == NULL )
3322 {
3323 status = PSA_ERROR_NOT_SUPPORTED;
3324 goto exit;
3325 }
3326 operation->mac_size = cipher_info->block_size;
3327 ret = psa_cmac_setup( operation, key_bits, slot, cipher_info );
3328 status = mbedtls_to_psa_error( ret );
3329 }
3330 else
Gilles Peskine8c9def32018-02-08 10:02:12 +01003331#endif /* MBEDTLS_CMAC_C */
John Durkopd0321952020-10-29 21:37:36 -07003332#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Gilles Peskined911eb72018-08-14 15:18:45 +02003333 if( PSA_ALG_IS_HMAC( full_length_alg ) )
Gilles Peskinefbfac682018-07-08 20:51:54 +02003334 {
Gilles Peskine00709fa2018-08-22 18:25:41 +02003335 psa_algorithm_t hash_alg = PSA_ALG_HMAC_GET_HASH( alg );
Gilles Peskine01126fa2018-07-12 17:04:55 +02003336 if( hash_alg == 0 )
3337 {
3338 status = PSA_ERROR_NOT_SUPPORTED;
3339 goto exit;
3340 }
Gilles Peskine9aa369e2018-07-16 00:36:29 +02003341
3342 operation->mac_size = PSA_HASH_SIZE( hash_alg );
3343 /* Sanity check. This shouldn't fail on a valid configuration. */
3344 if( operation->mac_size == 0 ||
3345 operation->mac_size > sizeof( operation->ctx.hmac.opad ) )
3346 {
3347 status = PSA_ERROR_NOT_SUPPORTED;
3348 goto exit;
3349 }
3350
Gilles Peskine8e338702019-07-30 20:06:31 +02003351 if( slot->attr.type != PSA_KEY_TYPE_HMAC )
Gilles Peskine01126fa2018-07-12 17:04:55 +02003352 {
3353 status = PSA_ERROR_INVALID_ARGUMENT;
3354 goto exit;
3355 }
Gilles Peskine9aa369e2018-07-16 00:36:29 +02003356
Gilles Peskine01126fa2018-07-12 17:04:55 +02003357 status = psa_hmac_setup_internal( &operation->ctx.hmac,
Steven Cooreman71fd80d2020-07-07 21:12:27 +02003358 slot->data.key.data,
3359 slot->data.key.bytes,
Gilles Peskine01126fa2018-07-12 17:04:55 +02003360 hash_alg );
Gilles Peskinefbfac682018-07-08 20:51:54 +02003361 }
3362 else
John Durkopd0321952020-10-29 21:37:36 -07003363#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Gilles Peskinefbfac682018-07-08 20:51:54 +02003364 {
Jaeden Amero82df32e2018-11-23 15:11:20 +00003365 (void) key_bits;
Gilles Peskinefbfac682018-07-08 20:51:54 +02003366 status = PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine8c9def32018-02-08 10:02:12 +01003367 }
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003368
Gilles Peskined911eb72018-08-14 15:18:45 +02003369 if( truncated == 0 )
3370 {
3371 /* The "normal" case: untruncated algorithm. Nothing to do. */
3372 }
3373 else if( truncated < 4 )
3374 {
Gilles Peskine6d72ff92018-08-21 14:55:08 +02003375 /* A very short MAC is too short for security since it can be
3376 * brute-forced. Ancient protocols with 32-bit MACs do exist,
3377 * so we make this our minimum, even though 32 bits is still
3378 * too small for security. */
Gilles Peskined911eb72018-08-14 15:18:45 +02003379 status = PSA_ERROR_NOT_SUPPORTED;
3380 }
3381 else if( truncated > operation->mac_size )
3382 {
3383 /* It's impossible to "truncate" to a larger length. */
3384 status = PSA_ERROR_INVALID_ARGUMENT;
3385 }
3386 else
3387 operation->mac_size = truncated;
3388
Gilles Peskinefbfac682018-07-08 20:51:54 +02003389exit:
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003390 if( status != PSA_SUCCESS )
Gilles Peskine8c9def32018-02-08 10:02:12 +01003391 {
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02003392 psa_mac_abort( operation );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003393 }
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003394 else
3395 {
Gilles Peskine7e454bc2018-06-11 17:26:17 +02003396 operation->key_set = 1;
3397 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02003398
Ronald Cron5c522922020-11-14 16:35:34 +01003399 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02003400
Ronald Cron5c522922020-11-14 16:35:34 +01003401 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003402}
3403
Gilles Peskine89167cb2018-07-08 20:12:23 +02003404psa_status_t psa_mac_sign_setup( psa_mac_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02003405 mbedtls_svc_key_id_t key,
Gilles Peskine89167cb2018-07-08 20:12:23 +02003406 psa_algorithm_t alg )
3407{
Ronald Croncf56a0a2020-08-04 09:51:30 +02003408 return( psa_mac_setup( operation, key, alg, 1 ) );
Gilles Peskine89167cb2018-07-08 20:12:23 +02003409}
3410
3411psa_status_t psa_mac_verify_setup( psa_mac_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02003412 mbedtls_svc_key_id_t key,
Gilles Peskine89167cb2018-07-08 20:12:23 +02003413 psa_algorithm_t alg )
3414{
Ronald Croncf56a0a2020-08-04 09:51:30 +02003415 return( psa_mac_setup( operation, key, alg, 0 ) );
Gilles Peskine89167cb2018-07-08 20:12:23 +02003416}
3417
Gilles Peskine8c9def32018-02-08 10:02:12 +01003418psa_status_t psa_mac_update( psa_mac_operation_t *operation,
3419 const uint8_t *input,
3420 size_t input_length )
3421{
Gilles Peskinefbfac682018-07-08 20:51:54 +02003422 psa_status_t status = PSA_ERROR_BAD_STATE;
Gilles Peskine8c9def32018-02-08 10:02:12 +01003423 if( ! operation->key_set )
Jaeden Ameroe236c2a2019-02-20 15:37:15 +00003424 return( PSA_ERROR_BAD_STATE );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003425 if( operation->iv_required && ! operation->iv_set )
Jaeden Ameroe236c2a2019-02-20 15:37:15 +00003426 return( PSA_ERROR_BAD_STATE );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003427 operation->has_input = 1;
3428
Gilles Peskine8c9def32018-02-08 10:02:12 +01003429#if defined(MBEDTLS_CMAC_C)
Gilles Peskinefbfac682018-07-08 20:51:54 +02003430 if( operation->alg == PSA_ALG_CMAC )
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03003431 {
Gilles Peskinefbfac682018-07-08 20:51:54 +02003432 int ret = mbedtls_cipher_cmac_update( &operation->ctx.cmac,
3433 input, input_length );
3434 status = mbedtls_to_psa_error( ret );
3435 }
3436 else
3437#endif /* MBEDTLS_CMAC_C */
John Durkopd0321952020-10-29 21:37:36 -07003438#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Gilles Peskinefbfac682018-07-08 20:51:54 +02003439 if( PSA_ALG_IS_HMAC( operation->alg ) )
3440 {
3441 status = psa_hash_update( &operation->ctx.hmac.hash_ctx, input,
3442 input_length );
3443 }
3444 else
John Durkopd0321952020-10-29 21:37:36 -07003445#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Gilles Peskinefbfac682018-07-08 20:51:54 +02003446 {
3447 /* This shouldn't happen if `operation` was initialized by
3448 * a setup function. */
Jaeden Ameroe236c2a2019-02-20 15:37:15 +00003449 return( PSA_ERROR_BAD_STATE );
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03003450 }
3451
Gilles Peskinefbfac682018-07-08 20:51:54 +02003452 if( status != PSA_SUCCESS )
3453 psa_mac_abort( operation );
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02003454 return( status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003455}
3456
John Durkop6ba40d12020-11-10 08:50:04 -08003457#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Gilles Peskine01126fa2018-07-12 17:04:55 +02003458static psa_status_t psa_hmac_finish_internal( psa_hmac_internal_data *hmac,
3459 uint8_t *mac,
3460 size_t mac_size )
3461{
Gilles Peskinec11c4dc2019-07-15 11:06:38 +02003462 uint8_t tmp[MBEDTLS_MD_MAX_SIZE];
Gilles Peskine01126fa2018-07-12 17:04:55 +02003463 psa_algorithm_t hash_alg = hmac->hash_ctx.alg;
3464 size_t hash_size = 0;
3465 size_t block_size = psa_get_hash_block_size( hash_alg );
3466 psa_status_t status;
3467
Gilles Peskine01126fa2018-07-12 17:04:55 +02003468 status = psa_hash_finish( &hmac->hash_ctx, tmp, sizeof( tmp ), &hash_size );
3469 if( status != PSA_SUCCESS )
3470 return( status );
3471 /* From here on, tmp needs to be wiped. */
3472
3473 status = psa_hash_setup( &hmac->hash_ctx, hash_alg );
3474 if( status != PSA_SUCCESS )
3475 goto exit;
3476
3477 status = psa_hash_update( &hmac->hash_ctx, hmac->opad, block_size );
3478 if( status != PSA_SUCCESS )
3479 goto exit;
3480
3481 status = psa_hash_update( &hmac->hash_ctx, tmp, hash_size );
3482 if( status != PSA_SUCCESS )
3483 goto exit;
3484
Gilles Peskined911eb72018-08-14 15:18:45 +02003485 status = psa_hash_finish( &hmac->hash_ctx, tmp, sizeof( tmp ), &hash_size );
3486 if( status != PSA_SUCCESS )
3487 goto exit;
3488
3489 memcpy( mac, tmp, mac_size );
Gilles Peskine01126fa2018-07-12 17:04:55 +02003490
3491exit:
Gilles Peskine3f108122018-12-07 18:14:53 +01003492 mbedtls_platform_zeroize( tmp, hash_size );
Gilles Peskine01126fa2018-07-12 17:04:55 +02003493 return( status );
3494}
John Durkop6ba40d12020-11-10 08:50:04 -08003495#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Gilles Peskine01126fa2018-07-12 17:04:55 +02003496
mohammad16036df908f2018-04-02 08:34:15 -07003497static psa_status_t psa_mac_finish_internal( psa_mac_operation_t *operation,
Gilles Peskine2d277862018-06-18 15:41:12 +02003498 uint8_t *mac,
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003499 size_t mac_size )
Gilles Peskine8c9def32018-02-08 10:02:12 +01003500{
Gilles Peskine1d96fff2018-07-02 12:15:39 +02003501 if( ! operation->key_set )
3502 return( PSA_ERROR_BAD_STATE );
3503 if( operation->iv_required && ! operation->iv_set )
3504 return( PSA_ERROR_BAD_STATE );
3505
Gilles Peskine8c9def32018-02-08 10:02:12 +01003506 if( mac_size < operation->mac_size )
3507 return( PSA_ERROR_BUFFER_TOO_SMALL );
3508
Gilles Peskine8c9def32018-02-08 10:02:12 +01003509#if defined(MBEDTLS_CMAC_C)
Gilles Peskinefbfac682018-07-08 20:51:54 +02003510 if( operation->alg == PSA_ALG_CMAC )
3511 {
Gilles Peskined911eb72018-08-14 15:18:45 +02003512 uint8_t tmp[PSA_MAX_BLOCK_CIPHER_BLOCK_SIZE];
3513 int ret = mbedtls_cipher_cmac_finish( &operation->ctx.cmac, tmp );
3514 if( ret == 0 )
Gilles Peskine87b0ac42018-08-21 14:55:49 +02003515 memcpy( mac, tmp, operation->mac_size );
Gilles Peskine3f108122018-12-07 18:14:53 +01003516 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
Gilles Peskinefbfac682018-07-08 20:51:54 +02003517 return( mbedtls_to_psa_error( ret ) );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003518 }
Gilles Peskinefbfac682018-07-08 20:51:54 +02003519 else
3520#endif /* MBEDTLS_CMAC_C */
John Durkopd0321952020-10-29 21:37:36 -07003521#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Gilles Peskinefbfac682018-07-08 20:51:54 +02003522 if( PSA_ALG_IS_HMAC( operation->alg ) )
3523 {
Gilles Peskine01126fa2018-07-12 17:04:55 +02003524 return( psa_hmac_finish_internal( &operation->ctx.hmac,
Gilles Peskined911eb72018-08-14 15:18:45 +02003525 mac, operation->mac_size ) );
Gilles Peskinefbfac682018-07-08 20:51:54 +02003526 }
3527 else
John Durkopd0321952020-10-29 21:37:36 -07003528#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Gilles Peskinefbfac682018-07-08 20:51:54 +02003529 {
3530 /* This shouldn't happen if `operation` was initialized by
3531 * a setup function. */
3532 return( PSA_ERROR_BAD_STATE );
3533 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01003534}
3535
Gilles Peskineacd4be32018-07-08 19:56:25 +02003536psa_status_t psa_mac_sign_finish( psa_mac_operation_t *operation,
3537 uint8_t *mac,
3538 size_t mac_size,
3539 size_t *mac_length )
mohammad16036df908f2018-04-02 08:34:15 -07003540{
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003541 psa_status_t status;
3542
Jaeden Amero252ef282019-02-15 14:05:35 +00003543 if( operation->alg == 0 )
3544 {
3545 return( PSA_ERROR_BAD_STATE );
3546 }
3547
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003548 /* Fill the output buffer with something that isn't a valid mac
3549 * (barring an attack on the mac and deliberately-crafted input),
3550 * in case the caller doesn't check the return status properly. */
3551 *mac_length = mac_size;
3552 /* If mac_size is 0 then mac may be NULL and then the
3553 * call to memset would have undefined behavior. */
3554 if( mac_size != 0 )
3555 memset( mac, '!', mac_size );
3556
Gilles Peskine89167cb2018-07-08 20:12:23 +02003557 if( ! operation->is_sign )
3558 {
Jaeden Ameroe236c2a2019-02-20 15:37:15 +00003559 return( PSA_ERROR_BAD_STATE );
Gilles Peskine89167cb2018-07-08 20:12:23 +02003560 }
mohammad16036df908f2018-04-02 08:34:15 -07003561
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003562 status = psa_mac_finish_internal( operation, mac, mac_size );
3563
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003564 if( status == PSA_SUCCESS )
3565 {
3566 status = psa_mac_abort( operation );
3567 if( status == PSA_SUCCESS )
3568 *mac_length = operation->mac_size;
3569 else
3570 memset( mac, '!', mac_size );
3571 }
3572 else
3573 psa_mac_abort( operation );
3574 return( status );
mohammad16036df908f2018-04-02 08:34:15 -07003575}
3576
Gilles Peskineacd4be32018-07-08 19:56:25 +02003577psa_status_t psa_mac_verify_finish( psa_mac_operation_t *operation,
3578 const uint8_t *mac,
3579 size_t mac_length )
Gilles Peskine8c9def32018-02-08 10:02:12 +01003580{
Gilles Peskine828ed142018-06-18 23:25:51 +02003581 uint8_t actual_mac[PSA_MAC_MAX_SIZE];
mohammad16036df908f2018-04-02 08:34:15 -07003582 psa_status_t status;
3583
Jaeden Amero252ef282019-02-15 14:05:35 +00003584 if( operation->alg == 0 )
3585 {
3586 return( PSA_ERROR_BAD_STATE );
3587 }
3588
Gilles Peskine89167cb2018-07-08 20:12:23 +02003589 if( operation->is_sign )
3590 {
Jaeden Ameroe236c2a2019-02-20 15:37:15 +00003591 return( PSA_ERROR_BAD_STATE );
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003592 }
3593 if( operation->mac_size != mac_length )
3594 {
3595 status = PSA_ERROR_INVALID_SIGNATURE;
3596 goto cleanup;
Gilles Peskine89167cb2018-07-08 20:12:23 +02003597 }
mohammad16036df908f2018-04-02 08:34:15 -07003598
3599 status = psa_mac_finish_internal( operation,
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003600 actual_mac, sizeof( actual_mac ) );
Gilles Peskine28cd4162020-01-20 16:31:06 +01003601 if( status != PSA_SUCCESS )
3602 goto cleanup;
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003603
3604 if( safer_memcmp( mac, actual_mac, mac_length ) != 0 )
3605 status = PSA_ERROR_INVALID_SIGNATURE;
3606
3607cleanup:
3608 if( status == PSA_SUCCESS )
3609 status = psa_mac_abort( operation );
3610 else
3611 psa_mac_abort( operation );
3612
Gilles Peskine3f108122018-12-07 18:14:53 +01003613 mbedtls_platform_zeroize( actual_mac, sizeof( actual_mac ) );
Gilles Peskined911eb72018-08-14 15:18:45 +02003614
Gilles Peskine5d0b8642018-07-08 20:35:02 +02003615 return( status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003616}
3617
3618
Gilles Peskine20035e32018-02-03 22:44:14 +01003619
Gilles Peskine20035e32018-02-03 22:44:14 +01003620/****************************************************************/
3621/* Asymmetric cryptography */
3622/****************************************************************/
3623
John Durkop6ba40d12020-11-10 08:50:04 -08003624#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
3625 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
Gilles Peskine8b18a4f2018-06-08 16:34:46 +02003626/* Decode the hash algorithm from alg and store the mbedtls encoding in
Gilles Peskine71ac7b12018-06-29 23:36:35 +02003627 * md_alg. Verify that the hash length is acceptable. */
Gilles Peskine8b18a4f2018-06-08 16:34:46 +02003628static psa_status_t psa_rsa_decode_md_type( psa_algorithm_t alg,
3629 size_t hash_length,
3630 mbedtls_md_type_t *md_alg )
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03003631{
Gilles Peskine7ed29c52018-06-26 15:50:08 +02003632 psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH( alg );
Gilles Peskine61b91d42018-06-08 16:09:36 +02003633 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
Gilles Peskine71ac7b12018-06-29 23:36:35 +02003634 *md_alg = mbedtls_md_get_type( md_info );
3635
3636 /* The Mbed TLS RSA module uses an unsigned int for hash length
3637 * parameters. Validate that it fits so that we don't risk an
3638 * overflow later. */
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03003639#if SIZE_MAX > UINT_MAX
Gilles Peskine71ac7b12018-06-29 23:36:35 +02003640 if( hash_length > UINT_MAX )
3641 return( PSA_ERROR_INVALID_ARGUMENT );
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03003642#endif
Gilles Peskine71ac7b12018-06-29 23:36:35 +02003643
John Durkop0e005192020-10-31 22:06:54 -07003644#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN)
Gilles Peskine71ac7b12018-06-29 23:36:35 +02003645 /* For PKCS#1 v1.5 signature, if using a hash, the hash length
3646 * must be correct. */
3647 if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) &&
3648 alg != PSA_ALG_RSA_PKCS1V15_SIGN_RAW )
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03003649 {
Gilles Peskine71ac7b12018-06-29 23:36:35 +02003650 if( md_info == NULL )
3651 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine61b91d42018-06-08 16:09:36 +02003652 if( mbedtls_md_get_size( md_info ) != hash_length )
3653 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine71ac7b12018-06-29 23:36:35 +02003654 }
John Durkop0e005192020-10-31 22:06:54 -07003655#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN */
Gilles Peskine71ac7b12018-06-29 23:36:35 +02003656
John Durkop0e005192020-10-31 22:06:54 -07003657#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
Gilles Peskine71ac7b12018-06-29 23:36:35 +02003658 /* PSS requires a hash internally. */
3659 if( PSA_ALG_IS_RSA_PSS( alg ) )
3660 {
Gilles Peskine61b91d42018-06-08 16:09:36 +02003661 if( md_info == NULL )
3662 return( PSA_ERROR_NOT_SUPPORTED );
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03003663 }
John Durkop0e005192020-10-31 22:06:54 -07003664#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS */
Gilles Peskine71ac7b12018-06-29 23:36:35 +02003665
Gilles Peskine61b91d42018-06-08 16:09:36 +02003666 return( PSA_SUCCESS );
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03003667}
3668
Gilles Peskine2b450e32018-06-27 15:42:46 +02003669static psa_status_t psa_rsa_sign( mbedtls_rsa_context *rsa,
3670 psa_algorithm_t alg,
3671 const uint8_t *hash,
3672 size_t hash_length,
3673 uint8_t *signature,
3674 size_t signature_size,
3675 size_t *signature_length )
3676{
3677 psa_status_t status;
Janos Follath24eed8d2019-11-22 13:21:35 +00003678 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2b450e32018-06-27 15:42:46 +02003679 mbedtls_md_type_t md_alg;
3680
3681 status = psa_rsa_decode_md_type( alg, hash_length, &md_alg );
3682 if( status != PSA_SUCCESS )
3683 return( status );
3684
Gilles Peskine630a18a2018-06-29 17:49:35 +02003685 if( signature_size < mbedtls_rsa_get_len( rsa ) )
Gilles Peskine2b450e32018-06-27 15:42:46 +02003686 return( PSA_ERROR_BUFFER_TOO_SMALL );
3687
John Durkop0e005192020-10-31 22:06:54 -07003688#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN)
Gilles Peskine2b450e32018-06-27 15:42:46 +02003689 if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) )
3690 {
3691 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V15,
3692 MBEDTLS_MD_NONE );
3693 ret = mbedtls_rsa_pkcs1_sign( rsa,
Gilles Peskine30524eb2020-11-13 17:02:26 +01003694 mbedtls_psa_get_random,
Gilles Peskine5894e8e2020-12-14 14:54:06 +01003695 MBEDTLS_PSA_RANDOM_STATE,
Gilles Peskine2b450e32018-06-27 15:42:46 +02003696 MBEDTLS_RSA_PRIVATE,
Jaeden Amerobbf97e32018-06-26 14:20:51 +01003697 md_alg,
3698 (unsigned int) hash_length,
3699 hash,
Gilles Peskine2b450e32018-06-27 15:42:46 +02003700 signature );
3701 }
3702 else
John Durkop0e005192020-10-31 22:06:54 -07003703#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN */
3704#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
Gilles Peskine2b450e32018-06-27 15:42:46 +02003705 if( PSA_ALG_IS_RSA_PSS( alg ) )
3706 {
3707 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
3708 ret = mbedtls_rsa_rsassa_pss_sign( rsa,
Gilles Peskine30524eb2020-11-13 17:02:26 +01003709 mbedtls_psa_get_random,
Gilles Peskine5894e8e2020-12-14 14:54:06 +01003710 MBEDTLS_PSA_RANDOM_STATE,
Gilles Peskine2b450e32018-06-27 15:42:46 +02003711 MBEDTLS_RSA_PRIVATE,
Gilles Peskine71ac7b12018-06-29 23:36:35 +02003712 MBEDTLS_MD_NONE,
Jaeden Amerobbf97e32018-06-26 14:20:51 +01003713 (unsigned int) hash_length,
3714 hash,
Gilles Peskine2b450e32018-06-27 15:42:46 +02003715 signature );
3716 }
3717 else
John Durkop0e005192020-10-31 22:06:54 -07003718#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS */
Gilles Peskine2b450e32018-06-27 15:42:46 +02003719 {
3720 return( PSA_ERROR_INVALID_ARGUMENT );
3721 }
3722
3723 if( ret == 0 )
Gilles Peskine630a18a2018-06-29 17:49:35 +02003724 *signature_length = mbedtls_rsa_get_len( rsa );
Gilles Peskine2b450e32018-06-27 15:42:46 +02003725 return( mbedtls_to_psa_error( ret ) );
3726}
3727
3728static psa_status_t psa_rsa_verify( mbedtls_rsa_context *rsa,
3729 psa_algorithm_t alg,
3730 const uint8_t *hash,
3731 size_t hash_length,
3732 const uint8_t *signature,
3733 size_t signature_length )
3734{
3735 psa_status_t status;
Janos Follath24eed8d2019-11-22 13:21:35 +00003736 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2b450e32018-06-27 15:42:46 +02003737 mbedtls_md_type_t md_alg;
3738
3739 status = psa_rsa_decode_md_type( alg, hash_length, &md_alg );
3740 if( status != PSA_SUCCESS )
3741 return( status );
3742
Gilles Peskine89cc74f2019-09-12 22:08:23 +02003743 if( signature_length != mbedtls_rsa_get_len( rsa ) )
3744 return( PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskine2b450e32018-06-27 15:42:46 +02003745
John Durkop0e005192020-10-31 22:06:54 -07003746#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN)
Gilles Peskine2b450e32018-06-27 15:42:46 +02003747 if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) )
3748 {
3749 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V15,
3750 MBEDTLS_MD_NONE );
3751 ret = mbedtls_rsa_pkcs1_verify( rsa,
Gilles Peskine30524eb2020-11-13 17:02:26 +01003752 mbedtls_psa_get_random,
Gilles Peskine5894e8e2020-12-14 14:54:06 +01003753 MBEDTLS_PSA_RANDOM_STATE,
Gilles Peskine2b450e32018-06-27 15:42:46 +02003754 MBEDTLS_RSA_PUBLIC,
3755 md_alg,
Jaeden Amerobbf97e32018-06-26 14:20:51 +01003756 (unsigned int) hash_length,
Gilles Peskine2b450e32018-06-27 15:42:46 +02003757 hash,
3758 signature );
3759 }
3760 else
John Durkop0e005192020-10-31 22:06:54 -07003761#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN */
3762#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
Gilles Peskine2b450e32018-06-27 15:42:46 +02003763 if( PSA_ALG_IS_RSA_PSS( alg ) )
3764 {
3765 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
3766 ret = mbedtls_rsa_rsassa_pss_verify( rsa,
Gilles Peskine30524eb2020-11-13 17:02:26 +01003767 mbedtls_psa_get_random,
Gilles Peskine5894e8e2020-12-14 14:54:06 +01003768 MBEDTLS_PSA_RANDOM_STATE,
Gilles Peskine2b450e32018-06-27 15:42:46 +02003769 MBEDTLS_RSA_PUBLIC,
Gilles Peskine71ac7b12018-06-29 23:36:35 +02003770 MBEDTLS_MD_NONE,
Jaeden Amerobbf97e32018-06-26 14:20:51 +01003771 (unsigned int) hash_length,
3772 hash,
Gilles Peskine2b450e32018-06-27 15:42:46 +02003773 signature );
3774 }
3775 else
John Durkop0e005192020-10-31 22:06:54 -07003776#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS */
Gilles Peskine2b450e32018-06-27 15:42:46 +02003777 {
3778 return( PSA_ERROR_INVALID_ARGUMENT );
3779 }
Gilles Peskineef12c632018-09-13 20:37:48 +02003780
3781 /* Mbed TLS distinguishes "invalid padding" from "valid padding but
3782 * the rest of the signature is invalid". This has little use in
3783 * practice and PSA doesn't report this distinction. */
3784 if( ret == MBEDTLS_ERR_RSA_INVALID_PADDING )
3785 return( PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskine2b450e32018-06-27 15:42:46 +02003786 return( mbedtls_to_psa_error( ret ) );
3787}
John Durkop6ba40d12020-11-10 08:50:04 -08003788#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
3789 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
Gilles Peskine2b450e32018-06-27 15:42:46 +02003790
John Durkop6ba40d12020-11-10 08:50:04 -08003791#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3792 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003793/* `ecp` cannot be const because `ecp->grp` needs to be non-const
3794 * for mbedtls_ecdsa_sign() and mbedtls_ecdsa_sign_det()
3795 * (even though these functions don't modify it). */
3796static psa_status_t psa_ecdsa_sign( mbedtls_ecp_keypair *ecp,
3797 psa_algorithm_t alg,
3798 const uint8_t *hash,
3799 size_t hash_length,
3800 uint8_t *signature,
3801 size_t signature_size,
3802 size_t *signature_length )
3803{
Janos Follath24eed8d2019-11-22 13:21:35 +00003804 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003805 mbedtls_mpi r, s;
Gilles Peskineeae6eee2018-06-28 13:56:01 +02003806 size_t curve_bytes = PSA_BITS_TO_BYTES( ecp->grp.pbits );
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003807 mbedtls_mpi_init( &r );
3808 mbedtls_mpi_init( &s );
3809
Gilles Peskineeae6eee2018-06-28 13:56:01 +02003810 if( signature_size < 2 * curve_bytes )
3811 {
3812 ret = MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL;
3813 goto cleanup;
3814 }
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003815
John Durkop0ea39e02020-10-13 19:58:20 -07003816#if defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003817 if( PSA_ALG_DSA_IS_DETERMINISTIC( alg ) )
3818 {
3819 psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH( alg );
3820 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
3821 mbedtls_md_type_t md_alg = mbedtls_md_get_type( md_info );
Darryl Green5e843fa2019-09-05 14:06:34 +01003822 MBEDTLS_MPI_CHK( mbedtls_ecdsa_sign_det_ext( &ecp->grp, &r, &s,
3823 &ecp->d, hash,
3824 hash_length, md_alg,
Gilles Peskine30524eb2020-11-13 17:02:26 +01003825 mbedtls_psa_get_random,
Gilles Peskine5894e8e2020-12-14 14:54:06 +01003826 MBEDTLS_PSA_RANDOM_STATE ) );
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003827 }
3828 else
John Durkop0ea39e02020-10-13 19:58:20 -07003829#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003830 {
Gilles Peskinea05219c2018-11-16 16:02:56 +01003831 (void) alg;
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003832 MBEDTLS_MPI_CHK( mbedtls_ecdsa_sign( &ecp->grp, &r, &s, &ecp->d,
3833 hash, hash_length,
Gilles Peskine30524eb2020-11-13 17:02:26 +01003834 mbedtls_psa_get_random,
Gilles Peskine5894e8e2020-12-14 14:54:06 +01003835 MBEDTLS_PSA_RANDOM_STATE ) );
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003836 }
Gilles Peskineeae6eee2018-06-28 13:56:01 +02003837
3838 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &r,
3839 signature,
3840 curve_bytes ) );
3841 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &s,
3842 signature + curve_bytes,
3843 curve_bytes ) );
3844
3845cleanup:
3846 mbedtls_mpi_free( &r );
3847 mbedtls_mpi_free( &s );
3848 if( ret == 0 )
3849 *signature_length = 2 * curve_bytes;
Gilles Peskineeae6eee2018-06-28 13:56:01 +02003850 return( mbedtls_to_psa_error( ret ) );
3851}
3852
3853static psa_status_t psa_ecdsa_verify( mbedtls_ecp_keypair *ecp,
3854 const uint8_t *hash,
3855 size_t hash_length,
3856 const uint8_t *signature,
3857 size_t signature_length )
3858{
Janos Follath24eed8d2019-11-22 13:21:35 +00003859 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskineeae6eee2018-06-28 13:56:01 +02003860 mbedtls_mpi r, s;
3861 size_t curve_bytes = PSA_BITS_TO_BYTES( ecp->grp.pbits );
3862 mbedtls_mpi_init( &r );
3863 mbedtls_mpi_init( &s );
3864
3865 if( signature_length != 2 * curve_bytes )
3866 return( PSA_ERROR_INVALID_SIGNATURE );
3867
3868 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &r,
3869 signature,
3870 curve_bytes ) );
3871 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &s,
3872 signature + curve_bytes,
3873 curve_bytes ) );
3874
Steven Cooremanacda8342020-07-24 23:09:52 +02003875 /* Check whether the public part is loaded. If not, load it. */
3876 if( mbedtls_ecp_is_zero( &ecp->Q ) )
3877 {
3878 MBEDTLS_MPI_CHK(
3879 mbedtls_ecp_mul( &ecp->grp, &ecp->Q, &ecp->d, &ecp->grp.G,
Gilles Peskine5894e8e2020-12-14 14:54:06 +01003880 mbedtls_psa_get_random, MBEDTLS_PSA_RANDOM_STATE ) );
Steven Cooremanacda8342020-07-24 23:09:52 +02003881 }
3882
Gilles Peskineeae6eee2018-06-28 13:56:01 +02003883 ret = mbedtls_ecdsa_verify( &ecp->grp, hash, hash_length,
3884 &ecp->Q, &r, &s );
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003885
3886cleanup:
3887 mbedtls_mpi_free( &r );
3888 mbedtls_mpi_free( &s );
3889 return( mbedtls_to_psa_error( ret ) );
3890}
John Durkop6ba40d12020-11-10 08:50:04 -08003891#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3892 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003893
Ronald Croncf56a0a2020-08-04 09:51:30 +02003894psa_status_t psa_sign_hash( mbedtls_svc_key_id_t key,
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01003895 psa_algorithm_t alg,
3896 const uint8_t *hash,
3897 size_t hash_length,
3898 uint8_t *signature,
3899 size_t signature_size,
3900 size_t *signature_length )
Gilles Peskine20035e32018-02-03 22:44:14 +01003901{
Ronald Cronf95a2b12020-10-22 15:24:49 +02003902 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01003903 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01003904 psa_key_slot_t *slot;
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003905
3906 *signature_length = signature_size;
Gilles Peskine4019f0e2019-09-12 22:05:59 +02003907 /* Immediately reject a zero-length signature buffer. This guarantees
3908 * that signature must be a valid pointer. (On the other hand, the hash
3909 * buffer can in principle be empty since it doesn't actually have
3910 * to be a hash.) */
3911 if( signature_size == 0 )
3912 return( PSA_ERROR_BUFFER_TOO_SMALL );
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003913
Ronald Cron5c522922020-11-14 16:35:34 +01003914 status = psa_get_and_lock_key_slot_with_policy( key, &slot,
3915 PSA_KEY_USAGE_SIGN_HASH,
3916 alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003917 if( status != PSA_SUCCESS )
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003918 goto exit;
Gilles Peskine8e338702019-07-30 20:06:31 +02003919 if( ! PSA_KEY_TYPE_IS_KEY_PAIR( slot->attr.type ) )
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003920 {
3921 status = PSA_ERROR_INVALID_ARGUMENT;
3922 goto exit;
3923 }
Gilles Peskine20035e32018-02-03 22:44:14 +01003924
Steven Cooremancd84cb42020-07-16 20:28:36 +02003925 /* Try any of the available accelerators first */
3926 status = psa_driver_wrapper_sign_hash( slot,
3927 alg,
3928 hash,
3929 hash_length,
3930 signature,
3931 signature_size,
3932 signature_length );
Steven Cooreman8d2bde72020-09-04 13:06:39 +02003933 if( status != PSA_ERROR_NOT_SUPPORTED ||
3934 psa_key_lifetime_is_external( slot->attr.lifetime ) )
Steven Cooremancd84cb42020-07-16 20:28:36 +02003935 goto exit;
3936
Steven Cooreman7a250572020-07-17 16:43:05 +02003937 /* If the operation was not supported by any accelerator, try fallback. */
John Durkop6ba40d12020-11-10 08:50:04 -08003938#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
3939 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
Gilles Peskine8e338702019-07-30 20:06:31 +02003940 if( slot->attr.type == PSA_KEY_TYPE_RSA_KEY_PAIR )
Gilles Peskine20035e32018-02-03 22:44:14 +01003941 {
Steven Cooremana2371e52020-07-28 14:30:39 +02003942 mbedtls_rsa_context *rsa = NULL;
Steven Cooremana01795d2020-07-24 22:48:15 +02003943
Steven Cooreman4fed4552020-08-03 14:46:03 +02003944 status = psa_load_rsa_representation( slot->attr.type,
3945 slot->data.key.data,
Steven Cooreman7f391872020-07-30 14:57:44 +02003946 slot->data.key.bytes,
Steven Cooremana01795d2020-07-24 22:48:15 +02003947 &rsa );
3948 if( status != PSA_SUCCESS )
3949 goto exit;
3950
Steven Cooremana2371e52020-07-28 14:30:39 +02003951 status = psa_rsa_sign( rsa,
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003952 alg,
3953 hash, hash_length,
3954 signature, signature_size,
3955 signature_length );
Steven Cooremana01795d2020-07-24 22:48:15 +02003956
Steven Cooremana2371e52020-07-28 14:30:39 +02003957 mbedtls_rsa_free( rsa );
3958 mbedtls_free( rsa );
Gilles Peskine20035e32018-02-03 22:44:14 +01003959 }
3960 else
John Durkop6ba40d12020-11-10 08:50:04 -08003961#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
3962 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
Gilles Peskine8e338702019-07-30 20:06:31 +02003963 if( PSA_KEY_TYPE_IS_ECC( slot->attr.type ) )
Gilles Peskine20035e32018-02-03 22:44:14 +01003964 {
John Durkop9814fa22020-11-04 12:28:15 -08003965#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3966 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
Gilles Peskinea05219c2018-11-16 16:02:56 +01003967 if(
John Durkop0ea39e02020-10-13 19:58:20 -07003968#if defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
Gilles Peskinea05219c2018-11-16 16:02:56 +01003969 PSA_ALG_IS_ECDSA( alg )
3970#else
3971 PSA_ALG_IS_RANDOMIZED_ECDSA( alg )
3972#endif
3973 )
Steven Cooremanacda8342020-07-24 23:09:52 +02003974 {
Steven Cooremana2371e52020-07-28 14:30:39 +02003975 mbedtls_ecp_keypair *ecp = NULL;
Steven Cooreman4fed4552020-08-03 14:46:03 +02003976 status = psa_load_ecp_representation( slot->attr.type,
3977 slot->data.key.data,
Steven Cooreman7f391872020-07-30 14:57:44 +02003978 slot->data.key.bytes,
Steven Cooreman7f391872020-07-30 14:57:44 +02003979 &ecp );
Steven Cooremanacda8342020-07-24 23:09:52 +02003980 if( status != PSA_SUCCESS )
3981 goto exit;
Steven Cooremana2371e52020-07-28 14:30:39 +02003982 status = psa_ecdsa_sign( ecp,
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003983 alg,
3984 hash, hash_length,
3985 signature, signature_size,
3986 signature_length );
Steven Cooremana2371e52020-07-28 14:30:39 +02003987 mbedtls_ecp_keypair_free( ecp );
3988 mbedtls_free( ecp );
Steven Cooremanacda8342020-07-24 23:09:52 +02003989 }
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003990 else
John Durkop9814fa22020-11-04 12:28:15 -08003991#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3992 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003993 {
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003994 status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea81d85b2018-06-26 16:10:23 +02003995 }
itayzafrir5c753392018-05-08 11:18:38 +03003996 }
3997 else
itayzafrir5c753392018-05-08 11:18:38 +03003998 {
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02003999 status = PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine20035e32018-02-03 22:44:14 +01004000 }
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02004001
4002exit:
4003 /* Fill the unused part of the output buffer (the whole buffer on error,
4004 * the trailing part on success) with something that isn't a valid mac
4005 * (barring an attack on the mac and deliberately-crafted input),
4006 * in case the caller doesn't check the return status properly. */
4007 if( status == PSA_SUCCESS )
4008 memset( signature + *signature_length, '!',
4009 signature_size - *signature_length );
Gilles Peskine4019f0e2019-09-12 22:05:59 +02004010 else
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02004011 memset( signature, '!', signature_size );
Gilles Peskine46f1fd72018-06-28 19:31:31 +02004012 /* If signature_size is 0 then we have nothing to do. We must not call
4013 * memset because signature may be NULL in this case. */
Ronald Cronf95a2b12020-10-22 15:24:49 +02004014
Ronald Cron5c522922020-11-14 16:35:34 +01004015 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02004016
Ronald Cron5c522922020-11-14 16:35:34 +01004017 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
itayzafrir5c753392018-05-08 11:18:38 +03004018}
4019
Ronald Croncf56a0a2020-08-04 09:51:30 +02004020psa_status_t psa_verify_hash( mbedtls_svc_key_id_t key,
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01004021 psa_algorithm_t alg,
4022 const uint8_t *hash,
4023 size_t hash_length,
4024 const uint8_t *signature,
4025 size_t signature_length )
itayzafrir5c753392018-05-08 11:18:38 +03004026{
Ronald Cronf95a2b12020-10-22 15:24:49 +02004027 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01004028 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01004029 psa_key_slot_t *slot;
Gilles Peskine2b450e32018-06-27 15:42:46 +02004030
Ronald Cron5c522922020-11-14 16:35:34 +01004031 status = psa_get_and_lock_key_slot_with_policy( key, &slot,
4032 PSA_KEY_USAGE_VERIFY_HASH,
4033 alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02004034 if( status != PSA_SUCCESS )
4035 return( status );
itayzafrir5c753392018-05-08 11:18:38 +03004036
Steven Cooreman55ae2172020-07-17 19:46:15 +02004037 /* Try any of the available accelerators first */
4038 status = psa_driver_wrapper_verify_hash( slot,
4039 alg,
4040 hash,
4041 hash_length,
4042 signature,
4043 signature_length );
Steven Cooreman8d2bde72020-09-04 13:06:39 +02004044 if( status != PSA_ERROR_NOT_SUPPORTED ||
4045 psa_key_lifetime_is_external( slot->attr.lifetime ) )
Ronald Cronf95a2b12020-10-22 15:24:49 +02004046 goto exit;
Steven Cooreman55ae2172020-07-17 19:46:15 +02004047
John Durkop6ba40d12020-11-10 08:50:04 -08004048#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
4049 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
Gilles Peskine8e338702019-07-30 20:06:31 +02004050 if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004051 {
Steven Cooremana2371e52020-07-28 14:30:39 +02004052 mbedtls_rsa_context *rsa = NULL;
Steven Cooremana01795d2020-07-24 22:48:15 +02004053
Steven Cooreman4fed4552020-08-03 14:46:03 +02004054 status = psa_load_rsa_representation( slot->attr.type,
4055 slot->data.key.data,
Steven Cooreman7f391872020-07-30 14:57:44 +02004056 slot->data.key.bytes,
Steven Cooreman7f391872020-07-30 14:57:44 +02004057 &rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02004058 if( status != PSA_SUCCESS )
Ronald Cronf95a2b12020-10-22 15:24:49 +02004059 goto exit;
Steven Cooremana01795d2020-07-24 22:48:15 +02004060
Steven Cooremana2371e52020-07-28 14:30:39 +02004061 status = psa_rsa_verify( rsa,
Steven Cooremana01795d2020-07-24 22:48:15 +02004062 alg,
4063 hash, hash_length,
4064 signature, signature_length );
Steven Cooremana2371e52020-07-28 14:30:39 +02004065 mbedtls_rsa_free( rsa );
4066 mbedtls_free( rsa );
Ronald Cronf95a2b12020-10-22 15:24:49 +02004067 goto exit;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004068 }
4069 else
John Durkop6ba40d12020-11-10 08:50:04 -08004070#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
4071 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
Gilles Peskine8e338702019-07-30 20:06:31 +02004072 if( PSA_KEY_TYPE_IS_ECC( slot->attr.type ) )
itayzafrir5c753392018-05-08 11:18:38 +03004073 {
John Durkop9814fa22020-11-04 12:28:15 -08004074#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
4075 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
Gilles Peskinea81d85b2018-06-26 16:10:23 +02004076 if( PSA_ALG_IS_ECDSA( alg ) )
Steven Cooremanacda8342020-07-24 23:09:52 +02004077 {
Steven Cooremana2371e52020-07-28 14:30:39 +02004078 mbedtls_ecp_keypair *ecp = NULL;
Steven Cooreman4fed4552020-08-03 14:46:03 +02004079 status = psa_load_ecp_representation( slot->attr.type,
4080 slot->data.key.data,
Steven Cooreman7f391872020-07-30 14:57:44 +02004081 slot->data.key.bytes,
Steven Cooreman7f391872020-07-30 14:57:44 +02004082 &ecp );
Steven Cooremanacda8342020-07-24 23:09:52 +02004083 if( status != PSA_SUCCESS )
Ronald Cronf95a2b12020-10-22 15:24:49 +02004084 goto exit;
Steven Cooremana2371e52020-07-28 14:30:39 +02004085 status = psa_ecdsa_verify( ecp,
Steven Cooremanacda8342020-07-24 23:09:52 +02004086 hash, hash_length,
4087 signature, signature_length );
Steven Cooremana2371e52020-07-28 14:30:39 +02004088 mbedtls_ecp_keypair_free( ecp );
4089 mbedtls_free( ecp );
Ronald Cronf95a2b12020-10-22 15:24:49 +02004090 goto exit;
Steven Cooremanacda8342020-07-24 23:09:52 +02004091 }
Gilles Peskinea81d85b2018-06-26 16:10:23 +02004092 else
John Durkop9814fa22020-11-04 12:28:15 -08004093#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
4094 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Gilles Peskinea81d85b2018-06-26 16:10:23 +02004095 {
Ronald Cronf95a2b12020-10-22 15:24:49 +02004096 status = PSA_ERROR_INVALID_ARGUMENT;
4097 goto exit;
Gilles Peskinea81d85b2018-06-26 16:10:23 +02004098 }
itayzafrir5c753392018-05-08 11:18:38 +03004099 }
Gilles Peskine20035e32018-02-03 22:44:14 +01004100 else
Gilles Peskine20035e32018-02-03 22:44:14 +01004101 {
Ronald Cronf95a2b12020-10-22 15:24:49 +02004102 status = PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine20035e32018-02-03 22:44:14 +01004103 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02004104
4105exit:
Ronald Cron5c522922020-11-14 16:35:34 +01004106 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02004107
Ronald Cron5c522922020-11-14 16:35:34 +01004108 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskine20035e32018-02-03 22:44:14 +01004109}
4110
John Durkop0e005192020-10-31 22:06:54 -07004111#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
Gilles Peskine072ac562018-06-30 00:21:29 +02004112static void psa_rsa_oaep_set_padding_mode( psa_algorithm_t alg,
4113 mbedtls_rsa_context *rsa )
4114{
4115 psa_algorithm_t hash_alg = PSA_ALG_RSA_OAEP_GET_HASH( alg );
4116 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
4117 mbedtls_md_type_t md_alg = mbedtls_md_get_type( md_info );
4118 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
4119}
John Durkop0e005192020-10-31 22:06:54 -07004120#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */
Gilles Peskine072ac562018-06-30 00:21:29 +02004121
Ronald Croncf56a0a2020-08-04 09:51:30 +02004122psa_status_t psa_asymmetric_encrypt( mbedtls_svc_key_id_t key,
Gilles Peskine61b91d42018-06-08 16:09:36 +02004123 psa_algorithm_t alg,
4124 const uint8_t *input,
4125 size_t input_length,
4126 const uint8_t *salt,
4127 size_t salt_length,
4128 uint8_t *output,
4129 size_t output_size,
4130 size_t *output_length )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004131{
Ronald Cronf95a2b12020-10-22 15:24:49 +02004132 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01004133 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01004134 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02004135
Darryl Green5cc689a2018-07-24 15:34:10 +01004136 (void) input;
4137 (void) input_length;
4138 (void) salt;
4139 (void) output;
4140 (void) output_size;
4141
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03004142 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004143
Gilles Peskineb3fc05d2018-06-30 19:04:35 +02004144 if( ! PSA_ALG_IS_RSA_OAEP( alg ) && salt_length != 0 )
4145 return( PSA_ERROR_INVALID_ARGUMENT );
4146
Ronald Cron5c522922020-11-14 16:35:34 +01004147 status = psa_get_and_lock_transparent_key_slot_with_policy(
4148 key, &slot, PSA_KEY_USAGE_ENCRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02004149 if( status != PSA_SUCCESS )
4150 return( status );
Gilles Peskine8e338702019-07-30 20:06:31 +02004151 if( ! ( PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->attr.type ) ||
4152 PSA_KEY_TYPE_IS_KEY_PAIR( slot->attr.type ) ) )
Ronald Cronf95a2b12020-10-22 15:24:49 +02004153 {
4154 status = PSA_ERROR_INVALID_ARGUMENT;
4155 goto exit;
4156 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004157
John Durkop6ba40d12020-11-10 08:50:04 -08004158#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \
4159 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
Gilles Peskine8e338702019-07-30 20:06:31 +02004160 if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004161 {
Steven Cooremana2371e52020-07-28 14:30:39 +02004162 mbedtls_rsa_context *rsa = NULL;
Steven Cooreman4fed4552020-08-03 14:46:03 +02004163 status = psa_load_rsa_representation( slot->attr.type,
4164 slot->data.key.data,
Steven Cooreman7f391872020-07-30 14:57:44 +02004165 slot->data.key.bytes,
Steven Cooreman7f391872020-07-30 14:57:44 +02004166 &rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02004167 if( status != PSA_SUCCESS )
Steven Cooreman4fed4552020-08-03 14:46:03 +02004168 goto rsa_exit;
Steven Cooremana2371e52020-07-28 14:30:39 +02004169
4170 if( output_size < mbedtls_rsa_get_len( rsa ) )
Steven Cooremana01795d2020-07-24 22:48:15 +02004171 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02004172 status = PSA_ERROR_BUFFER_TOO_SMALL;
4173 goto rsa_exit;
Steven Cooremana01795d2020-07-24 22:48:15 +02004174 }
John Durkop0e005192020-10-31 22:06:54 -07004175#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT)
Gilles Peskine6afe7892018-05-31 13:16:08 +02004176 if( alg == PSA_ALG_RSA_PKCS1V15_CRYPT )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004177 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02004178 status = mbedtls_to_psa_error(
4179 mbedtls_rsa_pkcs1_encrypt( rsa,
Gilles Peskine30524eb2020-11-13 17:02:26 +01004180 mbedtls_psa_get_random,
Gilles Peskine5894e8e2020-12-14 14:54:06 +01004181 MBEDTLS_PSA_RANDOM_STATE,
Steven Cooreman4fed4552020-08-03 14:46:03 +02004182 MBEDTLS_RSA_PUBLIC,
4183 input_length,
4184 input,
4185 output ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004186 }
4187 else
John Durkop0e005192020-10-31 22:06:54 -07004188#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT */
4189#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
Gilles Peskine55bf3d12018-06-26 15:53:48 +02004190 if( PSA_ALG_IS_RSA_OAEP( alg ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004191 {
Steven Cooremana2371e52020-07-28 14:30:39 +02004192 psa_rsa_oaep_set_padding_mode( alg, rsa );
Steven Cooreman4fed4552020-08-03 14:46:03 +02004193 status = mbedtls_to_psa_error(
4194 mbedtls_rsa_rsaes_oaep_encrypt( rsa,
Gilles Peskine30524eb2020-11-13 17:02:26 +01004195 mbedtls_psa_get_random,
Gilles Peskine5894e8e2020-12-14 14:54:06 +01004196 MBEDTLS_PSA_RANDOM_STATE,
Steven Cooreman4fed4552020-08-03 14:46:03 +02004197 MBEDTLS_RSA_PUBLIC,
4198 salt, salt_length,
4199 input_length,
4200 input,
4201 output ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004202 }
4203 else
John Durkop0e005192020-10-31 22:06:54 -07004204#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP */
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004205 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02004206 status = PSA_ERROR_INVALID_ARGUMENT;
4207 goto rsa_exit;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004208 }
Steven Cooreman4fed4552020-08-03 14:46:03 +02004209rsa_exit:
4210 if( status == PSA_SUCCESS )
Steven Cooremana2371e52020-07-28 14:30:39 +02004211 *output_length = mbedtls_rsa_get_len( rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02004212
Steven Cooremana2371e52020-07-28 14:30:39 +02004213 mbedtls_rsa_free( rsa );
4214 mbedtls_free( rsa );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004215 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004216 else
John Durkop9814fa22020-11-04 12:28:15 -08004217#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) ||
John Durkop6ba40d12020-11-10 08:50:04 -08004218 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004219 {
Ronald Cronf95a2b12020-10-22 15:24:49 +02004220 status = PSA_ERROR_NOT_SUPPORTED;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004221 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02004222
4223exit:
Ronald Cron5c522922020-11-14 16:35:34 +01004224 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02004225
Ronald Cron5c522922020-11-14 16:35:34 +01004226 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskine5b051bc2018-05-31 13:25:48 +02004227}
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004228
Ronald Croncf56a0a2020-08-04 09:51:30 +02004229psa_status_t psa_asymmetric_decrypt( mbedtls_svc_key_id_t key,
Gilles Peskine61b91d42018-06-08 16:09:36 +02004230 psa_algorithm_t alg,
4231 const uint8_t *input,
4232 size_t input_length,
4233 const uint8_t *salt,
4234 size_t salt_length,
4235 uint8_t *output,
4236 size_t output_size,
4237 size_t *output_length )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004238{
Ronald Cronf95a2b12020-10-22 15:24:49 +02004239 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01004240 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01004241 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02004242
Darryl Green5cc689a2018-07-24 15:34:10 +01004243 (void) input;
4244 (void) input_length;
4245 (void) salt;
4246 (void) output;
4247 (void) output_size;
4248
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03004249 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004250
Gilles Peskineb3fc05d2018-06-30 19:04:35 +02004251 if( ! PSA_ALG_IS_RSA_OAEP( alg ) && salt_length != 0 )
4252 return( PSA_ERROR_INVALID_ARGUMENT );
4253
Ronald Cron5c522922020-11-14 16:35:34 +01004254 status = psa_get_and_lock_transparent_key_slot_with_policy(
4255 key, &slot, PSA_KEY_USAGE_DECRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02004256 if( status != PSA_SUCCESS )
4257 return( status );
Gilles Peskine8e338702019-07-30 20:06:31 +02004258 if( ! PSA_KEY_TYPE_IS_KEY_PAIR( slot->attr.type ) )
Ronald Cronf95a2b12020-10-22 15:24:49 +02004259 {
4260 status = PSA_ERROR_INVALID_ARGUMENT;
4261 goto exit;
4262 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004263
John Durkop6ba40d12020-11-10 08:50:04 -08004264#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \
4265 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
Gilles Peskine8e338702019-07-30 20:06:31 +02004266 if( slot->attr.type == PSA_KEY_TYPE_RSA_KEY_PAIR )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004267 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02004268 mbedtls_rsa_context *rsa = NULL;
4269 status = psa_load_rsa_representation( slot->attr.type,
4270 slot->data.key.data,
Steven Cooreman7f391872020-07-30 14:57:44 +02004271 slot->data.key.bytes,
Steven Cooreman7f391872020-07-30 14:57:44 +02004272 &rsa );
Steven Cooremana01795d2020-07-24 22:48:15 +02004273 if( status != PSA_SUCCESS )
Ronald Cronf95a2b12020-10-22 15:24:49 +02004274 goto exit;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004275
Steven Cooremana2371e52020-07-28 14:30:39 +02004276 if( input_length != mbedtls_rsa_get_len( rsa ) )
Steven Cooremana01795d2020-07-24 22:48:15 +02004277 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02004278 status = PSA_ERROR_INVALID_ARGUMENT;
4279 goto rsa_exit;
Steven Cooremana01795d2020-07-24 22:48:15 +02004280 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004281
John Durkop0e005192020-10-31 22:06:54 -07004282#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT)
Gilles Peskine6afe7892018-05-31 13:16:08 +02004283 if( alg == PSA_ALG_RSA_PKCS1V15_CRYPT )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004284 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02004285 status = mbedtls_to_psa_error(
4286 mbedtls_rsa_pkcs1_decrypt( rsa,
Gilles Peskine30524eb2020-11-13 17:02:26 +01004287 mbedtls_psa_get_random,
Gilles Peskine5894e8e2020-12-14 14:54:06 +01004288 MBEDTLS_PSA_RANDOM_STATE,
Steven Cooreman4fed4552020-08-03 14:46:03 +02004289 MBEDTLS_RSA_PRIVATE,
4290 output_length,
4291 input,
4292 output,
4293 output_size ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004294 }
4295 else
John Durkop0e005192020-10-31 22:06:54 -07004296#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT */
4297#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
Gilles Peskine55bf3d12018-06-26 15:53:48 +02004298 if( PSA_ALG_IS_RSA_OAEP( alg ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004299 {
Steven Cooremana2371e52020-07-28 14:30:39 +02004300 psa_rsa_oaep_set_padding_mode( alg, rsa );
Steven Cooreman4fed4552020-08-03 14:46:03 +02004301 status = mbedtls_to_psa_error(
4302 mbedtls_rsa_rsaes_oaep_decrypt( rsa,
Gilles Peskine30524eb2020-11-13 17:02:26 +01004303 mbedtls_psa_get_random,
Gilles Peskine5894e8e2020-12-14 14:54:06 +01004304 MBEDTLS_PSA_RANDOM_STATE,
Steven Cooreman4fed4552020-08-03 14:46:03 +02004305 MBEDTLS_RSA_PRIVATE,
4306 salt, salt_length,
4307 output_length,
4308 input,
4309 output,
4310 output_size ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004311 }
4312 else
John Durkop0e005192020-10-31 22:06:54 -07004313#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP */
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004314 {
Steven Cooreman4fed4552020-08-03 14:46:03 +02004315 status = PSA_ERROR_INVALID_ARGUMENT;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004316 }
Nir Sonnenschein717a0402018-06-04 16:36:15 +03004317
Steven Cooreman4fed4552020-08-03 14:46:03 +02004318rsa_exit:
Steven Cooremana2371e52020-07-28 14:30:39 +02004319 mbedtls_rsa_free( rsa );
4320 mbedtls_free( rsa );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004321 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004322 else
John Durkop6ba40d12020-11-10 08:50:04 -08004323#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) ||
4324 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004325 {
Ronald Cronf95a2b12020-10-22 15:24:49 +02004326 status = PSA_ERROR_NOT_SUPPORTED;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004327 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02004328
4329exit:
Ronald Cron5c522922020-11-14 16:35:34 +01004330 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02004331
Ronald Cron5c522922020-11-14 16:35:34 +01004332 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskine5b051bc2018-05-31 13:25:48 +02004333}
Gilles Peskine20035e32018-02-03 22:44:14 +01004334
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02004335
4336
mohammad1603503973b2018-03-12 15:59:30 +02004337/****************************************************************/
4338/* Symmetric cryptography */
4339/****************************************************************/
4340
Gilles Peskinee553c652018-06-04 16:22:46 +02004341static psa_status_t psa_cipher_setup( psa_cipher_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02004342 mbedtls_svc_key_id_t key,
Gilles Peskine7e928852018-06-04 16:23:10 +02004343 psa_algorithm_t alg,
4344 mbedtls_operation_t cipher_operation )
mohammad1603503973b2018-03-12 15:59:30 +02004345{
Ronald Cronf95a2b12020-10-22 15:24:49 +02004346 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01004347 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine9ab61b62019-02-25 17:43:14 +01004348 int ret = 0;
Gilles Peskine2f060a82018-12-04 17:12:32 +01004349 psa_key_slot_t *slot;
mohammad1603503973b2018-03-12 15:59:30 +02004350 size_t key_bits;
4351 const mbedtls_cipher_info_t *cipher_info = NULL;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02004352 psa_key_usage_t usage = ( cipher_operation == MBEDTLS_ENCRYPT ?
4353 PSA_KEY_USAGE_ENCRYPT :
4354 PSA_KEY_USAGE_DECRYPT );
mohammad1603503973b2018-03-12 15:59:30 +02004355
Steven Cooremand3feccd2020-09-01 15:56:14 +02004356 /* A context must be freshly initialized before it can be set up. */
4357 if( operation->alg != 0 )
4358 return( PSA_ERROR_BAD_STATE );
4359
Steven Cooremana07b9972020-09-10 14:54:14 +02004360 /* The requested algorithm must be one that can be processed by cipher. */
4361 if( ! PSA_ALG_IS_CIPHER( alg ) )
Steven Cooremana07b9972020-09-10 14:54:14 +02004362 return( PSA_ERROR_INVALID_ARGUMENT );
Steven Cooremand3feccd2020-09-01 15:56:14 +02004363
Steven Cooremanef8575e2020-09-11 11:44:50 +02004364 /* Fetch key material from key storage. */
Ronald Cron5c522922020-11-14 16:35:34 +01004365 status = psa_get_and_lock_key_slot_with_policy( key, &slot, usage, alg );
Steven Cooremanef8575e2020-09-11 11:44:50 +02004366 if( status != PSA_SUCCESS )
4367 goto exit;
4368
4369 /* Initialize the operation struct members, except for alg. The alg member
4370 * is used to indicate to psa_cipher_abort that there are resources to free,
4371 * so we only set it after resources have been allocated/initialized. */
Steven Cooremana07b9972020-09-10 14:54:14 +02004372 operation->key_set = 0;
4373 operation->iv_set = 0;
Steven Cooremanef8575e2020-09-11 11:44:50 +02004374 operation->mbedtls_in_use = 0;
Steven Cooremana07b9972020-09-10 14:54:14 +02004375 operation->iv_size = 0;
4376 operation->block_size = 0;
4377 if( alg == PSA_ALG_ECB_NO_PADDING )
4378 operation->iv_required = 0;
4379 else
4380 operation->iv_required = 1;
4381
Steven Cooremana07b9972020-09-10 14:54:14 +02004382 /* Try doing the operation through a driver before using software fallback. */
Steven Cooreman37941cb2020-07-28 18:49:51 +02004383 if( cipher_operation == MBEDTLS_ENCRYPT )
Steven Cooremanfb81aa52020-09-09 12:01:43 +02004384 status = psa_driver_wrapper_cipher_encrypt_setup( &operation->ctx.driver,
Steven Cooreman37941cb2020-07-28 18:49:51 +02004385 slot,
4386 alg );
4387 else
Steven Cooremanfb81aa52020-09-09 12:01:43 +02004388 status = psa_driver_wrapper_cipher_decrypt_setup( &operation->ctx.driver,
Steven Cooreman37941cb2020-07-28 18:49:51 +02004389 slot,
4390 alg );
4391
Steven Cooremanef8575e2020-09-11 11:44:50 +02004392 if( status == PSA_SUCCESS )
Steven Cooreman6d81f7e2020-09-14 13:14:31 +02004393 {
Steven Cooremanef8575e2020-09-11 11:44:50 +02004394 /* Once the driver context is initialised, it needs to be freed using
4395 * psa_cipher_abort. Indicate this through setting alg. */
4396 operation->alg = alg;
Steven Cooreman6d81f7e2020-09-14 13:14:31 +02004397 }
Steven Cooremanef8575e2020-09-11 11:44:50 +02004398
Steven Cooremand3feccd2020-09-01 15:56:14 +02004399 if( status != PSA_ERROR_NOT_SUPPORTED ||
4400 psa_key_lifetime_is_external( slot->attr.lifetime ) )
4401 goto exit;
4402
Steven Cooremana07b9972020-09-10 14:54:14 +02004403 /* Proceed with initializing an mbed TLS cipher context if no driver is
Steven Cooremand3feccd2020-09-01 15:56:14 +02004404 * available for the given algorithm & key. */
4405 mbedtls_cipher_init( &operation->ctx.cipher );
mohammad1603503973b2018-03-12 15:59:30 +02004406
Steven Cooremana07b9972020-09-10 14:54:14 +02004407 /* Once the cipher context is initialised, it needs to be freed using
Steven Cooremanef8575e2020-09-11 11:44:50 +02004408 * psa_cipher_abort. Indicate there is something to be freed through setting
4409 * alg, and indicate the operation is being done using mbedtls crypto through
4410 * setting mbedtls_in_use. */
Steven Cooremana07b9972020-09-10 14:54:14 +02004411 operation->alg = alg;
Steven Cooremanef8575e2020-09-11 11:44:50 +02004412 operation->mbedtls_in_use = 1;
Steven Cooremana07b9972020-09-10 14:54:14 +02004413
Gilles Peskinedb4b3ab2019-04-18 12:53:01 +02004414 key_bits = psa_get_key_slot_bits( slot );
Gilles Peskine8e338702019-07-30 20:06:31 +02004415 cipher_info = mbedtls_cipher_info_from_psa( alg, slot->attr.type, key_bits, NULL );
mohammad1603503973b2018-03-12 15:59:30 +02004416 if( cipher_info == NULL )
Gilles Peskine9ab61b62019-02-25 17:43:14 +01004417 {
4418 status = PSA_ERROR_NOT_SUPPORTED;
4419 goto exit;
4420 }
mohammad1603503973b2018-03-12 15:59:30 +02004421
mohammad1603503973b2018-03-12 15:59:30 +02004422 ret = mbedtls_cipher_setup( &operation->ctx.cipher, cipher_info );
Moran Peker41deec42018-04-04 15:43:05 +03004423 if( ret != 0 )
Gilles Peskine9ab61b62019-02-25 17:43:14 +01004424 goto exit;
mohammad1603503973b2018-03-12 15:59:30 +02004425
Gilles Peskine9ad29e22018-06-21 09:40:04 +02004426#if defined(MBEDTLS_DES_C)
Gilles Peskine8e338702019-07-30 20:06:31 +02004427 if( slot->attr.type == PSA_KEY_TYPE_DES && key_bits == 128 )
Gilles Peskine9ad29e22018-06-21 09:40:04 +02004428 {
4429 /* Two-key Triple-DES is 3-key Triple-DES with K1=K3 */
Gilles Peskinec11c4dc2019-07-15 11:06:38 +02004430 uint8_t keys[24];
Steven Cooreman71fd80d2020-07-07 21:12:27 +02004431 memcpy( keys, slot->data.key.data, 16 );
4432 memcpy( keys + 16, slot->data.key.data, 8 );
Gilles Peskine9ad29e22018-06-21 09:40:04 +02004433 ret = mbedtls_cipher_setkey( &operation->ctx.cipher,
4434 keys,
4435 192, cipher_operation );
4436 }
4437 else
4438#endif
4439 {
4440 ret = mbedtls_cipher_setkey( &operation->ctx.cipher,
Steven Cooreman71fd80d2020-07-07 21:12:27 +02004441 slot->data.key.data,
Jaeden Amero23bbb752018-06-26 14:16:54 +01004442 (int) key_bits, cipher_operation );
Gilles Peskine9ad29e22018-06-21 09:40:04 +02004443 }
Moran Peker41deec42018-04-04 15:43:05 +03004444 if( ret != 0 )
Gilles Peskine9ab61b62019-02-25 17:43:14 +01004445 goto exit;
mohammad1603503973b2018-03-12 15:59:30 +02004446
mohammad16038481e742018-03-18 13:57:31 +02004447#if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING)
Gilles Peskinedaea26f2018-08-21 14:02:45 +02004448 switch( alg )
mohammad16038481e742018-03-18 13:57:31 +02004449 {
Gilles Peskinedaea26f2018-08-21 14:02:45 +02004450 case PSA_ALG_CBC_NO_PADDING:
4451 ret = mbedtls_cipher_set_padding_mode( &operation->ctx.cipher,
4452 MBEDTLS_PADDING_NONE );
4453 break;
4454 case PSA_ALG_CBC_PKCS7:
4455 ret = mbedtls_cipher_set_padding_mode( &operation->ctx.cipher,
4456 MBEDTLS_PADDING_PKCS7 );
4457 break;
4458 default:
4459 /* The algorithm doesn't involve padding. */
4460 ret = 0;
4461 break;
4462 }
4463 if( ret != 0 )
Gilles Peskine9ab61b62019-02-25 17:43:14 +01004464 goto exit;
mohammad16038481e742018-03-18 13:57:31 +02004465#endif //MBEDTLS_CIPHER_MODE_WITH_PADDING
4466
Gilles Peskinedaea26f2018-08-21 14:02:45 +02004467 operation->block_size = ( PSA_ALG_IS_STREAM_CIPHER( alg ) ? 1 :
Gilles Peskine8e338702019-07-30 20:06:31 +02004468 PSA_BLOCK_CIPHER_BLOCK_SIZE( slot->attr.type ) );
Steven Cooremana6033e92020-08-25 11:47:50 +02004469 if( ( alg & PSA_ALG_CIPHER_FROM_BLOCK_FLAG ) != 0 &&
4470 alg != PSA_ALG_ECB_NO_PADDING )
mohammad16038481e742018-03-18 13:57:31 +02004471 {
Gilles Peskine8e338702019-07-30 20:06:31 +02004472 operation->iv_size = PSA_BLOCK_CIPHER_BLOCK_SIZE( slot->attr.type );
mohammad16038481e742018-03-18 13:57:31 +02004473 }
Gilles Peskine26869f22019-05-06 15:25:00 +02004474#if defined(MBEDTLS_CHACHA20_C)
4475 else
Bence Szépkúticbe39532020-12-08 00:01:31 +01004476 if( alg == PSA_ALG_STREAM_CIPHER && slot->attr.type == PSA_KEY_TYPE_CHACHA20 )
Gilles Peskine26869f22019-05-06 15:25:00 +02004477 operation->iv_size = 12;
4478#endif
mohammad1603503973b2018-03-12 15:59:30 +02004479
Steven Cooreman7df02922020-09-09 15:28:49 +02004480 status = PSA_SUCCESS;
4481
Gilles Peskine9ab61b62019-02-25 17:43:14 +01004482exit:
Steven Cooreman7df02922020-09-09 15:28:49 +02004483 if( ret != 0 )
Gilles Peskine9ab61b62019-02-25 17:43:14 +01004484 status = mbedtls_to_psa_error( ret );
Steven Cooreman7df02922020-09-09 15:28:49 +02004485 if( status == PSA_SUCCESS )
4486 {
4487 /* Update operation flags for both driver and software implementations */
4488 operation->key_set = 1;
4489 }
4490 else
Gilles Peskine9ab61b62019-02-25 17:43:14 +01004491 psa_cipher_abort( operation );
Ronald Cronf95a2b12020-10-22 15:24:49 +02004492
Ronald Cron5c522922020-11-14 16:35:34 +01004493 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02004494
Ronald Cron5c522922020-11-14 16:35:34 +01004495 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
mohammad1603503973b2018-03-12 15:59:30 +02004496}
4497
Gilles Peskinefe119512018-07-08 21:39:34 +02004498psa_status_t psa_cipher_encrypt_setup( psa_cipher_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02004499 mbedtls_svc_key_id_t key,
Gilles Peskinefe119512018-07-08 21:39:34 +02004500 psa_algorithm_t alg )
mohammad16038481e742018-03-18 13:57:31 +02004501{
Ronald Croncf56a0a2020-08-04 09:51:30 +02004502 return( psa_cipher_setup( operation, key, alg, MBEDTLS_ENCRYPT ) );
mohammad16038481e742018-03-18 13:57:31 +02004503}
4504
Gilles Peskinefe119512018-07-08 21:39:34 +02004505psa_status_t psa_cipher_decrypt_setup( psa_cipher_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02004506 mbedtls_svc_key_id_t key,
Gilles Peskinefe119512018-07-08 21:39:34 +02004507 psa_algorithm_t alg )
mohammad16038481e742018-03-18 13:57:31 +02004508{
Ronald Croncf56a0a2020-08-04 09:51:30 +02004509 return( psa_cipher_setup( operation, key, alg, MBEDTLS_DECRYPT ) );
mohammad16038481e742018-03-18 13:57:31 +02004510}
4511
Gilles Peskinefe119512018-07-08 21:39:34 +02004512psa_status_t psa_cipher_generate_iv( psa_cipher_operation_t *operation,
Andrew Thoelke163639b2019-05-15 12:33:23 +01004513 uint8_t *iv,
Gilles Peskinefe119512018-07-08 21:39:34 +02004514 size_t iv_size,
4515 size_t *iv_length )
mohammad1603503973b2018-03-12 15:59:30 +02004516{
itayzafrir534bd7c2018-08-02 13:56:32 +03004517 psa_status_t status;
Janos Follath24eed8d2019-11-22 13:21:35 +00004518 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Steven Cooreman7df02922020-09-09 15:28:49 +02004519 if( operation->iv_set || ! operation->iv_required )
4520 {
4521 return( PSA_ERROR_BAD_STATE );
4522 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004523
Steven Cooremanef8575e2020-09-11 11:44:50 +02004524 if( operation->mbedtls_in_use == 0 )
Steven Cooreman8b122252020-09-03 15:30:32 +02004525 {
Steven Cooremanfb81aa52020-09-09 12:01:43 +02004526 status = psa_driver_wrapper_cipher_generate_iv( &operation->ctx.driver,
Steven Cooreman8b122252020-09-03 15:30:32 +02004527 iv,
4528 iv_size,
4529 iv_length );
4530 goto exit;
4531 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004532
Moran Peker41deec42018-04-04 15:43:05 +03004533 if( iv_size < operation->iv_size )
mohammad1603503973b2018-03-12 15:59:30 +02004534 {
itayzafrir534bd7c2018-08-02 13:56:32 +03004535 status = PSA_ERROR_BUFFER_TOO_SMALL;
Moran Peker41deec42018-04-04 15:43:05 +03004536 goto exit;
4537 }
Gilles Peskine5894e8e2020-12-14 14:54:06 +01004538 ret = mbedtls_psa_get_random( MBEDTLS_PSA_RANDOM_STATE,
Gilles Peskine30524eb2020-11-13 17:02:26 +01004539 iv, operation->iv_size );
Moran Peker41deec42018-04-04 15:43:05 +03004540 if( ret != 0 )
4541 {
itayzafrir534bd7c2018-08-02 13:56:32 +03004542 status = mbedtls_to_psa_error( ret );
Gilles Peskinee553c652018-06-04 16:22:46 +02004543 goto exit;
mohammad1603503973b2018-03-12 15:59:30 +02004544 }
Gilles Peskinee553c652018-06-04 16:22:46 +02004545
mohammad16038481e742018-03-18 13:57:31 +02004546 *iv_length = operation->iv_size;
itayzafrir534bd7c2018-08-02 13:56:32 +03004547 status = psa_cipher_set_iv( operation, iv, *iv_length );
Moran Peker41deec42018-04-04 15:43:05 +03004548
Moran Peker395db872018-05-31 14:07:14 +03004549exit:
Steven Cooreman7df02922020-09-09 15:28:49 +02004550 if( status == PSA_SUCCESS )
4551 operation->iv_set = 1;
4552 else
Moran Peker395db872018-05-31 14:07:14 +03004553 psa_cipher_abort( operation );
itayzafrir534bd7c2018-08-02 13:56:32 +03004554 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02004555}
4556
Gilles Peskinefe119512018-07-08 21:39:34 +02004557psa_status_t psa_cipher_set_iv( psa_cipher_operation_t *operation,
Andrew Thoelke163639b2019-05-15 12:33:23 +01004558 const uint8_t *iv,
Gilles Peskinefe119512018-07-08 21:39:34 +02004559 size_t iv_length )
mohammad1603503973b2018-03-12 15:59:30 +02004560{
itayzafrir534bd7c2018-08-02 13:56:32 +03004561 psa_status_t status;
Janos Follath24eed8d2019-11-22 13:21:35 +00004562 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Steven Cooreman7df02922020-09-09 15:28:49 +02004563 if( operation->iv_set || ! operation->iv_required )
4564 {
4565 return( PSA_ERROR_BAD_STATE );
4566 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004567
Steven Cooremanef8575e2020-09-11 11:44:50 +02004568 if( operation->mbedtls_in_use == 0 )
Steven Cooreman8b122252020-09-03 15:30:32 +02004569 {
Steven Cooremanfb81aa52020-09-09 12:01:43 +02004570 status = psa_driver_wrapper_cipher_set_iv( &operation->ctx.driver,
Steven Cooreman8b122252020-09-03 15:30:32 +02004571 iv,
4572 iv_length );
4573 goto exit;
4574 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004575
Moran Pekera28258c2018-05-29 16:25:04 +03004576 if( iv_length != operation->iv_size )
Moran Peker71f19ae2018-04-22 20:23:16 +03004577 {
itayzafrir534bd7c2018-08-02 13:56:32 +03004578 status = PSA_ERROR_INVALID_ARGUMENT;
4579 goto exit;
Moran Peker71f19ae2018-04-22 20:23:16 +03004580 }
itayzafrir534bd7c2018-08-02 13:56:32 +03004581 ret = mbedtls_cipher_set_iv( &operation->ctx.cipher, iv, iv_length );
4582 status = mbedtls_to_psa_error( ret );
4583exit:
4584 if( status == PSA_SUCCESS )
4585 operation->iv_set = 1;
4586 else
mohammad1603503973b2018-03-12 15:59:30 +02004587 psa_cipher_abort( operation );
itayzafrir534bd7c2018-08-02 13:56:32 +03004588 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02004589}
4590
Steven Cooreman177deba2020-09-07 17:14:14 +02004591/* Process input for which the algorithm is set to ECB mode. This requires
4592 * manual processing, since the PSA API is defined as being able to process
4593 * arbitrary-length calls to psa_cipher_update() with ECB mode, but the
4594 * underlying mbedtls_cipher_update only takes full blocks. */
4595static psa_status_t psa_cipher_update_ecb_internal(
4596 mbedtls_cipher_context_t *ctx,
4597 const uint8_t *input,
4598 size_t input_length,
4599 uint8_t *output,
4600 size_t output_size,
4601 size_t *output_length )
4602{
4603 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4604 size_t block_size = ctx->cipher_info->block_size;
4605 size_t internal_output_length = 0;
4606 *output_length = 0;
4607
4608 if( input_length == 0 )
4609 {
4610 status = PSA_SUCCESS;
4611 goto exit;
4612 }
4613
4614 if( ctx->unprocessed_len > 0 )
4615 {
4616 /* Fill up to block size, and run the block if there's a full one. */
4617 size_t bytes_to_copy = block_size - ctx->unprocessed_len;
4618
4619 if( input_length < bytes_to_copy )
4620 bytes_to_copy = input_length;
4621
4622 memcpy( &( ctx->unprocessed_data[ctx->unprocessed_len] ),
4623 input, bytes_to_copy );
4624 input_length -= bytes_to_copy;
4625 input += bytes_to_copy;
4626 ctx->unprocessed_len += bytes_to_copy;
4627
4628 if( ctx->unprocessed_len == block_size )
4629 {
4630 status = mbedtls_to_psa_error(
4631 mbedtls_cipher_update( ctx,
4632 ctx->unprocessed_data,
4633 block_size,
4634 output, &internal_output_length ) );
4635
4636 if( status != PSA_SUCCESS )
4637 goto exit;
4638
4639 output += internal_output_length;
4640 output_size -= internal_output_length;
4641 *output_length += internal_output_length;
4642 ctx->unprocessed_len = 0;
4643 }
4644 }
4645
4646 while( input_length >= block_size )
4647 {
4648 /* Run all full blocks we have, one by one */
4649 status = mbedtls_to_psa_error(
4650 mbedtls_cipher_update( ctx, input,
4651 block_size,
4652 output, &internal_output_length ) );
4653
4654 if( status != PSA_SUCCESS )
4655 goto exit;
4656
4657 input_length -= block_size;
4658 input += block_size;
4659
4660 output += internal_output_length;
4661 output_size -= internal_output_length;
4662 *output_length += internal_output_length;
4663 }
4664
4665 if( input_length > 0 )
4666 {
4667 /* Save unprocessed bytes for later processing */
4668 memcpy( &( ctx->unprocessed_data[ctx->unprocessed_len] ),
4669 input, input_length );
4670 ctx->unprocessed_len += input_length;
4671 }
4672
4673 status = PSA_SUCCESS;
4674
4675exit:
4676 return( status );
4677}
4678
Gilles Peskinee553c652018-06-04 16:22:46 +02004679psa_status_t psa_cipher_update( psa_cipher_operation_t *operation,
4680 const uint8_t *input,
4681 size_t input_length,
Andrew Thoelke163639b2019-05-15 12:33:23 +01004682 uint8_t *output,
Gilles Peskinee553c652018-06-04 16:22:46 +02004683 size_t output_size,
4684 size_t *output_length )
mohammad1603503973b2018-03-12 15:59:30 +02004685{
Steven Cooremanffecb7b2020-08-25 15:13:13 +02004686 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine89d789c2018-06-04 17:17:16 +02004687 size_t expected_output_size;
Steven Cooreman7df02922020-09-09 15:28:49 +02004688 if( operation->alg == 0 )
4689 {
4690 return( PSA_ERROR_BAD_STATE );
4691 }
4692 if( operation->iv_required && ! operation->iv_set )
4693 {
4694 return( PSA_ERROR_BAD_STATE );
4695 }
Jaeden Ameroab439972019-02-15 14:12:05 +00004696
Steven Cooremanef8575e2020-09-11 11:44:50 +02004697 if( operation->mbedtls_in_use == 0 )
Steven Cooreman8b122252020-09-03 15:30:32 +02004698 {
Steven Cooremanfb81aa52020-09-09 12:01:43 +02004699 status = psa_driver_wrapper_cipher_update( &operation->ctx.driver,
Steven Cooreman8b122252020-09-03 15:30:32 +02004700 input,
4701 input_length,
4702 output,
4703 output_size,
4704 output_length );
4705 goto exit;
4706 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004707
Gilles Peskinedaea26f2018-08-21 14:02:45 +02004708 if( ! PSA_ALG_IS_STREAM_CIPHER( operation->alg ) )
Gilles Peskine89d789c2018-06-04 17:17:16 +02004709 {
4710 /* Take the unprocessed partial block left over from previous
4711 * update calls, if any, plus the input to this call. Remove
4712 * the last partial block, if any. You get the data that will be
4713 * output in this call. */
4714 expected_output_size =
4715 ( operation->ctx.cipher.unprocessed_len + input_length )
4716 / operation->block_size * operation->block_size;
4717 }
4718 else
4719 {
4720 expected_output_size = input_length;
4721 }
itayzafrir534bd7c2018-08-02 13:56:32 +03004722
Gilles Peskine89d789c2018-06-04 17:17:16 +02004723 if( output_size < expected_output_size )
itayzafrir534bd7c2018-08-02 13:56:32 +03004724 {
4725 status = PSA_ERROR_BUFFER_TOO_SMALL;
4726 goto exit;
4727 }
mohammad160382759612018-03-12 18:16:40 +02004728
Steven Cooremanffecb7b2020-08-25 15:13:13 +02004729 if( operation->alg == PSA_ALG_ECB_NO_PADDING )
4730 {
4731 /* mbedtls_cipher_update has an API inconsistency: it will only
4732 * process a single block at a time in ECB mode. Abstract away that
4733 * inconsistency here to match the PSA API behaviour. */
Steven Cooreman177deba2020-09-07 17:14:14 +02004734 status = psa_cipher_update_ecb_internal( &operation->ctx.cipher,
4735 input,
4736 input_length,
4737 output,
4738 output_size,
4739 output_length );
Steven Cooremanffecb7b2020-08-25 15:13:13 +02004740 }
4741 else
4742 {
4743 status = mbedtls_to_psa_error(
4744 mbedtls_cipher_update( &operation->ctx.cipher, input,
4745 input_length, output, output_length ) );
4746 }
itayzafrir534bd7c2018-08-02 13:56:32 +03004747exit:
4748 if( status != PSA_SUCCESS )
mohammad1603503973b2018-03-12 15:59:30 +02004749 psa_cipher_abort( operation );
itayzafrir534bd7c2018-08-02 13:56:32 +03004750 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02004751}
4752
Gilles Peskinee553c652018-06-04 16:22:46 +02004753psa_status_t psa_cipher_finish( psa_cipher_operation_t *operation,
4754 uint8_t *output,
4755 size_t output_size,
4756 size_t *output_length )
mohammad1603503973b2018-03-12 15:59:30 +02004757{
David Saadab4ecc272019-02-14 13:48:10 +02004758 psa_status_t status = PSA_ERROR_GENERIC_ERROR;
Gilles Peskinee553c652018-06-04 16:22:46 +02004759 uint8_t temp_output_buffer[MBEDTLS_MAX_BLOCK_LENGTH];
Steven Cooreman7df02922020-09-09 15:28:49 +02004760 if( operation->alg == 0 )
4761 {
4762 return( PSA_ERROR_BAD_STATE );
4763 }
4764 if( operation->iv_required && ! operation->iv_set )
4765 {
4766 return( PSA_ERROR_BAD_STATE );
4767 }
Moran Pekerbed71a22018-04-22 20:19:20 +03004768
Steven Cooremanef8575e2020-09-11 11:44:50 +02004769 if( operation->mbedtls_in_use == 0 )
Steven Cooreman8b122252020-09-03 15:30:32 +02004770 {
Steven Cooremanfb81aa52020-09-09 12:01:43 +02004771 status = psa_driver_wrapper_cipher_finish( &operation->ctx.driver,
Steven Cooreman8b122252020-09-03 15:30:32 +02004772 output,
4773 output_size,
4774 output_length );
Steven Cooremanef8575e2020-09-11 11:44:50 +02004775 goto exit;
Steven Cooreman8b122252020-09-03 15:30:32 +02004776 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004777
Steven Cooremaned3c9ec2020-07-06 14:08:59 +02004778 if( operation->ctx.cipher.unprocessed_len != 0 )
Moran Peker7cb22b82018-06-05 11:40:02 +03004779 {
Steven Cooremaned3c9ec2020-07-06 14:08:59 +02004780 if( operation->alg == PSA_ALG_ECB_NO_PADDING ||
Fredrik Strupef90e3012020-09-28 16:11:33 +02004781 operation->alg == PSA_ALG_CBC_NO_PADDING )
Steven Cooremana6033e92020-08-25 11:47:50 +02004782 {
Gilles Peskinedaea26f2018-08-21 14:02:45 +02004783 status = PSA_ERROR_INVALID_ARGUMENT;
Steven Cooremanef8575e2020-09-11 11:44:50 +02004784 goto exit;
Steven Cooremaned3c9ec2020-07-06 14:08:59 +02004785 }
Moran Pekerdc38ebc2018-04-30 15:45:34 +03004786 }
4787
Steven Cooremanef8575e2020-09-11 11:44:50 +02004788 status = mbedtls_to_psa_error(
4789 mbedtls_cipher_finish( &operation->ctx.cipher,
4790 temp_output_buffer,
4791 output_length ) );
4792 if( status != PSA_SUCCESS )
4793 goto exit;
Janos Follath315b51c2018-07-09 16:04:51 +01004794
Gilles Peskine46f1fd72018-06-28 19:31:31 +02004795 if( *output_length == 0 )
Janos Follath315b51c2018-07-09 16:04:51 +01004796 ; /* Nothing to copy. Note that output may be NULL in this case. */
Gilles Peskine46f1fd72018-06-28 19:31:31 +02004797 else if( output_size >= *output_length )
Moran Pekerdc38ebc2018-04-30 15:45:34 +03004798 memcpy( output, temp_output_buffer, *output_length );
4799 else
Janos Follath315b51c2018-07-09 16:04:51 +01004800 status = PSA_ERROR_BUFFER_TOO_SMALL;
mohammad1603503973b2018-03-12 15:59:30 +02004801
Steven Cooremanef8575e2020-09-11 11:44:50 +02004802exit:
4803 if( operation->mbedtls_in_use == 1 )
4804 mbedtls_platform_zeroize( temp_output_buffer, sizeof( temp_output_buffer ) );
Janos Follath315b51c2018-07-09 16:04:51 +01004805
Steven Cooremanef8575e2020-09-11 11:44:50 +02004806 if( status == PSA_SUCCESS )
4807 return( psa_cipher_abort( operation ) );
4808 else
4809 {
4810 *output_length = 0;
Steven Cooremanef8575e2020-09-11 11:44:50 +02004811 (void) psa_cipher_abort( operation );
Janos Follath315b51c2018-07-09 16:04:51 +01004812
Steven Cooremanef8575e2020-09-11 11:44:50 +02004813 return( status );
4814 }
mohammad1603503973b2018-03-12 15:59:30 +02004815}
4816
Gilles Peskinee553c652018-06-04 16:22:46 +02004817psa_status_t psa_cipher_abort( psa_cipher_operation_t *operation )
4818{
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02004819 if( operation->alg == 0 )
Gilles Peskine81736312018-06-26 15:04:31 +02004820 {
Steven Cooremana07b9972020-09-10 14:54:14 +02004821 /* The object has (apparently) been initialized but it is not (yet)
Gilles Peskine81736312018-06-26 15:04:31 +02004822 * in use. It's ok to call abort on such an object, and there's
4823 * nothing to do. */
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02004824 return( PSA_SUCCESS );
Gilles Peskine81736312018-06-26 15:04:31 +02004825 }
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02004826
Gilles Peskinef9c2c092018-06-21 16:57:07 +02004827 /* Sanity check (shouldn't happen: operation->alg should
4828 * always have been initialized to a valid value). */
4829 if( ! PSA_ALG_IS_CIPHER( operation->alg ) )
4830 return( PSA_ERROR_BAD_STATE );
4831
Steven Cooremanef8575e2020-09-11 11:44:50 +02004832 if( operation->mbedtls_in_use == 0 )
Steven Cooremanfb81aa52020-09-09 12:01:43 +02004833 psa_driver_wrapper_cipher_abort( &operation->ctx.driver );
Steven Cooremand3feccd2020-09-01 15:56:14 +02004834 else
4835 mbedtls_cipher_free( &operation->ctx.cipher );
Gilles Peskinee553c652018-06-04 16:22:46 +02004836
Moran Peker41deec42018-04-04 15:43:05 +03004837 operation->alg = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03004838 operation->key_set = 0;
4839 operation->iv_set = 0;
Steven Cooremanef8575e2020-09-11 11:44:50 +02004840 operation->mbedtls_in_use = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03004841 operation->iv_size = 0;
Moran Peker41deec42018-04-04 15:43:05 +03004842 operation->block_size = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03004843 operation->iv_required = 0;
Moran Peker41deec42018-04-04 15:43:05 +03004844
Moran Peker395db872018-05-31 14:07:14 +03004845 return( PSA_SUCCESS );
mohammad1603503973b2018-03-12 15:59:30 +02004846}
4847
Gilles Peskinea0655c32018-04-30 17:06:50 +02004848
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02004849
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02004850
mohammad16035955c982018-04-26 00:53:03 +03004851/****************************************************************/
4852/* AEAD */
4853/****************************************************************/
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02004854
Gilles Peskineedf9a652018-08-17 18:11:56 +02004855typedef struct
4856{
Gilles Peskine2f060a82018-12-04 17:12:32 +01004857 psa_key_slot_t *slot;
Gilles Peskineedf9a652018-08-17 18:11:56 +02004858 const mbedtls_cipher_info_t *cipher_info;
4859 union
4860 {
Ronald Cronf95a2b12020-10-22 15:24:49 +02004861 unsigned dummy; /* Make the union non-empty even with no supported algorithms. */
Gilles Peskineedf9a652018-08-17 18:11:56 +02004862#if defined(MBEDTLS_CCM_C)
4863 mbedtls_ccm_context ccm;
4864#endif /* MBEDTLS_CCM_C */
4865#if defined(MBEDTLS_GCM_C)
4866 mbedtls_gcm_context gcm;
4867#endif /* MBEDTLS_GCM_C */
Gilles Peskine26869f22019-05-06 15:25:00 +02004868#if defined(MBEDTLS_CHACHAPOLY_C)
4869 mbedtls_chachapoly_context chachapoly;
4870#endif /* MBEDTLS_CHACHAPOLY_C */
Gilles Peskineedf9a652018-08-17 18:11:56 +02004871 } ctx;
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02004872 psa_algorithm_t core_alg;
4873 uint8_t full_tag_length;
Gilles Peskineedf9a652018-08-17 18:11:56 +02004874 uint8_t tag_length;
4875} aead_operation_t;
4876
Ronald Cronf95a2b12020-10-22 15:24:49 +02004877#define AEAD_OPERATION_INIT {0, 0, {0}, 0, 0, 0}
4878
Gilles Peskine30a9e412019-01-14 18:36:12 +01004879static void psa_aead_abort_internal( aead_operation_t *operation )
Gilles Peskineedf9a652018-08-17 18:11:56 +02004880{
Gilles Peskinef8a8fe62018-08-21 16:38:05 +02004881 switch( operation->core_alg )
Gilles Peskineedf9a652018-08-17 18:11:56 +02004882 {
4883#if defined(MBEDTLS_CCM_C)
4884 case PSA_ALG_CCM:
4885 mbedtls_ccm_free( &operation->ctx.ccm );
4886 break;
4887#endif /* MBEDTLS_CCM_C */
Gilles Peskineb0b189f2018-11-28 17:30:58 +01004888#if defined(MBEDTLS_GCM_C)
Gilles Peskineedf9a652018-08-17 18:11:56 +02004889 case PSA_ALG_GCM:
4890 mbedtls_gcm_free( &operation->ctx.gcm );
4891 break;
4892#endif /* MBEDTLS_GCM_C */
4893 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02004894
Ronald Cron5c522922020-11-14 16:35:34 +01004895 psa_unlock_key_slot( operation->slot );
Gilles Peskineedf9a652018-08-17 18:11:56 +02004896}
4897
4898static psa_status_t psa_aead_setup( aead_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02004899 mbedtls_svc_key_id_t key,
Gilles Peskineedf9a652018-08-17 18:11:56 +02004900 psa_key_usage_t usage,
4901 psa_algorithm_t alg )
4902{
4903 psa_status_t status;
4904 size_t key_bits;
4905 mbedtls_cipher_id_t cipher_id;
4906
Ronald Cron5c522922020-11-14 16:35:34 +01004907 status = psa_get_and_lock_transparent_key_slot_with_policy(
4908 key, &operation->slot, usage, alg );
Gilles Peskineedf9a652018-08-17 18:11:56 +02004909 if( status != PSA_SUCCESS )
4910 return( status );
4911
Gilles Peskinedb4b3ab2019-04-18 12:53:01 +02004912 key_bits = psa_get_key_slot_bits( operation->slot );
Gilles Peskineedf9a652018-08-17 18:11:56 +02004913
4914 operation->cipher_info =
Gilles Peskine8e338702019-07-30 20:06:31 +02004915 mbedtls_cipher_info_from_psa( alg, operation->slot->attr.type, key_bits,
Gilles Peskineedf9a652018-08-17 18:11:56 +02004916 &cipher_id );
4917 if( operation->cipher_info == NULL )
Ronald Cronf95a2b12020-10-22 15:24:49 +02004918 {
4919 status = PSA_ERROR_NOT_SUPPORTED;
4920 goto cleanup;
4921 }
Gilles Peskineedf9a652018-08-17 18:11:56 +02004922
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02004923 switch( PSA_ALG_AEAD_WITH_TAG_LENGTH( alg, 0 ) )
Gilles Peskineedf9a652018-08-17 18:11:56 +02004924 {
4925#if defined(MBEDTLS_CCM_C)
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02004926 case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_CCM, 0 ):
4927 operation->core_alg = PSA_ALG_CCM;
4928 operation->full_tag_length = 16;
Gilles Peskinef7e7b012019-05-06 15:27:16 +02004929 /* CCM allows the following tag lengths: 4, 6, 8, 10, 12, 14, 16.
4930 * The call to mbedtls_ccm_encrypt_and_tag or
4931 * mbedtls_ccm_auth_decrypt will validate the tag length. */
Gilles Peskine8e338702019-07-30 20:06:31 +02004932 if( PSA_BLOCK_CIPHER_BLOCK_SIZE( operation->slot->attr.type ) != 16 )
Ronald Cronf95a2b12020-10-22 15:24:49 +02004933 {
4934 status = PSA_ERROR_INVALID_ARGUMENT;
4935 goto cleanup;
4936 }
Gilles Peskineedf9a652018-08-17 18:11:56 +02004937 mbedtls_ccm_init( &operation->ctx.ccm );
4938 status = mbedtls_to_psa_error(
4939 mbedtls_ccm_setkey( &operation->ctx.ccm, cipher_id,
Steven Cooreman71fd80d2020-07-07 21:12:27 +02004940 operation->slot->data.key.data,
Gilles Peskineedf9a652018-08-17 18:11:56 +02004941 (unsigned int) key_bits ) );
4942 if( status != 0 )
4943 goto cleanup;
4944 break;
4945#endif /* MBEDTLS_CCM_C */
4946
4947#if defined(MBEDTLS_GCM_C)
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02004948 case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_GCM, 0 ):
4949 operation->core_alg = PSA_ALG_GCM;
4950 operation->full_tag_length = 16;
Gilles Peskinef7e7b012019-05-06 15:27:16 +02004951 /* GCM allows the following tag lengths: 4, 8, 12, 13, 14, 15, 16.
4952 * The call to mbedtls_gcm_crypt_and_tag or
4953 * mbedtls_gcm_auth_decrypt will validate the tag length. */
Gilles Peskine8e338702019-07-30 20:06:31 +02004954 if( PSA_BLOCK_CIPHER_BLOCK_SIZE( operation->slot->attr.type ) != 16 )
Ronald Cronf95a2b12020-10-22 15:24:49 +02004955 {
4956 status = PSA_ERROR_INVALID_ARGUMENT;
4957 goto cleanup;
4958 }
Gilles Peskineedf9a652018-08-17 18:11:56 +02004959 mbedtls_gcm_init( &operation->ctx.gcm );
4960 status = mbedtls_to_psa_error(
4961 mbedtls_gcm_setkey( &operation->ctx.gcm, cipher_id,
Steven Cooreman71fd80d2020-07-07 21:12:27 +02004962 operation->slot->data.key.data,
Gilles Peskineedf9a652018-08-17 18:11:56 +02004963 (unsigned int) key_bits ) );
Gilles Peskinef7e7b012019-05-06 15:27:16 +02004964 if( status != 0 )
4965 goto cleanup;
Gilles Peskineedf9a652018-08-17 18:11:56 +02004966 break;
4967#endif /* MBEDTLS_GCM_C */
4968
Gilles Peskine26869f22019-05-06 15:25:00 +02004969#if defined(MBEDTLS_CHACHAPOLY_C)
4970 case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_CHACHA20_POLY1305, 0 ):
4971 operation->core_alg = PSA_ALG_CHACHA20_POLY1305;
4972 operation->full_tag_length = 16;
4973 /* We only support the default tag length. */
4974 if( alg != PSA_ALG_CHACHA20_POLY1305 )
Ronald Cronf95a2b12020-10-22 15:24:49 +02004975 {
4976 status = PSA_ERROR_NOT_SUPPORTED;
4977 goto cleanup;
4978 }
Gilles Peskine26869f22019-05-06 15:25:00 +02004979 mbedtls_chachapoly_init( &operation->ctx.chachapoly );
4980 status = mbedtls_to_psa_error(
4981 mbedtls_chachapoly_setkey( &operation->ctx.chachapoly,
Steven Cooreman71fd80d2020-07-07 21:12:27 +02004982 operation->slot->data.key.data ) );
Gilles Peskine26869f22019-05-06 15:25:00 +02004983 if( status != 0 )
4984 goto cleanup;
4985 break;
4986#endif /* MBEDTLS_CHACHAPOLY_C */
4987
Gilles Peskineedf9a652018-08-17 18:11:56 +02004988 default:
Ronald Cronf95a2b12020-10-22 15:24:49 +02004989 status = PSA_ERROR_NOT_SUPPORTED;
4990 goto cleanup;
Gilles Peskineedf9a652018-08-17 18:11:56 +02004991 }
4992
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02004993 if( PSA_AEAD_TAG_LENGTH( alg ) > operation->full_tag_length )
4994 {
4995 status = PSA_ERROR_INVALID_ARGUMENT;
4996 goto cleanup;
4997 }
4998 operation->tag_length = PSA_AEAD_TAG_LENGTH( alg );
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02004999
Gilles Peskineedf9a652018-08-17 18:11:56 +02005000 return( PSA_SUCCESS );
5001
5002cleanup:
Gilles Peskine30a9e412019-01-14 18:36:12 +01005003 psa_aead_abort_internal( operation );
Gilles Peskineedf9a652018-08-17 18:11:56 +02005004 return( status );
5005}
5006
Ronald Croncf56a0a2020-08-04 09:51:30 +02005007psa_status_t psa_aead_encrypt( mbedtls_svc_key_id_t key,
mohammad16035955c982018-04-26 00:53:03 +03005008 psa_algorithm_t alg,
5009 const uint8_t *nonce,
5010 size_t nonce_length,
5011 const uint8_t *additional_data,
5012 size_t additional_data_length,
5013 const uint8_t *plaintext,
5014 size_t plaintext_length,
5015 uint8_t *ciphertext,
5016 size_t ciphertext_size,
5017 size_t *ciphertext_length )
5018{
mohammad16035955c982018-04-26 00:53:03 +03005019 psa_status_t status;
Ronald Cronf95a2b12020-10-22 15:24:49 +02005020 aead_operation_t operation = AEAD_OPERATION_INIT;
mohammad160315223a82018-06-03 17:19:55 +03005021 uint8_t *tag;
Gilles Peskine2d277862018-06-18 15:41:12 +02005022
mohammad1603f08a5502018-06-03 15:05:47 +03005023 *ciphertext_length = 0;
mohammad1603e58e6842018-05-09 04:58:32 -07005024
Ronald Croncf56a0a2020-08-04 09:51:30 +02005025 status = psa_aead_setup( &operation, key, PSA_KEY_USAGE_ENCRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02005026 if( status != PSA_SUCCESS )
5027 return( status );
mohammad16035955c982018-04-26 00:53:03 +03005028
Gilles Peskineedf9a652018-08-17 18:11:56 +02005029 /* For all currently supported modes, the tag is at the end of the
5030 * ciphertext. */
5031 if( ciphertext_size < ( plaintext_length + operation.tag_length ) )
5032 {
5033 status = PSA_ERROR_BUFFER_TOO_SMALL;
5034 goto exit;
5035 }
5036 tag = ciphertext + plaintext_length;
mohammad16035955c982018-04-26 00:53:03 +03005037
Gilles Peskineb0b189f2018-11-28 17:30:58 +01005038#if defined(MBEDTLS_GCM_C)
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02005039 if( operation.core_alg == PSA_ALG_GCM )
mohammad16035955c982018-04-26 00:53:03 +03005040 {
Gilles Peskineedf9a652018-08-17 18:11:56 +02005041 status = mbedtls_to_psa_error(
5042 mbedtls_gcm_crypt_and_tag( &operation.ctx.gcm,
5043 MBEDTLS_GCM_ENCRYPT,
5044 plaintext_length,
5045 nonce, nonce_length,
5046 additional_data, additional_data_length,
5047 plaintext, ciphertext,
5048 operation.tag_length, tag ) );
mohammad16035955c982018-04-26 00:53:03 +03005049 }
Gilles Peskineb0b189f2018-11-28 17:30:58 +01005050 else
5051#endif /* MBEDTLS_GCM_C */
5052#if defined(MBEDTLS_CCM_C)
5053 if( operation.core_alg == PSA_ALG_CCM )
mohammad16035955c982018-04-26 00:53:03 +03005054 {
Gilles Peskineedf9a652018-08-17 18:11:56 +02005055 status = mbedtls_to_psa_error(
5056 mbedtls_ccm_encrypt_and_tag( &operation.ctx.ccm,
5057 plaintext_length,
5058 nonce, nonce_length,
5059 additional_data,
5060 additional_data_length,
5061 plaintext, ciphertext,
5062 tag, operation.tag_length ) );
mohammad16035955c982018-04-26 00:53:03 +03005063 }
mohammad16035c8845f2018-05-09 05:40:09 -07005064 else
Gilles Peskineb0b189f2018-11-28 17:30:58 +01005065#endif /* MBEDTLS_CCM_C */
Gilles Peskine26869f22019-05-06 15:25:00 +02005066#if defined(MBEDTLS_CHACHAPOLY_C)
5067 if( operation.core_alg == PSA_ALG_CHACHA20_POLY1305 )
5068 {
5069 if( nonce_length != 12 || operation.tag_length != 16 )
5070 {
5071 status = PSA_ERROR_NOT_SUPPORTED;
5072 goto exit;
5073 }
5074 status = mbedtls_to_psa_error(
5075 mbedtls_chachapoly_encrypt_and_tag( &operation.ctx.chachapoly,
5076 plaintext_length,
5077 nonce,
5078 additional_data,
5079 additional_data_length,
5080 plaintext,
5081 ciphertext,
5082 tag ) );
5083 }
5084 else
5085#endif /* MBEDTLS_CHACHAPOLY_C */
mohammad16035c8845f2018-05-09 05:40:09 -07005086 {
mohammad1603554faad2018-06-03 15:07:38 +03005087 return( PSA_ERROR_NOT_SUPPORTED );
mohammad16035c8845f2018-05-09 05:40:09 -07005088 }
Gilles Peskine2d277862018-06-18 15:41:12 +02005089
Gilles Peskineedf9a652018-08-17 18:11:56 +02005090 if( status != PSA_SUCCESS && ciphertext_size != 0 )
5091 memset( ciphertext, 0, ciphertext_size );
Gilles Peskine2d277862018-06-18 15:41:12 +02005092
Gilles Peskineedf9a652018-08-17 18:11:56 +02005093exit:
Gilles Peskine30a9e412019-01-14 18:36:12 +01005094 psa_aead_abort_internal( &operation );
Gilles Peskineedf9a652018-08-17 18:11:56 +02005095 if( status == PSA_SUCCESS )
5096 *ciphertext_length = plaintext_length + operation.tag_length;
5097 return( status );
mohammad16035955c982018-04-26 00:53:03 +03005098}
5099
Gilles Peskineee652a32018-06-01 19:23:52 +02005100/* Locate the tag in a ciphertext buffer containing the encrypted data
5101 * followed by the tag. Return the length of the part preceding the tag in
5102 * *plaintext_length. This is the size of the plaintext in modes where
5103 * the encrypted data has the same size as the plaintext, such as
5104 * CCM and GCM. */
5105static psa_status_t psa_aead_unpadded_locate_tag( size_t tag_length,
5106 const uint8_t *ciphertext,
5107 size_t ciphertext_length,
5108 size_t plaintext_size,
Gilles Peskineee652a32018-06-01 19:23:52 +02005109 const uint8_t **p_tag )
5110{
5111 size_t payload_length;
5112 if( tag_length > ciphertext_length )
5113 return( PSA_ERROR_INVALID_ARGUMENT );
5114 payload_length = ciphertext_length - tag_length;
5115 if( payload_length > plaintext_size )
5116 return( PSA_ERROR_BUFFER_TOO_SMALL );
5117 *p_tag = ciphertext + payload_length;
Gilles Peskineee652a32018-06-01 19:23:52 +02005118 return( PSA_SUCCESS );
5119}
5120
Ronald Croncf56a0a2020-08-04 09:51:30 +02005121psa_status_t psa_aead_decrypt( mbedtls_svc_key_id_t key,
mohammad16035955c982018-04-26 00:53:03 +03005122 psa_algorithm_t alg,
5123 const uint8_t *nonce,
5124 size_t nonce_length,
5125 const uint8_t *additional_data,
5126 size_t additional_data_length,
5127 const uint8_t *ciphertext,
5128 size_t ciphertext_length,
5129 uint8_t *plaintext,
5130 size_t plaintext_size,
5131 size_t *plaintext_length )
5132{
mohammad16035955c982018-04-26 00:53:03 +03005133 psa_status_t status;
Ronald Cronf95a2b12020-10-22 15:24:49 +02005134 aead_operation_t operation = AEAD_OPERATION_INIT;
Gilles Peskineedf9a652018-08-17 18:11:56 +02005135 const uint8_t *tag = NULL;
Gilles Peskine2d277862018-06-18 15:41:12 +02005136
Gilles Peskineee652a32018-06-01 19:23:52 +02005137 *plaintext_length = 0;
mohammad16039e5a5152018-04-26 12:07:35 +03005138
Ronald Croncf56a0a2020-08-04 09:51:30 +02005139 status = psa_aead_setup( &operation, key, PSA_KEY_USAGE_DECRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02005140 if( status != PSA_SUCCESS )
5141 return( status );
mohammad16035955c982018-04-26 00:53:03 +03005142
Gilles Peskinef7e7b012019-05-06 15:27:16 +02005143 status = psa_aead_unpadded_locate_tag( operation.tag_length,
5144 ciphertext, ciphertext_length,
5145 plaintext_size, &tag );
5146 if( status != PSA_SUCCESS )
5147 goto exit;
5148
Gilles Peskineb0b189f2018-11-28 17:30:58 +01005149#if defined(MBEDTLS_GCM_C)
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02005150 if( operation.core_alg == PSA_ALG_GCM )
mohammad16035955c982018-04-26 00:53:03 +03005151 {
Gilles Peskineedf9a652018-08-17 18:11:56 +02005152 status = mbedtls_to_psa_error(
5153 mbedtls_gcm_auth_decrypt( &operation.ctx.gcm,
5154 ciphertext_length - operation.tag_length,
5155 nonce, nonce_length,
5156 additional_data,
5157 additional_data_length,
5158 tag, operation.tag_length,
5159 ciphertext, plaintext ) );
mohammad16035955c982018-04-26 00:53:03 +03005160 }
Gilles Peskineb0b189f2018-11-28 17:30:58 +01005161 else
5162#endif /* MBEDTLS_GCM_C */
5163#if defined(MBEDTLS_CCM_C)
5164 if( operation.core_alg == PSA_ALG_CCM )
mohammad16035955c982018-04-26 00:53:03 +03005165 {
Gilles Peskineedf9a652018-08-17 18:11:56 +02005166 status = mbedtls_to_psa_error(
5167 mbedtls_ccm_auth_decrypt( &operation.ctx.ccm,
5168 ciphertext_length - operation.tag_length,
5169 nonce, nonce_length,
5170 additional_data,
5171 additional_data_length,
5172 ciphertext, plaintext,
5173 tag, operation.tag_length ) );
mohammad16035955c982018-04-26 00:53:03 +03005174 }
mohammad160339574652018-06-01 04:39:53 -07005175 else
Gilles Peskineb0b189f2018-11-28 17:30:58 +01005176#endif /* MBEDTLS_CCM_C */
Gilles Peskine26869f22019-05-06 15:25:00 +02005177#if defined(MBEDTLS_CHACHAPOLY_C)
5178 if( operation.core_alg == PSA_ALG_CHACHA20_POLY1305 )
5179 {
5180 if( nonce_length != 12 || operation.tag_length != 16 )
5181 {
5182 status = PSA_ERROR_NOT_SUPPORTED;
5183 goto exit;
5184 }
5185 status = mbedtls_to_psa_error(
5186 mbedtls_chachapoly_auth_decrypt( &operation.ctx.chachapoly,
5187 ciphertext_length - operation.tag_length,
5188 nonce,
5189 additional_data,
5190 additional_data_length,
5191 tag,
5192 ciphertext,
5193 plaintext ) );
5194 }
5195 else
5196#endif /* MBEDTLS_CHACHAPOLY_C */
mohammad160339574652018-06-01 04:39:53 -07005197 {
mohammad1603554faad2018-06-03 15:07:38 +03005198 return( PSA_ERROR_NOT_SUPPORTED );
mohammad160339574652018-06-01 04:39:53 -07005199 }
Gilles Peskinea40d7742018-06-01 16:28:30 +02005200
Gilles Peskineedf9a652018-08-17 18:11:56 +02005201 if( status != PSA_SUCCESS && plaintext_size != 0 )
5202 memset( plaintext, 0, plaintext_size );
mohammad160360a64d02018-06-03 17:20:42 +03005203
Gilles Peskineedf9a652018-08-17 18:11:56 +02005204exit:
Gilles Peskine30a9e412019-01-14 18:36:12 +01005205 psa_aead_abort_internal( &operation );
Gilles Peskineedf9a652018-08-17 18:11:56 +02005206 if( status == PSA_SUCCESS )
5207 *plaintext_length = ciphertext_length - operation.tag_length;
5208 return( status );
mohammad16035955c982018-04-26 00:53:03 +03005209}
5210
Gilles Peskinea0655c32018-04-30 17:06:50 +02005211
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02005212
Gilles Peskine20035e32018-02-03 22:44:14 +01005213/****************************************************************/
Gilles Peskineeab56e42018-07-12 17:12:33 +02005214/* Generators */
5215/****************************************************************/
5216
John Durkop07cc04a2020-11-16 22:08:34 -08005217#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF) || \
5218 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
5219 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
5220#define AT_LEAST_ONE_BUILTIN_KDF
5221#endif
5222
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005223#define HKDF_STATE_INIT 0 /* no input yet */
5224#define HKDF_STATE_STARTED 1 /* got salt */
5225#define HKDF_STATE_KEYED 2 /* got key */
5226#define HKDF_STATE_OUTPUT 3 /* output started */
5227
Gilles Peskinecbe66502019-05-16 16:59:18 +02005228static psa_algorithm_t psa_key_derivation_get_kdf_alg(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005229 const psa_key_derivation_operation_t *operation )
Gilles Peskine969c5d62019-01-16 15:53:06 +01005230{
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005231 if ( PSA_ALG_IS_KEY_AGREEMENT( operation->alg ) )
5232 return( PSA_ALG_KEY_AGREEMENT_GET_KDF( operation->alg ) );
Gilles Peskine969c5d62019-01-16 15:53:06 +01005233 else
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005234 return( operation->alg );
Gilles Peskine969c5d62019-01-16 15:53:06 +01005235}
5236
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005237psa_status_t psa_key_derivation_abort( psa_key_derivation_operation_t *operation )
Gilles Peskineeab56e42018-07-12 17:12:33 +02005238{
5239 psa_status_t status = PSA_SUCCESS;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005240 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg( operation );
Gilles Peskine969c5d62019-01-16 15:53:06 +01005241 if( kdf_alg == 0 )
Gilles Peskineeab56e42018-07-12 17:12:33 +02005242 {
5243 /* The object has (apparently) been initialized but it is not
5244 * in use. It's ok to call abort on such an object, and there's
5245 * nothing to do. */
5246 }
5247 else
John Durkopd0321952020-10-29 21:37:36 -07005248#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Gilles Peskine969c5d62019-01-16 15:53:06 +01005249 if( PSA_ALG_IS_HKDF( kdf_alg ) )
Gilles Peskinebef7f142018-07-12 17:22:21 +02005250 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005251 mbedtls_free( operation->ctx.hkdf.info );
5252 status = psa_hmac_abort_internal( &operation->ctx.hkdf.hmac );
Gilles Peskinebef7f142018-07-12 17:22:21 +02005253 }
John Durkop07cc04a2020-11-16 22:08:34 -08005254 else
5255#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF */
5256#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
5257 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
5258 if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005259 /* TLS-1.2 PSK-to-MS KDF uses the same core as TLS-1.2 PRF */
Gilles Peskine969c5d62019-01-16 15:53:06 +01005260 PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005261 {
Janos Follath6a1d2622019-06-11 10:37:28 +01005262 if( operation->ctx.tls12_prf.seed != NULL )
5263 {
5264 mbedtls_platform_zeroize( operation->ctx.tls12_prf.seed,
5265 operation->ctx.tls12_prf.seed_length );
5266 mbedtls_free( operation->ctx.tls12_prf.seed );
5267 }
5268
5269 if( operation->ctx.tls12_prf.label != NULL )
5270 {
5271 mbedtls_platform_zeroize( operation->ctx.tls12_prf.label,
5272 operation->ctx.tls12_prf.label_length );
5273 mbedtls_free( operation->ctx.tls12_prf.label );
5274 }
5275
5276 status = psa_hmac_abort_internal( &operation->ctx.tls12_prf.hmac );
5277
5278 /* We leave the fields Ai and output_block to be erased safely by the
5279 * mbedtls_platform_zeroize() in the end of this function. */
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005280 }
Gilles Peskinebef7f142018-07-12 17:22:21 +02005281 else
John Durkop07cc04a2020-11-16 22:08:34 -08005282#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) ||
5283 * defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) */
Gilles Peskineeab56e42018-07-12 17:12:33 +02005284 {
5285 status = PSA_ERROR_BAD_STATE;
5286 }
Janos Follath083036a2019-06-11 10:22:26 +01005287 mbedtls_platform_zeroize( operation, sizeof( *operation ) );
Gilles Peskineeab56e42018-07-12 17:12:33 +02005288 return( status );
5289}
5290
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005291psa_status_t psa_key_derivation_get_capacity(const psa_key_derivation_operation_t *operation,
Gilles Peskineeab56e42018-07-12 17:12:33 +02005292 size_t *capacity)
5293{
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005294 if( operation->alg == 0 )
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005295 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005296 /* This is a blank key derivation operation. */
Steven Cooreman29149862020-08-05 15:43:42 +02005297 return( PSA_ERROR_BAD_STATE );
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005298 }
5299
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005300 *capacity = operation->capacity;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005301 return( PSA_SUCCESS );
5302}
5303
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005304psa_status_t psa_key_derivation_set_capacity( psa_key_derivation_operation_t *operation,
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005305 size_t capacity )
5306{
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005307 if( operation->alg == 0 )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005308 return( PSA_ERROR_BAD_STATE );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005309 if( capacity > operation->capacity )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005310 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005311 operation->capacity = capacity;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005312 return( PSA_SUCCESS );
5313}
5314
John Durkopd0321952020-10-29 21:37:36 -07005315#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005316/* Read some bytes from an HKDF-based operation. This performs a chunk
Gilles Peskinebef7f142018-07-12 17:22:21 +02005317 * of the expand phase of the HKDF algorithm. */
Gilles Peskinecbe66502019-05-16 16:59:18 +02005318static psa_status_t psa_key_derivation_hkdf_read( psa_hkdf_key_derivation_t *hkdf,
Gilles Peskinebef7f142018-07-12 17:22:21 +02005319 psa_algorithm_t hash_alg,
5320 uint8_t *output,
5321 size_t output_length )
5322{
5323 uint8_t hash_length = PSA_HASH_SIZE( hash_alg );
5324 psa_status_t status;
5325
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005326 if( hkdf->state < HKDF_STATE_KEYED || ! hkdf->info_set )
5327 return( PSA_ERROR_BAD_STATE );
5328 hkdf->state = HKDF_STATE_OUTPUT;
5329
Gilles Peskinebef7f142018-07-12 17:22:21 +02005330 while( output_length != 0 )
5331 {
5332 /* Copy what remains of the current block */
5333 uint8_t n = hash_length - hkdf->offset_in_block;
5334 if( n > output_length )
5335 n = (uint8_t) output_length;
5336 memcpy( output, hkdf->output_block + hkdf->offset_in_block, n );
5337 output += n;
5338 output_length -= n;
5339 hkdf->offset_in_block += n;
Gilles Peskined54931c2018-07-17 21:06:59 +02005340 if( output_length == 0 )
Gilles Peskinebef7f142018-07-12 17:22:21 +02005341 break;
Gilles Peskined54931c2018-07-17 21:06:59 +02005342 /* We can't be wanting more output after block 0xff, otherwise
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02005343 * the capacity check in psa_key_derivation_output_bytes() would have
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005344 * prevented this call. It could happen only if the operation
Gilles Peskined54931c2018-07-17 21:06:59 +02005345 * object was corrupted or if this function is called directly
5346 * inside the library. */
5347 if( hkdf->block_number == 0xff )
5348 return( PSA_ERROR_BAD_STATE );
Gilles Peskinebef7f142018-07-12 17:22:21 +02005349
5350 /* We need a new block */
5351 ++hkdf->block_number;
5352 hkdf->offset_in_block = 0;
5353 status = psa_hmac_setup_internal( &hkdf->hmac,
5354 hkdf->prk, hash_length,
5355 hash_alg );
5356 if( status != PSA_SUCCESS )
5357 return( status );
5358 if( hkdf->block_number != 1 )
5359 {
5360 status = psa_hash_update( &hkdf->hmac.hash_ctx,
5361 hkdf->output_block,
5362 hash_length );
5363 if( status != PSA_SUCCESS )
5364 return( status );
5365 }
5366 status = psa_hash_update( &hkdf->hmac.hash_ctx,
5367 hkdf->info,
5368 hkdf->info_length );
5369 if( status != PSA_SUCCESS )
5370 return( status );
5371 status = psa_hash_update( &hkdf->hmac.hash_ctx,
5372 &hkdf->block_number, 1 );
5373 if( status != PSA_SUCCESS )
5374 return( status );
5375 status = psa_hmac_finish_internal( &hkdf->hmac,
5376 hkdf->output_block,
5377 sizeof( hkdf->output_block ) );
5378 if( status != PSA_SUCCESS )
5379 return( status );
5380 }
5381
5382 return( PSA_SUCCESS );
5383}
John Durkop07cc04a2020-11-16 22:08:34 -08005384#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005385
John Durkop07cc04a2020-11-16 22:08:34 -08005386#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
5387 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Janos Follath7742fee2019-06-17 12:58:10 +01005388static psa_status_t psa_key_derivation_tls12_prf_generate_next_block(
5389 psa_tls12_prf_key_derivation_t *tls12_prf,
5390 psa_algorithm_t alg )
5391{
5392 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( alg );
5393 uint8_t hash_length = PSA_HASH_SIZE( hash_alg );
Janos Follathea29bfb2019-06-19 12:21:20 +01005394 psa_hash_operation_t backup = PSA_HASH_OPERATION_INIT;
5395 psa_status_t status, cleanup_status;
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005396
Janos Follath7742fee2019-06-17 12:58:10 +01005397 /* We can't be wanting more output after block 0xff, otherwise
5398 * the capacity check in psa_key_derivation_output_bytes() would have
5399 * prevented this call. It could happen only if the operation
5400 * object was corrupted or if this function is called directly
5401 * inside the library. */
5402 if( tls12_prf->block_number == 0xff )
Janos Follath30090bc2019-06-25 10:15:04 +01005403 return( PSA_ERROR_CORRUPTION_DETECTED );
Janos Follath7742fee2019-06-17 12:58:10 +01005404
5405 /* We need a new block */
5406 ++tls12_prf->block_number;
Janos Follath844eb0e2019-06-19 12:10:49 +01005407 tls12_prf->left_in_block = hash_length;
Janos Follath7742fee2019-06-17 12:58:10 +01005408
5409 /* Recall the definition of the TLS-1.2-PRF from RFC 5246:
5410 *
5411 * PRF(secret, label, seed) = P_<hash>(secret, label + seed)
5412 *
5413 * P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
5414 * HMAC_hash(secret, A(2) + seed) +
5415 * HMAC_hash(secret, A(3) + seed) + ...
5416 *
5417 * A(0) = seed
Janos Follathea29bfb2019-06-19 12:21:20 +01005418 * A(i) = HMAC_hash(secret, A(i-1))
Janos Follath7742fee2019-06-17 12:58:10 +01005419 *
Janos Follathea29bfb2019-06-19 12:21:20 +01005420 * The `psa_tls12_prf_key_derivation` structure saves the block
Janos Follath7742fee2019-06-17 12:58:10 +01005421 * `HMAC_hash(secret, A(i) + seed)` from which the output
Janos Follath76c39842019-06-26 12:50:36 +01005422 * is currently extracted as `output_block` and where i is
5423 * `block_number`.
Janos Follath7742fee2019-06-17 12:58:10 +01005424 */
5425
Janos Follathea29bfb2019-06-19 12:21:20 +01005426 /* Save the hash context before using it, to preserve the hash state with
5427 * only the inner padding in it. We need this, because inner padding depends
5428 * on the key (secret in the RFC's terminology). */
5429 status = psa_hash_clone( &tls12_prf->hmac.hash_ctx, &backup );
5430 if( status != PSA_SUCCESS )
5431 goto cleanup;
5432
5433 /* Calculate A(i) where i = tls12_prf->block_number. */
5434 if( tls12_prf->block_number == 1 )
5435 {
5436 /* A(1) = HMAC_hash(secret, A(0)), where A(0) = seed. (The RFC overloads
5437 * the variable seed and in this instance means it in the context of the
5438 * P_hash function, where seed = label + seed.) */
5439 status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
5440 tls12_prf->label, tls12_prf->label_length );
5441 if( status != PSA_SUCCESS )
5442 goto cleanup;
5443 status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
5444 tls12_prf->seed, tls12_prf->seed_length );
5445 if( status != PSA_SUCCESS )
5446 goto cleanup;
5447 }
5448 else
5449 {
5450 /* A(i) = HMAC_hash(secret, A(i-1)) */
5451 status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
5452 tls12_prf->Ai, hash_length );
5453 if( status != PSA_SUCCESS )
5454 goto cleanup;
5455 }
5456
5457 status = psa_hmac_finish_internal( &tls12_prf->hmac,
5458 tls12_prf->Ai, hash_length );
5459 if( status != PSA_SUCCESS )
5460 goto cleanup;
5461 status = psa_hash_clone( &backup, &tls12_prf->hmac.hash_ctx );
5462 if( status != PSA_SUCCESS )
5463 goto cleanup;
5464
5465 /* Calculate HMAC_hash(secret, A(i) + label + seed). */
5466 status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
5467 tls12_prf->Ai, hash_length );
5468 if( status != PSA_SUCCESS )
5469 goto cleanup;
5470 status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
5471 tls12_prf->label, tls12_prf->label_length );
5472 if( status != PSA_SUCCESS )
5473 goto cleanup;
5474 status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
5475 tls12_prf->seed, tls12_prf->seed_length );
5476 if( status != PSA_SUCCESS )
5477 goto cleanup;
5478 status = psa_hmac_finish_internal( &tls12_prf->hmac,
5479 tls12_prf->output_block, hash_length );
5480 if( status != PSA_SUCCESS )
5481 goto cleanup;
5482 status = psa_hash_clone( &backup, &tls12_prf->hmac.hash_ctx );
5483 if( status != PSA_SUCCESS )
5484 goto cleanup;
5485
Janos Follath7742fee2019-06-17 12:58:10 +01005486
5487cleanup:
5488
Janos Follathea29bfb2019-06-19 12:21:20 +01005489 cleanup_status = psa_hash_abort( &backup );
5490 if( status == PSA_SUCCESS && cleanup_status != PSA_SUCCESS )
5491 status = cleanup_status;
5492
5493 return( status );
Janos Follath7742fee2019-06-17 12:58:10 +01005494}
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005495
Janos Follath844eb0e2019-06-19 12:10:49 +01005496static psa_status_t psa_key_derivation_tls12_prf_read(
5497 psa_tls12_prf_key_derivation_t *tls12_prf,
5498 psa_algorithm_t alg,
5499 uint8_t *output,
5500 size_t output_length )
5501{
5502 psa_algorithm_t hash_alg = PSA_ALG_TLS12_PRF_GET_HASH( alg );
5503 uint8_t hash_length = PSA_HASH_SIZE( hash_alg );
5504 psa_status_t status;
5505 uint8_t offset, length;
5506
5507 while( output_length != 0 )
5508 {
5509 /* Check if we have fully processed the current block. */
5510 if( tls12_prf->left_in_block == 0 )
5511 {
5512 status = psa_key_derivation_tls12_prf_generate_next_block( tls12_prf,
5513 alg );
5514 if( status != PSA_SUCCESS )
5515 return( status );
5516
5517 continue;
5518 }
5519
5520 if( tls12_prf->left_in_block > output_length )
5521 length = (uint8_t) output_length;
5522 else
5523 length = tls12_prf->left_in_block;
5524
5525 offset = hash_length - tls12_prf->left_in_block;
5526 memcpy( output, tls12_prf->output_block + offset, length );
5527 output += length;
5528 output_length -= length;
5529 tls12_prf->left_in_block -= length;
5530 }
5531
5532 return( PSA_SUCCESS );
5533}
John Durkop07cc04a2020-11-16 22:08:34 -08005534#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF ||
5535 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Gilles Peskinebef7f142018-07-12 17:22:21 +02005536
Janos Follath6c6c8fc2019-06-17 12:38:20 +01005537psa_status_t psa_key_derivation_output_bytes(
5538 psa_key_derivation_operation_t *operation,
5539 uint8_t *output,
5540 size_t output_length )
Gilles Peskineeab56e42018-07-12 17:12:33 +02005541{
5542 psa_status_t status;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005543 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg( operation );
Gilles Peskineeab56e42018-07-12 17:12:33 +02005544
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005545 if( operation->alg == 0 )
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005546 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005547 /* This is a blank operation. */
Steven Cooreman29149862020-08-05 15:43:42 +02005548 return( PSA_ERROR_BAD_STATE );
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005549 }
5550
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005551 if( output_length > operation->capacity )
Gilles Peskineeab56e42018-07-12 17:12:33 +02005552 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005553 operation->capacity = 0;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005554 /* Go through the error path to wipe all confidential data now
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005555 * that the operation object is useless. */
David Saadab4ecc272019-02-14 13:48:10 +02005556 status = PSA_ERROR_INSUFFICIENT_DATA;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005557 goto exit;
5558 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005559 if( output_length == 0 && operation->capacity == 0 )
Gilles Peskineeab56e42018-07-12 17:12:33 +02005560 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005561 /* Edge case: this is a finished operation, and 0 bytes
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005562 * were requested. The right error in this case could
Gilles Peskineeab56e42018-07-12 17:12:33 +02005563 * be either INSUFFICIENT_CAPACITY or BAD_STATE. Return
5564 * INSUFFICIENT_CAPACITY, which is right for a finished
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005565 * operation, for consistency with the case when
Gilles Peskineeab56e42018-07-12 17:12:33 +02005566 * output_length > 0. */
David Saadab4ecc272019-02-14 13:48:10 +02005567 return( PSA_ERROR_INSUFFICIENT_DATA );
Gilles Peskineeab56e42018-07-12 17:12:33 +02005568 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005569 operation->capacity -= output_length;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005570
John Durkopd0321952020-10-29 21:37:36 -07005571#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Gilles Peskine969c5d62019-01-16 15:53:06 +01005572 if( PSA_ALG_IS_HKDF( kdf_alg ) )
Gilles Peskinebef7f142018-07-12 17:22:21 +02005573 {
Gilles Peskine969c5d62019-01-16 15:53:06 +01005574 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( kdf_alg );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005575 status = psa_key_derivation_hkdf_read( &operation->ctx.hkdf, hash_alg,
Gilles Peskinebef7f142018-07-12 17:22:21 +02005576 output, output_length );
5577 }
Janos Follathadbec812019-06-14 11:05:39 +01005578 else
John Durkop07cc04a2020-11-16 22:08:34 -08005579#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */
5580#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
5581 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Janos Follathadbec812019-06-14 11:05:39 +01005582 if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
John Durkop07cc04a2020-11-16 22:08:34 -08005583 PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005584 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005585 status = psa_key_derivation_tls12_prf_read( &operation->ctx.tls12_prf,
Gilles Peskine969c5d62019-01-16 15:53:06 +01005586 kdf_alg, output,
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005587 output_length );
5588 }
Gilles Peskinebef7f142018-07-12 17:22:21 +02005589 else
John Durkop07cc04a2020-11-16 22:08:34 -08005590#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF ||
5591 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Gilles Peskineeab56e42018-07-12 17:12:33 +02005592 {
5593 return( PSA_ERROR_BAD_STATE );
5594 }
5595
5596exit:
5597 if( status != PSA_SUCCESS )
5598 {
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005599 /* Preserve the algorithm upon errors, but clear all sensitive state.
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005600 * This allows us to differentiate between exhausted operations and
5601 * blank operations, so we can return PSA_ERROR_BAD_STATE on blank
5602 * operations. */
5603 psa_algorithm_t alg = operation->alg;
5604 psa_key_derivation_abort( operation );
5605 operation->alg = alg;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005606 memset( output, '!', output_length );
5607 }
5608 return( status );
5609}
5610
Gilles Peskine08542d82018-07-19 17:05:42 +02005611#if defined(MBEDTLS_DES_C)
5612static void psa_des_set_key_parity( uint8_t *data, size_t data_size )
5613{
5614 if( data_size >= 8 )
5615 mbedtls_des_key_set_parity( data );
5616 if( data_size >= 16 )
5617 mbedtls_des_key_set_parity( data + 8 );
5618 if( data_size >= 24 )
5619 mbedtls_des_key_set_parity( data + 16 );
5620}
5621#endif /* MBEDTLS_DES_C */
5622
Adrian L. Shaw5a5a79a2019-05-03 15:44:28 +01005623static psa_status_t psa_generate_derived_key_internal(
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005624 psa_key_slot_t *slot,
5625 size_t bits,
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005626 psa_key_derivation_operation_t *operation )
Gilles Peskineeab56e42018-07-12 17:12:33 +02005627{
5628 uint8_t *data = NULL;
5629 size_t bytes = PSA_BITS_TO_BYTES( bits );
5630 psa_status_t status;
5631
Gilles Peskine8e338702019-07-30 20:06:31 +02005632 if( ! key_type_is_raw_bytes( slot->attr.type ) )
Gilles Peskineeab56e42018-07-12 17:12:33 +02005633 return( PSA_ERROR_INVALID_ARGUMENT );
5634 if( bits % 8 != 0 )
5635 return( PSA_ERROR_INVALID_ARGUMENT );
5636 data = mbedtls_calloc( 1, bytes );
5637 if( data == NULL )
5638 return( PSA_ERROR_INSUFFICIENT_MEMORY );
5639
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005640 status = psa_key_derivation_output_bytes( operation, data, bytes );
Gilles Peskineeab56e42018-07-12 17:12:33 +02005641 if( status != PSA_SUCCESS )
5642 goto exit;
Gilles Peskine08542d82018-07-19 17:05:42 +02005643#if defined(MBEDTLS_DES_C)
Gilles Peskine8e338702019-07-30 20:06:31 +02005644 if( slot->attr.type == PSA_KEY_TYPE_DES )
Gilles Peskine08542d82018-07-19 17:05:42 +02005645 psa_des_set_key_parity( data, bytes );
5646#endif /* MBEDTLS_DES_C */
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005647 status = psa_import_key_into_slot( slot, data, bytes );
Gilles Peskineeab56e42018-07-12 17:12:33 +02005648
5649exit:
5650 mbedtls_free( data );
5651 return( status );
5652}
5653
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02005654psa_status_t psa_key_derivation_output_key( const psa_key_attributes_t *attributes,
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005655 psa_key_derivation_operation_t *operation,
Ronald Croncf56a0a2020-08-04 09:51:30 +02005656 mbedtls_svc_key_id_t *key )
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005657{
5658 psa_status_t status;
5659 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02005660 psa_se_drv_table_entry_t *driver = NULL;
Gilles Peskine0f84d622019-09-12 19:03:13 +02005661
Ronald Cron81709fc2020-11-14 12:10:32 +01005662 *key = MBEDTLS_SVC_KEY_ID_INIT;
5663
Gilles Peskine0f84d622019-09-12 19:03:13 +02005664 /* Reject any attempt to create a zero-length key so that we don't
5665 * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
5666 if( psa_get_key_bits( attributes ) == 0 )
5667 return( PSA_ERROR_INVALID_ARGUMENT );
5668
Gilles Peskine178c9aa2019-09-24 18:21:06 +02005669 if( ! operation->can_output_key )
5670 return( PSA_ERROR_NOT_PERMITTED );
5671
Ronald Cron81709fc2020-11-14 12:10:32 +01005672 status = psa_start_key_creation( PSA_KEY_CREATION_DERIVE, attributes,
5673 &slot, &driver );
Gilles Peskinef4ee6622019-07-24 13:44:30 +02005674#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
5675 if( driver != NULL )
5676 {
5677 /* Deriving a key in a secure element is not implemented yet. */
5678 status = PSA_ERROR_NOT_SUPPORTED;
5679 }
5680#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005681 if( status == PSA_SUCCESS )
5682 {
Adrian L. Shaw5a5a79a2019-05-03 15:44:28 +01005683 status = psa_generate_derived_key_internal( slot,
Gilles Peskine7e0cff92019-07-30 13:48:52 +02005684 attributes->core.bits,
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005685 operation );
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005686 }
5687 if( status == PSA_SUCCESS )
Ronald Cron81709fc2020-11-14 12:10:32 +01005688 status = psa_finish_key_creation( slot, driver, key );
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005689 if( status != PSA_SUCCESS )
Gilles Peskine011e4282019-06-26 18:34:38 +02005690 psa_fail_key_creation( slot, driver );
Ronald Cronf95a2b12020-10-22 15:24:49 +02005691
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005692 return( status );
5693}
5694
Gilles Peskineeab56e42018-07-12 17:12:33 +02005695
5696
5697/****************************************************************/
Gilles Peskineea0fb492018-07-12 17:17:20 +02005698/* Key derivation */
5699/****************************************************************/
5700
John Durkop07cc04a2020-11-16 22:08:34 -08005701#ifdef AT_LEAST_ONE_BUILTIN_KDF
Gilles Peskine969c5d62019-01-16 15:53:06 +01005702static psa_status_t psa_key_derivation_setup_kdf(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005703 psa_key_derivation_operation_t *operation,
Gilles Peskine969c5d62019-01-16 15:53:06 +01005704 psa_algorithm_t kdf_alg )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005705{
John Durkop07cc04a2020-11-16 22:08:34 -08005706 int is_kdf_alg_supported;
5707
Janos Follath5fe19732019-06-20 15:09:30 +01005708 /* Make sure that operation->ctx is properly zero-initialised. (Macro
5709 * initialisers for this union leave some bytes unspecified.) */
5710 memset( &operation->ctx, 0, sizeof( operation->ctx ) );
5711
Gilles Peskine969c5d62019-01-16 15:53:06 +01005712 /* Make sure that kdf_alg is a supported key derivation algorithm. */
John Durkopd0321952020-10-29 21:37:36 -07005713#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
John Durkop07cc04a2020-11-16 22:08:34 -08005714 if( PSA_ALG_IS_HKDF( kdf_alg ) )
5715 is_kdf_alg_supported = 1;
5716 else
5717#endif
5718#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF)
5719 if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) )
5720 is_kdf_alg_supported = 1;
5721 else
5722#endif
5723#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
5724 if( PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
5725 is_kdf_alg_supported = 1;
5726 else
5727#endif
5728 is_kdf_alg_supported = 0;
5729
5730 if( is_kdf_alg_supported )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005731 {
Gilles Peskine969c5d62019-01-16 15:53:06 +01005732 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( kdf_alg );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005733 size_t hash_size = PSA_HASH_SIZE( hash_alg );
5734 if( hash_size == 0 )
5735 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine969c5d62019-01-16 15:53:06 +01005736 if( ( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
5737 PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) ) &&
Gilles Peskineab4b2012019-04-12 15:06:27 +02005738 ! ( hash_alg == PSA_ALG_SHA_256 || hash_alg == PSA_ALG_SHA_384 ) )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005739 {
5740 return( PSA_ERROR_NOT_SUPPORTED );
5741 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005742 operation->capacity = 255 * hash_size;
Gilles Peskine969c5d62019-01-16 15:53:06 +01005743 return( PSA_SUCCESS );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005744 }
John Durkop07cc04a2020-11-16 22:08:34 -08005745
5746 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine969c5d62019-01-16 15:53:06 +01005747}
John Durkop07cc04a2020-11-16 22:08:34 -08005748#endif /* AT_LEAST_ONE_BUILTIN_KDF */
Gilles Peskine969c5d62019-01-16 15:53:06 +01005749
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005750psa_status_t psa_key_derivation_setup( psa_key_derivation_operation_t *operation,
Gilles Peskine969c5d62019-01-16 15:53:06 +01005751 psa_algorithm_t alg )
5752{
5753 psa_status_t status;
5754
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005755 if( operation->alg != 0 )
Gilles Peskine969c5d62019-01-16 15:53:06 +01005756 return( PSA_ERROR_BAD_STATE );
5757
Gilles Peskine6843c292019-01-18 16:44:49 +01005758 if( PSA_ALG_IS_RAW_KEY_AGREEMENT( alg ) )
5759 return( PSA_ERROR_INVALID_ARGUMENT );
John Durkop07cc04a2020-11-16 22:08:34 -08005760#ifdef AT_LEAST_ONE_BUILTIN_KDF
Gilles Peskine6843c292019-01-18 16:44:49 +01005761 else if( PSA_ALG_IS_KEY_AGREEMENT( alg ) )
Gilles Peskine969c5d62019-01-16 15:53:06 +01005762 {
5763 psa_algorithm_t kdf_alg = PSA_ALG_KEY_AGREEMENT_GET_KDF( alg );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005764 status = psa_key_derivation_setup_kdf( operation, kdf_alg );
Gilles Peskine969c5d62019-01-16 15:53:06 +01005765 }
5766 else if( PSA_ALG_IS_KEY_DERIVATION( alg ) )
5767 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005768 status = psa_key_derivation_setup_kdf( operation, alg );
Gilles Peskine969c5d62019-01-16 15:53:06 +01005769 }
John Durkop07cc04a2020-11-16 22:08:34 -08005770#endif
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005771 else
5772 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine969c5d62019-01-16 15:53:06 +01005773
5774 if( status == PSA_SUCCESS )
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005775 operation->alg = alg;
Gilles Peskine969c5d62019-01-16 15:53:06 +01005776 return( status );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005777}
5778
John Durkopd0321952020-10-29 21:37:36 -07005779#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Gilles Peskinecbe66502019-05-16 16:59:18 +02005780static psa_status_t psa_hkdf_input( psa_hkdf_key_derivation_t *hkdf,
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005781 psa_algorithm_t hash_alg,
5782 psa_key_derivation_step_t step,
5783 const uint8_t *data,
5784 size_t data_length )
5785{
5786 psa_status_t status;
5787 switch( step )
5788 {
Gilles Peskine03410b52019-05-16 16:05:19 +02005789 case PSA_KEY_DERIVATION_INPUT_SALT:
Gilles Peskine2b522db2019-04-12 15:11:49 +02005790 if( hkdf->state != HKDF_STATE_INIT )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005791 return( PSA_ERROR_BAD_STATE );
Gilles Peskine2b522db2019-04-12 15:11:49 +02005792 status = psa_hmac_setup_internal( &hkdf->hmac,
5793 data, data_length,
5794 hash_alg );
5795 if( status != PSA_SUCCESS )
5796 return( status );
5797 hkdf->state = HKDF_STATE_STARTED;
5798 return( PSA_SUCCESS );
Gilles Peskine03410b52019-05-16 16:05:19 +02005799 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005800 /* If no salt was provided, use an empty salt. */
5801 if( hkdf->state == HKDF_STATE_INIT )
5802 {
5803 status = psa_hmac_setup_internal( &hkdf->hmac,
5804 NULL, 0,
Gilles Peskinef9ee6332019-04-11 21:22:52 +02005805 hash_alg );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005806 if( status != PSA_SUCCESS )
5807 return( status );
5808 hkdf->state = HKDF_STATE_STARTED;
5809 }
Gilles Peskine2b522db2019-04-12 15:11:49 +02005810 if( hkdf->state != HKDF_STATE_STARTED )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005811 return( PSA_ERROR_BAD_STATE );
Gilles Peskine2b522db2019-04-12 15:11:49 +02005812 status = psa_hash_update( &hkdf->hmac.hash_ctx,
5813 data, data_length );
5814 if( status != PSA_SUCCESS )
5815 return( status );
5816 status = psa_hmac_finish_internal( &hkdf->hmac,
5817 hkdf->prk,
5818 sizeof( hkdf->prk ) );
5819 if( status != PSA_SUCCESS )
5820 return( status );
5821 hkdf->offset_in_block = PSA_HASH_SIZE( hash_alg );
5822 hkdf->block_number = 0;
5823 hkdf->state = HKDF_STATE_KEYED;
5824 return( PSA_SUCCESS );
Gilles Peskine03410b52019-05-16 16:05:19 +02005825 case PSA_KEY_DERIVATION_INPUT_INFO:
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005826 if( hkdf->state == HKDF_STATE_OUTPUT )
5827 return( PSA_ERROR_BAD_STATE );
5828 if( hkdf->info_set )
5829 return( PSA_ERROR_BAD_STATE );
5830 hkdf->info_length = data_length;
5831 if( data_length != 0 )
5832 {
5833 hkdf->info = mbedtls_calloc( 1, data_length );
5834 if( hkdf->info == NULL )
5835 return( PSA_ERROR_INSUFFICIENT_MEMORY );
5836 memcpy( hkdf->info, data, data_length );
5837 }
5838 hkdf->info_set = 1;
5839 return( PSA_SUCCESS );
5840 default:
5841 return( PSA_ERROR_INVALID_ARGUMENT );
5842 }
5843}
John Durkop07cc04a2020-11-16 22:08:34 -08005844#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */
Janos Follathb03233e2019-06-11 15:30:30 +01005845
John Durkop07cc04a2020-11-16 22:08:34 -08005846#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
5847 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Janos Follathf08e2652019-06-13 09:05:41 +01005848static psa_status_t psa_tls12_prf_set_seed( psa_tls12_prf_key_derivation_t *prf,
5849 const uint8_t *data,
5850 size_t data_length )
5851{
5852 if( prf->state != TLS12_PRF_STATE_INIT )
5853 return( PSA_ERROR_BAD_STATE );
5854
Janos Follathd6dce9f2019-07-04 09:11:38 +01005855 if( data_length != 0 )
5856 {
5857 prf->seed = mbedtls_calloc( 1, data_length );
5858 if( prf->seed == NULL )
5859 return( PSA_ERROR_INSUFFICIENT_MEMORY );
Janos Follathf08e2652019-06-13 09:05:41 +01005860
Janos Follathd6dce9f2019-07-04 09:11:38 +01005861 memcpy( prf->seed, data, data_length );
5862 prf->seed_length = data_length;
5863 }
Janos Follathf08e2652019-06-13 09:05:41 +01005864
5865 prf->state = TLS12_PRF_STATE_SEED_SET;
5866
5867 return( PSA_SUCCESS );
5868}
5869
Janos Follath81550542019-06-13 14:26:34 +01005870static psa_status_t psa_tls12_prf_set_key( psa_tls12_prf_key_derivation_t *prf,
5871 psa_algorithm_t hash_alg,
5872 const uint8_t *data,
5873 size_t data_length )
5874{
5875 psa_status_t status;
5876 if( prf->state != TLS12_PRF_STATE_SEED_SET )
5877 return( PSA_ERROR_BAD_STATE );
5878
5879 status = psa_hmac_setup_internal( &prf->hmac, data, data_length, hash_alg );
5880 if( status != PSA_SUCCESS )
5881 return( status );
5882
5883 prf->state = TLS12_PRF_STATE_KEY_SET;
5884
5885 return( PSA_SUCCESS );
5886}
5887
Janos Follath63028dd2019-06-13 09:15:47 +01005888static psa_status_t psa_tls12_prf_set_label( psa_tls12_prf_key_derivation_t *prf,
5889 const uint8_t *data,
5890 size_t data_length )
5891{
5892 if( prf->state != TLS12_PRF_STATE_KEY_SET )
5893 return( PSA_ERROR_BAD_STATE );
5894
Janos Follathd6dce9f2019-07-04 09:11:38 +01005895 if( data_length != 0 )
5896 {
5897 prf->label = mbedtls_calloc( 1, data_length );
5898 if( prf->label == NULL )
5899 return( PSA_ERROR_INSUFFICIENT_MEMORY );
Janos Follath63028dd2019-06-13 09:15:47 +01005900
Janos Follathd6dce9f2019-07-04 09:11:38 +01005901 memcpy( prf->label, data, data_length );
5902 prf->label_length = data_length;
5903 }
Janos Follath63028dd2019-06-13 09:15:47 +01005904
5905 prf->state = TLS12_PRF_STATE_LABEL_SET;
5906
5907 return( PSA_SUCCESS );
5908}
5909
Janos Follathb03233e2019-06-11 15:30:30 +01005910static psa_status_t psa_tls12_prf_input( psa_tls12_prf_key_derivation_t *prf,
5911 psa_algorithm_t hash_alg,
5912 psa_key_derivation_step_t step,
5913 const uint8_t *data,
5914 size_t data_length )
5915{
Janos Follathb03233e2019-06-11 15:30:30 +01005916 switch( step )
5917 {
Janos Follathf08e2652019-06-13 09:05:41 +01005918 case PSA_KEY_DERIVATION_INPUT_SEED:
5919 return( psa_tls12_prf_set_seed( prf, data, data_length ) );
Janos Follath81550542019-06-13 14:26:34 +01005920 case PSA_KEY_DERIVATION_INPUT_SECRET:
5921 return( psa_tls12_prf_set_key( prf, hash_alg, data, data_length ) );
Janos Follath63028dd2019-06-13 09:15:47 +01005922 case PSA_KEY_DERIVATION_INPUT_LABEL:
5923 return( psa_tls12_prf_set_label( prf, data, data_length ) );
Janos Follathb03233e2019-06-11 15:30:30 +01005924 default:
5925 return( PSA_ERROR_INVALID_ARGUMENT );
5926 }
5927}
John Durkop07cc04a2020-11-16 22:08:34 -08005928#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) ||
5929 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
5930
5931#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
5932static psa_status_t psa_tls12_prf_psk_to_ms_set_key(
5933 psa_tls12_prf_key_derivation_t *prf,
5934 psa_algorithm_t hash_alg,
5935 const uint8_t *data,
5936 size_t data_length )
5937{
5938 psa_status_t status;
5939 uint8_t pms[ 4 + 2 * PSA_ALG_TLS12_PSK_TO_MS_MAX_PSK_LEN ];
5940 uint8_t *cur = pms;
5941
5942 if( data_length > PSA_ALG_TLS12_PSK_TO_MS_MAX_PSK_LEN )
5943 return( PSA_ERROR_INVALID_ARGUMENT );
5944
5945 /* Quoting RFC 4279, Section 2:
5946 *
5947 * The premaster secret is formed as follows: if the PSK is N octets
5948 * long, concatenate a uint16 with the value N, N zero octets, a second
5949 * uint16 with the value N, and the PSK itself.
5950 */
5951
5952 *cur++ = ( data_length >> 8 ) & 0xff;
5953 *cur++ = ( data_length >> 0 ) & 0xff;
5954 memset( cur, 0, data_length );
5955 cur += data_length;
5956 *cur++ = pms[0];
5957 *cur++ = pms[1];
5958 memcpy( cur, data, data_length );
5959 cur += data_length;
5960
5961 status = psa_tls12_prf_set_key( prf, hash_alg, pms, cur - pms );
5962
5963 mbedtls_platform_zeroize( pms, sizeof( pms ) );
5964 return( status );
5965}
Janos Follath6660f0e2019-06-17 08:44:03 +01005966
5967static psa_status_t psa_tls12_prf_psk_to_ms_input(
5968 psa_tls12_prf_key_derivation_t *prf,
5969 psa_algorithm_t hash_alg,
5970 psa_key_derivation_step_t step,
5971 const uint8_t *data,
5972 size_t data_length )
5973{
5974 if( step == PSA_KEY_DERIVATION_INPUT_SECRET )
Janos Follath0c1ed842019-06-28 13:35:36 +01005975 {
Janos Follath6660f0e2019-06-17 08:44:03 +01005976 return( psa_tls12_prf_psk_to_ms_set_key( prf, hash_alg,
5977 data, data_length ) );
Janos Follath0c1ed842019-06-28 13:35:36 +01005978 }
Janos Follath6660f0e2019-06-17 08:44:03 +01005979
5980 return( psa_tls12_prf_input( prf, hash_alg, step, data, data_length ) );
5981}
John Durkop07cc04a2020-11-16 22:08:34 -08005982#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005983
Gilles Peskineb8965192019-09-24 16:21:10 +02005984/** Check whether the given key type is acceptable for the given
5985 * input step of a key derivation.
5986 *
5987 * Secret inputs must have the type #PSA_KEY_TYPE_DERIVE.
5988 * Non-secret inputs must have the type #PSA_KEY_TYPE_RAW_DATA.
5989 * Both secret and non-secret inputs can alternatively have the type
5990 * #PSA_KEY_TYPE_NONE, which is never the type of a key object, meaning
5991 * that the input was passed as a buffer rather than via a key object.
5992 */
Gilles Peskine224b0d62019-09-23 18:13:17 +02005993static int psa_key_derivation_check_input_type(
5994 psa_key_derivation_step_t step,
5995 psa_key_type_t key_type )
5996{
5997 switch( step )
5998 {
5999 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskineb8965192019-09-24 16:21:10 +02006000 if( key_type == PSA_KEY_TYPE_DERIVE )
6001 return( PSA_SUCCESS );
6002 if( key_type == PSA_KEY_TYPE_NONE )
Gilles Peskine224b0d62019-09-23 18:13:17 +02006003 return( PSA_SUCCESS );
6004 break;
6005 case PSA_KEY_DERIVATION_INPUT_LABEL:
6006 case PSA_KEY_DERIVATION_INPUT_SALT:
6007 case PSA_KEY_DERIVATION_INPUT_INFO:
6008 case PSA_KEY_DERIVATION_INPUT_SEED:
Gilles Peskineb8965192019-09-24 16:21:10 +02006009 if( key_type == PSA_KEY_TYPE_RAW_DATA )
6010 return( PSA_SUCCESS );
6011 if( key_type == PSA_KEY_TYPE_NONE )
Gilles Peskine224b0d62019-09-23 18:13:17 +02006012 return( PSA_SUCCESS );
6013 break;
6014 }
6015 return( PSA_ERROR_INVALID_ARGUMENT );
6016}
6017
Janos Follathb80a94e2019-06-12 15:54:46 +01006018static psa_status_t psa_key_derivation_input_internal(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006019 psa_key_derivation_operation_t *operation,
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01006020 psa_key_derivation_step_t step,
Gilles Peskine224b0d62019-09-23 18:13:17 +02006021 psa_key_type_t key_type,
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01006022 const uint8_t *data,
6023 size_t data_length )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006024{
Gilles Peskine46d7faf2019-09-23 19:22:55 +02006025 psa_status_t status;
6026 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg( operation );
6027
6028 status = psa_key_derivation_check_input_type( step, key_type );
Gilles Peskine224b0d62019-09-23 18:13:17 +02006029 if( status != PSA_SUCCESS )
6030 goto exit;
6031
John Durkopd0321952020-10-29 21:37:36 -07006032#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Gilles Peskine969c5d62019-01-16 15:53:06 +01006033 if( PSA_ALG_IS_HKDF( kdf_alg ) )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006034 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006035 status = psa_hkdf_input( &operation->ctx.hkdf,
Gilles Peskine969c5d62019-01-16 15:53:06 +01006036 PSA_ALG_HKDF_GET_HASH( kdf_alg ),
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006037 step, data, data_length );
6038 }
John Durkop07cc04a2020-11-16 22:08:34 -08006039 else
6040#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */
6041#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF)
6042 if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006043 {
Janos Follathb03233e2019-06-11 15:30:30 +01006044 status = psa_tls12_prf_input( &operation->ctx.tls12_prf,
6045 PSA_ALG_HKDF_GET_HASH( kdf_alg ),
6046 step, data, data_length );
Janos Follath6660f0e2019-06-17 08:44:03 +01006047 }
John Durkop07cc04a2020-11-16 22:08:34 -08006048 else
6049#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF */
6050#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
6051 if( PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Janos Follath6660f0e2019-06-17 08:44:03 +01006052 {
6053 status = psa_tls12_prf_psk_to_ms_input( &operation->ctx.tls12_prf,
6054 PSA_ALG_HKDF_GET_HASH( kdf_alg ),
6055 step, data, data_length );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006056 }
6057 else
John Durkop07cc04a2020-11-16 22:08:34 -08006058#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006059 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006060 /* This can't happen unless the operation object was not initialized */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006061 return( PSA_ERROR_BAD_STATE );
6062 }
6063
Gilles Peskine224b0d62019-09-23 18:13:17 +02006064exit:
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006065 if( status != PSA_SUCCESS )
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006066 psa_key_derivation_abort( operation );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006067 return( status );
6068}
6069
Janos Follath51f4a0f2019-06-14 11:35:55 +01006070psa_status_t psa_key_derivation_input_bytes(
6071 psa_key_derivation_operation_t *operation,
6072 psa_key_derivation_step_t step,
6073 const uint8_t *data,
6074 size_t data_length )
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01006075{
Gilles Peskineb8965192019-09-24 16:21:10 +02006076 return( psa_key_derivation_input_internal( operation, step,
6077 PSA_KEY_TYPE_NONE,
Janos Follathc5621512019-06-14 11:27:57 +01006078 data, data_length ) );
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01006079}
6080
Janos Follath51f4a0f2019-06-14 11:35:55 +01006081psa_status_t psa_key_derivation_input_key(
6082 psa_key_derivation_operation_t *operation,
6083 psa_key_derivation_step_t step,
Ronald Croncf56a0a2020-08-04 09:51:30 +02006084 mbedtls_svc_key_id_t key )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006085{
Ronald Cronf95a2b12020-10-22 15:24:49 +02006086 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01006087 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006088 psa_key_slot_t *slot;
Gilles Peskine178c9aa2019-09-24 18:21:06 +02006089
Ronald Cron5c522922020-11-14 16:35:34 +01006090 status = psa_get_and_lock_transparent_key_slot_with_policy(
6091 key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006092 if( status != PSA_SUCCESS )
Gilles Peskine593773d2019-09-23 18:17:40 +02006093 {
6094 psa_key_derivation_abort( operation );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006095 return( status );
Gilles Peskine593773d2019-09-23 18:17:40 +02006096 }
Gilles Peskine178c9aa2019-09-24 18:21:06 +02006097
6098 /* Passing a key object as a SECRET input unlocks the permission
6099 * to output to a key object. */
6100 if( step == PSA_KEY_DERIVATION_INPUT_SECRET )
6101 operation->can_output_key = 1;
6102
Ronald Cronf95a2b12020-10-22 15:24:49 +02006103 status = psa_key_derivation_input_internal( operation,
6104 step, slot->attr.type,
6105 slot->data.key.data,
6106 slot->data.key.bytes );
6107
Ronald Cron5c522922020-11-14 16:35:34 +01006108 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02006109
Ronald Cron5c522922020-11-14 16:35:34 +01006110 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006111}
Gilles Peskineea0fb492018-07-12 17:17:20 +02006112
6113
6114
6115/****************************************************************/
Gilles Peskine01d718c2018-09-18 12:01:02 +02006116/* Key agreement */
6117/****************************************************************/
6118
John Durkop6ba40d12020-11-10 08:50:04 -08006119#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02006120static psa_status_t psa_key_agreement_ecdh( const uint8_t *peer_key,
6121 size_t peer_key_length,
6122 const mbedtls_ecp_keypair *our_key,
6123 uint8_t *shared_secret,
6124 size_t shared_secret_size,
6125 size_t *shared_secret_length )
6126{
Steven Cooremand4867872020-08-05 16:31:39 +02006127 mbedtls_ecp_keypair *their_key = NULL;
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02006128 mbedtls_ecdh_context ecdh;
Jaeden Amero97271b32019-01-10 19:38:51 +00006129 psa_status_t status;
Gilles Peskinec7ef5b32019-12-12 16:58:00 +01006130 size_t bits = 0;
Paul Elliott8ff510a2020-06-02 17:19:28 +01006131 psa_ecc_family_t curve = mbedtls_ecc_group_to_psa( our_key->grp.id, &bits );
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02006132 mbedtls_ecdh_init( &ecdh );
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02006133
Steven Cooreman4fed4552020-08-03 14:46:03 +02006134 status = psa_load_ecp_representation( PSA_KEY_TYPE_ECC_PUBLIC_KEY(curve),
6135 peer_key,
Steven Cooreman7f391872020-07-30 14:57:44 +02006136 peer_key_length,
Steven Cooreman7f391872020-07-30 14:57:44 +02006137 &their_key );
Jaeden Amero97271b32019-01-10 19:38:51 +00006138 if( status != PSA_SUCCESS )
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02006139 goto exit;
6140
Jaeden Amero97271b32019-01-10 19:38:51 +00006141 status = mbedtls_to_psa_error(
Steven Cooremana2371e52020-07-28 14:30:39 +02006142 mbedtls_ecdh_get_params( &ecdh, their_key, MBEDTLS_ECDH_THEIRS ) );
Jaeden Amero97271b32019-01-10 19:38:51 +00006143 if( status != PSA_SUCCESS )
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02006144 goto exit;
Jaeden Amero97271b32019-01-10 19:38:51 +00006145 status = mbedtls_to_psa_error(
6146 mbedtls_ecdh_get_params( &ecdh, our_key, MBEDTLS_ECDH_OURS ) );
6147 if( status != PSA_SUCCESS )
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02006148 goto exit;
6149
Jaeden Amero97271b32019-01-10 19:38:51 +00006150 status = mbedtls_to_psa_error(
6151 mbedtls_ecdh_calc_secret( &ecdh,
6152 shared_secret_length,
6153 shared_secret, shared_secret_size,
Gilles Peskine30524eb2020-11-13 17:02:26 +01006154 mbedtls_psa_get_random,
Gilles Peskine5894e8e2020-12-14 14:54:06 +01006155 MBEDTLS_PSA_RANDOM_STATE ) );
Gilles Peskinec7ef5b32019-12-12 16:58:00 +01006156 if( status != PSA_SUCCESS )
6157 goto exit;
6158 if( PSA_BITS_TO_BYTES( bits ) != *shared_secret_length )
6159 status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02006160
6161exit:
Gilles Peskine3e819b72019-12-20 14:09:55 +01006162 if( status != PSA_SUCCESS )
6163 mbedtls_platform_zeroize( shared_secret, shared_secret_size );
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02006164 mbedtls_ecdh_free( &ecdh );
Steven Cooremana2371e52020-07-28 14:30:39 +02006165 mbedtls_ecp_keypair_free( their_key );
Steven Cooreman6d839f02020-07-30 11:36:45 +02006166 mbedtls_free( their_key );
Steven Cooremana2371e52020-07-28 14:30:39 +02006167
Jaeden Amero97271b32019-01-10 19:38:51 +00006168 return( status );
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02006169}
John Durkop6ba40d12020-11-10 08:50:04 -08006170#endif /* MBEDTLS_PSA_BUILTIN_ALG_ECDH */
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02006171
Gilles Peskine01d718c2018-09-18 12:01:02 +02006172#define PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE MBEDTLS_ECP_MAX_BYTES
6173
Gilles Peskine0216fe12019-04-11 21:23:21 +02006174static psa_status_t psa_key_agreement_raw_internal( psa_algorithm_t alg,
6175 psa_key_slot_t *private_key,
6176 const uint8_t *peer_key,
6177 size_t peer_key_length,
6178 uint8_t *shared_secret,
6179 size_t shared_secret_size,
6180 size_t *shared_secret_length )
Gilles Peskine01d718c2018-09-18 12:01:02 +02006181{
Gilles Peskine0216fe12019-04-11 21:23:21 +02006182 switch( alg )
Gilles Peskine01d718c2018-09-18 12:01:02 +02006183 {
John Durkop6ba40d12020-11-10 08:50:04 -08006184#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
Gilles Peskine0216fe12019-04-11 21:23:21 +02006185 case PSA_ALG_ECDH:
Gilles Peskine8e338702019-07-30 20:06:31 +02006186 if( ! PSA_KEY_TYPE_IS_ECC_KEY_PAIR( private_key->attr.type ) )
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02006187 return( PSA_ERROR_INVALID_ARGUMENT );
Steven Cooremana2371e52020-07-28 14:30:39 +02006188 mbedtls_ecp_keypair *ecp = NULL;
Steven Cooreman7f391872020-07-30 14:57:44 +02006189 psa_status_t status = psa_load_ecp_representation(
Steven Cooreman4fed4552020-08-03 14:46:03 +02006190 private_key->attr.type,
Steven Cooreman7f391872020-07-30 14:57:44 +02006191 private_key->data.key.data,
6192 private_key->data.key.bytes,
Steven Cooreman7f391872020-07-30 14:57:44 +02006193 &ecp );
Steven Cooremanacda8342020-07-24 23:09:52 +02006194 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02006195 return( status );
Steven Cooremanacda8342020-07-24 23:09:52 +02006196 status = psa_key_agreement_ecdh( peer_key, peer_key_length,
Steven Cooremana2371e52020-07-28 14:30:39 +02006197 ecp,
Steven Cooremanacda8342020-07-24 23:09:52 +02006198 shared_secret, shared_secret_size,
6199 shared_secret_length );
Steven Cooremana2371e52020-07-28 14:30:39 +02006200 mbedtls_ecp_keypair_free( ecp );
6201 mbedtls_free( ecp );
Steven Cooreman29149862020-08-05 15:43:42 +02006202 return( status );
John Durkop6ba40d12020-11-10 08:50:04 -08006203#endif /* MBEDTLS_PSA_BUILTIN_ALG_ECDH */
Gilles Peskine01d718c2018-09-18 12:01:02 +02006204 default:
Gilles Peskine93f85002018-11-16 16:43:31 +01006205 (void) private_key;
6206 (void) peer_key;
6207 (void) peer_key_length;
Gilles Peskine0216fe12019-04-11 21:23:21 +02006208 (void) shared_secret;
6209 (void) shared_secret_size;
6210 (void) shared_secret_length;
Gilles Peskine01d718c2018-09-18 12:01:02 +02006211 return( PSA_ERROR_NOT_SUPPORTED );
6212 }
Gilles Peskine0216fe12019-04-11 21:23:21 +02006213}
6214
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02006215/* Note that if this function fails, you must call psa_key_derivation_abort()
Gilles Peskine01d718c2018-09-18 12:01:02 +02006216 * to potentially free embedded data structures and wipe confidential data.
6217 */
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006218static psa_status_t psa_key_agreement_internal( psa_key_derivation_operation_t *operation,
Gilles Peskine969c5d62019-01-16 15:53:06 +01006219 psa_key_derivation_step_t step,
Gilles Peskine01d718c2018-09-18 12:01:02 +02006220 psa_key_slot_t *private_key,
6221 const uint8_t *peer_key,
Gilles Peskine969c5d62019-01-16 15:53:06 +01006222 size_t peer_key_length )
Gilles Peskine01d718c2018-09-18 12:01:02 +02006223{
6224 psa_status_t status;
6225 uint8_t shared_secret[PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE];
6226 size_t shared_secret_length = 0;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006227 psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE( operation->alg );
Gilles Peskine01d718c2018-09-18 12:01:02 +02006228
6229 /* Step 1: run the secret agreement algorithm to generate the shared
6230 * secret. */
Gilles Peskine0216fe12019-04-11 21:23:21 +02006231 status = psa_key_agreement_raw_internal( ka_alg,
6232 private_key,
6233 peer_key, peer_key_length,
itayzafrir0adf0fc2018-09-06 16:24:41 +03006234 shared_secret,
6235 sizeof( shared_secret ),
Gilles Peskine05d69892018-06-19 22:00:52 +02006236 &shared_secret_length );
Gilles Peskine53d991e2018-07-12 01:14:59 +02006237 if( status != PSA_SUCCESS )
Gilles Peskine12313cd2018-06-20 00:20:32 +02006238 goto exit;
6239
Gilles Peskineb0b255c2018-07-06 17:01:38 +02006240 /* Step 2: set up the key derivation to generate key material from
Gilles Peskine224b0d62019-09-23 18:13:17 +02006241 * the shared secret. A shared secret is permitted wherever a key
6242 * of type DERIVE is permitted. */
Janos Follathb80a94e2019-06-12 15:54:46 +01006243 status = psa_key_derivation_input_internal( operation, step,
Gilles Peskine224b0d62019-09-23 18:13:17 +02006244 PSA_KEY_TYPE_DERIVE,
Janos Follathb80a94e2019-06-12 15:54:46 +01006245 shared_secret,
6246 shared_secret_length );
Gilles Peskine12313cd2018-06-20 00:20:32 +02006247exit:
Gilles Peskine3f108122018-12-07 18:14:53 +01006248 mbedtls_platform_zeroize( shared_secret, shared_secret_length );
Gilles Peskine12313cd2018-06-20 00:20:32 +02006249 return( status );
6250}
6251
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006252psa_status_t psa_key_derivation_key_agreement( psa_key_derivation_operation_t *operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02006253 psa_key_derivation_step_t step,
Ronald Croncf56a0a2020-08-04 09:51:30 +02006254 mbedtls_svc_key_id_t private_key,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02006255 const uint8_t *peer_key,
6256 size_t peer_key_length )
Gilles Peskine12313cd2018-06-20 00:20:32 +02006257{
Ronald Cronf95a2b12020-10-22 15:24:49 +02006258 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01006259 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01006260 psa_key_slot_t *slot;
Ronald Cronf95a2b12020-10-22 15:24:49 +02006261
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006262 if( ! PSA_ALG_IS_KEY_AGREEMENT( operation->alg ) )
Gilles Peskine12313cd2018-06-20 00:20:32 +02006263 return( PSA_ERROR_INVALID_ARGUMENT );
Ronald Cron5c522922020-11-14 16:35:34 +01006264 status = psa_get_and_lock_transparent_key_slot_with_policy(
6265 private_key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg );
Gilles Peskine12313cd2018-06-20 00:20:32 +02006266 if( status != PSA_SUCCESS )
6267 return( status );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006268 status = psa_key_agreement_internal( operation, step,
Gilles Peskine346797d2018-11-16 16:05:06 +01006269 slot,
Gilles Peskine969c5d62019-01-16 15:53:06 +01006270 peer_key, peer_key_length );
Gilles Peskine346797d2018-11-16 16:05:06 +01006271 if( status != PSA_SUCCESS )
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006272 psa_key_derivation_abort( operation );
Steven Cooremanfa5e6312020-10-15 17:07:12 +02006273 else
6274 {
6275 /* If a private key has been added as SECRET, we allow the derived
6276 * key material to be used as a key in PSA Crypto. */
6277 if( step == PSA_KEY_DERIVATION_INPUT_SECRET )
6278 operation->can_output_key = 1;
6279 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02006280
Ronald Cron5c522922020-11-14 16:35:34 +01006281 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02006282
Ronald Cron5c522922020-11-14 16:35:34 +01006283 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskineaf3baab2018-06-27 22:55:52 +02006284}
6285
Gilles Peskinebe697d82019-05-16 18:00:41 +02006286psa_status_t psa_raw_key_agreement( psa_algorithm_t alg,
Ronald Croncf56a0a2020-08-04 09:51:30 +02006287 mbedtls_svc_key_id_t private_key,
Gilles Peskinebe697d82019-05-16 18:00:41 +02006288 const uint8_t *peer_key,
6289 size_t peer_key_length,
6290 uint8_t *output,
6291 size_t output_size,
6292 size_t *output_length )
Gilles Peskine0216fe12019-04-11 21:23:21 +02006293{
Ronald Cronf95a2b12020-10-22 15:24:49 +02006294 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01006295 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cronf95a2b12020-10-22 15:24:49 +02006296 psa_key_slot_t *slot = NULL;
Gilles Peskine0216fe12019-04-11 21:23:21 +02006297
6298 if( ! PSA_ALG_IS_KEY_AGREEMENT( alg ) )
6299 {
6300 status = PSA_ERROR_INVALID_ARGUMENT;
6301 goto exit;
6302 }
Ronald Cron5c522922020-11-14 16:35:34 +01006303 status = psa_get_and_lock_transparent_key_slot_with_policy(
6304 private_key, &slot, PSA_KEY_USAGE_DERIVE, alg );
Gilles Peskine0216fe12019-04-11 21:23:21 +02006305 if( status != PSA_SUCCESS )
6306 goto exit;
6307
6308 status = psa_key_agreement_raw_internal( alg, slot,
6309 peer_key, peer_key_length,
6310 output, output_size,
6311 output_length );
6312
6313exit:
6314 if( status != PSA_SUCCESS )
6315 {
6316 /* If an error happens and is not handled properly, the output
6317 * may be used as a key to protect sensitive data. Arrange for such
6318 * a key to be random, which is likely to result in decryption or
6319 * verification errors. This is better than filling the buffer with
6320 * some constant data such as zeros, which would result in the data
6321 * being protected with a reproducible, easily knowable key.
6322 */
6323 psa_generate_random( output, output_size );
6324 *output_length = output_size;
6325 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02006326
Ronald Cron5c522922020-11-14 16:35:34 +01006327 unlock_status = psa_unlock_key_slot( slot );
Ronald Cronf95a2b12020-10-22 15:24:49 +02006328
Ronald Cron5c522922020-11-14 16:35:34 +01006329 return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Gilles Peskine0216fe12019-04-11 21:23:21 +02006330}
Gilles Peskine86a440b2018-11-12 18:39:40 +01006331
6332
Gilles Peskine30524eb2020-11-13 17:02:26 +01006333
Gilles Peskine86a440b2018-11-12 18:39:40 +01006334/****************************************************************/
6335/* Random generation */
Gilles Peskine53d991e2018-07-12 01:14:59 +02006336/****************************************************************/
Gilles Peskine12313cd2018-06-20 00:20:32 +02006337
Gilles Peskine30524eb2020-11-13 17:02:26 +01006338/** Initialize the PSA random generator.
6339 */
6340static void mbedtls_psa_random_init( mbedtls_psa_random_context_t *rng )
6341{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01006342#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
6343 memset( rng, 0, sizeof( *rng ) );
6344#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
6345
Gilles Peskine30524eb2020-11-13 17:02:26 +01006346 /* Set default configuration if
6347 * mbedtls_psa_crypto_configure_entropy_sources() hasn't been called. */
6348 if( rng->entropy_init == NULL )
6349 rng->entropy_init = mbedtls_entropy_init;
6350 if( rng->entropy_free == NULL )
6351 rng->entropy_free = mbedtls_entropy_free;
6352
6353 rng->entropy_init( &rng->entropy );
6354#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \
6355 defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES)
6356 /* The PSA entropy injection feature depends on using NV seed as an entropy
6357 * source. Add NV seed as an entropy source for PSA entropy injection. */
6358 mbedtls_entropy_add_source( &rng->entropy,
6359 mbedtls_nv_seed_poll, NULL,
6360 MBEDTLS_ENTROPY_BLOCK_SIZE,
6361 MBEDTLS_ENTROPY_SOURCE_STRONG );
6362#endif
6363
Gilles Peskine5894e8e2020-12-14 14:54:06 +01006364 mbedtls_psa_drbg_init( MBEDTLS_PSA_RANDOM_STATE );
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01006365#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01006366}
6367
6368/** Deinitialize the PSA random generator.
6369 */
6370static void mbedtls_psa_random_free( mbedtls_psa_random_context_t *rng )
6371{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01006372#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
6373 memset( rng, 0, sizeof( *rng ) );
6374#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine5894e8e2020-12-14 14:54:06 +01006375 mbedtls_psa_drbg_free( MBEDTLS_PSA_RANDOM_STATE );
Gilles Peskine30524eb2020-11-13 17:02:26 +01006376 rng->entropy_free( &rng->entropy );
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01006377#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01006378}
6379
6380/** Seed the PSA random generator.
6381 */
6382static psa_status_t mbedtls_psa_random_seed( mbedtls_psa_random_context_t *rng )
6383{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01006384#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
6385 /* Do nothing: the external RNG seeds itself. */
6386 (void) rng;
6387 return( PSA_SUCCESS );
6388#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01006389 const unsigned char drbg_seed[] = "PSA";
Gilles Peskine5894e8e2020-12-14 14:54:06 +01006390 int ret = mbedtls_psa_drbg_seed( &rng->entropy,
6391 drbg_seed, sizeof( drbg_seed ) - 1 );
Gilles Peskine30524eb2020-11-13 17:02:26 +01006392 return mbedtls_to_psa_error( ret );
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01006393#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01006394}
6395
Gilles Peskinee59236f2018-01-27 23:32:46 +01006396psa_status_t psa_generate_random( uint8_t *output,
6397 size_t output_size )
6398{
Gilles Peskinee59236f2018-01-27 23:32:46 +01006399 GUARD_MODULE_INITIALIZED;
6400
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01006401#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
6402
6403 size_t output_length = 0;
6404 psa_status_t status = mbedtls_psa_external_get_random( &global_data.rng,
6405 output, output_size,
6406 &output_length );
6407 if( status != PSA_SUCCESS )
6408 return( status );
6409 /* Breaking up a request into smaller chunks is currently not supported
6410 * for the extrernal RNG interface. */
6411 if( output_length != output_size )
6412 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
6413 return( PSA_SUCCESS );
6414
6415#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
6416
Gilles Peskine71ddab92021-01-04 21:01:07 +01006417 while( output_size > 0 )
Gilles Peskinef181eca2019-08-07 13:49:00 +02006418 {
Gilles Peskine71ddab92021-01-04 21:01:07 +01006419 size_t request_size =
6420 ( output_size > MBEDTLS_PSA_RANDOM_MAX_REQUEST ?
6421 MBEDTLS_PSA_RANDOM_MAX_REQUEST :
6422 output_size );
Gilles Peskine0c59ba82021-01-05 14:10:59 +01006423 int ret = mbedtls_psa_get_random( MBEDTLS_PSA_RANDOM_STATE,
6424 output, request_size );
Gilles Peskinef181eca2019-08-07 13:49:00 +02006425 if( ret != 0 )
6426 return( mbedtls_to_psa_error( ret ) );
Gilles Peskine71ddab92021-01-04 21:01:07 +01006427 output_size -= request_size;
6428 output += request_size;
Gilles Peskinef181eca2019-08-07 13:49:00 +02006429 }
Gilles Peskine0c59ba82021-01-05 14:10:59 +01006430 return( PSA_SUCCESS );
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01006431#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskinee59236f2018-01-27 23:32:46 +01006432}
6433
Gilles Peskine8814fc42020-12-14 15:33:44 +01006434/* Wrapper function allowing the classic API to use the PSA RNG.
Gilles Peskine9c3e0602021-01-05 16:03:55 +01006435 *
6436 * `mbedtls_psa_get_random(MBEDTLS_PSA_RANDOM_STATE, ...)` calls
6437 * `psa_generate_random(...)`. The state parameter is ignored since the
6438 * PSA API doesn't support passing an explicit state.
6439 *
6440 * In the non-external case, psa_generate_random() calls an
6441 * `mbedtls_xxx_drbg_random` function which has exactly the same signature
6442 * and semantics as mbedtls_psa_get_random(). As an optimization,
6443 * instead of doing this back-and-forth between the PSA API and the
6444 * classic API, psa_crypto_random_impl.h defines `mbedtls_psa_get_random`
6445 * as a constant function pointer to `mbedtls_xxx_drbg_random`.
Gilles Peskine8814fc42020-12-14 15:33:44 +01006446 */
6447#if defined (MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
6448int mbedtls_psa_get_random( void *p_rng,
6449 unsigned char *output,
6450 size_t output_size )
6451{
Gilles Peskine9c3e0602021-01-05 16:03:55 +01006452 /* This function takes a pointer to the RNG state because that's what
6453 * classic mbedtls functions using an RNG expect. The PSA RNG manages
6454 * its own state internally and doesn't let the caller access that state.
6455 * So we just ignore the state parameter, and in practice we'll pass
6456 * NULL. */
Gilles Peskine8814fc42020-12-14 15:33:44 +01006457 (void) p_rng;
6458 psa_status_t status = psa_generate_random( output, output_size );
6459 if( status == PSA_SUCCESS )
6460 return( 0 );
6461 else
6462 return( MBEDTLS_ERR_ENTROPY_SOURCE_FAILED );
6463}
6464#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
6465
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01006466#if defined(MBEDTLS_PSA_INJECT_ENTROPY)
6467#include "mbedtls/entropy_poll.h"
6468
Gilles Peskine7228da22019-07-15 11:06:15 +02006469psa_status_t mbedtls_psa_inject_entropy( const uint8_t *seed,
Netanel Gonen2bcd3122018-11-19 11:53:02 +02006470 size_t seed_size )
6471{
Netanel Gonen2bcd3122018-11-19 11:53:02 +02006472 if( global_data.initialized )
6473 return( PSA_ERROR_NOT_PERMITTED );
Netanel Gonen21f37cb2018-11-19 11:53:55 +02006474
6475 if( ( ( seed_size < MBEDTLS_ENTROPY_MIN_PLATFORM ) ||
6476 ( seed_size < MBEDTLS_ENTROPY_BLOCK_SIZE ) ) ||
6477 ( seed_size > MBEDTLS_ENTROPY_MAX_SEED_SIZE ) )
6478 return( PSA_ERROR_INVALID_ARGUMENT );
6479
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01006480 return( mbedtls_psa_storage_inject_entropy( seed, seed_size ) );
Netanel Gonen2bcd3122018-11-19 11:53:02 +02006481}
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01006482#endif /* MBEDTLS_PSA_INJECT_ENTROPY */
Netanel Gonen2bcd3122018-11-19 11:53:02 +02006483
John Durkop07cc04a2020-11-16 22:08:34 -08006484#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR)
Gilles Peskinee56e8782019-04-26 17:34:02 +02006485static psa_status_t psa_read_rsa_exponent( const uint8_t *domain_parameters,
6486 size_t domain_parameters_size,
6487 int *exponent )
Gilles Peskinee59236f2018-01-27 23:32:46 +01006488{
Gilles Peskinee56e8782019-04-26 17:34:02 +02006489 size_t i;
6490 uint32_t acc = 0;
Gilles Peskinee59236f2018-01-27 23:32:46 +01006491
Gilles Peskinee56e8782019-04-26 17:34:02 +02006492 if( domain_parameters_size == 0 )
6493 {
6494 *exponent = 65537;
6495 return( PSA_SUCCESS );
6496 }
6497
6498 /* Mbed TLS encodes the public exponent as an int. For simplicity, only
6499 * support values that fit in a 32-bit integer, which is larger than
6500 * int on just about every platform anyway. */
6501 if( domain_parameters_size > sizeof( acc ) )
6502 return( PSA_ERROR_NOT_SUPPORTED );
6503 for( i = 0; i < domain_parameters_size; i++ )
6504 acc = ( acc << 8 ) | domain_parameters[i];
6505 if( acc > INT_MAX )
6506 return( PSA_ERROR_NOT_SUPPORTED );
6507 *exponent = acc;
6508 return( PSA_SUCCESS );
6509}
John Durkop07cc04a2020-11-16 22:08:34 -08006510#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) */
Gilles Peskinee56e8782019-04-26 17:34:02 +02006511
Gilles Peskine35ef36b2019-05-16 19:42:05 +02006512static psa_status_t psa_generate_key_internal(
Gilles Peskinee56e8782019-04-26 17:34:02 +02006513 psa_key_slot_t *slot, size_t bits,
6514 const uint8_t *domain_parameters, size_t domain_parameters_size )
Gilles Peskinee59236f2018-01-27 23:32:46 +01006515{
Gilles Peskine8e338702019-07-30 20:06:31 +02006516 psa_key_type_t type = slot->attr.type;
Gilles Peskinee59236f2018-01-27 23:32:46 +01006517
Gilles Peskinee56e8782019-04-26 17:34:02 +02006518 if( domain_parameters == NULL && domain_parameters_size != 0 )
Gilles Peskinee59236f2018-01-27 23:32:46 +01006519 return( PSA_ERROR_INVALID_ARGUMENT );
6520
Gilles Peskinee59236f2018-01-27 23:32:46 +01006521 if( key_type_is_raw_bytes( type ) )
6522 {
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006523 psa_status_t status;
Steven Cooreman81be2fa2020-07-24 22:04:59 +02006524
6525 status = validate_unstructured_key_bit_size( slot->attr.type, bits );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006526 if( status != PSA_SUCCESS )
6527 return( status );
Steven Cooreman81be2fa2020-07-24 22:04:59 +02006528
6529 /* Allocate memory for the key */
Steven Cooreman75b74362020-07-28 14:30:13 +02006530 status = psa_allocate_buffer_to_slot( slot, PSA_BITS_TO_BYTES( bits ) );
6531 if( status != PSA_SUCCESS )
Steven Cooreman29149862020-08-05 15:43:42 +02006532 return( status );
Steven Cooreman81be2fa2020-07-24 22:04:59 +02006533
Steven Cooreman71fd80d2020-07-07 21:12:27 +02006534 status = psa_generate_random( slot->data.key.data,
6535 slot->data.key.bytes );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006536 if( status != PSA_SUCCESS )
Gilles Peskinee59236f2018-01-27 23:32:46 +01006537 return( status );
Steven Cooreman81be2fa2020-07-24 22:04:59 +02006538
6539 slot->attr.bits = (psa_key_bits_t) bits;
Gilles Peskinee59236f2018-01-27 23:32:46 +01006540#if defined(MBEDTLS_DES_C)
6541 if( type == PSA_KEY_TYPE_DES )
Steven Cooreman71fd80d2020-07-07 21:12:27 +02006542 psa_des_set_key_parity( slot->data.key.data,
6543 slot->data.key.bytes );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006544#endif /* MBEDTLS_DES_C */
6545 }
6546 else
6547
John Durkop07cc04a2020-11-16 22:08:34 -08006548#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR)
Gilles Peskinec93b80c2019-05-16 19:39:54 +02006549 if ( type == PSA_KEY_TYPE_RSA_KEY_PAIR )
Gilles Peskinee59236f2018-01-27 23:32:46 +01006550 {
Steven Cooremana01795d2020-07-24 22:48:15 +02006551 mbedtls_rsa_context rsa;
Janos Follath24eed8d2019-11-22 13:21:35 +00006552 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskinee56e8782019-04-26 17:34:02 +02006553 int exponent;
6554 psa_status_t status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01006555 if( bits > PSA_VENDOR_RSA_MAX_KEY_BITS )
6556 return( PSA_ERROR_NOT_SUPPORTED );
6557 /* Accept only byte-aligned keys, for the same reasons as
6558 * in psa_import_rsa_key(). */
6559 if( bits % 8 != 0 )
6560 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskinee56e8782019-04-26 17:34:02 +02006561 status = psa_read_rsa_exponent( domain_parameters,
6562 domain_parameters_size,
6563 &exponent );
6564 if( status != PSA_SUCCESS )
6565 return( status );
Steven Cooremana01795d2020-07-24 22:48:15 +02006566 mbedtls_rsa_init( &rsa, MBEDTLS_RSA_PKCS_V15, MBEDTLS_MD_NONE );
6567 ret = mbedtls_rsa_gen_key( &rsa,
Gilles Peskine30524eb2020-11-13 17:02:26 +01006568 mbedtls_psa_get_random,
Gilles Peskine5894e8e2020-12-14 14:54:06 +01006569 MBEDTLS_PSA_RANDOM_STATE,
Gilles Peskinee59236f2018-01-27 23:32:46 +01006570 (unsigned int) bits,
6571 exponent );
6572 if( ret != 0 )
Gilles Peskinee59236f2018-01-27 23:32:46 +01006573 return( mbedtls_to_psa_error( ret ) );
Steven Cooremana01795d2020-07-24 22:48:15 +02006574
6575 /* Make sure to always have an export representation available */
6576 size_t bytes = PSA_KEY_EXPORT_RSA_KEY_PAIR_MAX_SIZE( bits );
6577
Steven Cooreman75b74362020-07-28 14:30:13 +02006578 status = psa_allocate_buffer_to_slot( slot, bytes );
6579 if( status != PSA_SUCCESS )
Steven Cooremana01795d2020-07-24 22:48:15 +02006580 {
6581 mbedtls_rsa_free( &rsa );
Steven Cooreman29149862020-08-05 15:43:42 +02006582 return( status );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006583 }
Steven Cooremana01795d2020-07-24 22:48:15 +02006584
6585 status = psa_export_rsa_key( type,
6586 &rsa,
6587 slot->data.key.data,
6588 bytes,
6589 &slot->data.key.bytes );
6590 mbedtls_rsa_free( &rsa );
6591 if( status != PSA_SUCCESS )
Steven Cooremana01795d2020-07-24 22:48:15 +02006592 psa_remove_key_data_from_memory( slot );
Steven Cooreman560c28a2020-07-24 23:20:24 +02006593 return( status );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006594 }
6595 else
John Durkop07cc04a2020-11-16 22:08:34 -08006596#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) */
Gilles Peskinee59236f2018-01-27 23:32:46 +01006597
John Durkop9814fa22020-11-04 12:28:15 -08006598#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR)
Gilles Peskinec93b80c2019-05-16 19:39:54 +02006599 if ( PSA_KEY_TYPE_IS_ECC( type ) && PSA_KEY_TYPE_IS_KEY_PAIR( type ) )
Gilles Peskinee59236f2018-01-27 23:32:46 +01006600 {
Paul Elliott8ff510a2020-06-02 17:19:28 +01006601 psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY( type );
Gilles Peskine4295e8b2019-12-02 21:39:10 +01006602 mbedtls_ecp_group_id grp_id =
6603 mbedtls_ecc_group_of_psa( curve, PSA_BITS_TO_BYTES( bits ) );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006604 const mbedtls_ecp_curve_info *curve_info =
6605 mbedtls_ecp_curve_info_from_grp_id( grp_id );
Steven Cooremanacda8342020-07-24 23:09:52 +02006606 mbedtls_ecp_keypair ecp;
Janos Follath24eed8d2019-11-22 13:21:35 +00006607 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskinee56e8782019-04-26 17:34:02 +02006608 if( domain_parameters_size != 0 )
Gilles Peskinee59236f2018-01-27 23:32:46 +01006609 return( PSA_ERROR_NOT_SUPPORTED );
6610 if( grp_id == MBEDTLS_ECP_DP_NONE || curve_info == NULL )
6611 return( PSA_ERROR_NOT_SUPPORTED );
Steven Cooremanacda8342020-07-24 23:09:52 +02006612 mbedtls_ecp_keypair_init( &ecp );
6613 ret = mbedtls_ecp_gen_key( grp_id, &ecp,
Gilles Peskine30524eb2020-11-13 17:02:26 +01006614 mbedtls_psa_get_random,
Gilles Peskine5894e8e2020-12-14 14:54:06 +01006615 MBEDTLS_PSA_RANDOM_STATE );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006616 if( ret != 0 )
6617 {
Steven Cooremanacda8342020-07-24 23:09:52 +02006618 mbedtls_ecp_keypair_free( &ecp );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006619 return( mbedtls_to_psa_error( ret ) );
6620 }
Steven Cooremanacda8342020-07-24 23:09:52 +02006621
6622
6623 /* Make sure to always have an export representation available */
6624 size_t bytes = PSA_BITS_TO_BYTES( bits );
Steven Cooreman75b74362020-07-28 14:30:13 +02006625 psa_status_t status = psa_allocate_buffer_to_slot( slot, bytes );
6626 if( status != PSA_SUCCESS )
Steven Cooremanacda8342020-07-24 23:09:52 +02006627 {
6628 mbedtls_ecp_keypair_free( &ecp );
Steven Cooreman29149862020-08-05 15:43:42 +02006629 return( status );
Steven Cooremanacda8342020-07-24 23:09:52 +02006630 }
Steven Cooreman75b74362020-07-28 14:30:13 +02006631
6632 status = mbedtls_to_psa_error(
Steven Cooremanacda8342020-07-24 23:09:52 +02006633 mbedtls_ecp_write_key( &ecp, slot->data.key.data, bytes ) );
6634
6635 mbedtls_ecp_keypair_free( &ecp );
Steven Cooremanb7f6dea2020-08-05 16:07:20 +02006636 if( status != PSA_SUCCESS ) {
6637 memset( slot->data.key.data, 0, bytes );
Steven Cooremanacda8342020-07-24 23:09:52 +02006638 psa_remove_key_data_from_memory( slot );
Steven Cooremanb7f6dea2020-08-05 16:07:20 +02006639 }
Steven Cooreman560c28a2020-07-24 23:20:24 +02006640 return( status );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006641 }
6642 else
John Durkop9814fa22020-11-04 12:28:15 -08006643#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) */
Steven Cooreman29149862020-08-05 15:43:42 +02006644 {
Gilles Peskinee59236f2018-01-27 23:32:46 +01006645 return( PSA_ERROR_NOT_SUPPORTED );
Steven Cooreman29149862020-08-05 15:43:42 +02006646 }
Gilles Peskinee59236f2018-01-27 23:32:46 +01006647
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006648 return( PSA_SUCCESS );
6649}
Darryl Green0c6575a2018-11-07 16:05:30 +00006650
Gilles Peskine35ef36b2019-05-16 19:42:05 +02006651psa_status_t psa_generate_key( const psa_key_attributes_t *attributes,
Ronald Croncf56a0a2020-08-04 09:51:30 +02006652 mbedtls_svc_key_id_t *key )
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006653{
6654 psa_status_t status;
6655 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02006656 psa_se_drv_table_entry_t *driver = NULL;
Gilles Peskine11792082019-08-06 18:36:36 +02006657
Ronald Cron81709fc2020-11-14 12:10:32 +01006658 *key = MBEDTLS_SVC_KEY_ID_INIT;
6659
Gilles Peskine0f84d622019-09-12 19:03:13 +02006660 /* Reject any attempt to create a zero-length key so that we don't
6661 * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
6662 if( psa_get_key_bits( attributes ) == 0 )
6663 return( PSA_ERROR_INVALID_ARGUMENT );
6664
Ronald Cron81709fc2020-11-14 12:10:32 +01006665 status = psa_start_key_creation( PSA_KEY_CREATION_GENERATE, attributes,
6666 &slot, &driver );
Gilles Peskine11792082019-08-06 18:36:36 +02006667 if( status != PSA_SUCCESS )
6668 goto exit;
6669
Steven Cooreman2a1664c2020-07-20 15:33:08 +02006670 status = psa_driver_wrapper_generate_key( attributes,
6671 slot );
6672 if( status != PSA_ERROR_NOT_SUPPORTED ||
6673 psa_key_lifetime_is_external( attributes->core.lifetime ) )
6674 goto exit;
6675
6676 status = psa_generate_key_internal(
6677 slot, attributes->core.bits,
6678 attributes->domain_parameters, attributes->domain_parameters_size );
Gilles Peskine11792082019-08-06 18:36:36 +02006679
6680exit:
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006681 if( status == PSA_SUCCESS )
Ronald Cron81709fc2020-11-14 12:10:32 +01006682 status = psa_finish_key_creation( slot, driver, key );
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006683 if( status != PSA_SUCCESS )
Gilles Peskine011e4282019-06-26 18:34:38 +02006684 psa_fail_key_creation( slot, driver );
Ronald Cronf95a2b12020-10-22 15:24:49 +02006685
Darryl Green0c6575a2018-11-07 16:05:30 +00006686 return( status );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006687}
6688
6689
Gilles Peskinee59236f2018-01-27 23:32:46 +01006690
6691/****************************************************************/
6692/* Module setup */
6693/****************************************************************/
6694
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01006695#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
Gilles Peskine5e769522018-11-20 21:59:56 +01006696psa_status_t mbedtls_psa_crypto_configure_entropy_sources(
6697 void (* entropy_init )( mbedtls_entropy_context *ctx ),
6698 void (* entropy_free )( mbedtls_entropy_context *ctx ) )
6699{
6700 if( global_data.rng_state != RNG_NOT_INITIALIZED )
6701 return( PSA_ERROR_BAD_STATE );
Gilles Peskine30524eb2020-11-13 17:02:26 +01006702 global_data.rng.entropy_init = entropy_init;
6703 global_data.rng.entropy_free = entropy_free;
Gilles Peskine5e769522018-11-20 21:59:56 +01006704 return( PSA_SUCCESS );
6705}
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01006706#endif /* !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) */
Gilles Peskine5e769522018-11-20 21:59:56 +01006707
Gilles Peskinee59236f2018-01-27 23:32:46 +01006708void mbedtls_psa_crypto_free( void )
6709{
Gilles Peskine66fb1262018-12-10 16:29:04 +01006710 psa_wipe_all_key_slots( );
Gilles Peskinec6b69072018-11-20 21:42:52 +01006711 if( global_data.rng_state != RNG_NOT_INITIALIZED )
6712 {
Gilles Peskine30524eb2020-11-13 17:02:26 +01006713 mbedtls_psa_random_free( &global_data.rng );
Gilles Peskinec6b69072018-11-20 21:42:52 +01006714 }
6715 /* Wipe all remaining data, including configuration.
6716 * In particular, this sets all state indicator to the value
6717 * indicating "uninitialized". */
Gilles Peskine3f108122018-12-07 18:14:53 +01006718 mbedtls_platform_zeroize( &global_data, sizeof( global_data ) );
Gilles Peskinea8ade162019-06-26 11:24:49 +02006719#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined0890212019-06-24 14:34:43 +02006720 /* Unregister all secure element drivers, so that we restart from
6721 * a pristine state. */
6722 psa_unregister_all_se_drivers( );
Gilles Peskinea8ade162019-06-26 11:24:49 +02006723#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskinee59236f2018-01-27 23:32:46 +01006724}
6725
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02006726#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
6727/** Recover a transaction that was interrupted by a power failure.
6728 *
6729 * This function is called during initialization, before psa_crypto_init()
6730 * returns. If this function returns a failure status, the initialization
6731 * fails.
6732 */
6733static psa_status_t psa_crypto_recover_transaction(
6734 const psa_crypto_transaction_t *transaction )
6735{
6736 switch( transaction->unknown.type )
6737 {
6738 case PSA_CRYPTO_TRANSACTION_CREATE_KEY:
6739 case PSA_CRYPTO_TRANSACTION_DESTROY_KEY:
Janos Follath1d57a202019-08-13 12:15:34 +01006740 /* TODO - fall through to the failure case until this
Gilles Peskinec9d7f942019-08-13 16:17:16 +02006741 * is implemented.
6742 * https://github.com/ARMmbed/mbed-crypto/issues/218
6743 */
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02006744 default:
6745 /* We found an unsupported transaction in the storage.
6746 * We don't know what state the storage is in. Give up. */
6747 return( PSA_ERROR_STORAGE_FAILURE );
6748 }
6749}
6750#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
6751
Gilles Peskinee59236f2018-01-27 23:32:46 +01006752psa_status_t psa_crypto_init( void )
6753{
Gilles Peskine66fb1262018-12-10 16:29:04 +01006754 psa_status_t status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01006755
Gilles Peskinec6b69072018-11-20 21:42:52 +01006756 /* Double initialization is explicitly allowed. */
Gilles Peskinee59236f2018-01-27 23:32:46 +01006757 if( global_data.initialized != 0 )
6758 return( PSA_SUCCESS );
6759
Gilles Peskine30524eb2020-11-13 17:02:26 +01006760 /* Initialize and seed the random generator. */
6761 mbedtls_psa_random_init( &global_data.rng );
Gilles Peskinec6b69072018-11-20 21:42:52 +01006762 global_data.rng_state = RNG_INITIALIZED;
Gilles Peskine30524eb2020-11-13 17:02:26 +01006763 status = mbedtls_psa_random_seed( &global_data.rng );
Gilles Peskine66fb1262018-12-10 16:29:04 +01006764 if( status != PSA_SUCCESS )
Gilles Peskinee59236f2018-01-27 23:32:46 +01006765 goto exit;
Gilles Peskinec6b69072018-11-20 21:42:52 +01006766 global_data.rng_state = RNG_SEEDED;
Gilles Peskinee59236f2018-01-27 23:32:46 +01006767
Gilles Peskine66fb1262018-12-10 16:29:04 +01006768 status = psa_initialize_key_slots( );
6769 if( status != PSA_SUCCESS )
6770 goto exit;
Gilles Peskinec6b69072018-11-20 21:42:52 +01006771
Gilles Peskined9348f22019-10-01 15:22:29 +02006772#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
6773 status = psa_init_all_se_drivers( );
6774 if( status != PSA_SUCCESS )
6775 goto exit;
6776#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
6777
Gilles Peskine4b734222019-07-24 15:56:31 +02006778#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
Gilles Peskinefc762652019-07-22 19:30:34 +02006779 status = psa_crypto_load_transaction( );
6780 if( status == PSA_SUCCESS )
6781 {
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02006782 status = psa_crypto_recover_transaction( &psa_crypto_transaction );
6783 if( status != PSA_SUCCESS )
6784 goto exit;
6785 status = psa_crypto_stop_transaction( );
Gilles Peskinefc762652019-07-22 19:30:34 +02006786 }
6787 else if( status == PSA_ERROR_DOES_NOT_EXIST )
6788 {
6789 /* There's no transaction to complete. It's all good. */
6790 status = PSA_SUCCESS;
6791 }
Gilles Peskine4b734222019-07-24 15:56:31 +02006792#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
Gilles Peskinefc762652019-07-22 19:30:34 +02006793
Gilles Peskinec6b69072018-11-20 21:42:52 +01006794 /* All done. */
Gilles Peskinee59236f2018-01-27 23:32:46 +01006795 global_data.initialized = 1;
6796
6797exit:
Gilles Peskine66fb1262018-12-10 16:29:04 +01006798 if( status != PSA_SUCCESS )
Gilles Peskinee59236f2018-01-27 23:32:46 +01006799 mbedtls_psa_crypto_free( );
Gilles Peskine66fb1262018-12-10 16:29:04 +01006800 return( status );
Gilles Peskinee59236f2018-01-27 23:32:46 +01006801}
6802
6803#endif /* MBEDTLS_PSA_CRYPTO_C */