blob: e10ca30ed0b30043009284ed92bb0516d79a7745 [file] [log] [blame]
Gilles Peskinee59236f2018-01-27 23:32:46 +01001/*
2 * PSA crypto layer on top of Mbed TLS crypto
3 */
4/* Copyright (C) 2018, ARM Limited, All Rights Reserved
5 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 *
19 * This file is part of mbed TLS (https://tls.mbed.org)
20 */
21
22#if !defined(MBEDTLS_CONFIG_FILE)
23#include "mbedtls/config.h"
24#else
25#include MBEDTLS_CONFIG_FILE
26#endif
27
28#if defined(MBEDTLS_PSA_CRYPTO_C)
Mohammad Abo Mokha5c7b7d2018-07-04 15:57:00 +030029/*
30 * In case MBEDTLS_PSA_CRYPTO_SPM is defined the code is built for SPM (Secure
31 * Partition Manager) integration which separate the code into two parts
32 * NSPE (Non-Secure Process Environment) and SPE (Secure Process Environment).
33 * In this mode an additional header file should be included.
34 */
mohammad160327010052018-07-03 13:16:15 +030035#if defined(MBEDTLS_PSA_CRYPTO_SPM)
Mohammad Abo Mokha5c7b7d2018-07-04 15:57:00 +030036/*
37 * PSA_CRYPTO_SECURE means that this file is compiled to the SPE side.
38 * some headers will be affected by this flag.
39 */
mohammad160327010052018-07-03 13:16:15 +030040#define PSA_CRYPTO_SECURE 1
41#include "crypto_spe.h"
42#endif
43
Gilles Peskinee59236f2018-01-27 23:32:46 +010044#include "psa/crypto.h"
45
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010046#include <stdlib.h>
47#include <string.h>
48#if defined(MBEDTLS_PLATFORM_C)
49#include "mbedtls/platform.h"
50#else
51#define mbedtls_calloc calloc
52#define mbedtls_free free
53#endif
54
Gilles Peskinea5905292018-02-07 20:59:33 +010055#include "mbedtls/arc4.h"
Gilles Peskine9a944802018-06-21 09:35:35 +020056#include "mbedtls/asn1.h"
Gilles Peskinea81d85b2018-06-26 16:10:23 +020057#include "mbedtls/bignum.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010058#include "mbedtls/blowfish.h"
59#include "mbedtls/camellia.h"
60#include "mbedtls/cipher.h"
61#include "mbedtls/ccm.h"
62#include "mbedtls/cmac.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010063#include "mbedtls/ctr_drbg.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010064#include "mbedtls/des.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010065#include "mbedtls/ecp.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010066#include "mbedtls/entropy.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010067#include "mbedtls/error.h"
68#include "mbedtls/gcm.h"
69#include "mbedtls/md2.h"
70#include "mbedtls/md4.h"
71#include "mbedtls/md5.h"
Gilles Peskine20035e32018-02-03 22:44:14 +010072#include "mbedtls/md.h"
73#include "mbedtls/md_internal.h"
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010074#include "mbedtls/pk.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010075#include "mbedtls/pk_internal.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010076#include "mbedtls/ripemd160.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010077#include "mbedtls/rsa.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010078#include "mbedtls/sha1.h"
79#include "mbedtls/sha256.h"
80#include "mbedtls/sha512.h"
81#include "mbedtls/xtea.h"
82
Gilles Peskinee59236f2018-01-27 23:32:46 +010083
84
85/* Implementation that should never be optimized out by the compiler */
86static void mbedtls_zeroize( void *v, size_t n )
87{
88 volatile unsigned char *p = v; while( n-- ) *p++ = 0;
89}
90
Gilles Peskine9ef733f2018-02-07 21:05:37 +010091/* constant-time buffer comparison */
92static inline int safer_memcmp( const uint8_t *a, const uint8_t *b, size_t n )
93{
94 size_t i;
95 unsigned char diff = 0;
96
97 for( i = 0; i < n; i++ )
98 diff |= a[i] ^ b[i];
99
100 return( diff );
101}
102
103
104
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100105/****************************************************************/
106/* Global data, support functions and library management */
107/****************************************************************/
108
109/* Number of key slots (plus one because 0 is not used).
110 * The value is a compile-time constant for now, for simplicity. */
Gilles Peskine828ed142018-06-18 23:25:51 +0200111#define PSA_KEY_SLOT_COUNT 32
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100112
Gilles Peskine2d277862018-06-18 15:41:12 +0200113typedef struct
114{
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100115 psa_key_type_t type;
mohammad16038cc1cee2018-03-28 01:21:33 +0300116 psa_key_policy_t policy;
mohammad1603804cd712018-03-20 22:44:08 +0200117 psa_key_lifetime_t lifetime;
Gilles Peskine2d277862018-06-18 15:41:12 +0200118 union
119 {
120 struct raw_data
121 {
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100122 uint8_t *data;
123 size_t bytes;
124 } raw;
Gilles Peskine969ac722018-01-28 18:16:59 +0100125#if defined(MBEDTLS_RSA_C)
126 mbedtls_rsa_context *rsa;
127#endif /* MBEDTLS_RSA_C */
128#if defined(MBEDTLS_ECP_C)
129 mbedtls_ecp_keypair *ecp;
130#endif /* MBEDTLS_ECP_C */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100131 } data;
132} key_slot_t;
133
Gilles Peskine48c0ea12018-06-21 14:15:31 +0200134static int key_type_is_raw_bytes( psa_key_type_t type )
135{
136 psa_key_type_t category = type & PSA_KEY_TYPE_CATEGORY_MASK;
137 return( category == PSA_KEY_TYPE_RAW_DATA ||
138 category == PSA_KEY_TYPE_CATEGORY_SYMMETRIC );
139}
140
Gilles Peskine2d277862018-06-18 15:41:12 +0200141typedef struct
142{
Gilles Peskinee59236f2018-01-27 23:32:46 +0100143 int initialized;
144 mbedtls_entropy_context entropy;
145 mbedtls_ctr_drbg_context ctr_drbg;
Gilles Peskine828ed142018-06-18 23:25:51 +0200146 key_slot_t key_slots[PSA_KEY_SLOT_COUNT];
Gilles Peskinee59236f2018-01-27 23:32:46 +0100147} psa_global_data_t;
148
149static psa_global_data_t global_data;
150
151static psa_status_t mbedtls_to_psa_error( int ret )
152{
Gilles Peskinea5905292018-02-07 20:59:33 +0100153 /* If there's both a high-level code and low-level code, dispatch on
154 * the high-level code. */
155 switch( ret < -0x7f ? - ( -ret & 0x7f80 ) : ret )
Gilles Peskinee59236f2018-01-27 23:32:46 +0100156 {
157 case 0:
158 return( PSA_SUCCESS );
Gilles Peskinea5905292018-02-07 20:59:33 +0100159
160 case MBEDTLS_ERR_AES_INVALID_KEY_LENGTH:
161 case MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH:
162 case MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE:
163 return( PSA_ERROR_NOT_SUPPORTED );
164 case MBEDTLS_ERR_AES_HW_ACCEL_FAILED:
165 return( PSA_ERROR_HARDWARE_FAILURE );
166
167 case MBEDTLS_ERR_ARC4_HW_ACCEL_FAILED:
168 return( PSA_ERROR_HARDWARE_FAILURE );
169
Gilles Peskine9a944802018-06-21 09:35:35 +0200170 case MBEDTLS_ERR_ASN1_OUT_OF_DATA:
171 case MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:
172 case MBEDTLS_ERR_ASN1_INVALID_LENGTH:
173 case MBEDTLS_ERR_ASN1_LENGTH_MISMATCH:
174 case MBEDTLS_ERR_ASN1_INVALID_DATA:
175 return( PSA_ERROR_INVALID_ARGUMENT );
176 case MBEDTLS_ERR_ASN1_ALLOC_FAILED:
177 return( PSA_ERROR_INSUFFICIENT_MEMORY );
178 case MBEDTLS_ERR_ASN1_BUF_TOO_SMALL:
179 return( PSA_ERROR_BUFFER_TOO_SMALL );
180
Gilles Peskinea5905292018-02-07 20:59:33 +0100181 case MBEDTLS_ERR_BLOWFISH_INVALID_KEY_LENGTH:
182 case MBEDTLS_ERR_BLOWFISH_INVALID_INPUT_LENGTH:
183 return( PSA_ERROR_NOT_SUPPORTED );
184 case MBEDTLS_ERR_BLOWFISH_HW_ACCEL_FAILED:
185 return( PSA_ERROR_HARDWARE_FAILURE );
186
187 case MBEDTLS_ERR_CAMELLIA_INVALID_KEY_LENGTH:
188 case MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH:
189 return( PSA_ERROR_NOT_SUPPORTED );
190 case MBEDTLS_ERR_CAMELLIA_HW_ACCEL_FAILED:
191 return( PSA_ERROR_HARDWARE_FAILURE );
192
193 case MBEDTLS_ERR_CCM_BAD_INPUT:
194 return( PSA_ERROR_INVALID_ARGUMENT );
195 case MBEDTLS_ERR_CCM_AUTH_FAILED:
196 return( PSA_ERROR_INVALID_SIGNATURE );
197 case MBEDTLS_ERR_CCM_HW_ACCEL_FAILED:
198 return( PSA_ERROR_HARDWARE_FAILURE );
199
200 case MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE:
201 return( PSA_ERROR_NOT_SUPPORTED );
202 case MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA:
203 return( PSA_ERROR_INVALID_ARGUMENT );
204 case MBEDTLS_ERR_CIPHER_ALLOC_FAILED:
205 return( PSA_ERROR_INSUFFICIENT_MEMORY );
206 case MBEDTLS_ERR_CIPHER_INVALID_PADDING:
207 return( PSA_ERROR_INVALID_PADDING );
208 case MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED:
209 return( PSA_ERROR_BAD_STATE );
210 case MBEDTLS_ERR_CIPHER_AUTH_FAILED:
211 return( PSA_ERROR_INVALID_SIGNATURE );
212 case MBEDTLS_ERR_CIPHER_INVALID_CONTEXT:
213 return( PSA_ERROR_TAMPERING_DETECTED );
214 case MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED:
215 return( PSA_ERROR_HARDWARE_FAILURE );
216
217 case MBEDTLS_ERR_CMAC_HW_ACCEL_FAILED:
218 return( PSA_ERROR_HARDWARE_FAILURE );
219
220 case MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED:
221 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
222 case MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG:
223 case MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG:
224 return( PSA_ERROR_NOT_SUPPORTED );
225 case MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR:
226 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
227
228 case MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH:
229 return( PSA_ERROR_NOT_SUPPORTED );
230 case MBEDTLS_ERR_DES_HW_ACCEL_FAILED:
231 return( PSA_ERROR_HARDWARE_FAILURE );
232
Gilles Peskinee59236f2018-01-27 23:32:46 +0100233 case MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED:
234 case MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE:
235 case MBEDTLS_ERR_ENTROPY_SOURCE_FAILED:
236 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
Gilles Peskinea5905292018-02-07 20:59:33 +0100237
238 case MBEDTLS_ERR_GCM_AUTH_FAILED:
239 return( PSA_ERROR_INVALID_SIGNATURE );
240 case MBEDTLS_ERR_GCM_BAD_INPUT:
241 return( PSA_ERROR_NOT_SUPPORTED );
242 case MBEDTLS_ERR_GCM_HW_ACCEL_FAILED:
243 return( PSA_ERROR_HARDWARE_FAILURE );
244
245 case MBEDTLS_ERR_MD2_HW_ACCEL_FAILED:
246 case MBEDTLS_ERR_MD4_HW_ACCEL_FAILED:
247 case MBEDTLS_ERR_MD5_HW_ACCEL_FAILED:
248 return( PSA_ERROR_HARDWARE_FAILURE );
249
250 case MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE:
251 return( PSA_ERROR_NOT_SUPPORTED );
252 case MBEDTLS_ERR_MD_BAD_INPUT_DATA:
253 return( PSA_ERROR_INVALID_ARGUMENT );
254 case MBEDTLS_ERR_MD_ALLOC_FAILED:
255 return( PSA_ERROR_INSUFFICIENT_MEMORY );
256 case MBEDTLS_ERR_MD_FILE_IO_ERROR:
257 return( PSA_ERROR_STORAGE_FAILURE );
258 case MBEDTLS_ERR_MD_HW_ACCEL_FAILED:
259 return( PSA_ERROR_HARDWARE_FAILURE );
260
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100261 case MBEDTLS_ERR_PK_ALLOC_FAILED:
262 return( PSA_ERROR_INSUFFICIENT_MEMORY );
263 case MBEDTLS_ERR_PK_TYPE_MISMATCH:
264 case MBEDTLS_ERR_PK_BAD_INPUT_DATA:
265 return( PSA_ERROR_INVALID_ARGUMENT );
266 case MBEDTLS_ERR_PK_FILE_IO_ERROR:
Gilles Peskinea5905292018-02-07 20:59:33 +0100267 return( PSA_ERROR_STORAGE_FAILURE );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100268 case MBEDTLS_ERR_PK_KEY_INVALID_VERSION:
269 case MBEDTLS_ERR_PK_KEY_INVALID_FORMAT:
270 return( PSA_ERROR_INVALID_ARGUMENT );
271 case MBEDTLS_ERR_PK_UNKNOWN_PK_ALG:
272 return( PSA_ERROR_NOT_SUPPORTED );
273 case MBEDTLS_ERR_PK_PASSWORD_REQUIRED:
274 case MBEDTLS_ERR_PK_PASSWORD_MISMATCH:
275 return( PSA_ERROR_NOT_PERMITTED );
276 case MBEDTLS_ERR_PK_INVALID_PUBKEY:
277 return( PSA_ERROR_INVALID_ARGUMENT );
278 case MBEDTLS_ERR_PK_INVALID_ALG:
279 case MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE:
280 case MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE:
281 return( PSA_ERROR_NOT_SUPPORTED );
282 case MBEDTLS_ERR_PK_SIG_LEN_MISMATCH:
283 return( PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskinea5905292018-02-07 20:59:33 +0100284 case MBEDTLS_ERR_PK_HW_ACCEL_FAILED:
285 return( PSA_ERROR_HARDWARE_FAILURE );
286
287 case MBEDTLS_ERR_RIPEMD160_HW_ACCEL_FAILED:
288 return( PSA_ERROR_HARDWARE_FAILURE );
289
290 case MBEDTLS_ERR_RSA_BAD_INPUT_DATA:
291 return( PSA_ERROR_INVALID_ARGUMENT );
292 case MBEDTLS_ERR_RSA_INVALID_PADDING:
293 return( PSA_ERROR_INVALID_PADDING );
294 case MBEDTLS_ERR_RSA_KEY_GEN_FAILED:
295 return( PSA_ERROR_HARDWARE_FAILURE );
296 case MBEDTLS_ERR_RSA_KEY_CHECK_FAILED:
297 return( PSA_ERROR_INVALID_ARGUMENT );
298 case MBEDTLS_ERR_RSA_PUBLIC_FAILED:
299 case MBEDTLS_ERR_RSA_PRIVATE_FAILED:
300 return( PSA_ERROR_TAMPERING_DETECTED );
301 case MBEDTLS_ERR_RSA_VERIFY_FAILED:
302 return( PSA_ERROR_INVALID_SIGNATURE );
303 case MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE:
304 return( PSA_ERROR_BUFFER_TOO_SMALL );
305 case MBEDTLS_ERR_RSA_RNG_FAILED:
306 return( PSA_ERROR_INSUFFICIENT_MEMORY );
307 case MBEDTLS_ERR_RSA_UNSUPPORTED_OPERATION:
308 return( PSA_ERROR_NOT_SUPPORTED );
309 case MBEDTLS_ERR_RSA_HW_ACCEL_FAILED:
310 return( PSA_ERROR_HARDWARE_FAILURE );
311
312 case MBEDTLS_ERR_SHA1_HW_ACCEL_FAILED:
313 case MBEDTLS_ERR_SHA256_HW_ACCEL_FAILED:
314 case MBEDTLS_ERR_SHA512_HW_ACCEL_FAILED:
315 return( PSA_ERROR_HARDWARE_FAILURE );
316
317 case MBEDTLS_ERR_XTEA_INVALID_INPUT_LENGTH:
318 return( PSA_ERROR_INVALID_ARGUMENT );
319 case MBEDTLS_ERR_XTEA_HW_ACCEL_FAILED:
320 return( PSA_ERROR_HARDWARE_FAILURE );
321
itayzafrir5c753392018-05-08 11:18:38 +0300322 case MBEDTLS_ERR_ECP_BAD_INPUT_DATA:
itayzafrir7b30f8b2018-05-09 16:07:36 +0300323 case MBEDTLS_ERR_ECP_INVALID_KEY:
itayzafrir5c753392018-05-08 11:18:38 +0300324 return( PSA_ERROR_INVALID_ARGUMENT );
itayzafrir7b30f8b2018-05-09 16:07:36 +0300325 case MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL:
326 return( PSA_ERROR_BUFFER_TOO_SMALL );
327 case MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE:
328 return( PSA_ERROR_NOT_SUPPORTED );
329 case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH:
330 case MBEDTLS_ERR_ECP_VERIFY_FAILED:
331 return( PSA_ERROR_INVALID_SIGNATURE );
332 case MBEDTLS_ERR_ECP_ALLOC_FAILED:
333 return( PSA_ERROR_INSUFFICIENT_MEMORY );
334 case MBEDTLS_ERR_ECP_HW_ACCEL_FAILED:
335 return( PSA_ERROR_HARDWARE_FAILURE );
itayzafrir5c753392018-05-08 11:18:38 +0300336
Gilles Peskinee59236f2018-01-27 23:32:46 +0100337 default:
338 return( PSA_ERROR_UNKNOWN_ERROR );
339 }
340}
341
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +0200342
343
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100344/****************************************************************/
345/* Key management */
346/****************************************************************/
347
Gilles Peskine34ef7f52018-06-18 20:47:51 +0200348static psa_ecc_curve_t mbedtls_ecc_group_to_psa( mbedtls_ecp_group_id grpid )
349{
350 switch( grpid )
351 {
352 case MBEDTLS_ECP_DP_SECP192R1:
353 return( PSA_ECC_CURVE_SECP192R1 );
354 case MBEDTLS_ECP_DP_SECP224R1:
355 return( PSA_ECC_CURVE_SECP224R1 );
356 case MBEDTLS_ECP_DP_SECP256R1:
357 return( PSA_ECC_CURVE_SECP256R1 );
358 case MBEDTLS_ECP_DP_SECP384R1:
359 return( PSA_ECC_CURVE_SECP384R1 );
360 case MBEDTLS_ECP_DP_SECP521R1:
361 return( PSA_ECC_CURVE_SECP521R1 );
362 case MBEDTLS_ECP_DP_BP256R1:
363 return( PSA_ECC_CURVE_BRAINPOOL_P256R1 );
364 case MBEDTLS_ECP_DP_BP384R1:
365 return( PSA_ECC_CURVE_BRAINPOOL_P384R1 );
366 case MBEDTLS_ECP_DP_BP512R1:
367 return( PSA_ECC_CURVE_BRAINPOOL_P512R1 );
368 case MBEDTLS_ECP_DP_CURVE25519:
369 return( PSA_ECC_CURVE_CURVE25519 );
370 case MBEDTLS_ECP_DP_SECP192K1:
371 return( PSA_ECC_CURVE_SECP192K1 );
372 case MBEDTLS_ECP_DP_SECP224K1:
373 return( PSA_ECC_CURVE_SECP224K1 );
374 case MBEDTLS_ECP_DP_SECP256K1:
375 return( PSA_ECC_CURVE_SECP256K1 );
376 case MBEDTLS_ECP_DP_CURVE448:
377 return( PSA_ECC_CURVE_CURVE448 );
378 default:
379 return( 0 );
380 }
381}
382
Gilles Peskine12313cd2018-06-20 00:20:32 +0200383static mbedtls_ecp_group_id mbedtls_ecc_group_of_psa( psa_ecc_curve_t curve )
384{
385 switch( curve )
386 {
387 case PSA_ECC_CURVE_SECP192R1:
388 return( MBEDTLS_ECP_DP_SECP192R1 );
389 case PSA_ECC_CURVE_SECP224R1:
390 return( MBEDTLS_ECP_DP_SECP224R1 );
391 case PSA_ECC_CURVE_SECP256R1:
392 return( MBEDTLS_ECP_DP_SECP256R1 );
393 case PSA_ECC_CURVE_SECP384R1:
394 return( MBEDTLS_ECP_DP_SECP384R1 );
395 case PSA_ECC_CURVE_SECP521R1:
396 return( MBEDTLS_ECP_DP_SECP521R1 );
397 case PSA_ECC_CURVE_BRAINPOOL_P256R1:
398 return( MBEDTLS_ECP_DP_BP256R1 );
399 case PSA_ECC_CURVE_BRAINPOOL_P384R1:
400 return( MBEDTLS_ECP_DP_BP384R1 );
401 case PSA_ECC_CURVE_BRAINPOOL_P512R1:
402 return( MBEDTLS_ECP_DP_BP512R1 );
403 case PSA_ECC_CURVE_CURVE25519:
404 return( MBEDTLS_ECP_DP_CURVE25519 );
405 case PSA_ECC_CURVE_SECP192K1:
406 return( MBEDTLS_ECP_DP_SECP192K1 );
407 case PSA_ECC_CURVE_SECP224K1:
408 return( MBEDTLS_ECP_DP_SECP224K1 );
409 case PSA_ECC_CURVE_SECP256K1:
410 return( MBEDTLS_ECP_DP_SECP256K1 );
411 case PSA_ECC_CURVE_CURVE448:
412 return( MBEDTLS_ECP_DP_CURVE448 );
413 default:
414 return( MBEDTLS_ECP_DP_NONE );
415 }
416}
417
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200418static psa_status_t prepare_raw_data_slot( psa_key_type_t type,
419 size_t bits,
420 struct raw_data *raw )
421{
422 /* Check that the bit size is acceptable for the key type */
423 switch( type )
424 {
425 case PSA_KEY_TYPE_RAW_DATA:
Gilles Peskine46f1fd72018-06-28 19:31:31 +0200426 if( bits == 0 )
427 {
428 raw->bytes = 0;
429 raw->data = NULL;
430 return( PSA_SUCCESS );
431 }
432 break;
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200433#if defined(MBEDTLS_MD_C)
434 case PSA_KEY_TYPE_HMAC:
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200435 break;
Gilles Peskine46f1fd72018-06-28 19:31:31 +0200436#endif
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200437#if defined(MBEDTLS_AES_C)
438 case PSA_KEY_TYPE_AES:
439 if( bits != 128 && bits != 192 && bits != 256 )
440 return( PSA_ERROR_INVALID_ARGUMENT );
441 break;
442#endif
443#if defined(MBEDTLS_CAMELLIA_C)
444 case PSA_KEY_TYPE_CAMELLIA:
445 if( bits != 128 && bits != 192 && bits != 256 )
446 return( PSA_ERROR_INVALID_ARGUMENT );
447 break;
448#endif
449#if defined(MBEDTLS_DES_C)
450 case PSA_KEY_TYPE_DES:
451 if( bits != 64 && bits != 128 && bits != 192 )
452 return( PSA_ERROR_INVALID_ARGUMENT );
453 break;
454#endif
455#if defined(MBEDTLS_ARC4_C)
456 case PSA_KEY_TYPE_ARC4:
457 if( bits < 8 || bits > 2048 )
458 return( PSA_ERROR_INVALID_ARGUMENT );
459 break;
460#endif
461 default:
462 return( PSA_ERROR_NOT_SUPPORTED );
463 }
Gilles Peskineb54979a2018-06-21 09:32:47 +0200464 if( bits % 8 != 0 )
465 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200466
467 /* Allocate memory for the key */
468 raw->bytes = PSA_BITS_TO_BYTES( bits );
469 raw->data = mbedtls_calloc( 1, raw->bytes );
470 if( raw->data == NULL )
471 {
472 raw->bytes = 0;
473 return( PSA_ERROR_INSUFFICIENT_MEMORY );
474 }
475 return( PSA_SUCCESS );
476}
477
Gilles Peskine2d277862018-06-18 15:41:12 +0200478psa_status_t psa_import_key( psa_key_slot_t key,
479 psa_key_type_t type,
480 const uint8_t *data,
481 size_t data_length )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100482{
483 key_slot_t *slot;
484
Gilles Peskine828ed142018-06-18 23:25:51 +0200485 if( key == 0 || key > PSA_KEY_SLOT_COUNT )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100486 return( PSA_ERROR_INVALID_ARGUMENT );
487 slot = &global_data.key_slots[key];
488 if( slot->type != PSA_KEY_TYPE_NONE )
489 return( PSA_ERROR_OCCUPIED_SLOT );
490
Gilles Peskine48c0ea12018-06-21 14:15:31 +0200491 if( key_type_is_raw_bytes( type ) )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100492 {
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200493 psa_status_t status;
Gilles Peskine6d912132018-03-07 16:41:37 +0100494 /* Ensure that a bytes-to-bit conversion won't overflow. */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100495 if( data_length > SIZE_MAX / 8 )
496 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200497 status = prepare_raw_data_slot( type,
498 PSA_BYTES_TO_BITS( data_length ),
499 &slot->data.raw );
500 if( status != PSA_SUCCESS )
501 return( status );
Gilles Peskine46f1fd72018-06-28 19:31:31 +0200502 if( data_length != 0 )
503 memcpy( slot->data.raw.data, data, data_length );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100504 }
505 else
Gilles Peskine969ac722018-01-28 18:16:59 +0100506#if defined(MBEDTLS_PK_PARSE_C)
Gilles Peskinec66ea6a2018-02-03 22:43:28 +0100507 if( type == PSA_KEY_TYPE_RSA_PUBLIC_KEY ||
508 type == PSA_KEY_TYPE_RSA_KEYPAIR ||
509 PSA_KEY_TYPE_IS_ECC( type ) )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100510 {
511 int ret;
Gilles Peskine969ac722018-01-28 18:16:59 +0100512 mbedtls_pk_context pk;
Gilles Peskinec648d692018-06-28 08:46:13 +0200513 psa_status_t status = PSA_SUCCESS;
Gilles Peskine969ac722018-01-28 18:16:59 +0100514 mbedtls_pk_init( &pk );
Gilles Peskinec66ea6a2018-02-03 22:43:28 +0100515 if( PSA_KEY_TYPE_IS_KEYPAIR( type ) )
516 ret = mbedtls_pk_parse_key( &pk, data, data_length, NULL, 0 );
517 else
518 ret = mbedtls_pk_parse_public_key( &pk, data, data_length );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100519 if( ret != 0 )
520 return( mbedtls_to_psa_error( ret ) );
Gilles Peskine969ac722018-01-28 18:16:59 +0100521 switch( mbedtls_pk_get_type( &pk ) )
522 {
523#if defined(MBEDTLS_RSA_C)
524 case MBEDTLS_PK_RSA:
Gilles Peskinec66ea6a2018-02-03 22:43:28 +0100525 if( type == PSA_KEY_TYPE_RSA_PUBLIC_KEY ||
526 type == PSA_KEY_TYPE_RSA_KEYPAIR )
Gilles Peskineaf3baab2018-06-27 22:55:52 +0200527 {
528 mbedtls_rsa_context *rsa = mbedtls_pk_rsa( pk );
529 size_t bits = mbedtls_rsa_get_bitlen( rsa );
530 if( bits > PSA_VENDOR_RSA_MAX_KEY_BITS )
Gilles Peskine1ae05142018-06-30 17:46:59 +0200531 {
532 status = PSA_ERROR_NOT_SUPPORTED;
533 break;
534 }
Gilles Peskineaf3baab2018-06-27 22:55:52 +0200535 slot->data.rsa = rsa;
536 }
Gilles Peskine969ac722018-01-28 18:16:59 +0100537 else
Gilles Peskinec648d692018-06-28 08:46:13 +0200538 status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine969ac722018-01-28 18:16:59 +0100539 break;
540#endif /* MBEDTLS_RSA_C */
541#if defined(MBEDTLS_ECP_C)
542 case MBEDTLS_PK_ECKEY:
543 if( PSA_KEY_TYPE_IS_ECC( type ) )
544 {
Gilles Peskine34ef7f52018-06-18 20:47:51 +0200545 mbedtls_ecp_keypair *ecp = mbedtls_pk_ec( pk );
546 psa_ecc_curve_t actual_curve =
547 mbedtls_ecc_group_to_psa( ecp->grp.id );
548 psa_ecc_curve_t expected_curve =
549 PSA_KEY_TYPE_GET_CURVE( type );
550 if( actual_curve != expected_curve )
Gilles Peskinec648d692018-06-28 08:46:13 +0200551 {
552 status = PSA_ERROR_INVALID_ARGUMENT;
553 break;
554 }
Gilles Peskine34ef7f52018-06-18 20:47:51 +0200555 slot->data.ecp = ecp;
Gilles Peskine969ac722018-01-28 18:16:59 +0100556 }
557 else
Gilles Peskinec648d692018-06-28 08:46:13 +0200558 status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine969ac722018-01-28 18:16:59 +0100559 break;
560#endif /* MBEDTLS_ECP_C */
561 default:
Gilles Peskinec648d692018-06-28 08:46:13 +0200562 status = PSA_ERROR_INVALID_ARGUMENT;
563 break;
564 }
565 /* Free the content of the pk object only on error. On success,
566 * the content of the object has been stored in the slot. */
567 if( status != PSA_SUCCESS )
568 {
569 mbedtls_pk_free( &pk );
570 return( status );
Gilles Peskine969ac722018-01-28 18:16:59 +0100571 }
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100572 }
573 else
Gilles Peskine969ac722018-01-28 18:16:59 +0100574#endif /* defined(MBEDTLS_PK_PARSE_C) */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100575 {
576 return( PSA_ERROR_NOT_SUPPORTED );
577 }
578
579 slot->type = type;
580 return( PSA_SUCCESS );
581}
582
Gilles Peskine2d277862018-06-18 15:41:12 +0200583psa_status_t psa_destroy_key( psa_key_slot_t key )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100584{
585 key_slot_t *slot;
586
Gilles Peskine828ed142018-06-18 23:25:51 +0200587 if( key == 0 || key > PSA_KEY_SLOT_COUNT )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100588 return( PSA_ERROR_INVALID_ARGUMENT );
589 slot = &global_data.key_slots[key];
590 if( slot->type == PSA_KEY_TYPE_NONE )
Gilles Peskine154bd952018-04-19 08:38:16 +0200591 {
592 /* No key material to clean, but do zeroize the slot below to wipe
593 * metadata such as policies. */
594 }
Gilles Peskine48c0ea12018-06-21 14:15:31 +0200595 else if( key_type_is_raw_bytes( slot->type ) )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100596 {
597 mbedtls_free( slot->data.raw.data );
598 }
599 else
Gilles Peskine969ac722018-01-28 18:16:59 +0100600#if defined(MBEDTLS_RSA_C)
Gilles Peskinec66ea6a2018-02-03 22:43:28 +0100601 if( slot->type == PSA_KEY_TYPE_RSA_PUBLIC_KEY ||
602 slot->type == PSA_KEY_TYPE_RSA_KEYPAIR )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100603 {
Gilles Peskine969ac722018-01-28 18:16:59 +0100604 mbedtls_rsa_free( slot->data.rsa );
Gilles Peskine3c6e9702018-03-07 16:42:44 +0100605 mbedtls_free( slot->data.rsa );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100606 }
607 else
Gilles Peskine969ac722018-01-28 18:16:59 +0100608#endif /* defined(MBEDTLS_RSA_C) */
609#if defined(MBEDTLS_ECP_C)
610 if( PSA_KEY_TYPE_IS_ECC( slot->type ) )
611 {
612 mbedtls_ecp_keypair_free( slot->data.ecp );
Gilles Peskine3c6e9702018-03-07 16:42:44 +0100613 mbedtls_free( slot->data.ecp );
Gilles Peskine969ac722018-01-28 18:16:59 +0100614 }
615 else
616#endif /* defined(MBEDTLS_ECP_C) */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100617 {
618 /* Shouldn't happen: the key type is not any type that we
Gilles Peskine6d912132018-03-07 16:41:37 +0100619 * put in. */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100620 return( PSA_ERROR_TAMPERING_DETECTED );
621 }
622
623 mbedtls_zeroize( slot, sizeof( *slot ) );
624 return( PSA_SUCCESS );
625}
626
Gilles Peskine2d277862018-06-18 15:41:12 +0200627psa_status_t psa_get_key_information( psa_key_slot_t key,
628 psa_key_type_t *type,
629 size_t *bits )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100630{
631 key_slot_t *slot;
632
Gilles Peskine828ed142018-06-18 23:25:51 +0200633 if( key == 0 || key > PSA_KEY_SLOT_COUNT )
Gilles Peskinec66ea6a2018-02-03 22:43:28 +0100634 return( PSA_ERROR_EMPTY_SLOT );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100635 slot = &global_data.key_slots[key];
636 if( type != NULL )
637 *type = slot->type;
638 if( bits != NULL )
639 *bits = 0;
640 if( slot->type == PSA_KEY_TYPE_NONE )
641 return( PSA_ERROR_EMPTY_SLOT );
642
Gilles Peskine48c0ea12018-06-21 14:15:31 +0200643 if( key_type_is_raw_bytes( slot->type ) )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100644 {
645 if( bits != NULL )
646 *bits = slot->data.raw.bytes * 8;
647 }
648 else
Gilles Peskine969ac722018-01-28 18:16:59 +0100649#if defined(MBEDTLS_RSA_C)
Gilles Peskinec66ea6a2018-02-03 22:43:28 +0100650 if( slot->type == PSA_KEY_TYPE_RSA_PUBLIC_KEY ||
651 slot->type == PSA_KEY_TYPE_RSA_KEYPAIR )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100652 {
653 if( bits != NULL )
Gilles Peskine969ac722018-01-28 18:16:59 +0100654 *bits = mbedtls_rsa_get_bitlen( slot->data.rsa );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100655 }
656 else
Gilles Peskine969ac722018-01-28 18:16:59 +0100657#endif /* defined(MBEDTLS_RSA_C) */
658#if defined(MBEDTLS_ECP_C)
659 if( PSA_KEY_TYPE_IS_ECC( slot->type ) )
660 {
661 if( bits != NULL )
662 *bits = slot->data.ecp->grp.pbits;
663 }
664 else
665#endif /* defined(MBEDTLS_ECP_C) */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100666 {
667 /* Shouldn't happen: the key type is not any type that we
Gilles Peskine6d912132018-03-07 16:41:37 +0100668 * put in. */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100669 return( PSA_ERROR_TAMPERING_DETECTED );
670 }
671
672 return( PSA_SUCCESS );
673}
674
Gilles Peskine2d277862018-06-18 15:41:12 +0200675static psa_status_t psa_internal_export_key( psa_key_slot_t key,
676 uint8_t *data,
677 size_t data_size,
678 size_t *data_length,
679 int export_public_key )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100680{
681 key_slot_t *slot;
682
Jaeden Amerof24c7f82018-06-27 17:20:43 +0100683 /* Set the key to empty now, so that even when there are errors, we always
684 * set data_length to a value between 0 and data_size. On error, setting
685 * the key to empty is a good choice because an empty key representation is
686 * unlikely to be accepted anywhere. */
687 *data_length = 0;
688
Gilles Peskine828ed142018-06-18 23:25:51 +0200689 if( key == 0 || key > PSA_KEY_SLOT_COUNT )
Gilles Peskinec66ea6a2018-02-03 22:43:28 +0100690 return( PSA_ERROR_EMPTY_SLOT );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100691 slot = &global_data.key_slots[key];
692 if( slot->type == PSA_KEY_TYPE_NONE )
693 return( PSA_ERROR_EMPTY_SLOT );
694
Gilles Peskinec1bb6c82018-06-18 16:04:39 +0200695 if( export_public_key && ! PSA_KEY_TYPE_IS_ASYMMETRIC( slot->type ) )
Moran Pekera998bc62018-04-16 18:16:20 +0300696 return( PSA_ERROR_INVALID_ARGUMENT );
mohammad160306e79202018-03-28 13:17:44 +0300697
Gilles Peskinec1bb6c82018-06-18 16:04:39 +0200698 if( ! export_public_key &&
699 ! PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->type ) &&
700 ( slot->policy.usage & PSA_KEY_USAGE_EXPORT ) == 0 )
Moran Peker87567632018-06-04 18:41:37 +0300701 return( PSA_ERROR_NOT_PERMITTED );
Gilles Peskine2d277862018-06-18 15:41:12 +0200702
Gilles Peskine48c0ea12018-06-21 14:15:31 +0200703 if( key_type_is_raw_bytes( slot->type ) )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100704 {
705 if( slot->data.raw.bytes > data_size )
706 return( PSA_ERROR_BUFFER_TOO_SMALL );
Gilles Peskine46f1fd72018-06-28 19:31:31 +0200707 if( slot->data.raw.bytes != 0 )
708 memcpy( data, slot->data.raw.data, slot->data.raw.bytes );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100709 *data_length = slot->data.raw.bytes;
710 return( PSA_SUCCESS );
711 }
712 else
Moran Peker17e36e12018-05-02 12:55:20 +0300713 {
Gilles Peskine969ac722018-01-28 18:16:59 +0100714#if defined(MBEDTLS_PK_WRITE_C)
Gilles Peskinec66ea6a2018-02-03 22:43:28 +0100715 if( slot->type == PSA_KEY_TYPE_RSA_PUBLIC_KEY ||
Moran Pekera998bc62018-04-16 18:16:20 +0300716 slot->type == PSA_KEY_TYPE_RSA_KEYPAIR ||
717 PSA_KEY_TYPE_IS_ECC( slot->type ) )
Gilles Peskine969ac722018-01-28 18:16:59 +0100718 {
Moran Pekera998bc62018-04-16 18:16:20 +0300719 mbedtls_pk_context pk;
720 int ret;
721 mbedtls_pk_init( &pk );
722 if( slot->type == PSA_KEY_TYPE_RSA_PUBLIC_KEY ||
723 slot->type == PSA_KEY_TYPE_RSA_KEYPAIR )
724 {
725 pk.pk_info = &mbedtls_rsa_info;
726 pk.pk_ctx = slot->data.rsa;
727 }
728 else
729 {
730 pk.pk_info = &mbedtls_eckey_info;
731 pk.pk_ctx = slot->data.ecp;
732 }
Moran Pekerd7326592018-05-29 16:56:39 +0300733 if( export_public_key || PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->type ) )
Moran Pekera998bc62018-04-16 18:16:20 +0300734 ret = mbedtls_pk_write_pubkey_der( &pk, data, data_size );
Moran Peker17e36e12018-05-02 12:55:20 +0300735 else
736 ret = mbedtls_pk_write_key_der( &pk, data, data_size );
Moran Peker60364322018-04-29 11:34:58 +0300737 if( ret < 0 )
Gilles Peskinee66ca3b2018-06-20 00:11:45 +0200738 {
Gilles Peskine46f1fd72018-06-28 19:31:31 +0200739 /* If data_size is 0 then data may be NULL and then the
740 * call to memset would have undefined behavior. */
741 if( data_size != 0 )
742 memset( data, 0, data_size );
Moran Pekera998bc62018-04-16 18:16:20 +0300743 return( mbedtls_to_psa_error( ret ) );
Gilles Peskinee66ca3b2018-06-20 00:11:45 +0200744 }
Gilles Peskine0e231582018-06-20 00:11:07 +0200745 /* The mbedtls_pk_xxx functions write to the end of the buffer.
746 * Move the data to the beginning and erase remaining data
747 * at the original location. */
748 if( 2 * (size_t) ret <= data_size )
749 {
750 memcpy( data, data + data_size - ret, ret );
Gilles Peskinee66ca3b2018-06-20 00:11:45 +0200751 memset( data + data_size - ret, 0, ret );
Gilles Peskine0e231582018-06-20 00:11:07 +0200752 }
753 else if( (size_t) ret < data_size )
754 {
755 memmove( data, data + data_size - ret, ret );
Gilles Peskinee66ca3b2018-06-20 00:11:45 +0200756 memset( data + ret, 0, data_size - ret );
Gilles Peskine0e231582018-06-20 00:11:07 +0200757 }
Moran Pekera998bc62018-04-16 18:16:20 +0300758 *data_length = ret;
759 return( PSA_SUCCESS );
Gilles Peskine969ac722018-01-28 18:16:59 +0100760 }
761 else
Gilles Peskine6d912132018-03-07 16:41:37 +0100762#endif /* defined(MBEDTLS_PK_WRITE_C) */
Moran Pekera998bc62018-04-16 18:16:20 +0300763 {
764 /* This shouldn't happen in the reference implementation, but
Gilles Peskine785fd552018-06-04 15:08:56 +0200765 it is valid for a special-purpose implementation to omit
766 support for exporting certain key types. */
Moran Pekera998bc62018-04-16 18:16:20 +0300767 return( PSA_ERROR_NOT_SUPPORTED );
768 }
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100769 }
770}
771
Gilles Peskine2d277862018-06-18 15:41:12 +0200772psa_status_t psa_export_key( psa_key_slot_t key,
773 uint8_t *data,
774 size_t data_size,
775 size_t *data_length )
Moran Pekera998bc62018-04-16 18:16:20 +0300776{
Gilles Peskinec1bb6c82018-06-18 16:04:39 +0200777 return( psa_internal_export_key( key, data, data_size,
778 data_length, 0 ) );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100779}
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100780
Gilles Peskine2d277862018-06-18 15:41:12 +0200781psa_status_t psa_export_public_key( psa_key_slot_t key,
782 uint8_t *data,
783 size_t data_size,
784 size_t *data_length )
Moran Pekerdd4ea382018-04-03 15:30:03 +0300785{
Gilles Peskinec1bb6c82018-06-18 16:04:39 +0200786 return( psa_internal_export_key( key, data, data_size,
787 data_length, 1 ) );
Moran Pekerdd4ea382018-04-03 15:30:03 +0300788}
789
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +0200790
791
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100792/****************************************************************/
Gilles Peskine20035e32018-02-03 22:44:14 +0100793/* Message digests */
794/****************************************************************/
795
Gilles Peskinedc2fc842018-03-07 16:42:59 +0100796static const mbedtls_md_info_t *mbedtls_md_info_from_psa( psa_algorithm_t alg )
Gilles Peskine20035e32018-02-03 22:44:14 +0100797{
798 switch( alg )
799 {
800#if defined(MBEDTLS_MD2_C)
801 case PSA_ALG_MD2:
802 return( &mbedtls_md2_info );
803#endif
804#if defined(MBEDTLS_MD4_C)
805 case PSA_ALG_MD4:
806 return( &mbedtls_md4_info );
807#endif
808#if defined(MBEDTLS_MD5_C)
809 case PSA_ALG_MD5:
810 return( &mbedtls_md5_info );
811#endif
812#if defined(MBEDTLS_RIPEMD160_C)
813 case PSA_ALG_RIPEMD160:
814 return( &mbedtls_ripemd160_info );
815#endif
816#if defined(MBEDTLS_SHA1_C)
817 case PSA_ALG_SHA_1:
818 return( &mbedtls_sha1_info );
819#endif
820#if defined(MBEDTLS_SHA256_C)
821 case PSA_ALG_SHA_224:
822 return( &mbedtls_sha224_info );
823 case PSA_ALG_SHA_256:
824 return( &mbedtls_sha256_info );
825#endif
826#if defined(MBEDTLS_SHA512_C)
827 case PSA_ALG_SHA_384:
828 return( &mbedtls_sha384_info );
829 case PSA_ALG_SHA_512:
830 return( &mbedtls_sha512_info );
831#endif
832 default:
833 return( NULL );
834 }
835}
836
Gilles Peskine9ef733f2018-02-07 21:05:37 +0100837psa_status_t psa_hash_abort( psa_hash_operation_t *operation )
838{
839 switch( operation->alg )
840 {
Gilles Peskine81736312018-06-26 15:04:31 +0200841 case 0:
842 /* The object has (apparently) been initialized but it is not
843 * in use. It's ok to call abort on such an object, and there's
844 * nothing to do. */
845 break;
Gilles Peskine9ef733f2018-02-07 21:05:37 +0100846#if defined(MBEDTLS_MD2_C)
847 case PSA_ALG_MD2:
848 mbedtls_md2_free( &operation->ctx.md2 );
849 break;
850#endif
851#if defined(MBEDTLS_MD4_C)
852 case PSA_ALG_MD4:
853 mbedtls_md4_free( &operation->ctx.md4 );
854 break;
855#endif
856#if defined(MBEDTLS_MD5_C)
857 case PSA_ALG_MD5:
858 mbedtls_md5_free( &operation->ctx.md5 );
859 break;
860#endif
861#if defined(MBEDTLS_RIPEMD160_C)
862 case PSA_ALG_RIPEMD160:
863 mbedtls_ripemd160_free( &operation->ctx.ripemd160 );
864 break;
865#endif
866#if defined(MBEDTLS_SHA1_C)
867 case PSA_ALG_SHA_1:
868 mbedtls_sha1_free( &operation->ctx.sha1 );
869 break;
870#endif
871#if defined(MBEDTLS_SHA256_C)
872 case PSA_ALG_SHA_224:
873 case PSA_ALG_SHA_256:
874 mbedtls_sha256_free( &operation->ctx.sha256 );
875 break;
876#endif
877#if defined(MBEDTLS_SHA512_C)
878 case PSA_ALG_SHA_384:
879 case PSA_ALG_SHA_512:
880 mbedtls_sha512_free( &operation->ctx.sha512 );
881 break;
882#endif
883 default:
Gilles Peskinef9c2c092018-06-21 16:57:07 +0200884 return( PSA_ERROR_BAD_STATE );
Gilles Peskine9ef733f2018-02-07 21:05:37 +0100885 }
886 operation->alg = 0;
887 return( PSA_SUCCESS );
888}
889
890psa_status_t psa_hash_start( psa_hash_operation_t *operation,
891 psa_algorithm_t alg )
892{
893 int ret;
894 operation->alg = 0;
895 switch( alg )
896 {
897#if defined(MBEDTLS_MD2_C)
898 case PSA_ALG_MD2:
899 mbedtls_md2_init( &operation->ctx.md2 );
900 ret = mbedtls_md2_starts_ret( &operation->ctx.md2 );
901 break;
902#endif
903#if defined(MBEDTLS_MD4_C)
904 case PSA_ALG_MD4:
905 mbedtls_md4_init( &operation->ctx.md4 );
906 ret = mbedtls_md4_starts_ret( &operation->ctx.md4 );
907 break;
908#endif
909#if defined(MBEDTLS_MD5_C)
910 case PSA_ALG_MD5:
911 mbedtls_md5_init( &operation->ctx.md5 );
912 ret = mbedtls_md5_starts_ret( &operation->ctx.md5 );
913 break;
914#endif
915#if defined(MBEDTLS_RIPEMD160_C)
916 case PSA_ALG_RIPEMD160:
917 mbedtls_ripemd160_init( &operation->ctx.ripemd160 );
918 ret = mbedtls_ripemd160_starts_ret( &operation->ctx.ripemd160 );
919 break;
920#endif
921#if defined(MBEDTLS_SHA1_C)
922 case PSA_ALG_SHA_1:
923 mbedtls_sha1_init( &operation->ctx.sha1 );
924 ret = mbedtls_sha1_starts_ret( &operation->ctx.sha1 );
925 break;
926#endif
927#if defined(MBEDTLS_SHA256_C)
928 case PSA_ALG_SHA_224:
929 mbedtls_sha256_init( &operation->ctx.sha256 );
930 ret = mbedtls_sha256_starts_ret( &operation->ctx.sha256, 1 );
931 break;
932 case PSA_ALG_SHA_256:
933 mbedtls_sha256_init( &operation->ctx.sha256 );
934 ret = mbedtls_sha256_starts_ret( &operation->ctx.sha256, 0 );
935 break;
936#endif
937#if defined(MBEDTLS_SHA512_C)
938 case PSA_ALG_SHA_384:
939 mbedtls_sha512_init( &operation->ctx.sha512 );
940 ret = mbedtls_sha512_starts_ret( &operation->ctx.sha512, 1 );
941 break;
942 case PSA_ALG_SHA_512:
943 mbedtls_sha512_init( &operation->ctx.sha512 );
944 ret = mbedtls_sha512_starts_ret( &operation->ctx.sha512, 0 );
945 break;
946#endif
947 default:
Gilles Peskinec06e0712018-06-20 16:21:04 +0200948 return( PSA_ALG_IS_HASH( alg ) ?
949 PSA_ERROR_NOT_SUPPORTED :
950 PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine9ef733f2018-02-07 21:05:37 +0100951 }
952 if( ret == 0 )
953 operation->alg = alg;
954 else
955 psa_hash_abort( operation );
956 return( mbedtls_to_psa_error( ret ) );
957}
958
959psa_status_t psa_hash_update( psa_hash_operation_t *operation,
960 const uint8_t *input,
961 size_t input_length )
962{
963 int ret;
964 switch( operation->alg )
965 {
966#if defined(MBEDTLS_MD2_C)
967 case PSA_ALG_MD2:
968 ret = mbedtls_md2_update_ret( &operation->ctx.md2,
969 input, input_length );
970 break;
971#endif
972#if defined(MBEDTLS_MD4_C)
973 case PSA_ALG_MD4:
974 ret = mbedtls_md4_update_ret( &operation->ctx.md4,
975 input, input_length );
976 break;
977#endif
978#if defined(MBEDTLS_MD5_C)
979 case PSA_ALG_MD5:
980 ret = mbedtls_md5_update_ret( &operation->ctx.md5,
981 input, input_length );
982 break;
983#endif
984#if defined(MBEDTLS_RIPEMD160_C)
985 case PSA_ALG_RIPEMD160:
986 ret = mbedtls_ripemd160_update_ret( &operation->ctx.ripemd160,
987 input, input_length );
988 break;
989#endif
990#if defined(MBEDTLS_SHA1_C)
991 case PSA_ALG_SHA_1:
992 ret = mbedtls_sha1_update_ret( &operation->ctx.sha1,
993 input, input_length );
994 break;
995#endif
996#if defined(MBEDTLS_SHA256_C)
997 case PSA_ALG_SHA_224:
998 case PSA_ALG_SHA_256:
999 ret = mbedtls_sha256_update_ret( &operation->ctx.sha256,
1000 input, input_length );
1001 break;
1002#endif
1003#if defined(MBEDTLS_SHA512_C)
1004 case PSA_ALG_SHA_384:
1005 case PSA_ALG_SHA_512:
1006 ret = mbedtls_sha512_update_ret( &operation->ctx.sha512,
1007 input, input_length );
1008 break;
1009#endif
1010 default:
1011 ret = MBEDTLS_ERR_MD_BAD_INPUT_DATA;
1012 break;
1013 }
1014 if( ret != 0 )
1015 psa_hash_abort( operation );
1016 return( mbedtls_to_psa_error( ret ) );
1017}
1018
1019psa_status_t psa_hash_finish( psa_hash_operation_t *operation,
1020 uint8_t *hash,
1021 size_t hash_size,
1022 size_t *hash_length )
1023{
1024 int ret;
Gilles Peskine71bb7b72018-04-19 08:29:59 +02001025 size_t actual_hash_length = PSA_HASH_SIZE( operation->alg );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001026
1027 /* Fill the output buffer with something that isn't a valid hash
1028 * (barring an attack on the hash and deliberately-crafted input),
1029 * in case the caller doesn't check the return status properly. */
Gilles Peskineaee13332018-07-02 12:15:28 +02001030 *hash_length = hash_size;
Gilles Peskine46f1fd72018-06-28 19:31:31 +02001031 /* If hash_size is 0 then hash may be NULL and then the
1032 * call to memset would have undefined behavior. */
1033 if( hash_size != 0 )
1034 memset( hash, '!', hash_size );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001035
1036 if( hash_size < actual_hash_length )
1037 return( PSA_ERROR_BUFFER_TOO_SMALL );
1038
1039 switch( operation->alg )
1040 {
1041#if defined(MBEDTLS_MD2_C)
1042 case PSA_ALG_MD2:
1043 ret = mbedtls_md2_finish_ret( &operation->ctx.md2, hash );
1044 break;
1045#endif
1046#if defined(MBEDTLS_MD4_C)
1047 case PSA_ALG_MD4:
1048 ret = mbedtls_md4_finish_ret( &operation->ctx.md4, hash );
1049 break;
1050#endif
1051#if defined(MBEDTLS_MD5_C)
1052 case PSA_ALG_MD5:
1053 ret = mbedtls_md5_finish_ret( &operation->ctx.md5, hash );
1054 break;
1055#endif
1056#if defined(MBEDTLS_RIPEMD160_C)
1057 case PSA_ALG_RIPEMD160:
1058 ret = mbedtls_ripemd160_finish_ret( &operation->ctx.ripemd160, hash );
1059 break;
1060#endif
1061#if defined(MBEDTLS_SHA1_C)
1062 case PSA_ALG_SHA_1:
1063 ret = mbedtls_sha1_finish_ret( &operation->ctx.sha1, hash );
1064 break;
1065#endif
1066#if defined(MBEDTLS_SHA256_C)
1067 case PSA_ALG_SHA_224:
1068 case PSA_ALG_SHA_256:
1069 ret = mbedtls_sha256_finish_ret( &operation->ctx.sha256, hash );
1070 break;
1071#endif
1072#if defined(MBEDTLS_SHA512_C)
1073 case PSA_ALG_SHA_384:
1074 case PSA_ALG_SHA_512:
1075 ret = mbedtls_sha512_finish_ret( &operation->ctx.sha512, hash );
1076 break;
1077#endif
1078 default:
1079 ret = MBEDTLS_ERR_MD_BAD_INPUT_DATA;
1080 break;
1081 }
1082
1083 if( ret == 0 )
1084 {
Gilles Peskineaee13332018-07-02 12:15:28 +02001085 *hash_length = actual_hash_length;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001086 return( psa_hash_abort( operation ) );
1087 }
1088 else
1089 {
1090 psa_hash_abort( operation );
1091 return( mbedtls_to_psa_error( ret ) );
1092 }
1093}
1094
Gilles Peskine2d277862018-06-18 15:41:12 +02001095psa_status_t psa_hash_verify( psa_hash_operation_t *operation,
1096 const uint8_t *hash,
1097 size_t hash_length )
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001098{
1099 uint8_t actual_hash[MBEDTLS_MD_MAX_SIZE];
1100 size_t actual_hash_length;
1101 psa_status_t status = psa_hash_finish( operation,
1102 actual_hash, sizeof( actual_hash ),
1103 &actual_hash_length );
1104 if( status != PSA_SUCCESS )
1105 return( status );
1106 if( actual_hash_length != hash_length )
1107 return( PSA_ERROR_INVALID_SIGNATURE );
1108 if( safer_memcmp( hash, actual_hash, actual_hash_length ) != 0 )
1109 return( PSA_ERROR_INVALID_SIGNATURE );
1110 return( PSA_SUCCESS );
1111}
1112
1113
1114
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001115/****************************************************************/
Gilles Peskine8c9def32018-02-08 10:02:12 +01001116/* MAC */
1117/****************************************************************/
1118
Gilles Peskinedc2fc842018-03-07 16:42:59 +01001119static const mbedtls_cipher_info_t *mbedtls_cipher_info_from_psa(
Gilles Peskine8c9def32018-02-08 10:02:12 +01001120 psa_algorithm_t alg,
1121 psa_key_type_t key_type,
Gilles Peskine2d277862018-06-18 15:41:12 +02001122 size_t key_bits,
mohammad1603f4f0d612018-06-03 15:04:51 +03001123 mbedtls_cipher_id_t* cipher_id )
Gilles Peskine8c9def32018-02-08 10:02:12 +01001124{
Gilles Peskine8c9def32018-02-08 10:02:12 +01001125 mbedtls_cipher_mode_t mode;
mohammad1603f4f0d612018-06-03 15:04:51 +03001126 mbedtls_cipher_id_t cipher_id_tmp;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001127
1128 if( PSA_ALG_IS_CIPHER( alg ) || PSA_ALG_IS_AEAD( alg ) )
1129 {
1130 if( PSA_ALG_IS_BLOCK_CIPHER( alg ) )
mohammad16038481e742018-03-18 13:57:31 +02001131 {
1132 alg &= ~PSA_ALG_BLOCK_CIPHER_PADDING_MASK;
1133 }
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001134
Nir Sonnenscheine9664c32018-06-17 14:41:30 +03001135 switch( alg )
Gilles Peskine8c9def32018-02-08 10:02:12 +01001136 {
1137 case PSA_ALG_STREAM_CIPHER:
1138 mode = MBEDTLS_MODE_STREAM;
1139 break;
1140 case PSA_ALG_CBC_BASE:
1141 mode = MBEDTLS_MODE_CBC;
1142 break;
1143 case PSA_ALG_CFB_BASE:
1144 mode = MBEDTLS_MODE_CFB;
1145 break;
1146 case PSA_ALG_OFB_BASE:
1147 mode = MBEDTLS_MODE_OFB;
1148 break;
1149 case PSA_ALG_CTR:
1150 mode = MBEDTLS_MODE_CTR;
1151 break;
1152 case PSA_ALG_CCM:
1153 mode = MBEDTLS_MODE_CCM;
1154 break;
1155 case PSA_ALG_GCM:
1156 mode = MBEDTLS_MODE_GCM;
1157 break;
1158 default:
1159 return( NULL );
1160 }
1161 }
1162 else if( alg == PSA_ALG_CMAC )
1163 mode = MBEDTLS_MODE_ECB;
1164 else if( alg == PSA_ALG_GMAC )
1165 mode = MBEDTLS_MODE_GCM;
1166 else
1167 return( NULL );
1168
1169 switch( key_type )
1170 {
1171 case PSA_KEY_TYPE_AES:
mohammad1603f4f0d612018-06-03 15:04:51 +03001172 cipher_id_tmp = MBEDTLS_CIPHER_ID_AES;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001173 break;
1174 case PSA_KEY_TYPE_DES:
Gilles Peskine9ad29e22018-06-21 09:40:04 +02001175 /* key_bits is 64 for Single-DES, 128 for two-key Triple-DES,
1176 * and 192 for three-key Triple-DES. */
Gilles Peskine8c9def32018-02-08 10:02:12 +01001177 if( key_bits == 64 )
mohammad1603f4f0d612018-06-03 15:04:51 +03001178 cipher_id_tmp = MBEDTLS_CIPHER_ID_DES;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001179 else
mohammad1603f4f0d612018-06-03 15:04:51 +03001180 cipher_id_tmp = MBEDTLS_CIPHER_ID_3DES;
Gilles Peskine9ad29e22018-06-21 09:40:04 +02001181 /* mbedtls doesn't recognize two-key Triple-DES as an algorithm,
1182 * but two-key Triple-DES is functionally three-key Triple-DES
1183 * with K1=K3, so that's how we present it to mbedtls. */
1184 if( key_bits == 128 )
1185 key_bits = 192;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001186 break;
1187 case PSA_KEY_TYPE_CAMELLIA:
mohammad1603f4f0d612018-06-03 15:04:51 +03001188 cipher_id_tmp = MBEDTLS_CIPHER_ID_CAMELLIA;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001189 break;
1190 case PSA_KEY_TYPE_ARC4:
mohammad1603f4f0d612018-06-03 15:04:51 +03001191 cipher_id_tmp = MBEDTLS_CIPHER_ID_ARC4;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001192 break;
1193 default:
1194 return( NULL );
1195 }
mohammad1603f4f0d612018-06-03 15:04:51 +03001196 if( cipher_id != NULL )
mohammad160360a64d02018-06-03 17:20:42 +03001197 *cipher_id = cipher_id_tmp;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001198
Jaeden Amero23bbb752018-06-26 14:16:54 +01001199 return( mbedtls_cipher_info_from_values( cipher_id_tmp,
1200 (int) key_bits, mode ) );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001201}
1202
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001203static size_t psa_get_hash_block_size( psa_algorithm_t alg )
Nir Sonnenschein96272412018-06-17 14:41:10 +03001204{
Gilles Peskine2d277862018-06-18 15:41:12 +02001205 switch( alg )
Nir Sonnenschein96272412018-06-17 14:41:10 +03001206 {
1207 case PSA_ALG_MD2:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001208 return( 16 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001209 case PSA_ALG_MD4:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001210 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001211 case PSA_ALG_MD5:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001212 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001213 case PSA_ALG_RIPEMD160:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001214 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001215 case PSA_ALG_SHA_1:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001216 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001217 case PSA_ALG_SHA_224:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001218 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001219 case PSA_ALG_SHA_256:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001220 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001221 case PSA_ALG_SHA_384:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001222 return( 128 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001223 case PSA_ALG_SHA_512:
Gilles Peskine2d277862018-06-18 15:41:12 +02001224 return( 128 );
1225 default:
1226 return( 0 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001227 }
1228}
Nir Sonnenschein0c9ec532018-06-07 13:27:47 +03001229
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02001230/* Initialize the MAC operation structure. Once this function has been
1231 * called, psa_mac_abort can run and will do the right thing. */
1232static psa_status_t psa_mac_init( psa_mac_operation_t *operation,
1233 psa_algorithm_t alg )
1234{
1235 psa_status_t status = PSA_ERROR_NOT_SUPPORTED;
1236
1237 operation->alg = alg;
1238 operation->key_set = 0;
1239 operation->iv_set = 0;
1240 operation->iv_required = 0;
1241 operation->has_input = 0;
1242 operation->key_usage_sign = 0;
1243 operation->key_usage_verify = 0;
1244
1245#if defined(MBEDTLS_CMAC_C)
1246 if( alg == PSA_ALG_CMAC )
1247 {
1248 operation->iv_required = 0;
1249 mbedtls_cipher_init( &operation->ctx.cmac );
1250 status = PSA_SUCCESS;
1251 }
1252 else
1253#endif /* MBEDTLS_CMAC_C */
1254#if defined(MBEDTLS_MD_C)
1255 if( PSA_ALG_IS_HMAC( operation->alg ) )
1256 {
1257 status = psa_hash_start( &operation->ctx.hmac.hash_ctx,
1258 PSA_ALG_HMAC_HASH( alg ) );
1259 }
1260 else
1261#endif /* MBEDTLS_MD_C */
1262 {
Gilles Peskinec06e0712018-06-20 16:21:04 +02001263 if( ! PSA_ALG_IS_MAC( alg ) )
1264 status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02001265 }
1266
1267 if( status != PSA_SUCCESS )
1268 memset( operation, 0, sizeof( *operation ) );
1269 return( status );
1270}
1271
Gilles Peskine8c9def32018-02-08 10:02:12 +01001272psa_status_t psa_mac_abort( psa_mac_operation_t *operation )
1273{
1274 switch( operation->alg )
1275 {
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02001276 case 0:
Gilles Peskine81736312018-06-26 15:04:31 +02001277 /* The object has (apparently) been initialized but it is not
1278 * in use. It's ok to call abort on such an object, and there's
1279 * nothing to do. */
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02001280 return( PSA_SUCCESS );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001281#if defined(MBEDTLS_CMAC_C)
1282 case PSA_ALG_CMAC:
1283 mbedtls_cipher_free( &operation->ctx.cmac );
1284 break;
1285#endif /* MBEDTLS_CMAC_C */
1286 default:
1287#if defined(MBEDTLS_MD_C)
1288 if( PSA_ALG_IS_HMAC( operation->alg ) )
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001289 {
Jaeden Amero5390f692018-06-26 14:18:50 +01001290 size_t block_size =
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001291 psa_get_hash_block_size( PSA_ALG_HMAC_HASH( operation->alg ) );
Nir Sonnenschein084832d2018-06-08 22:52:24 +03001292
Gilles Peskine99bc6492018-06-11 17:13:00 +02001293 if( block_size == 0 )
Nir Sonnenschein084832d2018-06-08 22:52:24 +03001294 return( PSA_ERROR_NOT_SUPPORTED );
1295
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001296 psa_hash_abort( &operation->ctx.hmac.hash_ctx );
Gilles Peskine2d277862018-06-18 15:41:12 +02001297 mbedtls_zeroize( operation->ctx.hmac.opad, block_size );
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001298 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01001299 else
1300#endif /* MBEDTLS_MD_C */
Gilles Peskinef9c2c092018-06-21 16:57:07 +02001301 {
1302 /* Sanity check (shouldn't happen: operation->alg should
1303 * always have been initialized to a valid value). */
1304 return( PSA_ERROR_BAD_STATE );
1305 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01001306 }
Moran Peker41deec42018-04-04 15:43:05 +03001307
Gilles Peskine8c9def32018-02-08 10:02:12 +01001308 operation->alg = 0;
1309 operation->key_set = 0;
1310 operation->iv_set = 0;
1311 operation->iv_required = 0;
1312 operation->has_input = 0;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02001313 operation->key_usage_sign = 0;
1314 operation->key_usage_verify = 0;
Moran Peker41deec42018-04-04 15:43:05 +03001315
Gilles Peskine8c9def32018-02-08 10:02:12 +01001316 return( PSA_SUCCESS );
1317}
1318
Gilles Peskinee3b07d82018-06-19 11:57:35 +02001319#if defined(MBEDTLS_CMAC_C)
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001320static int psa_cmac_start( psa_mac_operation_t *operation,
1321 size_t key_bits,
1322 key_slot_t *slot,
1323 const mbedtls_cipher_info_t *cipher_info )
1324{
1325 int ret;
1326
1327 operation->mac_size = cipher_info->block_size;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001328
1329 ret = mbedtls_cipher_setup( &operation->ctx.cmac, cipher_info );
1330 if( ret != 0 )
1331 return( ret );
1332
1333 ret = mbedtls_cipher_cmac_starts( &operation->ctx.cmac,
1334 slot->data.raw.data,
1335 key_bits );
1336 return( ret );
1337}
Gilles Peskinee3b07d82018-06-19 11:57:35 +02001338#endif /* MBEDTLS_CMAC_C */
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001339
Gilles Peskine248051a2018-06-20 16:09:38 +02001340#if defined(MBEDTLS_MD_C)
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001341static int psa_hmac_start( psa_mac_operation_t *operation,
1342 psa_key_type_t key_type,
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001343 key_slot_t *slot,
1344 psa_algorithm_t alg )
1345{
Gilles Peskineb3e6e5d2018-06-18 22:16:43 +02001346 unsigned char ipad[PSA_HMAC_MAX_HASH_BLOCK_SIZE];
Nir Sonnenschein5ca65472018-06-17 14:03:40 +03001347 unsigned char *opad = operation->ctx.hmac.opad;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001348 size_t i;
Gilles Peskinee1bc6802018-06-11 17:36:05 +02001349 size_t block_size =
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001350 psa_get_hash_block_size( PSA_ALG_HMAC_HASH( alg ) );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001351 unsigned int digest_size =
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001352 PSA_HASH_SIZE( PSA_ALG_HMAC_HASH( alg ) );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001353 size_t key_length = slot->data.raw.bytes;
1354 psa_status_t status;
1355
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001356 if( block_size == 0 || digest_size == 0 )
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001357 return( PSA_ERROR_NOT_SUPPORTED );
1358
1359 if( key_type != PSA_KEY_TYPE_HMAC )
1360 return( PSA_ERROR_INVALID_ARGUMENT );
1361
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001362 operation->mac_size = digest_size;
1363
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02001364 /* The hash was started earlier in psa_mac_init. */
Gilles Peskined223b522018-06-11 18:12:58 +02001365 if( key_length > block_size )
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001366 {
1367 status = psa_hash_update( &operation->ctx.hmac.hash_ctx,
Gilles Peskined223b522018-06-11 18:12:58 +02001368 slot->data.raw.data, slot->data.raw.bytes );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001369 if( status != PSA_SUCCESS )
1370 return( status );
1371 status = psa_hash_finish( &operation->ctx.hmac.hash_ctx,
Gilles Peskined223b522018-06-11 18:12:58 +02001372 ipad, sizeof( ipad ), &key_length );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001373 if( status != PSA_SUCCESS )
1374 return( status );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001375 }
Gilles Peskined223b522018-06-11 18:12:58 +02001376 else
1377 memcpy( ipad, slot->data.raw.data, slot->data.raw.bytes );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001378
Gilles Peskined223b522018-06-11 18:12:58 +02001379 /* ipad contains the key followed by garbage. Xor and fill with 0x36
1380 * to create the ipad value. */
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001381 for( i = 0; i < key_length; i++ )
Gilles Peskined223b522018-06-11 18:12:58 +02001382 ipad[i] ^= 0x36;
1383 memset( ipad + key_length, 0x36, block_size - key_length );
1384
1385 /* Copy the key material from ipad to opad, flipping the requisite bits,
1386 * and filling the rest of opad with the requisite constant. */
1387 for( i = 0; i < key_length; i++ )
1388 opad[i] = ipad[i] ^ 0x36 ^ 0x5C;
1389 memset( opad + key_length, 0x5C, block_size - key_length );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001390
1391 status = psa_hash_start( &operation->ctx.hmac.hash_ctx,
1392 PSA_ALG_HMAC_HASH( alg ) );
1393 if( status != PSA_SUCCESS )
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02001394 goto cleanup;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001395
1396 status = psa_hash_update( &operation->ctx.hmac.hash_ctx, ipad,
1397 block_size );
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02001398
1399cleanup:
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02001400 mbedtls_zeroize( ipad, key_length );
1401 /* opad is in the context. It needs to stay in memory if this function
1402 * succeeds, and it will be wiped by psa_mac_abort() called from
1403 * psa_mac_start in the error case. */
1404
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001405 return( status );
1406}
Gilles Peskine248051a2018-06-20 16:09:38 +02001407#endif /* MBEDTLS_MD_C */
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001408
Gilles Peskine8c9def32018-02-08 10:02:12 +01001409psa_status_t psa_mac_start( psa_mac_operation_t *operation,
1410 psa_key_slot_t key,
1411 psa_algorithm_t alg )
1412{
Gilles Peskine8c9def32018-02-08 10:02:12 +01001413 psa_status_t status;
1414 key_slot_t *slot;
1415 psa_key_type_t key_type;
1416 size_t key_bits;
Gilles Peskine828ed142018-06-18 23:25:51 +02001417 const mbedtls_cipher_info_t *cipher_info = NULL;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001418
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02001419 status = psa_mac_init( operation, alg );
1420 if( status != PSA_SUCCESS )
1421 return( status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001422
1423 status = psa_get_key_information( key, &key_type, &key_bits );
1424 if( status != PSA_SUCCESS )
1425 return( status );
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001426
Gilles Peskine8c9def32018-02-08 10:02:12 +01001427 slot = &global_data.key_slots[key];
Gilles Peskine99bc6492018-06-11 17:13:00 +02001428 if( slot->type == PSA_KEY_TYPE_NONE )
1429 return( PSA_ERROR_EMPTY_SLOT );
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001430
Moran Pekerd7326592018-05-29 16:56:39 +03001431 if( ( slot->policy.usage & PSA_KEY_USAGE_SIGN ) != 0 )
mohammad16036df908f2018-04-02 08:34:15 -07001432 operation->key_usage_sign = 1;
1433
Moran Pekerd7326592018-05-29 16:56:39 +03001434 if( ( slot->policy.usage & PSA_KEY_USAGE_VERIFY ) != 0 )
mohammad16036df908f2018-04-02 08:34:15 -07001435 operation->key_usage_verify = 1;
1436
Gilles Peskine8c9def32018-02-08 10:02:12 +01001437 if( ! PSA_ALG_IS_HMAC( alg ) )
1438 {
mohammad1603f4f0d612018-06-03 15:04:51 +03001439 cipher_info = mbedtls_cipher_info_from_psa( alg, key_type, key_bits, NULL );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001440 if( cipher_info == NULL )
1441 return( PSA_ERROR_NOT_SUPPORTED );
1442 operation->mac_size = cipher_info->block_size;
1443 }
1444 switch( alg )
1445 {
1446#if defined(MBEDTLS_CMAC_C)
1447 case PSA_ALG_CMAC:
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001448 status = mbedtls_to_psa_error( psa_cmac_start( operation,
1449 key_bits,
1450 slot,
1451 cipher_info ) );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001452 break;
1453#endif /* MBEDTLS_CMAC_C */
1454 default:
1455#if defined(MBEDTLS_MD_C)
1456 if( PSA_ALG_IS_HMAC( alg ) )
Gilles Peskined223b522018-06-11 18:12:58 +02001457 status = psa_hmac_start( operation, key_type, slot, alg );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001458 else
1459#endif /* MBEDTLS_MD_C */
1460 return( PSA_ERROR_NOT_SUPPORTED );
1461 }
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001462
Gilles Peskine8c9def32018-02-08 10:02:12 +01001463 /* If we reach this point, then the algorithm-specific part of the
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001464 * context may contain data that needs to be wiped on error. */
1465 if( status != PSA_SUCCESS )
Gilles Peskine8c9def32018-02-08 10:02:12 +01001466 {
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02001467 psa_mac_abort( operation );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001468 }
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001469 else
1470 {
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001471 operation->key_set = 1;
1472 }
1473 return( status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001474}
1475
1476psa_status_t psa_mac_update( psa_mac_operation_t *operation,
1477 const uint8_t *input,
1478 size_t input_length )
1479{
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001480 int ret = 0 ;
1481 psa_status_t status = PSA_SUCCESS;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001482 if( ! operation->key_set )
1483 return( PSA_ERROR_BAD_STATE );
1484 if( operation->iv_required && ! operation->iv_set )
1485 return( PSA_ERROR_BAD_STATE );
1486 operation->has_input = 1;
1487
1488 switch( operation->alg )
1489 {
1490#if defined(MBEDTLS_CMAC_C)
1491 case PSA_ALG_CMAC:
1492 ret = mbedtls_cipher_cmac_update( &operation->ctx.cmac,
1493 input, input_length );
1494 break;
1495#endif /* MBEDTLS_CMAC_C */
1496 default:
1497#if defined(MBEDTLS_MD_C)
1498 if( PSA_ALG_IS_HMAC( operation->alg ) )
1499 {
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001500 status = psa_hash_update( &operation->ctx.hmac.hash_ctx, input,
Gilles Peskine2d277862018-06-18 15:41:12 +02001501 input_length );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001502 }
1503 else
1504#endif /* MBEDTLS_MD_C */
1505 {
1506 ret = MBEDTLS_ERR_MD_BAD_INPUT_DATA;
1507 }
1508 break;
1509 }
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001510 if( ret != 0 || status != PSA_SUCCESS )
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001511 {
Nir Sonnenscheine9664c32018-06-17 14:41:30 +03001512 psa_mac_abort( operation );
Gilles Peskine2d277862018-06-18 15:41:12 +02001513 if( ret != 0 )
Nir Sonnenscheine9664c32018-06-17 14:41:30 +03001514 status = mbedtls_to_psa_error( ret );
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001515 }
1516
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001517 return( status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001518}
1519
mohammad16036df908f2018-04-02 08:34:15 -07001520static psa_status_t psa_mac_finish_internal( psa_mac_operation_t *operation,
Gilles Peskine2d277862018-06-18 15:41:12 +02001521 uint8_t *mac,
1522 size_t mac_size,
1523 size_t *mac_length )
Gilles Peskine8c9def32018-02-08 10:02:12 +01001524{
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001525 int ret = 0;
1526 psa_status_t status = PSA_SUCCESS;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001527
1528 /* Fill the output buffer with something that isn't a valid mac
1529 * (barring an attack on the mac and deliberately-crafted input),
1530 * in case the caller doesn't check the return status properly. */
Gilles Peskineaee13332018-07-02 12:15:28 +02001531 *mac_length = mac_size;
Gilles Peskine46f1fd72018-06-28 19:31:31 +02001532 /* If mac_size is 0 then mac may be NULL and then the
1533 * call to memset would have undefined behavior. */
1534 if( mac_size != 0 )
1535 memset( mac, '!', mac_size );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001536
Gilles Peskine1d96fff2018-07-02 12:15:39 +02001537 if( ! operation->key_set )
1538 return( PSA_ERROR_BAD_STATE );
1539 if( operation->iv_required && ! operation->iv_set )
1540 return( PSA_ERROR_BAD_STATE );
1541
Gilles Peskine8c9def32018-02-08 10:02:12 +01001542 if( mac_size < operation->mac_size )
1543 return( PSA_ERROR_BUFFER_TOO_SMALL );
1544
1545 switch( operation->alg )
1546 {
1547#if defined(MBEDTLS_CMAC_C)
1548 case PSA_ALG_CMAC:
1549 ret = mbedtls_cipher_cmac_finish( &operation->ctx.cmac, mac );
1550 break;
1551#endif /* MBEDTLS_CMAC_C */
1552 default:
1553#if defined(MBEDTLS_MD_C)
1554 if( PSA_ALG_IS_HMAC( operation->alg ) )
1555 {
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001556 unsigned char tmp[MBEDTLS_MD_MAX_SIZE];
Nir Sonnenschein5ca65472018-06-17 14:03:40 +03001557 unsigned char *opad = operation->ctx.hmac.opad;
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001558 size_t hash_size = 0;
Nir Sonnenschein96272412018-06-17 14:41:10 +03001559 size_t block_size =
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001560 psa_get_hash_block_size( PSA_ALG_HMAC_HASH( operation->alg ) );
Nir Sonnenschein084832d2018-06-08 22:52:24 +03001561
Gilles Peskine99bc6492018-06-11 17:13:00 +02001562 if( block_size == 0 )
1563 return( PSA_ERROR_NOT_SUPPORTED );
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001564
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001565 status = psa_hash_finish( &operation->ctx.hmac.hash_ctx, tmp,
Gilles Peskine99bc6492018-06-11 17:13:00 +02001566 sizeof( tmp ), &hash_size );
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001567 if( status != PSA_SUCCESS )
1568 goto cleanup;
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02001569 /* From here on, tmp needs to be wiped. */
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001570
1571 status = psa_hash_start( &operation->ctx.hmac.hash_ctx,
1572 PSA_ALG_HMAC_HASH( operation->alg ) );
1573 if( status != PSA_SUCCESS )
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02001574 goto hmac_cleanup;
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001575
1576 status = psa_hash_update( &operation->ctx.hmac.hash_ctx, opad,
Nir Sonnenschein0c9ec532018-06-07 13:27:47 +03001577 block_size );
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001578 if( status != PSA_SUCCESS )
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02001579 goto hmac_cleanup;
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001580
1581 status = psa_hash_update( &operation->ctx.hmac.hash_ctx, tmp,
Gilles Peskine2d277862018-06-18 15:41:12 +02001582 hash_size );
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001583 if( status != PSA_SUCCESS )
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02001584 goto hmac_cleanup;
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001585
1586 status = psa_hash_finish( &operation->ctx.hmac.hash_ctx, mac,
1587 mac_size, mac_length );
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02001588 hmac_cleanup:
1589 mbedtls_zeroize( tmp, hash_size );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001590 }
1591 else
1592#endif /* MBEDTLS_MD_C */
1593 {
1594 ret = MBEDTLS_ERR_MD_BAD_INPUT_DATA;
1595 }
1596 break;
1597 }
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001598cleanup:
Gilles Peskine8c9def32018-02-08 10:02:12 +01001599
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001600 if( ret == 0 && status == PSA_SUCCESS )
Gilles Peskine8c9def32018-02-08 10:02:12 +01001601 {
Gilles Peskineaee13332018-07-02 12:15:28 +02001602 *mac_length = operation->mac_size;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001603 return( psa_mac_abort( operation ) );
1604 }
1605 else
1606 {
1607 psa_mac_abort( operation );
Gilles Peskine99bc6492018-06-11 17:13:00 +02001608 if( ret != 0 )
Gilles Peskine2d277862018-06-18 15:41:12 +02001609 status = mbedtls_to_psa_error( ret );
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001610
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001611 return( status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001612 }
1613}
1614
mohammad16036df908f2018-04-02 08:34:15 -07001615psa_status_t psa_mac_finish( psa_mac_operation_t *operation,
1616 uint8_t *mac,
1617 size_t mac_size,
1618 size_t *mac_length )
1619{
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001620 if( ! operation->key_usage_sign )
mohammad16036df908f2018-04-02 08:34:15 -07001621 return( PSA_ERROR_NOT_PERMITTED );
1622
Gilles Peskine99bc6492018-06-11 17:13:00 +02001623 return( psa_mac_finish_internal( operation, mac,
1624 mac_size, mac_length ) );
mohammad16036df908f2018-04-02 08:34:15 -07001625}
1626
Gilles Peskine8c9def32018-02-08 10:02:12 +01001627psa_status_t psa_mac_verify( psa_mac_operation_t *operation,
1628 const uint8_t *mac,
1629 size_t mac_length )
1630{
Gilles Peskine828ed142018-06-18 23:25:51 +02001631 uint8_t actual_mac[PSA_MAC_MAX_SIZE];
Gilles Peskine8c9def32018-02-08 10:02:12 +01001632 size_t actual_mac_length;
mohammad16036df908f2018-04-02 08:34:15 -07001633 psa_status_t status;
1634
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001635 if( ! operation->key_usage_verify )
mohammad16036df908f2018-04-02 08:34:15 -07001636 return( PSA_ERROR_NOT_PERMITTED );
1637
1638 status = psa_mac_finish_internal( operation,
1639 actual_mac, sizeof( actual_mac ),
1640 &actual_mac_length );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001641 if( status != PSA_SUCCESS )
1642 return( status );
1643 if( actual_mac_length != mac_length )
1644 return( PSA_ERROR_INVALID_SIGNATURE );
1645 if( safer_memcmp( mac, actual_mac, actual_mac_length ) != 0 )
1646 return( PSA_ERROR_INVALID_SIGNATURE );
1647 return( PSA_SUCCESS );
1648}
1649
1650
Gilles Peskine20035e32018-02-03 22:44:14 +01001651
Gilles Peskine20035e32018-02-03 22:44:14 +01001652/****************************************************************/
1653/* Asymmetric cryptography */
1654/****************************************************************/
1655
Gilles Peskine2b450e32018-06-27 15:42:46 +02001656#if defined(MBEDTLS_RSA_C)
Gilles Peskine8b18a4f2018-06-08 16:34:46 +02001657/* Decode the hash algorithm from alg and store the mbedtls encoding in
1658 * md_alg. Verify that the hash length is consistent. */
1659static psa_status_t psa_rsa_decode_md_type( psa_algorithm_t alg,
1660 size_t hash_length,
1661 mbedtls_md_type_t *md_alg )
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03001662{
Gilles Peskine7ed29c52018-06-26 15:50:08 +02001663 psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH( alg );
Gilles Peskine61b91d42018-06-08 16:09:36 +02001664 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
1665 *md_alg = hash_alg == 0 ? MBEDTLS_MD_NONE : mbedtls_md_get_type( md_info );
1666 if( *md_alg == MBEDTLS_MD_NONE )
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03001667 {
1668#if SIZE_MAX > UINT_MAX
Gilles Peskine61b91d42018-06-08 16:09:36 +02001669 if( hash_length > UINT_MAX )
1670 return( PSA_ERROR_INVALID_ARGUMENT );
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03001671#endif
1672 }
1673 else
1674 {
Gilles Peskine61b91d42018-06-08 16:09:36 +02001675 if( mbedtls_md_get_size( md_info ) != hash_length )
1676 return( PSA_ERROR_INVALID_ARGUMENT );
1677 if( md_info == NULL )
1678 return( PSA_ERROR_NOT_SUPPORTED );
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03001679 }
Gilles Peskine61b91d42018-06-08 16:09:36 +02001680 return( PSA_SUCCESS );
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03001681}
1682
Gilles Peskine2b450e32018-06-27 15:42:46 +02001683static psa_status_t psa_rsa_sign( mbedtls_rsa_context *rsa,
1684 psa_algorithm_t alg,
1685 const uint8_t *hash,
1686 size_t hash_length,
1687 uint8_t *signature,
1688 size_t signature_size,
1689 size_t *signature_length )
1690{
1691 psa_status_t status;
1692 int ret;
1693 mbedtls_md_type_t md_alg;
1694
1695 status = psa_rsa_decode_md_type( alg, hash_length, &md_alg );
1696 if( status != PSA_SUCCESS )
1697 return( status );
1698
1699 if( signature_size < rsa->len )
1700 return( PSA_ERROR_BUFFER_TOO_SMALL );
1701
Jaeden Amerobbf97e32018-06-26 14:20:51 +01001702 /* The Mbed TLS RSA module uses an unsigned int for hash_length. See if
1703 * hash_length will fit and return an error if it doesn't. */
1704#if defined(MBEDTLS_PKCS1_V15) || defined(MBEDTLS_PKCS1_V21)
1705#if SIZE_MAX > UINT_MAX
1706 if( hash_length > UINT_MAX )
1707 return( PSA_ERROR_NOT_SUPPORTED );
1708#endif
1709#endif
1710
Gilles Peskine2b450e32018-06-27 15:42:46 +02001711#if defined(MBEDTLS_PKCS1_V15)
1712 if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) )
1713 {
1714 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V15,
1715 MBEDTLS_MD_NONE );
1716 ret = mbedtls_rsa_pkcs1_sign( rsa,
1717 mbedtls_ctr_drbg_random,
1718 &global_data.ctr_drbg,
1719 MBEDTLS_RSA_PRIVATE,
Jaeden Amerobbf97e32018-06-26 14:20:51 +01001720 md_alg,
1721 (unsigned int) hash_length,
1722 hash,
Gilles Peskine2b450e32018-06-27 15:42:46 +02001723 signature );
1724 }
1725 else
1726#endif /* MBEDTLS_PKCS1_V15 */
1727#if defined(MBEDTLS_PKCS1_V21)
1728 if( PSA_ALG_IS_RSA_PSS( alg ) )
1729 {
1730 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
1731 ret = mbedtls_rsa_rsassa_pss_sign( rsa,
1732 mbedtls_ctr_drbg_random,
1733 &global_data.ctr_drbg,
1734 MBEDTLS_RSA_PRIVATE,
Jaeden Amerobbf97e32018-06-26 14:20:51 +01001735 md_alg,
1736 (unsigned int) hash_length,
1737 hash,
Gilles Peskine2b450e32018-06-27 15:42:46 +02001738 signature );
1739 }
1740 else
1741#endif /* MBEDTLS_PKCS1_V21 */
1742 {
1743 return( PSA_ERROR_INVALID_ARGUMENT );
1744 }
1745
1746 if( ret == 0 )
1747 *signature_length = rsa->len;
1748 return( mbedtls_to_psa_error( ret ) );
1749}
1750
1751static psa_status_t psa_rsa_verify( mbedtls_rsa_context *rsa,
1752 psa_algorithm_t alg,
1753 const uint8_t *hash,
1754 size_t hash_length,
1755 const uint8_t *signature,
1756 size_t signature_length )
1757{
1758 psa_status_t status;
1759 int ret;
1760 mbedtls_md_type_t md_alg;
1761
1762 status = psa_rsa_decode_md_type( alg, hash_length, &md_alg );
1763 if( status != PSA_SUCCESS )
1764 return( status );
1765
1766 if( signature_length < rsa->len )
1767 return( PSA_ERROR_BUFFER_TOO_SMALL );
1768
Jaeden Amerobbf97e32018-06-26 14:20:51 +01001769#if defined(MBEDTLS_PKCS1_V15) || defined(MBEDTLS_PKCS1_V21)
1770#if SIZE_MAX > UINT_MAX
1771 /* The Mbed TLS RSA module uses an unsigned int for hash_length. See if
1772 * hash_length will fit and return an error if it doesn't. */
1773 if( hash_length > UINT_MAX )
1774 return( PSA_ERROR_NOT_SUPPORTED );
1775#endif
1776#endif
1777
Gilles Peskine2b450e32018-06-27 15:42:46 +02001778#if defined(MBEDTLS_PKCS1_V15)
1779 if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) )
1780 {
1781 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V15,
1782 MBEDTLS_MD_NONE );
1783 ret = mbedtls_rsa_pkcs1_verify( rsa,
1784 mbedtls_ctr_drbg_random,
1785 &global_data.ctr_drbg,
1786 MBEDTLS_RSA_PUBLIC,
1787 md_alg,
Jaeden Amerobbf97e32018-06-26 14:20:51 +01001788 (unsigned int) hash_length,
Gilles Peskine2b450e32018-06-27 15:42:46 +02001789 hash,
1790 signature );
1791 }
1792 else
1793#endif /* MBEDTLS_PKCS1_V15 */
1794#if defined(MBEDTLS_PKCS1_V21)
1795 if( PSA_ALG_IS_RSA_PSS( alg ) )
1796 {
1797 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
1798 ret = mbedtls_rsa_rsassa_pss_verify( rsa,
1799 mbedtls_ctr_drbg_random,
1800 &global_data.ctr_drbg,
1801 MBEDTLS_RSA_PUBLIC,
Jaeden Amerobbf97e32018-06-26 14:20:51 +01001802 md_alg,
1803 (unsigned int) hash_length,
1804 hash,
Gilles Peskine2b450e32018-06-27 15:42:46 +02001805 signature );
1806 }
1807 else
1808#endif /* MBEDTLS_PKCS1_V21 */
1809 {
1810 return( PSA_ERROR_INVALID_ARGUMENT );
1811 }
1812 return( mbedtls_to_psa_error( ret ) );
1813}
1814#endif /* MBEDTLS_RSA_C */
1815
Gilles Peskinea81d85b2018-06-26 16:10:23 +02001816#if defined(MBEDTLS_ECDSA_C)
Gilles Peskinea81d85b2018-06-26 16:10:23 +02001817/* `ecp` cannot be const because `ecp->grp` needs to be non-const
1818 * for mbedtls_ecdsa_sign() and mbedtls_ecdsa_sign_det()
1819 * (even though these functions don't modify it). */
1820static psa_status_t psa_ecdsa_sign( mbedtls_ecp_keypair *ecp,
1821 psa_algorithm_t alg,
1822 const uint8_t *hash,
1823 size_t hash_length,
1824 uint8_t *signature,
1825 size_t signature_size,
1826 size_t *signature_length )
1827{
1828 int ret;
1829 mbedtls_mpi r, s;
Gilles Peskineeae6eee2018-06-28 13:56:01 +02001830 size_t curve_bytes = PSA_BITS_TO_BYTES( ecp->grp.pbits );
Gilles Peskinea81d85b2018-06-26 16:10:23 +02001831 mbedtls_mpi_init( &r );
1832 mbedtls_mpi_init( &s );
1833
Gilles Peskineeae6eee2018-06-28 13:56:01 +02001834 if( signature_size < 2 * curve_bytes )
1835 {
1836 ret = MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL;
1837 goto cleanup;
1838 }
Gilles Peskinea81d85b2018-06-26 16:10:23 +02001839
1840 if( PSA_ALG_DSA_IS_DETERMINISTIC( alg ) )
1841 {
1842 psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH( alg );
1843 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
1844 mbedtls_md_type_t md_alg = mbedtls_md_get_type( md_info );
1845 MBEDTLS_MPI_CHK( mbedtls_ecdsa_sign_det( &ecp->grp, &r, &s, &ecp->d,
1846 hash, hash_length,
1847 md_alg ) );
1848 }
1849 else
1850 {
1851 MBEDTLS_MPI_CHK( mbedtls_ecdsa_sign( &ecp->grp, &r, &s, &ecp->d,
1852 hash, hash_length,
1853 mbedtls_ctr_drbg_random,
1854 &global_data.ctr_drbg ) );
1855 }
Gilles Peskineeae6eee2018-06-28 13:56:01 +02001856
1857 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &r,
1858 signature,
1859 curve_bytes ) );
1860 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &s,
1861 signature + curve_bytes,
1862 curve_bytes ) );
1863
1864cleanup:
1865 mbedtls_mpi_free( &r );
1866 mbedtls_mpi_free( &s );
1867 if( ret == 0 )
1868 *signature_length = 2 * curve_bytes;
Gilles Peskineeae6eee2018-06-28 13:56:01 +02001869 return( mbedtls_to_psa_error( ret ) );
1870}
1871
1872static psa_status_t psa_ecdsa_verify( mbedtls_ecp_keypair *ecp,
1873 const uint8_t *hash,
1874 size_t hash_length,
1875 const uint8_t *signature,
1876 size_t signature_length )
1877{
1878 int ret;
1879 mbedtls_mpi r, s;
1880 size_t curve_bytes = PSA_BITS_TO_BYTES( ecp->grp.pbits );
1881 mbedtls_mpi_init( &r );
1882 mbedtls_mpi_init( &s );
1883
1884 if( signature_length != 2 * curve_bytes )
1885 return( PSA_ERROR_INVALID_SIGNATURE );
1886
1887 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &r,
1888 signature,
1889 curve_bytes ) );
1890 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &s,
1891 signature + curve_bytes,
1892 curve_bytes ) );
1893
1894 ret = mbedtls_ecdsa_verify( &ecp->grp, hash, hash_length,
1895 &ecp->Q, &r, &s );
Gilles Peskinea81d85b2018-06-26 16:10:23 +02001896
1897cleanup:
1898 mbedtls_mpi_free( &r );
1899 mbedtls_mpi_free( &s );
1900 return( mbedtls_to_psa_error( ret ) );
1901}
1902#endif /* MBEDTLS_ECDSA_C */
1903
Gilles Peskine61b91d42018-06-08 16:09:36 +02001904psa_status_t psa_asymmetric_sign( psa_key_slot_t key,
1905 psa_algorithm_t alg,
1906 const uint8_t *hash,
1907 size_t hash_length,
1908 const uint8_t *salt,
1909 size_t salt_length,
1910 uint8_t *signature,
1911 size_t signature_size,
1912 size_t *signature_length )
Gilles Peskine20035e32018-02-03 22:44:14 +01001913{
1914 key_slot_t *slot;
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02001915 psa_status_t status;
1916
1917 *signature_length = signature_size;
1918
Gilles Peskine93aa0332018-02-03 23:58:03 +01001919 (void) salt;
1920 (void) salt_length;
1921
Gilles Peskine828ed142018-06-18 23:25:51 +02001922 if( key == 0 || key > PSA_KEY_SLOT_COUNT )
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02001923 {
1924 status = PSA_ERROR_EMPTY_SLOT;
1925 goto exit;
1926 }
Gilles Peskine20035e32018-02-03 22:44:14 +01001927 slot = &global_data.key_slots[key];
1928 if( slot->type == PSA_KEY_TYPE_NONE )
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02001929 {
1930 status = PSA_ERROR_EMPTY_SLOT;
1931 goto exit;
1932 }
Gilles Peskine20035e32018-02-03 22:44:14 +01001933 if( ! PSA_KEY_TYPE_IS_KEYPAIR( slot->type ) )
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02001934 {
1935 status = PSA_ERROR_INVALID_ARGUMENT;
1936 goto exit;
1937 }
Gilles Peskine61b91d42018-06-08 16:09:36 +02001938 if( ! ( slot->policy.usage & PSA_KEY_USAGE_SIGN ) )
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02001939 {
1940 status = PSA_ERROR_NOT_PERMITTED;
1941 goto exit;
1942 }
Gilles Peskine20035e32018-02-03 22:44:14 +01001943
Gilles Peskine20035e32018-02-03 22:44:14 +01001944#if defined(MBEDTLS_RSA_C)
1945 if( slot->type == PSA_KEY_TYPE_RSA_KEYPAIR )
1946 {
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02001947 status = psa_rsa_sign( slot->data.rsa,
1948 alg,
1949 hash, hash_length,
1950 signature, signature_size,
1951 signature_length );
Gilles Peskine20035e32018-02-03 22:44:14 +01001952 }
1953 else
1954#endif /* defined(MBEDTLS_RSA_C) */
1955#if defined(MBEDTLS_ECP_C)
1956 if( PSA_KEY_TYPE_IS_ECC( slot->type ) )
1957 {
Gilles Peskinea81d85b2018-06-26 16:10:23 +02001958#if defined(MBEDTLS_ECDSA_C)
1959 if( PSA_ALG_IS_ECDSA( alg ) )
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02001960 status = psa_ecdsa_sign( slot->data.ecp,
1961 alg,
1962 hash, hash_length,
1963 signature, signature_size,
1964 signature_length );
Gilles Peskinea81d85b2018-06-26 16:10:23 +02001965 else
1966#endif /* defined(MBEDTLS_ECDSA_C) */
1967 {
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02001968 status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea81d85b2018-06-26 16:10:23 +02001969 }
itayzafrir5c753392018-05-08 11:18:38 +03001970 }
1971 else
1972#endif /* defined(MBEDTLS_ECP_C) */
1973 {
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02001974 status = PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine20035e32018-02-03 22:44:14 +01001975 }
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02001976
1977exit:
1978 /* Fill the unused part of the output buffer (the whole buffer on error,
1979 * the trailing part on success) with something that isn't a valid mac
1980 * (barring an attack on the mac and deliberately-crafted input),
1981 * in case the caller doesn't check the return status properly. */
1982 if( status == PSA_SUCCESS )
1983 memset( signature + *signature_length, '!',
1984 signature_size - *signature_length );
Gilles Peskine46f1fd72018-06-28 19:31:31 +02001985 else if( signature_size != 0 )
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02001986 memset( signature, '!', signature_size );
Gilles Peskine46f1fd72018-06-28 19:31:31 +02001987 /* If signature_size is 0 then we have nothing to do. We must not call
1988 * memset because signature may be NULL in this case. */
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02001989 return( status );
itayzafrir5c753392018-05-08 11:18:38 +03001990}
1991
1992psa_status_t psa_asymmetric_verify( psa_key_slot_t key,
1993 psa_algorithm_t alg,
1994 const uint8_t *hash,
1995 size_t hash_length,
1996 const uint8_t *salt,
1997 size_t salt_length,
Gilles Peskinee9191ff2018-06-27 14:58:41 +02001998 const uint8_t *signature,
Gilles Peskine526fab02018-06-27 18:19:40 +02001999 size_t signature_length )
itayzafrir5c753392018-05-08 11:18:38 +03002000{
2001 key_slot_t *slot;
Gilles Peskine2b450e32018-06-27 15:42:46 +02002002
itayzafrir5c753392018-05-08 11:18:38 +03002003 (void) salt;
2004 (void) salt_length;
2005
Gilles Peskine828ed142018-06-18 23:25:51 +02002006 if( key == 0 || key > PSA_KEY_SLOT_COUNT )
itayzafrir5c753392018-05-08 11:18:38 +03002007 return( PSA_ERROR_INVALID_ARGUMENT );
2008 slot = &global_data.key_slots[key];
2009 if( slot->type == PSA_KEY_TYPE_NONE )
2010 return( PSA_ERROR_EMPTY_SLOT );
Gilles Peskine61b91d42018-06-08 16:09:36 +02002011 if( ! ( slot->policy.usage & PSA_KEY_USAGE_VERIFY ) )
itayzafrir5c753392018-05-08 11:18:38 +03002012 return( PSA_ERROR_NOT_PERMITTED );
2013
Gilles Peskine61b91d42018-06-08 16:09:36 +02002014#if defined(MBEDTLS_RSA_C)
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02002015 if( slot->type == PSA_KEY_TYPE_RSA_KEYPAIR ||
2016 slot->type == PSA_KEY_TYPE_RSA_PUBLIC_KEY )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002017 {
Gilles Peskine2b450e32018-06-27 15:42:46 +02002018 return( psa_rsa_verify( slot->data.rsa,
2019 alg,
2020 hash, hash_length,
2021 signature, signature_length ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002022 }
2023 else
2024#endif /* defined(MBEDTLS_RSA_C) */
itayzafrir5c753392018-05-08 11:18:38 +03002025#if defined(MBEDTLS_ECP_C)
2026 if( PSA_KEY_TYPE_IS_ECC( slot->type ) )
2027 {
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002028#if defined(MBEDTLS_ECDSA_C)
2029 if( PSA_ALG_IS_ECDSA( alg ) )
Gilles Peskineeae6eee2018-06-28 13:56:01 +02002030 return( psa_ecdsa_verify( slot->data.ecp,
2031 hash, hash_length,
2032 signature, signature_length ) );
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002033 else
2034#endif /* defined(MBEDTLS_ECDSA_C) */
2035 {
2036 return( PSA_ERROR_INVALID_ARGUMENT );
2037 }
itayzafrir5c753392018-05-08 11:18:38 +03002038 }
Gilles Peskine20035e32018-02-03 22:44:14 +01002039 else
2040#endif /* defined(MBEDTLS_ECP_C) */
2041 {
2042 return( PSA_ERROR_NOT_SUPPORTED );
2043 }
2044}
2045
Gilles Peskine61b91d42018-06-08 16:09:36 +02002046psa_status_t psa_asymmetric_encrypt( psa_key_slot_t key,
2047 psa_algorithm_t alg,
2048 const uint8_t *input,
2049 size_t input_length,
2050 const uint8_t *salt,
2051 size_t salt_length,
2052 uint8_t *output,
2053 size_t output_size,
2054 size_t *output_length )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002055{
2056 key_slot_t *slot;
2057 (void) salt;
2058 (void) salt_length;
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03002059 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002060
Gilles Peskine828ed142018-06-18 23:25:51 +02002061 if( key == 0 || key > PSA_KEY_SLOT_COUNT )
Nir Sonnenschein7f5a3192018-05-06 22:26:54 +03002062 return( PSA_ERROR_INVALID_ARGUMENT );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002063 slot = &global_data.key_slots[key];
2064 if( slot->type == PSA_KEY_TYPE_NONE )
2065 return( PSA_ERROR_EMPTY_SLOT );
2066 if( ! PSA_KEY_TYPE_IS_KEYPAIR( slot->type ) )
2067 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine61b91d42018-06-08 16:09:36 +02002068 if( ! ( slot->policy.usage & PSA_KEY_USAGE_ENCRYPT ) )
2069 return( PSA_ERROR_NOT_PERMITTED );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002070
2071#if defined(MBEDTLS_RSA_C)
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02002072 if( slot->type == PSA_KEY_TYPE_RSA_KEYPAIR ||
2073 slot->type == PSA_KEY_TYPE_RSA_PUBLIC_KEY )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002074 {
2075 mbedtls_rsa_context *rsa = slot->data.rsa;
2076 int ret;
Gilles Peskine5b051bc2018-05-31 13:25:48 +02002077 if( output_size < rsa->len )
Gilles Peskine61b91d42018-06-08 16:09:36 +02002078 return( PSA_ERROR_INVALID_ARGUMENT );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002079#if defined(MBEDTLS_PKCS1_V15)
Gilles Peskine6afe7892018-05-31 13:16:08 +02002080 if( alg == PSA_ALG_RSA_PKCS1V15_CRYPT )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002081 {
Gilles Peskine61b91d42018-06-08 16:09:36 +02002082 ret = mbedtls_rsa_pkcs1_encrypt( rsa,
2083 mbedtls_ctr_drbg_random,
2084 &global_data.ctr_drbg,
2085 MBEDTLS_RSA_PUBLIC,
2086 input_length,
2087 input,
2088 output );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002089 }
2090 else
2091#endif /* MBEDTLS_PKCS1_V15 */
2092#if defined(MBEDTLS_PKCS1_V21)
Gilles Peskine55bf3d12018-06-26 15:53:48 +02002093 if( PSA_ALG_IS_RSA_OAEP( alg ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002094 {
2095 return( PSA_ERROR_NOT_SUPPORTED );
2096 }
2097 else
2098#endif /* MBEDTLS_PKCS1_V21 */
2099 {
2100 return( PSA_ERROR_INVALID_ARGUMENT );
2101 }
2102 if( ret == 0 )
Nir Sonnenschein717a0402018-06-04 16:36:15 +03002103 *output_length = rsa->len;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002104 return( mbedtls_to_psa_error( ret ) );
2105 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002106 else
Gilles Peskineb75e4f12018-06-08 17:44:47 +02002107#endif /* defined(MBEDTLS_RSA_C) */
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002108 {
2109 return( PSA_ERROR_NOT_SUPPORTED );
2110 }
Gilles Peskine5b051bc2018-05-31 13:25:48 +02002111}
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002112
Gilles Peskine61b91d42018-06-08 16:09:36 +02002113psa_status_t psa_asymmetric_decrypt( psa_key_slot_t key,
2114 psa_algorithm_t alg,
2115 const uint8_t *input,
2116 size_t input_length,
2117 const uint8_t *salt,
2118 size_t salt_length,
2119 uint8_t *output,
2120 size_t output_size,
2121 size_t *output_length )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002122{
2123 key_slot_t *slot;
2124 (void) salt;
2125 (void) salt_length;
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03002126 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002127
Gilles Peskine828ed142018-06-18 23:25:51 +02002128 if( key == 0 || key > PSA_KEY_SLOT_COUNT )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002129 return( PSA_ERROR_EMPTY_SLOT );
2130 slot = &global_data.key_slots[key];
2131 if( slot->type == PSA_KEY_TYPE_NONE )
2132 return( PSA_ERROR_EMPTY_SLOT );
2133 if( ! PSA_KEY_TYPE_IS_KEYPAIR( slot->type ) )
2134 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine61b91d42018-06-08 16:09:36 +02002135 if( ! ( slot->policy.usage & PSA_KEY_USAGE_DECRYPT ) )
2136 return( PSA_ERROR_NOT_PERMITTED );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002137
2138#if defined(MBEDTLS_RSA_C)
2139 if( slot->type == PSA_KEY_TYPE_RSA_KEYPAIR )
2140 {
2141 mbedtls_rsa_context *rsa = slot->data.rsa;
2142 int ret;
2143
Gilles Peskinec4def2f2018-06-08 17:53:48 +02002144 if( input_length != rsa->len )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002145 return( PSA_ERROR_INVALID_ARGUMENT );
2146
2147#if defined(MBEDTLS_PKCS1_V15)
Gilles Peskine6afe7892018-05-31 13:16:08 +02002148 if( alg == PSA_ALG_RSA_PKCS1V15_CRYPT )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002149 {
Gilles Peskine61b91d42018-06-08 16:09:36 +02002150 ret = mbedtls_rsa_pkcs1_decrypt( rsa,
2151 mbedtls_ctr_drbg_random,
2152 &global_data.ctr_drbg,
2153 MBEDTLS_RSA_PRIVATE,
2154 output_length,
2155 input,
2156 output,
2157 output_size );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002158 }
2159 else
2160#endif /* MBEDTLS_PKCS1_V15 */
2161#if defined(MBEDTLS_PKCS1_V21)
Gilles Peskine55bf3d12018-06-26 15:53:48 +02002162 if( PSA_ALG_IS_RSA_OAEP( alg ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002163 {
2164 return( PSA_ERROR_NOT_SUPPORTED );
2165 }
2166 else
2167#endif /* MBEDTLS_PKCS1_V21 */
2168 {
2169 return( PSA_ERROR_INVALID_ARGUMENT );
2170 }
Nir Sonnenschein717a0402018-06-04 16:36:15 +03002171
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002172 return( mbedtls_to_psa_error( ret ) );
2173 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002174 else
Gilles Peskineb75e4f12018-06-08 17:44:47 +02002175#endif /* defined(MBEDTLS_RSA_C) */
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002176 {
2177 return( PSA_ERROR_NOT_SUPPORTED );
2178 }
Gilles Peskine5b051bc2018-05-31 13:25:48 +02002179}
Gilles Peskine20035e32018-02-03 22:44:14 +01002180
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02002181
2182
mohammad1603503973b2018-03-12 15:59:30 +02002183/****************************************************************/
2184/* Symmetric cryptography */
2185/****************************************************************/
2186
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002187/* Initialize the cipher operation structure. Once this function has been
2188 * called, psa_cipher_abort can run and will do the right thing. */
2189static psa_status_t psa_cipher_init( psa_cipher_operation_t *operation,
2190 psa_algorithm_t alg )
2191{
Gilles Peskinec06e0712018-06-20 16:21:04 +02002192 if( ! PSA_ALG_IS_CIPHER( alg ) )
2193 {
2194 memset( operation, 0, sizeof( *operation ) );
2195 return( PSA_ERROR_INVALID_ARGUMENT );
2196 }
2197
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002198 operation->alg = alg;
2199 operation->key_set = 0;
2200 operation->iv_set = 0;
2201 operation->iv_required = 1;
2202 operation->iv_size = 0;
2203 operation->block_size = 0;
2204 mbedtls_cipher_init( &operation->ctx.cipher );
2205 return( PSA_SUCCESS );
2206}
2207
Gilles Peskinee553c652018-06-04 16:22:46 +02002208static psa_status_t psa_cipher_setup( psa_cipher_operation_t *operation,
2209 psa_key_slot_t key,
Gilles Peskine7e928852018-06-04 16:23:10 +02002210 psa_algorithm_t alg,
2211 mbedtls_operation_t cipher_operation )
mohammad1603503973b2018-03-12 15:59:30 +02002212{
2213 int ret = MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE;
2214 psa_status_t status;
2215 key_slot_t *slot;
2216 psa_key_type_t key_type;
2217 size_t key_bits;
2218 const mbedtls_cipher_info_t *cipher_info = NULL;
2219
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002220 status = psa_cipher_init( operation, alg );
2221 if( status != PSA_SUCCESS )
2222 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02002223
2224 status = psa_get_key_information( key, &key_type, &key_bits );
2225 if( status != PSA_SUCCESS )
2226 return( status );
2227 slot = &global_data.key_slots[key];
2228
Gilles Peskinebb1072f2018-06-08 18:46:05 +02002229 cipher_info = mbedtls_cipher_info_from_psa( alg, key_type, key_bits, NULL );
mohammad1603503973b2018-03-12 15:59:30 +02002230 if( cipher_info == NULL )
2231 return( PSA_ERROR_NOT_SUPPORTED );
2232
mohammad1603503973b2018-03-12 15:59:30 +02002233 ret = mbedtls_cipher_setup( &operation->ctx.cipher, cipher_info );
Moran Peker41deec42018-04-04 15:43:05 +03002234 if( ret != 0 )
mohammad1603503973b2018-03-12 15:59:30 +02002235 {
2236 psa_cipher_abort( operation );
2237 return( mbedtls_to_psa_error( ret ) );
2238 }
2239
Gilles Peskine9ad29e22018-06-21 09:40:04 +02002240#if defined(MBEDTLS_DES_C)
2241 if( key_type == PSA_KEY_TYPE_DES && key_bits == 128 )
2242 {
2243 /* Two-key Triple-DES is 3-key Triple-DES with K1=K3 */
2244 unsigned char keys[24];
2245 memcpy( keys, slot->data.raw.data, 16 );
2246 memcpy( keys + 16, slot->data.raw.data, 8 );
2247 ret = mbedtls_cipher_setkey( &operation->ctx.cipher,
2248 keys,
2249 192, cipher_operation );
2250 }
2251 else
2252#endif
2253 {
2254 ret = mbedtls_cipher_setkey( &operation->ctx.cipher,
2255 slot->data.raw.data,
Jaeden Amero23bbb752018-06-26 14:16:54 +01002256 (int) key_bits, cipher_operation );
Gilles Peskine9ad29e22018-06-21 09:40:04 +02002257 }
Moran Peker41deec42018-04-04 15:43:05 +03002258 if( ret != 0 )
mohammad1603503973b2018-03-12 15:59:30 +02002259 {
2260 psa_cipher_abort( operation );
2261 return( mbedtls_to_psa_error( ret ) );
2262 }
2263
mohammad16038481e742018-03-18 13:57:31 +02002264#if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING)
Moran Peker7cb22b82018-06-05 11:40:02 +03002265 if( ( alg & ~PSA_ALG_BLOCK_CIPHER_PADDING_MASK ) == PSA_ALG_CBC_BASE )
mohammad16038481e742018-03-18 13:57:31 +02002266 {
Gilles Peskine53514202018-06-06 15:11:46 +02002267 psa_algorithm_t padding_mode = alg & PSA_ALG_BLOCK_CIPHER_PADDING_MASK;
2268 mbedtls_cipher_padding_t mode;
mohammad16038481e742018-03-18 13:57:31 +02002269
Moran Pekera28258c2018-05-29 16:25:04 +03002270 switch ( padding_mode )
mohammad16038481e742018-03-18 13:57:31 +02002271 {
2272 case PSA_ALG_BLOCK_CIPHER_PAD_PKCS7:
2273 mode = MBEDTLS_PADDING_PKCS7;
2274 break;
2275 case PSA_ALG_BLOCK_CIPHER_PAD_NONE:
2276 mode = MBEDTLS_PADDING_NONE;
2277 break;
2278 default:
Moran Pekerae382792018-05-31 14:06:17 +03002279 psa_cipher_abort( operation );
2280 return( PSA_ERROR_INVALID_ARGUMENT );
mohammad16038481e742018-03-18 13:57:31 +02002281 }
2282 ret = mbedtls_cipher_set_padding_mode( &operation->ctx.cipher, mode );
Moran Pekera28258c2018-05-29 16:25:04 +03002283 if( ret != 0 )
Moran Peker71f19ae2018-04-22 20:23:16 +03002284 {
2285 psa_cipher_abort( operation );
mohammad16038481e742018-03-18 13:57:31 +02002286 return( mbedtls_to_psa_error( ret ) );
Moran Peker71f19ae2018-04-22 20:23:16 +03002287 }
mohammad16038481e742018-03-18 13:57:31 +02002288 }
2289#endif //MBEDTLS_CIPHER_MODE_WITH_PADDING
2290
mohammad1603503973b2018-03-12 15:59:30 +02002291 operation->key_set = 1;
Gilles Peskine7e928852018-06-04 16:23:10 +02002292 operation->block_size = ( PSA_ALG_IS_BLOCK_CIPHER( alg ) ?
2293 PSA_BLOCK_CIPHER_BLOCK_SIZE( key_type ) :
2294 1 );
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02002295 if( PSA_ALG_IS_BLOCK_CIPHER( alg ) || alg == PSA_ALG_CTR )
mohammad16038481e742018-03-18 13:57:31 +02002296 {
mohammad160389e0f462018-04-12 08:48:45 +03002297 operation->iv_size = PSA_BLOCK_CIPHER_BLOCK_SIZE( key_type );
mohammad16038481e742018-03-18 13:57:31 +02002298 }
mohammad1603503973b2018-03-12 15:59:30 +02002299
Moran Peker395db872018-05-31 14:07:14 +03002300 return( PSA_SUCCESS );
mohammad1603503973b2018-03-12 15:59:30 +02002301}
2302
Gilles Peskinee553c652018-06-04 16:22:46 +02002303psa_status_t psa_encrypt_setup( psa_cipher_operation_t *operation,
2304 psa_key_slot_t key,
2305 psa_algorithm_t alg )
mohammad16038481e742018-03-18 13:57:31 +02002306{
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02002307 return( psa_cipher_setup( operation, key, alg, MBEDTLS_ENCRYPT ) );
mohammad16038481e742018-03-18 13:57:31 +02002308}
2309
Gilles Peskinee553c652018-06-04 16:22:46 +02002310psa_status_t psa_decrypt_setup( psa_cipher_operation_t *operation,
2311 psa_key_slot_t key,
2312 psa_algorithm_t alg )
mohammad16038481e742018-03-18 13:57:31 +02002313{
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02002314 return( psa_cipher_setup( operation, key, alg, MBEDTLS_DECRYPT ) );
mohammad16038481e742018-03-18 13:57:31 +02002315}
2316
Gilles Peskinee553c652018-06-04 16:22:46 +02002317psa_status_t psa_encrypt_generate_iv( psa_cipher_operation_t *operation,
2318 unsigned char *iv,
2319 size_t iv_size,
2320 size_t *iv_length )
mohammad1603503973b2018-03-12 15:59:30 +02002321{
Moran Peker41deec42018-04-04 15:43:05 +03002322 int ret = PSA_SUCCESS;
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02002323 if( operation->iv_set || ! operation->iv_required )
Moran Peker41deec42018-04-04 15:43:05 +03002324 return( PSA_ERROR_BAD_STATE );
2325 if( iv_size < operation->iv_size )
mohammad1603503973b2018-03-12 15:59:30 +02002326 {
Moran Peker41deec42018-04-04 15:43:05 +03002327 ret = PSA_ERROR_BUFFER_TOO_SMALL;
2328 goto exit;
2329 }
Gilles Peskine7e928852018-06-04 16:23:10 +02002330 ret = mbedtls_ctr_drbg_random( &global_data.ctr_drbg,
2331 iv, operation->iv_size );
Moran Peker41deec42018-04-04 15:43:05 +03002332 if( ret != 0 )
2333 {
2334 ret = mbedtls_to_psa_error( ret );
Gilles Peskinee553c652018-06-04 16:22:46 +02002335 goto exit;
mohammad1603503973b2018-03-12 15:59:30 +02002336 }
Gilles Peskinee553c652018-06-04 16:22:46 +02002337
mohammad16038481e742018-03-18 13:57:31 +02002338 *iv_length = operation->iv_size;
mohammad160389e0f462018-04-12 08:48:45 +03002339 ret = psa_encrypt_set_iv( operation, iv, *iv_length );
Moran Peker41deec42018-04-04 15:43:05 +03002340
Moran Peker395db872018-05-31 14:07:14 +03002341exit:
2342 if( ret != PSA_SUCCESS )
2343 psa_cipher_abort( operation );
2344 return( ret );
mohammad1603503973b2018-03-12 15:59:30 +02002345}
2346
Gilles Peskinee553c652018-06-04 16:22:46 +02002347psa_status_t psa_encrypt_set_iv( psa_cipher_operation_t *operation,
2348 const unsigned char *iv,
2349 size_t iv_length )
mohammad1603503973b2018-03-12 15:59:30 +02002350{
Moran Peker41deec42018-04-04 15:43:05 +03002351 int ret = PSA_SUCCESS;
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02002352 if( operation->iv_set || ! operation->iv_required )
Moran Peker41deec42018-04-04 15:43:05 +03002353 return( PSA_ERROR_BAD_STATE );
Moran Pekera28258c2018-05-29 16:25:04 +03002354 if( iv_length != operation->iv_size )
Moran Peker71f19ae2018-04-22 20:23:16 +03002355 {
Moran Pekerae382792018-05-31 14:06:17 +03002356 psa_cipher_abort( operation );
2357 return( PSA_ERROR_INVALID_ARGUMENT );
Moran Peker71f19ae2018-04-22 20:23:16 +03002358 }
mohammad1603503973b2018-03-12 15:59:30 +02002359 ret = mbedtls_cipher_set_iv( &operation->ctx.cipher, iv, iv_length );
Moran Peker41deec42018-04-04 15:43:05 +03002360 if( ret != 0 )
mohammad1603503973b2018-03-12 15:59:30 +02002361 {
2362 psa_cipher_abort( operation );
2363 return( mbedtls_to_psa_error( ret ) );
2364 }
2365
2366 operation->iv_set = 1;
mohammad1603503973b2018-03-12 15:59:30 +02002367
Moran Peker395db872018-05-31 14:07:14 +03002368 return( PSA_SUCCESS );
mohammad1603503973b2018-03-12 15:59:30 +02002369}
2370
Gilles Peskinee553c652018-06-04 16:22:46 +02002371psa_status_t psa_cipher_update( psa_cipher_operation_t *operation,
2372 const uint8_t *input,
2373 size_t input_length,
2374 unsigned char *output,
2375 size_t output_size,
2376 size_t *output_length )
mohammad1603503973b2018-03-12 15:59:30 +02002377{
2378 int ret = MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE;
Gilles Peskine89d789c2018-06-04 17:17:16 +02002379 size_t expected_output_size;
2380 if( PSA_ALG_IS_BLOCK_CIPHER( operation->alg ) )
2381 {
2382 /* Take the unprocessed partial block left over from previous
2383 * update calls, if any, plus the input to this call. Remove
2384 * the last partial block, if any. You get the data that will be
2385 * output in this call. */
2386 expected_output_size =
2387 ( operation->ctx.cipher.unprocessed_len + input_length )
2388 / operation->block_size * operation->block_size;
2389 }
2390 else
2391 {
2392 expected_output_size = input_length;
2393 }
2394 if( output_size < expected_output_size )
Moran Peker395db872018-05-31 14:07:14 +03002395 return( PSA_ERROR_BUFFER_TOO_SMALL );
mohammad160382759612018-03-12 18:16:40 +02002396
mohammad1603503973b2018-03-12 15:59:30 +02002397 ret = mbedtls_cipher_update( &operation->ctx.cipher, input,
Gilles Peskinee553c652018-06-04 16:22:46 +02002398 input_length, output, output_length );
Moran Peker41deec42018-04-04 15:43:05 +03002399 if( ret != 0 )
mohammad1603503973b2018-03-12 15:59:30 +02002400 {
2401 psa_cipher_abort( operation );
2402 return( mbedtls_to_psa_error( ret ) );
2403 }
2404
Moran Peker395db872018-05-31 14:07:14 +03002405 return( PSA_SUCCESS );
mohammad1603503973b2018-03-12 15:59:30 +02002406}
2407
Gilles Peskinee553c652018-06-04 16:22:46 +02002408psa_status_t psa_cipher_finish( psa_cipher_operation_t *operation,
2409 uint8_t *output,
2410 size_t output_size,
2411 size_t *output_length )
mohammad1603503973b2018-03-12 15:59:30 +02002412{
Janos Follath315b51c2018-07-09 16:04:51 +01002413 psa_status_t status = PSA_ERROR_UNKNOWN_ERROR;
2414 int cipher_ret = MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE;
Gilles Peskinee553c652018-06-04 16:22:46 +02002415 uint8_t temp_output_buffer[MBEDTLS_MAX_BLOCK_LENGTH];
Moran Pekerbed71a22018-04-22 20:19:20 +03002416
mohammad1603503973b2018-03-12 15:59:30 +02002417 if( ! operation->key_set )
Moran Pekerdc38ebc2018-04-30 15:45:34 +03002418 {
Janos Follath315b51c2018-07-09 16:04:51 +01002419 status = PSA_ERROR_BAD_STATE;
2420 goto error;
Moran Peker7cb22b82018-06-05 11:40:02 +03002421 }
2422 if( operation->iv_required && ! operation->iv_set )
2423 {
Janos Follath315b51c2018-07-09 16:04:51 +01002424 status = PSA_ERROR_BAD_STATE;
2425 goto error;
Moran Peker7cb22b82018-06-05 11:40:02 +03002426 }
Gilles Peskine2c5219a2018-06-06 15:12:32 +02002427 if( operation->ctx.cipher.operation == MBEDTLS_ENCRYPT &&
2428 PSA_ALG_IS_BLOCK_CIPHER( operation->alg ) )
Moran Peker7cb22b82018-06-05 11:40:02 +03002429 {
Gilles Peskine53514202018-06-06 15:11:46 +02002430 psa_algorithm_t padding_mode =
2431 operation->alg & PSA_ALG_BLOCK_CIPHER_PADDING_MASK;
Moran Peker7cb22b82018-06-05 11:40:02 +03002432 if( operation->ctx.cipher.unprocessed_len >= operation->block_size )
Gilles Peskine89d789c2018-06-04 17:17:16 +02002433 {
Janos Follath315b51c2018-07-09 16:04:51 +01002434 status = PSA_ERROR_TAMPERING_DETECTED;
2435 goto error;
Moran Peker7cb22b82018-06-05 11:40:02 +03002436 }
Gilles Peskine53514202018-06-06 15:11:46 +02002437 if( padding_mode == PSA_ALG_BLOCK_CIPHER_PAD_NONE )
Moran Peker7cb22b82018-06-05 11:40:02 +03002438 {
2439 if( operation->ctx.cipher.unprocessed_len != 0 )
2440 {
Janos Follath315b51c2018-07-09 16:04:51 +01002441 status = PSA_ERROR_INVALID_ARGUMENT;
2442 goto error;
Moran Peker7cb22b82018-06-05 11:40:02 +03002443 }
Gilles Peskine89d789c2018-06-04 17:17:16 +02002444 }
Moran Pekerdc38ebc2018-04-30 15:45:34 +03002445 }
2446
Janos Follath315b51c2018-07-09 16:04:51 +01002447 cipher_ret = mbedtls_cipher_finish( &operation->ctx.cipher,
2448 temp_output_buffer,
2449 output_length );
2450 if( cipher_ret != 0 )
mohammad1603503973b2018-03-12 15:59:30 +02002451 {
Janos Follath315b51c2018-07-09 16:04:51 +01002452 status = mbedtls_to_psa_error( cipher_ret );
2453 goto error;
mohammad1603503973b2018-03-12 15:59:30 +02002454 }
Janos Follath315b51c2018-07-09 16:04:51 +01002455
Gilles Peskine46f1fd72018-06-28 19:31:31 +02002456 if( *output_length == 0 )
Janos Follath315b51c2018-07-09 16:04:51 +01002457 ; /* Nothing to copy. Note that output may be NULL in this case. */
Gilles Peskine46f1fd72018-06-28 19:31:31 +02002458 else if( output_size >= *output_length )
Moran Pekerdc38ebc2018-04-30 15:45:34 +03002459 memcpy( output, temp_output_buffer, *output_length );
2460 else
2461 {
Janos Follath315b51c2018-07-09 16:04:51 +01002462 status = PSA_ERROR_BUFFER_TOO_SMALL;
2463 goto error;
Moran Pekerdc38ebc2018-04-30 15:45:34 +03002464 }
mohammad1603503973b2018-03-12 15:59:30 +02002465
Janos Follath315b51c2018-07-09 16:04:51 +01002466 status = psa_cipher_abort( operation );
2467
2468 return( status );
2469
2470error:
2471
2472 *output_length = 0;
2473
2474 (void) psa_cipher_abort( operation );
2475
2476 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02002477}
2478
Gilles Peskinee553c652018-06-04 16:22:46 +02002479psa_status_t psa_cipher_abort( psa_cipher_operation_t *operation )
2480{
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002481 if( operation->alg == 0 )
Gilles Peskine81736312018-06-26 15:04:31 +02002482 {
2483 /* The object has (apparently) been initialized but it is not
2484 * in use. It's ok to call abort on such an object, and there's
2485 * nothing to do. */
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002486 return( PSA_SUCCESS );
Gilles Peskine81736312018-06-26 15:04:31 +02002487 }
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002488
Gilles Peskinef9c2c092018-06-21 16:57:07 +02002489 /* Sanity check (shouldn't happen: operation->alg should
2490 * always have been initialized to a valid value). */
2491 if( ! PSA_ALG_IS_CIPHER( operation->alg ) )
2492 return( PSA_ERROR_BAD_STATE );
2493
mohammad1603503973b2018-03-12 15:59:30 +02002494 mbedtls_cipher_free( &operation->ctx.cipher );
Gilles Peskinee553c652018-06-04 16:22:46 +02002495
Moran Peker41deec42018-04-04 15:43:05 +03002496 operation->alg = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03002497 operation->key_set = 0;
2498 operation->iv_set = 0;
2499 operation->iv_size = 0;
Moran Peker41deec42018-04-04 15:43:05 +03002500 operation->block_size = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03002501 operation->iv_required = 0;
Moran Peker41deec42018-04-04 15:43:05 +03002502
Moran Peker395db872018-05-31 14:07:14 +03002503 return( PSA_SUCCESS );
mohammad1603503973b2018-03-12 15:59:30 +02002504}
2505
Gilles Peskinea0655c32018-04-30 17:06:50 +02002506
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02002507
mohammad16038cc1cee2018-03-28 01:21:33 +03002508/****************************************************************/
2509/* Key Policy */
2510/****************************************************************/
Mohammad Abo Mokha5c7b7d2018-07-04 15:57:00 +03002511
mohammad160327010052018-07-03 13:16:15 +03002512#if !defined(MBEDTLS_PSA_CRYPTO_SPM)
Gilles Peskine2d277862018-06-18 15:41:12 +02002513void psa_key_policy_init( psa_key_policy_t *policy )
mohammad16038cc1cee2018-03-28 01:21:33 +03002514{
Gilles Peskine803ce742018-06-18 16:07:14 +02002515 memset( policy, 0, sizeof( *policy ) );
mohammad16038cc1cee2018-03-28 01:21:33 +03002516}
2517
Gilles Peskine2d277862018-06-18 15:41:12 +02002518void psa_key_policy_set_usage( psa_key_policy_t *policy,
2519 psa_key_usage_t usage,
2520 psa_algorithm_t alg )
mohammad16038cc1cee2018-03-28 01:21:33 +03002521{
mohammad16034eed7572018-03-28 05:14:59 -07002522 policy->usage = usage;
2523 policy->alg = alg;
mohammad16038cc1cee2018-03-28 01:21:33 +03002524}
2525
Gilles Peskine2d277862018-06-18 15:41:12 +02002526psa_key_usage_t psa_key_policy_get_usage( psa_key_policy_t *policy )
mohammad16038cc1cee2018-03-28 01:21:33 +03002527{
mohammad16036df908f2018-04-02 08:34:15 -07002528 return( policy->usage );
mohammad16038cc1cee2018-03-28 01:21:33 +03002529}
2530
Gilles Peskine2d277862018-06-18 15:41:12 +02002531psa_algorithm_t psa_key_policy_get_algorithm( psa_key_policy_t *policy )
mohammad16038cc1cee2018-03-28 01:21:33 +03002532{
mohammad16036df908f2018-04-02 08:34:15 -07002533 return( policy->alg );
mohammad16038cc1cee2018-03-28 01:21:33 +03002534}
mohammad160327010052018-07-03 13:16:15 +03002535#endif /* !defined(MBEDTLS_PSA_CRYPTO_SPM) */
Mohammad Abo Mokha5c7b7d2018-07-04 15:57:00 +03002536
Gilles Peskine2d277862018-06-18 15:41:12 +02002537psa_status_t psa_set_key_policy( psa_key_slot_t key,
2538 const psa_key_policy_t *policy )
mohammad16038cc1cee2018-03-28 01:21:33 +03002539{
2540 key_slot_t *slot;
mohammad16038cc1cee2018-03-28 01:21:33 +03002541
Gilles Peskine828ed142018-06-18 23:25:51 +02002542 if( key == 0 || key > PSA_KEY_SLOT_COUNT || policy == NULL )
mohammad16038cc1cee2018-03-28 01:21:33 +03002543 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine5b051bc2018-05-31 13:25:48 +02002544
mohammad16038cc1cee2018-03-28 01:21:33 +03002545 slot = &global_data.key_slots[key];
2546 if( slot->type != PSA_KEY_TYPE_NONE )
2547 return( PSA_ERROR_OCCUPIED_SLOT );
2548
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02002549 if( ( policy->usage & ~( PSA_KEY_USAGE_EXPORT |
2550 PSA_KEY_USAGE_ENCRYPT |
2551 PSA_KEY_USAGE_DECRYPT |
2552 PSA_KEY_USAGE_SIGN |
2553 PSA_KEY_USAGE_VERIFY ) ) != 0 )
mohammad16035feda722018-04-16 04:38:57 -07002554 return( PSA_ERROR_INVALID_ARGUMENT );
mohammad16038cc1cee2018-03-28 01:21:33 +03002555
mohammad16036df908f2018-04-02 08:34:15 -07002556 slot->policy = *policy;
mohammad16038cc1cee2018-03-28 01:21:33 +03002557
2558 return( PSA_SUCCESS );
2559}
2560
Gilles Peskine2d277862018-06-18 15:41:12 +02002561psa_status_t psa_get_key_policy( psa_key_slot_t key,
2562 psa_key_policy_t *policy )
mohammad16038cc1cee2018-03-28 01:21:33 +03002563{
2564 key_slot_t *slot;
2565
Gilles Peskine828ed142018-06-18 23:25:51 +02002566 if( key == 0 || key > PSA_KEY_SLOT_COUNT || policy == NULL )
mohammad16038cc1cee2018-03-28 01:21:33 +03002567 return( PSA_ERROR_INVALID_ARGUMENT );
2568
2569 slot = &global_data.key_slots[key];
Gilles Peskine5b051bc2018-05-31 13:25:48 +02002570
mohammad16036df908f2018-04-02 08:34:15 -07002571 *policy = slot->policy;
mohammad16038cc1cee2018-03-28 01:21:33 +03002572
2573 return( PSA_SUCCESS );
2574}
Gilles Peskine20035e32018-02-03 22:44:14 +01002575
Gilles Peskinea0655c32018-04-30 17:06:50 +02002576
2577
mohammad1603804cd712018-03-20 22:44:08 +02002578/****************************************************************/
2579/* Key Lifetime */
2580/****************************************************************/
2581
Gilles Peskine2d277862018-06-18 15:41:12 +02002582psa_status_t psa_get_key_lifetime( psa_key_slot_t key,
2583 psa_key_lifetime_t *lifetime )
mohammad1603804cd712018-03-20 22:44:08 +02002584{
2585 key_slot_t *slot;
2586
Gilles Peskine828ed142018-06-18 23:25:51 +02002587 if( key == 0 || key > PSA_KEY_SLOT_COUNT )
mohammad1603804cd712018-03-20 22:44:08 +02002588 return( PSA_ERROR_INVALID_ARGUMENT );
2589
2590 slot = &global_data.key_slots[key];
Gilles Peskine5b051bc2018-05-31 13:25:48 +02002591
mohammad1603804cd712018-03-20 22:44:08 +02002592 *lifetime = slot->lifetime;
2593
2594 return( PSA_SUCCESS );
2595}
2596
Gilles Peskine2d277862018-06-18 15:41:12 +02002597psa_status_t psa_set_key_lifetime( psa_key_slot_t key,
Jaeden Amero65fb2362018-06-26 13:55:30 +01002598 psa_key_lifetime_t lifetime )
mohammad1603804cd712018-03-20 22:44:08 +02002599{
2600 key_slot_t *slot;
2601
Gilles Peskine828ed142018-06-18 23:25:51 +02002602 if( key == 0 || key > PSA_KEY_SLOT_COUNT )
mohammad1603804cd712018-03-20 22:44:08 +02002603 return( PSA_ERROR_INVALID_ARGUMENT );
2604
Gilles Peskine5b051bc2018-05-31 13:25:48 +02002605 if( lifetime != PSA_KEY_LIFETIME_VOLATILE &&
2606 lifetime != PSA_KEY_LIFETIME_PERSISTENT &&
mohammad1603ba178512018-03-21 04:35:20 -07002607 lifetime != PSA_KEY_LIFETIME_WRITE_ONCE)
2608 return( PSA_ERROR_INVALID_ARGUMENT );
2609
mohammad1603804cd712018-03-20 22:44:08 +02002610 slot = &global_data.key_slots[key];
mohammad16035d7ec202018-03-28 01:29:41 +03002611 if( slot->type != PSA_KEY_TYPE_NONE )
2612 return( PSA_ERROR_OCCUPIED_SLOT );
mohammad1603804cd712018-03-20 22:44:08 +02002613
Moran Pekerd7326592018-05-29 16:56:39 +03002614 if( lifetime != PSA_KEY_LIFETIME_VOLATILE )
mohammad1603ba178512018-03-21 04:35:20 -07002615 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine5b051bc2018-05-31 13:25:48 +02002616
mohammad1603060ad8a2018-03-20 14:28:38 -07002617 slot->lifetime = lifetime;
mohammad1603804cd712018-03-20 22:44:08 +02002618
2619 return( PSA_SUCCESS );
2620}
2621
Gilles Peskine20035e32018-02-03 22:44:14 +01002622
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02002623
mohammad16035955c982018-04-26 00:53:03 +03002624/****************************************************************/
2625/* AEAD */
2626/****************************************************************/
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02002627
mohammad16035955c982018-04-26 00:53:03 +03002628psa_status_t psa_aead_encrypt( psa_key_slot_t key,
2629 psa_algorithm_t alg,
2630 const uint8_t *nonce,
2631 size_t nonce_length,
2632 const uint8_t *additional_data,
2633 size_t additional_data_length,
2634 const uint8_t *plaintext,
2635 size_t plaintext_length,
2636 uint8_t *ciphertext,
2637 size_t ciphertext_size,
2638 size_t *ciphertext_length )
2639{
2640 int ret;
2641 psa_status_t status;
2642 key_slot_t *slot;
2643 psa_key_type_t key_type;
2644 size_t key_bits;
mohammad160315223a82018-06-03 17:19:55 +03002645 uint8_t *tag;
2646 size_t tag_length;
mohammad1603dad36fa2018-05-09 02:24:42 -07002647 mbedtls_cipher_id_t cipher_id;
mohammad16030f214652018-06-03 15:10:06 +03002648 const mbedtls_cipher_info_t *cipher_info = NULL;
Gilles Peskine2d277862018-06-18 15:41:12 +02002649
mohammad1603f08a5502018-06-03 15:05:47 +03002650 *ciphertext_length = 0;
mohammad1603e58e6842018-05-09 04:58:32 -07002651
mohammad16035955c982018-04-26 00:53:03 +03002652 status = psa_get_key_information( key, &key_type, &key_bits );
2653 if( status != PSA_SUCCESS )
2654 return( status );
2655 slot = &global_data.key_slots[key];
mohammad1603a1d98012018-06-06 13:45:55 +03002656 if( slot->type == PSA_KEY_TYPE_NONE )
Gilles Peskine2d277862018-06-18 15:41:12 +02002657 return( PSA_ERROR_EMPTY_SLOT );
mohammad16035955c982018-04-26 00:53:03 +03002658
mohammad16035ed06212018-06-06 13:09:34 +03002659 cipher_info = mbedtls_cipher_info_from_psa( alg, key_type,
2660 key_bits, &cipher_id );
mohammad16030f214652018-06-03 15:10:06 +03002661 if( cipher_info == NULL )
Gilles Peskine2d277862018-06-18 15:41:12 +02002662 return( PSA_ERROR_NOT_SUPPORTED );
mohammad1603dad36fa2018-05-09 02:24:42 -07002663
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02002664 if( ( slot->policy.usage & PSA_KEY_USAGE_ENCRYPT ) == 0 )
mohammad1603f14394b2018-06-04 14:33:19 +03002665 return( PSA_ERROR_NOT_PERMITTED );
mohammad16035955c982018-04-26 00:53:03 +03002666
Gilles Peskine2d277862018-06-18 15:41:12 +02002667 if( ( key_type & PSA_KEY_TYPE_CATEGORY_MASK ) !=
2668 PSA_KEY_TYPE_CATEGORY_SYMMETRIC )
mohammad1603db624732018-04-30 17:21:50 +03002669 return( PSA_ERROR_INVALID_ARGUMENT );
mohammad16035955c982018-04-26 00:53:03 +03002670
mohammad16035955c982018-04-26 00:53:03 +03002671 if( alg == PSA_ALG_GCM )
2672 {
2673 mbedtls_gcm_context gcm;
mohammad160315223a82018-06-03 17:19:55 +03002674 tag_length = 16;
2675
mohammad160396910d82018-06-04 14:33:00 +03002676 if( PSA_BLOCK_CIPHER_BLOCK_SIZE( key_type ) != 16 )
2677 return( PSA_ERROR_INVALID_ARGUMENT );
2678
mohammad160315223a82018-06-03 17:19:55 +03002679 //make sure we have place to hold the tag in the ciphertext buffer
2680 if( ciphertext_size < ( plaintext_length + tag_length ) )
mohammad1603e3cb8a82018-06-06 13:45:03 +03002681 return( PSA_ERROR_BUFFER_TOO_SMALL );
mohammad160315223a82018-06-03 17:19:55 +03002682
2683 //update the tag pointer to point to the end of the ciphertext_length
2684 tag = ciphertext + plaintext_length;
2685
mohammad16035955c982018-04-26 00:53:03 +03002686 mbedtls_gcm_init( &gcm );
Gilles Peskinea40d7742018-06-01 16:28:30 +02002687 ret = mbedtls_gcm_setkey( &gcm, cipher_id,
mohammad160395893f82018-06-03 15:06:17 +03002688 slot->data.raw.data,
Jaeden Amero23bbb752018-06-26 14:16:54 +01002689 (unsigned int) key_bits );
mohammad16035955c982018-04-26 00:53:03 +03002690 if( ret != 0 )
2691 {
2692 mbedtls_gcm_free( &gcm );
2693 return( mbedtls_to_psa_error( ret ) );
2694 }
2695 ret = mbedtls_gcm_crypt_and_tag( &gcm, MBEDTLS_GCM_ENCRYPT,
Gilles Peskinea40d7742018-06-01 16:28:30 +02002696 plaintext_length, nonce,
2697 nonce_length, additional_data,
2698 additional_data_length, plaintext,
mohammad160315223a82018-06-03 17:19:55 +03002699 ciphertext, tag_length, tag );
mohammad16035955c982018-04-26 00:53:03 +03002700 mbedtls_gcm_free( &gcm );
2701 }
2702 else if( alg == PSA_ALG_CCM )
2703 {
2704 mbedtls_ccm_context ccm;
mohammad160315223a82018-06-03 17:19:55 +03002705 tag_length = 16;
2706
mohammad160396910d82018-06-04 14:33:00 +03002707 if( PSA_BLOCK_CIPHER_BLOCK_SIZE( key_type ) != 16 )
2708 return( PSA_ERROR_INVALID_ARGUMENT );
2709
mohammad160347ddf3d2018-04-26 01:11:21 +03002710 if( nonce_length < 7 || nonce_length > 13 )
2711 return( PSA_ERROR_INVALID_ARGUMENT );
2712
mohammad160315223a82018-06-03 17:19:55 +03002713 //make sure we have place to hold the tag in the ciphertext buffer
2714 if( ciphertext_size < ( plaintext_length + tag_length ) )
mohammad1603e3cb8a82018-06-06 13:45:03 +03002715 return( PSA_ERROR_BUFFER_TOO_SMALL );
mohammad160315223a82018-06-03 17:19:55 +03002716
2717 //update the tag pointer to point to the end of the ciphertext_length
2718 tag = ciphertext + plaintext_length;
2719
mohammad16035955c982018-04-26 00:53:03 +03002720 mbedtls_ccm_init( &ccm );
Gilles Peskinea40d7742018-06-01 16:28:30 +02002721 ret = mbedtls_ccm_setkey( &ccm, cipher_id,
Jaeden Amero23bbb752018-06-26 14:16:54 +01002722 slot->data.raw.data,
2723 (unsigned int) key_bits );
mohammad16035955c982018-04-26 00:53:03 +03002724 if( ret != 0 )
2725 {
2726 mbedtls_ccm_free( &ccm );
2727 return( mbedtls_to_psa_error( ret ) );
2728 }
Gilles Peskinea40d7742018-06-01 16:28:30 +02002729 ret = mbedtls_ccm_encrypt_and_tag( &ccm, plaintext_length,
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02002730 nonce, nonce_length,
2731 additional_data,
Gilles Peskinea40d7742018-06-01 16:28:30 +02002732 additional_data_length,
2733 plaintext, ciphertext,
mohammad160315223a82018-06-03 17:19:55 +03002734 tag, tag_length );
mohammad16035955c982018-04-26 00:53:03 +03002735 mbedtls_ccm_free( &ccm );
2736 }
mohammad16035c8845f2018-05-09 05:40:09 -07002737 else
2738 {
mohammad1603554faad2018-06-03 15:07:38 +03002739 return( PSA_ERROR_NOT_SUPPORTED );
mohammad16035c8845f2018-05-09 05:40:09 -07002740 }
Gilles Peskine2d277862018-06-18 15:41:12 +02002741
mohammad160315223a82018-06-03 17:19:55 +03002742 if( ret != 0 )
2743 {
Gilles Peskine46f1fd72018-06-28 19:31:31 +02002744 /* If ciphertext_size is 0 then ciphertext may be NULL and then the
2745 * call to memset would have undefined behavior. */
2746 if( ciphertext_size != 0 )
2747 memset( ciphertext, 0, ciphertext_size );
mohammad160315223a82018-06-03 17:19:55 +03002748 return( mbedtls_to_psa_error( ret ) );
2749 }
Gilles Peskine2d277862018-06-18 15:41:12 +02002750
mohammad160315223a82018-06-03 17:19:55 +03002751 *ciphertext_length = plaintext_length + tag_length;
mohammad160347ddf3d2018-04-26 01:11:21 +03002752 return( PSA_SUCCESS );
mohammad16035955c982018-04-26 00:53:03 +03002753}
2754
Gilles Peskineee652a32018-06-01 19:23:52 +02002755/* Locate the tag in a ciphertext buffer containing the encrypted data
2756 * followed by the tag. Return the length of the part preceding the tag in
2757 * *plaintext_length. This is the size of the plaintext in modes where
2758 * the encrypted data has the same size as the plaintext, such as
2759 * CCM and GCM. */
2760static psa_status_t psa_aead_unpadded_locate_tag( size_t tag_length,
2761 const uint8_t *ciphertext,
2762 size_t ciphertext_length,
2763 size_t plaintext_size,
Gilles Peskineee652a32018-06-01 19:23:52 +02002764 const uint8_t **p_tag )
2765{
2766 size_t payload_length;
2767 if( tag_length > ciphertext_length )
2768 return( PSA_ERROR_INVALID_ARGUMENT );
2769 payload_length = ciphertext_length - tag_length;
2770 if( payload_length > plaintext_size )
2771 return( PSA_ERROR_BUFFER_TOO_SMALL );
2772 *p_tag = ciphertext + payload_length;
Gilles Peskineee652a32018-06-01 19:23:52 +02002773 return( PSA_SUCCESS );
2774}
2775
mohammad16035955c982018-04-26 00:53:03 +03002776psa_status_t psa_aead_decrypt( psa_key_slot_t key,
2777 psa_algorithm_t alg,
2778 const uint8_t *nonce,
2779 size_t nonce_length,
2780 const uint8_t *additional_data,
2781 size_t additional_data_length,
2782 const uint8_t *ciphertext,
2783 size_t ciphertext_length,
2784 uint8_t *plaintext,
2785 size_t plaintext_size,
2786 size_t *plaintext_length )
2787{
2788 int ret;
2789 psa_status_t status;
2790 key_slot_t *slot;
2791 psa_key_type_t key_type;
2792 size_t key_bits;
Gilles Peskineee652a32018-06-01 19:23:52 +02002793 const uint8_t *tag;
2794 size_t tag_length;
mohammad1603dad36fa2018-05-09 02:24:42 -07002795 mbedtls_cipher_id_t cipher_id;
mohammad16030f214652018-06-03 15:10:06 +03002796 const mbedtls_cipher_info_t *cipher_info = NULL;
Gilles Peskine2d277862018-06-18 15:41:12 +02002797
Gilles Peskineee652a32018-06-01 19:23:52 +02002798 *plaintext_length = 0;
mohammad16039e5a5152018-04-26 12:07:35 +03002799
mohammad16035955c982018-04-26 00:53:03 +03002800 status = psa_get_key_information( key, &key_type, &key_bits );
2801 if( status != PSA_SUCCESS )
2802 return( status );
2803 slot = &global_data.key_slots[key];
mohammad1603a1d98012018-06-06 13:45:55 +03002804 if( slot->type == PSA_KEY_TYPE_NONE )
Gilles Peskine2d277862018-06-18 15:41:12 +02002805 return( PSA_ERROR_EMPTY_SLOT );
mohammad16035955c982018-04-26 00:53:03 +03002806
mohammad16035ed06212018-06-06 13:09:34 +03002807 cipher_info = mbedtls_cipher_info_from_psa( alg, key_type,
2808 key_bits, &cipher_id );
mohammad16030f214652018-06-03 15:10:06 +03002809 if( cipher_info == NULL )
Gilles Peskine2d277862018-06-18 15:41:12 +02002810 return( PSA_ERROR_NOT_SUPPORTED );
2811
mohammad1603f14394b2018-06-04 14:33:19 +03002812 if( !( slot->policy.usage & PSA_KEY_USAGE_DECRYPT ) )
2813 return( PSA_ERROR_NOT_PERMITTED );
mohammad16035955c982018-04-26 00:53:03 +03002814
Gilles Peskine2d277862018-06-18 15:41:12 +02002815 if( ( key_type & PSA_KEY_TYPE_CATEGORY_MASK ) !=
2816 PSA_KEY_TYPE_CATEGORY_SYMMETRIC )
mohammad1603a7e6df72018-04-30 17:25:45 +03002817 return( PSA_ERROR_INVALID_ARGUMENT );
mohammad16035955c982018-04-26 00:53:03 +03002818
mohammad16035955c982018-04-26 00:53:03 +03002819 if( alg == PSA_ALG_GCM )
2820 {
2821 mbedtls_gcm_context gcm;
mohammad160347ddf3d2018-04-26 01:11:21 +03002822
Gilles Peskineee652a32018-06-01 19:23:52 +02002823 tag_length = 16;
2824 status = psa_aead_unpadded_locate_tag( tag_length,
2825 ciphertext, ciphertext_length,
mohammad160360a64d02018-06-03 17:20:42 +03002826 plaintext_size, &tag );
Gilles Peskineee652a32018-06-01 19:23:52 +02002827 if( status != PSA_SUCCESS )
2828 return( status );
2829
mohammad16035955c982018-04-26 00:53:03 +03002830 mbedtls_gcm_init( &gcm );
Gilles Peskinea40d7742018-06-01 16:28:30 +02002831 ret = mbedtls_gcm_setkey( &gcm, cipher_id,
Jaeden Amero23bbb752018-06-26 14:16:54 +01002832 slot->data.raw.data,
2833 (unsigned int) key_bits );
mohammad16035955c982018-04-26 00:53:03 +03002834 if( ret != 0 )
2835 {
2836 mbedtls_gcm_free( &gcm );
2837 return( mbedtls_to_psa_error( ret ) );
2838 }
mohammad16035955c982018-04-26 00:53:03 +03002839
Gilles Peskineee652a32018-06-01 19:23:52 +02002840 ret = mbedtls_gcm_auth_decrypt( &gcm,
mohammad160360a64d02018-06-03 17:20:42 +03002841 ciphertext_length - tag_length,
Gilles Peskineee652a32018-06-01 19:23:52 +02002842 nonce, nonce_length,
mohammad16035ed06212018-06-06 13:09:34 +03002843 additional_data,
2844 additional_data_length,
Gilles Peskineee652a32018-06-01 19:23:52 +02002845 tag, tag_length,
2846 ciphertext, plaintext );
mohammad16035955c982018-04-26 00:53:03 +03002847 mbedtls_gcm_free( &gcm );
2848 }
2849 else if( alg == PSA_ALG_CCM )
2850 {
2851 mbedtls_ccm_context ccm;
Gilles Peskinea40d7742018-06-01 16:28:30 +02002852
mohammad160347ddf3d2018-04-26 01:11:21 +03002853 if( nonce_length < 7 || nonce_length > 13 )
2854 return( PSA_ERROR_INVALID_ARGUMENT );
2855
mohammad16039375f842018-06-03 14:28:24 +03002856 tag_length = 16;
2857 status = psa_aead_unpadded_locate_tag( tag_length,
2858 ciphertext, ciphertext_length,
mohammad160360a64d02018-06-03 17:20:42 +03002859 plaintext_size, &tag );
mohammad16039375f842018-06-03 14:28:24 +03002860 if( status != PSA_SUCCESS )
2861 return( status );
2862
mohammad16035955c982018-04-26 00:53:03 +03002863 mbedtls_ccm_init( &ccm );
Gilles Peskinea40d7742018-06-01 16:28:30 +02002864 ret = mbedtls_ccm_setkey( &ccm, cipher_id,
Jaeden Amero23bbb752018-06-26 14:16:54 +01002865 slot->data.raw.data,
2866 (unsigned int) key_bits );
mohammad16035955c982018-04-26 00:53:03 +03002867 if( ret != 0 )
2868 {
2869 mbedtls_ccm_free( &ccm );
2870 return( mbedtls_to_psa_error( ret ) );
2871 }
mohammad160360a64d02018-06-03 17:20:42 +03002872 ret = mbedtls_ccm_auth_decrypt( &ccm, ciphertext_length - tag_length,
Gilles Peskineee652a32018-06-01 19:23:52 +02002873 nonce, nonce_length,
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02002874 additional_data,
2875 additional_data_length,
Gilles Peskineee652a32018-06-01 19:23:52 +02002876 ciphertext, plaintext,
2877 tag, tag_length );
mohammad16035955c982018-04-26 00:53:03 +03002878 mbedtls_ccm_free( &ccm );
2879 }
mohammad160339574652018-06-01 04:39:53 -07002880 else
2881 {
mohammad1603554faad2018-06-03 15:07:38 +03002882 return( PSA_ERROR_NOT_SUPPORTED );
mohammad160339574652018-06-01 04:39:53 -07002883 }
Gilles Peskinea40d7742018-06-01 16:28:30 +02002884
Gilles Peskineee652a32018-06-01 19:23:52 +02002885 if( ret != 0 )
Gilles Peskine46f1fd72018-06-28 19:31:31 +02002886 {
2887 /* If plaintext_size is 0 then plaintext may be NULL and then the
2888 * call to memset has undefined behavior. */
2889 if( plaintext_size != 0 )
2890 memset( plaintext, 0, plaintext_size );
2891 }
mohammad160360a64d02018-06-03 17:20:42 +03002892 else
2893 *plaintext_length = ciphertext_length - tag_length;
2894
Gilles Peskineee652a32018-06-01 19:23:52 +02002895 return( mbedtls_to_psa_error( ret ) );
mohammad16035955c982018-04-26 00:53:03 +03002896}
2897
Gilles Peskinea0655c32018-04-30 17:06:50 +02002898
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02002899
Gilles Peskine20035e32018-02-03 22:44:14 +01002900/****************************************************************/
Gilles Peskine05d69892018-06-19 22:00:52 +02002901/* Key generation */
2902/****************************************************************/
2903
2904psa_status_t psa_generate_random( uint8_t *output,
2905 size_t output_size )
2906{
2907 int ret = mbedtls_ctr_drbg_random( &global_data.ctr_drbg,
2908 output, output_size );
2909 return( mbedtls_to_psa_error( ret ) );
2910}
2911
2912psa_status_t psa_generate_key( psa_key_slot_t key,
2913 psa_key_type_t type,
2914 size_t bits,
2915 const void *parameters,
2916 size_t parameters_size )
2917{
Gilles Peskine12313cd2018-06-20 00:20:32 +02002918 key_slot_t *slot;
2919
2920 if( key == 0 || key > PSA_KEY_SLOT_COUNT )
2921 return( PSA_ERROR_INVALID_ARGUMENT );
2922 slot = &global_data.key_slots[key];
2923 if( slot->type != PSA_KEY_TYPE_NONE )
2924 return( PSA_ERROR_OCCUPIED_SLOT );
2925 if( parameters == NULL && parameters_size != 0 )
2926 return( PSA_ERROR_INVALID_ARGUMENT );
2927
Gilles Peskine48c0ea12018-06-21 14:15:31 +02002928 if( key_type_is_raw_bytes( type ) )
Gilles Peskine12313cd2018-06-20 00:20:32 +02002929 {
2930 psa_status_t status = prepare_raw_data_slot( type, bits,
2931 &slot->data.raw );
2932 if( status != PSA_SUCCESS )
2933 return( status );
2934 status = psa_generate_random( slot->data.raw.data,
2935 slot->data.raw.bytes );
2936 if( status != PSA_SUCCESS )
2937 {
2938 mbedtls_free( slot->data.raw.data );
2939 return( status );
2940 }
2941#if defined(MBEDTLS_DES_C)
2942 if( type == PSA_KEY_TYPE_DES )
2943 {
2944 mbedtls_des_key_set_parity( slot->data.raw.data );
2945 if( slot->data.raw.bytes >= 16 )
2946 mbedtls_des_key_set_parity( slot->data.raw.data + 8 );
2947 if( slot->data.raw.bytes == 24 )
2948 mbedtls_des_key_set_parity( slot->data.raw.data + 16 );
2949 }
2950#endif /* MBEDTLS_DES_C */
2951 }
2952 else
2953
2954#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_GENPRIME)
2955 if ( type == PSA_KEY_TYPE_RSA_KEYPAIR )
2956 {
2957 mbedtls_rsa_context *rsa;
2958 int ret;
2959 int exponent = 65537;
Gilles Peskineaf3baab2018-06-27 22:55:52 +02002960 if( bits > PSA_VENDOR_RSA_MAX_KEY_BITS )
2961 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine12313cd2018-06-20 00:20:32 +02002962 if( parameters != NULL )
2963 {
2964 const unsigned *p = parameters;
2965 if( parameters_size != sizeof( *p ) )
2966 return( PSA_ERROR_INVALID_ARGUMENT );
2967 if( *p > INT_MAX )
2968 return( PSA_ERROR_INVALID_ARGUMENT );
2969 exponent = *p;
2970 }
2971 rsa = mbedtls_calloc( 1, sizeof( *rsa ) );
2972 if( rsa == NULL )
2973 return( PSA_ERROR_INSUFFICIENT_MEMORY );
2974 mbedtls_rsa_init( rsa, MBEDTLS_RSA_PKCS_V15, MBEDTLS_MD_NONE );
2975 ret = mbedtls_rsa_gen_key( rsa,
2976 mbedtls_ctr_drbg_random,
2977 &global_data.ctr_drbg,
Jaeden Amero23bbb752018-06-26 14:16:54 +01002978 (unsigned int) bits,
Gilles Peskine12313cd2018-06-20 00:20:32 +02002979 exponent );
2980 if( ret != 0 )
2981 {
2982 mbedtls_rsa_free( rsa );
2983 mbedtls_free( rsa );
2984 return( mbedtls_to_psa_error( ret ) );
2985 }
2986 slot->data.rsa = rsa;
2987 }
2988 else
2989#endif /* MBEDTLS_RSA_C && MBEDTLS_GENPRIME */
2990
2991#if defined(MBEDTLS_ECP_C)
2992 if ( PSA_KEY_TYPE_IS_ECC( type ) && PSA_KEY_TYPE_IS_KEYPAIR( type ) )
2993 {
2994 psa_ecc_curve_t curve = PSA_KEY_TYPE_GET_CURVE( type );
2995 mbedtls_ecp_group_id grp_id = mbedtls_ecc_group_of_psa( curve );
2996 const mbedtls_ecp_curve_info *curve_info =
2997 mbedtls_ecp_curve_info_from_grp_id( grp_id );
2998 mbedtls_ecp_keypair *ecp;
2999 int ret;
3000 if( parameters != NULL )
3001 return( PSA_ERROR_NOT_SUPPORTED );
3002 if( grp_id == MBEDTLS_ECP_DP_NONE || curve_info == NULL )
3003 return( PSA_ERROR_NOT_SUPPORTED );
3004 if( curve_info->bit_size != bits )
3005 return( PSA_ERROR_INVALID_ARGUMENT );
3006 ecp = mbedtls_calloc( 1, sizeof( *ecp ) );
3007 if( ecp == NULL )
3008 return( PSA_ERROR_INSUFFICIENT_MEMORY );
3009 mbedtls_ecp_keypair_init( ecp );
3010 ret = mbedtls_ecp_gen_key( grp_id, ecp,
3011 mbedtls_ctr_drbg_random,
3012 &global_data.ctr_drbg );
3013 if( ret != 0 )
3014 {
3015 mbedtls_ecp_keypair_free( ecp );
3016 mbedtls_free( ecp );
3017 return( mbedtls_to_psa_error( ret ) );
3018 }
3019 slot->data.ecp = ecp;
3020 }
3021 else
3022#endif /* MBEDTLS_ECP_C */
3023
3024 return( PSA_ERROR_NOT_SUPPORTED );
3025
3026 slot->type = type;
3027 return( PSA_SUCCESS );
Gilles Peskine05d69892018-06-19 22:00:52 +02003028}
3029
3030
3031/****************************************************************/
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01003032/* Module setup */
3033/****************************************************************/
3034
Gilles Peskinee59236f2018-01-27 23:32:46 +01003035void mbedtls_psa_crypto_free( void )
3036{
Jaeden Amero045bd502018-06-26 14:00:08 +01003037 psa_key_slot_t key;
Gilles Peskine828ed142018-06-18 23:25:51 +02003038 for( key = 1; key < PSA_KEY_SLOT_COUNT; key++ )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01003039 psa_destroy_key( key );
Gilles Peskinee59236f2018-01-27 23:32:46 +01003040 mbedtls_ctr_drbg_free( &global_data.ctr_drbg );
3041 mbedtls_entropy_free( &global_data.entropy );
3042 mbedtls_zeroize( &global_data, sizeof( global_data ) );
3043}
3044
3045psa_status_t psa_crypto_init( void )
3046{
3047 int ret;
3048 const unsigned char drbg_seed[] = "PSA";
3049
3050 if( global_data.initialized != 0 )
3051 return( PSA_SUCCESS );
3052
3053 mbedtls_zeroize( &global_data, sizeof( global_data ) );
3054 mbedtls_entropy_init( &global_data.entropy );
3055 mbedtls_ctr_drbg_init( &global_data.ctr_drbg );
3056
3057 ret = mbedtls_ctr_drbg_seed( &global_data.ctr_drbg,
3058 mbedtls_entropy_func,
3059 &global_data.entropy,
3060 drbg_seed, sizeof( drbg_seed ) - 1 );
3061 if( ret != 0 )
3062 goto exit;
3063
Gilles Peskinee4ebc122018-03-07 14:16:44 +01003064 global_data.initialized = 1;
3065
Gilles Peskinee59236f2018-01-27 23:32:46 +01003066exit:
3067 if( ret != 0 )
3068 mbedtls_psa_crypto_free( );
3069 return( mbedtls_to_psa_error( ret ) );
3070}
3071
3072#endif /* MBEDTLS_PSA_CRYPTO_C */