blob: 0a5ecc857ca9f3c10b9d3719b4bbecf8771f5a93 [file] [log] [blame]
Gilles Peskinee59236f2018-01-27 23:32:46 +01001/*
2 * PSA crypto layer on top of Mbed TLS crypto
3 */
Bence Szépkúti86974652020-06-15 11:59:37 +02004/*
Bence Szépkúti1e148272020-08-07 13:07:28 +02005 * Copyright The Mbed TLS Contributors
Gilles Peskinee59236f2018-01-27 23:32:46 +01006 * SPDX-License-Identifier: Apache-2.0
7 *
8 * Licensed under the Apache License, Version 2.0 (the "License"); you may
9 * not use this file except in compliance with the License.
10 * You may obtain a copy of the License at
11 *
12 * http://www.apache.org/licenses/LICENSE-2.0
13 *
14 * Unless required by applicable law or agreed to in writing, software
15 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
16 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17 * See the License for the specific language governing permissions and
18 * limitations under the License.
Gilles Peskinee59236f2018-01-27 23:32:46 +010019 */
20
Gilles Peskinedb09ef62020-06-03 01:43:33 +020021#include "common.h"
Ronald Cronafbc7ed2023-01-24 16:02:04 +010022#include "psa_crypto_core_common.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010023
24#if defined(MBEDTLS_PSA_CRYPTO_C)
mohammad160327010052018-07-03 13:16:15 +030025
John Durkop07cc04a2020-11-16 22:08:34 -080026#if defined(MBEDTLS_PSA_CRYPTO_CONFIG)
27#include "check_crypto_config.h"
28#endif
29
Gilles Peskinee59236f2018-01-27 23:32:46 +010030#include "psa/crypto.h"
Przemyslaw Stekiel705fb0f2021-11-24 08:47:29 +010031#include "psa/crypto_values.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010032
Ronald Crond6d28882020-12-14 14:56:02 +010033#include "psa_crypto_cipher.h"
Gilles Peskine039b90c2018-12-07 18:24:41 +010034#include "psa_crypto_core.h"
Gilles Peskine5e769522018-11-20 21:59:56 +010035#include "psa_crypto_invasive.h"
Steven Cooremancd84cb42020-07-16 20:28:36 +020036#include "psa_crypto_driver_wrappers.h"
Ronald Cron00b7bfc2020-11-25 15:25:26 +010037#include "psa_crypto_ecp.h"
Przemek Stekiel359f4622022-12-05 14:11:55 +010038#include "psa_crypto_ffdh.h"
Steven Cooreman5f88e772021-03-15 11:07:12 +010039#include "psa_crypto_hash.h"
Steven Cooreman82c66b62021-03-19 17:39:17 +010040#include "psa_crypto_mac.h"
Ronald Cron00b7bfc2020-11-25 15:25:26 +010041#include "psa_crypto_rsa.h"
Ronald Cron7023db52020-11-20 18:17:42 +010042#include "psa_crypto_ecp.h"
Gilles Peskinea8ade162019-06-26 11:24:49 +020043#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined0890212019-06-24 14:34:43 +020044#include "psa_crypto_se.h"
Gilles Peskinea8ade162019-06-26 11:24:49 +020045#endif
Gilles Peskine961849f2018-11-30 18:54:54 +010046#include "psa_crypto_slot_management.h"
Darryl Greend49a4992018-06-18 17:27:26 +010047/* Include internal declarations that are useful for implementing persistently
48 * stored keys. */
49#include "psa_crypto_storage.h"
50
Gilles Peskineb2b64d32020-12-14 16:43:58 +010051#include "psa_crypto_random_impl.h"
Gilles Peskine90edc992020-11-13 15:39:19 +010052
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010053#include <stdlib.h>
54#include <string.h>
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010055#include "mbedtls/platform.h"
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010056
Gilles Peskine1c49f1a2020-11-13 18:46:25 +010057#include "mbedtls/aes.h"
Gilles Peskine9a944802018-06-21 09:35:35 +020058#include "mbedtls/asn1.h"
Jaeden Amero25384a22019-01-10 10:23:21 +000059#include "mbedtls/asn1write.h"
Gilles Peskinea81d85b2018-06-26 16:10:23 +020060#include "mbedtls/bignum.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010061#include "mbedtls/camellia.h"
Gilles Peskine26869f22019-05-06 15:25:00 +020062#include "mbedtls/chacha20.h"
63#include "mbedtls/chachapoly.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010064#include "mbedtls/cipher.h"
65#include "mbedtls/ccm.h"
66#include "mbedtls/cmac.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010067#include "mbedtls/des.h"
Gilles Peskineb7ecdf02018-09-18 12:11:27 +020068#include "mbedtls/ecdh.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010069#include "mbedtls/ecp.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010070#include "mbedtls/entropy.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010071#include "mbedtls/error.h"
72#include "mbedtls/gcm.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010073#include "mbedtls/md5.h"
Gilles Peskine20035e32018-02-03 22:44:14 +010074#include "mbedtls/md.h"
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010075#include "mbedtls/pk.h"
Chris Jonesdaacb592021-03-09 17:03:29 +000076#include "pk_wrap.h"
Gilles Peskine3f108122018-12-07 18:14:53 +010077#include "mbedtls/platform_util.h"
Janos Follath24eed8d2019-11-22 13:21:35 +000078#include "mbedtls/error.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010079#include "mbedtls/ripemd160.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010080#include "mbedtls/rsa.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010081#include "mbedtls/sha1.h"
82#include "mbedtls/sha256.h"
83#include "mbedtls/sha512.h"
Manuel Pégourié-Gonnard02b10d82023-03-28 12:33:20 +020084#include "md_psa.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010085
Przemek Stekiel75fe3fb2022-06-09 14:44:55 +020086#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF) || \
87 defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) || \
88 defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Przemek Stekiel69c46792022-06-10 12:59:51 +020089#define BUILTIN_ALG_ANY_HKDF 1
Przemek Stekiel75fe3fb2022-06-09 14:44:55 +020090#endif
91
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010092/****************************************************************/
93/* Global data, support functions and library management */
94/****************************************************************/
95
Gilles Peskine449bd832023-01-11 14:50:10 +010096static int key_type_is_raw_bytes(psa_key_type_t type)
Gilles Peskine48c0ea12018-06-21 14:15:31 +020097{
Gilles Peskine449bd832023-01-11 14:50:10 +010098 return PSA_KEY_TYPE_IS_UNSTRUCTURED(type);
Gilles Peskine48c0ea12018-06-21 14:15:31 +020099}
100
Gilles Peskine5a3c50e2018-12-04 12:27:09 +0100101/* Values for psa_global_data_t::rng_state */
102#define RNG_NOT_INITIALIZED 0
103#define RNG_INITIALIZED 1
104#define RNG_SEEDED 2
Gilles Peskinec6b69072018-11-20 21:42:52 +0100105
Gilles Peskine449bd832023-01-11 14:50:10 +0100106typedef struct {
Dave Rodgman864f5942023-08-16 18:04:44 +0100107 uint8_t initialized;
108 uint8_t rng_state;
109 uint8_t drivers_initialized;
Gilles Peskine2d8a1822021-11-08 22:20:03 +0100110 mbedtls_psa_random_context_t rng;
Gilles Peskinee59236f2018-01-27 23:32:46 +0100111} psa_global_data_t;
112
113static psa_global_data_t global_data;
114
Gilles Peskine5894e8e2020-12-14 14:54:06 +0100115#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
116mbedtls_psa_drbg_context_t *const mbedtls_psa_random_state =
117 &global_data.rng.drbg;
118#endif
119
itayzafrir0adf0fc2018-09-06 16:24:41 +0300120#define GUARD_MODULE_INITIALIZED \
Gilles Peskine449bd832023-01-11 14:50:10 +0100121 if (global_data.initialized == 0) \
122 return PSA_ERROR_BAD_STATE;
itayzafrir0adf0fc2018-09-06 16:24:41 +0300123
Manuel Pégourié-Gonnard7abdf7e2023-03-09 11:17:43 +0100124int psa_can_do_hash(psa_algorithm_t hash_alg)
125{
126 (void) hash_alg;
127 return global_data.drivers_initialized;
128}
Valerio Settia55f0422023-07-10 15:34:41 +0200129#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT) || \
Przemek Stekiel53410502023-04-28 13:18:43 +0200130 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) || \
Valerio Settia55f0422023-07-10 15:34:41 +0200131 defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE)
Przemek Stekiel134cc2e2023-05-05 10:13:37 +0200132static int psa_is_dh_key_size_valid(size_t bits)
133{
Przemek Stekield1cf1ba2023-04-27 12:04:21 +0200134 if (bits != 2048 && bits != 3072 && bits != 4096 &&
135 bits != 6144 && bits != 8192) {
136 return 0;
137 }
138
139 return 1;
140}
Valerio Settia55f0422023-07-10 15:34:41 +0200141#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT ||
Przemek Stekiel53410502023-04-28 13:18:43 +0200142 MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY ||
Valerio Settia55f0422023-07-10 15:34:41 +0200143 PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE */
Manuel Pégourié-Gonnard7abdf7e2023-03-09 11:17:43 +0100144
Gilles Peskine449bd832023-01-11 14:50:10 +0100145psa_status_t mbedtls_to_psa_error(int ret)
Gilles Peskinee59236f2018-01-27 23:32:46 +0100146{
Gilles Peskinedbf68962021-01-06 20:04:23 +0100147 /* Mbed TLS error codes can combine a high-level error code and a
148 * low-level error code. The low-level error usually reflects the
149 * root cause better, so dispatch on that preferably. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100150 int low_level_ret = -(-ret & 0x007f);
151 switch (low_level_ret != 0 ? low_level_ret : ret) {
Gilles Peskinee59236f2018-01-27 23:32:46 +0100152 case 0:
Gilles Peskine449bd832023-01-11 14:50:10 +0100153 return PSA_SUCCESS;
Gilles Peskinea5905292018-02-07 20:59:33 +0100154
155 case MBEDTLS_ERR_AES_INVALID_KEY_LENGTH:
156 case MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100157 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine9a944802018-06-21 09:35:35 +0200158 case MBEDTLS_ERR_ASN1_OUT_OF_DATA:
159 case MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:
160 case MBEDTLS_ERR_ASN1_INVALID_LENGTH:
161 case MBEDTLS_ERR_ASN1_LENGTH_MISMATCH:
162 case MBEDTLS_ERR_ASN1_INVALID_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100163 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine9a944802018-06-21 09:35:35 +0200164 case MBEDTLS_ERR_ASN1_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100165 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskine9a944802018-06-21 09:35:35 +0200166 case MBEDTLS_ERR_ASN1_BUF_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100167 return PSA_ERROR_BUFFER_TOO_SMALL;
Gilles Peskine9a944802018-06-21 09:35:35 +0200168
Jaeden Amero93e21112019-02-20 13:57:28 +0000169#if defined(MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA)
Jaeden Amero892cd6d2019-02-11 12:21:12 +0000170 case MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA:
Jaeden Amero93e21112019-02-20 13:57:28 +0000171#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100172 case MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100173 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100174
175 case MBEDTLS_ERR_CCM_BAD_INPUT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100176 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100177 case MBEDTLS_ERR_CCM_AUTH_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100178 return PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskinea5905292018-02-07 20:59:33 +0100179
Gilles Peskine26869f22019-05-06 15:25:00 +0200180 case MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100181 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine26869f22019-05-06 15:25:00 +0200182
183 case MBEDTLS_ERR_CHACHAPOLY_BAD_STATE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100184 return PSA_ERROR_BAD_STATE;
Gilles Peskine26869f22019-05-06 15:25:00 +0200185 case MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100186 return PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskine26869f22019-05-06 15:25:00 +0200187
Gilles Peskinea5905292018-02-07 20:59:33 +0100188 case MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100189 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100190 case MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100191 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100192 case MBEDTLS_ERR_CIPHER_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100193 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskinea5905292018-02-07 20:59:33 +0100194 case MBEDTLS_ERR_CIPHER_INVALID_PADDING:
Gilles Peskine449bd832023-01-11 14:50:10 +0100195 return PSA_ERROR_INVALID_PADDING;
Gilles Peskinea5905292018-02-07 20:59:33 +0100196 case MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100197 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100198 case MBEDTLS_ERR_CIPHER_AUTH_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100199 return PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskinea5905292018-02-07 20:59:33 +0100200 case MBEDTLS_ERR_CIPHER_INVALID_CONTEXT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100201 return PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100202
Gilles Peskine449bd832023-01-11 14:50:10 +0100203#if !(defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) || \
204 defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE))
Gilles Peskinebee96c82020-11-23 21:00:09 +0100205 /* Only check CTR_DRBG error codes if underlying mbedtls_xxx
206 * functions are passed a CTR_DRBG instance. */
Gilles Peskinea5905292018-02-07 20:59:33 +0100207 case MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100208 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskinea5905292018-02-07 20:59:33 +0100209 case MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG:
210 case MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG:
Gilles Peskine449bd832023-01-11 14:50:10 +0100211 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100212 case MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100213 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskine82e57d12020-11-13 21:31:17 +0100214#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100215
216 case MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100217 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100218
Gilles Peskinee59236f2018-01-27 23:32:46 +0100219 case MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED:
220 case MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE:
221 case MBEDTLS_ERR_ENTROPY_SOURCE_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100222 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskinea5905292018-02-07 20:59:33 +0100223
224 case MBEDTLS_ERR_GCM_AUTH_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100225 return PSA_ERROR_INVALID_SIGNATURE;
Mateusz Starzykf28261f2021-09-30 16:39:07 +0200226 case MBEDTLS_ERR_GCM_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100227 return PSA_ERROR_BUFFER_TOO_SMALL;
Gilles Peskinea5905292018-02-07 20:59:33 +0100228 case MBEDTLS_ERR_GCM_BAD_INPUT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100229 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100230
Gilles Peskine82e57d12020-11-13 21:31:17 +0100231#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) && \
Gilles Peskine449bd832023-01-11 14:50:10 +0100232 defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE)
Gilles Peskinebee96c82020-11-23 21:00:09 +0100233 /* Only check HMAC_DRBG error codes if underlying mbedtls_xxx
234 * functions are passed a HMAC_DRBG instance. */
Gilles Peskine82e57d12020-11-13 21:31:17 +0100235 case MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100236 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskine82e57d12020-11-13 21:31:17 +0100237 case MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG:
238 case MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG:
Gilles Peskine449bd832023-01-11 14:50:10 +0100239 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine82e57d12020-11-13 21:31:17 +0100240 case MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100241 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskine82e57d12020-11-13 21:31:17 +0100242#endif
243
Gilles Peskinea5905292018-02-07 20:59:33 +0100244 case MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100245 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100246 case MBEDTLS_ERR_MD_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100247 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100248 case MBEDTLS_ERR_MD_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100249 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskinea5905292018-02-07 20:59:33 +0100250 case MBEDTLS_ERR_MD_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100251 return PSA_ERROR_STORAGE_FAILURE;
Gilles Peskinea5905292018-02-07 20:59:33 +0100252
Gilles Peskinef76aa772018-10-29 19:24:33 +0100253 case MBEDTLS_ERR_MPI_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100254 return PSA_ERROR_STORAGE_FAILURE;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100255 case MBEDTLS_ERR_MPI_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100256 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100257 case MBEDTLS_ERR_MPI_INVALID_CHARACTER:
Gilles Peskine449bd832023-01-11 14:50:10 +0100258 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100259 case MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100260 return PSA_ERROR_BUFFER_TOO_SMALL;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100261 case MBEDTLS_ERR_MPI_NEGATIVE_VALUE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100262 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100263 case MBEDTLS_ERR_MPI_DIVISION_BY_ZERO:
Gilles Peskine449bd832023-01-11 14:50:10 +0100264 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100265 case MBEDTLS_ERR_MPI_NOT_ACCEPTABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100266 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100267 case MBEDTLS_ERR_MPI_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100268 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100269
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100270 case MBEDTLS_ERR_PK_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100271 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100272 case MBEDTLS_ERR_PK_TYPE_MISMATCH:
273 case MBEDTLS_ERR_PK_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100274 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100275 case MBEDTLS_ERR_PK_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100276 return PSA_ERROR_STORAGE_FAILURE;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100277 case MBEDTLS_ERR_PK_KEY_INVALID_VERSION:
278 case MBEDTLS_ERR_PK_KEY_INVALID_FORMAT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100279 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100280 case MBEDTLS_ERR_PK_UNKNOWN_PK_ALG:
Gilles Peskine449bd832023-01-11 14:50:10 +0100281 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100282 case MBEDTLS_ERR_PK_PASSWORD_REQUIRED:
283 case MBEDTLS_ERR_PK_PASSWORD_MISMATCH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100284 return PSA_ERROR_NOT_PERMITTED;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100285 case MBEDTLS_ERR_PK_INVALID_PUBKEY:
Gilles Peskine449bd832023-01-11 14:50:10 +0100286 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100287 case MBEDTLS_ERR_PK_INVALID_ALG:
288 case MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE:
289 case MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100290 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100291 case MBEDTLS_ERR_PK_SIG_LEN_MISMATCH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100292 return PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskinef9f1bdf2021-06-23 20:32:27 +0200293 case MBEDTLS_ERR_PK_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100294 return PSA_ERROR_BUFFER_TOO_SMALL;
Gilles Peskinea5905292018-02-07 20:59:33 +0100295
Gilles Peskineff2d2002019-05-06 15:26:23 +0200296 case MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100297 return PSA_ERROR_HARDWARE_FAILURE;
Gilles Peskineff2d2002019-05-06 15:26:23 +0200298 case MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100299 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskineff2d2002019-05-06 15:26:23 +0200300
Gilles Peskinea5905292018-02-07 20:59:33 +0100301 case MBEDTLS_ERR_RSA_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100302 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100303 case MBEDTLS_ERR_RSA_INVALID_PADDING:
Gilles Peskine449bd832023-01-11 14:50:10 +0100304 return PSA_ERROR_INVALID_PADDING;
Gilles Peskinea5905292018-02-07 20:59:33 +0100305 case MBEDTLS_ERR_RSA_KEY_GEN_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100306 return PSA_ERROR_HARDWARE_FAILURE;
Gilles Peskinea5905292018-02-07 20:59:33 +0100307 case MBEDTLS_ERR_RSA_KEY_CHECK_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100308 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100309 case MBEDTLS_ERR_RSA_PUBLIC_FAILED:
310 case MBEDTLS_ERR_RSA_PRIVATE_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100311 return PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100312 case MBEDTLS_ERR_RSA_VERIFY_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100313 return PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskinea5905292018-02-07 20:59:33 +0100314 case MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100315 return PSA_ERROR_BUFFER_TOO_SMALL;
Gilles Peskinea5905292018-02-07 20:59:33 +0100316 case MBEDTLS_ERR_RSA_RNG_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100317 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Manuel Pégourié-Gonnard93c08472021-04-15 12:23:55 +0200318
itayzafrir5c753392018-05-08 11:18:38 +0300319 case MBEDTLS_ERR_ECP_BAD_INPUT_DATA:
itayzafrir7b30f8b2018-05-09 16:07:36 +0300320 case MBEDTLS_ERR_ECP_INVALID_KEY:
Gilles Peskine449bd832023-01-11 14:50:10 +0100321 return PSA_ERROR_INVALID_ARGUMENT;
itayzafrir7b30f8b2018-05-09 16:07:36 +0300322 case MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100323 return PSA_ERROR_BUFFER_TOO_SMALL;
itayzafrir7b30f8b2018-05-09 16:07:36 +0300324 case MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100325 return PSA_ERROR_NOT_SUPPORTED;
itayzafrir7b30f8b2018-05-09 16:07:36 +0300326 case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH:
327 case MBEDTLS_ERR_ECP_VERIFY_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100328 return PSA_ERROR_INVALID_SIGNATURE;
itayzafrir7b30f8b2018-05-09 16:07:36 +0300329 case MBEDTLS_ERR_ECP_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100330 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskine40d81602020-11-25 00:09:47 +0100331 case MBEDTLS_ERR_ECP_RANDOM_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100332 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskine40d81602020-11-25 00:09:47 +0100333
Paul Elliott588f8ed2022-12-02 18:10:26 +0000334 case MBEDTLS_ERR_ECP_IN_PROGRESS:
335 return PSA_OPERATION_INCOMPLETE;
336
Janos Follatha13b9052019-11-22 12:48:59 +0000337 case MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100338 return PSA_ERROR_CORRUPTION_DETECTED;
itayzafrir5c753392018-05-08 11:18:38 +0300339
Gilles Peskinee59236f2018-01-27 23:32:46 +0100340 default:
Gilles Peskine449bd832023-01-11 14:50:10 +0100341 return PSA_ERROR_GENERIC_ERROR;
Gilles Peskinee59236f2018-01-27 23:32:46 +0100342 }
343}
344
Paul Elliottdc42ca82023-02-24 18:11:59 +0000345/**
346 * \brief For output buffers which contain "tags"
347 * (outputs that may be checked for validity like
348 * hashes, MACs and signatures), fill the unused
349 * part of the output buffer (the whole buffer on
350 * error, the trailing part on success) with
351 * something that isn't a valid tag (barring an
352 * attack on the tag and deliberately-crafted
353 * input), in case the caller doesn't check the
354 * return status properly.
355 *
356 * \param output_buffer Pointer to buffer to wipe. May not be NULL
357 * unless \p output_buffer_size is zero.
358 * \param status Status of function called to generate
359 * output_buffer originally
360 * \param output_buffer_size Size of output buffer. If zero, \p output_buffer
361 * could be NULL.
362 * \param output_buffer_length Length of data written to output_buffer, must be
363 * less than \p output_buffer_size
364 */
365static void psa_wipe_tag_output_buffer(uint8_t *output_buffer, psa_status_t status,
Paul Elliott7118d172023-02-26 16:57:05 +0000366 size_t output_buffer_size, size_t output_buffer_length)
367{
Paul Elliottdc42ca82023-02-24 18:11:59 +0000368 size_t offset = 0;
369
370 if (output_buffer_size == 0) {
371 /* If output_buffer_size is 0 then we have nothing to do. We must not
372 call memset because output_buffer may be NULL in this case */
373 return;
374 }
375
376 if (status == PSA_SUCCESS) {
377 offset = output_buffer_length;
378 }
379
380 memset(output_buffer + offset, '!', output_buffer_size - offset);
381}
382
Gilles Peskineb0b255c2018-07-06 17:01:38 +0200383
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +0200384
385
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100386/****************************************************************/
387/* Key management */
388/****************************************************************/
389
Valerio Settia9aab1a2023-06-19 13:39:54 +0200390#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)
Valerio Settibc2b1d32023-06-19 12:15:13 +0200391psa_ecc_family_t mbedtls_ecc_group_to_psa(mbedtls_ecp_group_id grpid,
392 size_t *bits)
393{
394 switch (grpid) {
395 case MBEDTLS_ECP_DP_SECP192R1:
396 *bits = 192;
397 return PSA_ECC_FAMILY_SECP_R1;
398 case MBEDTLS_ECP_DP_SECP224R1:
399 *bits = 224;
400 return PSA_ECC_FAMILY_SECP_R1;
401 case MBEDTLS_ECP_DP_SECP256R1:
402 *bits = 256;
403 return PSA_ECC_FAMILY_SECP_R1;
404 case MBEDTLS_ECP_DP_SECP384R1:
405 *bits = 384;
406 return PSA_ECC_FAMILY_SECP_R1;
407 case MBEDTLS_ECP_DP_SECP521R1:
408 *bits = 521;
409 return PSA_ECC_FAMILY_SECP_R1;
410 case MBEDTLS_ECP_DP_BP256R1:
411 *bits = 256;
412 return PSA_ECC_FAMILY_BRAINPOOL_P_R1;
413 case MBEDTLS_ECP_DP_BP384R1:
414 *bits = 384;
415 return PSA_ECC_FAMILY_BRAINPOOL_P_R1;
416 case MBEDTLS_ECP_DP_BP512R1:
417 *bits = 512;
418 return PSA_ECC_FAMILY_BRAINPOOL_P_R1;
419 case MBEDTLS_ECP_DP_CURVE25519:
420 *bits = 255;
421 return PSA_ECC_FAMILY_MONTGOMERY;
422 case MBEDTLS_ECP_DP_SECP192K1:
423 *bits = 192;
424 return PSA_ECC_FAMILY_SECP_K1;
425 case MBEDTLS_ECP_DP_SECP224K1:
426 *bits = 224;
427 return PSA_ECC_FAMILY_SECP_K1;
428 case MBEDTLS_ECP_DP_SECP256K1:
429 *bits = 256;
430 return PSA_ECC_FAMILY_SECP_K1;
431 case MBEDTLS_ECP_DP_CURVE448:
432 *bits = 448;
433 return PSA_ECC_FAMILY_MONTGOMERY;
434 default:
435 *bits = 0;
436 return 0;
437 }
438}
439
Gilles Peskine449bd832023-01-11 14:50:10 +0100440mbedtls_ecp_group_id mbedtls_ecc_group_of_psa(psa_ecc_family_t curve,
441 size_t bits,
442 int bits_is_sloppy)
Gilles Peskine12313cd2018-06-20 00:20:32 +0200443{
Gilles Peskine449bd832023-01-11 14:50:10 +0100444 switch (curve) {
Paul Elliott8ff510a2020-06-02 17:19:28 +0100445 case PSA_ECC_FAMILY_SECP_R1:
Gilles Peskine449bd832023-01-11 14:50:10 +0100446 switch (bits) {
Gilles Peskinea1684f42021-03-23 13:12:34 +0100447#if defined(PSA_WANT_ECC_SECP_R1_192)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100448 case 192:
Gilles Peskine449bd832023-01-11 14:50:10 +0100449 return MBEDTLS_ECP_DP_SECP192R1;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100450#endif
451#if defined(PSA_WANT_ECC_SECP_R1_224)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100452 case 224:
Gilles Peskine449bd832023-01-11 14:50:10 +0100453 return MBEDTLS_ECP_DP_SECP224R1;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100454#endif
455#if defined(PSA_WANT_ECC_SECP_R1_256)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100456 case 256:
Gilles Peskine449bd832023-01-11 14:50:10 +0100457 return MBEDTLS_ECP_DP_SECP256R1;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100458#endif
459#if defined(PSA_WANT_ECC_SECP_R1_384)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100460 case 384:
Gilles Peskine449bd832023-01-11 14:50:10 +0100461 return MBEDTLS_ECP_DP_SECP384R1;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100462#endif
463#if defined(PSA_WANT_ECC_SECP_R1_521)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100464 case 521:
Gilles Peskine449bd832023-01-11 14:50:10 +0100465 return MBEDTLS_ECP_DP_SECP521R1;
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100466 case 528:
Gilles Peskine449bd832023-01-11 14:50:10 +0100467 if (bits_is_sloppy) {
468 return MBEDTLS_ECP_DP_SECP521R1;
469 }
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100470 break;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100471#endif
Gilles Peskine228abc52019-12-03 17:24:19 +0100472 }
473 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100474
Paul Elliott8ff510a2020-06-02 17:19:28 +0100475 case PSA_ECC_FAMILY_BRAINPOOL_P_R1:
Gilles Peskine449bd832023-01-11 14:50:10 +0100476 switch (bits) {
Gilles Peskinea1684f42021-03-23 13:12:34 +0100477#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100478 case 256:
Gilles Peskine449bd832023-01-11 14:50:10 +0100479 return MBEDTLS_ECP_DP_BP256R1;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100480#endif
481#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100482 case 384:
Gilles Peskine449bd832023-01-11 14:50:10 +0100483 return MBEDTLS_ECP_DP_BP384R1;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100484#endif
485#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100486 case 512:
Gilles Peskine449bd832023-01-11 14:50:10 +0100487 return MBEDTLS_ECP_DP_BP512R1;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100488#endif
Gilles Peskine228abc52019-12-03 17:24:19 +0100489 }
490 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100491
Paul Elliott8ff510a2020-06-02 17:19:28 +0100492 case PSA_ECC_FAMILY_MONTGOMERY:
Gilles Peskine449bd832023-01-11 14:50:10 +0100493 switch (bits) {
Gilles Peskinea1684f42021-03-23 13:12:34 +0100494#if defined(PSA_WANT_ECC_MONTGOMERY_255)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100495 case 255:
Gilles Peskine449bd832023-01-11 14:50:10 +0100496 return MBEDTLS_ECP_DP_CURVE25519;
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100497 case 256:
Gilles Peskine449bd832023-01-11 14:50:10 +0100498 if (bits_is_sloppy) {
499 return MBEDTLS_ECP_DP_CURVE25519;
500 }
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100501 break;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100502#endif
503#if defined(PSA_WANT_ECC_MONTGOMERY_448)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100504 case 448:
Gilles Peskine449bd832023-01-11 14:50:10 +0100505 return MBEDTLS_ECP_DP_CURVE448;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100506#endif
Gilles Peskine228abc52019-12-03 17:24:19 +0100507 }
508 break;
Gilles Peskine228abc52019-12-03 17:24:19 +0100509
Paul Elliott8ff510a2020-06-02 17:19:28 +0100510 case PSA_ECC_FAMILY_SECP_K1:
Gilles Peskine449bd832023-01-11 14:50:10 +0100511 switch (bits) {
Gilles Peskinea1684f42021-03-23 13:12:34 +0100512#if defined(PSA_WANT_ECC_SECP_K1_192)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100513 case 192:
Gilles Peskine449bd832023-01-11 14:50:10 +0100514 return MBEDTLS_ECP_DP_SECP192K1;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100515#endif
516#if defined(PSA_WANT_ECC_SECP_K1_224)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100517 case 224:
Gilles Peskine449bd832023-01-11 14:50:10 +0100518 return MBEDTLS_ECP_DP_SECP224K1;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100519#endif
520#if defined(PSA_WANT_ECC_SECP_K1_256)
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100521 case 256:
Gilles Peskine449bd832023-01-11 14:50:10 +0100522 return MBEDTLS_ECP_DP_SECP256K1;
Gilles Peskinea1684f42021-03-23 13:12:34 +0100523#endif
Gilles Peskine228abc52019-12-03 17:24:19 +0100524 }
525 break;
Gilles Peskine12313cd2018-06-20 00:20:32 +0200526 }
Gilles Peskine2fa6b5f2021-01-27 15:44:45 +0100527
Gilles Peskine71f45ba2021-03-23 14:17:55 +0100528 (void) bits_is_sloppy;
Gilles Peskine449bd832023-01-11 14:50:10 +0100529 return MBEDTLS_ECP_DP_NONE;
Gilles Peskine12313cd2018-06-20 00:20:32 +0200530}
Valerio Settia9aab1a2023-06-19 13:39:54 +0200531#endif /* PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY */
Gilles Peskine12313cd2018-06-20 00:20:32 +0200532
Gilles Peskine449bd832023-01-11 14:50:10 +0100533psa_status_t psa_validate_unstructured_key_bit_size(psa_key_type_t type,
534 size_t bits)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200535{
536 /* Check that the bit size is acceptable for the key type */
Gilles Peskine449bd832023-01-11 14:50:10 +0100537 switch (type) {
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200538 case PSA_KEY_TYPE_RAW_DATA:
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200539 case PSA_KEY_TYPE_HMAC:
Gilles Peskineea0fb492018-07-12 17:17:20 +0200540 case PSA_KEY_TYPE_DERIVE:
Neil Armstrong4b5710f2022-05-25 11:30:27 +0200541 case PSA_KEY_TYPE_PASSWORD:
542 case PSA_KEY_TYPE_PASSWORD_HASH:
Gilles Peskineea0fb492018-07-12 17:17:20 +0200543 break;
Ronald Cron1f0db802021-03-12 09:59:30 +0100544#if defined(PSA_WANT_KEY_TYPE_AES)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200545 case PSA_KEY_TYPE_AES:
Gilles Peskine449bd832023-01-11 14:50:10 +0100546 if (bits != 128 && bits != 192 && bits != 256) {
547 return PSA_ERROR_INVALID_ARGUMENT;
548 }
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200549 break;
550#endif
Gilles Peskine6c12a1e2021-09-21 11:59:39 +0200551#if defined(PSA_WANT_KEY_TYPE_ARIA)
552 case PSA_KEY_TYPE_ARIA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100553 if (bits != 128 && bits != 192 && bits != 256) {
554 return PSA_ERROR_INVALID_ARGUMENT;
555 }
Gilles Peskine6c12a1e2021-09-21 11:59:39 +0200556 break;
557#endif
Ronald Cron1f0db802021-03-12 09:59:30 +0100558#if defined(PSA_WANT_KEY_TYPE_CAMELLIA)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200559 case PSA_KEY_TYPE_CAMELLIA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100560 if (bits != 128 && bits != 192 && bits != 256) {
561 return PSA_ERROR_INVALID_ARGUMENT;
562 }
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200563 break;
564#endif
Ronald Cron1f0db802021-03-12 09:59:30 +0100565#if defined(PSA_WANT_KEY_TYPE_DES)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200566 case PSA_KEY_TYPE_DES:
Gilles Peskine449bd832023-01-11 14:50:10 +0100567 if (bits != 64 && bits != 128 && bits != 192) {
568 return PSA_ERROR_INVALID_ARGUMENT;
569 }
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200570 break;
571#endif
Ronald Cron1f0db802021-03-12 09:59:30 +0100572#if defined(PSA_WANT_KEY_TYPE_CHACHA20)
Gilles Peskine26869f22019-05-06 15:25:00 +0200573 case PSA_KEY_TYPE_CHACHA20:
Gilles Peskine449bd832023-01-11 14:50:10 +0100574 if (bits != 256) {
575 return PSA_ERROR_INVALID_ARGUMENT;
576 }
Gilles Peskine26869f22019-05-06 15:25:00 +0200577 break;
578#endif
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200579 default:
Gilles Peskine449bd832023-01-11 14:50:10 +0100580 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200581 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100582 if (bits % 8 != 0) {
583 return PSA_ERROR_INVALID_ARGUMENT;
584 }
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200585
Gilles Peskine449bd832023-01-11 14:50:10 +0100586 return PSA_SUCCESS;
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200587}
588
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100589/** Check whether a given key type is valid for use with a given MAC algorithm
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100590 *
Steven Cooremancd640932021-03-08 12:00:27 +0100591 * Upon successful return of this function, the behavior of #PSA_MAC_LENGTH
592 * when called with the validated \p algorithm and \p key_type is well-defined.
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100593 *
594 * \param[in] algorithm The specific MAC algorithm (can be wildcard).
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100595 * \param[in] key_type The key type of the key to be used with the
596 * \p algorithm.
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100597 *
598 * \retval #PSA_SUCCESS
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100599 * The \p key_type is valid for use with the \p algorithm
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100600 * \retval #PSA_ERROR_INVALID_ARGUMENT
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100601 * The \p key_type is not valid for use with the \p algorithm
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100602 */
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100603MBEDTLS_STATIC_TESTABLE psa_status_t psa_mac_key_can_do(
Steven Cooreman58c94d32021-03-02 21:31:17 +0100604 psa_algorithm_t algorithm,
Gilles Peskine449bd832023-01-11 14:50:10 +0100605 psa_key_type_t key_type)
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100606{
Gilles Peskine449bd832023-01-11 14:50:10 +0100607 if (PSA_ALG_IS_HMAC(algorithm)) {
608 if (key_type == PSA_KEY_TYPE_HMAC) {
609 return PSA_SUCCESS;
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100610 }
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100611 }
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100612
Gilles Peskine449bd832023-01-11 14:50:10 +0100613 if (PSA_ALG_IS_BLOCK_CIPHER_MAC(algorithm)) {
614 /* Check that we're calling PSA_BLOCK_CIPHER_BLOCK_LENGTH with a cipher
615 * key. */
616 if ((key_type & PSA_KEY_TYPE_CATEGORY_MASK) ==
617 PSA_KEY_TYPE_CATEGORY_SYMMETRIC) {
618 /* PSA_BLOCK_CIPHER_BLOCK_LENGTH returns 1 for stream ciphers and
619 * the block length (larger than 1) for block ciphers. */
620 if (PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type) > 1) {
621 return PSA_SUCCESS;
622 }
623 }
624 }
625
626 return PSA_ERROR_INVALID_ARGUMENT;
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100627}
628
Gilles Peskine449bd832023-01-11 14:50:10 +0100629psa_status_t psa_allocate_buffer_to_slot(psa_key_slot_t *slot,
630 size_t buffer_length)
Steven Cooreman75b74362020-07-28 14:30:13 +0200631{
Gilles Peskine449bd832023-01-11 14:50:10 +0100632 if (slot->key.data != NULL) {
633 return PSA_ERROR_ALREADY_EXISTS;
634 }
Steven Cooreman75b74362020-07-28 14:30:13 +0200635
Gilles Peskine449bd832023-01-11 14:50:10 +0100636 slot->key.data = mbedtls_calloc(1, buffer_length);
637 if (slot->key.data == NULL) {
638 return PSA_ERROR_INSUFFICIENT_MEMORY;
639 }
Steven Cooreman75b74362020-07-28 14:30:13 +0200640
Ronald Cronea0f8a62020-11-25 17:52:23 +0100641 slot->key.bytes = buffer_length;
Gilles Peskine449bd832023-01-11 14:50:10 +0100642 return PSA_SUCCESS;
Steven Cooreman75b74362020-07-28 14:30:13 +0200643}
644
Gilles Peskine449bd832023-01-11 14:50:10 +0100645psa_status_t psa_copy_key_material_into_slot(psa_key_slot_t *slot,
646 const uint8_t *data,
647 size_t data_length)
Steven Cooremanf7cebd42020-10-13 20:27:40 +0200648{
Gilles Peskine449bd832023-01-11 14:50:10 +0100649 psa_status_t status = psa_allocate_buffer_to_slot(slot,
650 data_length);
651 if (status != PSA_SUCCESS) {
652 return status;
653 }
Steven Cooremanf7cebd42020-10-13 20:27:40 +0200654
Gilles Peskine449bd832023-01-11 14:50:10 +0100655 memcpy(slot->key.data, data, data_length);
656 return PSA_SUCCESS;
Steven Cooremanf7cebd42020-10-13 20:27:40 +0200657}
658
Ronald Crona0fe59f2020-11-29 11:14:53 +0100659psa_status_t psa_import_key_into_slot(
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100660 const psa_key_attributes_t *attributes,
661 const uint8_t *data, size_t data_length,
662 uint8_t *key_buffer, size_t key_buffer_size,
Gilles Peskine449bd832023-01-11 14:50:10 +0100663 size_t *key_buffer_length, size_t *bits)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100664{
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100665 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
666 psa_key_type_t type = attributes->core.type;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100667
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200668 /* zero-length keys are never supported. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100669 if (data_length == 0) {
670 return PSA_ERROR_NOT_SUPPORTED;
671 }
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200672
Gilles Peskine449bd832023-01-11 14:50:10 +0100673 if (key_type_is_raw_bytes(type)) {
674 *bits = PSA_BYTES_TO_BITS(data_length);
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200675
Gilles Peskine449bd832023-01-11 14:50:10 +0100676 status = psa_validate_unstructured_key_bit_size(attributes->core.type,
677 *bits);
678 if (status != PSA_SUCCESS) {
679 return status;
680 }
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200681
Ronald Crondd04d422020-11-28 15:14:42 +0100682 /* Copy the key material. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100683 memcpy(key_buffer, data, data_length);
Ronald Crondd04d422020-11-28 15:14:42 +0100684 *key_buffer_length = data_length;
Gilles Peskine449bd832023-01-11 14:50:10 +0100685 (void) key_buffer_size;
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200686
Gilles Peskine449bd832023-01-11 14:50:10 +0100687 return PSA_SUCCESS;
688 } else if (PSA_KEY_TYPE_IS_ASYMMETRIC(type)) {
Valerio Settia55f0422023-07-10 15:34:41 +0200689#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT) || \
Przemek Stekiel6d85afa2023-04-28 11:42:17 +0200690 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY)
Przemek Stekiel472b3f32022-12-01 14:38:49 +0100691 if (PSA_KEY_TYPE_IS_DH(type)) {
Przemek Stekield1cf1ba2023-04-27 12:04:21 +0200692 if (psa_is_dh_key_size_valid(PSA_BYTES_TO_BITS(data_length)) == 0) {
Przemek Stekiel472b3f32022-12-01 14:38:49 +0100693 return PSA_ERROR_INVALID_ARGUMENT;
694 }
Przemek Stekiel33c91eb2023-05-30 15:16:35 +0200695 return mbedtls_psa_ffdh_import_key(attributes,
696 data, data_length,
697 key_buffer, key_buffer_size,
698 key_buffer_length,
699 bits);
Przemek Stekiel472b3f32022-12-01 14:38:49 +0100700 }
Valerio Settia55f0422023-07-10 15:34:41 +0200701#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT) ||
Przemek Stekiel6d85afa2023-04-28 11:42:17 +0200702 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) */
Valerio Setti27c501a2023-06-27 16:58:52 +0200703#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT) || \
Gilles Peskine449bd832023-01-11 14:50:10 +0100704 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
705 if (PSA_KEY_TYPE_IS_ECC(type)) {
706 return mbedtls_psa_ecp_import_key(attributes,
707 data, data_length,
708 key_buffer, key_buffer_size,
709 key_buffer_length,
710 bits);
Steven Cooreman40120f62020-10-29 11:42:22 +0100711 }
Valerio Setti27c501a2023-06-27 16:58:52 +0200712#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT) ||
John Durkop9814fa22020-11-04 12:28:15 -0800713 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
Valerio Settife478902023-07-25 12:27:19 +0200714#if (defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT) && \
715 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT)) || \
Gilles Peskine449bd832023-01-11 14:50:10 +0100716 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
717 if (PSA_KEY_TYPE_IS_RSA(type)) {
718 return mbedtls_psa_rsa_import_key(attributes,
719 data, data_length,
720 key_buffer, key_buffer_size,
721 key_buffer_length,
722 bits);
Steven Cooreman3ea0ce42020-10-23 11:37:05 +0200723 }
Valerio Settife478902023-07-25 12:27:19 +0200724#endif /* (defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT) &&
725 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT)) ||
John Durkop9814fa22020-11-04 12:28:15 -0800726 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100727 }
Steven Cooreman40120f62020-10-29 11:42:22 +0100728
Gilles Peskine449bd832023-01-11 14:50:10 +0100729 return PSA_ERROR_NOT_SUPPORTED;
Darryl Green06fd18d2018-07-16 11:21:11 +0100730}
731
Gilles Peskinef603c712019-01-19 13:40:11 +0100732/** Calculate the intersection of two algorithm usage policies.
733 *
734 * Return 0 (which allows no operation) on incompatibility.
735 */
736static psa_algorithm_t psa_key_policy_algorithm_intersection(
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100737 psa_key_type_t key_type,
Gilles Peskinef603c712019-01-19 13:40:11 +0100738 psa_algorithm_t alg1,
Gilles Peskine449bd832023-01-11 14:50:10 +0100739 psa_algorithm_t alg2)
Gilles Peskinef603c712019-01-19 13:40:11 +0100740{
Gilles Peskine549ea862019-05-22 11:45:59 +0200741 /* Common case: both sides actually specify the same policy. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100742 if (alg1 == alg2) {
743 return alg1;
744 }
Steven Cooreman03488022021-02-18 12:07:20 +0100745 /* If the policies are from the same hash-and-sign family, check
746 * if one is a wildcard. If so the other has the specific algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100747 if (PSA_ALG_IS_SIGN_HASH(alg1) &&
748 PSA_ALG_IS_SIGN_HASH(alg2) &&
749 (alg1 & ~PSA_ALG_HASH_MASK) == (alg2 & ~PSA_ALG_HASH_MASK)) {
750 if (PSA_ALG_SIGN_GET_HASH(alg1) == PSA_ALG_ANY_HASH) {
751 return alg2;
752 }
753 if (PSA_ALG_SIGN_GET_HASH(alg2) == PSA_ALG_ANY_HASH) {
754 return alg1;
755 }
Steven Cooreman03488022021-02-18 12:07:20 +0100756 }
757 /* If the policies are from the same AEAD family, check whether
Steven Cooreman7de9e2d2021-02-22 17:05:56 +0100758 * one of them is a minimum-tag-length wildcard. Calculate the most
Steven Cooreman03488022021-02-18 12:07:20 +0100759 * restrictive tag length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100760 if (PSA_ALG_IS_AEAD(alg1) && PSA_ALG_IS_AEAD(alg2) &&
761 (PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg1, 0) ==
762 PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg2, 0))) {
763 size_t alg1_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg1);
764 size_t alg2_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg2);
Steven Cooremancd640932021-03-08 12:00:27 +0100765 size_t restricted_len = alg1_len > alg2_len ? alg1_len : alg2_len;
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100766
Steven Cooreman7de9e2d2021-02-22 17:05:56 +0100767 /* If both are wildcards, return most restrictive wildcard */
Gilles Peskine449bd832023-01-11 14:50:10 +0100768 if (((alg1 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
769 ((alg2 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0)) {
770 return PSA_ALG_AEAD_WITH_AT_LEAST_THIS_LENGTH_TAG(
771 alg1, restricted_len);
Steven Cooreman03488022021-02-18 12:07:20 +0100772 }
773 /* If only one is a wildcard, return specific algorithm if compatible. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100774 if (((alg1 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
775 (alg1_len <= alg2_len)) {
776 return alg2;
Steven Cooreman03488022021-02-18 12:07:20 +0100777 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100778 if (((alg2 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
779 (alg2_len <= alg1_len)) {
780 return alg1;
Steven Cooreman03488022021-02-18 12:07:20 +0100781 }
782 }
783 /* If the policies are from the same MAC family, check whether one
784 * of them is a minimum-MAC-length policy. Calculate the most
785 * restrictive tag length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100786 if (PSA_ALG_IS_MAC(alg1) && PSA_ALG_IS_MAC(alg2) &&
787 (PSA_ALG_FULL_LENGTH_MAC(alg1) ==
788 PSA_ALG_FULL_LENGTH_MAC(alg2))) {
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100789 /* Validate the combination of key type and algorithm. Since the base
790 * algorithm of alg1 and alg2 are the same, we only need this once. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100791 if (PSA_SUCCESS != psa_mac_key_can_do(alg1, key_type)) {
792 return 0;
793 }
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100794
Steven Cooreman31a876d2021-03-03 20:47:40 +0100795 /* Get the (exact or at-least) output lengths for both sides of the
796 * requested intersection. None of the currently supported algorithms
797 * have an output length dependent on the actual key size, so setting it
798 * to a bogus value of 0 is currently OK.
799 *
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100800 * Note that for at-least-this-length wildcard algorithms, the output
801 * length is set to the shortest allowed length, which allows us to
802 * calculate the most restrictive tag length for the intersection. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100803 size_t alg1_len = PSA_MAC_LENGTH(key_type, 0, alg1);
804 size_t alg2_len = PSA_MAC_LENGTH(key_type, 0, alg2);
Steven Cooremancd640932021-03-08 12:00:27 +0100805 size_t restricted_len = alg1_len > alg2_len ? alg1_len : alg2_len;
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100806
Steven Cooremana1d83222021-02-25 10:20:29 +0100807 /* If both are wildcards, return most restrictive wildcard */
Gilles Peskine449bd832023-01-11 14:50:10 +0100808 if (((alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
809 ((alg2 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0)) {
810 return PSA_ALG_AT_LEAST_THIS_LENGTH_MAC(alg1, restricted_len);
Steven Cooreman03488022021-02-18 12:07:20 +0100811 }
Steven Cooreman31a876d2021-03-03 20:47:40 +0100812
813 /* If only one is an at-least-this-length policy, the intersection would
814 * be the other (fixed-length) policy as long as said fixed length is
815 * equal to or larger than the shortest allowed length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100816 if ((alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) {
817 return (alg1_len <= alg2_len) ? alg2 : 0;
Steven Cooreman03488022021-02-18 12:07:20 +0100818 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100819 if ((alg2 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) {
820 return (alg2_len <= alg1_len) ? alg1 : 0;
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100821 }
Steven Cooreman31a876d2021-03-03 20:47:40 +0100822
Steven Cooremancd640932021-03-08 12:00:27 +0100823 /* If none of them are wildcards, check whether they define the same tag
824 * length. This is still possible here when one is default-length and
825 * the other specific-length. Ensure to always return the
826 * specific-length version for the intersection. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100827 if (alg1_len == alg2_len) {
828 return PSA_ALG_TRUNCATED_MAC(alg1, alg1_len);
829 }
Gilles Peskinef603c712019-01-19 13:40:11 +0100830 }
831 /* If the policies are incompatible, allow nothing. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100832 return 0;
Gilles Peskinef603c712019-01-19 13:40:11 +0100833}
834
Gilles Peskine449bd832023-01-11 14:50:10 +0100835static int psa_key_algorithm_permits(psa_key_type_t key_type,
836 psa_algorithm_t policy_alg,
837 psa_algorithm_t requested_alg)
Gilles Peskined6f371b2019-05-10 19:33:38 +0200838{
Gilles Peskine549ea862019-05-22 11:45:59 +0200839 /* Common case: the policy only allows requested_alg. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100840 if (requested_alg == policy_alg) {
841 return 1;
842 }
Steven Cooreman03488022021-02-18 12:07:20 +0100843 /* If policy_alg is a hash-and-sign with a wildcard for the hash,
844 * and requested_alg is the same hash-and-sign family with any hash,
845 * then requested_alg is compliant with policy_alg. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100846 if (PSA_ALG_IS_SIGN_HASH(requested_alg) &&
847 PSA_ALG_SIGN_GET_HASH(policy_alg) == PSA_ALG_ANY_HASH) {
848 return (policy_alg & ~PSA_ALG_HASH_MASK) ==
849 (requested_alg & ~PSA_ALG_HASH_MASK);
Steven Cooreman03488022021-02-18 12:07:20 +0100850 }
851 /* If policy_alg is a wildcard AEAD algorithm of the same base as
852 * the requested algorithm, check the requested tag length to be
853 * equal-length or longer than the wildcard-specified length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100854 if (PSA_ALG_IS_AEAD(policy_alg) &&
855 PSA_ALG_IS_AEAD(requested_alg) &&
856 (PSA_ALG_AEAD_WITH_SHORTENED_TAG(policy_alg, 0) ==
857 PSA_ALG_AEAD_WITH_SHORTENED_TAG(requested_alg, 0)) &&
858 ((policy_alg & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0)) {
859 return PSA_ALG_AEAD_GET_TAG_LENGTH(policy_alg) <=
860 PSA_ALG_AEAD_GET_TAG_LENGTH(requested_alg);
Steven Cooreman03488022021-02-18 12:07:20 +0100861 }
Steven Cooremancd640932021-03-08 12:00:27 +0100862 /* If policy_alg is a MAC algorithm of the same base as the requested
863 * algorithm, check whether their MAC lengths are compatible. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100864 if (PSA_ALG_IS_MAC(policy_alg) &&
865 PSA_ALG_IS_MAC(requested_alg) &&
866 (PSA_ALG_FULL_LENGTH_MAC(policy_alg) ==
867 PSA_ALG_FULL_LENGTH_MAC(requested_alg))) {
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100868 /* Validate the combination of key type and algorithm. Since the policy
869 * and requested algorithms are the same, we only need this once. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100870 if (PSA_SUCCESS != psa_mac_key_can_do(policy_alg, key_type)) {
871 return 0;
872 }
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100873
Steven Cooreman31a876d2021-03-03 20:47:40 +0100874 /* Get both the requested output length for the algorithm which is to be
875 * verified, and the default output length for the base algorithm.
876 * Note that none of the currently supported algorithms have an output
877 * length dependent on actual key size, so setting it to a bogus value
878 * of 0 is currently OK. */
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100879 size_t requested_output_length = PSA_MAC_LENGTH(
Gilles Peskine449bd832023-01-11 14:50:10 +0100880 key_type, 0, requested_alg);
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100881 size_t default_output_length = PSA_MAC_LENGTH(
Gilles Peskine449bd832023-01-11 14:50:10 +0100882 key_type, 0,
883 PSA_ALG_FULL_LENGTH_MAC(requested_alg));
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100884
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100885 /* If the policy is default-length, only allow an algorithm with
886 * a declared exact-length matching the default. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100887 if (PSA_MAC_TRUNCATED_LENGTH(policy_alg) == 0) {
888 return requested_output_length == default_output_length;
889 }
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100890
891 /* If the requested algorithm is default-length, allow it if the policy
Steven Cooremancd640932021-03-08 12:00:27 +0100892 * length exactly matches the default length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100893 if (PSA_MAC_TRUNCATED_LENGTH(requested_alg) == 0 &&
894 PSA_MAC_TRUNCATED_LENGTH(policy_alg) == default_output_length) {
895 return 1;
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100896 }
897
Steven Cooremancd640932021-03-08 12:00:27 +0100898 /* If policy_alg is an at-least-this-length wildcard MAC algorithm,
899 * check for the requested MAC length to be equal to or longer than the
900 * minimum allowed length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100901 if ((policy_alg & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) {
902 return PSA_MAC_TRUNCATED_LENGTH(policy_alg) <=
903 requested_output_length;
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100904 }
Gilles Peskined6f371b2019-05-10 19:33:38 +0200905 }
Steven Cooremance48e852020-10-05 16:02:45 +0200906 /* If policy_alg is a generic key agreement operation, then using it for
Steven Cooremanfa5e6312020-10-15 17:07:12 +0200907 * a key derivation with that key agreement should also be allowed. This
908 * behaviour is expected to be defined in a future specification version. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100909 if (PSA_ALG_IS_RAW_KEY_AGREEMENT(policy_alg) &&
910 PSA_ALG_IS_KEY_AGREEMENT(requested_alg)) {
911 return PSA_ALG_KEY_AGREEMENT_GET_BASE(requested_alg) ==
912 policy_alg;
Steven Cooremance48e852020-10-05 16:02:45 +0200913 }
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100914 /* If it isn't explicitly permitted, it's forbidden. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100915 return 0;
Gilles Peskined6f371b2019-05-10 19:33:38 +0200916}
917
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100918/** Test whether a policy permits an algorithm.
919 *
920 * The caller must test usage flags separately.
Steven Cooreman7e39f052021-02-23 14:18:32 +0100921 *
Steven Cooreman5a172672021-03-02 21:27:42 +0100922 * \note This function requires providing the key type for which the policy is
923 * being validated, since some algorithm policy definitions (e.g. MAC)
924 * have different properties depending on what kind of cipher it is
925 * combined with.
926 *
Steven Cooreman7e39f052021-02-23 14:18:32 +0100927 * \retval PSA_SUCCESS When \p alg is a specific algorithm
928 * allowed by the \p policy.
929 * \retval PSA_ERROR_INVALID_ARGUMENT When \p alg is not a specific algorithm
930 * \retval PSA_ERROR_NOT_PERMITTED When \p alg is a specific algorithm, but
931 * the \p policy does not allow it.
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100932 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100933static psa_status_t psa_key_policy_permits(const psa_key_policy_t *policy,
934 psa_key_type_t key_type,
935 psa_algorithm_t alg)
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100936{
Steven Cooremand788fab2021-02-25 11:29:17 +0100937 /* '0' is not a valid algorithm */
Gilles Peskine449bd832023-01-11 14:50:10 +0100938 if (alg == 0) {
939 return PSA_ERROR_INVALID_ARGUMENT;
940 }
Steven Cooremand788fab2021-02-25 11:29:17 +0100941
Steven Cooreman7e39f052021-02-23 14:18:32 +0100942 /* A requested algorithm cannot be a wildcard. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100943 if (PSA_ALG_IS_WILDCARD(alg)) {
944 return PSA_ERROR_INVALID_ARGUMENT;
945 }
Steven Cooreman7e39f052021-02-23 14:18:32 +0100946
Gilles Peskine449bd832023-01-11 14:50:10 +0100947 if (psa_key_algorithm_permits(key_type, policy->alg, alg) ||
948 psa_key_algorithm_permits(key_type, policy->alg2, alg)) {
949 return PSA_SUCCESS;
950 } else {
951 return PSA_ERROR_NOT_PERMITTED;
952 }
Gilles Peskine30f77cd2019-01-14 16:06:39 +0100953}
954
Gilles Peskinef603c712019-01-19 13:40:11 +0100955/** Restrict a key policy based on a constraint.
956 *
Steven Cooreman5a172672021-03-02 21:27:42 +0100957 * \note This function requires providing the key type for which the policy is
958 * being restricted, since some algorithm policy definitions (e.g. MAC)
959 * have different properties depending on what kind of cipher it is
960 * combined with.
961 *
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100962 * \param[in] key_type The key type for which to restrict the policy
Gilles Peskinef603c712019-01-19 13:40:11 +0100963 * \param[in,out] policy The policy to restrict.
964 * \param[in] constraint The policy constraint to apply.
965 *
966 * \retval #PSA_SUCCESS
967 * \c *policy contains the intersection of the original value of
968 * \c *policy and \c *constraint.
969 * \retval #PSA_ERROR_INVALID_ARGUMENT
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100970 * \c key_type, \c *policy and \c *constraint are incompatible.
Gilles Peskinef603c712019-01-19 13:40:11 +0100971 * \c *policy is unchanged.
972 */
973static psa_status_t psa_restrict_key_policy(
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100974 psa_key_type_t key_type,
Gilles Peskinef603c712019-01-19 13:40:11 +0100975 psa_key_policy_t *policy,
Gilles Peskine449bd832023-01-11 14:50:10 +0100976 const psa_key_policy_t *constraint)
Gilles Peskinef603c712019-01-19 13:40:11 +0100977{
978 psa_algorithm_t intersection_alg =
Gilles Peskine449bd832023-01-11 14:50:10 +0100979 psa_key_policy_algorithm_intersection(key_type, policy->alg,
980 constraint->alg);
Gilles Peskined6f371b2019-05-10 19:33:38 +0200981 psa_algorithm_t intersection_alg2 =
Gilles Peskine449bd832023-01-11 14:50:10 +0100982 psa_key_policy_algorithm_intersection(key_type, policy->alg2,
983 constraint->alg2);
984 if (intersection_alg == 0 && policy->alg != 0 && constraint->alg != 0) {
985 return PSA_ERROR_INVALID_ARGUMENT;
986 }
987 if (intersection_alg2 == 0 && policy->alg2 != 0 && constraint->alg2 != 0) {
988 return PSA_ERROR_INVALID_ARGUMENT;
989 }
Gilles Peskinef603c712019-01-19 13:40:11 +0100990 policy->usage &= constraint->usage;
991 policy->alg = intersection_alg;
Gilles Peskined6f371b2019-05-10 19:33:38 +0200992 policy->alg2 = intersection_alg2;
Gilles Peskine449bd832023-01-11 14:50:10 +0100993 return PSA_SUCCESS;
Gilles Peskinef603c712019-01-19 13:40:11 +0100994}
995
Przemek Stekiel061f6942022-11-30 10:51:35 +0100996/** Get the description of a key given its identifier and policy constraints
997 * and lock it.
998 *
999 * The key must have allow all the usage flags set in \p usage. If \p alg is
1000 * nonzero, the key must allow operations with this algorithm. If \p alg is
1001 * zero, the algorithm is not checked.
1002 *
1003 * In case of a persistent key, the function loads the description of the key
1004 * into a key slot if not already done.
1005 *
1006 * On success, the returned key slot is locked. It is the responsibility of
1007 * the caller to unlock the key slot when it does not access it anymore.
1008 */
1009static psa_status_t psa_get_and_lock_key_slot_with_policy(
Ronald Cron5c522922020-11-14 16:35:34 +01001010 mbedtls_svc_key_id_t key,
1011 psa_key_slot_t **p_slot,
1012 psa_key_usage_t usage,
Gilles Peskine449bd832023-01-11 14:50:10 +01001013 psa_algorithm_t alg)
Darryl Green06fd18d2018-07-16 11:21:11 +01001014{
Ronald Cronf95a2b12020-10-22 15:24:49 +02001015 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01001016 psa_key_slot_t *slot = NULL;
Darryl Green06fd18d2018-07-16 11:21:11 +01001017
Gilles Peskine449bd832023-01-11 14:50:10 +01001018 status = psa_get_and_lock_key_slot(key, p_slot);
1019 if (status != PSA_SUCCESS) {
1020 return status;
1021 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02001022 slot = *p_slot;
Darryl Green06fd18d2018-07-16 11:21:11 +01001023
1024 /* Enforce that usage policy for the key slot contains all the flags
1025 * required by the usage parameter. There is one exception: public
1026 * keys can always be exported, so we treat public key objects as
1027 * if they had the export flag. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001028 if (PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type)) {
Darryl Green06fd18d2018-07-16 11:21:11 +01001029 usage &= ~PSA_KEY_USAGE_EXPORT;
Gilles Peskine449bd832023-01-11 14:50:10 +01001030 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02001031
Gilles Peskine449bd832023-01-11 14:50:10 +01001032 if ((slot->attr.policy.usage & usage) != usage) {
Steven Cooreman328f11c2021-03-02 11:44:51 +01001033 status = PSA_ERROR_NOT_PERMITTED;
Ronald Cronf95a2b12020-10-22 15:24:49 +02001034 goto error;
Steven Cooreman328f11c2021-03-02 11:44:51 +01001035 }
Gilles Peskine30f77cd2019-01-14 16:06:39 +01001036
Shaun Case8b0ecbc2021-12-20 21:14:10 -08001037 /* Enforce that the usage policy permits the requested algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001038 if (alg != 0) {
1039 status = psa_key_policy_permits(&slot->attr.policy,
1040 slot->attr.type,
1041 alg);
1042 if (status != PSA_SUCCESS) {
Steven Cooreman7e39f052021-02-23 14:18:32 +01001043 goto error;
Gilles Peskine449bd832023-01-11 14:50:10 +01001044 }
Steven Cooreman7e39f052021-02-23 14:18:32 +01001045 }
Darryl Green06fd18d2018-07-16 11:21:11 +01001046
Gilles Peskine449bd832023-01-11 14:50:10 +01001047 return PSA_SUCCESS;
Ronald Cronf95a2b12020-10-22 15:24:49 +02001048
1049error:
1050 *p_slot = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01001051 psa_unlock_key_slot(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02001052
Gilles Peskine449bd832023-01-11 14:50:10 +01001053 return status;
Darryl Green06fd18d2018-07-16 11:21:11 +01001054}
Darryl Green940d72c2018-07-13 13:18:51 +01001055
Ronald Cron5c522922020-11-14 16:35:34 +01001056/** Get a key slot containing a transparent key and lock it.
Gilles Peskine28f8f302019-07-24 13:30:31 +02001057 *
1058 * A transparent key is a key for which the key material is directly
Ronald Cronddae0f52021-08-24 15:39:44 +02001059 * available, as opposed to a key in a secure element and/or to be used
1060 * by a secure element.
Gilles Peskine28f8f302019-07-24 13:30:31 +02001061 *
Ronald Cronddae0f52021-08-24 15:39:44 +02001062 * This is a temporary function that may be used instead of
1063 * psa_get_and_lock_key_slot_with_policy() when there is no opaque key support
1064 * for a cryptographic operation.
Ronald Cronf95a2b12020-10-22 15:24:49 +02001065 *
Ronald Cron5c522922020-11-14 16:35:34 +01001066 * On success, the returned key slot is locked. It is the responsibility of the
1067 * caller to unlock the key slot when it does not access it anymore.
Gilles Peskine28f8f302019-07-24 13:30:31 +02001068 */
Ronald Cron5c522922020-11-14 16:35:34 +01001069static psa_status_t psa_get_and_lock_transparent_key_slot_with_policy(
1070 mbedtls_svc_key_id_t key,
1071 psa_key_slot_t **p_slot,
1072 psa_key_usage_t usage,
Gilles Peskine449bd832023-01-11 14:50:10 +01001073 psa_algorithm_t alg)
Gilles Peskine28f8f302019-07-24 13:30:31 +02001074{
Gilles Peskine449bd832023-01-11 14:50:10 +01001075 psa_status_t status = psa_get_and_lock_key_slot_with_policy(key, p_slot,
1076 usage, alg);
1077 if (status != PSA_SUCCESS) {
1078 return status;
Gilles Peskine28f8f302019-07-24 13:30:31 +02001079 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02001080
Gilles Peskine449bd832023-01-11 14:50:10 +01001081 if (psa_key_lifetime_is_external((*p_slot)->attr.lifetime)) {
1082 psa_unlock_key_slot(*p_slot);
1083 *p_slot = NULL;
1084 return PSA_ERROR_NOT_SUPPORTED;
1085 }
1086
1087 return PSA_SUCCESS;
Gilles Peskine28f8f302019-07-24 13:30:31 +02001088}
Gilles Peskine28f8f302019-07-24 13:30:31 +02001089
Gilles Peskine449bd832023-01-11 14:50:10 +01001090psa_status_t psa_remove_key_data_from_memory(psa_key_slot_t *slot)
Darryl Green40225ba2018-11-15 14:48:15 +00001091{
Gilles Peskine449bd832023-01-11 14:50:10 +01001092 if (slot->key.data != NULL) {
Tom Cosgrove52f7e182023-08-01 09:08:48 +01001093 mbedtls_zeroize_and_free(slot->key.data, slot->key.bytes);
Gilles Peskine449bd832023-01-11 14:50:10 +01001094 }
Ronald Cronea0f8a62020-11-25 17:52:23 +01001095
Ronald Cronea0f8a62020-11-25 17:52:23 +01001096 slot->key.data = NULL;
1097 slot->key.bytes = 0;
Darryl Green40225ba2018-11-15 14:48:15 +00001098
Gilles Peskine449bd832023-01-11 14:50:10 +01001099 return PSA_SUCCESS;
Darryl Green40225ba2018-11-15 14:48:15 +00001100}
1101
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001102/** Completely wipe a slot in memory, including its policy.
1103 * Persistent storage is not affected. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001104psa_status_t psa_wipe_key_slot(psa_key_slot_t *slot)
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001105{
Gilles Peskine449bd832023-01-11 14:50:10 +01001106 psa_status_t status = psa_remove_key_data_from_memory(slot);
Ronald Cronddd3d052020-10-30 14:07:07 +01001107
Gilles Peskine449bd832023-01-11 14:50:10 +01001108 /*
1109 * As the return error code may not be handled in case of multiple errors,
1110 * do our best to report an unexpected lock counter. Assert with
1111 * MBEDTLS_TEST_HOOK_TEST_ASSERT that the lock counter is equal to one:
1112 * if the MBEDTLS_TEST_HOOKS configuration option is enabled and the
1113 * function is called as part of the execution of a test suite, the
1114 * execution of the test suite is stopped in error if the assertion fails.
1115 */
1116 if (slot->lock_count != 1) {
1117 MBEDTLS_TEST_HOOK_TEST_ASSERT(slot->lock_count == 1);
Ronald Cronddd3d052020-10-30 14:07:07 +01001118 status = PSA_ERROR_CORRUPTION_DETECTED;
1119 }
1120
Gilles Peskine3f7cd622019-08-13 15:01:08 +02001121 /* Multipart operations may still be using the key. This is safe
1122 * because all multipart operation objects are independent from
1123 * the key slot: if they need to access the key after the setup
1124 * phase, they have a copy of the key. Note that this means that
1125 * key material can linger until all operations are completed. */
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001126 /* At this point, key material and other type-specific content has
1127 * been wiped. Clear remaining metadata. We can call memset and not
1128 * zeroize because the metadata is not particularly sensitive. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001129 memset(slot, 0, sizeof(*slot));
1130 return status;
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001131}
1132
Gilles Peskine449bd832023-01-11 14:50:10 +01001133psa_status_t psa_destroy_key(mbedtls_svc_key_id_t key)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001134{
Gilles Peskine2f060a82018-12-04 17:12:32 +01001135 psa_key_slot_t *slot;
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001136 psa_status_t status; /* status of the last operation */
1137 psa_status_t overall_status = PSA_SUCCESS;
Gilles Peskine354f7672019-07-12 23:46:38 +02001138#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1139 psa_se_drv_table_entry_t *driver;
1140#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001141
Gilles Peskine449bd832023-01-11 14:50:10 +01001142 if (mbedtls_svc_key_id_is_null(key)) {
1143 return PSA_SUCCESS;
1144 }
Gilles Peskine1841cf42019-10-08 15:48:25 +02001145
Ronald Cronf2911112020-10-29 17:51:10 +01001146 /*
Ronald Cron19daca92020-11-10 18:08:03 +01001147 * Get the description of the key in a key slot. In case of a persistent
Ronald Cronf2911112020-10-29 17:51:10 +01001148 * key, this will load the key description from persistent memory if not
1149 * done yet. We cannot avoid this loading as without it we don't know if
1150 * the key is operated by an SE or not and this information is needed by
1151 * the current implementation.
1152 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001153 status = psa_get_and_lock_key_slot(key, &slot);
1154 if (status != PSA_SUCCESS) {
1155 return status;
1156 }
Gilles Peskine354f7672019-07-12 23:46:38 +02001157
Ronald Cronf2911112020-10-29 17:51:10 +01001158 /*
1159 * If the key slot containing the key description is under access by the
1160 * library (apart from the present access), the key cannot be destroyed
1161 * yet. For the time being, just return in error. Eventually (to be
1162 * implemented), the key should be destroyed when all accesses have
1163 * stopped.
1164 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001165 if (slot->lock_count > 1) {
1166 psa_unlock_key_slot(slot);
1167 return PSA_ERROR_GENERIC_ERROR;
Ronald Cronf2911112020-10-29 17:51:10 +01001168 }
1169
Gilles Peskine449bd832023-01-11 14:50:10 +01001170 if (PSA_KEY_LIFETIME_IS_READ_ONLY(slot->attr.lifetime)) {
Gilles Peskine6687cd02021-04-21 22:32:05 +02001171 /* Refuse the destruction of a read-only key (which may or may not work
1172 * if we attempt it, depending on whether the key is merely read-only
1173 * by policy or actually physically read-only).
Gilles Peskinef9a046e2021-06-07 23:27:54 +02001174 * Just do the best we can, which is to wipe the copy in memory
1175 * (done in this function's cleanup code). */
1176 overall_status = PSA_ERROR_NOT_PERMITTED;
1177 goto exit;
Gilles Peskine6687cd02021-04-21 22:32:05 +02001178 }
1179
Gilles Peskine354f7672019-07-12 23:46:38 +02001180#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001181 driver = psa_get_se_driver_entry(slot->attr.lifetime);
1182 if (driver != NULL) {
Gilles Peskine60450a42019-07-25 11:32:45 +02001183 /* For a key in a secure element, we need to do three things:
1184 * remove the key file in internal storage, destroy the
1185 * key inside the secure element, and update the driver's
1186 * persistent data. Start a transaction that will encompass these
1187 * three actions. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001188 psa_crypto_prepare_transaction(PSA_CRYPTO_TRANSACTION_DESTROY_KEY);
Gilles Peskine8e338702019-07-30 20:06:31 +02001189 psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
Gilles Peskine449bd832023-01-11 14:50:10 +01001190 psa_crypto_transaction.key.slot = psa_key_slot_get_slot_number(slot);
Gilles Peskine8e338702019-07-30 20:06:31 +02001191 psa_crypto_transaction.key.id = slot->attr.id;
Gilles Peskine449bd832023-01-11 14:50:10 +01001192 status = psa_crypto_save_transaction();
1193 if (status != PSA_SUCCESS) {
1194 (void) psa_crypto_stop_transaction();
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001195 /* We should still try to destroy the key in the secure
1196 * element and the key metadata in storage. This is especially
1197 * important if the error is that the storage is full.
1198 * But how to do it exactly without risking an inconsistent
1199 * state after a reset?
1200 * https://github.com/ARMmbed/mbed-crypto/issues/215
1201 */
1202 overall_status = status;
1203 goto exit;
Gilles Peskinefc762652019-07-22 19:30:34 +02001204 }
1205
Gilles Peskine449bd832023-01-11 14:50:10 +01001206 status = psa_destroy_se_key(driver,
1207 psa_key_slot_get_slot_number(slot));
1208 if (overall_status == PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001209 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001210 }
Gilles Peskinefc762652019-07-22 19:30:34 +02001211 }
Gilles Peskine354f7672019-07-12 23:46:38 +02001212#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1213
Darryl Greend49a4992018-06-18 17:27:26 +01001214#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001215 if (!PSA_KEY_LIFETIME_IS_VOLATILE(slot->attr.lifetime)) {
1216 status = psa_destroy_persistent_key(slot->attr.id);
1217 if (overall_status == PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001218 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001219 }
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001220
Gilles Peskine9ce31c42019-08-13 15:14:20 +02001221 /* TODO: other slots may have a copy of the same key. We should
1222 * invalidate them.
1223 * https://github.com/ARMmbed/mbed-crypto/issues/214
1224 */
Darryl Greend49a4992018-06-18 17:27:26 +01001225 }
1226#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
Gilles Peskine354f7672019-07-12 23:46:38 +02001227
Gilles Peskinefc762652019-07-22 19:30:34 +02001228#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001229 if (driver != NULL) {
1230 status = psa_save_se_persistent_data(driver);
1231 if (overall_status == PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001232 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001233 }
1234 status = psa_crypto_stop_transaction();
1235 if (overall_status == PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001236 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001237 }
Gilles Peskinefc762652019-07-22 19:30:34 +02001238 }
1239#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1240
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001241exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001242 status = psa_wipe_key_slot(slot);
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001243 /* Prioritize CORRUPTION_DETECTED from wiping over a storage error */
Gilles Peskine449bd832023-01-11 14:50:10 +01001244 if (status != PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001245 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001246 }
1247 return overall_status;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001248}
1249
Valerio Settib2bcedb2023-07-10 11:24:00 +02001250#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT) || \
John Durkop0e005192020-10-31 22:06:54 -07001251 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Gilles Peskineb699f072019-04-26 16:06:02 +02001252static psa_status_t psa_get_rsa_public_exponent(
1253 const mbedtls_rsa_context *rsa,
Gilles Peskine449bd832023-01-11 14:50:10 +01001254 psa_key_attributes_t *attributes)
Gilles Peskineb699f072019-04-26 16:06:02 +02001255{
1256 mbedtls_mpi mpi;
Janos Follath24eed8d2019-11-22 13:21:35 +00001257 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskineb699f072019-04-26 16:06:02 +02001258 uint8_t *buffer = NULL;
1259 size_t buflen;
Gilles Peskine449bd832023-01-11 14:50:10 +01001260 mbedtls_mpi_init(&mpi);
Gilles Peskineb699f072019-04-26 16:06:02 +02001261
Gilles Peskine449bd832023-01-11 14:50:10 +01001262 ret = mbedtls_rsa_export(rsa, NULL, NULL, NULL, NULL, &mpi);
1263 if (ret != 0) {
Gilles Peskineb699f072019-04-26 16:06:02 +02001264 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001265 }
1266 if (mbedtls_mpi_cmp_int(&mpi, 65537) == 0) {
Gilles Peskine772c8b12019-04-26 17:37:21 +02001267 /* It's the default value, which is reported as an empty string,
1268 * so there's nothing to do. */
1269 goto exit;
1270 }
Gilles Peskineb699f072019-04-26 16:06:02 +02001271
Gilles Peskine449bd832023-01-11 14:50:10 +01001272 buflen = mbedtls_mpi_size(&mpi);
1273 buffer = mbedtls_calloc(1, buflen);
1274 if (buffer == NULL) {
Gilles Peskineb699f072019-04-26 16:06:02 +02001275 ret = MBEDTLS_ERR_MPI_ALLOC_FAILED;
1276 goto exit;
1277 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001278 ret = mbedtls_mpi_write_binary(&mpi, buffer, buflen);
1279 if (ret != 0) {
Gilles Peskineb699f072019-04-26 16:06:02 +02001280 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001281 }
Gilles Peskineb699f072019-04-26 16:06:02 +02001282 attributes->domain_parameters = buffer;
1283 attributes->domain_parameters_size = buflen;
1284
1285exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001286 mbedtls_mpi_free(&mpi);
1287 if (ret != 0) {
1288 mbedtls_free(buffer);
1289 }
1290 return mbedtls_to_psa_error(ret);
Gilles Peskineb699f072019-04-26 16:06:02 +02001291}
Valerio Settib2bcedb2023-07-10 11:24:00 +02001292#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT) ||
John Durkop9814fa22020-11-04 12:28:15 -08001293 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Gilles Peskineb699f072019-04-26 16:06:02 +02001294
Gilles Peskinebfd322f2019-07-23 11:58:03 +02001295/** Retrieve all the publicly-accessible attributes of a key.
1296 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001297psa_status_t psa_get_key_attributes(mbedtls_svc_key_id_t key,
1298 psa_key_attributes_t *attributes)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001299{
Ronald Cronf95a2b12020-10-22 15:24:49 +02001300 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01001301 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01001302 psa_key_slot_t *slot;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001303
Gilles Peskine449bd832023-01-11 14:50:10 +01001304 psa_reset_key_attributes(attributes);
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001305
Gilles Peskine449bd832023-01-11 14:50:10 +01001306 status = psa_get_and_lock_key_slot_with_policy(key, &slot, 0, 0);
1307 if (status != PSA_SUCCESS) {
1308 return status;
1309 }
Gilles Peskineb870b182018-07-06 16:02:09 +02001310
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001311 attributes->core = slot->attr;
Gilles Peskine449bd832023-01-11 14:50:10 +01001312 attributes->core.flags &= (MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY |
1313 MBEDTLS_PSA_KA_MASK_DUAL_USE);
Gilles Peskinec8000c02019-08-02 20:15:51 +02001314
1315#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001316 if (psa_get_se_driver_entry(slot->attr.lifetime) != NULL) {
1317 psa_set_key_slot_number(attributes,
1318 psa_key_slot_get_slot_number(slot));
1319 }
Gilles Peskinec8000c02019-08-02 20:15:51 +02001320#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskineb699f072019-04-26 16:06:02 +02001321
Gilles Peskine449bd832023-01-11 14:50:10 +01001322 switch (slot->attr.type) {
Valerio Settib2bcedb2023-07-10 11:24:00 +02001323#if (defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT) && \
1324 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT)) || \
John Durkop0e005192020-10-31 22:06:54 -07001325 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Gilles Peskinec93b80c2019-05-16 19:39:54 +02001326 case PSA_KEY_TYPE_RSA_KEY_PAIR:
Gilles Peskineb699f072019-04-26 16:06:02 +02001327 case PSA_KEY_TYPE_RSA_PUBLIC_KEY:
Janos Follath1d57a202019-08-13 12:15:34 +01001328 /* TODO: reporting the public exponent for opaque keys
Gilles Peskinec9d7f942019-08-13 16:17:16 +02001329 * is not yet implemented.
1330 * https://github.com/ARMmbed/mbed-crypto/issues/216
1331 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001332 if (!psa_key_lifetime_is_external(slot->attr.lifetime)) {
Steven Cooremana2371e52020-07-28 14:30:39 +02001333 mbedtls_rsa_context *rsa = NULL;
Steven Cooremana01795d2020-07-24 22:48:15 +02001334
Ronald Cron90857082020-11-25 14:58:33 +01001335 status = mbedtls_psa_rsa_load_representation(
Gilles Peskine449bd832023-01-11 14:50:10 +01001336 slot->attr.type,
1337 slot->key.data,
1338 slot->key.bytes,
1339 &rsa);
1340 if (status != PSA_SUCCESS) {
Steven Cooremana01795d2020-07-24 22:48:15 +02001341 break;
Gilles Peskine449bd832023-01-11 14:50:10 +01001342 }
Steven Cooremana01795d2020-07-24 22:48:15 +02001343
Gilles Peskine449bd832023-01-11 14:50:10 +01001344 status = psa_get_rsa_public_exponent(rsa,
1345 attributes);
1346 mbedtls_rsa_free(rsa);
1347 mbedtls_free(rsa);
Steven Cooremana01795d2020-07-24 22:48:15 +02001348 }
Gilles Peskineb699f072019-04-26 16:06:02 +02001349 break;
Valerio Settib2bcedb2023-07-10 11:24:00 +02001350#endif /* (defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT) && \
1351 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT)) ||
John Durkop9814fa22020-11-04 12:28:15 -08001352 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Gilles Peskineb699f072019-04-26 16:06:02 +02001353 default:
1354 /* Nothing else to do. */
1355 break;
1356 }
1357
Gilles Peskine449bd832023-01-11 14:50:10 +01001358 if (status != PSA_SUCCESS) {
1359 psa_reset_key_attributes(attributes);
1360 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02001361
Gilles Peskine449bd832023-01-11 14:50:10 +01001362 unlock_status = psa_unlock_key_slot(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02001363
Gilles Peskine449bd832023-01-11 14:50:10 +01001364 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001365}
1366
Gilles Peskinec8000c02019-08-02 20:15:51 +02001367#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1368psa_status_t psa_get_key_slot_number(
1369 const psa_key_attributes_t *attributes,
Gilles Peskine449bd832023-01-11 14:50:10 +01001370 psa_key_slot_number_t *slot_number)
Gilles Peskinec8000c02019-08-02 20:15:51 +02001371{
Gilles Peskine449bd832023-01-11 14:50:10 +01001372 if (attributes->core.flags & MBEDTLS_PSA_KA_FLAG_HAS_SLOT_NUMBER) {
Gilles Peskinec8000c02019-08-02 20:15:51 +02001373 *slot_number = attributes->slot_number;
Gilles Peskine449bd832023-01-11 14:50:10 +01001374 return PSA_SUCCESS;
1375 } else {
1376 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinec8000c02019-08-02 20:15:51 +02001377 }
Gilles Peskinec8000c02019-08-02 20:15:51 +02001378}
1379#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1380
Gilles Peskine449bd832023-01-11 14:50:10 +01001381static psa_status_t psa_export_key_buffer_internal(const uint8_t *key_buffer,
1382 size_t key_buffer_size,
1383 uint8_t *data,
1384 size_t data_size,
1385 size_t *data_length)
Steven Cooremana01795d2020-07-24 22:48:15 +02001386{
Gilles Peskine449bd832023-01-11 14:50:10 +01001387 if (key_buffer_size > data_size) {
1388 return PSA_ERROR_BUFFER_TOO_SMALL;
1389 }
1390 memcpy(data, key_buffer, key_buffer_size);
1391 memset(data + key_buffer_size, 0,
1392 data_size - key_buffer_size);
Ronald Crond18b5f82020-11-25 16:46:05 +01001393 *data_length = key_buffer_size;
Gilles Peskine449bd832023-01-11 14:50:10 +01001394 return PSA_SUCCESS;
Steven Cooremana01795d2020-07-24 22:48:15 +02001395}
1396
Ronald Cron7285cda2020-11-26 14:46:37 +01001397psa_status_t psa_export_key_internal(
Ronald Crond18b5f82020-11-25 16:46:05 +01001398 const psa_key_attributes_t *attributes,
1399 const uint8_t *key_buffer, size_t key_buffer_size,
Gilles Peskine449bd832023-01-11 14:50:10 +01001400 uint8_t *data, size_t data_size, size_t *data_length)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001401{
Ronald Crond18b5f82020-11-25 16:46:05 +01001402 psa_key_type_t type = attributes->core.type;
1403
Gilles Peskine449bd832023-01-11 14:50:10 +01001404 if (key_type_is_raw_bytes(type) ||
1405 PSA_KEY_TYPE_IS_RSA(type) ||
Przemek Stekiel472b3f32022-12-01 14:38:49 +01001406 PSA_KEY_TYPE_IS_ECC(type) ||
1407 PSA_KEY_TYPE_IS_DH(type)) {
Gilles Peskine449bd832023-01-11 14:50:10 +01001408 return psa_export_key_buffer_internal(
1409 key_buffer, key_buffer_size,
1410 data, data_size, data_length);
1411 } else {
Ronald Cron9486f9d2020-11-26 13:36:23 +01001412 /* This shouldn't happen in the reference implementation, but
1413 it is valid for a special-purpose implementation to omit
1414 support for exporting certain key types. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001415 return PSA_ERROR_NOT_SUPPORTED;
Ronald Cron9486f9d2020-11-26 13:36:23 +01001416 }
1417}
1418
Gilles Peskine449bd832023-01-11 14:50:10 +01001419psa_status_t psa_export_key(mbedtls_svc_key_id_t key,
1420 uint8_t *data,
1421 size_t data_size,
1422 size_t *data_length)
Ronald Cron9486f9d2020-11-26 13:36:23 +01001423{
1424 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
1425 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
1426 psa_key_slot_t *slot;
1427
Ronald Crone907e552021-01-18 13:22:38 +01001428 /* Reject a zero-length output buffer now, since this can never be a
1429 * valid key representation. This way we know that data must be a valid
1430 * pointer and we can do things like memset(data, ..., data_size). */
Gilles Peskine449bd832023-01-11 14:50:10 +01001431 if (data_size == 0) {
1432 return PSA_ERROR_BUFFER_TOO_SMALL;
1433 }
Ronald Crone907e552021-01-18 13:22:38 +01001434
Ronald Cron9486f9d2020-11-26 13:36:23 +01001435 /* Set the key to empty now, so that even when there are errors, we always
1436 * set data_length to a value between 0 and data_size. On error, setting
1437 * the key to empty is a good choice because an empty key representation is
1438 * unlikely to be accepted anywhere. */
Jaeden Amerof24c7f82018-06-27 17:20:43 +01001439 *data_length = 0;
1440
Ronald Cron9486f9d2020-11-26 13:36:23 +01001441 /* Export requires the EXPORT flag. There is an exception for public keys,
1442 * which don't require any flag, but
1443 * psa_get_and_lock_key_slot_with_policy() takes care of this.
1444 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001445 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
1446 PSA_KEY_USAGE_EXPORT, 0);
1447 if (status != PSA_SUCCESS) {
1448 return status;
1449 }
mohammad160306e79202018-03-28 13:17:44 +03001450
Ronald Crond18b5f82020-11-25 16:46:05 +01001451 psa_key_attributes_t attributes = {
1452 .core = slot->attr
1453 };
Gilles Peskine449bd832023-01-11 14:50:10 +01001454 status = psa_driver_wrapper_export_key(&attributes,
1455 slot->key.data, slot->key.bytes,
1456 data, data_size, data_length);
Ronald Cron9486f9d2020-11-26 13:36:23 +01001457
Gilles Peskine449bd832023-01-11 14:50:10 +01001458 unlock_status = psa_unlock_key_slot(slot);
Ronald Cron9486f9d2020-11-26 13:36:23 +01001459
Gilles Peskine449bd832023-01-11 14:50:10 +01001460 return (status == PSA_SUCCESS) ? unlock_status : status;
Ronald Cron9486f9d2020-11-26 13:36:23 +01001461}
1462
Ronald Cron7285cda2020-11-26 14:46:37 +01001463psa_status_t psa_export_public_key_internal(
Ronald Crond18b5f82020-11-25 16:46:05 +01001464 const psa_key_attributes_t *attributes,
1465 const uint8_t *key_buffer,
1466 size_t key_buffer_size,
1467 uint8_t *data,
1468 size_t data_size,
Gilles Peskine449bd832023-01-11 14:50:10 +01001469 size_t *data_length)
Ronald Cron9486f9d2020-11-26 13:36:23 +01001470{
Ronald Crond18b5f82020-11-25 16:46:05 +01001471 psa_key_type_t type = attributes->core.type;
Ronald Crond18b5f82020-11-25 16:46:05 +01001472
Przemek Stekiel6fd72b62023-04-27 10:20:56 +02001473 if (PSA_KEY_TYPE_IS_PUBLIC_KEY(type) &&
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001474 (PSA_KEY_TYPE_IS_RSA(type) || PSA_KEY_TYPE_IS_ECC(type) ||
1475 PSA_KEY_TYPE_IS_DH(type))) {
Przemek Stekiel6fd72b62023-04-27 10:20:56 +02001476 /* Exporting public -> public */
1477 return psa_export_key_buffer_internal(
1478 key_buffer, key_buffer_size,
1479 data, data_size, data_length);
1480 } else if (PSA_KEY_TYPE_IS_RSA(type)) {
Valerio Settib2bcedb2023-07-10 11:24:00 +02001481#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT) || \
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001482 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
1483 return mbedtls_psa_rsa_export_public_key(attributes,
1484 key_buffer,
1485 key_buffer_size,
1486 data,
1487 data_size,
1488 data_length);
Darryl Green9e2d7a02018-07-24 16:33:30 +01001489#else
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001490 /* We don't know how to convert a private RSA key to public. */
1491 return PSA_ERROR_NOT_SUPPORTED;
Valerio Settib2bcedb2023-07-10 11:24:00 +02001492#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT) ||
John Durkop9814fa22020-11-04 12:28:15 -08001493 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Przemek Stekiel6fd72b62023-04-27 10:20:56 +02001494 } else if (PSA_KEY_TYPE_IS_ECC(type)) {
Valerio Setti27c501a2023-06-27 16:58:52 +02001495#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT) || \
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001496 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
1497 return mbedtls_psa_ecp_export_public_key(attributes,
1498 key_buffer,
1499 key_buffer_size,
1500 data,
1501 data_size,
1502 data_length);
Steven Cooreman560c28a2020-07-24 23:20:24 +02001503#else
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001504 /* We don't know how to convert a private ECC key to public */
1505 return PSA_ERROR_NOT_SUPPORTED;
Valerio Setti27c501a2023-06-27 16:58:52 +02001506#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT) ||
John Durkop9814fa22020-11-04 12:28:15 -08001507 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
Przemek Stekiel6fd72b62023-04-27 10:20:56 +02001508 } else if (PSA_KEY_TYPE_IS_DH(type)) {
Valerio Settia55f0422023-07-10 15:34:41 +02001509#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT) || \
Przemek Stekiel6d85afa2023-04-28 11:42:17 +02001510 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY)
Przemek Stekiel152bb462023-06-01 11:52:39 +02001511 return mbedtls_psa_ffdh_export_public_key(attributes,
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001512 key_buffer,
1513 key_buffer_size,
1514 data, data_size,
1515 data_length);
Przemek Stekiel472b3f32022-12-01 14:38:49 +01001516#else
Przemek Stekiel472b3f32022-12-01 14:38:49 +01001517 return PSA_ERROR_NOT_SUPPORTED;
Valerio Settia55f0422023-07-10 15:34:41 +02001518#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT) ||
Przemek Stekiel6d85afa2023-04-28 11:42:17 +02001519 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) */
Gilles Peskine449bd832023-01-11 14:50:10 +01001520 } else {
Przemek Stekiel0b11ee02023-05-16 13:26:06 +02001521 (void) key_buffer;
1522 (void) key_buffer_size;
1523 (void) data;
1524 (void) data_size;
1525 (void) data_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01001526 return PSA_ERROR_NOT_SUPPORTED;
Steven Cooreman560c28a2020-07-24 23:20:24 +02001527 }
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001528}
Ronald Crond18b5f82020-11-25 16:46:05 +01001529
Gilles Peskine449bd832023-01-11 14:50:10 +01001530psa_status_t psa_export_public_key(mbedtls_svc_key_id_t key,
1531 uint8_t *data,
1532 size_t data_size,
1533 size_t *data_length)
Moran Pekerdd4ea382018-04-03 15:30:03 +03001534{
Ronald Cronf95a2b12020-10-22 15:24:49 +02001535 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01001536 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01001537 psa_key_slot_t *slot;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01001538 psa_key_attributes_t attributes;
Darryl Greendd8fb772018-11-07 16:00:44 +00001539
Ronald Crone907e552021-01-18 13:22:38 +01001540 /* Reject a zero-length output buffer now, since this can never be a
1541 * valid key representation. This way we know that data must be a valid
1542 * pointer and we can do things like memset(data, ..., data_size). */
Gilles Peskine449bd832023-01-11 14:50:10 +01001543 if (data_size == 0) {
1544 return PSA_ERROR_BUFFER_TOO_SMALL;
1545 }
Ronald Crone907e552021-01-18 13:22:38 +01001546
Darryl Greendd8fb772018-11-07 16:00:44 +00001547 /* Set the key to empty now, so that even when there are errors, we always
1548 * set data_length to a value between 0 and data_size. On error, setting
1549 * the key to empty is a good choice because an empty key representation is
1550 * unlikely to be accepted anywhere. */
1551 *data_length = 0;
1552
1553 /* Exporting a public key doesn't require a usage flag. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001554 status = psa_get_and_lock_key_slot_with_policy(key, &slot, 0, 0);
1555 if (status != PSA_SUCCESS) {
1556 return status;
1557 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02001558
Gilles Peskine449bd832023-01-11 14:50:10 +01001559 if (!PSA_KEY_TYPE_IS_ASYMMETRIC(slot->attr.type)) {
1560 status = PSA_ERROR_INVALID_ARGUMENT;
1561 goto exit;
Ronald Cron9486f9d2020-11-26 13:36:23 +01001562 }
1563
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01001564 attributes = (psa_key_attributes_t) {
Ronald Crond18b5f82020-11-25 16:46:05 +01001565 .core = slot->attr
1566 };
Ronald Cron67227982020-11-26 15:16:05 +01001567 status = psa_driver_wrapper_export_public_key(
Ronald Crond18b5f82020-11-25 16:46:05 +01001568 &attributes, slot->key.data, slot->key.bytes,
Gilles Peskine449bd832023-01-11 14:50:10 +01001569 data, data_size, data_length);
Ronald Cron9486f9d2020-11-26 13:36:23 +01001570
1571exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001572 unlock_status = psa_unlock_key_slot(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02001573
Gilles Peskine449bd832023-01-11 14:50:10 +01001574 return (status == PSA_SUCCESS) ? unlock_status : status;
Moran Pekerdd4ea382018-04-03 15:30:03 +03001575}
1576
Tom Cosgrove6ef9bb32023-03-08 14:19:51 +00001577MBEDTLS_STATIC_ASSERT(
1578 (MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE) == 0,
1579 "One or more key attribute flag is listed as both external-only and dual-use")
1580MBEDTLS_STATIC_ASSERT(
1581 (PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE) == 0,
1582 "One or more key attribute flag is listed as both internal-only and dual-use")
1583MBEDTLS_STATIC_ASSERT(
1584 (PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY) == 0,
1585 "One or more key attribute flag is listed as both internal-only and external-only")
Gilles Peskine91e8c332019-08-02 19:19:39 +02001586
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001587/** Validate that a key policy is internally well-formed.
1588 *
1589 * This function only rejects invalid policies. It does not validate the
1590 * consistency of the policy with respect to other attributes of the key
1591 * such as the key type.
1592 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001593static psa_status_t psa_validate_key_policy(const psa_key_policy_t *policy)
Gilles Peskine4747d192019-04-17 15:05:45 +02001594{
Gilles Peskine449bd832023-01-11 14:50:10 +01001595 if ((policy->usage & ~(PSA_KEY_USAGE_EXPORT |
1596 PSA_KEY_USAGE_COPY |
1597 PSA_KEY_USAGE_ENCRYPT |
1598 PSA_KEY_USAGE_DECRYPT |
1599 PSA_KEY_USAGE_SIGN_MESSAGE |
1600 PSA_KEY_USAGE_VERIFY_MESSAGE |
1601 PSA_KEY_USAGE_SIGN_HASH |
1602 PSA_KEY_USAGE_VERIFY_HASH |
1603 PSA_KEY_USAGE_VERIFY_DERIVATION |
1604 PSA_KEY_USAGE_DERIVE)) != 0) {
1605 return PSA_ERROR_INVALID_ARGUMENT;
1606 }
Gilles Peskine4747d192019-04-17 15:05:45 +02001607
Gilles Peskine449bd832023-01-11 14:50:10 +01001608 return PSA_SUCCESS;
Gilles Peskine4747d192019-04-17 15:05:45 +02001609}
1610
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001611/** Validate the internal consistency of key attributes.
1612 *
1613 * This function only rejects invalid attribute values. If does not
1614 * validate the consistency of the attributes with any key data that may
1615 * be involved in the creation of the key.
1616 *
1617 * Call this function early in the key creation process.
1618 *
1619 * \param[in] attributes Key attributes for the new key.
1620 * \param[out] p_drv On any return, the driver for the key, if any.
1621 * NULL for a transparent key.
1622 *
1623 */
1624static psa_status_t psa_validate_key_attributes(
1625 const psa_key_attributes_t *attributes,
Gilles Peskine449bd832023-01-11 14:50:10 +01001626 psa_se_drv_table_entry_t **p_drv)
Darryl Green0c6575a2018-11-07 16:05:30 +00001627{
Steven Cooreman81fe7c32020-06-08 18:37:19 +02001628 psa_status_t status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine449bd832023-01-11 14:50:10 +01001629 psa_key_lifetime_t lifetime = psa_get_key_lifetime(attributes);
1630 mbedtls_svc_key_id_t key = psa_get_key_id(attributes);
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001631
Gilles Peskine449bd832023-01-11 14:50:10 +01001632 status = psa_validate_key_location(lifetime, p_drv);
1633 if (status != PSA_SUCCESS) {
1634 return status;
Ronald Crond2ed4812020-07-17 16:11:30 +02001635 }
1636
Gilles Peskine449bd832023-01-11 14:50:10 +01001637 status = psa_validate_key_persistence(lifetime);
1638 if (status != PSA_SUCCESS) {
1639 return status;
1640 }
1641
1642 if (PSA_KEY_LIFETIME_IS_VOLATILE(lifetime)) {
1643 if (MBEDTLS_SVC_KEY_ID_GET_KEY_ID(key) != 0) {
1644 return PSA_ERROR_INVALID_ARGUMENT;
1645 }
1646 } else {
1647 if (!psa_is_valid_key_id(psa_get_key_id(attributes), 0)) {
1648 return PSA_ERROR_INVALID_ARGUMENT;
1649 }
1650 }
1651
1652 status = psa_validate_key_policy(&attributes->core.policy);
1653 if (status != PSA_SUCCESS) {
1654 return status;
1655 }
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001656
1657 /* Refuse to create overly large keys.
1658 * Note that this doesn't trigger on import if the attributes don't
1659 * explicitly specify a size (so psa_get_key_bits returns 0), so
1660 * psa_import_key() needs its own checks. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001661 if (psa_get_key_bits(attributes) > PSA_MAX_KEY_BITS) {
1662 return PSA_ERROR_NOT_SUPPORTED;
1663 }
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001664
Gilles Peskine91e8c332019-08-02 19:19:39 +02001665 /* Reject invalid flags. These should not be reachable through the API. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001666 if (attributes->core.flags & ~(MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY |
1667 MBEDTLS_PSA_KA_MASK_DUAL_USE)) {
1668 return PSA_ERROR_INVALID_ARGUMENT;
1669 }
Gilles Peskine91e8c332019-08-02 19:19:39 +02001670
Gilles Peskine449bd832023-01-11 14:50:10 +01001671 return PSA_SUCCESS;
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001672}
1673
Gilles Peskine4747d192019-04-17 15:05:45 +02001674/** Prepare a key slot to receive key material.
1675 *
1676 * This function allocates a key slot and sets its metadata.
1677 *
1678 * If this function fails, call psa_fail_key_creation().
1679 *
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001680 * This function is intended to be used as follows:
1681 * -# Call psa_start_key_creation() to allocate a key slot, prepare
Ronald Croncf56a0a2020-08-04 09:51:30 +02001682 * it with the specified attributes, and in case of a volatile key assign it
1683 * a volatile key identifier.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001684 * -# Populate the slot with the key material.
1685 * -# Call psa_finish_key_creation() to finalize the creation of the slot.
1686 * In case of failure at any step, stop the sequence and call
1687 * psa_fail_key_creation().
1688 *
Ronald Cron5c522922020-11-14 16:35:34 +01001689 * On success, the key slot is locked. It is the responsibility of the caller
1690 * to unlock the key slot when it does not access it anymore.
Ronald Cronf95a2b12020-10-22 15:24:49 +02001691 *
Gilles Peskinedf179142019-07-15 22:02:14 +02001692 * \param method An identification of the calling function.
Gilles Peskine011e4282019-06-26 18:34:38 +02001693 * \param[in] attributes Key attributes for the new key.
Gilles Peskine011e4282019-06-26 18:34:38 +02001694 * \param[out] p_slot On success, a pointer to the prepared slot.
1695 * \param[out] p_drv On any return, the driver for the key, if any.
1696 * NULL for a transparent key.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001697 *
1698 * \retval #PSA_SUCCESS
1699 * The key slot is ready to receive key material.
1700 * \return If this function fails, the key slot is an invalid state.
1701 * You must call psa_fail_key_creation() to wipe and free the slot.
Gilles Peskine4747d192019-04-17 15:05:45 +02001702 */
1703static psa_status_t psa_start_key_creation(
Gilles Peskinedf179142019-07-15 22:02:14 +02001704 psa_key_creation_method_t method,
Gilles Peskine4747d192019-04-17 15:05:45 +02001705 const psa_key_attributes_t *attributes,
Gilles Peskine011e4282019-06-26 18:34:38 +02001706 psa_key_slot_t **p_slot,
Gilles Peskine449bd832023-01-11 14:50:10 +01001707 psa_se_drv_table_entry_t **p_drv)
Gilles Peskine4747d192019-04-17 15:05:45 +02001708{
1709 psa_status_t status;
Ronald Cron2a993152020-07-17 14:13:26 +02001710 psa_key_id_t volatile_key_id;
Gilles Peskine4747d192019-04-17 15:05:45 +02001711 psa_key_slot_t *slot;
1712
Gilles Peskinedf179142019-07-15 22:02:14 +02001713 (void) method;
Gilles Peskine011e4282019-06-26 18:34:38 +02001714 *p_drv = NULL;
1715
Gilles Peskine449bd832023-01-11 14:50:10 +01001716 status = psa_validate_key_attributes(attributes, p_drv);
1717 if (status != PSA_SUCCESS) {
1718 return status;
1719 }
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001720
Gilles Peskine449bd832023-01-11 14:50:10 +01001721 status = psa_get_empty_key_slot(&volatile_key_id, p_slot);
1722 if (status != PSA_SUCCESS) {
1723 return status;
1724 }
Gilles Peskine4747d192019-04-17 15:05:45 +02001725 slot = *p_slot;
1726
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001727 /* We're storing the declared bit-size of the key. It's up to each
1728 * creation mechanism to verify that this information is correct.
1729 * It's automatically correct for mechanisms that use the bit-size as
Gilles Peskineb46bef22019-07-30 21:32:04 +02001730 * an input (generate, device) but not for those where the bit-size
Ronald Cronc4d1b512020-07-31 11:26:37 +02001731 * is optional (import, copy). In case of a volatile key, assign it the
1732 * volatile key identifier associated to the slot returned to contain its
1733 * definition. */
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001734
1735 slot->attr = attributes->core;
Gilles Peskine449bd832023-01-11 14:50:10 +01001736 if (PSA_KEY_LIFETIME_IS_VOLATILE(slot->attr.lifetime)) {
Ronald Cronc4d1b512020-07-31 11:26:37 +02001737#if !defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER)
1738 slot->attr.id = volatile_key_id;
1739#else
1740 slot->attr.id.key_id = volatile_key_id;
1741#endif
1742 }
Gilles Peskinec744d992019-07-30 17:26:54 +02001743
Gilles Peskine91e8c332019-08-02 19:19:39 +02001744 /* Erase external-only flags from the internal copy. To access
Gilles Peskine013f5472019-08-07 15:42:14 +02001745 * external-only flags, query `attributes`. Thanks to the check
1746 * in psa_validate_key_attributes(), this leaves the dual-use
Gilles Peskineedbed562019-08-07 18:19:59 +02001747 * flags and any internal flag that psa_get_empty_key_slot()
Gilles Peskine013f5472019-08-07 15:42:14 +02001748 * may have set. */
1749 slot->attr.flags &= ~MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY;
Gilles Peskine91e8c332019-08-02 19:19:39 +02001750
Gilles Peskinecbaff462019-07-12 23:46:04 +02001751#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined7729582019-08-05 15:55:54 +02001752 /* For a key in a secure element, we need to do three things
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001753 * when creating or registering a persistent key:
Gilles Peskine60450a42019-07-25 11:32:45 +02001754 * create the key file in internal storage, create the
1755 * key inside the secure element, and update the driver's
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001756 * persistent data. This is done by starting a transaction that will
1757 * encompass these three actions.
1758 * For registering a volatile key, we just need to find an appropriate
1759 * slot number inside the SE. Since the key is designated volatile, creating
1760 * a transaction is not required. */
Gilles Peskine60450a42019-07-25 11:32:45 +02001761 /* The first thing to do is to find a slot number for the new key.
1762 * We save the slot number in persistent storage as part of the
1763 * transaction data. It will be needed to recover if the power
1764 * fails during the key creation process, to clean up on the secure
1765 * element side after restarting. Obtaining a slot number from the
1766 * secure element driver updates its persistent state, but we do not yet
1767 * save the driver's persistent state, so that if the power fails,
Gilles Peskinefc762652019-07-22 19:30:34 +02001768 * we can roll back to a state where the key doesn't exist. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001769 if (*p_drv != NULL) {
Ronald Cronea0f8a62020-11-25 17:52:23 +01001770 psa_key_slot_number_t slot_number;
Gilles Peskine449bd832023-01-11 14:50:10 +01001771 status = psa_find_se_slot_for_key(attributes, method, *p_drv,
1772 &slot_number);
1773 if (status != PSA_SUCCESS) {
1774 return status;
1775 }
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001776
Gilles Peskine449bd832023-01-11 14:50:10 +01001777 if (!PSA_KEY_LIFETIME_IS_VOLATILE(attributes->core.lifetime)) {
1778 psa_crypto_prepare_transaction(PSA_CRYPTO_TRANSACTION_CREATE_KEY);
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001779 psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
Ronald Cronea0f8a62020-11-25 17:52:23 +01001780 psa_crypto_transaction.key.slot = slot_number;
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001781 psa_crypto_transaction.key.id = slot->attr.id;
Gilles Peskine449bd832023-01-11 14:50:10 +01001782 status = psa_crypto_save_transaction();
1783 if (status != PSA_SUCCESS) {
1784 (void) psa_crypto_stop_transaction();
1785 return status;
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001786 }
Gilles Peskine66be51c2019-07-25 18:02:52 +02001787 }
Ronald Cronea0f8a62020-11-25 17:52:23 +01001788
1789 status = psa_copy_key_material_into_slot(
Gilles Peskine449bd832023-01-11 14:50:10 +01001790 slot, (uint8_t *) (&slot_number), sizeof(slot_number));
Darryl Green0c6575a2018-11-07 16:05:30 +00001791 }
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001792
Gilles Peskine449bd832023-01-11 14:50:10 +01001793 if (*p_drv == NULL && method == PSA_KEY_CREATION_REGISTER) {
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001794 /* Key registration only makes sense with a secure element. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001795 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001796 }
Gilles Peskinecbaff462019-07-12 23:46:04 +02001797#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1798
Gilles Peskine449bd832023-01-11 14:50:10 +01001799 return PSA_SUCCESS;
Darryl Green0c6575a2018-11-07 16:05:30 +00001800}
Gilles Peskine4747d192019-04-17 15:05:45 +02001801
1802/** Finalize the creation of a key once its key material has been set.
1803 *
1804 * This entails writing the key to persistent storage.
1805 *
1806 * If this function fails, call psa_fail_key_creation().
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001807 * See the documentation of psa_start_key_creation() for the intended use
1808 * of this function.
Gilles Peskine4747d192019-04-17 15:05:45 +02001809 *
Ronald Cron5c522922020-11-14 16:35:34 +01001810 * If the finalization succeeds, the function unlocks the key slot (it was
1811 * locked by psa_start_key_creation()) and the key slot cannot be accessed
1812 * anymore as part of the key creation process.
Ronald Cron50972942020-11-14 11:28:25 +01001813 *
Gilles Peskine011e4282019-06-26 18:34:38 +02001814 * \param[in,out] slot Pointer to the slot with key material.
1815 * \param[in] driver The secure element driver for the key,
1816 * or NULL for a transparent key.
Ronald Cron81709fc2020-11-14 12:10:32 +01001817 * \param[out] key On success, identifier of the key. Note that the
1818 * key identifier is also stored in the key slot.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001819 *
1820 * \retval #PSA_SUCCESS
Ronald Croncf56a0a2020-08-04 09:51:30 +02001821 * The key was successfully created.
Gilles Peskineed733552023-02-14 19:21:09 +01001822 * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription
1823 * \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription
1824 * \retval #PSA_ERROR_ALREADY_EXISTS \emptydescription
1825 * \retval #PSA_ERROR_DATA_INVALID \emptydescription
1826 * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription
1827 * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription
gabor-mezei-arm452b0a32020-11-09 17:42:55 +01001828 *
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001829 * \return If this function fails, the key slot is an invalid state.
1830 * You must call psa_fail_key_creation() to wipe and free the slot.
Gilles Peskine4747d192019-04-17 15:05:45 +02001831 */
Gilles Peskine011e4282019-06-26 18:34:38 +02001832static psa_status_t psa_finish_key_creation(
1833 psa_key_slot_t *slot,
Ronald Cron81709fc2020-11-14 12:10:32 +01001834 psa_se_drv_table_entry_t *driver,
1835 mbedtls_svc_key_id_t *key)
Gilles Peskine4747d192019-04-17 15:05:45 +02001836{
1837 psa_status_t status = PSA_SUCCESS;
Gilles Peskine30afafd2019-04-25 13:47:40 +02001838 (void) slot;
Gilles Peskine011e4282019-06-26 18:34:38 +02001839 (void) driver;
Gilles Peskine4747d192019-04-17 15:05:45 +02001840
1841#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001842 if (!PSA_KEY_LIFETIME_IS_VOLATILE(slot->attr.lifetime)) {
Gilles Peskine1df83d42019-07-23 16:13:14 +02001843#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001844 if (driver != NULL) {
Gilles Peskineb46bef22019-07-30 21:32:04 +02001845 psa_se_key_data_storage_t data;
Ronald Cronea0f8a62020-11-25 17:52:23 +01001846 psa_key_slot_number_t slot_number =
Gilles Peskine449bd832023-01-11 14:50:10 +01001847 psa_key_slot_get_slot_number(slot);
Ronald Cronea0f8a62020-11-25 17:52:23 +01001848
Tom Cosgrove6ef9bb32023-03-08 14:19:51 +00001849 MBEDTLS_STATIC_ASSERT(sizeof(slot_number) ==
1850 sizeof(data.slot_number),
1851 "Slot number size does not match psa_se_key_data_storage_t");
1852
Gilles Peskine449bd832023-01-11 14:50:10 +01001853 memcpy(&data.slot_number, &slot_number, sizeof(slot_number));
1854 status = psa_save_persistent_key(&slot->attr,
1855 (uint8_t *) &data,
1856 sizeof(data));
1857 } else
Gilles Peskine1df83d42019-07-23 16:13:14 +02001858#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1859 {
Steven Cooreman40120f62020-10-29 11:42:22 +01001860 /* Key material is saved in export representation in the slot, so
1861 * just pass the slot buffer for storage. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001862 status = psa_save_persistent_key(&slot->attr,
1863 slot->key.data,
1864 slot->key.bytes);
Gilles Peskine1df83d42019-07-23 16:13:14 +02001865 }
Gilles Peskine4747d192019-04-17 15:05:45 +02001866 }
Darryl Green0c6575a2018-11-07 16:05:30 +00001867#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
1868
Gilles Peskinecbaff462019-07-12 23:46:04 +02001869#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined7729582019-08-05 15:55:54 +02001870 /* Finish the transaction for a key creation. This does not
1871 * happen when registering an existing key. Detect this case
1872 * by checking whether a transaction is in progress (actual
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001873 * creation of a persistent key in a secure element requires a transaction,
1874 * but registration or volatile key creation doesn't use one). */
Gilles Peskine449bd832023-01-11 14:50:10 +01001875 if (driver != NULL &&
1876 psa_crypto_transaction.unknown.type == PSA_CRYPTO_TRANSACTION_CREATE_KEY) {
1877 status = psa_save_se_persistent_data(driver);
1878 if (status != PSA_SUCCESS) {
1879 psa_destroy_persistent_key(slot->attr.id);
1880 return status;
Gilles Peskinecbaff462019-07-12 23:46:04 +02001881 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001882 status = psa_crypto_stop_transaction();
Gilles Peskinecbaff462019-07-12 23:46:04 +02001883 }
1884#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1885
Gilles Peskine449bd832023-01-11 14:50:10 +01001886 if (status == PSA_SUCCESS) {
Ronald Cron81709fc2020-11-14 12:10:32 +01001887 *key = slot->attr.id;
Gilles Peskine449bd832023-01-11 14:50:10 +01001888 status = psa_unlock_key_slot(slot);
1889 if (status != PSA_SUCCESS) {
Ronald Cron81709fc2020-11-14 12:10:32 +01001890 *key = MBEDTLS_SVC_KEY_ID_INIT;
Gilles Peskine449bd832023-01-11 14:50:10 +01001891 }
Ronald Cron81709fc2020-11-14 12:10:32 +01001892 }
Ronald Cron50972942020-11-14 11:28:25 +01001893
Gilles Peskine449bd832023-01-11 14:50:10 +01001894 return status;
Gilles Peskine4747d192019-04-17 15:05:45 +02001895}
1896
1897/** Abort the creation of a key.
1898 *
1899 * You may call this function after calling psa_start_key_creation(),
1900 * or after psa_finish_key_creation() fails. In other circumstances, this
1901 * function may not clean up persistent storage.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001902 * See the documentation of psa_start_key_creation() for the intended use
1903 * of this function.
Gilles Peskine4747d192019-04-17 15:05:45 +02001904 *
Gilles Peskine011e4282019-06-26 18:34:38 +02001905 * \param[in,out] slot Pointer to the slot with key material.
1906 * \param[in] driver The secure element driver for the key,
1907 * or NULL for a transparent key.
Gilles Peskine4747d192019-04-17 15:05:45 +02001908 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001909static void psa_fail_key_creation(psa_key_slot_t *slot,
1910 psa_se_drv_table_entry_t *driver)
Gilles Peskine4747d192019-04-17 15:05:45 +02001911{
Gilles Peskine011e4282019-06-26 18:34:38 +02001912 (void) driver;
1913
Gilles Peskine449bd832023-01-11 14:50:10 +01001914 if (slot == NULL) {
Gilles Peskine4747d192019-04-17 15:05:45 +02001915 return;
Gilles Peskine449bd832023-01-11 14:50:10 +01001916 }
Gilles Peskine011e4282019-06-26 18:34:38 +02001917
1918#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Janos Follath1d57a202019-08-13 12:15:34 +01001919 /* TODO: If the key has already been created in the secure
Gilles Peskine011e4282019-06-26 18:34:38 +02001920 * element, and the failure happened later (when saving metadata
1921 * to internal storage), we need to destroy the key in the secure
Gilles Peskinec9d7f942019-08-13 16:17:16 +02001922 * element.
1923 * https://github.com/ARMmbed/mbed-crypto/issues/217
1924 */
Gilles Peskinefc762652019-07-22 19:30:34 +02001925
Gilles Peskined7729582019-08-05 15:55:54 +02001926 /* Abort the ongoing transaction if any (there may not be one if
1927 * the creation process failed before starting one, or if the
1928 * key creation is a registration of a key in a secure element).
1929 * Earlier functions must already have done what it takes to undo any
1930 * partial creation. All that's left is to update the transaction data
1931 * itself. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001932 (void) psa_crypto_stop_transaction();
Gilles Peskine011e4282019-06-26 18:34:38 +02001933#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1934
Gilles Peskine449bd832023-01-11 14:50:10 +01001935 psa_wipe_key_slot(slot);
Gilles Peskine4747d192019-04-17 15:05:45 +02001936}
1937
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001938/** Validate optional attributes during key creation.
1939 *
1940 * Some key attributes are optional during key creation. If they are
1941 * specified in the attributes structure, check that they are consistent
1942 * with the data in the slot.
1943 *
1944 * This function should be called near the end of key creation, after
1945 * the slot in memory is fully populated but before saving persistent data.
1946 */
1947static psa_status_t psa_validate_optional_attributes(
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001948 const psa_key_slot_t *slot,
Gilles Peskine449bd832023-01-11 14:50:10 +01001949 const psa_key_attributes_t *attributes)
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001950{
Gilles Peskine449bd832023-01-11 14:50:10 +01001951 if (attributes->core.type != 0) {
1952 if (attributes->core.type != slot->attr.type) {
1953 return PSA_ERROR_INVALID_ARGUMENT;
1954 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001955 }
1956
Gilles Peskine449bd832023-01-11 14:50:10 +01001957 if (attributes->domain_parameters_size != 0) {
Valerio Settib2bcedb2023-07-10 11:24:00 +02001958#if (defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT) && \
1959 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT)) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01001960 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
1961 if (PSA_KEY_TYPE_IS_RSA(slot->attr.type)) {
Steven Cooremana2371e52020-07-28 14:30:39 +02001962 mbedtls_rsa_context *rsa = NULL;
Steven Cooreman75b74362020-07-28 14:30:13 +02001963 mbedtls_mpi actual, required;
Steven Cooreman6d839f02020-07-30 11:36:45 +02001964 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Steven Cooremana01795d2020-07-24 22:48:15 +02001965
Ronald Cron90857082020-11-25 14:58:33 +01001966 psa_status_t status = mbedtls_psa_rsa_load_representation(
Gilles Peskine449bd832023-01-11 14:50:10 +01001967 slot->attr.type,
1968 slot->key.data,
1969 slot->key.bytes,
1970 &rsa);
1971 if (status != PSA_SUCCESS) {
1972 return status;
1973 }
Steven Cooreman75b74362020-07-28 14:30:13 +02001974
Gilles Peskine449bd832023-01-11 14:50:10 +01001975 mbedtls_mpi_init(&actual);
1976 mbedtls_mpi_init(&required);
1977 ret = mbedtls_rsa_export(rsa,
1978 NULL, NULL, NULL, NULL, &actual);
1979 mbedtls_rsa_free(rsa);
1980 mbedtls_free(rsa);
1981 if (ret != 0) {
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001982 goto rsa_exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001983 }
1984 ret = mbedtls_mpi_read_binary(&required,
1985 attributes->domain_parameters,
1986 attributes->domain_parameters_size);
1987 if (ret != 0) {
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001988 goto rsa_exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01001989 }
1990 if (mbedtls_mpi_cmp_mpi(&actual, &required) != 0) {
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02001991 ret = MBEDTLS_ERR_RSA_BAD_INPUT_DATA;
Gilles Peskine449bd832023-01-11 14:50:10 +01001992 }
1993rsa_exit:
1994 mbedtls_mpi_free(&actual);
1995 mbedtls_mpi_free(&required);
1996 if (ret != 0) {
1997 return mbedtls_to_psa_error(ret);
1998 }
1999 } else
Valerio Settib2bcedb2023-07-10 11:24:00 +02002000#endif /* (defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT) &&
2001 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT)) ||
John Durkop9814fa22020-11-04 12:28:15 -08002002 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002003 {
Gilles Peskine449bd832023-01-11 14:50:10 +01002004 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002005 }
2006 }
2007
Gilles Peskine449bd832023-01-11 14:50:10 +01002008 if (attributes->core.bits != 0) {
2009 if (attributes->core.bits != slot->attr.bits) {
2010 return PSA_ERROR_INVALID_ARGUMENT;
2011 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002012 }
2013
Gilles Peskine449bd832023-01-11 14:50:10 +01002014 return PSA_SUCCESS;
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002015}
2016
Gilles Peskine449bd832023-01-11 14:50:10 +01002017psa_status_t psa_import_key(const psa_key_attributes_t *attributes,
2018 const uint8_t *data,
2019 size_t data_length,
2020 mbedtls_svc_key_id_t *key)
Gilles Peskine4747d192019-04-17 15:05:45 +02002021{
2022 psa_status_t status;
2023 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02002024 psa_se_drv_table_entry_t *driver = NULL;
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01002025 size_t bits;
Archanad8a83dc2021-06-14 10:04:16 +05302026 size_t storage_size = data_length;
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002027
Ronald Cron81709fc2020-11-14 12:10:32 +01002028 *key = MBEDTLS_SVC_KEY_ID_INIT;
2029
Gilles Peskine0f84d622019-09-12 19:03:13 +02002030 /* Reject zero-length symmetric keys (including raw data key objects).
2031 * This also rejects any key which might be encoded as an empty string,
2032 * which is never valid. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002033 if (data_length == 0) {
2034 return PSA_ERROR_INVALID_ARGUMENT;
2035 }
Gilles Peskine0f84d622019-09-12 19:03:13 +02002036
Archana449608b2021-09-08 15:36:05 +05302037 /* Ensure that the bytes-to-bits conversion cannot overflow. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002038 if (data_length > SIZE_MAX / 8) {
2039 return PSA_ERROR_NOT_SUPPORTED;
2040 }
Archana6ed4bda2021-08-04 10:47:15 +05302041
Gilles Peskine449bd832023-01-11 14:50:10 +01002042 status = psa_start_key_creation(PSA_KEY_CREATION_IMPORT, attributes,
2043 &slot, &driver);
2044 if (status != PSA_SUCCESS) {
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002045 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002046 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002047
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01002048 /* In the case of a transparent key or an opaque key stored in local
Archana449608b2021-09-08 15:36:05 +05302049 * storage ( thus not in the case of importing a key in a secure element
2050 * with storage ( MBEDTLS_PSA_CRYPTO_SE_C ) ),we have to allocate a
2051 * buffer to hold the imported key material. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002052 if (slot->key.data == NULL) {
2053 if (psa_key_lifetime_is_external(attributes->core.lifetime)) {
Archana449608b2021-09-08 15:36:05 +05302054 status = psa_driver_wrapper_get_key_buffer_size_from_key_data(
Gilles Peskine449bd832023-01-11 14:50:10 +01002055 attributes, data, data_length, &storage_size);
2056 if (status != PSA_SUCCESS) {
Archanad8a83dc2021-06-14 10:04:16 +05302057 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002058 }
Archanad8a83dc2021-06-14 10:04:16 +05302059 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002060 status = psa_allocate_buffer_to_slot(slot, storage_size);
2061 if (status != PSA_SUCCESS) {
Gilles Peskineb46bef22019-07-30 21:32:04 +02002062 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002063 }
Gilles Peskine5d309672019-07-12 23:47:28 +02002064 }
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01002065
2066 bits = slot->attr.bits;
Gilles Peskine449bd832023-01-11 14:50:10 +01002067 status = psa_driver_wrapper_import_key(attributes,
2068 data, data_length,
2069 slot->key.data,
2070 slot->key.bytes,
2071 &slot->key.bytes, &bits);
2072 if (status != PSA_SUCCESS) {
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01002073 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002074 }
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01002075
Gilles Peskine449bd832023-01-11 14:50:10 +01002076 if (slot->attr.bits == 0) {
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01002077 slot->attr.bits = (psa_key_bits_t) bits;
Gilles Peskine449bd832023-01-11 14:50:10 +01002078 } else if (bits != slot->attr.bits) {
Steven Cooremanac3434f2021-01-15 17:36:02 +01002079 status = PSA_ERROR_INVALID_ARGUMENT;
2080 goto exit;
Gilles Peskine5d309672019-07-12 23:47:28 +02002081 }
Ronald Cron2ebfdcc2020-11-28 15:54:54 +01002082
Archana6ed4bda2021-08-04 10:47:15 +05302083 /* Enforce a size limit, and in particular ensure that the bit
2084 * size fits in its representation type.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01002085 if (bits > PSA_MAX_KEY_BITS) {
Archana6ed4bda2021-08-04 10:47:15 +05302086 status = PSA_ERROR_NOT_SUPPORTED;
2087 goto exit;
2088 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002089 status = psa_validate_optional_attributes(slot, attributes);
2090 if (status != PSA_SUCCESS) {
Gilles Peskine18017402019-07-24 20:25:59 +02002091 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002092 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002093
Gilles Peskine449bd832023-01-11 14:50:10 +01002094 status = psa_finish_key_creation(slot, driver, key);
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002095exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002096 if (status != PSA_SUCCESS) {
2097 psa_fail_key_creation(slot, driver);
2098 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02002099
Gilles Peskine449bd832023-01-11 14:50:10 +01002100 return status;
Gilles Peskine4747d192019-04-17 15:05:45 +02002101}
2102
Gilles Peskined7729582019-08-05 15:55:54 +02002103#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
2104psa_status_t mbedtls_psa_register_se_key(
Gilles Peskine449bd832023-01-11 14:50:10 +01002105 const psa_key_attributes_t *attributes)
Gilles Peskined7729582019-08-05 15:55:54 +02002106{
2107 psa_status_t status;
2108 psa_key_slot_t *slot = NULL;
2109 psa_se_drv_table_entry_t *driver = NULL;
Ronald Croncf56a0a2020-08-04 09:51:30 +02002110 mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT;
Gilles Peskined7729582019-08-05 15:55:54 +02002111
2112 /* Leaving attributes unspecified is not currently supported.
2113 * It could make sense to query the key type and size from the
2114 * secure element, but not all secure elements support this
2115 * and the driver HAL doesn't currently support it. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002116 if (psa_get_key_type(attributes) == PSA_KEY_TYPE_NONE) {
2117 return PSA_ERROR_NOT_SUPPORTED;
2118 }
2119 if (psa_get_key_bits(attributes) == 0) {
2120 return PSA_ERROR_NOT_SUPPORTED;
2121 }
Gilles Peskined7729582019-08-05 15:55:54 +02002122
Gilles Peskine449bd832023-01-11 14:50:10 +01002123 status = psa_start_key_creation(PSA_KEY_CREATION_REGISTER, attributes,
2124 &slot, &driver);
2125 if (status != PSA_SUCCESS) {
Gilles Peskined7729582019-08-05 15:55:54 +02002126 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002127 }
Gilles Peskined7729582019-08-05 15:55:54 +02002128
Gilles Peskine449bd832023-01-11 14:50:10 +01002129 status = psa_finish_key_creation(slot, driver, &key);
Gilles Peskined7729582019-08-05 15:55:54 +02002130
2131exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002132 if (status != PSA_SUCCESS) {
2133 psa_fail_key_creation(slot, driver);
2134 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02002135
Gilles Peskined7729582019-08-05 15:55:54 +02002136 /* Registration doesn't keep the key in RAM. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002137 psa_close_key(key);
2138 return status;
Gilles Peskined7729582019-08-05 15:55:54 +02002139}
2140#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
2141
Gilles Peskine449bd832023-01-11 14:50:10 +01002142psa_status_t psa_copy_key(mbedtls_svc_key_id_t source_key,
2143 const psa_key_attributes_t *specified_attributes,
2144 mbedtls_svc_key_id_t *target_key)
Gilles Peskinef603c712019-01-19 13:40:11 +01002145{
Ronald Cronf95a2b12020-10-22 15:24:49 +02002146 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01002147 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinef603c712019-01-19 13:40:11 +01002148 psa_key_slot_t *source_slot = NULL;
2149 psa_key_slot_t *target_slot = NULL;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002150 psa_key_attributes_t actual_attributes = *specified_attributes;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02002151 psa_se_drv_table_entry_t *driver = NULL;
Archana8a180362021-07-05 02:18:48 +05302152 size_t storage_size = 0;
Gilles Peskinef603c712019-01-19 13:40:11 +01002153
Ronald Cron81709fc2020-11-14 12:10:32 +01002154 *target_key = MBEDTLS_SVC_KEY_ID_INIT;
2155
Archana8a180362021-07-05 02:18:48 +05302156 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002157 source_key, &source_slot, PSA_KEY_USAGE_COPY, 0);
2158 if (status != PSA_SUCCESS) {
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002159 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002160 }
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002161
Gilles Peskine449bd832023-01-11 14:50:10 +01002162 status = psa_validate_optional_attributes(source_slot,
2163 specified_attributes);
2164 if (status != PSA_SUCCESS) {
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002165 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002166 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002167
Archana9d17bf42021-09-10 06:22:44 +05302168 /* The target key type and number of bits have been validated by
2169 * psa_validate_optional_attributes() to be either equal to zero or
2170 * equal to the ones of the source key. So it is safe to inherit
2171 * them from the source key now."
Archana374fe5b2021-09-08 15:50:28 +05302172 * */
Archana9d17bf42021-09-10 06:22:44 +05302173 actual_attributes.core.bits = source_slot->attr.bits;
2174 actual_attributes.core.type = source_slot->attr.type;
Archana374fe5b2021-09-08 15:50:28 +05302175
2176
Gilles Peskine449bd832023-01-11 14:50:10 +01002177 status = psa_restrict_key_policy(source_slot->attr.type,
2178 &actual_attributes.core.policy,
2179 &source_slot->attr.policy);
2180 if (status != PSA_SUCCESS) {
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002181 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002182 }
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002183
Gilles Peskine449bd832023-01-11 14:50:10 +01002184 status = psa_start_key_creation(PSA_KEY_CREATION_COPY, &actual_attributes,
2185 &target_slot, &driver);
2186 if (status != PSA_SUCCESS) {
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002187 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002188 }
2189 if (PSA_KEY_LIFETIME_GET_LOCATION(target_slot->attr.lifetime) !=
2190 PSA_KEY_LIFETIME_GET_LOCATION(source_slot->attr.lifetime)) {
Archana8a180362021-07-05 02:18:48 +05302191 /*
Archana9d17bf42021-09-10 06:22:44 +05302192 * If the source and target keys are stored in different locations,
Archana8a180362021-07-05 02:18:48 +05302193 * the source key would need to be exported as plaintext and re-imported
2194 * in the other location. This has security implications which have not
Archana449608b2021-09-08 15:36:05 +05302195 * been fully mapped. For now, this can be achieved through
Archana8a180362021-07-05 02:18:48 +05302196 * appropriate API invocations from the application, if needed.
2197 * */
Gilles Peskinef4ee6622019-07-24 13:44:30 +02002198 status = PSA_ERROR_NOT_SUPPORTED;
2199 goto exit;
Gilles Peskinef603c712019-01-19 13:40:11 +01002200 }
Archana8a180362021-07-05 02:18:48 +05302201 /*
2202 * When the source and target keys are within the same location,
Archana449608b2021-09-08 15:36:05 +05302203 * - For transparent keys it is a blind copy without any driver invocation,
Archana8a180362021-07-05 02:18:48 +05302204 * - For opaque keys this translates to an invocation of the drivers'
2205 * copy_key entry point through the dispatch layer.
2206 * */
Gilles Peskine449bd832023-01-11 14:50:10 +01002207 if (psa_key_lifetime_is_external(actual_attributes.core.lifetime)) {
2208 status = psa_driver_wrapper_get_key_buffer_size(&actual_attributes,
2209 &storage_size);
2210 if (status != PSA_SUCCESS) {
Archana8a180362021-07-05 02:18:48 +05302211 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002212 }
Archana374fe5b2021-09-08 15:50:28 +05302213
Gilles Peskine449bd832023-01-11 14:50:10 +01002214 status = psa_allocate_buffer_to_slot(target_slot, storage_size);
2215 if (status != PSA_SUCCESS) {
Archana8a180362021-07-05 02:18:48 +05302216 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002217 }
Archana374fe5b2021-09-08 15:50:28 +05302218
Gilles Peskine449bd832023-01-11 14:50:10 +01002219 status = psa_driver_wrapper_copy_key(&actual_attributes,
2220 source_slot->key.data,
2221 source_slot->key.bytes,
2222 target_slot->key.data,
2223 target_slot->key.bytes,
2224 &target_slot->key.bytes);
2225 if (status != PSA_SUCCESS) {
Archana8a180362021-07-05 02:18:48 +05302226 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002227 }
2228 } else {
2229 status = psa_copy_key_material_into_slot(target_slot,
Archana9d17bf42021-09-10 06:22:44 +05302230 source_slot->key.data,
Gilles Peskine449bd832023-01-11 14:50:10 +01002231 source_slot->key.bytes);
2232 if (status != PSA_SUCCESS) {
Archana8a180362021-07-05 02:18:48 +05302233 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002234 }
Archana8a180362021-07-05 02:18:48 +05302235 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002236 status = psa_finish_key_creation(target_slot, driver, target_key);
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002237exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002238 if (status != PSA_SUCCESS) {
2239 psa_fail_key_creation(target_slot, driver);
2240 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02002241
Gilles Peskine449bd832023-01-11 14:50:10 +01002242 unlock_status = psa_unlock_key_slot(source_slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02002243
Gilles Peskine449bd832023-01-11 14:50:10 +01002244 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskinef603c712019-01-19 13:40:11 +01002245}
2246
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02002247
2248
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01002249/****************************************************************/
Gilles Peskine20035e32018-02-03 22:44:14 +01002250/* Message digests */
2251/****************************************************************/
2252
Gilles Peskine449bd832023-01-11 14:50:10 +01002253psa_status_t psa_hash_abort(psa_hash_operation_t *operation)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002254{
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002255 /* Aborting a non-active operation is allowed */
Gilles Peskine449bd832023-01-11 14:50:10 +01002256 if (operation->id == 0) {
2257 return PSA_SUCCESS;
2258 }
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002259
Gilles Peskine449bd832023-01-11 14:50:10 +01002260 psa_status_t status = psa_driver_wrapper_hash_abort(operation);
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002261 operation->id = 0;
2262
Gilles Peskine449bd832023-01-11 14:50:10 +01002263 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002264}
2265
Gilles Peskine449bd832023-01-11 14:50:10 +01002266psa_status_t psa_hash_setup(psa_hash_operation_t *operation,
2267 psa_algorithm_t alg)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002268{
Dave Rodgman685b6a72021-06-24 11:49:14 +01002269 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002270
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002271 /* A context must be freshly initialized before it can be set up. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002272 if (operation->id != 0) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002273 status = PSA_ERROR_BAD_STATE;
2274 goto exit;
2275 }
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002276
Gilles Peskine449bd832023-01-11 14:50:10 +01002277 if (!PSA_ALG_IS_HASH(alg)) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002278 status = PSA_ERROR_INVALID_ARGUMENT;
2279 goto exit;
2280 }
Jaeden Amero36ee5d02019-02-19 09:25:10 +00002281
Steven Cooremanb6bf4bb2021-03-15 19:00:14 +01002282 /* Ensure all of the context is zeroized, since PSA_HASH_OPERATION_INIT only
2283 * directly zeroes the int-sized dummy member of the context union. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002284 memset(&operation->ctx, 0, sizeof(operation->ctx));
Steven Cooreman893232f2021-03-15 12:23:37 +01002285
Gilles Peskine449bd832023-01-11 14:50:10 +01002286 status = psa_driver_wrapper_hash_setup(operation, alg);
Dave Rodgman685b6a72021-06-24 11:49:14 +01002287
2288exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002289 if (status != PSA_SUCCESS) {
2290 psa_hash_abort(operation);
2291 }
Dave Rodgman685b6a72021-06-24 11:49:14 +01002292
2293 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002294}
2295
Gilles Peskine449bd832023-01-11 14:50:10 +01002296psa_status_t psa_hash_update(psa_hash_operation_t *operation,
2297 const uint8_t *input,
2298 size_t input_length)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002299{
Dave Rodgman685b6a72021-06-24 11:49:14 +01002300 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2301
Gilles Peskine449bd832023-01-11 14:50:10 +01002302 if (operation->id == 0) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002303 status = PSA_ERROR_BAD_STATE;
2304 goto exit;
2305 }
Gilles Peskine94e44542018-07-12 16:58:43 +02002306
Steven Cooremanc8288352021-03-04 14:02:19 +01002307 /* Don't require hash implementations to behave correctly on a
2308 * zero-length input, which may have an invalid pointer. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002309 if (input_length == 0) {
2310 return PSA_SUCCESS;
2311 }
Steven Cooremanc8288352021-03-04 14:02:19 +01002312
Gilles Peskine449bd832023-01-11 14:50:10 +01002313 status = psa_driver_wrapper_hash_update(operation, input, input_length);
Dave Rodgman685b6a72021-06-24 11:49:14 +01002314
2315exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002316 if (status != PSA_SUCCESS) {
2317 psa_hash_abort(operation);
2318 }
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002319
Gilles Peskine449bd832023-01-11 14:50:10 +01002320 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002321}
2322
Gilles Peskine449bd832023-01-11 14:50:10 +01002323psa_status_t psa_hash_finish(psa_hash_operation_t *operation,
2324 uint8_t *hash,
2325 size_t hash_size,
2326 size_t *hash_length)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002327{
Steven Cooremanfbe09282021-03-08 18:41:12 +01002328 *hash_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01002329 if (operation->id == 0) {
2330 return PSA_ERROR_BAD_STATE;
2331 }
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002332
Steven Cooreman1e582352021-02-18 17:24:37 +01002333 psa_status_t status = psa_driver_wrapper_hash_finish(
Gilles Peskine449bd832023-01-11 14:50:10 +01002334 operation, hash, hash_size, hash_length);
2335 psa_hash_abort(operation);
2336 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002337}
2338
Gilles Peskine449bd832023-01-11 14:50:10 +01002339psa_status_t psa_hash_verify(psa_hash_operation_t *operation,
2340 const uint8_t *hash,
2341 size_t hash_length)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002342{
Ronald Cron69a63422021-10-18 09:47:58 +02002343 uint8_t actual_hash[PSA_HASH_MAX_SIZE];
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002344 size_t actual_hash_length;
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002345 psa_status_t status = psa_hash_finish(
Gilles Peskine449bd832023-01-11 14:50:10 +01002346 operation,
2347 actual_hash, sizeof(actual_hash),
2348 &actual_hash_length);
Dave Rodgman685b6a72021-06-24 11:49:14 +01002349
Gilles Peskine449bd832023-01-11 14:50:10 +01002350 if (status != PSA_SUCCESS) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002351 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002352 }
Dave Rodgman685b6a72021-06-24 11:49:14 +01002353
Gilles Peskine449bd832023-01-11 14:50:10 +01002354 if (actual_hash_length != hash_length) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002355 status = PSA_ERROR_INVALID_SIGNATURE;
2356 goto exit;
2357 }
2358
Gilles Peskine449bd832023-01-11 14:50:10 +01002359 if (mbedtls_psa_safer_memcmp(hash, actual_hash, actual_hash_length) != 0) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002360 status = PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskine449bd832023-01-11 14:50:10 +01002361 }
Dave Rodgman685b6a72021-06-24 11:49:14 +01002362
2363exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002364 mbedtls_platform_zeroize(actual_hash, sizeof(actual_hash));
2365 if (status != PSA_SUCCESS) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002366 psa_hash_abort(operation);
Gilles Peskine449bd832023-01-11 14:50:10 +01002367 }
Dave Rodgman685b6a72021-06-24 11:49:14 +01002368
Gilles Peskine449bd832023-01-11 14:50:10 +01002369 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002370}
2371
Gilles Peskine449bd832023-01-11 14:50:10 +01002372psa_status_t psa_hash_compute(psa_algorithm_t alg,
2373 const uint8_t *input, size_t input_length,
2374 uint8_t *hash, size_t hash_size,
2375 size_t *hash_length)
Gilles Peskine0a749c82019-11-28 19:33:58 +01002376{
Steven Cooremanfbe09282021-03-08 18:41:12 +01002377 *hash_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01002378 if (!PSA_ALG_IS_HASH(alg)) {
2379 return PSA_ERROR_INVALID_ARGUMENT;
2380 }
Steven Cooremanf66d5fd2021-03-08 18:40:40 +01002381
Gilles Peskine449bd832023-01-11 14:50:10 +01002382 return psa_driver_wrapper_hash_compute(alg, input, input_length,
2383 hash, hash_size, hash_length);
Gilles Peskine0a749c82019-11-28 19:33:58 +01002384}
2385
Gilles Peskine449bd832023-01-11 14:50:10 +01002386psa_status_t psa_hash_compare(psa_algorithm_t alg,
2387 const uint8_t *input, size_t input_length,
2388 const uint8_t *hash, size_t hash_length)
Gilles Peskine0a749c82019-11-28 19:33:58 +01002389{
Ronald Cron69a63422021-10-18 09:47:58 +02002390 uint8_t actual_hash[PSA_HASH_MAX_SIZE];
Steven Cooreman84d670d2021-02-18 16:22:53 +01002391 size_t actual_hash_length;
Steven Cooremanf66d5fd2021-03-08 18:40:40 +01002392
Gilles Peskine449bd832023-01-11 14:50:10 +01002393 if (!PSA_ALG_IS_HASH(alg)) {
2394 return PSA_ERROR_INVALID_ARGUMENT;
2395 }
Steven Cooremanf66d5fd2021-03-08 18:40:40 +01002396
Steven Cooreman1e582352021-02-18 17:24:37 +01002397 psa_status_t status = psa_driver_wrapper_hash_compute(
Gilles Peskine449bd832023-01-11 14:50:10 +01002398 alg, input, input_length,
2399 actual_hash, sizeof(actual_hash),
2400 &actual_hash_length);
2401 if (status != PSA_SUCCESS) {
Gilles Peskine60aebec2021-12-13 12:33:18 +01002402 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002403 }
2404 if (actual_hash_length != hash_length) {
Gilles Peskine60aebec2021-12-13 12:33:18 +01002405 status = PSA_ERROR_INVALID_SIGNATURE;
2406 goto exit;
2407 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002408 if (mbedtls_psa_safer_memcmp(hash, actual_hash, actual_hash_length) != 0) {
Gilles Peskine60aebec2021-12-13 12:33:18 +01002409 status = PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskine449bd832023-01-11 14:50:10 +01002410 }
Gilles Peskine60aebec2021-12-13 12:33:18 +01002411
2412exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002413 mbedtls_platform_zeroize(actual_hash, sizeof(actual_hash));
2414 return status;
Gilles Peskine0a749c82019-11-28 19:33:58 +01002415}
2416
Gilles Peskine449bd832023-01-11 14:50:10 +01002417psa_status_t psa_hash_clone(const psa_hash_operation_t *source_operation,
2418 psa_hash_operation_t *target_operation)
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002419{
Gilles Peskine449bd832023-01-11 14:50:10 +01002420 if (source_operation->id == 0 ||
2421 target_operation->id != 0) {
2422 return PSA_ERROR_BAD_STATE;
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002423 }
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002424
Gilles Peskine449bd832023-01-11 14:50:10 +01002425 psa_status_t status = psa_driver_wrapper_hash_clone(source_operation,
2426 target_operation);
2427 if (status != PSA_SUCCESS) {
2428 psa_hash_abort(target_operation);
2429 }
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002430
Gilles Peskine449bd832023-01-11 14:50:10 +01002431 return status;
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002432}
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002433
2434
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002435/****************************************************************/
Gilles Peskine8c9def32018-02-08 10:02:12 +01002436/* MAC */
2437/****************************************************************/
2438
Gilles Peskine449bd832023-01-11 14:50:10 +01002439psa_status_t psa_mac_abort(psa_mac_operation_t *operation)
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002440{
Steven Cooremane6804192021-03-19 18:28:56 +01002441 /* Aborting a non-active operation is allowed */
Gilles Peskine449bd832023-01-11 14:50:10 +01002442 if (operation->id == 0) {
2443 return PSA_SUCCESS;
2444 }
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002445
Gilles Peskine449bd832023-01-11 14:50:10 +01002446 psa_status_t status = psa_driver_wrapper_mac_abort(operation);
Steven Cooreman72f736a2021-05-07 14:14:37 +02002447 operation->mac_size = 0;
2448 operation->is_sign = 0;
Steven Cooremane6804192021-03-19 18:28:56 +01002449 operation->id = 0;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002450
Gilles Peskine449bd832023-01-11 14:50:10 +01002451 return status;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002452}
2453
Ronald Cron2dff3b22021-06-17 16:33:22 +02002454static psa_status_t psa_mac_finalize_alg_and_key_validation(
2455 psa_algorithm_t alg,
Ronald Cron79bdd822021-06-17 16:46:44 +02002456 const psa_key_attributes_t *attributes,
Gilles Peskine449bd832023-01-11 14:50:10 +01002457 uint8_t *mac_size)
Gilles Peskine8c9def32018-02-08 10:02:12 +01002458{
Ronald Cronf95a2b12020-10-22 15:24:49 +02002459 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine449bd832023-01-11 14:50:10 +01002460 psa_key_type_t key_type = psa_get_key_type(attributes);
2461 size_t key_bits = psa_get_key_bits(attributes);
Steven Cooreman77e2cc52021-03-19 17:05:52 +01002462
Gilles Peskine449bd832023-01-11 14:50:10 +01002463 if (!PSA_ALG_IS_MAC(alg)) {
2464 return PSA_ERROR_INVALID_ARGUMENT;
2465 }
Steven Cooremane6804192021-03-19 18:28:56 +01002466
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +01002467 /* Validate the combination of key type and algorithm */
Gilles Peskine449bd832023-01-11 14:50:10 +01002468 status = psa_mac_key_can_do(alg, key_type);
2469 if (status != PSA_SUCCESS) {
2470 return status;
2471 }
Steven Cooreman15472f82021-03-02 16:16:22 +01002472
Steven Cooremand1a68f12021-05-10 11:13:41 +02002473 /* Get the output length for the algorithm and key combination */
Gilles Peskine449bd832023-01-11 14:50:10 +01002474 *mac_size = PSA_MAC_LENGTH(key_type, key_bits, alg);
Steven Cooreman15472f82021-03-02 16:16:22 +01002475
Gilles Peskine449bd832023-01-11 14:50:10 +01002476 if (*mac_size < 4) {
Steven Cooreman15472f82021-03-02 16:16:22 +01002477 /* A very short MAC is too short for security since it can be
2478 * brute-forced. Ancient protocols with 32-bit MACs do exist,
2479 * so we make this our minimum, even though 32 bits is still
2480 * too small for security. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002481 return PSA_ERROR_NOT_SUPPORTED;
Steven Cooreman15472f82021-03-02 16:16:22 +01002482 }
Gilles Peskineab1d7ab2018-07-06 16:07:47 +02002483
Gilles Peskine449bd832023-01-11 14:50:10 +01002484 if (*mac_size > PSA_MAC_LENGTH(key_type, key_bits,
2485 PSA_ALG_FULL_LENGTH_MAC(alg))) {
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +01002486 /* It's impossible to "truncate" to a larger length than the full length
2487 * of the algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002488 return PSA_ERROR_INVALID_ARGUMENT;
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +01002489 }
2490
Gilles Peskine449bd832023-01-11 14:50:10 +01002491 if (*mac_size > PSA_MAC_MAX_SIZE) {
Gilles Peskinea9b6c802022-03-16 13:54:49 +01002492 /* PSA_MAC_LENGTH returns the correct length even for a MAC algorithm
2493 * that is disabled in the compile-time configuration. The result can
2494 * therefore be larger than PSA_MAC_MAX_SIZE, which does take the
2495 * configuration into account. In this case, force a return of
2496 * PSA_ERROR_NOT_SUPPORTED here. Otherwise psa_mac_verify(), or
2497 * psa_mac_compute(mac_size=PSA_MAC_MAX_SIZE), would return
2498 * PSA_ERROR_BUFFER_TOO_SMALL for an unsupported algorithm whose MAC size
2499 * is larger than PSA_MAC_MAX_SIZE, which is misleading and which breaks
2500 * systematically generated tests. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002501 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea9b6c802022-03-16 13:54:49 +01002502 }
2503
Gilles Peskine449bd832023-01-11 14:50:10 +01002504 return PSA_SUCCESS;
Ronald Cron2dff3b22021-06-17 16:33:22 +02002505}
2506
Gilles Peskine449bd832023-01-11 14:50:10 +01002507static psa_status_t psa_mac_setup(psa_mac_operation_t *operation,
2508 mbedtls_svc_key_id_t key,
2509 psa_algorithm_t alg,
2510 int is_sign)
Gilles Peskinee59236f2018-01-27 23:32:46 +01002511{
2512 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2513 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Dave Rodgman54648242021-06-24 11:49:45 +01002514 psa_key_slot_t *slot = NULL;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01002515 psa_key_attributes_t attributes;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002516
2517 /* A context must be freshly initialized before it can be set up. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002518 if (operation->id != 0) {
Dave Rodgman54648242021-06-24 11:49:45 +01002519 status = PSA_ERROR_BAD_STATE;
2520 goto exit;
2521 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002522
2523 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002524 key,
2525 &slot,
2526 is_sign ? PSA_KEY_USAGE_SIGN_MESSAGE : PSA_KEY_USAGE_VERIFY_MESSAGE,
2527 alg);
2528 if (status != PSA_SUCCESS) {
Dave Rodgman54648242021-06-24 11:49:45 +01002529 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002530 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002531
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01002532 attributes = (psa_key_attributes_t) {
Gilles Peskine8c9def32018-02-08 10:02:12 +01002533 .core = slot->attr
2534 };
2535
Gilles Peskine449bd832023-01-11 14:50:10 +01002536 status = psa_mac_finalize_alg_and_key_validation(alg, &attributes,
2537 &operation->mac_size);
2538 if (status != PSA_SUCCESS) {
Gilles Peskine8c9def32018-02-08 10:02:12 +01002539 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002540 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002541
2542 operation->is_sign = is_sign;
Steven Cooremane6804192021-03-19 18:28:56 +01002543 /* Dispatch the MAC setup call with validated input */
Gilles Peskine449bd832023-01-11 14:50:10 +01002544 if (is_sign) {
2545 status = psa_driver_wrapper_mac_sign_setup(operation,
2546 &attributes,
2547 slot->key.data,
2548 slot->key.bytes,
2549 alg);
2550 } else {
2551 status = psa_driver_wrapper_mac_verify_setup(operation,
2552 &attributes,
2553 slot->key.data,
2554 slot->key.bytes,
2555 alg);
Gilles Peskine8c9def32018-02-08 10:02:12 +01002556 }
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002557
Gilles Peskinefbfac682018-07-08 20:51:54 +02002558exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002559 if (status != PSA_SUCCESS) {
2560 psa_mac_abort(operation);
2561 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02002562
Gilles Peskine449bd832023-01-11 14:50:10 +01002563 unlock_status = psa_unlock_key_slot(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02002564
Gilles Peskine449bd832023-01-11 14:50:10 +01002565 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002566}
2567
Gilles Peskine449bd832023-01-11 14:50:10 +01002568psa_status_t psa_mac_sign_setup(psa_mac_operation_t *operation,
2569 mbedtls_svc_key_id_t key,
2570 psa_algorithm_t alg)
Gilles Peskine89167cb2018-07-08 20:12:23 +02002571{
Gilles Peskine449bd832023-01-11 14:50:10 +01002572 return psa_mac_setup(operation, key, alg, 1);
Gilles Peskine89167cb2018-07-08 20:12:23 +02002573}
2574
Gilles Peskine449bd832023-01-11 14:50:10 +01002575psa_status_t psa_mac_verify_setup(psa_mac_operation_t *operation,
2576 mbedtls_svc_key_id_t key,
2577 psa_algorithm_t alg)
Gilles Peskine89167cb2018-07-08 20:12:23 +02002578{
Gilles Peskine449bd832023-01-11 14:50:10 +01002579 return psa_mac_setup(operation, key, alg, 0);
Gilles Peskine89167cb2018-07-08 20:12:23 +02002580}
2581
Gilles Peskine449bd832023-01-11 14:50:10 +01002582psa_status_t psa_mac_update(psa_mac_operation_t *operation,
2583 const uint8_t *input,
2584 size_t input_length)
Gilles Peskine8c9def32018-02-08 10:02:12 +01002585{
Gilles Peskine449bd832023-01-11 14:50:10 +01002586 if (operation->id == 0) {
2587 return PSA_ERROR_BAD_STATE;
2588 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002589
Steven Cooreman6e7f2912021-03-19 18:38:46 +01002590 /* Don't require hash implementations to behave correctly on a
2591 * zero-length input, which may have an invalid pointer. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002592 if (input_length == 0) {
2593 return PSA_SUCCESS;
2594 }
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03002595
Gilles Peskine449bd832023-01-11 14:50:10 +01002596 psa_status_t status = psa_driver_wrapper_mac_update(operation,
2597 input, input_length);
2598 if (status != PSA_SUCCESS) {
2599 psa_mac_abort(operation);
2600 }
Steven Cooreman6e7f2912021-03-19 18:38:46 +01002601
Gilles Peskine449bd832023-01-11 14:50:10 +01002602 return status;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002603}
2604
Gilles Peskine449bd832023-01-11 14:50:10 +01002605psa_status_t psa_mac_sign_finish(psa_mac_operation_t *operation,
2606 uint8_t *mac,
2607 size_t mac_size,
2608 size_t *mac_length)
mohammad16036df908f2018-04-02 08:34:15 -07002609{
Steven Cooremana5b860a2021-03-19 19:04:39 +01002610 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2611 psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED;
Steven Cooreman77e2cc52021-03-19 17:05:52 +01002612
Gilles Peskine449bd832023-01-11 14:50:10 +01002613 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002614 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002615 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002616 }
Jaeden Amero252ef282019-02-15 14:05:35 +00002617
Gilles Peskine449bd832023-01-11 14:50:10 +01002618 if (!operation->is_sign) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002619 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002620 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002621 }
Steven Cooreman72f736a2021-05-07 14:14:37 +02002622
Steven Cooreman8af5c5c2021-05-11 11:09:13 +02002623 /* Sanity check. This will guarantee that mac_size != 0 (and so mac != NULL)
2624 * once all the error checks are done. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002625 if (operation->mac_size == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002626 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002627 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002628 }
Steven Cooreman8af5c5c2021-05-11 11:09:13 +02002629
Gilles Peskine449bd832023-01-11 14:50:10 +01002630 if (mac_size < operation->mac_size) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002631 status = PSA_ERROR_BUFFER_TOO_SMALL;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002632 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002633 }
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002634
Gilles Peskine449bd832023-01-11 14:50:10 +01002635 status = psa_driver_wrapper_mac_sign_finish(operation,
2636 mac, operation->mac_size,
2637 mac_length);
Steven Cooreman72f736a2021-05-07 14:14:37 +02002638
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002639exit:
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002640 /* In case of success, set the potential excess room in the output buffer
2641 * to an invalid value, to avoid potentially leaking a longer MAC.
2642 * In case of error, set the output length and content to a safe default,
2643 * such that in case the caller misses an error check, the output would be
2644 * an unachievable MAC.
2645 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002646 if (status != PSA_SUCCESS) {
Steven Cooreman72f736a2021-05-07 14:14:37 +02002647 *mac_length = mac_size;
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002648 operation->mac_size = 0;
Steven Cooreman72f736a2021-05-07 14:14:37 +02002649 }
mohammad16036df908f2018-04-02 08:34:15 -07002650
Paul Elliottdc42ca82023-02-24 18:11:59 +00002651 psa_wipe_tag_output_buffer(mac, status, mac_size, *mac_length);
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002652
Gilles Peskine449bd832023-01-11 14:50:10 +01002653 abort_status = psa_mac_abort(operation);
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002654
Gilles Peskine449bd832023-01-11 14:50:10 +01002655 return status == PSA_SUCCESS ? abort_status : status;
mohammad16036df908f2018-04-02 08:34:15 -07002656}
2657
Gilles Peskine449bd832023-01-11 14:50:10 +01002658psa_status_t psa_mac_verify_finish(psa_mac_operation_t *operation,
2659 const uint8_t *mac,
2660 size_t mac_length)
Gilles Peskine8c9def32018-02-08 10:02:12 +01002661{
Steven Cooremana5b860a2021-03-19 19:04:39 +01002662 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2663 psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED;
Steven Cooreman77e2cc52021-03-19 17:05:52 +01002664
Gilles Peskine449bd832023-01-11 14:50:10 +01002665 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002666 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002667 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002668 }
Jaeden Amero252ef282019-02-15 14:05:35 +00002669
Gilles Peskine449bd832023-01-11 14:50:10 +01002670 if (operation->is_sign) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002671 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002672 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002673 }
Steven Cooreman72f736a2021-05-07 14:14:37 +02002674
Gilles Peskine449bd832023-01-11 14:50:10 +01002675 if (operation->mac_size != mac_length) {
Steven Cooreman72f736a2021-05-07 14:14:37 +02002676 status = PSA_ERROR_INVALID_SIGNATURE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002677 goto exit;
Steven Cooreman72f736a2021-05-07 14:14:37 +02002678 }
2679
Gilles Peskine449bd832023-01-11 14:50:10 +01002680 status = psa_driver_wrapper_mac_verify_finish(operation,
2681 mac, mac_length);
Steven Cooreman72f736a2021-05-07 14:14:37 +02002682
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002683exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002684 abort_status = psa_mac_abort(operation);
mohammad16036df908f2018-04-02 08:34:15 -07002685
Gilles Peskine449bd832023-01-11 14:50:10 +01002686 return status == PSA_SUCCESS ? abort_status : status;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002687}
2688
Gilles Peskine449bd832023-01-11 14:50:10 +01002689static psa_status_t psa_mac_compute_internal(mbedtls_svc_key_id_t key,
2690 psa_algorithm_t alg,
2691 const uint8_t *input,
2692 size_t input_length,
2693 uint8_t *mac,
2694 size_t mac_size,
2695 size_t *mac_length,
2696 int is_sign)
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002697{
2698 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron51131b52021-06-17 17:17:20 +02002699 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
2700 psa_key_slot_t *slot;
2701 uint8_t operation_mac_size = 0;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01002702 psa_key_attributes_t attributes;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002703
Ronald Cron51131b52021-06-17 17:17:20 +02002704 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002705 key,
2706 &slot,
2707 is_sign ? PSA_KEY_USAGE_SIGN_MESSAGE : PSA_KEY_USAGE_VERIFY_MESSAGE,
2708 alg);
2709 if (status != PSA_SUCCESS) {
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002710 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002711 }
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002712
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01002713 attributes = (psa_key_attributes_t) {
Ronald Cron51131b52021-06-17 17:17:20 +02002714 .core = slot->attr
2715 };
2716
Gilles Peskine449bd832023-01-11 14:50:10 +01002717 status = psa_mac_finalize_alg_and_key_validation(alg, &attributes,
2718 &operation_mac_size);
2719 if (status != PSA_SUCCESS) {
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002720 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002721 }
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002722
Gilles Peskine449bd832023-01-11 14:50:10 +01002723 if (mac_size < operation_mac_size) {
Ronald Cron51131b52021-06-17 17:17:20 +02002724 status = PSA_ERROR_BUFFER_TOO_SMALL;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002725 goto exit;
Ronald Cron51131b52021-06-17 17:17:20 +02002726 }
2727
2728 status = psa_driver_wrapper_mac_compute(
Gilles Peskine449bd832023-01-11 14:50:10 +01002729 &attributes,
2730 slot->key.data, slot->key.bytes,
2731 alg,
2732 input, input_length,
2733 mac, operation_mac_size, mac_length);
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002734
2735exit:
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002736 /* In case of success, set the potential excess room in the output buffer
2737 * to an invalid value, to avoid potentially leaking a longer MAC.
2738 * In case of error, set the output length and content to a safe default,
2739 * such that in case the caller misses an error check, the output would be
2740 * an unachievable MAC.
2741 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002742 if (status != PSA_SUCCESS) {
Ronald Cron51131b52021-06-17 17:17:20 +02002743 *mac_length = mac_size;
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002744 operation_mac_size = 0;
Ronald Cron51131b52021-06-17 17:17:20 +02002745 }
Paul Elliottdc42ca82023-02-24 18:11:59 +00002746
2747 psa_wipe_tag_output_buffer(mac, status, mac_size, *mac_length);
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002748
Gilles Peskine449bd832023-01-11 14:50:10 +01002749 unlock_status = psa_unlock_key_slot(slot);
Ronald Cron51131b52021-06-17 17:17:20 +02002750
Gilles Peskine449bd832023-01-11 14:50:10 +01002751 return (status == PSA_SUCCESS) ? unlock_status : status;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002752}
2753
Gilles Peskine449bd832023-01-11 14:50:10 +01002754psa_status_t psa_mac_compute(mbedtls_svc_key_id_t key,
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002755 psa_algorithm_t alg,
2756 const uint8_t *input,
2757 size_t input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002758 uint8_t *mac,
2759 size_t mac_size,
2760 size_t *mac_length)
2761{
2762 return psa_mac_compute_internal(key, alg,
2763 input, input_length,
2764 mac, mac_size, mac_length, 1);
2765}
2766
2767psa_status_t psa_mac_verify(mbedtls_svc_key_id_t key,
2768 psa_algorithm_t alg,
2769 const uint8_t *input,
2770 size_t input_length,
2771 const uint8_t *mac,
2772 size_t mac_length)
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002773{
2774 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Crona587cbc2021-06-18 14:51:29 +02002775 uint8_t actual_mac[PSA_MAC_MAX_SIZE];
2776 size_t actual_mac_length;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002777
Gilles Peskine449bd832023-01-11 14:50:10 +01002778 status = psa_mac_compute_internal(key, alg,
2779 input, input_length,
2780 actual_mac, sizeof(actual_mac),
2781 &actual_mac_length, 0);
2782 if (status != PSA_SUCCESS) {
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002783 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002784 }
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002785
Gilles Peskine449bd832023-01-11 14:50:10 +01002786 if (mac_length != actual_mac_length) {
Ronald Crona587cbc2021-06-18 14:51:29 +02002787 status = PSA_ERROR_INVALID_SIGNATURE;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002788 goto exit;
Ronald Crona587cbc2021-06-18 14:51:29 +02002789 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002790 if (mbedtls_psa_safer_memcmp(mac, actual_mac, actual_mac_length) != 0) {
Ronald Crona587cbc2021-06-18 14:51:29 +02002791 status = PSA_ERROR_INVALID_SIGNATURE;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002792 goto exit;
Ronald Crona587cbc2021-06-18 14:51:29 +02002793 }
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002794
2795exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002796 mbedtls_platform_zeroize(actual_mac, sizeof(actual_mac));
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002797
Gilles Peskine449bd832023-01-11 14:50:10 +01002798 return status;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002799}
Gilles Peskinee59236f2018-01-27 23:32:46 +01002800
Gilles Peskinee59236f2018-01-27 23:32:46 +01002801/****************************************************************/
2802/* Asymmetric cryptography */
2803/****************************************************************/
2804
Gilles Peskine449bd832023-01-11 14:50:10 +01002805static psa_status_t psa_sign_verify_check_alg(int input_is_message,
2806 psa_algorithm_t alg)
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002807{
Gilles Peskine449bd832023-01-11 14:50:10 +01002808 if (input_is_message) {
2809 if (!PSA_ALG_IS_SIGN_MESSAGE(alg)) {
2810 return PSA_ERROR_INVALID_ARGUMENT;
2811 }
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002812
Gilles Peskine449bd832023-01-11 14:50:10 +01002813 if (PSA_ALG_IS_SIGN_HASH(alg)) {
2814 if (!PSA_ALG_IS_HASH(PSA_ALG_SIGN_GET_HASH(alg))) {
2815 return PSA_ERROR_INVALID_ARGUMENT;
2816 }
2817 }
2818 } else {
2819 if (!PSA_ALG_IS_SIGN_HASH(alg)) {
2820 return PSA_ERROR_INVALID_ARGUMENT;
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002821 }
2822 }
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002823
Gilles Peskine449bd832023-01-11 14:50:10 +01002824 return PSA_SUCCESS;
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002825}
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002826
Gilles Peskine449bd832023-01-11 14:50:10 +01002827static psa_status_t psa_sign_internal(mbedtls_svc_key_id_t key,
2828 int input_is_message,
2829 psa_algorithm_t alg,
2830 const uint8_t *input,
2831 size_t input_length,
2832 uint8_t *signature,
2833 size_t signature_size,
2834 size_t *signature_length)
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002835{
2836 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2837 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
2838 psa_key_slot_t *slot;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01002839 psa_key_attributes_t attributes;
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002840
2841 *signature_length = 0;
2842
Gilles Peskine449bd832023-01-11 14:50:10 +01002843 status = psa_sign_verify_check_alg(input_is_message, alg);
2844 if (status != PSA_SUCCESS) {
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002845 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01002846 }
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002847
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002848 /* Immediately reject a zero-length signature buffer. This guarantees
gabor-mezei-arm12b4f342021-05-05 13:54:55 +02002849 * that signature must be a valid pointer. (On the other hand, the input
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002850 * buffer can in principle be empty since it doesn't actually have
2851 * to be a hash.) */
Gilles Peskine449bd832023-01-11 14:50:10 +01002852 if (signature_size == 0) {
2853 return PSA_ERROR_BUFFER_TOO_SMALL;
2854 }
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002855
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002856 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002857 key, &slot,
2858 input_is_message ? PSA_KEY_USAGE_SIGN_MESSAGE :
2859 PSA_KEY_USAGE_SIGN_HASH,
2860 alg);
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002861
Gilles Peskine449bd832023-01-11 14:50:10 +01002862 if (status != PSA_SUCCESS) {
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002863 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002864 }
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002865
Gilles Peskine449bd832023-01-11 14:50:10 +01002866 if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) {
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002867 status = PSA_ERROR_INVALID_ARGUMENT;
2868 goto exit;
2869 }
2870
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01002871 attributes = (psa_key_attributes_t) {
Gilles Peskine449bd832023-01-11 14:50:10 +01002872 .core = slot->attr
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002873 };
2874
Gilles Peskine449bd832023-01-11 14:50:10 +01002875 if (input_is_message) {
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002876 status = psa_driver_wrapper_sign_message(
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002877 &attributes, slot->key.data, slot->key.bytes,
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002878 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002879 signature, signature_size, signature_length);
2880 } else {
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002881
2882 status = psa_driver_wrapper_sign_hash(
2883 &attributes, slot->key.data, slot->key.bytes,
2884 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002885 signature, signature_size, signature_length);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002886 }
2887
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002888
2889exit:
Paul Elliott59200a22023-02-21 15:07:40 +00002890 psa_wipe_tag_output_buffer(signature, status, signature_size,
2891 *signature_length);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002892
Gilles Peskine449bd832023-01-11 14:50:10 +01002893 unlock_status = psa_unlock_key_slot(slot);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002894
Gilles Peskine449bd832023-01-11 14:50:10 +01002895 return (status == PSA_SUCCESS) ? unlock_status : status;
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002896}
2897
Gilles Peskine449bd832023-01-11 14:50:10 +01002898static psa_status_t psa_verify_internal(mbedtls_svc_key_id_t key,
2899 int input_is_message,
2900 psa_algorithm_t alg,
2901 const uint8_t *input,
2902 size_t input_length,
2903 const uint8_t *signature,
2904 size_t signature_length)
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002905{
2906 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2907 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
2908 psa_key_slot_t *slot;
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002909
Gilles Peskine449bd832023-01-11 14:50:10 +01002910 status = psa_sign_verify_check_alg(input_is_message, alg);
2911 if (status != PSA_SUCCESS) {
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002912 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01002913 }
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002914
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002915 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002916 key, &slot,
2917 input_is_message ? PSA_KEY_USAGE_VERIFY_MESSAGE :
2918 PSA_KEY_USAGE_VERIFY_HASH,
2919 alg);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002920
Gilles Peskine449bd832023-01-11 14:50:10 +01002921 if (status != PSA_SUCCESS) {
2922 return status;
2923 }
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002924
2925 psa_key_attributes_t attributes = {
Gilles Peskine449bd832023-01-11 14:50:10 +01002926 .core = slot->attr
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002927 };
2928
Gilles Peskine449bd832023-01-11 14:50:10 +01002929 if (input_is_message) {
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002930 status = psa_driver_wrapper_verify_message(
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002931 &attributes, slot->key.data, slot->key.bytes,
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002932 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002933 signature, signature_length);
2934 } else {
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002935 status = psa_driver_wrapper_verify_hash(
2936 &attributes, slot->key.data, slot->key.bytes,
2937 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002938 signature, signature_length);
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002939 }
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002940
Gilles Peskine449bd832023-01-11 14:50:10 +01002941 unlock_status = psa_unlock_key_slot(slot);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002942
Gilles Peskine449bd832023-01-11 14:50:10 +01002943 return (status == PSA_SUCCESS) ? unlock_status : status;
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002944
2945}
2946
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02002947psa_status_t psa_sign_message_builtin(
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002948 const psa_key_attributes_t *attributes,
2949 const uint8_t *key_buffer,
2950 size_t key_buffer_size,
2951 psa_algorithm_t alg,
2952 const uint8_t *input,
2953 size_t input_length,
2954 uint8_t *signature,
2955 size_t signature_size,
Gilles Peskine449bd832023-01-11 14:50:10 +01002956 size_t *signature_length)
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002957{
2958 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002959
Gilles Peskine449bd832023-01-11 14:50:10 +01002960 if (PSA_ALG_IS_SIGN_HASH(alg)) {
gabor-mezei-armf9820f92021-05-03 16:26:20 +02002961 size_t hash_length;
2962 uint8_t hash[PSA_HASH_MAX_SIZE];
2963
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002964 status = psa_driver_wrapper_hash_compute(
Gilles Peskine449bd832023-01-11 14:50:10 +01002965 PSA_ALG_SIGN_GET_HASH(alg),
2966 input, input_length,
2967 hash, sizeof(hash), &hash_length);
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002968
Gilles Peskine449bd832023-01-11 14:50:10 +01002969 if (status != PSA_SUCCESS) {
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002970 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01002971 }
gabor-mezei-armf9820f92021-05-03 16:26:20 +02002972
2973 return psa_driver_wrapper_sign_hash(
Gilles Peskine449bd832023-01-11 14:50:10 +01002974 attributes, key_buffer, key_buffer_size,
2975 alg, hash, hash_length,
2976 signature, signature_size, signature_length);
gabor-mezei-arm0f622402021-04-29 16:48:44 +02002977 }
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002978
Gilles Peskine449bd832023-01-11 14:50:10 +01002979 return PSA_ERROR_NOT_SUPPORTED;
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002980}
2981
Gilles Peskine449bd832023-01-11 14:50:10 +01002982psa_status_t psa_sign_message(mbedtls_svc_key_id_t key,
2983 psa_algorithm_t alg,
2984 const uint8_t *input,
2985 size_t input_length,
2986 uint8_t *signature,
2987 size_t signature_size,
2988 size_t *signature_length)
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002989{
2990 return psa_sign_internal(
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002991 key, 1, alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01002992 signature, signature_size, signature_length);
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002993}
2994
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02002995psa_status_t psa_verify_message_builtin(
gabor-mezei-arm50eac352021-04-22 11:32:19 +02002996 const psa_key_attributes_t *attributes,
2997 const uint8_t *key_buffer,
2998 size_t key_buffer_size,
2999 psa_algorithm_t alg,
3000 const uint8_t *input,
3001 size_t input_length,
3002 const uint8_t *signature,
Gilles Peskine449bd832023-01-11 14:50:10 +01003003 size_t signature_length)
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003004{
3005 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003006
Gilles Peskine449bd832023-01-11 14:50:10 +01003007 if (PSA_ALG_IS_SIGN_HASH(alg)) {
gabor-mezei-armf9820f92021-05-03 16:26:20 +02003008 size_t hash_length;
3009 uint8_t hash[PSA_HASH_MAX_SIZE];
3010
gabor-mezei-arm0f622402021-04-29 16:48:44 +02003011 status = psa_driver_wrapper_hash_compute(
Gilles Peskine449bd832023-01-11 14:50:10 +01003012 PSA_ALG_SIGN_GET_HASH(alg),
3013 input, input_length,
3014 hash, sizeof(hash), &hash_length);
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003015
Gilles Peskine449bd832023-01-11 14:50:10 +01003016 if (status != PSA_SUCCESS) {
gabor-mezei-arm0f622402021-04-29 16:48:44 +02003017 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01003018 }
gabor-mezei-armf9820f92021-05-03 16:26:20 +02003019
3020 return psa_driver_wrapper_verify_hash(
Gilles Peskine449bd832023-01-11 14:50:10 +01003021 attributes, key_buffer, key_buffer_size,
3022 alg, hash, hash_length,
3023 signature, signature_length);
gabor-mezei-arm0f622402021-04-29 16:48:44 +02003024 }
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003025
Gilles Peskine449bd832023-01-11 14:50:10 +01003026 return PSA_ERROR_NOT_SUPPORTED;
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003027}
3028
Gilles Peskine449bd832023-01-11 14:50:10 +01003029psa_status_t psa_verify_message(mbedtls_svc_key_id_t key,
3030 psa_algorithm_t alg,
3031 const uint8_t *input,
3032 size_t input_length,
3033 const uint8_t *signature,
3034 size_t signature_length)
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003035{
3036 return psa_verify_internal(
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02003037 key, 1, alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003038 signature, signature_length);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003039}
3040
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02003041psa_status_t psa_sign_hash_builtin(
Ronald Cron18659932020-12-08 16:32:23 +01003042 const psa_key_attributes_t *attributes,
3043 const uint8_t *key_buffer, size_t key_buffer_size,
3044 psa_algorithm_t alg, const uint8_t *hash, size_t hash_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003045 uint8_t *signature, size_t signature_size, size_t *signature_length)
Gilles Peskinee59236f2018-01-27 23:32:46 +01003046{
Gilles Peskine449bd832023-01-11 14:50:10 +01003047 if (attributes->core.type == PSA_KEY_TYPE_RSA_KEY_PAIR) {
3048 if (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) ||
3049 PSA_ALG_IS_RSA_PSS(alg)) {
Ronald Cron4501c982021-03-19 20:09:32 +01003050#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01003051 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
3052 return mbedtls_psa_rsa_sign_hash(
3053 attributes,
3054 key_buffer, key_buffer_size,
3055 alg, hash, hash_length,
3056 signature, signature_size, signature_length);
Ronald Cron4501c982021-03-19 20:09:32 +01003057#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
3058 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
Gilles Peskine449bd832023-01-11 14:50:10 +01003059 } else {
3060 return PSA_ERROR_INVALID_ARGUMENT;
Steven Cooremanacda8342020-07-24 23:09:52 +02003061 }
Gilles Peskine449bd832023-01-11 14:50:10 +01003062 } else if (PSA_KEY_TYPE_IS_ECC(attributes->core.type)) {
3063 if (PSA_ALG_IS_ECDSA(alg)) {
Ronald Cron4501c982021-03-19 20:09:32 +01003064#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01003065 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
3066 return mbedtls_psa_ecdsa_sign_hash(
3067 attributes,
3068 key_buffer, key_buffer_size,
3069 alg, hash, hash_length,
3070 signature, signature_size, signature_length);
Gilles Peskinee59236f2018-01-27 23:32:46 +01003071#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3072 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Gilles Peskine449bd832023-01-11 14:50:10 +01003073 } else {
3074 return PSA_ERROR_INVALID_ARGUMENT;
Ronald Cron4501c982021-03-19 20:09:32 +01003075 }
Ronald Cron8a494f32021-02-17 09:49:51 +01003076 }
Ronald Cron4501c982021-03-19 20:09:32 +01003077
Gilles Peskine449bd832023-01-11 14:50:10 +01003078 (void) key_buffer;
3079 (void) key_buffer_size;
3080 (void) hash;
3081 (void) hash_length;
3082 (void) signature;
3083 (void) signature_size;
3084 (void) signature_length;
Ronald Cron4501c982021-03-19 20:09:32 +01003085
Gilles Peskine449bd832023-01-11 14:50:10 +01003086 return PSA_ERROR_NOT_SUPPORTED;
Ronald Cron18659932020-12-08 16:32:23 +01003087}
Gilles Peskinee59236f2018-01-27 23:32:46 +01003088
Gilles Peskine449bd832023-01-11 14:50:10 +01003089psa_status_t psa_sign_hash(mbedtls_svc_key_id_t key,
3090 psa_algorithm_t alg,
3091 const uint8_t *hash,
3092 size_t hash_length,
3093 uint8_t *signature,
3094 size_t signature_size,
3095 size_t *signature_length)
Gilles Peskinee59236f2018-01-27 23:32:46 +01003096{
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003097 return psa_sign_internal(
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02003098 key, 0, alg, hash, hash_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003099 signature, signature_size, signature_length);
itayzafrir5c753392018-05-08 11:18:38 +03003100}
3101
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02003102psa_status_t psa_verify_hash_builtin(
Ronald Cron18659932020-12-08 16:32:23 +01003103 const psa_key_attributes_t *attributes,
3104 const uint8_t *key_buffer, size_t key_buffer_size,
3105 psa_algorithm_t alg, const uint8_t *hash, size_t hash_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003106 const uint8_t *signature, size_t signature_length)
itayzafrir5c753392018-05-08 11:18:38 +03003107{
Gilles Peskine449bd832023-01-11 14:50:10 +01003108 if (PSA_KEY_TYPE_IS_RSA(attributes->core.type)) {
3109 if (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) ||
3110 PSA_ALG_IS_RSA_PSS(alg)) {
Ronald Cron4501c982021-03-19 20:09:32 +01003111#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01003112 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
3113 return mbedtls_psa_rsa_verify_hash(
3114 attributes,
3115 key_buffer, key_buffer_size,
3116 alg, hash, hash_length,
3117 signature, signature_length);
Ronald Cron4501c982021-03-19 20:09:32 +01003118#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
3119 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
Gilles Peskine449bd832023-01-11 14:50:10 +01003120 } else {
3121 return PSA_ERROR_INVALID_ARGUMENT;
Steven Cooremanacda8342020-07-24 23:09:52 +02003122 }
Gilles Peskine449bd832023-01-11 14:50:10 +01003123 } else if (PSA_KEY_TYPE_IS_ECC(attributes->core.type)) {
3124 if (PSA_ALG_IS_ECDSA(alg)) {
Ronald Cron4501c982021-03-19 20:09:32 +01003125#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01003126 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
3127 return mbedtls_psa_ecdsa_verify_hash(
3128 attributes,
3129 key_buffer, key_buffer_size,
3130 alg, hash, hash_length,
3131 signature, signature_length);
Ronald Cron4501c982021-03-19 20:09:32 +01003132#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3133 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Gilles Peskine449bd832023-01-11 14:50:10 +01003134 } else {
3135 return PSA_ERROR_INVALID_ARGUMENT;
Ronald Cron4501c982021-03-19 20:09:32 +01003136 }
Ronald Cron8a494f32021-02-17 09:49:51 +01003137 }
Ronald Cron4501c982021-03-19 20:09:32 +01003138
Gilles Peskine449bd832023-01-11 14:50:10 +01003139 (void) key_buffer;
3140 (void) key_buffer_size;
3141 (void) hash;
3142 (void) hash_length;
3143 (void) signature;
3144 (void) signature_length;
Ronald Cron4501c982021-03-19 20:09:32 +01003145
Gilles Peskine449bd832023-01-11 14:50:10 +01003146 return PSA_ERROR_NOT_SUPPORTED;
Ronald Cron18659932020-12-08 16:32:23 +01003147}
3148
Gilles Peskine449bd832023-01-11 14:50:10 +01003149psa_status_t psa_verify_hash(mbedtls_svc_key_id_t key,
3150 psa_algorithm_t alg,
3151 const uint8_t *hash,
3152 size_t hash_length,
3153 const uint8_t *signature,
3154 size_t signature_length)
itayzafrir5c753392018-05-08 11:18:38 +03003155{
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003156 return psa_verify_internal(
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02003157 key, 0, alg, hash, hash_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003158 signature, signature_length);
Gilles Peskinee59236f2018-01-27 23:32:46 +01003159}
3160
Gilles Peskine449bd832023-01-11 14:50:10 +01003161psa_status_t psa_asymmetric_encrypt(mbedtls_svc_key_id_t key,
3162 psa_algorithm_t alg,
3163 const uint8_t *input,
3164 size_t input_length,
3165 const uint8_t *salt,
3166 size_t salt_length,
3167 uint8_t *output,
3168 size_t output_size,
3169 size_t *output_length)
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003170{
Ronald Cronf95a2b12020-10-22 15:24:49 +02003171 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01003172 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01003173 psa_key_slot_t *slot;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01003174 psa_key_attributes_t attributes;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003175
Darryl Green5cc689a2018-07-24 15:34:10 +01003176 (void) input;
3177 (void) input_length;
3178 (void) salt;
3179 (void) output;
3180 (void) output_size;
3181
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03003182 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003183
Gilles Peskine449bd832023-01-11 14:50:10 +01003184 if (!PSA_ALG_IS_RSA_OAEP(alg) && salt_length != 0) {
3185 return PSA_ERROR_INVALID_ARGUMENT;
3186 }
Gilles Peskineb3fc05d2018-06-30 19:04:35 +02003187
Ronald Cron5c522922020-11-14 16:35:34 +01003188 status = psa_get_and_lock_transparent_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01003189 key, &slot, PSA_KEY_USAGE_ENCRYPT, alg);
3190 if (status != PSA_SUCCESS) {
3191 return status;
3192 }
3193 if (!(PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type) ||
3194 PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type))) {
Ronald Cronf95a2b12020-10-22 15:24:49 +02003195 status = PSA_ERROR_INVALID_ARGUMENT;
3196 goto exit;
3197 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003198
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01003199 attributes = (psa_key_attributes_t) {
Gilles Peskine449bd832023-01-11 14:50:10 +01003200 .core = slot->attr
Przemyslaw Stekiel19e61422021-12-09 11:09:11 +01003201 };
Steven Cooremana2371e52020-07-28 14:30:39 +02003202
Przemyslaw Stekiel19e61422021-12-09 11:09:11 +01003203 status = psa_driver_wrapper_asymmetric_encrypt(
3204 &attributes, slot->key.data, slot->key.bytes,
3205 alg, input, input_length, salt, salt_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003206 output, output_size, output_length);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003207exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01003208 unlock_status = psa_unlock_key_slot(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003209
Gilles Peskine449bd832023-01-11 14:50:10 +01003210 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine5b051bc2018-05-31 13:25:48 +02003211}
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003212
Gilles Peskine449bd832023-01-11 14:50:10 +01003213psa_status_t psa_asymmetric_decrypt(mbedtls_svc_key_id_t key,
3214 psa_algorithm_t alg,
3215 const uint8_t *input,
3216 size_t input_length,
3217 const uint8_t *salt,
3218 size_t salt_length,
3219 uint8_t *output,
3220 size_t output_size,
3221 size_t *output_length)
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003222{
Ronald Cronf95a2b12020-10-22 15:24:49 +02003223 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01003224 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01003225 psa_key_slot_t *slot;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01003226 psa_key_attributes_t attributes;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003227
Darryl Green5cc689a2018-07-24 15:34:10 +01003228 (void) input;
3229 (void) input_length;
3230 (void) salt;
3231 (void) output;
3232 (void) output_size;
3233
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03003234 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003235
Gilles Peskine449bd832023-01-11 14:50:10 +01003236 if (!PSA_ALG_IS_RSA_OAEP(alg) && salt_length != 0) {
3237 return PSA_ERROR_INVALID_ARGUMENT;
3238 }
Gilles Peskineb3fc05d2018-06-30 19:04:35 +02003239
Ronald Cron5c522922020-11-14 16:35:34 +01003240 status = psa_get_and_lock_transparent_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01003241 key, &slot, PSA_KEY_USAGE_DECRYPT, alg);
3242 if (status != PSA_SUCCESS) {
3243 return status;
3244 }
3245 if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) {
Ronald Cronf95a2b12020-10-22 15:24:49 +02003246 status = PSA_ERROR_INVALID_ARGUMENT;
3247 goto exit;
3248 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003249
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01003250 attributes = (psa_key_attributes_t) {
Gilles Peskine449bd832023-01-11 14:50:10 +01003251 .core = slot->attr
Przemyslaw Stekiel8d45c002021-12-13 08:58:19 +01003252 };
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003253
Przemyslaw Stekiel8d45c002021-12-13 08:58:19 +01003254 status = psa_driver_wrapper_asymmetric_decrypt(
3255 &attributes, slot->key.data, slot->key.bytes,
3256 alg, input, input_length, salt, salt_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003257 output, output_size, output_length);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003258
3259exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01003260 unlock_status = psa_unlock_key_slot(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003261
Gilles Peskine449bd832023-01-11 14:50:10 +01003262 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine5b051bc2018-05-31 13:25:48 +02003263}
Gilles Peskinee59236f2018-01-27 23:32:46 +01003264
Paul Elliott9fe12f62022-11-30 19:16:02 +00003265/****************************************************************/
3266/* Asymmetric interruptible cryptography */
3267/****************************************************************/
3268
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003269static uint32_t psa_interruptible_max_ops = PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED;
3270
Paul Elliott9fe12f62022-11-30 19:16:02 +00003271void psa_interruptible_set_max_ops(uint32_t max_ops)
3272{
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003273 psa_interruptible_max_ops = max_ops;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003274}
3275
3276uint32_t psa_interruptible_get_max_ops(void)
3277{
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003278 return psa_interruptible_max_ops;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003279}
3280
Paul Elliott9fe12f62022-11-30 19:16:02 +00003281uint32_t psa_sign_hash_get_num_ops(
3282 const psa_sign_hash_interruptible_operation_t *operation)
3283{
Paul Elliott296ede92022-12-15 17:00:30 +00003284 return operation->num_ops;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003285}
3286
3287uint32_t psa_verify_hash_get_num_ops(
3288 const psa_verify_hash_interruptible_operation_t *operation)
3289{
Paul Elliott296ede92022-12-15 17:00:30 +00003290 return operation->num_ops;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003291}
3292
Paul Elliott59ad9452022-12-18 15:09:02 +00003293static psa_status_t psa_sign_hash_abort_internal(
3294 psa_sign_hash_interruptible_operation_t *operation)
3295{
3296 if (operation->id == 0) {
3297 /* The object has (apparently) been initialized but it is not (yet)
3298 * in use. It's ok to call abort on such an object, and there's
3299 * nothing to do. */
3300 return PSA_SUCCESS;
3301 }
3302
3303 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3304
3305 status = psa_driver_wrapper_sign_hash_abort(operation);
3306
3307 operation->id = 0;
3308
Paul Elliotte6145dc2023-02-07 12:51:21 +00003309 /* Do not clear either the error_occurred or num_ops elements here as they
3310 * only want to be cleared by the application calling abort, not by abort
3311 * being called at completion of an operation. */
3312
Paul Elliott59ad9452022-12-18 15:09:02 +00003313 return status;
3314}
3315
Paul Elliott9fe12f62022-11-30 19:16:02 +00003316psa_status_t psa_sign_hash_start(
3317 psa_sign_hash_interruptible_operation_t *operation,
3318 mbedtls_svc_key_id_t key, psa_algorithm_t alg,
3319 const uint8_t *hash, size_t hash_length)
3320{
3321 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3322 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
3323 psa_key_slot_t *slot;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01003324 psa_key_attributes_t attributes;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003325
Paul Elliottc9774412023-02-06 15:14:07 +00003326 /* Check that start has not been previously called, or operation has not
3327 * previously errored. */
3328 if (operation->id != 0 || operation->error_occurred) {
Paul Elliott9fe12f62022-11-30 19:16:02 +00003329 return PSA_ERROR_BAD_STATE;
3330 }
3331
Paul Elliott9fe12f62022-11-30 19:16:02 +00003332 status = psa_sign_verify_check_alg(0, alg);
3333 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003334 operation->error_occurred = 1;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003335 return status;
3336 }
3337
3338 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
3339 PSA_KEY_USAGE_SIGN_HASH,
3340 alg);
3341
3342 if (status != PSA_SUCCESS) {
3343 goto exit;
3344 }
3345
3346 if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) {
3347 status = PSA_ERROR_INVALID_ARGUMENT;
3348 goto exit;
3349 }
3350
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01003351 attributes = (psa_key_attributes_t) {
Paul Elliott9fe12f62022-11-30 19:16:02 +00003352 .core = slot->attr
3353 };
3354
Paul Elliott296ede92022-12-15 17:00:30 +00003355 /* Ensure ops count gets reset, in case of operation re-use. */
3356 operation->num_ops = 0;
3357
Paul Elliott9fe12f62022-11-30 19:16:02 +00003358 status = psa_driver_wrapper_sign_hash_start(operation, &attributes,
3359 slot->key.data,
3360 slot->key.bytes, alg,
3361 hash, hash_length);
3362exit:
3363
3364 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003365 operation->error_occurred = 1;
Paul Elliott59ad9452022-12-18 15:09:02 +00003366 psa_sign_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003367 }
3368
3369 unlock_status = psa_unlock_key_slot(slot);
3370
Paul Elliottc9774412023-02-06 15:14:07 +00003371 if (unlock_status != PSA_SUCCESS) {
3372 operation->error_occurred = 1;
3373 }
Paul Elliott9fe12f62022-11-30 19:16:02 +00003374
Paul Elliottc9774412023-02-06 15:14:07 +00003375 return (status == PSA_SUCCESS) ? unlock_status : status;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003376}
3377
3378
3379psa_status_t psa_sign_hash_complete(
3380 psa_sign_hash_interruptible_operation_t *operation,
3381 uint8_t *signature, size_t signature_size,
3382 size_t *signature_length)
3383{
3384 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3385
3386 *signature_length = 0;
3387
Paul Elliottc9774412023-02-06 15:14:07 +00003388 /* Check that start has been called first, and that operation has not
3389 * previously errored. */
3390 if (operation->id == 0 || operation->error_occurred) {
Paul Elliott9fe12f62022-11-30 19:16:02 +00003391 status = PSA_ERROR_BAD_STATE;
3392 goto exit;
3393 }
3394
Paul Elliott096abc42023-02-03 18:33:23 +00003395 /* Immediately reject a zero-length signature buffer. This guarantees that
3396 * signature must be a valid pointer. */
Paul Elliott9fe12f62022-11-30 19:16:02 +00003397 if (signature_size == 0) {
3398 status = PSA_ERROR_BUFFER_TOO_SMALL;
3399 goto exit;
3400 }
3401
3402 status = psa_driver_wrapper_sign_hash_complete(operation, signature,
3403 signature_size,
3404 signature_length);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003405
Paul Elliott296ede92022-12-15 17:00:30 +00003406 /* Update ops count with work done. */
Paul Elliottde1114c2023-02-07 12:43:11 +00003407 operation->num_ops = psa_driver_wrapper_sign_hash_get_num_ops(operation);
Paul Elliott296ede92022-12-15 17:00:30 +00003408
Paul Elliottebe225c2023-02-10 14:32:53 +00003409exit:
3410
Paul Elliott59200a22023-02-21 15:07:40 +00003411 psa_wipe_tag_output_buffer(signature, status, signature_size,
3412 *signature_length);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003413
Paul Elliott53bb3122023-02-10 14:22:22 +00003414 if (status != PSA_OPERATION_INCOMPLETE) {
Paul Elliottc9774412023-02-06 15:14:07 +00003415 if (status != PSA_SUCCESS) {
3416 operation->error_occurred = 1;
3417 }
3418
Paul Elliott59ad9452022-12-18 15:09:02 +00003419 psa_sign_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003420 }
3421
3422 return status;
3423}
3424
3425psa_status_t psa_sign_hash_abort(
3426 psa_sign_hash_interruptible_operation_t *operation)
3427{
Paul Elliott59ad9452022-12-18 15:09:02 +00003428 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3429
3430 status = psa_sign_hash_abort_internal(operation);
3431
3432 /* We clear the number of ops done here, so that it is not cleared when
3433 * the operation fails or succeeds, only on manual abort. */
3434 operation->num_ops = 0;
3435
Paul Elliottc9774412023-02-06 15:14:07 +00003436 /* Likewise, failure state. */
3437 operation->error_occurred = 0;
3438
Paul Elliott59ad9452022-12-18 15:09:02 +00003439 return status;
3440}
3441
3442static psa_status_t psa_verify_hash_abort_internal(
3443 psa_verify_hash_interruptible_operation_t *operation)
3444{
Paul Elliott9fe12f62022-11-30 19:16:02 +00003445 if (operation->id == 0) {
3446 /* The object has (apparently) been initialized but it is not (yet)
3447 * in use. It's ok to call abort on such an object, and there's
3448 * nothing to do. */
3449 return PSA_SUCCESS;
3450 }
3451
Paul Elliott59ad9452022-12-18 15:09:02 +00003452 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3453
3454 status = psa_driver_wrapper_verify_hash_abort(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003455
3456 operation->id = 0;
3457
Paul Elliotte6145dc2023-02-07 12:51:21 +00003458 /* Do not clear either the error_occurred or num_ops elements here as they
3459 * only want to be cleared by the application calling abort, not by abort
3460 * being called at completion of an operation. */
3461
Paul Elliott59ad9452022-12-18 15:09:02 +00003462 return status;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003463}
3464
3465psa_status_t psa_verify_hash_start(
3466 psa_verify_hash_interruptible_operation_t *operation,
3467 mbedtls_svc_key_id_t key, psa_algorithm_t alg,
3468 const uint8_t *hash, size_t hash_length,
3469 const uint8_t *signature, size_t signature_length)
3470{
3471 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3472 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
3473 psa_key_slot_t *slot;
3474
Paul Elliottc9774412023-02-06 15:14:07 +00003475 /* Check that start has not been previously called, or operation has not
3476 * previously errored. */
3477 if (operation->id != 0 || operation->error_occurred) {
Paul Elliott9fe12f62022-11-30 19:16:02 +00003478 return PSA_ERROR_BAD_STATE;
3479 }
3480
3481 status = psa_sign_verify_check_alg(0, alg);
3482 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003483 operation->error_occurred = 1;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003484 return status;
3485 }
3486
3487 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
3488 PSA_KEY_USAGE_VERIFY_HASH,
3489 alg);
3490
3491 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003492 operation->error_occurred = 1;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003493 return status;
3494 }
3495
3496 psa_key_attributes_t attributes = {
3497 .core = slot->attr
3498 };
3499
Paul Elliott296ede92022-12-15 17:00:30 +00003500 /* Ensure ops count gets reset, in case of operation re-use. */
3501 operation->num_ops = 0;
3502
Paul Elliott9fe12f62022-11-30 19:16:02 +00003503 status = psa_driver_wrapper_verify_hash_start(operation, &attributes,
3504 slot->key.data,
3505 slot->key.bytes,
3506 alg, hash, hash_length,
3507 signature, signature_length);
3508
3509 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003510 operation->error_occurred = 1;
Paul Elliott59ad9452022-12-18 15:09:02 +00003511 psa_verify_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003512 }
3513
3514 unlock_status = psa_unlock_key_slot(slot);
3515
Paul Elliottc9774412023-02-06 15:14:07 +00003516 if (unlock_status != PSA_SUCCESS) {
3517 operation->error_occurred = 1;
3518 }
Paul Elliott9fe12f62022-11-30 19:16:02 +00003519
Paul Elliottc9774412023-02-06 15:14:07 +00003520 return (status == PSA_SUCCESS) ? unlock_status : status;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003521}
3522
3523psa_status_t psa_verify_hash_complete(
3524 psa_verify_hash_interruptible_operation_t *operation)
3525{
3526 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3527
Paul Elliottc9774412023-02-06 15:14:07 +00003528 /* Check that start has been called first, and that operation has not
3529 * previously errored. */
3530 if (operation->id == 0 || operation->error_occurred) {
Paul Elliott9fe12f62022-11-30 19:16:02 +00003531 status = PSA_ERROR_BAD_STATE;
3532 goto exit;
3533 }
3534
3535 status = psa_driver_wrapper_verify_hash_complete(operation);
3536
Paul Elliott296ede92022-12-15 17:00:30 +00003537 /* Update ops count with work done. */
Paul Elliottde1114c2023-02-07 12:43:11 +00003538 operation->num_ops = psa_driver_wrapper_verify_hash_get_num_ops(
Paul Elliott296ede92022-12-15 17:00:30 +00003539 operation);
3540
Paul Elliottebe225c2023-02-10 14:32:53 +00003541exit:
3542
Paul Elliott9fe12f62022-11-30 19:16:02 +00003543 if (status != PSA_OPERATION_INCOMPLETE) {
Paul Elliottc9774412023-02-06 15:14:07 +00003544 if (status != PSA_SUCCESS) {
3545 operation->error_occurred = 1;
3546 }
3547
Paul Elliott59ad9452022-12-18 15:09:02 +00003548 psa_verify_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003549 }
3550
3551 return status;
3552}
3553
3554psa_status_t psa_verify_hash_abort(
3555 psa_verify_hash_interruptible_operation_t *operation)
3556{
Paul Elliott59ad9452022-12-18 15:09:02 +00003557 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003558
Paul Elliott59ad9452022-12-18 15:09:02 +00003559 status = psa_verify_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003560
Paul Elliott59ad9452022-12-18 15:09:02 +00003561 /* We clear the number of ops done here, so that it is not cleared when
3562 * the operation fails or succeeds, only on manual abort. */
3563 operation->num_ops = 0;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003564
Paul Elliottc9774412023-02-06 15:14:07 +00003565 /* Likewise, failure state. */
3566 operation->error_occurred = 0;
3567
Paul Elliott59ad9452022-12-18 15:09:02 +00003568 return status;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003569}
3570
Paul Elliott588f8ed2022-12-02 18:10:26 +00003571/****************************************************************/
3572/* Asymmetric interruptible cryptography internal */
3573/* implementations */
3574/****************************************************************/
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02003575
Paul Elliott588f8ed2022-12-02 18:10:26 +00003576void mbedtls_psa_interruptible_set_max_ops(uint32_t max_ops)
3577{
Paul Elliott7cc4e812023-01-10 17:14:11 +00003578
Paul Elliott588f8ed2022-12-02 18:10:26 +00003579#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3580 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3581 defined(MBEDTLS_ECP_RESTARTABLE)
3582
3583 /* Internal implementation uses zero to indicate infinite number max ops,
3584 * therefore avoid this value, and set to minimum possible. */
3585 if (max_ops == 0) {
3586 max_ops = 1;
3587 }
3588
Paul Elliott588f8ed2022-12-02 18:10:26 +00003589 mbedtls_ecp_set_max_ops(max_ops);
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003590#else
3591 (void) max_ops;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003592#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3593 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3594 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3595}
3596
Paul Elliott588f8ed2022-12-02 18:10:26 +00003597uint32_t mbedtls_psa_sign_hash_get_num_ops(
Paul Elliottf8e5b562023-02-19 18:43:45 +00003598 const mbedtls_psa_sign_hash_interruptible_operation_t *operation)
Paul Elliott588f8ed2022-12-02 18:10:26 +00003599{
3600#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3601 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3602 defined(MBEDTLS_ECP_RESTARTABLE)
3603
Paul Elliott93d9ca82023-02-15 18:14:21 +00003604 return operation->num_ops;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003605#else
3606 (void) operation;
3607 return 0;
3608#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3609 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3610 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3611}
3612
3613uint32_t mbedtls_psa_verify_hash_get_num_ops(
Paul Elliottf8e5b562023-02-19 18:43:45 +00003614 const mbedtls_psa_verify_hash_interruptible_operation_t *operation)
Paul Elliott588f8ed2022-12-02 18:10:26 +00003615{
3616 #if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3617 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3618 defined(MBEDTLS_ECP_RESTARTABLE)
3619
Paul Elliott93d9ca82023-02-15 18:14:21 +00003620 return operation->num_ops;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003621#else
3622 (void) operation;
3623 return 0;
3624#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3625 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3626 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3627}
3628
3629psa_status_t mbedtls_psa_sign_hash_start(
3630 mbedtls_psa_sign_hash_interruptible_operation_t *operation,
3631 const psa_key_attributes_t *attributes, const uint8_t *key_buffer,
3632 size_t key_buffer_size, psa_algorithm_t alg,
3633 const uint8_t *hash, size_t hash_length)
3634{
3635 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott0290a762023-02-09 14:30:24 +00003636 size_t required_hash_length;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003637
Paul Elliott068fe072023-01-16 13:59:15 +00003638 if (!PSA_KEY_TYPE_IS_ECC(attributes->core.type)) {
3639 return PSA_ERROR_NOT_SUPPORTED;
3640 }
3641
3642 if (!PSA_ALG_IS_ECDSA(alg)) {
Paul Elliott813f9cd2023-02-05 15:28:46 +00003643 return PSA_ERROR_NOT_SUPPORTED;
Paul Elliott068fe072023-01-16 13:59:15 +00003644 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003645
3646#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
Paul Elliott068fe072023-01-16 13:59:15 +00003647 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3648 defined(MBEDTLS_ECP_RESTARTABLE)
Paul Elliott588f8ed2022-12-02 18:10:26 +00003649
Paul Elliotta1c94092023-02-15 16:38:04 +00003650 mbedtls_ecdsa_restart_init(&operation->restart_ctx);
3651
Paul Elliott93d9ca82023-02-15 18:14:21 +00003652 /* Ensure num_ops is zero'ed in case of context re-use. */
3653 operation->num_ops = 0;
3654
Paul Elliott068fe072023-01-16 13:59:15 +00003655 status = mbedtls_psa_ecp_load_representation(attributes->core.type,
3656 attributes->core.bits,
3657 key_buffer,
3658 key_buffer_size,
3659 &operation->ctx);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003660
Paul Elliott068fe072023-01-16 13:59:15 +00003661 if (status != PSA_SUCCESS) {
3662 return status;
3663 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003664
Paul Elliott1bc59df2023-02-05 13:41:57 +00003665 operation->coordinate_bytes = PSA_BITS_TO_BYTES(
Paul Elliottc569fc22023-02-10 13:02:54 +00003666 operation->ctx->grp.nbits);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003667
Paul Elliott068fe072023-01-16 13:59:15 +00003668 psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH(alg);
Manuel Pégourié-Gonnard2d6d9932023-03-28 11:38:08 +02003669 operation->md_alg = mbedtls_md_type_from_psa_alg(hash_alg);
Paul Elliott068fe072023-01-16 13:59:15 +00003670 operation->alg = alg;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003671
Paul Elliott0290a762023-02-09 14:30:24 +00003672 /* We only need to store the same length of hash as the private key size
3673 * here, it would be truncated by the internal implementation anyway. */
3674 required_hash_length = (hash_length < operation->coordinate_bytes ?
3675 hash_length : operation->coordinate_bytes);
3676
Paul Elliottba70ad42023-02-15 18:23:53 +00003677 if (required_hash_length > sizeof(operation->hash)) {
3678 /* Shouldn't happen, but better safe than sorry. */
3679 return PSA_ERROR_CORRUPTION_DETECTED;
3680 }
3681
Paul Elliott0290a762023-02-09 14:30:24 +00003682 memcpy(operation->hash, hash, required_hash_length);
3683 operation->hash_length = required_hash_length;
Paul Elliott068fe072023-01-16 13:59:15 +00003684
3685 return PSA_SUCCESS;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003686
3687#else
Paul Elliott068fe072023-01-16 13:59:15 +00003688 (void) operation;
3689 (void) key_buffer;
3690 (void) key_buffer_size;
3691 (void) alg;
3692 (void) hash;
3693 (void) hash_length;
3694 (void) status;
Paul Elliott0290a762023-02-09 14:30:24 +00003695 (void) required_hash_length;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003696
Paul Elliott068fe072023-01-16 13:59:15 +00003697 return PSA_ERROR_NOT_SUPPORTED;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003698#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3699 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3700 * defined( MBEDTLS_ECP_RESTARTABLE ) */
Paul Elliott588f8ed2022-12-02 18:10:26 +00003701}
3702
3703psa_status_t mbedtls_psa_sign_hash_complete(
3704 mbedtls_psa_sign_hash_interruptible_operation_t *operation,
3705 uint8_t *signature, size_t signature_size,
3706 size_t *signature_length)
3707{
Paul Elliott588f8ed2022-12-02 18:10:26 +00003708#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3709 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3710 defined(MBEDTLS_ECP_RESTARTABLE)
3711
Paul Elliotta1c94092023-02-15 16:38:04 +00003712 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott1243f932023-02-07 11:21:10 +00003713 mbedtls_mpi r;
3714 mbedtls_mpi s;
3715
Paul Elliott46845252023-02-03 14:59:11 +00003716 mbedtls_mpi_init(&r);
3717 mbedtls_mpi_init(&s);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003718
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003719 /* Ensure max_ops is set to the current value (or default). */
3720 mbedtls_psa_interruptible_set_max_ops(psa_interruptible_get_max_ops());
3721
Paul Elliotta1c94092023-02-15 16:38:04 +00003722 if (signature_size < 2 * operation->coordinate_bytes) {
3723 status = PSA_ERROR_BUFFER_TOO_SMALL;
3724 goto exit;
3725 }
3726
Paul Elliott588f8ed2022-12-02 18:10:26 +00003727 if (PSA_ALG_ECDSA_IS_DETERMINISTIC(operation->alg)) {
Paul Elliott46845252023-02-03 14:59:11 +00003728
Paul Elliott588f8ed2022-12-02 18:10:26 +00003729#if defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
3730 status = mbedtls_to_psa_error(
3731 mbedtls_ecdsa_sign_det_restartable(&operation->ctx->grp,
Paul Elliott46845252023-02-03 14:59:11 +00003732 &r,
3733 &s,
Paul Elliott588f8ed2022-12-02 18:10:26 +00003734 &operation->ctx->d,
3735 operation->hash,
3736 operation->hash_length,
3737 operation->md_alg,
3738 mbedtls_psa_get_random,
3739 MBEDTLS_PSA_RANDOM_STATE,
3740 &operation->restart_ctx));
3741#else /* defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Paul Elliott724bd252023-02-08 12:35:08 +00003742 status = PSA_ERROR_NOT_SUPPORTED;
3743 goto exit;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003744#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
3745 } else {
Paul Elliott588f8ed2022-12-02 18:10:26 +00003746 status = mbedtls_to_psa_error(
3747 mbedtls_ecdsa_sign_restartable(&operation->ctx->grp,
Paul Elliott46845252023-02-03 14:59:11 +00003748 &r,
3749 &s,
Paul Elliott588f8ed2022-12-02 18:10:26 +00003750 &operation->ctx->d,
3751 operation->hash,
3752 operation->hash_length,
3753 mbedtls_psa_get_random,
3754 MBEDTLS_PSA_RANDOM_STATE,
3755 mbedtls_psa_get_random,
3756 MBEDTLS_PSA_RANDOM_STATE,
3757 &operation->restart_ctx));
3758 }
3759
Paul Elliottf8e5b562023-02-19 18:43:45 +00003760 /* Hide the fact that the restart context only holds a delta of number of
3761 * ops done during the last operation, not an absolute value. */
3762 operation->num_ops += operation->restart_ctx.ecp.ops_done;
3763
Paul Elliott724bd252023-02-08 12:35:08 +00003764 if (status == PSA_SUCCESS) {
Paul Elliott588f8ed2022-12-02 18:10:26 +00003765 status = mbedtls_to_psa_error(
Paul Elliott46845252023-02-03 14:59:11 +00003766 mbedtls_mpi_write_binary(&r,
Paul Elliott588f8ed2022-12-02 18:10:26 +00003767 signature,
Paul Elliott1bc59df2023-02-05 13:41:57 +00003768 operation->coordinate_bytes)
3769 );
Paul Elliott588f8ed2022-12-02 18:10:26 +00003770
3771 if (status != PSA_SUCCESS) {
Paul Elliott724bd252023-02-08 12:35:08 +00003772 goto exit;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003773 }
3774
3775 status = mbedtls_to_psa_error(
Paul Elliott46845252023-02-03 14:59:11 +00003776 mbedtls_mpi_write_binary(&s,
Paul Elliott588f8ed2022-12-02 18:10:26 +00003777 signature +
Paul Elliott1bc59df2023-02-05 13:41:57 +00003778 operation->coordinate_bytes,
3779 operation->coordinate_bytes)
3780 );
Paul Elliott588f8ed2022-12-02 18:10:26 +00003781
3782 if (status != PSA_SUCCESS) {
Paul Elliott724bd252023-02-08 12:35:08 +00003783 goto exit;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003784 }
3785
Paul Elliott1bc59df2023-02-05 13:41:57 +00003786 *signature_length = operation->coordinate_bytes * 2;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003787
Paul Elliott724bd252023-02-08 12:35:08 +00003788 status = PSA_SUCCESS;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003789 }
Paul Elliott724bd252023-02-08 12:35:08 +00003790
3791exit:
3792
3793 mbedtls_mpi_free(&r);
3794 mbedtls_mpi_free(&s);
3795 return status;
3796
Paul Elliott588f8ed2022-12-02 18:10:26 +00003797 #else
3798
3799 (void) operation;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003800 (void) signature;
3801 (void) signature_size;
3802 (void) signature_length;
3803
3804 return PSA_ERROR_NOT_SUPPORTED;
3805
3806#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3807 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3808 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3809}
3810
3811psa_status_t mbedtls_psa_sign_hash_abort(
3812 mbedtls_psa_sign_hash_interruptible_operation_t *operation)
3813{
3814
3815#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3816 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3817 defined(MBEDTLS_ECP_RESTARTABLE)
3818
3819 if (operation->ctx) {
3820 mbedtls_ecdsa_free(operation->ctx);
3821 mbedtls_free(operation->ctx);
Paul Elliottf9c91a72023-02-05 18:06:38 +00003822 operation->ctx = NULL;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003823 }
3824
3825 mbedtls_ecdsa_restart_free(&operation->restart_ctx);
3826
Paul Elliott93d9ca82023-02-15 18:14:21 +00003827 operation->num_ops = 0;
3828
Paul Elliott588f8ed2022-12-02 18:10:26 +00003829 return PSA_SUCCESS;
3830
3831#else
3832
3833 (void) operation;
3834
3835 return PSA_ERROR_NOT_SUPPORTED;
3836
3837#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3838 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3839 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3840}
3841
3842psa_status_t mbedtls_psa_verify_hash_start(
3843 mbedtls_psa_verify_hash_interruptible_operation_t *operation,
3844 const psa_key_attributes_t *attributes,
3845 const uint8_t *key_buffer, size_t key_buffer_size,
3846 psa_algorithm_t alg,
3847 const uint8_t *hash, size_t hash_length,
3848 const uint8_t *signature, size_t signature_length)
3849{
3850 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott1bc59df2023-02-05 13:41:57 +00003851 size_t coordinate_bytes = 0;
Paul Elliott0290a762023-02-09 14:30:24 +00003852 size_t required_hash_length = 0;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003853
Paul Elliott068fe072023-01-16 13:59:15 +00003854 if (!PSA_KEY_TYPE_IS_ECC(attributes->core.type)) {
3855 return PSA_ERROR_NOT_SUPPORTED;
3856 }
3857
3858 if (!PSA_ALG_IS_ECDSA(alg)) {
Paul Elliott813f9cd2023-02-05 15:28:46 +00003859 return PSA_ERROR_NOT_SUPPORTED;
Paul Elliott068fe072023-01-16 13:59:15 +00003860 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003861
3862#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
Paul Elliott068fe072023-01-16 13:59:15 +00003863 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3864 defined(MBEDTLS_ECP_RESTARTABLE)
Paul Elliott588f8ed2022-12-02 18:10:26 +00003865
Paul Elliotta1c94092023-02-15 16:38:04 +00003866 mbedtls_ecdsa_restart_init(&operation->restart_ctx);
3867 mbedtls_mpi_init(&operation->r);
3868 mbedtls_mpi_init(&operation->s);
3869
Paul Elliott93d9ca82023-02-15 18:14:21 +00003870 /* Ensure num_ops is zero'ed in case of context re-use. */
3871 operation->num_ops = 0;
3872
Paul Elliott068fe072023-01-16 13:59:15 +00003873 status = mbedtls_psa_ecp_load_representation(attributes->core.type,
3874 attributes->core.bits,
3875 key_buffer,
3876 key_buffer_size,
3877 &operation->ctx);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003878
Paul Elliott068fe072023-01-16 13:59:15 +00003879 if (status != PSA_SUCCESS) {
3880 return status;
3881 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003882
Paul Elliottc569fc22023-02-10 13:02:54 +00003883 coordinate_bytes = PSA_BITS_TO_BYTES(operation->ctx->grp.nbits);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003884
Paul Elliott1bc59df2023-02-05 13:41:57 +00003885 if (signature_length != 2 * coordinate_bytes) {
Paul Elliott068fe072023-01-16 13:59:15 +00003886 return PSA_ERROR_INVALID_SIGNATURE;
3887 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003888
Paul Elliott068fe072023-01-16 13:59:15 +00003889 status = mbedtls_to_psa_error(
3890 mbedtls_mpi_read_binary(&operation->r,
3891 signature,
Paul Elliott1bc59df2023-02-05 13:41:57 +00003892 coordinate_bytes));
Paul Elliott588f8ed2022-12-02 18:10:26 +00003893
Paul Elliott068fe072023-01-16 13:59:15 +00003894 if (status != PSA_SUCCESS) {
3895 return status;
3896 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003897
Paul Elliott068fe072023-01-16 13:59:15 +00003898 status = mbedtls_to_psa_error(
3899 mbedtls_mpi_read_binary(&operation->s,
3900 signature +
Paul Elliott1bc59df2023-02-05 13:41:57 +00003901 coordinate_bytes,
3902 coordinate_bytes));
Paul Elliott588f8ed2022-12-02 18:10:26 +00003903
Paul Elliott068fe072023-01-16 13:59:15 +00003904 if (status != PSA_SUCCESS) {
3905 return status;
3906 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003907
Paul Elliott2c9843f2023-02-15 17:32:42 +00003908 status = mbedtls_psa_ecp_load_public_part(operation->ctx);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003909
Paul Elliott2c9843f2023-02-15 17:32:42 +00003910 if (status != PSA_SUCCESS) {
3911 return status;
Paul Elliott068fe072023-01-16 13:59:15 +00003912 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003913
Paul Elliott0290a762023-02-09 14:30:24 +00003914 /* We only need to store the same length of hash as the private key size
3915 * here, it would be truncated by the internal implementation anyway. */
3916 required_hash_length = (hash_length < coordinate_bytes ? hash_length :
3917 coordinate_bytes);
3918
Paul Elliottba70ad42023-02-15 18:23:53 +00003919 if (required_hash_length > sizeof(operation->hash)) {
3920 /* Shouldn't happen, but better safe than sorry. */
3921 return PSA_ERROR_CORRUPTION_DETECTED;
3922 }
3923
Paul Elliott0290a762023-02-09 14:30:24 +00003924 memcpy(operation->hash, hash, required_hash_length);
3925 operation->hash_length = required_hash_length;
Paul Elliott068fe072023-01-16 13:59:15 +00003926
3927 return PSA_SUCCESS;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003928#else
Paul Elliott068fe072023-01-16 13:59:15 +00003929 (void) operation;
3930 (void) key_buffer;
3931 (void) key_buffer_size;
3932 (void) alg;
3933 (void) hash;
3934 (void) hash_length;
3935 (void) signature;
3936 (void) signature_length;
3937 (void) status;
Paul Elliott1243f932023-02-07 11:21:10 +00003938 (void) coordinate_bytes;
Paul Elliott0290a762023-02-09 14:30:24 +00003939 (void) required_hash_length;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003940
Paul Elliott068fe072023-01-16 13:59:15 +00003941 return PSA_ERROR_NOT_SUPPORTED;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003942#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3943 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3944 * defined( MBEDTLS_ECP_RESTARTABLE ) */
Paul Elliott588f8ed2022-12-02 18:10:26 +00003945}
3946
3947psa_status_t mbedtls_psa_verify_hash_complete(
3948 mbedtls_psa_verify_hash_interruptible_operation_t *operation)
3949{
3950
3951#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3952 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3953 defined(MBEDTLS_ECP_RESTARTABLE)
3954
Paul Elliottf8e5b562023-02-19 18:43:45 +00003955 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3956
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003957 /* Ensure max_ops is set to the current value (or default). */
3958 mbedtls_psa_interruptible_set_max_ops(psa_interruptible_get_max_ops());
3959
Paul Elliottf8e5b562023-02-19 18:43:45 +00003960 status = mbedtls_to_psa_error(
Paul Elliott588f8ed2022-12-02 18:10:26 +00003961 mbedtls_ecdsa_verify_restartable(&operation->ctx->grp,
3962 operation->hash,
3963 operation->hash_length,
3964 &operation->ctx->Q,
3965 &operation->r,
3966 &operation->s,
3967 &operation->restart_ctx));
3968
Paul Elliottf8e5b562023-02-19 18:43:45 +00003969 /* Hide the fact that the restart context only holds a delta of number of
3970 * ops done during the last operation, not an absolute value. */
3971 operation->num_ops += operation->restart_ctx.ecp.ops_done;
3972
3973 return status;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003974#else
3975 (void) operation;
3976
3977 return PSA_ERROR_NOT_SUPPORTED;
3978
3979#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3980 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3981 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3982}
3983
3984psa_status_t mbedtls_psa_verify_hash_abort(
3985 mbedtls_psa_verify_hash_interruptible_operation_t *operation)
3986{
3987
3988#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3989 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3990 defined(MBEDTLS_ECP_RESTARTABLE)
3991
3992 if (operation->ctx) {
3993 mbedtls_ecdsa_free(operation->ctx);
3994 mbedtls_free(operation->ctx);
Paul Elliottf9c91a72023-02-05 18:06:38 +00003995 operation->ctx = NULL;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003996 }
3997
3998 mbedtls_ecdsa_restart_free(&operation->restart_ctx);
3999
Paul Elliott93d9ca82023-02-15 18:14:21 +00004000 operation->num_ops = 0;
4001
Paul Elliott588f8ed2022-12-02 18:10:26 +00004002 mbedtls_mpi_free(&operation->r);
4003 mbedtls_mpi_free(&operation->s);
4004
4005 return PSA_SUCCESS;
4006
4007#else
4008 (void) operation;
4009
4010 return PSA_ERROR_NOT_SUPPORTED;
4011
4012#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
4013 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
4014 * defined( MBEDTLS_ECP_RESTARTABLE ) */
4015}
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02004016
mohammad1603503973b2018-03-12 15:59:30 +02004017/****************************************************************/
4018/* Symmetric cryptography */
4019/****************************************************************/
4020
Gilles Peskine449bd832023-01-11 14:50:10 +01004021static psa_status_t psa_cipher_setup(psa_cipher_operation_t *operation,
4022 mbedtls_svc_key_id_t key,
4023 psa_algorithm_t alg,
4024 mbedtls_operation_t cipher_operation)
Ronald Cronab99ac22020-10-01 16:38:28 +02004025{
4026 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4027 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Dave Rodgman54648242021-06-24 11:49:45 +01004028 psa_key_slot_t *slot = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01004029 psa_key_usage_t usage = (cipher_operation == MBEDTLS_ENCRYPT ?
4030 PSA_KEY_USAGE_ENCRYPT :
4031 PSA_KEY_USAGE_DECRYPT);
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01004032 psa_key_attributes_t attributes;
Ronald Cronab99ac22020-10-01 16:38:28 +02004033
4034 /* A context must be freshly initialized before it can be set up. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004035 if (operation->id != 0) {
Dave Rodgman54648242021-06-24 11:49:45 +01004036 status = PSA_ERROR_BAD_STATE;
4037 goto exit;
4038 }
Ronald Cronab99ac22020-10-01 16:38:28 +02004039
Gilles Peskine449bd832023-01-11 14:50:10 +01004040 if (!PSA_ALG_IS_CIPHER(alg)) {
Dave Rodgman54648242021-06-24 11:49:45 +01004041 status = PSA_ERROR_INVALID_ARGUMENT;
4042 goto exit;
4043 }
Ronald Cronab99ac22020-10-01 16:38:28 +02004044
Gilles Peskine449bd832023-01-11 14:50:10 +01004045 status = psa_get_and_lock_key_slot_with_policy(key, &slot, usage, alg);
4046 if (status != PSA_SUCCESS) {
Ronald Cronab99ac22020-10-01 16:38:28 +02004047 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004048 }
Ronald Cronab99ac22020-10-01 16:38:28 +02004049
Ronald Cron49fafa92021-03-10 08:34:23 +01004050 /* Initialize the operation struct members, except for id. The id member
Ronald Cronab99ac22020-10-01 16:38:28 +02004051 * is used to indicate to psa_cipher_abort that there are resources to free,
Ronald Cron49fafa92021-03-10 08:34:23 +01004052 * so we only set it (in the driver wrapper) after resources have been
4053 * allocated/initialized. */
Ronald Cronab99ac22020-10-01 16:38:28 +02004054 operation->iv_set = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01004055 if (alg == PSA_ALG_ECB_NO_PADDING) {
Ronald Cronab99ac22020-10-01 16:38:28 +02004056 operation->iv_required = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01004057 } else {
Ronald Cronab99ac22020-10-01 16:38:28 +02004058 operation->iv_required = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004059 }
4060 operation->default_iv_length = PSA_CIPHER_IV_LENGTH(slot->attr.type, alg);
Ronald Cronab99ac22020-10-01 16:38:28 +02004061
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01004062 attributes = (psa_key_attributes_t) {
Gilles Peskine449bd832023-01-11 14:50:10 +01004063 .core = slot->attr
Ronald Crona4af55f2020-12-14 14:36:06 +01004064 };
4065
Ronald Cronab99ac22020-10-01 16:38:28 +02004066 /* Try doing the operation through a driver before using software fallback. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004067 if (cipher_operation == MBEDTLS_ENCRYPT) {
4068 status = psa_driver_wrapper_cipher_encrypt_setup(operation,
4069 &attributes,
4070 slot->key.data,
4071 slot->key.bytes,
4072 alg);
4073 } else {
4074 status = psa_driver_wrapper_cipher_decrypt_setup(operation,
4075 &attributes,
4076 slot->key.data,
4077 slot->key.bytes,
4078 alg);
4079 }
Ronald Cronab99ac22020-10-01 16:38:28 +02004080
Gilles Peskine9ab61b62019-02-25 17:43:14 +01004081exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004082 if (status != PSA_SUCCESS) {
4083 psa_cipher_abort(operation);
4084 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02004085
Gilles Peskine449bd832023-01-11 14:50:10 +01004086 unlock_status = psa_unlock_key_slot(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02004087
Gilles Peskine449bd832023-01-11 14:50:10 +01004088 return (status == PSA_SUCCESS) ? unlock_status : status;
mohammad1603503973b2018-03-12 15:59:30 +02004089}
4090
Gilles Peskine449bd832023-01-11 14:50:10 +01004091psa_status_t psa_cipher_encrypt_setup(psa_cipher_operation_t *operation,
4092 mbedtls_svc_key_id_t key,
4093 psa_algorithm_t alg)
mohammad16038481e742018-03-18 13:57:31 +02004094{
Gilles Peskine449bd832023-01-11 14:50:10 +01004095 return psa_cipher_setup(operation, key, alg, MBEDTLS_ENCRYPT);
mohammad16038481e742018-03-18 13:57:31 +02004096}
4097
Gilles Peskine449bd832023-01-11 14:50:10 +01004098psa_status_t psa_cipher_decrypt_setup(psa_cipher_operation_t *operation,
4099 mbedtls_svc_key_id_t key,
4100 psa_algorithm_t alg)
mohammad16038481e742018-03-18 13:57:31 +02004101{
Gilles Peskine449bd832023-01-11 14:50:10 +01004102 return psa_cipher_setup(operation, key, alg, MBEDTLS_DECRYPT);
mohammad16038481e742018-03-18 13:57:31 +02004103}
4104
Gilles Peskine449bd832023-01-11 14:50:10 +01004105psa_status_t psa_cipher_generate_iv(psa_cipher_operation_t *operation,
4106 uint8_t *iv,
4107 size_t iv_size,
4108 size_t *iv_length)
mohammad1603503973b2018-03-12 15:59:30 +02004109{
Ronald Cron6d051732020-10-01 14:10:20 +02004110 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron2fb90522021-07-05 12:31:44 +02004111 uint8_t local_iv[PSA_CIPHER_IV_MAX_SIZE];
4112 size_t default_iv_length;
Ronald Cron5618a392021-03-26 09:52:26 +01004113
Gilles Peskine449bd832023-01-11 14:50:10 +01004114 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004115 status = PSA_ERROR_BAD_STATE;
4116 goto exit;
Ronald Cronc45b4af2020-09-29 16:18:05 +02004117 }
4118
Gilles Peskine449bd832023-01-11 14:50:10 +01004119 if (operation->iv_set || !operation->iv_required) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004120 status = PSA_ERROR_BAD_STATE;
4121 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004122 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004123
Ronald Cron2fb90522021-07-05 12:31:44 +02004124 default_iv_length = operation->default_iv_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01004125 if (iv_size < default_iv_length) {
Ronald Cron5618a392021-03-26 09:52:26 +01004126 status = PSA_ERROR_BUFFER_TOO_SMALL;
4127 goto exit;
4128 }
Gilles Peskinee553c652018-06-04 16:22:46 +02004129
Gilles Peskine449bd832023-01-11 14:50:10 +01004130 if (default_iv_length > PSA_CIPHER_IV_MAX_SIZE) {
Ronald Cron2fb90522021-07-05 12:31:44 +02004131 status = PSA_ERROR_GENERIC_ERROR;
4132 goto exit;
4133 }
4134
Gilles Peskine449bd832023-01-11 14:50:10 +01004135 status = psa_generate_random(local_iv, default_iv_length);
4136 if (status != PSA_SUCCESS) {
Ronald Cron5618a392021-03-26 09:52:26 +01004137 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004138 }
Ronald Cron5618a392021-03-26 09:52:26 +01004139
Gilles Peskine449bd832023-01-11 14:50:10 +01004140 status = psa_driver_wrapper_cipher_set_iv(operation,
4141 local_iv, default_iv_length);
Ronald Cron5618a392021-03-26 09:52:26 +01004142
4143exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004144 if (status == PSA_SUCCESS) {
4145 memcpy(iv, local_iv, default_iv_length);
Ronald Cron2fb90522021-07-05 12:31:44 +02004146 *iv_length = default_iv_length;
Steven Cooreman7df02922020-09-09 15:28:49 +02004147 operation->iv_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004148 } else {
Ronald Cron2fb90522021-07-05 12:31:44 +02004149 *iv_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01004150 psa_cipher_abort(operation);
Ronald Cron2fb90522021-07-05 12:31:44 +02004151 }
Ronald Cron6d051732020-10-01 14:10:20 +02004152
Gilles Peskine449bd832023-01-11 14:50:10 +01004153 return status;
mohammad1603503973b2018-03-12 15:59:30 +02004154}
4155
Gilles Peskine449bd832023-01-11 14:50:10 +01004156psa_status_t psa_cipher_set_iv(psa_cipher_operation_t *operation,
4157 const uint8_t *iv,
4158 size_t iv_length)
mohammad1603503973b2018-03-12 15:59:30 +02004159{
Ronald Cron6d051732020-10-01 14:10:20 +02004160 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cronc45b4af2020-09-29 16:18:05 +02004161
Gilles Peskine449bd832023-01-11 14:50:10 +01004162 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004163 status = PSA_ERROR_BAD_STATE;
4164 goto exit;
4165 }
Ronald Cronc45b4af2020-09-29 16:18:05 +02004166
Gilles Peskine449bd832023-01-11 14:50:10 +01004167 if (operation->iv_set || !operation->iv_required) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004168 status = PSA_ERROR_BAD_STATE;
4169 goto exit;
4170 }
Ronald Crona0d68172021-03-26 10:15:08 +01004171
Gilles Peskine449bd832023-01-11 14:50:10 +01004172 if (iv_length > PSA_CIPHER_IV_MAX_SIZE) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004173 status = PSA_ERROR_INVALID_ARGUMENT;
4174 goto exit;
4175 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004176
Gilles Peskine449bd832023-01-11 14:50:10 +01004177 status = psa_driver_wrapper_cipher_set_iv(operation,
4178 iv,
4179 iv_length);
Steven Cooremand3feccd2020-09-01 15:56:14 +02004180
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004181exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004182 if (status == PSA_SUCCESS) {
itayzafrir534bd7c2018-08-02 13:56:32 +03004183 operation->iv_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004184 } else {
4185 psa_cipher_abort(operation);
4186 }
4187 return status;
mohammad1603503973b2018-03-12 15:59:30 +02004188}
4189
Gilles Peskine449bd832023-01-11 14:50:10 +01004190psa_status_t psa_cipher_update(psa_cipher_operation_t *operation,
4191 const uint8_t *input,
4192 size_t input_length,
4193 uint8_t *output,
4194 size_t output_size,
4195 size_t *output_length)
mohammad1603503973b2018-03-12 15:59:30 +02004196{
Steven Cooremanffecb7b2020-08-25 15:13:13 +02004197 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron6d051732020-10-01 14:10:20 +02004198
Gilles Peskine449bd832023-01-11 14:50:10 +01004199 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004200 status = PSA_ERROR_BAD_STATE;
4201 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004202 }
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004203
Gilles Peskine449bd832023-01-11 14:50:10 +01004204 if (operation->iv_required && !operation->iv_set) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004205 status = PSA_ERROR_BAD_STATE;
4206 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004207 }
Jaeden Ameroab439972019-02-15 14:12:05 +00004208
Gilles Peskine449bd832023-01-11 14:50:10 +01004209 status = psa_driver_wrapper_cipher_update(operation,
4210 input,
4211 input_length,
4212 output,
4213 output_size,
4214 output_length);
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004215
4216exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004217 if (status != PSA_SUCCESS) {
4218 psa_cipher_abort(operation);
4219 }
Ronald Cron6d051732020-10-01 14:10:20 +02004220
Gilles Peskine449bd832023-01-11 14:50:10 +01004221 return status;
mohammad1603503973b2018-03-12 15:59:30 +02004222}
4223
Gilles Peskine449bd832023-01-11 14:50:10 +01004224psa_status_t psa_cipher_finish(psa_cipher_operation_t *operation,
4225 uint8_t *output,
4226 size_t output_size,
4227 size_t *output_length)
mohammad1603503973b2018-03-12 15:59:30 +02004228{
David Saadab4ecc272019-02-14 13:48:10 +02004229 psa_status_t status = PSA_ERROR_GENERIC_ERROR;
Ronald Cron6d051732020-10-01 14:10:20 +02004230
Gilles Peskine449bd832023-01-11 14:50:10 +01004231 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004232 status = PSA_ERROR_BAD_STATE;
4233 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004234 }
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004235
Gilles Peskine449bd832023-01-11 14:50:10 +01004236 if (operation->iv_required && !operation->iv_set) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004237 status = PSA_ERROR_BAD_STATE;
4238 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004239 }
Moran Pekerbed71a22018-04-22 20:19:20 +03004240
Gilles Peskine449bd832023-01-11 14:50:10 +01004241 status = psa_driver_wrapper_cipher_finish(operation,
4242 output,
4243 output_size,
4244 output_length);
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004245
4246exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004247 if (status == PSA_SUCCESS) {
4248 return psa_cipher_abort(operation);
4249 } else {
Steven Cooremanef8575e2020-09-11 11:44:50 +02004250 *output_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01004251 (void) psa_cipher_abort(operation);
Janos Follath315b51c2018-07-09 16:04:51 +01004252
Gilles Peskine449bd832023-01-11 14:50:10 +01004253 return status;
Steven Cooremanef8575e2020-09-11 11:44:50 +02004254 }
mohammad1603503973b2018-03-12 15:59:30 +02004255}
4256
Gilles Peskine449bd832023-01-11 14:50:10 +01004257psa_status_t psa_cipher_abort(psa_cipher_operation_t *operation)
Gilles Peskinee553c652018-06-04 16:22:46 +02004258{
Gilles Peskine449bd832023-01-11 14:50:10 +01004259 if (operation->id == 0) {
Steven Cooremana07b9972020-09-10 14:54:14 +02004260 /* The object has (apparently) been initialized but it is not (yet)
Gilles Peskine81736312018-06-26 15:04:31 +02004261 * in use. It's ok to call abort on such an object, and there's
4262 * nothing to do. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004263 return PSA_SUCCESS;
Gilles Peskine81736312018-06-26 15:04:31 +02004264 }
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02004265
Gilles Peskine449bd832023-01-11 14:50:10 +01004266 psa_driver_wrapper_cipher_abort(operation);
Gilles Peskinee553c652018-06-04 16:22:46 +02004267
Ronald Cron49fafa92021-03-10 08:34:23 +01004268 operation->id = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03004269 operation->iv_set = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03004270 operation->iv_required = 0;
Moran Peker41deec42018-04-04 15:43:05 +03004271
Gilles Peskine449bd832023-01-11 14:50:10 +01004272 return PSA_SUCCESS;
mohammad1603503973b2018-03-12 15:59:30 +02004273}
4274
Gilles Peskine449bd832023-01-11 14:50:10 +01004275psa_status_t psa_cipher_encrypt(mbedtls_svc_key_id_t key,
4276 psa_algorithm_t alg,
4277 const uint8_t *input,
4278 size_t input_length,
4279 uint8_t *output,
4280 size_t output_size,
4281 size_t *output_length)
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004282{
4283 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004284 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron23919522021-07-08 19:00:07 +02004285 psa_key_slot_t *slot = NULL;
Ronald Cronc6e6f502021-07-09 18:44:58 +02004286 uint8_t local_iv[PSA_CIPHER_IV_MAX_SIZE];
4287 size_t default_iv_length = 0;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01004288 psa_key_attributes_t attributes;
gabor-mezei-arm6f4e5bb2021-06-25 15:21:11 +02004289
Gilles Peskine449bd832023-01-11 14:50:10 +01004290 if (!PSA_ALG_IS_CIPHER(alg)) {
Ronald Cron23919522021-07-08 19:00:07 +02004291 status = PSA_ERROR_INVALID_ARGUMENT;
4292 goto exit;
4293 }
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004294
Gilles Peskine449bd832023-01-11 14:50:10 +01004295 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
4296 PSA_KEY_USAGE_ENCRYPT,
4297 alg);
4298 if (status != PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004299 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004300 }
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004301
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01004302 attributes = (psa_key_attributes_t) {
Gilles Peskine449bd832023-01-11 14:50:10 +01004303 .core = slot->attr
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004304 };
4305
Gilles Peskine449bd832023-01-11 14:50:10 +01004306 default_iv_length = PSA_CIPHER_IV_LENGTH(slot->attr.type, alg);
4307 if (default_iv_length > PSA_CIPHER_IV_MAX_SIZE) {
Ronald Cronc6e6f502021-07-09 18:44:58 +02004308 status = PSA_ERROR_GENERIC_ERROR;
4309 goto exit;
4310 }
4311
Gilles Peskine449bd832023-01-11 14:50:10 +01004312 if (default_iv_length > 0) {
4313 if (output_size < default_iv_length) {
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004314 status = PSA_ERROR_BUFFER_TOO_SMALL;
4315 goto exit;
4316 }
4317
Gilles Peskine449bd832023-01-11 14:50:10 +01004318 status = psa_generate_random(local_iv, default_iv_length);
4319 if (status != PSA_SUCCESS) {
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004320 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004321 }
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004322 }
4323
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004324 status = psa_driver_wrapper_cipher_encrypt(
4325 &attributes, slot->key.data, slot->key.bytes,
Ronald Cronc6e6f502021-07-09 18:44:58 +02004326 alg, local_iv, default_iv_length, input, input_length,
Ronald Cronafbc7ed2023-01-24 16:02:04 +01004327 psa_crypto_buffer_offset(output, default_iv_length),
Gilles Peskine449bd832023-01-11 14:50:10 +01004328 output_size - default_iv_length, output_length);
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004329
4330exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004331 unlock_status = psa_unlock_key_slot(slot);
4332 if (status == PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004333 status = unlock_status;
Ronald Cronc6e6f502021-07-09 18:44:58 +02004334 }
Ronald Cron23919522021-07-08 19:00:07 +02004335
Gilles Peskine449bd832023-01-11 14:50:10 +01004336 if (status == PSA_SUCCESS) {
4337 if (default_iv_length > 0) {
4338 memcpy(output, local_iv, default_iv_length);
4339 }
4340 *output_length += default_iv_length;
4341 } else {
4342 *output_length = 0;
4343 }
4344
4345 return status;
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004346}
4347
Gilles Peskine449bd832023-01-11 14:50:10 +01004348psa_status_t psa_cipher_decrypt(mbedtls_svc_key_id_t key,
4349 psa_algorithm_t alg,
4350 const uint8_t *input,
4351 size_t input_length,
4352 uint8_t *output,
4353 size_t output_size,
4354 size_t *output_length)
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004355{
4356 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004357 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron23919522021-07-08 19:00:07 +02004358 psa_key_slot_t *slot = NULL;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01004359 psa_key_attributes_t attributes;
gabor-mezei-arm6f4e5bb2021-06-25 15:21:11 +02004360
Gilles Peskine449bd832023-01-11 14:50:10 +01004361 if (!PSA_ALG_IS_CIPHER(alg)) {
Ronald Cron23919522021-07-08 19:00:07 +02004362 status = PSA_ERROR_INVALID_ARGUMENT;
4363 goto exit;
4364 }
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004365
Gilles Peskine449bd832023-01-11 14:50:10 +01004366 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
4367 PSA_KEY_USAGE_DECRYPT,
4368 alg);
4369 if (status != PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004370 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004371 }
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004372
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01004373 attributes = (psa_key_attributes_t) {
Gilles Peskine449bd832023-01-11 14:50:10 +01004374 .core = slot->attr
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004375 };
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004376
Gilles Peskine449bd832023-01-11 14:50:10 +01004377 if (alg == PSA_ALG_CCM_STAR_NO_TAG &&
4378 input_length < PSA_BLOCK_CIPHER_BLOCK_LENGTH(slot->attr.type)) {
Mateusz Starzyk594215b2021-10-14 12:23:06 +02004379 status = PSA_ERROR_INVALID_ARGUMENT;
4380 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004381 } else if (input_length < PSA_CIPHER_IV_LENGTH(slot->attr.type, alg)) {
gabor-mezei-arm258ae072021-06-25 15:25:38 +02004382 status = PSA_ERROR_INVALID_ARGUMENT;
4383 goto exit;
4384 }
4385
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004386 status = psa_driver_wrapper_cipher_decrypt(
4387 &attributes, slot->key.data, slot->key.bytes,
4388 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01004389 output, output_size, output_length);
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004390
gabor-mezei-arm258ae072021-06-25 15:25:38 +02004391exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004392 unlock_status = psa_unlock_key_slot(slot);
4393 if (status == PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004394 status = unlock_status;
Gilles Peskine449bd832023-01-11 14:50:10 +01004395 }
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004396
Gilles Peskine449bd832023-01-11 14:50:10 +01004397 if (status != PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004398 *output_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01004399 }
Ronald Cron23919522021-07-08 19:00:07 +02004400
Gilles Peskine449bd832023-01-11 14:50:10 +01004401 return status;
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004402}
4403
4404
mohammad16035955c982018-04-26 00:53:03 +03004405/****************************************************************/
4406/* AEAD */
4407/****************************************************************/
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02004408
Paul Elliottbaff51c2021-09-28 17:44:45 +01004409/* Helper function to get the base algorithm from its variants. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004410static psa_algorithm_t psa_aead_get_base_algorithm(psa_algorithm_t alg)
Paul Elliottbaff51c2021-09-28 17:44:45 +01004411{
Gilles Peskine449bd832023-01-11 14:50:10 +01004412 return PSA_ALG_AEAD_WITH_DEFAULT_LENGTH_TAG(alg);
Paul Elliottbaff51c2021-09-28 17:44:45 +01004413}
4414
4415/* Helper function to perform common nonce length checks. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004416static psa_status_t psa_aead_check_nonce_length(psa_algorithm_t alg,
4417 size_t nonce_length)
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004418{
Gilles Peskine449bd832023-01-11 14:50:10 +01004419 psa_algorithm_t base_alg = psa_aead_get_base_algorithm(alg);
Paul Elliottbaff51c2021-09-28 17:44:45 +01004420
Gilles Peskine449bd832023-01-11 14:50:10 +01004421 switch (base_alg) {
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004422#if defined(PSA_WANT_ALG_GCM)
4423 case PSA_ALG_GCM:
4424 /* Not checking max nonce size here as GCM spec allows almost
Gilles Peskine449bd832023-01-11 14:50:10 +01004425 * arbitrarily large nonces. Please note that we do not generally
4426 * recommend the usage of nonces of greater length than
4427 * PSA_AEAD_NONCE_MAX_SIZE, as large nonces are hashed to a shorter
4428 * size, which can then lead to collisions if you encrypt a very
4429 * large number of messages.*/
4430 if (nonce_length != 0) {
4431 return PSA_SUCCESS;
4432 }
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004433 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004434#endif /* PSA_WANT_ALG_GCM */
4435#if defined(PSA_WANT_ALG_CCM)
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004436 case PSA_ALG_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01004437 if (nonce_length >= 7 && nonce_length <= 13) {
4438 return PSA_SUCCESS;
4439 }
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004440 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004441#endif /* PSA_WANT_ALG_CCM */
4442#if defined(PSA_WANT_ALG_CHACHA20_POLY1305)
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004443 case PSA_ALG_CHACHA20_POLY1305:
Gilles Peskine449bd832023-01-11 14:50:10 +01004444 if (nonce_length == 12) {
4445 return PSA_SUCCESS;
4446 } else if (nonce_length == 8) {
4447 return PSA_ERROR_NOT_SUPPORTED;
4448 }
Bence Szépkúti6d48e202021-11-15 20:04:15 +01004449 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004450#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004451 default:
Przemek Stekiel4c499272022-09-27 13:55:37 +02004452 (void) nonce_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01004453 return PSA_ERROR_NOT_SUPPORTED;
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004454 }
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004455
Gilles Peskine449bd832023-01-11 14:50:10 +01004456 return PSA_ERROR_INVALID_ARGUMENT;
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004457}
4458
Gilles Peskine449bd832023-01-11 14:50:10 +01004459static psa_status_t psa_aead_check_algorithm(psa_algorithm_t alg)
Bence Szépkútiaa3a6e42022-01-13 16:26:03 +01004460{
Gilles Peskine449bd832023-01-11 14:50:10 +01004461 if (!PSA_ALG_IS_AEAD(alg) || PSA_ALG_IS_WILDCARD(alg)) {
4462 return PSA_ERROR_INVALID_ARGUMENT;
4463 }
Bence Szépkúti08f34652021-12-08 21:07:13 +01004464
Gilles Peskine449bd832023-01-11 14:50:10 +01004465 return PSA_SUCCESS;
Bence Szépkúti08f34652021-12-08 21:07:13 +01004466}
4467
Gilles Peskine449bd832023-01-11 14:50:10 +01004468psa_status_t psa_aead_encrypt(mbedtls_svc_key_id_t key,
4469 psa_algorithm_t alg,
4470 const uint8_t *nonce,
4471 size_t nonce_length,
4472 const uint8_t *additional_data,
4473 size_t additional_data_length,
4474 const uint8_t *plaintext,
4475 size_t plaintext_length,
4476 uint8_t *ciphertext,
4477 size_t ciphertext_size,
4478 size_t *ciphertext_length)
mohammad16035955c982018-04-26 00:53:03 +03004479{
Ronald Cron215633c2021-03-16 17:15:37 +01004480 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4481 psa_key_slot_t *slot;
Gilles Peskine2d277862018-06-18 15:41:12 +02004482
mohammad1603f08a5502018-06-03 15:05:47 +03004483 *ciphertext_length = 0;
mohammad1603e58e6842018-05-09 04:58:32 -07004484
Gilles Peskine449bd832023-01-11 14:50:10 +01004485 status = psa_aead_check_algorithm(alg);
4486 if (status != PSA_SUCCESS) {
4487 return status;
4488 }
Steven Cooremanea7ab132021-03-17 16:28:00 +01004489
Ronald Cron9a986162021-03-26 12:40:07 +01004490 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01004491 key, &slot, PSA_KEY_USAGE_ENCRYPT, alg);
4492 if (status != PSA_SUCCESS) {
4493 return status;
4494 }
mohammad16035955c982018-04-26 00:53:03 +03004495
Ronald Cron215633c2021-03-16 17:15:37 +01004496 psa_key_attributes_t attributes = {
Gilles Peskine449bd832023-01-11 14:50:10 +01004497 .core = slot->attr
Ronald Cron215633c2021-03-16 17:15:37 +01004498 };
mohammad16035955c982018-04-26 00:53:03 +03004499
Gilles Peskine449bd832023-01-11 14:50:10 +01004500 status = psa_aead_check_nonce_length(alg, nonce_length);
4501 if (status != PSA_SUCCESS) {
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004502 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004503 }
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004504
Ronald Cronde822812021-03-17 16:08:20 +01004505 status = psa_driver_wrapper_aead_encrypt(
Ronald Cron215633c2021-03-16 17:15:37 +01004506 &attributes, slot->key.data, slot->key.bytes,
4507 alg,
4508 nonce, nonce_length,
4509 additional_data, additional_data_length,
4510 plaintext, plaintext_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01004511 ciphertext, ciphertext_size, ciphertext_length);
Gilles Peskine2d277862018-06-18 15:41:12 +02004512
Gilles Peskine449bd832023-01-11 14:50:10 +01004513 if (status != PSA_SUCCESS && ciphertext_size != 0) {
4514 memset(ciphertext, 0, ciphertext_size);
4515 }
Gilles Peskine2d277862018-06-18 15:41:12 +02004516
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004517exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004518 psa_unlock_key_slot(slot);
mohammad16035955c982018-04-26 00:53:03 +03004519
Gilles Peskine449bd832023-01-11 14:50:10 +01004520 return status;
Gilles Peskineee652a32018-06-01 19:23:52 +02004521}
4522
Gilles Peskine449bd832023-01-11 14:50:10 +01004523psa_status_t psa_aead_decrypt(mbedtls_svc_key_id_t key,
4524 psa_algorithm_t alg,
4525 const uint8_t *nonce,
4526 size_t nonce_length,
4527 const uint8_t *additional_data,
4528 size_t additional_data_length,
4529 const uint8_t *ciphertext,
4530 size_t ciphertext_length,
4531 uint8_t *plaintext,
4532 size_t plaintext_size,
4533 size_t *plaintext_length)
mohammad16035955c982018-04-26 00:53:03 +03004534{
Ronald Cron215633c2021-03-16 17:15:37 +01004535 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4536 psa_key_slot_t *slot;
Gilles Peskine2d277862018-06-18 15:41:12 +02004537
Gilles Peskineee652a32018-06-01 19:23:52 +02004538 *plaintext_length = 0;
mohammad16039e5a5152018-04-26 12:07:35 +03004539
Gilles Peskine449bd832023-01-11 14:50:10 +01004540 status = psa_aead_check_algorithm(alg);
4541 if (status != PSA_SUCCESS) {
4542 return status;
4543 }
Steven Cooremanea7ab132021-03-17 16:28:00 +01004544
Ronald Cron9a986162021-03-26 12:40:07 +01004545 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01004546 key, &slot, PSA_KEY_USAGE_DECRYPT, alg);
4547 if (status != PSA_SUCCESS) {
4548 return status;
4549 }
mohammad16035955c982018-04-26 00:53:03 +03004550
Ronald Cron215633c2021-03-16 17:15:37 +01004551 psa_key_attributes_t attributes = {
Gilles Peskine449bd832023-01-11 14:50:10 +01004552 .core = slot->attr
Ronald Cron215633c2021-03-16 17:15:37 +01004553 };
Gilles Peskinef7e7b012019-05-06 15:27:16 +02004554
Gilles Peskine449bd832023-01-11 14:50:10 +01004555 status = psa_aead_check_nonce_length(alg, nonce_length);
4556 if (status != PSA_SUCCESS) {
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004557 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004558 }
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004559
Ronald Cronde822812021-03-17 16:08:20 +01004560 status = psa_driver_wrapper_aead_decrypt(
Ronald Cron215633c2021-03-16 17:15:37 +01004561 &attributes, slot->key.data, slot->key.bytes,
4562 alg,
4563 nonce, nonce_length,
4564 additional_data, additional_data_length,
4565 ciphertext, ciphertext_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01004566 plaintext, plaintext_size, plaintext_length);
Gilles Peskinea40d7742018-06-01 16:28:30 +02004567
Gilles Peskine449bd832023-01-11 14:50:10 +01004568 if (status != PSA_SUCCESS && plaintext_size != 0) {
4569 memset(plaintext, 0, plaintext_size);
4570 }
mohammad160360a64d02018-06-03 17:20:42 +03004571
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004572exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004573 psa_unlock_key_slot(slot);
Ronald Cron215633c2021-03-16 17:15:37 +01004574
Gilles Peskine449bd832023-01-11 14:50:10 +01004575 return status;
mohammad16035955c982018-04-26 00:53:03 +03004576}
4577
Gilles Peskine449bd832023-01-11 14:50:10 +01004578static psa_status_t psa_validate_tag_length(psa_algorithm_t alg)
4579{
4580 const uint8_t tag_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg);
Andrzej Kurekf8816012021-12-19 17:00:12 +01004581
Gilles Peskine449bd832023-01-11 14:50:10 +01004582 switch (PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg, 0)) {
Przemek Stekiel86679c72022-10-06 17:06:56 +02004583#if defined(PSA_WANT_ALG_CCM)
Gilles Peskine449bd832023-01-11 14:50:10 +01004584 case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, 0):
Andrzej Kurekf8816012021-12-19 17:00:12 +01004585 /* CCM allows the following tag lengths: 4, 6, 8, 10, 12, 14, 16.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01004586 if (tag_len < 4 || tag_len > 16 || tag_len % 2) {
4587 return PSA_ERROR_INVALID_ARGUMENT;
4588 }
Andrzej Kurekf8816012021-12-19 17:00:12 +01004589 break;
Przemek Stekiel86679c72022-10-06 17:06:56 +02004590#endif /* PSA_WANT_ALG_CCM */
Andrzej Kurekf8816012021-12-19 17:00:12 +01004591
Przemek Stekiel86679c72022-10-06 17:06:56 +02004592#if defined(PSA_WANT_ALG_GCM)
Gilles Peskine449bd832023-01-11 14:50:10 +01004593 case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_GCM, 0):
Andrzej Kurekf8816012021-12-19 17:00:12 +01004594 /* GCM allows the following tag lengths: 4, 8, 12, 13, 14, 15, 16. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004595 if (tag_len != 4 && tag_len != 8 && (tag_len < 12 || tag_len > 16)) {
4596 return PSA_ERROR_INVALID_ARGUMENT;
4597 }
Andrzej Kurekf8816012021-12-19 17:00:12 +01004598 break;
Przemek Stekiel86679c72022-10-06 17:06:56 +02004599#endif /* PSA_WANT_ALG_GCM */
Andrzej Kurekf8816012021-12-19 17:00:12 +01004600
Przemek Stekiel86679c72022-10-06 17:06:56 +02004601#if defined(PSA_WANT_ALG_CHACHA20_POLY1305)
Gilles Peskine449bd832023-01-11 14:50:10 +01004602 case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CHACHA20_POLY1305, 0):
Andrzej Kurekf8816012021-12-19 17:00:12 +01004603 /* We only support the default tag length. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004604 if (tag_len != 16) {
4605 return PSA_ERROR_INVALID_ARGUMENT;
4606 }
Andrzej Kurekf8816012021-12-19 17:00:12 +01004607 break;
Przemek Stekiel86679c72022-10-06 17:06:56 +02004608#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */
Andrzej Kurekf8816012021-12-19 17:00:12 +01004609
4610 default:
4611 (void) tag_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01004612 return PSA_ERROR_NOT_SUPPORTED;
Andrzej Kurekf8816012021-12-19 17:00:12 +01004613 }
Gilles Peskine449bd832023-01-11 14:50:10 +01004614 return PSA_SUCCESS;
Andrzej Kurekf8816012021-12-19 17:00:12 +01004615}
4616
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004617/* Set the key for a multipart authenticated operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004618static psa_status_t psa_aead_setup(psa_aead_operation_t *operation,
4619 int is_encrypt,
4620 mbedtls_svc_key_id_t key,
4621 psa_algorithm_t alg)
Paul Elliottc2b71442021-06-24 18:17:52 +01004622{
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004623 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4624 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
4625 psa_key_slot_t *slot = NULL;
4626 psa_key_usage_t key_usage = 0;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01004627 psa_key_attributes_t attributes;
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004628
Gilles Peskine449bd832023-01-11 14:50:10 +01004629 status = psa_aead_check_algorithm(alg);
4630 if (status != PSA_SUCCESS) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004631 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004632 }
Paul Elliottc2b71442021-06-24 18:17:52 +01004633
Gilles Peskine449bd832023-01-11 14:50:10 +01004634 if (operation->id != 0) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004635 status = PSA_ERROR_BAD_STATE;
4636 goto exit;
Paul Elliottc2b71442021-06-24 18:17:52 +01004637 }
4638
Gilles Peskine449bd832023-01-11 14:50:10 +01004639 if (operation->nonce_set || operation->lengths_set ||
4640 operation->ad_started || operation->body_started) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004641 status = PSA_ERROR_BAD_STATE;
4642 goto exit;
Paul Elliottc2b71442021-06-24 18:17:52 +01004643 }
4644
Gilles Peskine449bd832023-01-11 14:50:10 +01004645 if (is_encrypt) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004646 key_usage = PSA_KEY_USAGE_ENCRYPT;
Gilles Peskine449bd832023-01-11 14:50:10 +01004647 } else {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004648 key_usage = PSA_KEY_USAGE_DECRYPT;
Gilles Peskine449bd832023-01-11 14:50:10 +01004649 }
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004650
Gilles Peskine449bd832023-01-11 14:50:10 +01004651 status = psa_get_and_lock_key_slot_with_policy(key, &slot, key_usage,
4652 alg);
4653 if (status != PSA_SUCCESS) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004654 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004655 }
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004656
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01004657 attributes = (psa_key_attributes_t) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004658 .core = slot->attr
4659 };
4660
Gilles Peskine449bd832023-01-11 14:50:10 +01004661 if ((status = psa_validate_tag_length(alg)) != PSA_SUCCESS) {
Przemek Stekiel6ab50762022-10-08 17:54:30 +02004662 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004663 }
Przemek Stekiel6ab50762022-10-08 17:54:30 +02004664
Gilles Peskine449bd832023-01-11 14:50:10 +01004665 if (is_encrypt) {
4666 status = psa_driver_wrapper_aead_encrypt_setup(operation,
4667 &attributes,
4668 slot->key.data,
4669 slot->key.bytes,
4670 alg);
4671 } else {
4672 status = psa_driver_wrapper_aead_decrypt_setup(operation,
4673 &attributes,
4674 slot->key.data,
4675 slot->key.bytes,
4676 alg);
4677 }
4678 if (status != PSA_SUCCESS) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004679 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004680 }
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004681
Gilles Peskine449bd832023-01-11 14:50:10 +01004682 operation->key_type = psa_get_key_type(&attributes);
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004683
4684exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004685 unlock_status = psa_unlock_key_slot(slot);
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004686
Gilles Peskine449bd832023-01-11 14:50:10 +01004687 if (status == PSA_SUCCESS) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004688 status = unlock_status;
Gilles Peskine449bd832023-01-11 14:50:10 +01004689 operation->alg = psa_aead_get_base_algorithm(alg);
Paul Elliottd9343f22021-08-23 18:59:49 +01004690 operation->is_encrypt = is_encrypt;
Gilles Peskine449bd832023-01-11 14:50:10 +01004691 } else {
4692 psa_aead_abort(operation);
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004693 }
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004694
Gilles Peskine449bd832023-01-11 14:50:10 +01004695 return status;
Paul Elliottc2b71442021-06-24 18:17:52 +01004696}
4697
Paul Elliott302ff6b2021-04-20 18:10:30 +01004698/* Set the key for a multipart authenticated encryption operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004699psa_status_t psa_aead_encrypt_setup(psa_aead_operation_t *operation,
4700 mbedtls_svc_key_id_t key,
4701 psa_algorithm_t alg)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004702{
Gilles Peskine449bd832023-01-11 14:50:10 +01004703 return psa_aead_setup(operation, 1, key, alg);
Paul Elliott302ff6b2021-04-20 18:10:30 +01004704}
4705
4706/* Set the key for a multipart authenticated decryption operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004707psa_status_t psa_aead_decrypt_setup(psa_aead_operation_t *operation,
4708 mbedtls_svc_key_id_t key,
4709 psa_algorithm_t alg)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004710{
Gilles Peskine449bd832023-01-11 14:50:10 +01004711 return psa_aead_setup(operation, 0, key, alg);
Paul Elliott302ff6b2021-04-20 18:10:30 +01004712}
4713
4714/* Generate a random nonce / IV for multipart AEAD operation */
Gilles Peskine449bd832023-01-11 14:50:10 +01004715psa_status_t psa_aead_generate_nonce(psa_aead_operation_t *operation,
4716 uint8_t *nonce,
4717 size_t nonce_size,
4718 size_t *nonce_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004719{
4720 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Croncae59092021-11-26 18:53:58 +01004721 uint8_t local_nonce[PSA_AEAD_NONCE_MAX_SIZE];
Paul Elliottb91da712021-05-20 14:43:47 +01004722 size_t required_nonce_size;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004723
Paul Elliott8eb9daf2021-06-04 16:42:21 +01004724 *nonce_length = 0;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004725
Gilles Peskine449bd832023-01-11 14:50:10 +01004726 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004727 status = PSA_ERROR_BAD_STATE;
4728 goto exit;
4729 }
4730
Gilles Peskine449bd832023-01-11 14:50:10 +01004731 if (operation->nonce_set || !operation->is_encrypt) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004732 status = PSA_ERROR_BAD_STATE;
4733 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004734 }
4735
Paul Elliotte193ea82021-10-01 13:00:16 +01004736 /* For CCM, this size may not be correct according to the PSA
4737 * specification. The PSA Crypto 1.0.1 specification states:
4738 *
4739 * CCM encodes the plaintext length pLen in L octets, with L the smallest
4740 * integer >= 2 where pLen < 2^(8L). The nonce length is then 15 - L bytes.
4741 *
4742 * However this restriction that L has to be the smallest integer is not
4743 * applied in practice, and it is not implementable here since the
4744 * plaintext length may or may not be known at this time. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004745 required_nonce_size = PSA_AEAD_NONCE_LENGTH(operation->key_type,
4746 operation->alg);
4747 if (nonce_size < required_nonce_size) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004748 status = PSA_ERROR_BUFFER_TOO_SMALL;
4749 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004750 }
4751
Gilles Peskine449bd832023-01-11 14:50:10 +01004752 status = psa_generate_random(local_nonce, required_nonce_size);
4753 if (status != PSA_SUCCESS) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004754 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004755 }
Paul Elliott302ff6b2021-04-20 18:10:30 +01004756
Gilles Peskine449bd832023-01-11 14:50:10 +01004757 status = psa_aead_set_nonce(operation, local_nonce, required_nonce_size);
Paul Elliott302ff6b2021-04-20 18:10:30 +01004758
Paul Elliott39dc6b82021-05-11 19:16:09 +01004759exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004760 if (status == PSA_SUCCESS) {
4761 memcpy(nonce, local_nonce, required_nonce_size);
Paul Elliott39dc6b82021-05-11 19:16:09 +01004762 *nonce_length = required_nonce_size;
Gilles Peskine449bd832023-01-11 14:50:10 +01004763 } else {
4764 psa_aead_abort(operation);
Ronald Croncae59092021-11-26 18:53:58 +01004765 }
Paul Elliott39dc6b82021-05-11 19:16:09 +01004766
Gilles Peskine449bd832023-01-11 14:50:10 +01004767 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004768}
4769
4770/* Set the nonce for a multipart authenticated encryption or decryption
4771 operation.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01004772psa_status_t psa_aead_set_nonce(psa_aead_operation_t *operation,
4773 const uint8_t *nonce,
4774 size_t nonce_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004775{
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004776 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4777
Gilles Peskine449bd832023-01-11 14:50:10 +01004778 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004779 status = PSA_ERROR_BAD_STATE;
4780 goto exit;
4781 }
4782
Gilles Peskine449bd832023-01-11 14:50:10 +01004783 if (operation->nonce_set) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004784 status = PSA_ERROR_BAD_STATE;
4785 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004786 }
4787
Gilles Peskine449bd832023-01-11 14:50:10 +01004788 status = psa_aead_check_nonce_length(operation->alg, nonce_length);
4789 if (status != PSA_SUCCESS) {
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004790 status = PSA_ERROR_INVALID_ARGUMENT;
4791 goto exit;
Paul Elliott4ed1ed12021-09-27 18:09:28 +01004792 }
Paul Elliott1a98aca2021-05-20 18:24:07 +01004793
Gilles Peskine449bd832023-01-11 14:50:10 +01004794 status = psa_driver_wrapper_aead_set_nonce(operation, nonce,
4795 nonce_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004796
Paul Elliott39dc6b82021-05-11 19:16:09 +01004797exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004798 if (status == PSA_SUCCESS) {
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004799 operation->nonce_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004800 } else {
4801 psa_aead_abort(operation);
4802 }
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004803
Gilles Peskine449bd832023-01-11 14:50:10 +01004804 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004805}
4806
4807/* Declare the lengths of the message and additional data for multipart AEAD. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004808psa_status_t psa_aead_set_lengths(psa_aead_operation_t *operation,
4809 size_t ad_length,
4810 size_t plaintext_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004811{
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004812 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4813
Gilles Peskine449bd832023-01-11 14:50:10 +01004814 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004815 status = PSA_ERROR_BAD_STATE;
4816 goto exit;
4817 }
4818
Gilles Peskine449bd832023-01-11 14:50:10 +01004819 if (operation->lengths_set || operation->ad_started ||
4820 operation->body_started) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004821 status = PSA_ERROR_BAD_STATE;
4822 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004823 }
4824
Gilles Peskine449bd832023-01-11 14:50:10 +01004825 switch (operation->alg) {
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004826#if defined(PSA_WANT_ALG_GCM)
4827 case PSA_ALG_GCM:
4828 /* Lengths can only be too large for GCM if size_t is bigger than 32
Gilles Peskine449bd832023-01-11 14:50:10 +01004829 * bits. Without the guard this code will generate warnings on 32bit
4830 * builds. */
Paul Elliott325d3742021-09-27 17:56:28 +01004831#if SIZE_MAX > UINT32_MAX
Gilles Peskine449bd832023-01-11 14:50:10 +01004832 if (((uint64_t) ad_length) >> 61 != 0 ||
4833 ((uint64_t) plaintext_length) > 0xFFFFFFFE0ull) {
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004834 status = PSA_ERROR_INVALID_ARGUMENT;
4835 goto exit;
4836 }
Paul Elliott325d3742021-09-27 17:56:28 +01004837#endif
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004838 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004839#endif /* PSA_WANT_ALG_GCM */
4840#if defined(PSA_WANT_ALG_CCM)
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004841 case PSA_ALG_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01004842 if (ad_length > 0xFF00) {
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004843 status = PSA_ERROR_INVALID_ARGUMENT;
4844 goto exit;
4845 }
4846 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004847#endif /* PSA_WANT_ALG_CCM */
4848#if defined(PSA_WANT_ALG_CHACHA20_POLY1305)
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004849 case PSA_ALG_CHACHA20_POLY1305:
4850 /* No length restrictions for ChaChaPoly. */
4851 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004852#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004853 default:
4854 break;
4855 }
Paul Elliott325d3742021-09-27 17:56:28 +01004856
Gilles Peskine449bd832023-01-11 14:50:10 +01004857 status = psa_driver_wrapper_aead_set_lengths(operation, ad_length,
4858 plaintext_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004859
Paul Elliott39dc6b82021-05-11 19:16:09 +01004860exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004861 if (status == PSA_SUCCESS) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01004862 operation->ad_remaining = ad_length;
4863 operation->body_remaining = plaintext_length;
Paul Elliott39dc6b82021-05-11 19:16:09 +01004864 operation->lengths_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004865 } else {
4866 psa_aead_abort(operation);
Paul Elliottee4ffe02021-05-20 17:25:06 +01004867 }
Paul Elliott39dc6b82021-05-11 19:16:09 +01004868
Gilles Peskine449bd832023-01-11 14:50:10 +01004869 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004870}
Paul Elliott3d7d52c2021-09-01 10:33:14 +01004871
4872/* Pass additional data to an active multipart AEAD operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004873psa_status_t psa_aead_update_ad(psa_aead_operation_t *operation,
4874 const uint8_t *input,
4875 size_t input_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004876{
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004877 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4878
Gilles Peskine449bd832023-01-11 14:50:10 +01004879 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004880 status = PSA_ERROR_BAD_STATE;
4881 goto exit;
4882 }
4883
Gilles Peskine449bd832023-01-11 14:50:10 +01004884 if (!operation->nonce_set || operation->body_started) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004885 status = PSA_ERROR_BAD_STATE;
4886 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004887 }
4888
Gilles Peskine449bd832023-01-11 14:50:10 +01004889 if (operation->lengths_set) {
4890 if (operation->ad_remaining < input_length) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01004891 status = PSA_ERROR_INVALID_ARGUMENT;
4892 goto exit;
4893 }
4894
4895 operation->ad_remaining -= input_length;
4896 }
Paul Elliotte193ea82021-10-01 13:00:16 +01004897#if defined(PSA_WANT_ALG_CCM)
Gilles Peskine449bd832023-01-11 14:50:10 +01004898 else if (operation->alg == PSA_ALG_CCM) {
Paul Elliotte193ea82021-10-01 13:00:16 +01004899 status = PSA_ERROR_BAD_STATE;
4900 goto exit;
4901 }
4902#endif /* PSA_WANT_ALG_CCM */
Paul Elliottee4ffe02021-05-20 17:25:06 +01004903
Gilles Peskine449bd832023-01-11 14:50:10 +01004904 status = psa_driver_wrapper_aead_update_ad(operation, input,
4905 input_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004906
Paul Elliott39dc6b82021-05-11 19:16:09 +01004907exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004908 if (status == PSA_SUCCESS) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004909 operation->ad_started = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004910 } else {
4911 psa_aead_abort(operation);
4912 }
Paul Elliott39dc6b82021-05-11 19:16:09 +01004913
Gilles Peskine449bd832023-01-11 14:50:10 +01004914 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004915}
4916
4917/* Encrypt or decrypt a message fragment in an active multipart AEAD
4918 operation.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01004919psa_status_t psa_aead_update(psa_aead_operation_t *operation,
4920 const uint8_t *input,
4921 size_t input_length,
4922 uint8_t *output,
4923 size_t output_size,
4924 size_t *output_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004925{
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004926 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004927
4928 *output_length = 0;
4929
Gilles Peskine449bd832023-01-11 14:50:10 +01004930 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01004931 status = PSA_ERROR_BAD_STATE;
4932 goto exit;
4933 }
4934
Gilles Peskine449bd832023-01-11 14:50:10 +01004935 if (!operation->nonce_set) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004936 status = PSA_ERROR_BAD_STATE;
4937 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004938 }
4939
Gilles Peskine449bd832023-01-11 14:50:10 +01004940 if (operation->lengths_set) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01004941 /* Additional data length was supplied, but not all the additional
4942 data was supplied.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01004943 if (operation->ad_remaining != 0) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01004944 status = PSA_ERROR_INVALID_ARGUMENT;
4945 goto exit;
4946 }
4947
4948 /* Too much data provided. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004949 if (operation->body_remaining < input_length) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01004950 status = PSA_ERROR_INVALID_ARGUMENT;
4951 goto exit;
4952 }
4953
4954 operation->body_remaining -= input_length;
4955 }
Paul Elliotte193ea82021-10-01 13:00:16 +01004956#if defined(PSA_WANT_ALG_CCM)
Gilles Peskine449bd832023-01-11 14:50:10 +01004957 else if (operation->alg == PSA_ALG_CCM) {
Paul Elliotte193ea82021-10-01 13:00:16 +01004958 status = PSA_ERROR_BAD_STATE;
4959 goto exit;
4960 }
4961#endif /* PSA_WANT_ALG_CCM */
Paul Elliottee4ffe02021-05-20 17:25:06 +01004962
Gilles Peskine449bd832023-01-11 14:50:10 +01004963 status = psa_driver_wrapper_aead_update(operation, input, input_length,
4964 output, output_size,
4965 output_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01004966
Paul Elliott39dc6b82021-05-11 19:16:09 +01004967exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004968 if (status == PSA_SUCCESS) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01004969 operation->body_started = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004970 } else {
4971 psa_aead_abort(operation);
4972 }
Paul Elliott39dc6b82021-05-11 19:16:09 +01004973
Gilles Peskine449bd832023-01-11 14:50:10 +01004974 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01004975}
4976
Gilles Peskine449bd832023-01-11 14:50:10 +01004977static psa_status_t psa_aead_final_checks(const psa_aead_operation_t *operation)
Paul Elliottad53dcc2021-06-23 08:50:14 +01004978{
Gilles Peskine449bd832023-01-11 14:50:10 +01004979 if (operation->id == 0 || !operation->nonce_set) {
4980 return PSA_ERROR_BAD_STATE;
4981 }
Paul Elliottad53dcc2021-06-23 08:50:14 +01004982
Gilles Peskine449bd832023-01-11 14:50:10 +01004983 if (operation->lengths_set && (operation->ad_remaining != 0 ||
4984 operation->body_remaining != 0)) {
4985 return PSA_ERROR_INVALID_ARGUMENT;
4986 }
Paul Elliottad53dcc2021-06-23 08:50:14 +01004987
Gilles Peskine449bd832023-01-11 14:50:10 +01004988 return PSA_SUCCESS;
Paul Elliottad53dcc2021-06-23 08:50:14 +01004989}
4990
Paul Elliott302ff6b2021-04-20 18:10:30 +01004991/* Finish encrypting a message in a multipart AEAD operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004992psa_status_t psa_aead_finish(psa_aead_operation_t *operation,
4993 uint8_t *ciphertext,
4994 size_t ciphertext_size,
4995 size_t *ciphertext_length,
4996 uint8_t *tag,
4997 size_t tag_size,
4998 size_t *tag_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01004999{
Paul Elliott39dc6b82021-05-11 19:16:09 +01005000 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
5001
Paul Elliott302ff6b2021-04-20 18:10:30 +01005002 *ciphertext_length = 0;
Paul Elliottf88a5652021-06-22 17:53:45 +01005003 *tag_length = tag_size;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005004
Gilles Peskine449bd832023-01-11 14:50:10 +01005005 status = psa_aead_final_checks(operation);
5006 if (status != PSA_SUCCESS) {
Paul Elliottad53dcc2021-06-23 08:50:14 +01005007 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005008 }
Paul Elliottad53dcc2021-06-23 08:50:14 +01005009
Gilles Peskine449bd832023-01-11 14:50:10 +01005010 if (!operation->is_encrypt) {
Paul Elliottcee785c2021-05-20 14:29:20 +01005011 status = PSA_ERROR_BAD_STATE;
5012 goto exit;
5013 }
5014
Gilles Peskine449bd832023-01-11 14:50:10 +01005015 status = psa_driver_wrapper_aead_finish(operation, ciphertext,
5016 ciphertext_size,
5017 ciphertext_length,
5018 tag, tag_size, tag_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01005019
Paul Elliott39dc6b82021-05-11 19:16:09 +01005020exit:
Paul Elliottdc42ca82023-02-24 18:11:59 +00005021
5022
Paul Elliottf47b0952021-05-21 18:02:33 +01005023 /* In case the operation fails and the user fails to check for failure or
Paul Elliott4c916e82021-09-19 18:34:50 +01005024 * the zero tag size, make sure the tag is set to something implausible.
5025 * Even if the operation succeeds, make sure we clear the rest of the
5026 * buffer to prevent potential leakage of anything previously placed in
5027 * the same buffer.*/
Paul Elliottdc42ca82023-02-24 18:11:59 +00005028 psa_wipe_tag_output_buffer(tag, status, tag_size, *tag_length);
Paul Elliottf47b0952021-05-21 18:02:33 +01005029
Gilles Peskine449bd832023-01-11 14:50:10 +01005030 psa_aead_abort(operation);
Paul Elliott39dc6b82021-05-11 19:16:09 +01005031
Gilles Peskine449bd832023-01-11 14:50:10 +01005032 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005033}
5034
5035/* Finish authenticating and decrypting a message in a multipart AEAD
5036 operation.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01005037psa_status_t psa_aead_verify(psa_aead_operation_t *operation,
5038 uint8_t *plaintext,
5039 size_t plaintext_size,
5040 size_t *plaintext_length,
5041 const uint8_t *tag,
5042 size_t tag_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01005043{
Paul Elliott39dc6b82021-05-11 19:16:09 +01005044 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
5045
Paul Elliott302ff6b2021-04-20 18:10:30 +01005046 *plaintext_length = 0;
5047
Gilles Peskine449bd832023-01-11 14:50:10 +01005048 status = psa_aead_final_checks(operation);
5049 if (status != PSA_SUCCESS) {
Paul Elliottad53dcc2021-06-23 08:50:14 +01005050 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005051 }
Paul Elliottad53dcc2021-06-23 08:50:14 +01005052
Gilles Peskine449bd832023-01-11 14:50:10 +01005053 if (operation->is_encrypt) {
Paul Elliottcee785c2021-05-20 14:29:20 +01005054 status = PSA_ERROR_BAD_STATE;
5055 goto exit;
5056 }
5057
Gilles Peskine449bd832023-01-11 14:50:10 +01005058 status = psa_driver_wrapper_aead_verify(operation, plaintext,
5059 plaintext_size,
5060 plaintext_length,
5061 tag, tag_length);
Paul Elliott39dc6b82021-05-11 19:16:09 +01005062
5063exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01005064 psa_aead_abort(operation);
Paul Elliott39dc6b82021-05-11 19:16:09 +01005065
Gilles Peskine449bd832023-01-11 14:50:10 +01005066 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005067}
5068
5069/* Abort an AEAD operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005070psa_status_t psa_aead_abort(psa_aead_operation_t *operation)
Paul Elliott302ff6b2021-04-20 18:10:30 +01005071{
5072 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
5073
Gilles Peskine449bd832023-01-11 14:50:10 +01005074 if (operation->id == 0) {
Paul Elliott302ff6b2021-04-20 18:10:30 +01005075 /* The object has (apparently) been initialized but it is not (yet)
5076 * in use. It's ok to call abort on such an object, and there's
5077 * nothing to do. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005078 return PSA_SUCCESS;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005079 }
5080
Gilles Peskine449bd832023-01-11 14:50:10 +01005081 status = psa_driver_wrapper_aead_abort(operation);
Paul Elliott302ff6b2021-04-20 18:10:30 +01005082
Gilles Peskine449bd832023-01-11 14:50:10 +01005083 memset(operation, 0, sizeof(*operation));
Paul Elliott302ff6b2021-04-20 18:10:30 +01005084
Gilles Peskine449bd832023-01-11 14:50:10 +01005085 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005086}
5087
Gilles Peskinee59236f2018-01-27 23:32:46 +01005088/****************************************************************/
Gilles Peskineeab56e42018-07-12 17:12:33 +02005089/* Generators */
5090/****************************************************************/
5091
Przemek Stekiel69c46792022-06-10 12:59:51 +02005092#if defined(BUILTIN_ALG_ANY_HKDF) || \
John Durkop07cc04a2020-11-16 22:08:34 -08005093 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005094 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) || \
Kusumit Ghoderaoaf0b5342023-05-03 11:58:46 +05305095 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) || \
5096 defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC)
John Durkop07cc04a2020-11-16 22:08:34 -08005097#define AT_LEAST_ONE_BUILTIN_KDF
Steven Cooreman094a77e2021-05-06 17:58:36 +02005098#endif /* At least one builtin KDF */
5099
Przemek Stekiel69c46792022-06-10 12:59:51 +02005100#if defined(BUILTIN_ALG_ANY_HKDF) || \
Steven Cooreman094a77e2021-05-06 17:58:36 +02005101 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
5102 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
5103static psa_status_t psa_key_derivation_start_hmac(
5104 psa_mac_operation_t *operation,
5105 psa_algorithm_t hash_alg,
5106 const uint8_t *hmac_key,
Gilles Peskine449bd832023-01-11 14:50:10 +01005107 size_t hmac_key_length)
Steven Cooreman094a77e2021-05-06 17:58:36 +02005108{
5109 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
5110 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine449bd832023-01-11 14:50:10 +01005111 psa_set_key_type(&attributes, PSA_KEY_TYPE_HMAC);
5112 psa_set_key_bits(&attributes, PSA_BYTES_TO_BITS(hmac_key_length));
5113 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_HASH);
Steven Cooreman094a77e2021-05-06 17:58:36 +02005114
Steven Cooreman72f736a2021-05-07 14:14:37 +02005115 operation->is_sign = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01005116 operation->mac_size = PSA_HASH_LENGTH(hash_alg);
Steven Cooreman72f736a2021-05-07 14:14:37 +02005117
Gilles Peskine449bd832023-01-11 14:50:10 +01005118 status = psa_driver_wrapper_mac_sign_setup(operation,
5119 &attributes,
5120 hmac_key, hmac_key_length,
5121 PSA_ALG_HMAC(hash_alg));
Steven Cooreman094a77e2021-05-06 17:58:36 +02005122
Gilles Peskine449bd832023-01-11 14:50:10 +01005123 psa_reset_key_attributes(&attributes);
5124 return status;
Steven Cooreman094a77e2021-05-06 17:58:36 +02005125}
5126#endif /* KDF algorithms reliant on HMAC */
John Durkop07cc04a2020-11-16 22:08:34 -08005127
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005128#define HKDF_STATE_INIT 0 /* no input yet */
5129#define HKDF_STATE_STARTED 1 /* got salt */
5130#define HKDF_STATE_KEYED 2 /* got key */
5131#define HKDF_STATE_OUTPUT 3 /* output started */
5132
Gilles Peskinecbe66502019-05-16 16:59:18 +02005133static psa_algorithm_t psa_key_derivation_get_kdf_alg(
Gilles Peskine449bd832023-01-11 14:50:10 +01005134 const psa_key_derivation_operation_t *operation)
Gilles Peskine969c5d62019-01-16 15:53:06 +01005135{
Gilles Peskine449bd832023-01-11 14:50:10 +01005136 if (PSA_ALG_IS_KEY_AGREEMENT(operation->alg)) {
5137 return PSA_ALG_KEY_AGREEMENT_GET_KDF(operation->alg);
5138 } else {
5139 return operation->alg;
5140 }
Gilles Peskine969c5d62019-01-16 15:53:06 +01005141}
5142
Gilles Peskine449bd832023-01-11 14:50:10 +01005143psa_status_t psa_key_derivation_abort(psa_key_derivation_operation_t *operation)
Gilles Peskineeab56e42018-07-12 17:12:33 +02005144{
5145 psa_status_t status = PSA_SUCCESS;
Gilles Peskine449bd832023-01-11 14:50:10 +01005146 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation);
5147 if (kdf_alg == 0) {
Gilles Peskineeab56e42018-07-12 17:12:33 +02005148 /* The object has (apparently) been initialized but it is not
5149 * in use. It's ok to call abort on such an object, and there's
5150 * nothing to do. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005151 } else
Przemek Stekiel69c46792022-06-10 12:59:51 +02005152#if defined(BUILTIN_ALG_ANY_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01005153 if (PSA_ALG_IS_ANY_HKDF(kdf_alg)) {
5154 mbedtls_free(operation->ctx.hkdf.info);
5155 status = psa_mac_abort(&operation->ctx.hkdf.hmac);
5156 } else
Przemek Stekiel69c46792022-06-10 12:59:51 +02005157#endif /* BUILTIN_ALG_ANY_HKDF */
John Durkop07cc04a2020-11-16 22:08:34 -08005158#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
5159 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005160 if (PSA_ALG_IS_TLS12_PRF(kdf_alg) ||
5161 /* TLS-1.2 PSK-to-MS KDF uses the same core as TLS-1.2 PRF */
5162 PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
5163 if (operation->ctx.tls12_prf.secret != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01005164 mbedtls_zeroize_and_free(operation->ctx.tls12_prf.secret,
Gilles Peskine449bd832023-01-11 14:50:10 +01005165 operation->ctx.tls12_prf.secret_length);
Steven Cooremana6df6042021-04-29 19:32:25 +02005166 }
5167
Gilles Peskine449bd832023-01-11 14:50:10 +01005168 if (operation->ctx.tls12_prf.seed != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01005169 mbedtls_zeroize_and_free(operation->ctx.tls12_prf.seed,
Gilles Peskine449bd832023-01-11 14:50:10 +01005170 operation->ctx.tls12_prf.seed_length);
Janos Follath6a1d2622019-06-11 10:37:28 +01005171 }
5172
Gilles Peskine449bd832023-01-11 14:50:10 +01005173 if (operation->ctx.tls12_prf.label != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01005174 mbedtls_zeroize_and_free(operation->ctx.tls12_prf.label,
Gilles Peskine449bd832023-01-11 14:50:10 +01005175 operation->ctx.tls12_prf.label_length);
Janos Follath6a1d2622019-06-11 10:37:28 +01005176 }
Przemek Stekiel6c764412022-11-22 14:05:12 +01005177#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005178 if (operation->ctx.tls12_prf.other_secret != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01005179 mbedtls_zeroize_and_free(operation->ctx.tls12_prf.other_secret,
Gilles Peskine449bd832023-01-11 14:50:10 +01005180 operation->ctx.tls12_prf.other_secret_length);
Przemek Stekiele3ee2212022-04-07 14:29:56 +02005181 }
Przemek Stekiel6c764412022-11-22 14:05:12 +01005182#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Steven Cooremana6df6042021-04-29 19:32:25 +02005183 status = PSA_SUCCESS;
Janos Follath6a1d2622019-06-11 10:37:28 +01005184
5185 /* We leave the fields Ai and output_block to be erased safely by the
5186 * mbedtls_platform_zeroize() in the end of this function. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005187 } else
John Durkop07cc04a2020-11-16 22:08:34 -08005188#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) ||
5189 * defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) */
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005190#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005191 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
5192 mbedtls_platform_zeroize(operation->ctx.tls12_ecjpake_to_pms.data,
5193 sizeof(operation->ctx.tls12_ecjpake_to_pms.data));
5194 } else
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005195#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) */
Kusumit Ghoderaof5fedf12023-05-03 12:29:48 +05305196#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC)
5197 if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) {
Kusumit Ghoderaof5fedf12023-05-03 12:29:48 +05305198 if (operation->ctx.pbkdf2.salt != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01005199 mbedtls_zeroize_and_free(operation->ctx.pbkdf2.salt,
Kusumit Ghoderaof5fedf12023-05-03 12:29:48 +05305200 operation->ctx.pbkdf2.salt_length);
Kusumit Ghoderaof5fedf12023-05-03 12:29:48 +05305201 }
Kusumit Ghoderaof5fedf12023-05-03 12:29:48 +05305202
5203 status = PSA_SUCCESS;
5204 } else
5205#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC) */
Gilles Peskineeab56e42018-07-12 17:12:33 +02005206 {
5207 status = PSA_ERROR_BAD_STATE;
5208 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005209 mbedtls_platform_zeroize(operation, sizeof(*operation));
5210 return status;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005211}
5212
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005213psa_status_t psa_key_derivation_get_capacity(const psa_key_derivation_operation_t *operation,
Gilles Peskine449bd832023-01-11 14:50:10 +01005214 size_t *capacity)
Gilles Peskineeab56e42018-07-12 17:12:33 +02005215{
Gilles Peskine449bd832023-01-11 14:50:10 +01005216 if (operation->alg == 0) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005217 /* This is a blank key derivation operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005218 return PSA_ERROR_BAD_STATE;
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005219 }
5220
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005221 *capacity = operation->capacity;
Gilles Peskine449bd832023-01-11 14:50:10 +01005222 return PSA_SUCCESS;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005223}
5224
Gilles Peskine449bd832023-01-11 14:50:10 +01005225psa_status_t psa_key_derivation_set_capacity(psa_key_derivation_operation_t *operation,
5226 size_t capacity)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005227{
Gilles Peskine449bd832023-01-11 14:50:10 +01005228 if (operation->alg == 0) {
5229 return PSA_ERROR_BAD_STATE;
5230 }
5231 if (capacity > operation->capacity) {
5232 return PSA_ERROR_INVALID_ARGUMENT;
5233 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005234 operation->capacity = capacity;
Gilles Peskine449bd832023-01-11 14:50:10 +01005235 return PSA_SUCCESS;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005236}
5237
Przemek Stekiel69c46792022-06-10 12:59:51 +02005238#if defined(BUILTIN_ALG_ANY_HKDF)
Przemek Stekiel03d948c2022-05-19 11:45:20 +02005239/* Read some bytes from an HKDF-based operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005240static psa_status_t psa_key_derivation_hkdf_read(psa_hkdf_key_derivation_t *hkdf,
5241 psa_algorithm_t kdf_alg,
5242 uint8_t *output,
5243 size_t output_length)
Gilles Peskinebef7f142018-07-12 17:22:21 +02005244{
Gilles Peskine449bd832023-01-11 14:50:10 +01005245 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(kdf_alg);
5246 uint8_t hash_length = PSA_HASH_LENGTH(hash_alg);
Steven Cooremand1ed1d92021-04-29 19:11:25 +02005247 size_t hmac_output_length;
Gilles Peskinebef7f142018-07-12 17:22:21 +02005248 psa_status_t status;
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02005249#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01005250 const uint8_t last_block = PSA_ALG_IS_HKDF_EXTRACT(kdf_alg) ? 0 : 0xff;
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02005251#else
5252 const uint8_t last_block = 0xff;
5253#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Gilles Peskinebef7f142018-07-12 17:22:21 +02005254
Gilles Peskine449bd832023-01-11 14:50:10 +01005255 if (hkdf->state < HKDF_STATE_KEYED ||
5256 (!hkdf->info_set
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02005257#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01005258 && !PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02005259#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Gilles Peskine449bd832023-01-11 14:50:10 +01005260 )) {
5261 return PSA_ERROR_BAD_STATE;
5262 }
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005263 hkdf->state = HKDF_STATE_OUTPUT;
5264
Gilles Peskine449bd832023-01-11 14:50:10 +01005265 while (output_length != 0) {
Gilles Peskinebef7f142018-07-12 17:22:21 +02005266 /* Copy what remains of the current block */
5267 uint8_t n = hash_length - hkdf->offset_in_block;
Gilles Peskine449bd832023-01-11 14:50:10 +01005268 if (n > output_length) {
Gilles Peskinebef7f142018-07-12 17:22:21 +02005269 n = (uint8_t) output_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01005270 }
5271 memcpy(output, hkdf->output_block + hkdf->offset_in_block, n);
Gilles Peskinebef7f142018-07-12 17:22:21 +02005272 output += n;
5273 output_length -= n;
5274 hkdf->offset_in_block += n;
Gilles Peskine449bd832023-01-11 14:50:10 +01005275 if (output_length == 0) {
Gilles Peskinebef7f142018-07-12 17:22:21 +02005276 break;
Gilles Peskine449bd832023-01-11 14:50:10 +01005277 }
Przemek Stekiel03d948c2022-05-19 11:45:20 +02005278 /* We can't be wanting more output after the last block, otherwise
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02005279 * the capacity check in psa_key_derivation_output_bytes() would have
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005280 * prevented this call. It could happen only if the operation
Gilles Peskined54931c2018-07-17 21:06:59 +02005281 * object was corrupted or if this function is called directly
5282 * inside the library. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005283 if (hkdf->block_number == last_block) {
5284 return PSA_ERROR_BAD_STATE;
5285 }
Gilles Peskinebef7f142018-07-12 17:22:21 +02005286
5287 /* We need a new block */
5288 ++hkdf->block_number;
5289 hkdf->offset_in_block = 0;
Steven Cooremand1ed1d92021-04-29 19:11:25 +02005290
Gilles Peskine449bd832023-01-11 14:50:10 +01005291 status = psa_key_derivation_start_hmac(&hkdf->hmac,
5292 hash_alg,
5293 hkdf->prk,
5294 hash_length);
5295 if (status != PSA_SUCCESS) {
5296 return status;
Gilles Peskinebef7f142018-07-12 17:22:21 +02005297 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005298
5299 if (hkdf->block_number != 1) {
5300 status = psa_mac_update(&hkdf->hmac,
5301 hkdf->output_block,
5302 hash_length);
5303 if (status != PSA_SUCCESS) {
5304 return status;
5305 }
5306 }
5307 status = psa_mac_update(&hkdf->hmac,
5308 hkdf->info,
5309 hkdf->info_length);
5310 if (status != PSA_SUCCESS) {
5311 return status;
5312 }
5313 status = psa_mac_update(&hkdf->hmac,
5314 &hkdf->block_number, 1);
5315 if (status != PSA_SUCCESS) {
5316 return status;
5317 }
5318 status = psa_mac_sign_finish(&hkdf->hmac,
5319 hkdf->output_block,
5320 sizeof(hkdf->output_block),
5321 &hmac_output_length);
5322 if (status != PSA_SUCCESS) {
5323 return status;
5324 }
Gilles Peskinebef7f142018-07-12 17:22:21 +02005325 }
5326
Gilles Peskine449bd832023-01-11 14:50:10 +01005327 return PSA_SUCCESS;
Gilles Peskinebef7f142018-07-12 17:22:21 +02005328}
Przemek Stekiel69c46792022-06-10 12:59:51 +02005329#endif /* BUILTIN_ALG_ANY_HKDF */
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005330
John Durkop07cc04a2020-11-16 22:08:34 -08005331#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
5332 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Janos Follath7742fee2019-06-17 12:58:10 +01005333static psa_status_t psa_key_derivation_tls12_prf_generate_next_block(
5334 psa_tls12_prf_key_derivation_t *tls12_prf,
Gilles Peskine449bd832023-01-11 14:50:10 +01005335 psa_algorithm_t alg)
Janos Follath7742fee2019-06-17 12:58:10 +01005336{
Gilles Peskine449bd832023-01-11 14:50:10 +01005337 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(alg);
5338 uint8_t hash_length = PSA_HASH_LENGTH(hash_alg);
Steven Cooremana6df6042021-04-29 19:32:25 +02005339 psa_mac_operation_t hmac = PSA_MAC_OPERATION_INIT;
5340 size_t hmac_output_length;
Janos Follathea29bfb2019-06-19 12:21:20 +01005341 psa_status_t status, cleanup_status;
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005342
Janos Follath7742fee2019-06-17 12:58:10 +01005343 /* We can't be wanting more output after block 0xff, otherwise
5344 * the capacity check in psa_key_derivation_output_bytes() would have
5345 * prevented this call. It could happen only if the operation
5346 * object was corrupted or if this function is called directly
5347 * inside the library. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005348 if (tls12_prf->block_number == 0xff) {
5349 return PSA_ERROR_CORRUPTION_DETECTED;
5350 }
Janos Follath7742fee2019-06-17 12:58:10 +01005351
5352 /* We need a new block */
5353 ++tls12_prf->block_number;
Janos Follath844eb0e2019-06-19 12:10:49 +01005354 tls12_prf->left_in_block = hash_length;
Janos Follath7742fee2019-06-17 12:58:10 +01005355
5356 /* Recall the definition of the TLS-1.2-PRF from RFC 5246:
5357 *
5358 * PRF(secret, label, seed) = P_<hash>(secret, label + seed)
5359 *
5360 * P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
5361 * HMAC_hash(secret, A(2) + seed) +
5362 * HMAC_hash(secret, A(3) + seed) + ...
5363 *
5364 * A(0) = seed
Janos Follathea29bfb2019-06-19 12:21:20 +01005365 * A(i) = HMAC_hash(secret, A(i-1))
Janos Follath7742fee2019-06-17 12:58:10 +01005366 *
Janos Follathea29bfb2019-06-19 12:21:20 +01005367 * The `psa_tls12_prf_key_derivation` structure saves the block
Janos Follath7742fee2019-06-17 12:58:10 +01005368 * `HMAC_hash(secret, A(i) + seed)` from which the output
Janos Follath76c39842019-06-26 12:50:36 +01005369 * is currently extracted as `output_block` and where i is
5370 * `block_number`.
Janos Follath7742fee2019-06-17 12:58:10 +01005371 */
5372
Gilles Peskine449bd832023-01-11 14:50:10 +01005373 status = psa_key_derivation_start_hmac(&hmac,
5374 hash_alg,
5375 tls12_prf->secret,
5376 tls12_prf->secret_length);
5377 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005378 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005379 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005380
5381 /* Calculate A(i) where i = tls12_prf->block_number. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005382 if (tls12_prf->block_number == 1) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005383 /* A(1) = HMAC_hash(secret, A(0)), where A(0) = seed. (The RFC overloads
5384 * the variable seed and in this instance means it in the context of the
5385 * P_hash function, where seed = label + seed.) */
Gilles Peskine449bd832023-01-11 14:50:10 +01005386 status = psa_mac_update(&hmac,
5387 tls12_prf->label,
5388 tls12_prf->label_length);
5389 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005390 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005391 }
5392 status = psa_mac_update(&hmac,
5393 tls12_prf->seed,
5394 tls12_prf->seed_length);
5395 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005396 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005397 }
5398 } else {
Janos Follathea29bfb2019-06-19 12:21:20 +01005399 /* A(i) = HMAC_hash(secret, A(i-1)) */
Gilles Peskine449bd832023-01-11 14:50:10 +01005400 status = psa_mac_update(&hmac, tls12_prf->Ai, hash_length);
5401 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005402 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005403 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005404 }
5405
Gilles Peskine449bd832023-01-11 14:50:10 +01005406 status = psa_mac_sign_finish(&hmac,
5407 tls12_prf->Ai, hash_length,
5408 &hmac_output_length);
5409 if (hmac_output_length != hash_length) {
Steven Cooremana6df6042021-04-29 19:32:25 +02005410 status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine449bd832023-01-11 14:50:10 +01005411 }
5412 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005413 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005414 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005415
5416 /* Calculate HMAC_hash(secret, A(i) + label + seed). */
Gilles Peskine449bd832023-01-11 14:50:10 +01005417 status = psa_key_derivation_start_hmac(&hmac,
5418 hash_alg,
5419 tls12_prf->secret,
5420 tls12_prf->secret_length);
5421 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005422 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005423 }
5424 status = psa_mac_update(&hmac, tls12_prf->Ai, hash_length);
5425 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005426 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005427 }
5428 status = psa_mac_update(&hmac, tls12_prf->label, tls12_prf->label_length);
5429 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005430 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005431 }
5432 status = psa_mac_update(&hmac, tls12_prf->seed, tls12_prf->seed_length);
5433 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005434 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005435 }
5436 status = psa_mac_sign_finish(&hmac,
5437 tls12_prf->output_block, hash_length,
5438 &hmac_output_length);
5439 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005440 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005441 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005442
Janos Follath7742fee2019-06-17 12:58:10 +01005443
5444cleanup:
Gilles Peskine449bd832023-01-11 14:50:10 +01005445 cleanup_status = psa_mac_abort(&hmac);
5446 if (status == PSA_SUCCESS && cleanup_status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005447 status = cleanup_status;
Gilles Peskine449bd832023-01-11 14:50:10 +01005448 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005449
Gilles Peskine449bd832023-01-11 14:50:10 +01005450 return status;
Janos Follath7742fee2019-06-17 12:58:10 +01005451}
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005452
Janos Follath844eb0e2019-06-19 12:10:49 +01005453static psa_status_t psa_key_derivation_tls12_prf_read(
5454 psa_tls12_prf_key_derivation_t *tls12_prf,
5455 psa_algorithm_t alg,
5456 uint8_t *output,
Gilles Peskine449bd832023-01-11 14:50:10 +01005457 size_t output_length)
Janos Follath844eb0e2019-06-19 12:10:49 +01005458{
Gilles Peskine449bd832023-01-11 14:50:10 +01005459 psa_algorithm_t hash_alg = PSA_ALG_TLS12_PRF_GET_HASH(alg);
5460 uint8_t hash_length = PSA_HASH_LENGTH(hash_alg);
Janos Follath844eb0e2019-06-19 12:10:49 +01005461 psa_status_t status;
5462 uint8_t offset, length;
5463
Gilles Peskine449bd832023-01-11 14:50:10 +01005464 switch (tls12_prf->state) {
Gilles Peskineb1edaec2021-06-11 22:41:46 +02005465 case PSA_TLS12_PRF_STATE_LABEL_SET:
5466 tls12_prf->state = PSA_TLS12_PRF_STATE_OUTPUT;
5467 break;
5468 case PSA_TLS12_PRF_STATE_OUTPUT:
5469 break;
5470 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01005471 return PSA_ERROR_BAD_STATE;
Gilles Peskineb1edaec2021-06-11 22:41:46 +02005472 }
5473
Gilles Peskine449bd832023-01-11 14:50:10 +01005474 while (output_length != 0) {
Janos Follath844eb0e2019-06-19 12:10:49 +01005475 /* Check if we have fully processed the current block. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005476 if (tls12_prf->left_in_block == 0) {
5477 status = psa_key_derivation_tls12_prf_generate_next_block(tls12_prf,
5478 alg);
5479 if (status != PSA_SUCCESS) {
5480 return status;
5481 }
Janos Follath844eb0e2019-06-19 12:10:49 +01005482
5483 continue;
5484 }
5485
Gilles Peskine449bd832023-01-11 14:50:10 +01005486 if (tls12_prf->left_in_block > output_length) {
Janos Follath844eb0e2019-06-19 12:10:49 +01005487 length = (uint8_t) output_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01005488 } else {
Janos Follath844eb0e2019-06-19 12:10:49 +01005489 length = tls12_prf->left_in_block;
Gilles Peskine449bd832023-01-11 14:50:10 +01005490 }
Janos Follath844eb0e2019-06-19 12:10:49 +01005491
5492 offset = hash_length - tls12_prf->left_in_block;
Gilles Peskine449bd832023-01-11 14:50:10 +01005493 memcpy(output, tls12_prf->output_block + offset, length);
Janos Follath844eb0e2019-06-19 12:10:49 +01005494 output += length;
5495 output_length -= length;
5496 tls12_prf->left_in_block -= length;
5497 }
5498
Gilles Peskine449bd832023-01-11 14:50:10 +01005499 return PSA_SUCCESS;
Janos Follath844eb0e2019-06-19 12:10:49 +01005500}
John Durkop07cc04a2020-11-16 22:08:34 -08005501#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF ||
5502 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Gilles Peskinebef7f142018-07-12 17:22:21 +02005503
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005504#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
5505static psa_status_t psa_key_derivation_tls12_ecjpake_to_pms_read(
5506 psa_tls12_ecjpake_to_pms_t *ecjpake,
5507 uint8_t *output,
Gilles Peskine449bd832023-01-11 14:50:10 +01005508 size_t output_length)
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005509{
5510 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Andrzej Kurek5603efd2022-09-26 10:49:16 -04005511 size_t output_size = 0;
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005512
Gilles Peskine449bd832023-01-11 14:50:10 +01005513 if (output_length != 32) {
5514 return PSA_ERROR_INVALID_ARGUMENT;
5515 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005516
Gilles Peskine449bd832023-01-11 14:50:10 +01005517 status = psa_hash_compute(PSA_ALG_SHA_256, ecjpake->data,
5518 PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE, output, output_length,
5519 &output_size);
5520 if (status != PSA_SUCCESS) {
5521 return status;
5522 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005523
Gilles Peskine449bd832023-01-11 14:50:10 +01005524 if (output_size != output_length) {
5525 return PSA_ERROR_GENERIC_ERROR;
5526 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005527
Gilles Peskine449bd832023-01-11 14:50:10 +01005528 return PSA_SUCCESS;
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005529}
5530#endif
5531
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305532#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC)
5533static psa_status_t psa_key_derivation_pbkdf2_generate_block(
5534 psa_pbkdf2_key_derivation_t *pbkdf2,
5535 psa_algorithm_t prf_alg,
5536 uint8_t prf_output_length,
5537 psa_key_attributes_t *attributes)
5538{
5539 psa_status_t status;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305540 psa_mac_operation_t mac_operation = PSA_MAC_OPERATION_INIT;
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305541 size_t mac_output_length;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305542 uint8_t U_i[PSA_MAC_MAX_SIZE];
Kusumit Ghoderao257ea002023-06-14 15:55:11 +05305543 uint8_t *U_accumulator = pbkdf2->output_block;
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305544 uint64_t i;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305545 uint8_t block_counter[4];
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305546
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305547 mac_operation.is_sign = 1;
5548 mac_operation.mac_size = prf_output_length;
5549 MBEDTLS_PUT_UINT32_BE(pbkdf2->block_number, block_counter, 0);
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305550
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305551 status = psa_driver_wrapper_mac_sign_setup(&mac_operation,
5552 attributes,
5553 pbkdf2->password,
5554 pbkdf2->password_length,
5555 prf_alg);
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305556 if (status != PSA_SUCCESS) {
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305557 goto cleanup;
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305558 }
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305559 status = psa_mac_update(&mac_operation, pbkdf2->salt, pbkdf2->salt_length);
5560 if (status != PSA_SUCCESS) {
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305561 goto cleanup;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305562 }
Kusumit Ghoderao257ea002023-06-14 15:55:11 +05305563 status = psa_mac_update(&mac_operation, block_counter, sizeof(block_counter));
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305564 if (status != PSA_SUCCESS) {
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305565 goto cleanup;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305566 }
5567 status = psa_mac_sign_finish(&mac_operation, U_i, sizeof(U_i),
5568 &mac_output_length);
5569 if (status != PSA_SUCCESS) {
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305570 goto cleanup;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305571 }
5572
5573 if (mac_output_length != prf_output_length) {
Kusumit Ghoderao257ea002023-06-14 15:55:11 +05305574 status = PSA_ERROR_CORRUPTION_DETECTED;
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305575 goto cleanup;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305576 }
5577
Kusumit Ghoderao257ea002023-06-14 15:55:11 +05305578 memcpy(U_accumulator, U_i, prf_output_length);
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305579
5580 for (i = 1; i < pbkdf2->input_cost; i++) {
5581 status = psa_driver_wrapper_mac_compute(attributes,
5582 pbkdf2->password,
5583 pbkdf2->password_length,
5584 prf_alg, U_i, prf_output_length,
Kusumit Ghoderao109ee3d2023-06-08 16:36:45 +05305585 U_i, sizeof(U_i),
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305586 &mac_output_length);
5587 if (status != PSA_SUCCESS) {
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305588 goto cleanup;
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305589 }
5590
Kusumit Ghoderao109ee3d2023-06-08 16:36:45 +05305591 mbedtls_xor(U_accumulator, U_accumulator, U_i, prf_output_length);
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305592 }
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305593
5594cleanup:
5595 /* Zeroise buffers to clear sensitive data from memory. */
5596 mbedtls_platform_zeroize(U_i, PSA_MAC_MAX_SIZE);
5597 return status;
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305598}
Kusumit Ghoderaof6a0d572023-06-05 14:55:56 +05305599
5600static psa_status_t psa_key_derivation_pbkdf2_read(
5601 psa_pbkdf2_key_derivation_t *pbkdf2,
5602 psa_algorithm_t kdf_alg,
5603 uint8_t *output,
5604 size_t output_length)
5605{
5606 psa_status_t status;
5607 psa_algorithm_t prf_alg;
5608 uint8_t prf_output_length;
5609 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
5610 psa_set_key_bits(&attributes, PSA_BYTES_TO_BITS(pbkdf2->password_length));
5611 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_MESSAGE);
5612
5613 if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) {
5614 prf_alg = PSA_ALG_HMAC(PSA_ALG_PBKDF2_HMAC_GET_HASH(kdf_alg));
5615 prf_output_length = PSA_HASH_LENGTH(prf_alg);
5616 psa_set_key_type(&attributes, PSA_KEY_TYPE_HMAC);
Kusumit Ghoderaod9ec1af2023-06-08 20:19:51 +05305617 } else {
5618 return PSA_ERROR_INVALID_ARGUMENT;
Kusumit Ghoderaof6a0d572023-06-05 14:55:56 +05305619 }
5620
5621 switch (pbkdf2->state) {
5622 case PSA_PBKDF2_STATE_PASSWORD_SET:
5623 /* Initially we need a new block so bytes_used is equal to block size*/
5624 pbkdf2->bytes_used = prf_output_length;
5625 pbkdf2->state = PSA_PBKDF2_STATE_OUTPUT;
5626 break;
5627 case PSA_PBKDF2_STATE_OUTPUT:
5628 break;
5629 default:
5630 return PSA_ERROR_BAD_STATE;
5631 }
5632
5633 while (output_length != 0) {
5634 uint8_t n = prf_output_length - pbkdf2->bytes_used;
5635 if (n > output_length) {
5636 n = (uint8_t) output_length;
5637 }
5638 memcpy(output, pbkdf2->output_block + pbkdf2->bytes_used, n);
5639 output += n;
5640 output_length -= n;
5641 pbkdf2->bytes_used += n;
5642
5643 if (output_length == 0) {
5644 break;
5645 }
5646
5647 /* We need a new block */
5648 pbkdf2->bytes_used = 0;
5649 pbkdf2->block_number++;
5650
5651 status = psa_key_derivation_pbkdf2_generate_block(pbkdf2, prf_alg,
5652 prf_output_length,
5653 &attributes);
5654 if (status != PSA_SUCCESS) {
5655 return status;
5656 }
5657 }
5658
5659 return PSA_SUCCESS;
5660}
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305661#endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC */
5662
Janos Follath6c6c8fc2019-06-17 12:38:20 +01005663psa_status_t psa_key_derivation_output_bytes(
5664 psa_key_derivation_operation_t *operation,
5665 uint8_t *output,
Gilles Peskine449bd832023-01-11 14:50:10 +01005666 size_t output_length)
Gilles Peskineeab56e42018-07-12 17:12:33 +02005667{
5668 psa_status_t status;
Gilles Peskine449bd832023-01-11 14:50:10 +01005669 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation);
Gilles Peskineeab56e42018-07-12 17:12:33 +02005670
Gilles Peskine449bd832023-01-11 14:50:10 +01005671 if (operation->alg == 0) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005672 /* This is a blank operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005673 return PSA_ERROR_BAD_STATE;
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005674 }
5675
Gilles Peskine449bd832023-01-11 14:50:10 +01005676 if (output_length > operation->capacity) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005677 operation->capacity = 0;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005678 /* Go through the error path to wipe all confidential data now
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005679 * that the operation object is useless. */
David Saadab4ecc272019-02-14 13:48:10 +02005680 status = PSA_ERROR_INSUFFICIENT_DATA;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005681 goto exit;
5682 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005683 if (output_length == 0 && operation->capacity == 0) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005684 /* Edge case: this is a finished operation, and 0 bytes
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005685 * were requested. The right error in this case could
Gilles Peskineeab56e42018-07-12 17:12:33 +02005686 * be either INSUFFICIENT_CAPACITY or BAD_STATE. Return
5687 * INSUFFICIENT_CAPACITY, which is right for a finished
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005688 * operation, for consistency with the case when
Gilles Peskineeab56e42018-07-12 17:12:33 +02005689 * output_length > 0. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005690 return PSA_ERROR_INSUFFICIENT_DATA;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005691 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005692 operation->capacity -= output_length;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005693
Przemek Stekiel69c46792022-06-10 12:59:51 +02005694#if defined(BUILTIN_ALG_ANY_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01005695 if (PSA_ALG_IS_ANY_HKDF(kdf_alg)) {
5696 status = psa_key_derivation_hkdf_read(&operation->ctx.hkdf, kdf_alg,
5697 output, output_length);
5698 } else
Przemek Stekiel69c46792022-06-10 12:59:51 +02005699#endif /* BUILTIN_ALG_ANY_HKDF */
John Durkop07cc04a2020-11-16 22:08:34 -08005700#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
5701 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005702 if (PSA_ALG_IS_TLS12_PRF(kdf_alg) ||
5703 PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
5704 status = psa_key_derivation_tls12_prf_read(&operation->ctx.tls12_prf,
5705 kdf_alg, output,
5706 output_length);
5707 } else
John Durkop07cc04a2020-11-16 22:08:34 -08005708#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF ||
5709 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005710#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005711 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005712 status = psa_key_derivation_tls12_ecjpake_to_pms_read(
Gilles Peskine449bd832023-01-11 14:50:10 +01005713 &operation->ctx.tls12_ecjpake_to_pms, output, output_length);
5714 } else
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005715#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */
Kusumit Ghoderao056f0c52023-05-03 15:58:34 +05305716#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC)
5717 if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) {
Kusumit Ghoderaof6a0d572023-06-05 14:55:56 +05305718 status = psa_key_derivation_pbkdf2_read(&operation->ctx.pbkdf2, kdf_alg,
5719 output, output_length);
Kusumit Ghoderao056f0c52023-05-03 15:58:34 +05305720 } else
5721#endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC */
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005722
Gilles Peskineeab56e42018-07-12 17:12:33 +02005723 {
Steven Cooreman74afe472021-02-10 17:19:22 +01005724 (void) kdf_alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01005725 return PSA_ERROR_BAD_STATE;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005726 }
5727
5728exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01005729 if (status != PSA_SUCCESS) {
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005730 /* Preserve the algorithm upon errors, but clear all sensitive state.
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005731 * This allows us to differentiate between exhausted operations and
5732 * blank operations, so we can return PSA_ERROR_BAD_STATE on blank
5733 * operations. */
5734 psa_algorithm_t alg = operation->alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01005735 psa_key_derivation_abort(operation);
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005736 operation->alg = alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01005737 memset(output, '!', output_length);
Gilles Peskineeab56e42018-07-12 17:12:33 +02005738 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005739 return status;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005740}
5741
David Brown7807bf72021-02-09 16:28:23 -07005742#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Gilles Peskine449bd832023-01-11 14:50:10 +01005743static void psa_des_set_key_parity(uint8_t *data, size_t data_size)
Gilles Peskine08542d82018-07-19 17:05:42 +02005744{
Gilles Peskine449bd832023-01-11 14:50:10 +01005745 if (data_size >= 8) {
5746 mbedtls_des_key_set_parity(data);
5747 }
5748 if (data_size >= 16) {
5749 mbedtls_des_key_set_parity(data + 8);
5750 }
5751 if (data_size >= 24) {
5752 mbedtls_des_key_set_parity(data + 16);
5753 }
Gilles Peskine08542d82018-07-19 17:05:42 +02005754}
David Brown7807bf72021-02-09 16:28:23 -07005755#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */
Gilles Peskine08542d82018-07-19 17:05:42 +02005756
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005757/*
Gilles Peskine449bd832023-01-11 14:50:10 +01005758 * ECC keys on a Weierstrass elliptic curve require the generation
5759 * of a private key which is an integer
5760 * in the range [1, N - 1], where N is the boundary of the private key domain:
5761 * N is the prime p for Diffie-Hellman, or the order of the
5762 * curve’s base point for ECC.
5763 *
5764 * Let m be the bit size of N, such that 2^m > N >= 2^(m-1).
5765 * This function generates the private key using the following process:
5766 *
5767 * 1. Draw a byte string of length ceiling(m/8) bytes.
5768 * 2. If m is not a multiple of 8, set the most significant
5769 * (8 * ceiling(m/8) - m) bits of the first byte in the string to zero.
5770 * 3. Convert the string to integer k by decoding it as a big-endian byte string.
5771 * 4. If k > N - 2, discard the result and return to step 1.
5772 * 5. Output k + 1 as the private key.
5773 *
5774 * This method allows compliance to NIST standards, specifically the methods titled
5775 * Key-Pair Generation by Testing Candidates in the following publications:
5776 * - NIST Special Publication 800-56A: Recommendation for Pair-Wise Key-Establishment
5777 * Schemes Using Discrete Logarithm Cryptography [SP800-56A] §5.6.1.1.4 for
5778 * Diffie-Hellman keys.
5779 *
5780 * - [SP800-56A] §5.6.1.2.2 or FIPS Publication 186-4: Digital Signature
5781 * Standard (DSS) [FIPS186-4] §B.4.2 for elliptic curve keys.
5782 *
5783 * Note: Function allocates memory for *data buffer, so given *data should be
5784 * always NULL.
5785 */
Valerio Setti86587ab2023-06-27 13:09:30 +02005786#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE)
5787#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE)
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01005788static psa_status_t psa_generate_derived_ecc_key_weierstrass_helper(
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005789 psa_key_slot_t *slot,
5790 size_t bits,
5791 psa_key_derivation_operation_t *operation,
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005792 uint8_t **data
5793 )
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005794{
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005795 unsigned key_out_of_range = 1;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005796 mbedtls_mpi k;
5797 mbedtls_mpi diff_N_2;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005798 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Przemek Stekiela81aed22022-03-01 15:13:30 +01005799 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01005800 size_t m;
5801 size_t m_bytes;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005802
Gilles Peskine449bd832023-01-11 14:50:10 +01005803 mbedtls_mpi_init(&k);
5804 mbedtls_mpi_init(&diff_N_2);
Przemyslaw Stekiel1dfd1222021-11-18 13:35:00 +01005805
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005806 psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY(
Gilles Peskine449bd832023-01-11 14:50:10 +01005807 slot->attr.type);
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005808 mbedtls_ecp_group_id grp_id =
Gilles Peskine449bd832023-01-11 14:50:10 +01005809 mbedtls_ecc_group_of_psa(curve, bits, 0);
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005810
Gilles Peskine449bd832023-01-11 14:50:10 +01005811 if (grp_id == MBEDTLS_ECP_DP_NONE) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005812 ret = MBEDTLS_ERR_ASN1_INVALID_DATA;
Przemyslaw Stekiel871a3362021-12-02 08:46:39 +01005813 goto cleanup;
5814 }
5815
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005816 mbedtls_ecp_group ecp_group;
Gilles Peskine449bd832023-01-11 14:50:10 +01005817 mbedtls_ecp_group_init(&ecp_group);
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005818
Gilles Peskine449bd832023-01-11 14:50:10 +01005819 MBEDTLS_MPI_CHK(mbedtls_ecp_group_load(&ecp_group, grp_id));
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005820
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005821 /* N is the boundary of the private key domain (ecp_group.N). */
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005822 /* Let m be the bit size of N. */
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01005823 m = ecp_group.nbits;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005824
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01005825 m_bytes = PSA_BITS_TO_BYTES(m);
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005826
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005827 /* Calculate N - 2 - it will be needed later. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005828 MBEDTLS_MPI_CHK(mbedtls_mpi_sub_int(&diff_N_2, &ecp_group.N, 2));
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005829
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005830 /* Note: This function is always called with *data == NULL and it
5831 * allocates memory for the data buffer. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005832 *data = mbedtls_calloc(1, m_bytes);
5833 if (*data == NULL) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005834 ret = MBEDTLS_ERR_ASN1_ALLOC_FAILED;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005835 goto cleanup;
5836 }
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005837
Gilles Peskine449bd832023-01-11 14:50:10 +01005838 while (key_out_of_range) {
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005839 /* 1. Draw a byte string of length ceiling(m/8) bytes. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005840 if ((status = psa_key_derivation_output_bytes(operation, *data, m_bytes)) != 0) {
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005841 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005842 }
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005843
5844 /* 2. If m is not a multiple of 8 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005845 if (m % 8 != 0) {
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005846 /* Set the most significant
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005847 * (8 * ceiling(m/8) - m) bits of the first byte in
5848 * the string to zero.
5849 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005850 uint8_t clear_bit_mask = (1 << (m % 8)) - 1;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005851 (*data)[0] &= clear_bit_mask;
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005852 }
5853
5854 /* 3. Convert the string to integer k by decoding it as a
Gilles Peskine449bd832023-01-11 14:50:10 +01005855 * big-endian byte string.
5856 */
5857 MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(&k, *data, m_bytes));
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005858
5859 /* 4. If k > N - 2, discard the result and return to step 1.
Gilles Peskine449bd832023-01-11 14:50:10 +01005860 * Result of comparison is returned. When it indicates error
5861 * then this function is called again.
5862 */
5863 MBEDTLS_MPI_CHK(mbedtls_mpi_lt_mpi_ct(&diff_N_2, &k, &key_out_of_range));
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005864 }
5865
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005866 /* 5. Output k + 1 as the private key. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005867 MBEDTLS_MPI_CHK(mbedtls_mpi_add_int(&k, &k, 1));
5868 MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(&k, *data, m_bytes));
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005869cleanup:
Gilles Peskine449bd832023-01-11 14:50:10 +01005870 if (ret != 0) {
5871 status = mbedtls_to_psa_error(ret);
5872 }
5873 if (status != PSA_SUCCESS) {
5874 mbedtls_free(*data);
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005875 *data = NULL;
5876 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005877 mbedtls_mpi_free(&k);
5878 mbedtls_mpi_free(&diff_N_2);
5879 return status;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005880}
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005881
5882/* ECC keys on a Montgomery elliptic curve draws a byte string whose length
5883 * is determined by the curve, and sets the mandatory bits accordingly. That is:
5884 *
5885 * - Curve25519 (PSA_ECC_FAMILY_MONTGOMERY, 255 bits):
5886 * draw a 32-byte string and process it as specified in
5887 * Elliptic Curves for Security [RFC7748] §5.
5888 *
5889 * - Curve448 (PSA_ECC_FAMILY_MONTGOMERY, 448 bits):
5890 * draw a 56-byte string and process it as specified in [RFC7748] §5.
5891 *
5892 * Note: Function allocates memory for *data buffer, so given *data should be
5893 * always NULL.
5894 */
5895
5896static psa_status_t psa_generate_derived_ecc_key_montgomery_helper(
5897 size_t bits,
5898 psa_key_derivation_operation_t *operation,
5899 uint8_t **data
5900 )
5901{
5902 size_t output_length;
Przemek Stekiela81aed22022-03-01 15:13:30 +01005903 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005904
Gilles Peskine449bd832023-01-11 14:50:10 +01005905 switch (bits) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005906 case 255:
5907 output_length = 32;
5908 break;
5909 case 448:
5910 output_length = 56;
5911 break;
5912 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01005913 return PSA_ERROR_INVALID_ARGUMENT;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005914 break;
5915 }
5916
Gilles Peskine449bd832023-01-11 14:50:10 +01005917 *data = mbedtls_calloc(1, output_length);
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005918
Gilles Peskine449bd832023-01-11 14:50:10 +01005919 if (*data == NULL) {
5920 return PSA_ERROR_INSUFFICIENT_MEMORY;
5921 }
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005922
Gilles Peskine449bd832023-01-11 14:50:10 +01005923 status = psa_key_derivation_output_bytes(operation, *data, output_length);
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005924
Gilles Peskine449bd832023-01-11 14:50:10 +01005925 if (status != PSA_SUCCESS) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005926 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01005927 }
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005928
Gilles Peskine449bd832023-01-11 14:50:10 +01005929 switch (bits) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005930 case 255:
5931 (*data)[0] &= 248;
5932 (*data)[31] &= 127;
5933 (*data)[31] |= 64;
5934 break;
5935 case 448:
5936 (*data)[0] &= 252;
5937 (*data)[55] |= 128;
5938 break;
5939 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01005940 return PSA_ERROR_CORRUPTION_DETECTED;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01005941 break;
5942 }
5943
5944 return status;
5945}
Valerio Setti86587ab2023-06-27 13:09:30 +02005946#else /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE */
5947static psa_status_t psa_generate_derived_ecc_key_weierstrass_helper(
5948 psa_key_slot_t *slot, size_t bits,
5949 psa_key_derivation_operation_t *operation, uint8_t **data)
5950{
5951 (void) slot;
5952 (void) bits;
5953 (void) operation;
5954 (void) data;
5955 return PSA_ERROR_NOT_SUPPORTED;
5956}
5957
5958static psa_status_t psa_generate_derived_ecc_key_montgomery_helper(
5959 size_t bits, psa_key_derivation_operation_t *operation, uint8_t **data)
5960{
5961 (void) bits;
5962 (void) operation;
5963 (void) data;
5964 return PSA_ERROR_NOT_SUPPORTED;
5965}
5966#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE */
5967#endif /* PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE */
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01005968
Adrian L. Shaw5a5a79a2019-05-03 15:44:28 +01005969static psa_status_t psa_generate_derived_key_internal(
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005970 psa_key_slot_t *slot,
5971 size_t bits,
Gilles Peskine449bd832023-01-11 14:50:10 +01005972 psa_key_derivation_operation_t *operation)
Gilles Peskineeab56e42018-07-12 17:12:33 +02005973{
5974 uint8_t *data = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01005975 size_t bytes = PSA_BITS_TO_BYTES(bits);
Archanad8a83dc2021-06-14 10:04:16 +05305976 size_t storage_size = bytes;
Przemek Stekiela81aed22022-03-01 15:13:30 +01005977 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01005978 psa_key_attributes_t attributes;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005979
Gilles Peskine449bd832023-01-11 14:50:10 +01005980 if (PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type)) {
5981 return PSA_ERROR_INVALID_ARGUMENT;
5982 }
Gilles Peskineeab56e42018-07-12 17:12:33 +02005983
Valerio Setti8ffdb5d2023-06-20 13:14:08 +02005984#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE) || \
Valerio Settidd24f292023-06-26 12:21:17 +02005985 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE)
Gilles Peskine449bd832023-01-11 14:50:10 +01005986 if (PSA_KEY_TYPE_IS_ECC(slot->attr.type)) {
5987 psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY(slot->attr.type);
5988 if (PSA_ECC_FAMILY_IS_WEIERSTRASS(curve)) {
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01005989 /* Weierstrass elliptic curve */
Gilles Peskine449bd832023-01-11 14:50:10 +01005990 status = psa_generate_derived_ecc_key_weierstrass_helper(slot, bits, operation, &data);
5991 if (status != PSA_SUCCESS) {
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01005992 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005993 }
5994 } else {
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01005995 /* Montgomery elliptic curve */
Gilles Peskine449bd832023-01-11 14:50:10 +01005996 status = psa_generate_derived_ecc_key_montgomery_helper(bits, operation, &data);
5997 if (status != PSA_SUCCESS) {
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01005998 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005999 }
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01006000 }
Przemyslaw Stekiel1dfd1222021-11-18 13:35:00 +01006001 } else
Valerio Setti8ffdb5d2023-06-20 13:14:08 +02006002#endif /* defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE) ||
Valerio Settidd24f292023-06-26 12:21:17 +02006003 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE) */
Gilles Peskine449bd832023-01-11 14:50:10 +01006004 if (key_type_is_raw_bytes(slot->attr.type)) {
6005 if (bits % 8 != 0) {
6006 return PSA_ERROR_INVALID_ARGUMENT;
6007 }
6008 data = mbedtls_calloc(1, bytes);
6009 if (data == NULL) {
6010 return PSA_ERROR_INSUFFICIENT_MEMORY;
6011 }
Przemyslaw Stekiel1608e332021-11-09 10:46:40 +01006012
Gilles Peskine449bd832023-01-11 14:50:10 +01006013 status = psa_key_derivation_output_bytes(operation, data, bytes);
6014 if (status != PSA_SUCCESS) {
Przemyslaw Stekiel1608e332021-11-09 10:46:40 +01006015 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006016 }
David Brown12ca5032021-02-11 11:02:00 -07006017#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Gilles Peskine449bd832023-01-11 14:50:10 +01006018 if (slot->attr.type == PSA_KEY_TYPE_DES) {
6019 psa_des_set_key_parity(data, bytes);
6020 }
Przemek Stekielf110dc02022-03-01 14:48:05 +01006021#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES) */
Gilles Peskine449bd832023-01-11 14:50:10 +01006022 } else {
6023 return PSA_ERROR_NOT_SUPPORTED;
Przemyslaw Stekiel1608e332021-11-09 10:46:40 +01006024 }
Ronald Crondd04d422020-11-28 15:14:42 +01006025
Ronald Cronbf33c932020-11-28 18:06:53 +01006026 slot->attr.bits = (psa_key_bits_t) bits;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01006027 attributes = (psa_key_attributes_t) {
Gilles Peskine449bd832023-01-11 14:50:10 +01006028 .core = slot->attr
Ronald Cron2ebfdcc2020-11-28 15:54:54 +01006029 };
6030
Gilles Peskine449bd832023-01-11 14:50:10 +01006031 if (psa_key_lifetime_is_external(attributes.core.lifetime)) {
6032 status = psa_driver_wrapper_get_key_buffer_size(&attributes,
6033 &storage_size);
6034 if (status != PSA_SUCCESS) {
Archanad8a83dc2021-06-14 10:04:16 +05306035 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006036 }
Archanad8a83dc2021-06-14 10:04:16 +05306037 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006038 status = psa_allocate_buffer_to_slot(slot, storage_size);
6039 if (status != PSA_SUCCESS) {
Archanad8a83dc2021-06-14 10:04:16 +05306040 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006041 }
Archanad8a83dc2021-06-14 10:04:16 +05306042
Gilles Peskine449bd832023-01-11 14:50:10 +01006043 status = psa_driver_wrapper_import_key(&attributes,
6044 data, bytes,
6045 slot->key.data,
6046 slot->key.bytes,
6047 &slot->key.bytes, &bits);
6048 if (bits != slot->attr.bits) {
Ronald Cronbf33c932020-11-28 18:06:53 +01006049 status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine449bd832023-01-11 14:50:10 +01006050 }
Gilles Peskineeab56e42018-07-12 17:12:33 +02006051
6052exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01006053 mbedtls_free(data);
6054 return status;
Gilles Peskineeab56e42018-07-12 17:12:33 +02006055}
6056
Gilles Peskine449bd832023-01-11 14:50:10 +01006057psa_status_t psa_key_derivation_output_key(const psa_key_attributes_t *attributes,
6058 psa_key_derivation_operation_t *operation,
6059 mbedtls_svc_key_id_t *key)
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006060{
6061 psa_status_t status;
6062 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02006063 psa_se_drv_table_entry_t *driver = NULL;
Gilles Peskine0f84d622019-09-12 19:03:13 +02006064
Ronald Cron81709fc2020-11-14 12:10:32 +01006065 *key = MBEDTLS_SVC_KEY_ID_INIT;
6066
Gilles Peskine0f84d622019-09-12 19:03:13 +02006067 /* Reject any attempt to create a zero-length key so that we don't
6068 * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006069 if (psa_get_key_bits(attributes) == 0) {
6070 return PSA_ERROR_INVALID_ARGUMENT;
6071 }
Gilles Peskine0f84d622019-09-12 19:03:13 +02006072
Gilles Peskine449bd832023-01-11 14:50:10 +01006073 if (operation->alg == PSA_ALG_NONE) {
6074 return PSA_ERROR_BAD_STATE;
6075 }
Dave Rodgmand69da6c2021-11-16 10:32:48 +00006076
Gilles Peskine449bd832023-01-11 14:50:10 +01006077 if (!operation->can_output_key) {
6078 return PSA_ERROR_NOT_PERMITTED;
6079 }
Gilles Peskine178c9aa2019-09-24 18:21:06 +02006080
Gilles Peskine449bd832023-01-11 14:50:10 +01006081 status = psa_start_key_creation(PSA_KEY_CREATION_DERIVE, attributes,
6082 &slot, &driver);
Gilles Peskinef4ee6622019-07-24 13:44:30 +02006083#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01006084 if (driver != NULL) {
Gilles Peskinef4ee6622019-07-24 13:44:30 +02006085 /* Deriving a key in a secure element is not implemented yet. */
6086 status = PSA_ERROR_NOT_SUPPORTED;
6087 }
6088#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskine449bd832023-01-11 14:50:10 +01006089 if (status == PSA_SUCCESS) {
6090 status = psa_generate_derived_key_internal(slot,
6091 attributes->core.bits,
6092 operation);
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006093 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006094 if (status == PSA_SUCCESS) {
6095 status = psa_finish_key_creation(slot, driver, key);
6096 }
6097 if (status != PSA_SUCCESS) {
6098 psa_fail_key_creation(slot, driver);
6099 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02006100
Gilles Peskine449bd832023-01-11 14:50:10 +01006101 return status;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006102}
6103
Gilles Peskineeab56e42018-07-12 17:12:33 +02006104
6105
6106/****************************************************************/
Gilles Peskineea0fb492018-07-12 17:17:20 +02006107/* Key derivation */
6108/****************************************************************/
6109
Steven Cooreman932ffb72021-02-15 12:14:32 +01006110#if defined(AT_LEAST_ONE_BUILTIN_KDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006111static int is_kdf_alg_supported(psa_algorithm_t kdf_alg)
Gilles Peskine9efde4f2021-04-29 21:10:00 +02006112{
6113#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006114 if (PSA_ALG_IS_HKDF(kdf_alg)) {
6115 return 1;
6116 }
Gilles Peskine9efde4f2021-04-29 21:10:00 +02006117#endif
Przemek Stekielb57a44b2022-06-06 08:33:45 +02006118#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01006119 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
6120 return 1;
6121 }
Przemek Stekielb57a44b2022-06-06 08:33:45 +02006122#endif
6123#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Gilles Peskine449bd832023-01-11 14:50:10 +01006124 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) {
6125 return 1;
6126 }
Gilles Peskine9efde4f2021-04-29 21:10:00 +02006127#endif
6128#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006129 if (PSA_ALG_IS_TLS12_PRF(kdf_alg)) {
6130 return 1;
6131 }
Gilles Peskine9efde4f2021-04-29 21:10:00 +02006132#endif
6133#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006134 if (PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
6135 return 1;
6136 }
Gilles Peskine9efde4f2021-04-29 21:10:00 +02006137#endif
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006138#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006139 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
6140 return 1;
6141 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006142#endif
Kusumit Ghoderaod132cac2023-05-03 12:00:27 +05306143#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC)
6144 if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) {
6145 return 1;
6146 }
6147#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01006148 return 0;
Gilles Peskine9efde4f2021-04-29 21:10:00 +02006149}
6150
Gilles Peskine449bd832023-01-11 14:50:10 +01006151static psa_status_t psa_hash_try_support(psa_algorithm_t alg)
Gilles Peskine0cc417d2021-04-29 21:18:14 +02006152{
6153 psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT;
Gilles Peskine449bd832023-01-11 14:50:10 +01006154 psa_status_t status = psa_hash_setup(&operation, alg);
6155 psa_hash_abort(&operation);
6156 return status;
Gilles Peskine0cc417d2021-04-29 21:18:14 +02006157}
6158
Gilles Peskine969c5d62019-01-16 15:53:06 +01006159static psa_status_t psa_key_derivation_setup_kdf(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006160 psa_key_derivation_operation_t *operation,
Gilles Peskine449bd832023-01-11 14:50:10 +01006161 psa_algorithm_t kdf_alg)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006162{
Janos Follath5fe19732019-06-20 15:09:30 +01006163 /* Make sure that operation->ctx is properly zero-initialised. (Macro
6164 * initialisers for this union leave some bytes unspecified.) */
Gilles Peskine449bd832023-01-11 14:50:10 +01006165 memset(&operation->ctx, 0, sizeof(operation->ctx));
Janos Follath5fe19732019-06-20 15:09:30 +01006166
Gilles Peskine969c5d62019-01-16 15:53:06 +01006167 /* Make sure that kdf_alg is a supported key derivation algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006168 if (!is_kdf_alg_supported(kdf_alg)) {
6169 return PSA_ERROR_NOT_SUPPORTED;
6170 }
John Durkop07cc04a2020-11-16 22:08:34 -08006171
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006172 /* All currently supported key derivation algorithms (apart from
Andrzej Kurek702776f2022-09-16 06:22:44 -04006173 * ecjpake to pms) are based on a hash algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006174 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(kdf_alg);
6175 size_t hash_size = PSA_HASH_LENGTH(hash_alg);
6176 if (kdf_alg != PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
6177 if (hash_size == 0) {
6178 return PSA_ERROR_NOT_SUPPORTED;
6179 }
Gilles Peskine0cc417d2021-04-29 21:18:14 +02006180
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006181 /* Make sure that hash_alg is a supported hash algorithm. Otherwise
6182 * we might fail later, which is somewhat unfriendly and potentially
6183 * risk-prone. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006184 psa_status_t status = psa_hash_try_support(hash_alg);
6185 if (status != PSA_SUCCESS) {
6186 return status;
6187 }
6188 } else {
6189 hash_size = PSA_HASH_LENGTH(PSA_ALG_SHA_256);
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006190 }
Gilles Peskine0cc417d2021-04-29 21:18:14 +02006191
Gilles Peskine449bd832023-01-11 14:50:10 +01006192 if ((PSA_ALG_IS_TLS12_PRF(kdf_alg) ||
6193 PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) &&
6194 !(hash_alg == PSA_ALG_SHA_256 || hash_alg == PSA_ALG_SHA_384)) {
6195 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006196 }
Andrzej Kurek77638292022-09-16 12:24:52 -04006197#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) || \
Andrzej Kurekb510cd22022-09-26 10:50:22 -04006198 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006199 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg) ||
6200 (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS)) {
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006201 operation->capacity = hash_size;
Gilles Peskine449bd832023-01-11 14:50:10 +01006202 } else
Andrzej Kurekb510cd22022-09-26 10:50:22 -04006203#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT ||
6204 MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */
Gilles Peskine449bd832023-01-11 14:50:10 +01006205 operation->capacity = 255 * hash_size;
6206 return PSA_SUCCESS;
Gilles Peskine969c5d62019-01-16 15:53:06 +01006207}
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006208
Gilles Peskine449bd832023-01-11 14:50:10 +01006209static psa_status_t psa_key_agreement_try_support(psa_algorithm_t alg)
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006210{
6211#if defined(PSA_WANT_ALG_ECDH)
Gilles Peskine449bd832023-01-11 14:50:10 +01006212 if (alg == PSA_ALG_ECDH) {
6213 return PSA_SUCCESS;
6214 }
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006215#endif
Przemek Stekielfb3dd542022-12-01 14:59:15 +01006216#if defined(PSA_WANT_ALG_FFDH)
6217 if (alg == PSA_ALG_FFDH) {
6218 return PSA_SUCCESS;
6219 }
6220#endif
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006221 (void) alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01006222 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006223}
Gilles Peskinebb3814c2022-12-16 01:12:12 +01006224
6225static int psa_key_derivation_allows_free_form_secret_input(
6226 psa_algorithm_t kdf_alg)
6227{
6228#if defined(PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS)
6229 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
6230 return 0;
6231 }
6232#endif
6233 (void) kdf_alg;
6234 return 1;
6235}
John Durkop07cc04a2020-11-16 22:08:34 -08006236#endif /* AT_LEAST_ONE_BUILTIN_KDF */
Gilles Peskine969c5d62019-01-16 15:53:06 +01006237
Gilles Peskine449bd832023-01-11 14:50:10 +01006238psa_status_t psa_key_derivation_setup(psa_key_derivation_operation_t *operation,
6239 psa_algorithm_t alg)
Gilles Peskine969c5d62019-01-16 15:53:06 +01006240{
6241 psa_status_t status;
6242
Gilles Peskine449bd832023-01-11 14:50:10 +01006243 if (operation->alg != 0) {
6244 return PSA_ERROR_BAD_STATE;
Gilles Peskine969c5d62019-01-16 15:53:06 +01006245 }
Gilles Peskine969c5d62019-01-16 15:53:06 +01006246
Gilles Peskine449bd832023-01-11 14:50:10 +01006247 if (PSA_ALG_IS_RAW_KEY_AGREEMENT(alg)) {
6248 return PSA_ERROR_INVALID_ARGUMENT;
6249 } else if (PSA_ALG_IS_KEY_AGREEMENT(alg)) {
6250#if defined(AT_LEAST_ONE_BUILTIN_KDF)
6251 psa_algorithm_t kdf_alg = PSA_ALG_KEY_AGREEMENT_GET_KDF(alg);
6252 psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE(alg);
6253 status = psa_key_agreement_try_support(ka_alg);
6254 if (status != PSA_SUCCESS) {
6255 return status;
6256 }
Gilles Peskinebb3814c2022-12-16 01:12:12 +01006257 if (!psa_key_derivation_allows_free_form_secret_input(kdf_alg)) {
6258 return PSA_ERROR_INVALID_ARGUMENT;
6259 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006260 status = psa_key_derivation_setup_kdf(operation, kdf_alg);
6261#else
6262 return PSA_ERROR_NOT_SUPPORTED;
6263#endif /* AT_LEAST_ONE_BUILTIN_KDF */
6264 } else if (PSA_ALG_IS_KEY_DERIVATION(alg)) {
6265#if defined(AT_LEAST_ONE_BUILTIN_KDF)
6266 status = psa_key_derivation_setup_kdf(operation, alg);
6267#else
6268 return PSA_ERROR_NOT_SUPPORTED;
6269#endif /* AT_LEAST_ONE_BUILTIN_KDF */
6270 } else {
6271 return PSA_ERROR_INVALID_ARGUMENT;
6272 }
6273
6274 if (status == PSA_SUCCESS) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006275 operation->alg = alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01006276 }
6277 return status;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006278}
6279
Przemek Stekiel69c46792022-06-10 12:59:51 +02006280#if defined(BUILTIN_ALG_ANY_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006281static psa_status_t psa_hkdf_input(psa_hkdf_key_derivation_t *hkdf,
6282 psa_algorithm_t kdf_alg,
6283 psa_key_derivation_step_t step,
6284 const uint8_t *data,
6285 size_t data_length)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006286{
Gilles Peskine449bd832023-01-11 14:50:10 +01006287 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(kdf_alg);
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006288 psa_status_t status;
Gilles Peskine449bd832023-01-11 14:50:10 +01006289 switch (step) {
Gilles Peskine03410b52019-05-16 16:05:19 +02006290 case PSA_KEY_DERIVATION_INPUT_SALT:
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006291#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Gilles Peskine449bd832023-01-11 14:50:10 +01006292 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) {
6293 return PSA_ERROR_INVALID_ARGUMENT;
6294 }
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006295#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND */
Gilles Peskine449bd832023-01-11 14:50:10 +01006296 if (hkdf->state != HKDF_STATE_INIT) {
6297 return PSA_ERROR_BAD_STATE;
6298 } else {
6299 status = psa_key_derivation_start_hmac(&hkdf->hmac,
6300 hash_alg,
6301 data, data_length);
6302 if (status != PSA_SUCCESS) {
6303 return status;
6304 }
Steven Cooremand1ed1d92021-04-29 19:11:25 +02006305 hkdf->state = HKDF_STATE_STARTED;
Gilles Peskine449bd832023-01-11 14:50:10 +01006306 return PSA_SUCCESS;
Steven Cooremand1ed1d92021-04-29 19:11:25 +02006307 }
Gilles Peskine03410b52019-05-16 16:05:19 +02006308 case PSA_KEY_DERIVATION_INPUT_SECRET:
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006309#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Gilles Peskine449bd832023-01-11 14:50:10 +01006310 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) {
Przemek Stekiel2fb0dcd2022-05-19 10:34:37 +02006311 /* We shouldn't be in different state as HKDF_EXPAND only allows
6312 * two inputs: SECRET (this case) and INFO which does not modify
6313 * the state. It could happen only if the hkdf
6314 * object was corrupted. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006315 if (hkdf->state != HKDF_STATE_INIT) {
6316 return PSA_ERROR_BAD_STATE;
6317 }
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006318
Przemek Stekiel2fb0dcd2022-05-19 10:34:37 +02006319 /* Allow only input that fits expected prk size */
Gilles Peskine449bd832023-01-11 14:50:10 +01006320 if (data_length != PSA_HASH_LENGTH(hash_alg)) {
6321 return PSA_ERROR_INVALID_ARGUMENT;
6322 }
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006323
Gilles Peskine449bd832023-01-11 14:50:10 +01006324 memcpy(hkdf->prk, data, data_length);
6325 } else
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006326#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND */
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006327 {
Przemek Stekiel0586f4c2022-06-03 16:00:25 +02006328 /* HKDF: If no salt was provided, use an empty salt.
6329 * HKDF-EXTRACT: salt is mandatory. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006330 if (hkdf->state == HKDF_STATE_INIT) {
Przemek Stekiel0586f4c2022-06-03 16:00:25 +02006331#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01006332 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
6333 return PSA_ERROR_BAD_STATE;
6334 }
Przemek Stekiel0586f4c2022-06-03 16:00:25 +02006335#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Gilles Peskine449bd832023-01-11 14:50:10 +01006336 status = psa_key_derivation_start_hmac(&hkdf->hmac,
6337 hash_alg,
6338 NULL, 0);
6339 if (status != PSA_SUCCESS) {
6340 return status;
6341 }
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006342 hkdf->state = HKDF_STATE_STARTED;
6343 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006344 if (hkdf->state != HKDF_STATE_STARTED) {
6345 return PSA_ERROR_BAD_STATE;
6346 }
6347 status = psa_mac_update(&hkdf->hmac,
6348 data, data_length);
6349 if (status != PSA_SUCCESS) {
6350 return status;
6351 }
6352 status = psa_mac_sign_finish(&hkdf->hmac,
6353 hkdf->prk,
6354 sizeof(hkdf->prk),
6355 &data_length);
6356 if (status != PSA_SUCCESS) {
6357 return status;
6358 }
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006359 }
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006360
Gilles Peskine2b522db2019-04-12 15:11:49 +02006361 hkdf->state = HKDF_STATE_KEYED;
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006362 hkdf->block_number = 0;
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006363#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01006364 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006365 /* The only block of output is the PRK. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006366 memcpy(hkdf->output_block, hkdf->prk, PSA_HASH_LENGTH(hash_alg));
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006367 hkdf->offset_in_block = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01006368 } else
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006369#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006370 {
6371 /* Block 0 is empty, and the next block will be
6372 * generated by psa_key_derivation_hkdf_read(). */
Gilles Peskine449bd832023-01-11 14:50:10 +01006373 hkdf->offset_in_block = PSA_HASH_LENGTH(hash_alg);
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006374 }
6375
Gilles Peskine449bd832023-01-11 14:50:10 +01006376 return PSA_SUCCESS;
Gilles Peskine03410b52019-05-16 16:05:19 +02006377 case PSA_KEY_DERIVATION_INPUT_INFO:
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006378#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01006379 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
6380 return PSA_ERROR_INVALID_ARGUMENT;
6381 }
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006382#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Przemek Stekielcde3f782022-06-03 16:12:27 +02006383#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Gilles Peskine449bd832023-01-11 14:50:10 +01006384 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg) &&
6385 hkdf->state == HKDF_STATE_INIT) {
6386 return PSA_ERROR_BAD_STATE;
6387 }
Przemek Stekielcde3f782022-06-03 16:12:27 +02006388#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Gilles Peskine449bd832023-01-11 14:50:10 +01006389 if (hkdf->state == HKDF_STATE_OUTPUT) {
6390 return PSA_ERROR_BAD_STATE;
6391 }
6392 if (hkdf->info_set) {
6393 return PSA_ERROR_BAD_STATE;
6394 }
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006395 hkdf->info_length = data_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01006396 if (data_length != 0) {
6397 hkdf->info = mbedtls_calloc(1, data_length);
6398 if (hkdf->info == NULL) {
6399 return PSA_ERROR_INSUFFICIENT_MEMORY;
6400 }
6401 memcpy(hkdf->info, data, data_length);
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006402 }
6403 hkdf->info_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01006404 return PSA_SUCCESS;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006405 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01006406 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006407 }
6408}
Przemek Stekiel69c46792022-06-10 12:59:51 +02006409#endif /* BUILTIN_ALG_ANY_HKDF */
Janos Follathb03233e2019-06-11 15:30:30 +01006410
John Durkop07cc04a2020-11-16 22:08:34 -08006411#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
6412 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006413static psa_status_t psa_tls12_prf_set_seed(psa_tls12_prf_key_derivation_t *prf,
6414 const uint8_t *data,
6415 size_t data_length)
Janos Follathf08e2652019-06-13 09:05:41 +01006416{
Gilles Peskine449bd832023-01-11 14:50:10 +01006417 if (prf->state != PSA_TLS12_PRF_STATE_INIT) {
6418 return PSA_ERROR_BAD_STATE;
6419 }
Janos Follathf08e2652019-06-13 09:05:41 +01006420
Gilles Peskine449bd832023-01-11 14:50:10 +01006421 if (data_length != 0) {
6422 prf->seed = mbedtls_calloc(1, data_length);
6423 if (prf->seed == NULL) {
6424 return PSA_ERROR_INSUFFICIENT_MEMORY;
6425 }
Janos Follathf08e2652019-06-13 09:05:41 +01006426
Gilles Peskine449bd832023-01-11 14:50:10 +01006427 memcpy(prf->seed, data, data_length);
Janos Follathd6dce9f2019-07-04 09:11:38 +01006428 prf->seed_length = data_length;
6429 }
Janos Follathf08e2652019-06-13 09:05:41 +01006430
Gilles Peskine43f958b2020-12-13 14:55:14 +01006431 prf->state = PSA_TLS12_PRF_STATE_SEED_SET;
Janos Follathf08e2652019-06-13 09:05:41 +01006432
Gilles Peskine449bd832023-01-11 14:50:10 +01006433 return PSA_SUCCESS;
Janos Follathf08e2652019-06-13 09:05:41 +01006434}
6435
Gilles Peskine449bd832023-01-11 14:50:10 +01006436static psa_status_t psa_tls12_prf_set_key(psa_tls12_prf_key_derivation_t *prf,
6437 const uint8_t *data,
6438 size_t data_length)
Janos Follath81550542019-06-13 14:26:34 +01006439{
Gilles Peskine449bd832023-01-11 14:50:10 +01006440 if (prf->state != PSA_TLS12_PRF_STATE_SEED_SET &&
6441 prf->state != PSA_TLS12_PRF_STATE_OTHER_KEY_SET) {
6442 return PSA_ERROR_BAD_STATE;
6443 }
Janos Follath81550542019-06-13 14:26:34 +01006444
Gilles Peskine449bd832023-01-11 14:50:10 +01006445 if (data_length != 0) {
6446 prf->secret = mbedtls_calloc(1, data_length);
6447 if (prf->secret == NULL) {
6448 return PSA_ERROR_INSUFFICIENT_MEMORY;
6449 }
Steven Cooremana6df6042021-04-29 19:32:25 +02006450
Gilles Peskine449bd832023-01-11 14:50:10 +01006451 memcpy(prf->secret, data, data_length);
Steven Cooremana6df6042021-04-29 19:32:25 +02006452 prf->secret_length = data_length;
6453 }
Janos Follath81550542019-06-13 14:26:34 +01006454
Gilles Peskine43f958b2020-12-13 14:55:14 +01006455 prf->state = PSA_TLS12_PRF_STATE_KEY_SET;
Janos Follath81550542019-06-13 14:26:34 +01006456
Gilles Peskine449bd832023-01-11 14:50:10 +01006457 return PSA_SUCCESS;
Janos Follath81550542019-06-13 14:26:34 +01006458}
6459
Gilles Peskine449bd832023-01-11 14:50:10 +01006460static psa_status_t psa_tls12_prf_set_label(psa_tls12_prf_key_derivation_t *prf,
6461 const uint8_t *data,
6462 size_t data_length)
Janos Follath63028dd2019-06-13 09:15:47 +01006463{
Gilles Peskine449bd832023-01-11 14:50:10 +01006464 if (prf->state != PSA_TLS12_PRF_STATE_KEY_SET) {
6465 return PSA_ERROR_BAD_STATE;
6466 }
Janos Follath63028dd2019-06-13 09:15:47 +01006467
Gilles Peskine449bd832023-01-11 14:50:10 +01006468 if (data_length != 0) {
6469 prf->label = mbedtls_calloc(1, data_length);
6470 if (prf->label == NULL) {
6471 return PSA_ERROR_INSUFFICIENT_MEMORY;
6472 }
Janos Follath63028dd2019-06-13 09:15:47 +01006473
Gilles Peskine449bd832023-01-11 14:50:10 +01006474 memcpy(prf->label, data, data_length);
Janos Follathd6dce9f2019-07-04 09:11:38 +01006475 prf->label_length = data_length;
6476 }
Janos Follath63028dd2019-06-13 09:15:47 +01006477
Gilles Peskine43f958b2020-12-13 14:55:14 +01006478 prf->state = PSA_TLS12_PRF_STATE_LABEL_SET;
Janos Follath63028dd2019-06-13 09:15:47 +01006479
Gilles Peskine449bd832023-01-11 14:50:10 +01006480 return PSA_SUCCESS;
Janos Follath63028dd2019-06-13 09:15:47 +01006481}
6482
Gilles Peskine449bd832023-01-11 14:50:10 +01006483static psa_status_t psa_tls12_prf_input(psa_tls12_prf_key_derivation_t *prf,
6484 psa_key_derivation_step_t step,
6485 const uint8_t *data,
6486 size_t data_length)
Janos Follathb03233e2019-06-11 15:30:30 +01006487{
Gilles Peskine449bd832023-01-11 14:50:10 +01006488 switch (step) {
Janos Follathf08e2652019-06-13 09:05:41 +01006489 case PSA_KEY_DERIVATION_INPUT_SEED:
Gilles Peskine449bd832023-01-11 14:50:10 +01006490 return psa_tls12_prf_set_seed(prf, data, data_length);
Janos Follath81550542019-06-13 14:26:34 +01006491 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01006492 return psa_tls12_prf_set_key(prf, data, data_length);
Janos Follath63028dd2019-06-13 09:15:47 +01006493 case PSA_KEY_DERIVATION_INPUT_LABEL:
Gilles Peskine449bd832023-01-11 14:50:10 +01006494 return psa_tls12_prf_set_label(prf, data, data_length);
Janos Follathb03233e2019-06-11 15:30:30 +01006495 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01006496 return PSA_ERROR_INVALID_ARGUMENT;
Janos Follathb03233e2019-06-11 15:30:30 +01006497 }
6498}
John Durkop07cc04a2020-11-16 22:08:34 -08006499#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) ||
6500 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
6501
6502#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
6503static psa_status_t psa_tls12_prf_psk_to_ms_set_key(
6504 psa_tls12_prf_key_derivation_t *prf,
John Durkop07cc04a2020-11-16 22:08:34 -08006505 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01006506 size_t data_length)
John Durkop07cc04a2020-11-16 22:08:34 -08006507{
6508 psa_status_t status;
Gilles Peskine449bd832023-01-11 14:50:10 +01006509 const size_t pms_len = (prf->state == PSA_TLS12_PRF_STATE_OTHER_KEY_SET ?
6510 4 + data_length + prf->other_secret_length :
6511 4 + 2 * data_length);
John Durkop07cc04a2020-11-16 22:08:34 -08006512
Gilles Peskine449bd832023-01-11 14:50:10 +01006513 if (data_length > PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE) {
6514 return PSA_ERROR_INVALID_ARGUMENT;
6515 }
John Durkop07cc04a2020-11-16 22:08:34 -08006516
Gilles Peskine449bd832023-01-11 14:50:10 +01006517 uint8_t *pms = mbedtls_calloc(1, pms_len);
6518 if (pms == NULL) {
6519 return PSA_ERROR_INSUFFICIENT_MEMORY;
6520 }
Przemek Stekielc8fa5a12022-04-07 14:17:13 +02006521 uint8_t *cur = pms;
6522
6523 /* pure-PSK:
6524 * Quoting RFC 4279, Section 2:
John Durkop07cc04a2020-11-16 22:08:34 -08006525 *
6526 * The premaster secret is formed as follows: if the PSK is N octets
6527 * long, concatenate a uint16 with the value N, N zero octets, a second
6528 * uint16 with the value N, and the PSK itself.
Przemek Stekielc8fa5a12022-04-07 14:17:13 +02006529 *
6530 * mixed-PSK:
6531 * In a DHE-PSK, RSA-PSK, ECDHE-PSK the premaster secret is formed as
6532 * follows: concatenate a uint16 with the length of the other secret,
6533 * the other secret itself, uint16 with the length of PSK, and the
6534 * PSK itself.
6535 * For details please check:
6536 * - RFC 4279, Section 4 for the definition of RSA-PSK,
6537 * - RFC 4279, Section 3 for the definition of DHE-PSK,
6538 * - RFC 5489 for the definition of ECDHE-PSK.
John Durkop07cc04a2020-11-16 22:08:34 -08006539 */
6540
Gilles Peskine449bd832023-01-11 14:50:10 +01006541 if (prf->state == PSA_TLS12_PRF_STATE_OTHER_KEY_SET) {
6542 *cur++ = MBEDTLS_BYTE_1(prf->other_secret_length);
6543 *cur++ = MBEDTLS_BYTE_0(prf->other_secret_length);
6544 if (prf->other_secret_length != 0) {
6545 memcpy(cur, prf->other_secret, prf->other_secret_length);
6546 mbedtls_platform_zeroize(prf->other_secret, prf->other_secret_length);
Przemek Stekiel2503f7e2022-04-12 12:08:01 +02006547 cur += prf->other_secret_length;
6548 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006549 } else {
6550 *cur++ = MBEDTLS_BYTE_1(data_length);
6551 *cur++ = MBEDTLS_BYTE_0(data_length);
6552 memset(cur, 0, data_length);
Przemek Stekielc8fa5a12022-04-07 14:17:13 +02006553 cur += data_length;
6554 }
6555
Gilles Peskine449bd832023-01-11 14:50:10 +01006556 *cur++ = MBEDTLS_BYTE_1(data_length);
6557 *cur++ = MBEDTLS_BYTE_0(data_length);
6558 memcpy(cur, data, data_length);
John Durkop07cc04a2020-11-16 22:08:34 -08006559 cur += data_length;
6560
Gilles Peskine449bd832023-01-11 14:50:10 +01006561 status = psa_tls12_prf_set_key(prf, pms, cur - pms);
John Durkop07cc04a2020-11-16 22:08:34 -08006562
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01006563 mbedtls_zeroize_and_free(pms, pms_len);
Gilles Peskine449bd832023-01-11 14:50:10 +01006564 return status;
John Durkop07cc04a2020-11-16 22:08:34 -08006565}
Janos Follath6660f0e2019-06-17 08:44:03 +01006566
Przemek Stekiele47201b2022-04-19 13:53:28 +02006567static psa_status_t psa_tls12_prf_psk_to_ms_set_other_key(
6568 psa_tls12_prf_key_derivation_t *prf,
6569 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01006570 size_t data_length)
Przemek Stekiele47201b2022-04-19 13:53:28 +02006571{
Gilles Peskine449bd832023-01-11 14:50:10 +01006572 if (prf->state != PSA_TLS12_PRF_STATE_SEED_SET) {
6573 return PSA_ERROR_BAD_STATE;
Przemek Stekiele47201b2022-04-19 13:53:28 +02006574 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006575
6576 if (data_length != 0) {
6577 prf->other_secret = mbedtls_calloc(1, data_length);
6578 if (prf->other_secret == NULL) {
6579 return PSA_ERROR_INSUFFICIENT_MEMORY;
6580 }
6581
6582 memcpy(prf->other_secret, data, data_length);
6583 prf->other_secret_length = data_length;
6584 } else {
Przemek Stekiele47201b2022-04-19 13:53:28 +02006585 prf->other_secret_length = 0;
6586 }
6587
6588 prf->state = PSA_TLS12_PRF_STATE_OTHER_KEY_SET;
6589
Gilles Peskine449bd832023-01-11 14:50:10 +01006590 return PSA_SUCCESS;
Przemek Stekiele47201b2022-04-19 13:53:28 +02006591}
6592
Janos Follath6660f0e2019-06-17 08:44:03 +01006593static psa_status_t psa_tls12_prf_psk_to_ms_input(
6594 psa_tls12_prf_key_derivation_t *prf,
Janos Follath6660f0e2019-06-17 08:44:03 +01006595 psa_key_derivation_step_t step,
6596 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01006597 size_t data_length)
Janos Follath6660f0e2019-06-17 08:44:03 +01006598{
Gilles Peskine449bd832023-01-11 14:50:10 +01006599 switch (step) {
Przemek Stekiele47201b2022-04-19 13:53:28 +02006600 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01006601 return psa_tls12_prf_psk_to_ms_set_key(prf,
6602 data, data_length);
Przemek Stekiele47201b2022-04-19 13:53:28 +02006603 break;
6604 case PSA_KEY_DERIVATION_INPUT_OTHER_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01006605 return psa_tls12_prf_psk_to_ms_set_other_key(prf,
6606 data,
6607 data_length);
Przemek Stekiele47201b2022-04-19 13:53:28 +02006608 break;
6609 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01006610 return psa_tls12_prf_input(prf, step, data, data_length);
Przemek Stekiele47201b2022-04-19 13:53:28 +02006611 break;
Janos Follath6660f0e2019-06-17 08:44:03 +01006612
Przemek Stekiele47201b2022-04-19 13:53:28 +02006613 }
Janos Follath6660f0e2019-06-17 08:44:03 +01006614}
John Durkop07cc04a2020-11-16 22:08:34 -08006615#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006616
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006617#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
6618static psa_status_t psa_tls12_ecjpake_to_pms_input(
6619 psa_tls12_ecjpake_to_pms_t *ecjpake,
Andrzej Kurek702776f2022-09-16 06:22:44 -04006620 psa_key_derivation_step_t step,
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006621 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01006622 size_t data_length)
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006623{
Gilles Peskine449bd832023-01-11 14:50:10 +01006624 if (data_length != PSA_TLS12_ECJPAKE_TO_PMS_INPUT_SIZE ||
6625 step != PSA_KEY_DERIVATION_INPUT_SECRET) {
6626 return PSA_ERROR_INVALID_ARGUMENT;
Andrzej Kurek5603efd2022-09-26 10:49:16 -04006627 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006628
6629 /* Check if the passed point is in an uncompressed form */
Gilles Peskine449bd832023-01-11 14:50:10 +01006630 if (data[0] != 0x04) {
6631 return PSA_ERROR_INVALID_ARGUMENT;
6632 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006633
6634 /* Only K.X has to be extracted - bytes 1 to 32 inclusive. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006635 memcpy(ecjpake->data, data + 1, PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE);
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006636
Gilles Peskine449bd832023-01-11 14:50:10 +01006637 return PSA_SUCCESS;
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006638}
6639#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05306640
6641#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC)
6642static psa_status_t psa_pbkdf2_set_input_cost(
6643 psa_pbkdf2_key_derivation_t *pbkdf2,
6644 psa_key_derivation_step_t step,
6645 uint64_t data)
6646{
6647 if (step != PSA_KEY_DERIVATION_INPUT_COST) {
6648 return PSA_ERROR_INVALID_ARGUMENT;
6649 }
6650
6651 if (pbkdf2->state != PSA_PBKDF2_STATE_INIT) {
6652 return PSA_ERROR_BAD_STATE;
6653 }
Kusumit Ghoderao3fc4ca72023-05-08 15:57:41 +05306654
Kusumit Ghoderaoe66a8ad2023-05-24 12:30:43 +05306655 if (data > PSA_VENDOR_PBKDF2_MAX_ITERATIONS) {
Kusumit Ghoderao3fc4ca72023-05-08 15:57:41 +05306656 return PSA_ERROR_NOT_SUPPORTED;
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05306657 }
Kusumit Ghoderao3fc4ca72023-05-08 15:57:41 +05306658
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05306659 if (data == 0) {
6660 return PSA_ERROR_INVALID_ARGUMENT;
6661 }
Kusumit Ghoderaoe66a8ad2023-05-24 12:30:43 +05306662
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05306663 pbkdf2->input_cost = data;
6664 pbkdf2->state = PSA_PBKDF2_STATE_INPUT_COST_SET;
6665
6666 return PSA_SUCCESS;
6667}
Kusumit Ghoderao547a6c62023-05-03 12:18:19 +05306668
6669static psa_status_t psa_pbkdf2_set_salt(psa_pbkdf2_key_derivation_t *pbkdf2,
6670 const uint8_t *data,
6671 size_t data_length)
6672{
Kusumit Ghoderao547a6c62023-05-03 12:18:19 +05306673 if (pbkdf2->state != PSA_PBKDF2_STATE_INPUT_COST_SET &&
6674 pbkdf2->state != PSA_PBKDF2_STATE_SALT_SET) {
6675 return PSA_ERROR_BAD_STATE;
6676 }
6677
Kusumit Ghoderaod0422f32023-05-08 15:56:19 +05306678 if (pbkdf2->state == PSA_PBKDF2_STATE_INPUT_COST_SET) {
6679 pbkdf2->salt = mbedtls_calloc(1, data_length);
6680 if (pbkdf2->salt == NULL) {
6681 return PSA_ERROR_INSUFFICIENT_MEMORY;
Kusumit Ghoderao547a6c62023-05-03 12:18:19 +05306682 }
Kusumit Ghoderaod0422f32023-05-08 15:56:19 +05306683
6684 memcpy(pbkdf2->salt, data, data_length);
6685 pbkdf2->salt_length = data_length;
6686 } else if (pbkdf2->state == PSA_PBKDF2_STATE_SALT_SET) {
Kusumit Ghoderaod7a3f802023-05-24 22:19:47 +05306687 uint8_t *next_salt;
Kusumit Ghoderaob538bb72023-05-24 12:32:14 +05306688
Kusumit Ghoderaod7a3f802023-05-24 22:19:47 +05306689 next_salt = mbedtls_calloc(1, data_length + pbkdf2->salt_length);
6690 if (next_salt == NULL) {
Kusumit Ghoderaod0422f32023-05-08 15:56:19 +05306691 return PSA_ERROR_INSUFFICIENT_MEMORY;
6692 }
6693
Kusumit Ghoderaod7a3f802023-05-24 22:19:47 +05306694 memcpy(next_salt, pbkdf2->salt, pbkdf2->salt_length);
6695 memcpy(next_salt + pbkdf2->salt_length, data, data_length);
Kusumit Ghoderaod0422f32023-05-08 15:56:19 +05306696 pbkdf2->salt_length += data_length;
Kusumit Ghoderaod7a3f802023-05-24 22:19:47 +05306697 mbedtls_free(pbkdf2->salt);
6698 pbkdf2->salt = next_salt;
Kusumit Ghoderao547a6c62023-05-03 12:18:19 +05306699 }
6700
6701 pbkdf2->state = PSA_PBKDF2_STATE_SALT_SET;
6702
6703 return PSA_SUCCESS;
6704}
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05306705
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306706static psa_status_t psa_pbkdf2_hmac_set_password(psa_algorithm_t hash_alg,
Kusumit Ghoderaoaac9a582023-05-24 14:19:17 +05306707 const uint8_t *input,
6708 size_t input_len,
6709 uint8_t *output,
Kusumit Ghoderao91f99f52023-05-24 22:21:48 +05306710 size_t *output_len)
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306711{
6712 psa_status_t status = PSA_SUCCESS;
6713 if (input_len > PSA_HASH_BLOCK_LENGTH(hash_alg)) {
6714 status = psa_hash_compute(hash_alg, input, input_len, output,
Kusumit Ghoderao91f99f52023-05-24 22:21:48 +05306715 PSA_HMAC_MAX_HASH_BLOCK_SIZE, output_len);
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306716 } else {
6717 memcpy(output, input, input_len);
Kusumit Ghoderao91f99f52023-05-24 22:21:48 +05306718 *output_len = PSA_HASH_BLOCK_LENGTH(hash_alg);
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306719 }
6720 return status;
6721}
6722
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05306723static psa_status_t psa_pbkdf2_set_password(psa_pbkdf2_key_derivation_t *pbkdf2,
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306724 psa_algorithm_t kdf_alg,
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05306725 const uint8_t *data,
6726 size_t data_length)
6727{
Kusumit Ghoderaoaac9a582023-05-24 14:19:17 +05306728 psa_status_t status = PSA_SUCCESS;
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05306729 if (pbkdf2->state != PSA_PBKDF2_STATE_SALT_SET) {
6730 return PSA_ERROR_BAD_STATE;
6731 }
6732
6733 if (data_length != 0) {
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306734 if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) {
6735 psa_algorithm_t hash_alg = PSA_ALG_PBKDF2_HMAC_GET_HASH(kdf_alg);
6736 status = psa_pbkdf2_hmac_set_password(hash_alg, data, data_length,
6737 pbkdf2->password,
Kusumit Ghoderao91f99f52023-05-24 22:21:48 +05306738 &pbkdf2->password_length);
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05306739 }
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05306740 }
6741
6742 pbkdf2->state = PSA_PBKDF2_STATE_PASSWORD_SET;
6743
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306744 return status;
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05306745}
Kusumit Ghoderao24b38952023-05-03 12:25:26 +05306746
6747static psa_status_t psa_pbkdf2_input(psa_pbkdf2_key_derivation_t *pbkdf2,
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306748 psa_algorithm_t kdf_alg,
Kusumit Ghoderao24b38952023-05-03 12:25:26 +05306749 psa_key_derivation_step_t step,
6750 const uint8_t *data,
6751 size_t data_length)
6752{
6753 switch (step) {
6754 case PSA_KEY_DERIVATION_INPUT_SALT:
6755 return psa_pbkdf2_set_salt(pbkdf2, data, data_length);
6756 case PSA_KEY_DERIVATION_INPUT_PASSWORD:
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306757 return psa_pbkdf2_set_password(pbkdf2, kdf_alg, data, data_length);
Kusumit Ghoderao24b38952023-05-03 12:25:26 +05306758 default:
6759 return PSA_ERROR_INVALID_ARGUMENT;
6760 }
6761}
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05306762#endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC */
6763
Gilles Peskineb8965192019-09-24 16:21:10 +02006764/** Check whether the given key type is acceptable for the given
6765 * input step of a key derivation.
6766 *
6767 * Secret inputs must have the type #PSA_KEY_TYPE_DERIVE.
6768 * Non-secret inputs must have the type #PSA_KEY_TYPE_RAW_DATA.
6769 * Both secret and non-secret inputs can alternatively have the type
6770 * #PSA_KEY_TYPE_NONE, which is never the type of a key object, meaning
6771 * that the input was passed as a buffer rather than via a key object.
6772 */
Gilles Peskine224b0d62019-09-23 18:13:17 +02006773static int psa_key_derivation_check_input_type(
6774 psa_key_derivation_step_t step,
Gilles Peskine449bd832023-01-11 14:50:10 +01006775 psa_key_type_t key_type)
Gilles Peskine224b0d62019-09-23 18:13:17 +02006776{
Gilles Peskine449bd832023-01-11 14:50:10 +01006777 switch (step) {
Gilles Peskine224b0d62019-09-23 18:13:17 +02006778 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01006779 if (key_type == PSA_KEY_TYPE_DERIVE) {
6780 return PSA_SUCCESS;
6781 }
6782 if (key_type == PSA_KEY_TYPE_NONE) {
6783 return PSA_SUCCESS;
6784 }
Gilles Peskine224b0d62019-09-23 18:13:17 +02006785 break;
Przemek Stekiela7695a22022-04-07 15:39:01 +02006786 case PSA_KEY_DERIVATION_INPUT_OTHER_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01006787 if (key_type == PSA_KEY_TYPE_DERIVE) {
6788 return PSA_SUCCESS;
6789 }
6790 if (key_type == PSA_KEY_TYPE_NONE) {
6791 return PSA_SUCCESS;
6792 }
Przemek Stekiela7695a22022-04-07 15:39:01 +02006793 break;
Gilles Peskine224b0d62019-09-23 18:13:17 +02006794 case PSA_KEY_DERIVATION_INPUT_LABEL:
6795 case PSA_KEY_DERIVATION_INPUT_SALT:
6796 case PSA_KEY_DERIVATION_INPUT_INFO:
6797 case PSA_KEY_DERIVATION_INPUT_SEED:
Gilles Peskine449bd832023-01-11 14:50:10 +01006798 if (key_type == PSA_KEY_TYPE_RAW_DATA) {
6799 return PSA_SUCCESS;
6800 }
6801 if (key_type == PSA_KEY_TYPE_NONE) {
6802 return PSA_SUCCESS;
6803 }
Gilles Peskine224b0d62019-09-23 18:13:17 +02006804 break;
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05306805 case PSA_KEY_DERIVATION_INPUT_PASSWORD:
6806 if (key_type == PSA_KEY_TYPE_PASSWORD) {
6807 return PSA_SUCCESS;
6808 }
6809 if (key_type == PSA_KEY_TYPE_DERIVE) {
6810 return PSA_SUCCESS;
6811 }
6812 if (key_type == PSA_KEY_TYPE_NONE) {
6813 return PSA_SUCCESS;
6814 }
6815 break;
Gilles Peskine224b0d62019-09-23 18:13:17 +02006816 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006817 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine224b0d62019-09-23 18:13:17 +02006818}
6819
Janos Follathb80a94e2019-06-12 15:54:46 +01006820static psa_status_t psa_key_derivation_input_internal(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006821 psa_key_derivation_operation_t *operation,
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01006822 psa_key_derivation_step_t step,
Gilles Peskine224b0d62019-09-23 18:13:17 +02006823 psa_key_type_t key_type,
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01006824 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01006825 size_t data_length)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006826{
Gilles Peskine46d7faf2019-09-23 19:22:55 +02006827 psa_status_t status;
Gilles Peskine449bd832023-01-11 14:50:10 +01006828 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation);
Gilles Peskine46d7faf2019-09-23 19:22:55 +02006829
Gilles Peskine449bd832023-01-11 14:50:10 +01006830 status = psa_key_derivation_check_input_type(step, key_type);
6831 if (status != PSA_SUCCESS) {
Gilles Peskine224b0d62019-09-23 18:13:17 +02006832 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006833 }
Gilles Peskine224b0d62019-09-23 18:13:17 +02006834
Przemek Stekiel69c46792022-06-10 12:59:51 +02006835#if defined(BUILTIN_ALG_ANY_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006836 if (PSA_ALG_IS_ANY_HKDF(kdf_alg)) {
6837 status = psa_hkdf_input(&operation->ctx.hkdf, kdf_alg,
6838 step, data, data_length);
6839 } else
Przemek Stekiel69c46792022-06-10 12:59:51 +02006840#endif /* BUILTIN_ALG_ANY_HKDF */
John Durkop07cc04a2020-11-16 22:08:34 -08006841#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006842 if (PSA_ALG_IS_TLS12_PRF(kdf_alg)) {
6843 status = psa_tls12_prf_input(&operation->ctx.tls12_prf,
6844 step, data, data_length);
6845 } else
John Durkop07cc04a2020-11-16 22:08:34 -08006846#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF */
6847#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006848 if (PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
6849 status = psa_tls12_prf_psk_to_ms_input(&operation->ctx.tls12_prf,
6850 step, data, data_length);
6851 } else
John Durkop07cc04a2020-11-16 22:08:34 -08006852#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006853#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006854 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006855 status = psa_tls12_ecjpake_to_pms_input(
Gilles Peskine449bd832023-01-11 14:50:10 +01006856 &operation->ctx.tls12_ecjpake_to_pms, step, data, data_length);
6857 } else
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006858#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */
Kusumit Ghoderao24b38952023-05-03 12:25:26 +05306859#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC)
6860 if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) {
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05306861 status = psa_pbkdf2_input(&operation->ctx.pbkdf2, kdf_alg,
6862 step, data, data_length);
Kusumit Ghoderao24b38952023-05-03 12:25:26 +05306863 } else
6864#endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006865 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006866 /* This can't happen unless the operation object was not initialized */
Steven Cooreman74afe472021-02-10 17:19:22 +01006867 (void) data;
6868 (void) data_length;
6869 (void) kdf_alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01006870 return PSA_ERROR_BAD_STATE;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006871 }
6872
Gilles Peskine224b0d62019-09-23 18:13:17 +02006873exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01006874 if (status != PSA_SUCCESS) {
6875 psa_key_derivation_abort(operation);
6876 }
6877 return status;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006878}
6879
Kusumit Ghoderao50e0e112023-04-06 17:47:25 +05306880static psa_status_t psa_key_derivation_input_integer_internal(
6881 psa_key_derivation_operation_t *operation,
6882 psa_key_derivation_step_t step,
6883 uint64_t value)
6884{
6885 psa_status_t status;
6886 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation);
6887
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05306888#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC)
6889 if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) {
6890 status = psa_pbkdf2_set_input_cost(
6891 &operation->ctx.pbkdf2, step, value);
6892 } else
6893#endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC */
Kusumit Ghoderao50e0e112023-04-06 17:47:25 +05306894 {
Kusumit Ghoderao3a18dee2023-04-07 16:16:27 +05306895 (void) step;
Kusumit Ghoderao50e0e112023-04-06 17:47:25 +05306896 (void) value;
6897 (void) kdf_alg;
Kusumit Ghoderaoa14ae5a2023-04-19 14:16:26 +05306898 status = PSA_ERROR_INVALID_ARGUMENT;
Kusumit Ghoderao50e0e112023-04-06 17:47:25 +05306899 }
6900
6901 if (status != PSA_SUCCESS) {
6902 psa_key_derivation_abort(operation);
6903 }
6904 return status;
6905}
6906
Janos Follath51f4a0f2019-06-14 11:35:55 +01006907psa_status_t psa_key_derivation_input_bytes(
6908 psa_key_derivation_operation_t *operation,
6909 psa_key_derivation_step_t step,
6910 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01006911 size_t data_length)
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01006912{
Gilles Peskine449bd832023-01-11 14:50:10 +01006913 return psa_key_derivation_input_internal(operation, step,
6914 PSA_KEY_TYPE_NONE,
6915 data, data_length);
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01006916}
6917
Kusumit Ghoderao50e0e112023-04-06 17:47:25 +05306918psa_status_t psa_key_derivation_input_integer(
6919 psa_key_derivation_operation_t *operation,
6920 psa_key_derivation_step_t step,
6921 uint64_t value)
6922{
6923 return psa_key_derivation_input_integer_internal(operation, step, value);
6924}
6925
Janos Follath51f4a0f2019-06-14 11:35:55 +01006926psa_status_t psa_key_derivation_input_key(
6927 psa_key_derivation_operation_t *operation,
6928 psa_key_derivation_step_t step,
Gilles Peskine449bd832023-01-11 14:50:10 +01006929 mbedtls_svc_key_id_t key)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006930{
Ronald Cronf95a2b12020-10-22 15:24:49 +02006931 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01006932 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006933 psa_key_slot_t *slot;
Gilles Peskine178c9aa2019-09-24 18:21:06 +02006934
Ronald Cron5c522922020-11-14 16:35:34 +01006935 status = psa_get_and_lock_transparent_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01006936 key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg);
6937 if (status != PSA_SUCCESS) {
6938 psa_key_derivation_abort(operation);
6939 return status;
Gilles Peskine593773d2019-09-23 18:17:40 +02006940 }
Gilles Peskine178c9aa2019-09-24 18:21:06 +02006941
Kusumit Ghoderao3128c5d2023-05-03 12:27:57 +05306942 /* Passing a key object as a SECRET or PASSWORD input unlocks the
6943 * permission to output to a key object. */
6944 if (step == PSA_KEY_DERIVATION_INPUT_SECRET ||
6945 step == PSA_KEY_DERIVATION_INPUT_PASSWORD) {
Gilles Peskine178c9aa2019-09-24 18:21:06 +02006946 operation->can_output_key = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01006947 }
Gilles Peskine178c9aa2019-09-24 18:21:06 +02006948
Gilles Peskine449bd832023-01-11 14:50:10 +01006949 status = psa_key_derivation_input_internal(operation,
6950 step, slot->attr.type,
6951 slot->key.data,
6952 slot->key.bytes);
Ronald Cronf95a2b12020-10-22 15:24:49 +02006953
Gilles Peskine449bd832023-01-11 14:50:10 +01006954 unlock_status = psa_unlock_key_slot(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02006955
Gilles Peskine449bd832023-01-11 14:50:10 +01006956 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006957}
Gilles Peskineea0fb492018-07-12 17:17:20 +02006958
6959
6960
6961/****************************************************************/
Gilles Peskine01d718c2018-09-18 12:01:02 +02006962/* Key agreement */
6963/****************************************************************/
6964
Gilles Peskine449bd832023-01-11 14:50:10 +01006965psa_status_t psa_key_agreement_raw_builtin(const psa_key_attributes_t *attributes,
6966 const uint8_t *key_buffer,
6967 size_t key_buffer_size,
6968 psa_algorithm_t alg,
6969 const uint8_t *peer_key,
6970 size_t peer_key_length,
6971 uint8_t *shared_secret,
6972 size_t shared_secret_size,
6973 size_t *shared_secret_length)
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02006974{
Gilles Peskine449bd832023-01-11 14:50:10 +01006975 switch (alg) {
John Durkop6ba40d12020-11-10 08:50:04 -08006976#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
Gilles Peskine0216fe12019-04-11 21:23:21 +02006977 case PSA_ALG_ECDH:
Gilles Peskine449bd832023-01-11 14:50:10 +01006978 return mbedtls_psa_key_agreement_ecdh(attributes, key_buffer,
6979 key_buffer_size, alg,
6980 peer_key, peer_key_length,
6981 shared_secret,
6982 shared_secret_size,
6983 shared_secret_length);
Gilles Peskine01d718c2018-09-18 12:01:02 +02006984#endif /* MBEDTLS_PSA_BUILTIN_ALG_ECDH */
Przemek Stekielfb3dd542022-12-01 14:59:15 +01006985
6986#if defined(MBEDTLS_PSA_BUILTIN_ALG_FFDH)
6987 case PSA_ALG_FFDH:
Przemek Stekiel152bb462023-06-01 11:52:39 +02006988 return mbedtls_psa_ffdh_key_agreement(attributes,
Przemek Stekiel359f4622022-12-05 14:11:55 +01006989 peer_key,
6990 peer_key_length,
6991 key_buffer,
6992 key_buffer_size,
6993 shared_secret,
6994 shared_secret_size,
6995 shared_secret_length);
Przemek Stekielfb3dd542022-12-01 14:59:15 +01006996#endif /* MBEDTLS_PSA_BUILTIN_ALG_FFDH */
6997
Gilles Peskine01d718c2018-09-18 12:01:02 +02006998 default:
Aditya Deshpande17845b82022-10-13 17:21:01 +01006999 (void) attributes;
7000 (void) key_buffer;
7001 (void) key_buffer_size;
Gilles Peskine93f85002018-11-16 16:43:31 +01007002 (void) peer_key;
7003 (void) peer_key_length;
Gilles Peskine0216fe12019-04-11 21:23:21 +02007004 (void) shared_secret;
7005 (void) shared_secret_size;
7006 (void) shared_secret_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01007007 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine01d718c2018-09-18 12:01:02 +02007008 }
Gilles Peskine0216fe12019-04-11 21:23:21 +02007009}
Gilles Peskine01d718c2018-09-18 12:01:02 +02007010
Aditya Deshpande17845b82022-10-13 17:21:01 +01007011/** Internal function for raw key agreement
7012 * Calls the driver wrapper which will hand off key agreement task
Aditya Deshpande40c05cc2022-10-14 16:41:40 +01007013 * to the driver's implementation if a driver is present.
7014 * Fallback specified in the driver wrapper is built-in raw key agreement
Aditya Deshpande17845b82022-10-13 17:21:01 +01007015 * (psa_key_agreement_raw_builtin).
7016 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007017static psa_status_t psa_key_agreement_raw_internal(psa_algorithm_t alg,
7018 psa_key_slot_t *private_key,
7019 const uint8_t *peer_key,
7020 size_t peer_key_length,
7021 uint8_t *shared_secret,
7022 size_t shared_secret_size,
7023 size_t *shared_secret_length)
Gilles Peskine51ae0e42019-05-16 17:31:03 +02007024{
Gilles Peskine449bd832023-01-11 14:50:10 +01007025 if (!PSA_ALG_IS_RAW_KEY_AGREEMENT(alg)) {
7026 return PSA_ERROR_NOT_SUPPORTED;
7027 }
Aditya Deshpande17845b82022-10-13 17:21:01 +01007028
7029 psa_key_attributes_t attributes = {
Gilles Peskine449bd832023-01-11 14:50:10 +01007030 .core = private_key->attr
Aditya Deshpande17845b82022-10-13 17:21:01 +01007031 };
7032
Gilles Peskine449bd832023-01-11 14:50:10 +01007033 return psa_driver_wrapper_key_agreement(&attributes,
7034 private_key->key.data,
7035 private_key->key.bytes, alg,
7036 peer_key, peer_key_length,
7037 shared_secret,
7038 shared_secret_size,
7039 shared_secret_length);
Gilles Peskine0216fe12019-04-11 21:23:21 +02007040}
7041
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02007042/* Note that if this function fails, you must call psa_key_derivation_abort()
Gilles Peskine01d718c2018-09-18 12:01:02 +02007043 * to potentially free embedded data structures and wipe confidential data.
7044 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007045static psa_status_t psa_key_agreement_internal(psa_key_derivation_operation_t *operation,
7046 psa_key_derivation_step_t step,
7047 psa_key_slot_t *private_key,
7048 const uint8_t *peer_key,
7049 size_t peer_key_length)
Gilles Peskine01d718c2018-09-18 12:01:02 +02007050{
7051 psa_status_t status;
Aditya Deshpande2f7fd762022-11-22 11:10:34 +00007052 uint8_t shared_secret[PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE];
Gilles Peskine01d718c2018-09-18 12:01:02 +02007053 size_t shared_secret_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01007054 psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE(operation->alg);
Gilles Peskine01d718c2018-09-18 12:01:02 +02007055
7056 /* Step 1: run the secret agreement algorithm to generate the shared
7057 * secret. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007058 status = psa_key_agreement_raw_internal(ka_alg,
7059 private_key,
7060 peer_key, peer_key_length,
7061 shared_secret,
7062 sizeof(shared_secret),
7063 &shared_secret_length);
7064 if (status != PSA_SUCCESS) {
Gilles Peskine12313cd2018-06-20 00:20:32 +02007065 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007066 }
Gilles Peskine12313cd2018-06-20 00:20:32 +02007067
Gilles Peskineb0b255c2018-07-06 17:01:38 +02007068 /* Step 2: set up the key derivation to generate key material from
Gilles Peskine224b0d62019-09-23 18:13:17 +02007069 * the shared secret. A shared secret is permitted wherever a key
7070 * of type DERIVE is permitted. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007071 status = psa_key_derivation_input_internal(operation, step,
7072 PSA_KEY_TYPE_DERIVE,
7073 shared_secret,
7074 shared_secret_length);
Gilles Peskine12313cd2018-06-20 00:20:32 +02007075exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01007076 mbedtls_platform_zeroize(shared_secret, shared_secret_length);
7077 return status;
Gilles Peskine12313cd2018-06-20 00:20:32 +02007078}
7079
Gilles Peskine449bd832023-01-11 14:50:10 +01007080psa_status_t psa_key_derivation_key_agreement(psa_key_derivation_operation_t *operation,
7081 psa_key_derivation_step_t step,
7082 mbedtls_svc_key_id_t private_key,
7083 const uint8_t *peer_key,
7084 size_t peer_key_length)
Gilles Peskine12313cd2018-06-20 00:20:32 +02007085{
Ronald Cronf95a2b12020-10-22 15:24:49 +02007086 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01007087 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01007088 psa_key_slot_t *slot;
Ronald Cronf95a2b12020-10-22 15:24:49 +02007089
Gilles Peskine449bd832023-01-11 14:50:10 +01007090 if (!PSA_ALG_IS_KEY_AGREEMENT(operation->alg)) {
7091 return PSA_ERROR_INVALID_ARGUMENT;
7092 }
Ronald Cron5c522922020-11-14 16:35:34 +01007093 status = psa_get_and_lock_transparent_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01007094 private_key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg);
7095 if (status != PSA_SUCCESS) {
7096 return status;
7097 }
7098 status = psa_key_agreement_internal(operation, step,
7099 slot,
7100 peer_key, peer_key_length);
7101 if (status != PSA_SUCCESS) {
7102 psa_key_derivation_abort(operation);
7103 } else {
Steven Cooremanfa5e6312020-10-15 17:07:12 +02007104 /* If a private key has been added as SECRET, we allow the derived
7105 * key material to be used as a key in PSA Crypto. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007106 if (step == PSA_KEY_DERIVATION_INPUT_SECRET) {
Steven Cooremanfa5e6312020-10-15 17:07:12 +02007107 operation->can_output_key = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01007108 }
Steven Cooremanfa5e6312020-10-15 17:07:12 +02007109 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02007110
Gilles Peskine449bd832023-01-11 14:50:10 +01007111 unlock_status = psa_unlock_key_slot(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02007112
Gilles Peskine449bd832023-01-11 14:50:10 +01007113 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskineaf3baab2018-06-27 22:55:52 +02007114}
7115
Gilles Peskine449bd832023-01-11 14:50:10 +01007116psa_status_t psa_raw_key_agreement(psa_algorithm_t alg,
7117 mbedtls_svc_key_id_t private_key,
7118 const uint8_t *peer_key,
7119 size_t peer_key_length,
7120 uint8_t *output,
7121 size_t output_size,
7122 size_t *output_length)
Gilles Peskine0216fe12019-04-11 21:23:21 +02007123{
Ronald Cronf95a2b12020-10-22 15:24:49 +02007124 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01007125 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cronf95a2b12020-10-22 15:24:49 +02007126 psa_key_slot_t *slot = NULL;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01007127 size_t expected_length;
Gilles Peskine0216fe12019-04-11 21:23:21 +02007128
Gilles Peskine449bd832023-01-11 14:50:10 +01007129 if (!PSA_ALG_IS_KEY_AGREEMENT(alg)) {
Gilles Peskine0216fe12019-04-11 21:23:21 +02007130 status = PSA_ERROR_INVALID_ARGUMENT;
7131 goto exit;
7132 }
Ronald Cron5c522922020-11-14 16:35:34 +01007133 status = psa_get_and_lock_transparent_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01007134 private_key, &slot, PSA_KEY_USAGE_DERIVE, alg);
7135 if (status != PSA_SUCCESS) {
Gilles Peskine0216fe12019-04-11 21:23:21 +02007136 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007137 }
Gilles Peskine0216fe12019-04-11 21:23:21 +02007138
Gilles Peskine3e561302022-04-14 00:17:15 +02007139 /* PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() is in general an upper bound
7140 * for the output size. The PSA specification only guarantees that this
7141 * function works if output_size >= PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE(...),
7142 * but it might be nice to allow smaller buffers if the output fits.
7143 * At the time of writing this comment, with only ECDH implemented,
7144 * PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() is exact so the point is moot.
7145 * If FFDH is implemented, PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() can easily
7146 * be exact for it as well. */
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01007147 expected_length =
Gilles Peskine449bd832023-01-11 14:50:10 +01007148 PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE(slot->attr.type, slot->attr.bits);
7149 if (output_size < expected_length) {
Gilles Peskine3e561302022-04-14 00:17:15 +02007150 status = PSA_ERROR_BUFFER_TOO_SMALL;
7151 goto exit;
7152 }
7153
Gilles Peskine449bd832023-01-11 14:50:10 +01007154 status = psa_key_agreement_raw_internal(alg, slot,
7155 peer_key, peer_key_length,
7156 output, output_size,
7157 output_length);
Gilles Peskine0216fe12019-04-11 21:23:21 +02007158
7159exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01007160 if (status != PSA_SUCCESS) {
Gilles Peskine0216fe12019-04-11 21:23:21 +02007161 /* If an error happens and is not handled properly, the output
7162 * may be used as a key to protect sensitive data. Arrange for such
7163 * a key to be random, which is likely to result in decryption or
7164 * verification errors. This is better than filling the buffer with
7165 * some constant data such as zeros, which would result in the data
7166 * being protected with a reproducible, easily knowable key.
7167 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007168 psa_generate_random(output, output_size);
Gilles Peskine0216fe12019-04-11 21:23:21 +02007169 *output_length = output_size;
7170 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02007171
Gilles Peskine449bd832023-01-11 14:50:10 +01007172 unlock_status = psa_unlock_key_slot(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02007173
Gilles Peskine449bd832023-01-11 14:50:10 +01007174 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine0216fe12019-04-11 21:23:21 +02007175}
Gilles Peskine86a440b2018-11-12 18:39:40 +01007176
7177
Gilles Peskine30524eb2020-11-13 17:02:26 +01007178
Gilles Peskine86a440b2018-11-12 18:39:40 +01007179/****************************************************************/
7180/* Random generation */
Gilles Peskine53d991e2018-07-12 01:14:59 +02007181/****************************************************************/
Gilles Peskine12313cd2018-06-20 00:20:32 +02007182
Gilles Peskine672a7712023-04-28 21:00:28 +02007183#if defined(MBEDTLS_PSA_INJECT_ENTROPY)
7184#include "entropy_poll.h"
7185#endif
7186
Gilles Peskine30524eb2020-11-13 17:02:26 +01007187/** Initialize the PSA random generator.
7188 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007189static void mbedtls_psa_random_init(mbedtls_psa_random_context_t *rng)
Gilles Peskine30524eb2020-11-13 17:02:26 +01007190{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007191#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
Gilles Peskine449bd832023-01-11 14:50:10 +01007192 memset(rng, 0, sizeof(*rng));
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007193#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
7194
Gilles Peskine30524eb2020-11-13 17:02:26 +01007195 /* Set default configuration if
7196 * mbedtls_psa_crypto_configure_entropy_sources() hasn't been called. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007197 if (rng->entropy_init == NULL) {
Gilles Peskine30524eb2020-11-13 17:02:26 +01007198 rng->entropy_init = mbedtls_entropy_init;
Gilles Peskine449bd832023-01-11 14:50:10 +01007199 }
7200 if (rng->entropy_free == NULL) {
Gilles Peskine30524eb2020-11-13 17:02:26 +01007201 rng->entropy_free = mbedtls_entropy_free;
Gilles Peskine449bd832023-01-11 14:50:10 +01007202 }
Gilles Peskine30524eb2020-11-13 17:02:26 +01007203
Gilles Peskine449bd832023-01-11 14:50:10 +01007204 rng->entropy_init(&rng->entropy);
Gilles Peskine30524eb2020-11-13 17:02:26 +01007205#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \
7206 defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES)
7207 /* The PSA entropy injection feature depends on using NV seed as an entropy
7208 * source. Add NV seed as an entropy source for PSA entropy injection. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007209 mbedtls_entropy_add_source(&rng->entropy,
7210 mbedtls_nv_seed_poll, NULL,
7211 MBEDTLS_ENTROPY_BLOCK_SIZE,
7212 MBEDTLS_ENTROPY_SOURCE_STRONG);
Gilles Peskine30524eb2020-11-13 17:02:26 +01007213#endif
7214
Gilles Peskine449bd832023-01-11 14:50:10 +01007215 mbedtls_psa_drbg_init(MBEDTLS_PSA_RANDOM_STATE);
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007216#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01007217}
7218
7219/** Deinitialize the PSA random generator.
7220 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007221static void mbedtls_psa_random_free(mbedtls_psa_random_context_t *rng)
Gilles Peskine30524eb2020-11-13 17:02:26 +01007222{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007223#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
Gilles Peskine449bd832023-01-11 14:50:10 +01007224 memset(rng, 0, sizeof(*rng));
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007225#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine449bd832023-01-11 14:50:10 +01007226 mbedtls_psa_drbg_free(MBEDTLS_PSA_RANDOM_STATE);
7227 rng->entropy_free(&rng->entropy);
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007228#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01007229}
7230
7231/** Seed the PSA random generator.
7232 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007233static psa_status_t mbedtls_psa_random_seed(mbedtls_psa_random_context_t *rng)
Gilles Peskine30524eb2020-11-13 17:02:26 +01007234{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007235#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
7236 /* Do nothing: the external RNG seeds itself. */
7237 (void) rng;
Gilles Peskine449bd832023-01-11 14:50:10 +01007238 return PSA_SUCCESS;
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007239#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01007240 const unsigned char drbg_seed[] = "PSA";
Gilles Peskine449bd832023-01-11 14:50:10 +01007241 int ret = mbedtls_psa_drbg_seed(&rng->entropy,
7242 drbg_seed, sizeof(drbg_seed) - 1);
7243 return mbedtls_to_psa_error(ret);
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007244#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01007245}
7246
Gilles Peskine449bd832023-01-11 14:50:10 +01007247psa_status_t psa_generate_random(uint8_t *output,
7248 size_t output_size)
Gilles Peskinee59236f2018-01-27 23:32:46 +01007249{
Gilles Peskinee59236f2018-01-27 23:32:46 +01007250 GUARD_MODULE_INITIALIZED;
7251
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007252#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
7253
7254 size_t output_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01007255 psa_status_t status = mbedtls_psa_external_get_random(&global_data.rng,
7256 output, output_size,
7257 &output_length);
7258 if (status != PSA_SUCCESS) {
7259 return status;
7260 }
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007261 /* Breaking up a request into smaller chunks is currently not supported
Tom Cosgrove1797b052022-12-04 17:19:59 +00007262 * for the external RNG interface. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007263 if (output_length != output_size) {
7264 return PSA_ERROR_INSUFFICIENT_ENTROPY;
7265 }
7266 return PSA_SUCCESS;
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007267
7268#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
7269
Gilles Peskine449bd832023-01-11 14:50:10 +01007270 while (output_size > 0) {
Gilles Peskine71ddab92021-01-04 21:01:07 +01007271 size_t request_size =
Gilles Peskine449bd832023-01-11 14:50:10 +01007272 (output_size > MBEDTLS_PSA_RANDOM_MAX_REQUEST ?
7273 MBEDTLS_PSA_RANDOM_MAX_REQUEST :
7274 output_size);
7275 int ret = mbedtls_psa_get_random(MBEDTLS_PSA_RANDOM_STATE,
7276 output, request_size);
7277 if (ret != 0) {
7278 return mbedtls_to_psa_error(ret);
7279 }
Gilles Peskine71ddab92021-01-04 21:01:07 +01007280 output_size -= request_size;
7281 output += request_size;
Gilles Peskinef181eca2019-08-07 13:49:00 +02007282 }
Gilles Peskine449bd832023-01-11 14:50:10 +01007283 return PSA_SUCCESS;
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007284#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskinee59236f2018-01-27 23:32:46 +01007285}
7286
Gilles Peskine8814fc42020-12-14 15:33:44 +01007287/* Wrapper function allowing the classic API to use the PSA RNG.
Gilles Peskine9c3e0602021-01-05 16:03:55 +01007288 *
7289 * `mbedtls_psa_get_random(MBEDTLS_PSA_RANDOM_STATE, ...)` calls
7290 * `psa_generate_random(...)`. The state parameter is ignored since the
7291 * PSA API doesn't support passing an explicit state.
7292 *
7293 * In the non-external case, psa_generate_random() calls an
7294 * `mbedtls_xxx_drbg_random` function which has exactly the same signature
7295 * and semantics as mbedtls_psa_get_random(). As an optimization,
7296 * instead of doing this back-and-forth between the PSA API and the
7297 * classic API, psa_crypto_random_impl.h defines `mbedtls_psa_get_random`
7298 * as a constant function pointer to `mbedtls_xxx_drbg_random`.
Gilles Peskine8814fc42020-12-14 15:33:44 +01007299 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007300#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
7301int mbedtls_psa_get_random(void *p_rng,
7302 unsigned char *output,
7303 size_t output_size)
Gilles Peskine8814fc42020-12-14 15:33:44 +01007304{
Gilles Peskine9c3e0602021-01-05 16:03:55 +01007305 /* This function takes a pointer to the RNG state because that's what
7306 * classic mbedtls functions using an RNG expect. The PSA RNG manages
7307 * its own state internally and doesn't let the caller access that state.
7308 * So we just ignore the state parameter, and in practice we'll pass
7309 * NULL. */
Gilles Peskine8814fc42020-12-14 15:33:44 +01007310 (void) p_rng;
Gilles Peskine449bd832023-01-11 14:50:10 +01007311 psa_status_t status = psa_generate_random(output, output_size);
7312 if (status == PSA_SUCCESS) {
7313 return 0;
7314 } else {
7315 return MBEDTLS_ERR_ENTROPY_SOURCE_FAILED;
7316 }
Gilles Peskine8814fc42020-12-14 15:33:44 +01007317}
7318#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
7319
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01007320#if defined(MBEDTLS_PSA_INJECT_ENTROPY)
Gilles Peskine449bd832023-01-11 14:50:10 +01007321psa_status_t mbedtls_psa_inject_entropy(const uint8_t *seed,
7322 size_t seed_size)
Netanel Gonen2bcd3122018-11-19 11:53:02 +02007323{
Gilles Peskine449bd832023-01-11 14:50:10 +01007324 if (global_data.initialized) {
7325 return PSA_ERROR_NOT_PERMITTED;
7326 }
Netanel Gonen21f37cb2018-11-19 11:53:55 +02007327
Gilles Peskine449bd832023-01-11 14:50:10 +01007328 if (((seed_size < MBEDTLS_ENTROPY_MIN_PLATFORM) ||
7329 (seed_size < MBEDTLS_ENTROPY_BLOCK_SIZE)) ||
7330 (seed_size > MBEDTLS_ENTROPY_MAX_SEED_SIZE)) {
7331 return PSA_ERROR_INVALID_ARGUMENT;
7332 }
Netanel Gonen21f37cb2018-11-19 11:53:55 +02007333
Gilles Peskine449bd832023-01-11 14:50:10 +01007334 return mbedtls_psa_storage_inject_entropy(seed, seed_size);
Netanel Gonen2bcd3122018-11-19 11:53:02 +02007335}
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01007336#endif /* MBEDTLS_PSA_INJECT_ENTROPY */
Netanel Gonen2bcd3122018-11-19 11:53:02 +02007337
Ronald Cron3772afe2021-02-08 16:10:05 +01007338/** Validate the key type and size for key generation
Ronald Cron01b2aba2020-10-05 09:42:02 +02007339 *
Ronald Cron3772afe2021-02-08 16:10:05 +01007340 * \param type The key type
7341 * \param bits The number of bits of the key
Ronald Cron01b2aba2020-10-05 09:42:02 +02007342 *
7343 * \retval #PSA_SUCCESS
Ronald Cron3772afe2021-02-08 16:10:05 +01007344 * The key type and size are valid.
Ronald Cron01b2aba2020-10-05 09:42:02 +02007345 * \retval #PSA_ERROR_INVALID_ARGUMENT
7346 * The size in bits of the key is not valid.
7347 * \retval #PSA_ERROR_NOT_SUPPORTED
7348 * The type and/or the size in bits of the key or the combination of
7349 * the two is not supported.
7350 */
Ronald Cron3772afe2021-02-08 16:10:05 +01007351static psa_status_t psa_validate_key_type_and_size_for_key_generation(
Gilles Peskine449bd832023-01-11 14:50:10 +01007352 psa_key_type_t type, size_t bits)
Gilles Peskinee59236f2018-01-27 23:32:46 +01007353{
Ronald Cronf3bb7612020-10-02 20:11:59 +02007354 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinee59236f2018-01-27 23:32:46 +01007355
Gilles Peskine449bd832023-01-11 14:50:10 +01007356 if (key_type_is_raw_bytes(type)) {
7357 status = psa_validate_unstructured_key_bit_size(type, bits);
7358 if (status != PSA_SUCCESS) {
7359 return status;
7360 }
7361 } else
Valerio Settif6d4dfb2023-07-10 10:55:12 +02007362#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01007363 if (PSA_KEY_TYPE_IS_RSA(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
7364 if (bits > PSA_VENDOR_RSA_MAX_KEY_BITS) {
7365 return PSA_ERROR_NOT_SUPPORTED;
7366 }
Waleed Elmelegyd7bdbbe2023-07-20 16:26:58 +00007367 if (bits < PSA_VENDOR_RSA_GENERATE_MIN_KEY_BITS) {
Waleed Elmelegyab570712023-07-05 16:40:58 +00007368 return PSA_ERROR_NOT_SUPPORTED;
7369 }
Steven Cooreman81be2fa2020-07-24 22:04:59 +02007370
Ronald Cron01b2aba2020-10-05 09:42:02 +02007371 /* Accept only byte-aligned keys, for the same reasons as
7372 * in psa_import_rsa_key(). */
Gilles Peskine449bd832023-01-11 14:50:10 +01007373 if (bits % 8 != 0) {
7374 return PSA_ERROR_NOT_SUPPORTED;
7375 }
7376 } else
Valerio Settif6d4dfb2023-07-10 10:55:12 +02007377#endif /* defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE) */
Ronald Cron01b2aba2020-10-05 09:42:02 +02007378
Valerio Setti6a9d0ee2023-06-21 10:07:21 +02007379#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01007380 if (PSA_KEY_TYPE_IS_ECC(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
Ronald Crond81ab562021-02-16 09:01:16 +01007381 /* To avoid empty block, return successfully here. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007382 return PSA_SUCCESS;
7383 } else
Valerio Setti6a9d0ee2023-06-21 10:07:21 +02007384#endif /* defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE) */
Przemek Stekielfedd1342022-12-01 15:00:02 +01007385
Valerio Settia55f0422023-07-10 15:34:41 +02007386#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE)
Przemek Stekielfedd1342022-12-01 15:00:02 +01007387 if (PSA_KEY_TYPE_IS_DH(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
Przemek Stekield1cf1ba2023-04-27 12:04:21 +02007388 if (psa_is_dh_key_size_valid(bits) == 0) {
Przemek Stekielfedd1342022-12-01 15:00:02 +01007389 return PSA_ERROR_NOT_SUPPORTED;
7390 }
7391 } else
Valerio Settia55f0422023-07-10 15:34:41 +02007392#endif /* defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE) */
Ronald Cron01b2aba2020-10-05 09:42:02 +02007393 {
Gilles Peskine449bd832023-01-11 14:50:10 +01007394 return PSA_ERROR_NOT_SUPPORTED;
Ronald Cron01b2aba2020-10-05 09:42:02 +02007395 }
7396
Gilles Peskine449bd832023-01-11 14:50:10 +01007397 return PSA_SUCCESS;
Ronald Cron01b2aba2020-10-05 09:42:02 +02007398}
7399
Ronald Cron55ed0592020-10-05 10:30:40 +02007400psa_status_t psa_generate_key_internal(
Ronald Cron2a38a6b2020-10-02 20:02:04 +02007401 const psa_key_attributes_t *attributes,
Gilles Peskine449bd832023-01-11 14:50:10 +01007402 uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length)
Ronald Cron01b2aba2020-10-05 09:42:02 +02007403{
7404 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron2a38a6b2020-10-02 20:02:04 +02007405 psa_key_type_t type = attributes->core.type;
Ronald Cron01b2aba2020-10-05 09:42:02 +02007406
Gilles Peskine449bd832023-01-11 14:50:10 +01007407 if ((attributes->domain_parameters == NULL) &&
7408 (attributes->domain_parameters_size != 0)) {
7409 return PSA_ERROR_INVALID_ARGUMENT;
7410 }
Ronald Cron01b2aba2020-10-05 09:42:02 +02007411
Gilles Peskine449bd832023-01-11 14:50:10 +01007412 if (key_type_is_raw_bytes(type)) {
7413 status = psa_generate_random(key_buffer, key_buffer_size);
7414 if (status != PSA_SUCCESS) {
7415 return status;
7416 }
Steven Cooreman81be2fa2020-07-24 22:04:59 +02007417
David Brown12ca5032021-02-11 11:02:00 -07007418#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Gilles Peskine449bd832023-01-11 14:50:10 +01007419 if (type == PSA_KEY_TYPE_DES) {
7420 psa_des_set_key_parity(key_buffer, key_buffer_size);
7421 }
David Brown8107e312021-02-12 08:08:46 -07007422#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */
Gilles Peskine449bd832023-01-11 14:50:10 +01007423 } else
Gilles Peskinee59236f2018-01-27 23:32:46 +01007424
Valerio Setti76df8c12023-07-11 14:11:28 +02007425#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_GENERATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01007426 if (type == PSA_KEY_TYPE_RSA_KEY_PAIR) {
7427 return mbedtls_psa_rsa_generate_key(attributes,
7428 key_buffer,
7429 key_buffer_size,
7430 key_buffer_length);
7431 } else
Valerio Setti76df8c12023-07-11 14:11:28 +02007432#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_GENERATE) */
Gilles Peskinee59236f2018-01-27 23:32:46 +01007433
Valerio Settibfeaf5b2023-06-20 13:27:46 +02007434#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01007435 if (PSA_KEY_TYPE_IS_ECC(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
7436 return mbedtls_psa_ecp_generate_key(attributes,
7437 key_buffer,
7438 key_buffer_size,
7439 key_buffer_length);
7440 } else
Valerio Settibfeaf5b2023-06-20 13:27:46 +02007441#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE) */
Przemek Stekielfedd1342022-12-01 15:00:02 +01007442
Valerio Settia55f0422023-07-10 15:34:41 +02007443#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE)
Przemek Stekielfedd1342022-12-01 15:00:02 +01007444 if (PSA_KEY_TYPE_IS_DH(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
7445 return mbedtls_psa_ffdh_generate_key(attributes,
7446 key_buffer,
7447 key_buffer_size,
7448 key_buffer_length);
7449 } else
Valerio Settia55f0422023-07-10 15:34:41 +02007450#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE) */
Steven Cooreman29149862020-08-05 15:43:42 +02007451 {
Gilles Peskine449bd832023-01-11 14:50:10 +01007452 (void) key_buffer_length;
7453 return PSA_ERROR_NOT_SUPPORTED;
Steven Cooreman29149862020-08-05 15:43:42 +02007454 }
Gilles Peskinee59236f2018-01-27 23:32:46 +01007455
Gilles Peskine449bd832023-01-11 14:50:10 +01007456 return PSA_SUCCESS;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02007457}
Darryl Green0c6575a2018-11-07 16:05:30 +00007458
Gilles Peskine449bd832023-01-11 14:50:10 +01007459psa_status_t psa_generate_key(const psa_key_attributes_t *attributes,
7460 mbedtls_svc_key_id_t *key)
Gilles Peskineff5f0e72019-04-18 12:53:30 +02007461{
7462 psa_status_t status;
7463 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02007464 psa_se_drv_table_entry_t *driver = NULL;
Ronald Cron2b56bc82020-10-05 10:02:26 +02007465 size_t key_buffer_size;
Gilles Peskine11792082019-08-06 18:36:36 +02007466
Ronald Cron81709fc2020-11-14 12:10:32 +01007467 *key = MBEDTLS_SVC_KEY_ID_INIT;
7468
Gilles Peskine0f84d622019-09-12 19:03:13 +02007469 /* Reject any attempt to create a zero-length key so that we don't
7470 * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007471 if (psa_get_key_bits(attributes) == 0) {
7472 return PSA_ERROR_INVALID_ARGUMENT;
7473 }
Gilles Peskine0f84d622019-09-12 19:03:13 +02007474
Przemyslaw Stekielc0fe8202021-10-07 11:08:56 +02007475 /* Reject any attempt to create a public key. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007476 if (PSA_KEY_TYPE_IS_PUBLIC_KEY(attributes->core.type)) {
7477 return PSA_ERROR_INVALID_ARGUMENT;
7478 }
Przemyslaw Stekielc0fe8202021-10-07 11:08:56 +02007479
Gilles Peskine449bd832023-01-11 14:50:10 +01007480 status = psa_start_key_creation(PSA_KEY_CREATION_GENERATE, attributes,
7481 &slot, &driver);
7482 if (status != PSA_SUCCESS) {
Gilles Peskine11792082019-08-06 18:36:36 +02007483 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007484 }
Gilles Peskine11792082019-08-06 18:36:36 +02007485
Ronald Cron977c2472020-10-13 08:32:21 +02007486 /* In the case of a transparent key or an opaque key stored in local
Archana449608b2021-09-08 15:36:05 +05307487 * storage ( thus not in the case of generating a key in a secure element
7488 * with storage ( MBEDTLS_PSA_CRYPTO_SE_C ) ),we have to allocate a
7489 * buffer to hold the generated key material. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007490 if (slot->key.data == NULL) {
7491 if (PSA_KEY_LIFETIME_GET_LOCATION(attributes->core.lifetime) ==
7492 PSA_KEY_LOCATION_LOCAL_STORAGE) {
Ronald Cron3772afe2021-02-08 16:10:05 +01007493 status = psa_validate_key_type_and_size_for_key_generation(
Gilles Peskine449bd832023-01-11 14:50:10 +01007494 attributes->core.type, attributes->core.bits);
7495 if (status != PSA_SUCCESS) {
Ronald Cron3772afe2021-02-08 16:10:05 +01007496 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007497 }
Ronald Cron3772afe2021-02-08 16:10:05 +01007498
7499 key_buffer_size = PSA_EXPORT_KEY_OUTPUT_SIZE(
Gilles Peskine449bd832023-01-11 14:50:10 +01007500 attributes->core.type,
7501 attributes->core.bits);
7502 } else {
Ronald Cron977c2472020-10-13 08:32:21 +02007503 status = psa_driver_wrapper_get_key_buffer_size(
Gilles Peskine449bd832023-01-11 14:50:10 +01007504 attributes, &key_buffer_size);
7505 if (status != PSA_SUCCESS) {
Ronald Cron3772afe2021-02-08 16:10:05 +01007506 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007507 }
Ronald Cron977c2472020-10-13 08:32:21 +02007508 }
Ronald Cron977c2472020-10-13 08:32:21 +02007509
Gilles Peskine449bd832023-01-11 14:50:10 +01007510 status = psa_allocate_buffer_to_slot(slot, key_buffer_size);
7511 if (status != PSA_SUCCESS) {
Ronald Cron977c2472020-10-13 08:32:21 +02007512 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007513 }
Ronald Cron977c2472020-10-13 08:32:21 +02007514 }
7515
Gilles Peskine449bd832023-01-11 14:50:10 +01007516 status = psa_driver_wrapper_generate_key(attributes,
7517 slot->key.data, slot->key.bytes, &slot->key.bytes);
Gilles Peskine11792082019-08-06 18:36:36 +02007518
Gilles Peskine449bd832023-01-11 14:50:10 +01007519 if (status != PSA_SUCCESS) {
7520 psa_remove_key_data_from_memory(slot);
7521 }
Ronald Cron2b56bc82020-10-05 10:02:26 +02007522
Gilles Peskine11792082019-08-06 18:36:36 +02007523exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01007524 if (status == PSA_SUCCESS) {
7525 status = psa_finish_key_creation(slot, driver, key);
7526 }
7527 if (status != PSA_SUCCESS) {
7528 psa_fail_key_creation(slot, driver);
7529 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02007530
Gilles Peskine449bd832023-01-11 14:50:10 +01007531 return status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01007532}
7533
Gilles Peskinee59236f2018-01-27 23:32:46 +01007534/****************************************************************/
7535/* Module setup */
7536/****************************************************************/
7537
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007538#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
Gilles Peskine5e769522018-11-20 21:59:56 +01007539psa_status_t mbedtls_psa_crypto_configure_entropy_sources(
Gilles Peskine449bd832023-01-11 14:50:10 +01007540 void (* entropy_init)(mbedtls_entropy_context *ctx),
7541 void (* entropy_free)(mbedtls_entropy_context *ctx))
Gilles Peskine5e769522018-11-20 21:59:56 +01007542{
Gilles Peskine449bd832023-01-11 14:50:10 +01007543 if (global_data.rng_state != RNG_NOT_INITIALIZED) {
7544 return PSA_ERROR_BAD_STATE;
7545 }
Gilles Peskine30524eb2020-11-13 17:02:26 +01007546 global_data.rng.entropy_init = entropy_init;
7547 global_data.rng.entropy_free = entropy_free;
Gilles Peskine449bd832023-01-11 14:50:10 +01007548 return PSA_SUCCESS;
Gilles Peskine5e769522018-11-20 21:59:56 +01007549}
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007550#endif /* !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) */
Gilles Peskine5e769522018-11-20 21:59:56 +01007551
Gilles Peskine449bd832023-01-11 14:50:10 +01007552void mbedtls_psa_crypto_free(void)
Gilles Peskinee59236f2018-01-27 23:32:46 +01007553{
Gilles Peskine449bd832023-01-11 14:50:10 +01007554 psa_wipe_all_key_slots();
7555 if (global_data.rng_state != RNG_NOT_INITIALIZED) {
7556 mbedtls_psa_random_free(&global_data.rng);
Gilles Peskinec6b69072018-11-20 21:42:52 +01007557 }
7558 /* Wipe all remaining data, including configuration.
7559 * In particular, this sets all state indicator to the value
7560 * indicating "uninitialized". */
Gilles Peskine449bd832023-01-11 14:50:10 +01007561 mbedtls_platform_zeroize(&global_data, sizeof(global_data));
Ronald Cron9ba76912021-04-10 16:57:30 +02007562
7563 /* Terminate drivers */
Gilles Peskine449bd832023-01-11 14:50:10 +01007564 psa_driver_wrapper_free();
Gilles Peskinee59236f2018-01-27 23:32:46 +01007565}
7566
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02007567#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
7568/** Recover a transaction that was interrupted by a power failure.
7569 *
7570 * This function is called during initialization, before psa_crypto_init()
7571 * returns. If this function returns a failure status, the initialization
7572 * fails.
7573 */
7574static psa_status_t psa_crypto_recover_transaction(
Gilles Peskine449bd832023-01-11 14:50:10 +01007575 const psa_crypto_transaction_t *transaction)
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02007576{
Gilles Peskine449bd832023-01-11 14:50:10 +01007577 switch (transaction->unknown.type) {
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02007578 case PSA_CRYPTO_TRANSACTION_CREATE_KEY:
7579 case PSA_CRYPTO_TRANSACTION_DESTROY_KEY:
Gilles Peskine449bd832023-01-11 14:50:10 +01007580 /* TODO - fall through to the failure case until this
7581 * is implemented.
7582 * https://github.com/ARMmbed/mbed-crypto/issues/218
7583 */
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02007584 default:
7585 /* We found an unsupported transaction in the storage.
7586 * We don't know what state the storage is in. Give up. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007587 return PSA_ERROR_DATA_INVALID;
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02007588 }
7589}
7590#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
7591
Gilles Peskine449bd832023-01-11 14:50:10 +01007592psa_status_t psa_crypto_init(void)
Gilles Peskinee59236f2018-01-27 23:32:46 +01007593{
Gilles Peskine66fb1262018-12-10 16:29:04 +01007594 psa_status_t status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01007595
Gilles Peskinec6b69072018-11-20 21:42:52 +01007596 /* Double initialization is explicitly allowed. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007597 if (global_data.initialized != 0) {
7598 return PSA_SUCCESS;
7599 }
Gilles Peskinee59236f2018-01-27 23:32:46 +01007600
Manuel Pégourié-Gonnard7abdf7e2023-03-09 11:17:43 +01007601 /* Init drivers */
7602 status = psa_driver_wrapper_init();
7603 if (status != PSA_SUCCESS) {
7604 goto exit;
7605 }
7606 global_data.drivers_initialized = 1;
7607
Gilles Peskine30524eb2020-11-13 17:02:26 +01007608 /* Initialize and seed the random generator. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007609 mbedtls_psa_random_init(&global_data.rng);
Gilles Peskinec6b69072018-11-20 21:42:52 +01007610 global_data.rng_state = RNG_INITIALIZED;
Gilles Peskine449bd832023-01-11 14:50:10 +01007611 status = mbedtls_psa_random_seed(&global_data.rng);
7612 if (status != PSA_SUCCESS) {
Gilles Peskinee59236f2018-01-27 23:32:46 +01007613 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007614 }
Gilles Peskinec6b69072018-11-20 21:42:52 +01007615 global_data.rng_state = RNG_SEEDED;
Gilles Peskinee59236f2018-01-27 23:32:46 +01007616
Gilles Peskine449bd832023-01-11 14:50:10 +01007617 status = psa_initialize_key_slots();
7618 if (status != PSA_SUCCESS) {
Gilles Peskine66fb1262018-12-10 16:29:04 +01007619 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007620 }
Gilles Peskinec6b69072018-11-20 21:42:52 +01007621
Gilles Peskine4b734222019-07-24 15:56:31 +02007622#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
Gilles Peskine449bd832023-01-11 14:50:10 +01007623 status = psa_crypto_load_transaction();
7624 if (status == PSA_SUCCESS) {
7625 status = psa_crypto_recover_transaction(&psa_crypto_transaction);
7626 if (status != PSA_SUCCESS) {
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02007627 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007628 }
7629 status = psa_crypto_stop_transaction();
7630 } else if (status == PSA_ERROR_DOES_NOT_EXIST) {
Gilles Peskinefc762652019-07-22 19:30:34 +02007631 /* There's no transaction to complete. It's all good. */
7632 status = PSA_SUCCESS;
7633 }
Gilles Peskine4b734222019-07-24 15:56:31 +02007634#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
Gilles Peskinefc762652019-07-22 19:30:34 +02007635
Gilles Peskinec6b69072018-11-20 21:42:52 +01007636 /* All done. */
Gilles Peskinee59236f2018-01-27 23:32:46 +01007637 global_data.initialized = 1;
7638
7639exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01007640 if (status != PSA_SUCCESS) {
7641 mbedtls_psa_crypto_free();
7642 }
7643 return status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01007644}
7645
Yanray Wangffc3c482023-07-11 12:01:04 +08007646#if defined(PSA_WANT_ALG_SOME_PAKE)
Przemek Stekielca8d2b22023-01-17 16:21:33 +01007647psa_status_t psa_crypto_driver_pake_get_password_len(
7648 const psa_crypto_driver_pake_inputs_t *inputs,
7649 size_t *password_len)
7650{
7651 if (inputs->password_len == 0) {
7652 return PSA_ERROR_BAD_STATE;
7653 }
7654
7655 *password_len = inputs->password_len;
7656
7657 return PSA_SUCCESS;
7658}
7659
7660psa_status_t psa_crypto_driver_pake_get_password(
7661 const psa_crypto_driver_pake_inputs_t *inputs,
7662 uint8_t *buffer, size_t buffer_size, size_t *buffer_length)
7663{
7664 if (inputs->password_len == 0) {
7665 return PSA_ERROR_BAD_STATE;
7666 }
7667
7668 if (buffer_size < inputs->password_len) {
7669 return PSA_ERROR_BUFFER_TOO_SMALL;
7670 }
7671
7672 memcpy(buffer, inputs->password, inputs->password_len);
7673 *buffer_length = inputs->password_len;
7674
7675 return PSA_SUCCESS;
7676}
7677
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007678psa_status_t psa_crypto_driver_pake_get_user_len(
7679 const psa_crypto_driver_pake_inputs_t *inputs,
7680 size_t *user_len)
7681{
7682 if (inputs->user_len == 0) {
7683 return PSA_ERROR_BAD_STATE;
7684 }
7685
7686 *user_len = inputs->user_len;
7687
7688 return PSA_SUCCESS;
7689}
7690
7691psa_status_t psa_crypto_driver_pake_get_user(
7692 const psa_crypto_driver_pake_inputs_t *inputs,
Przemek Stekielc0e62502023-03-14 11:49:36 +01007693 uint8_t *user_id, size_t user_id_size, size_t *user_id_len)
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007694{
7695 if (inputs->user_len == 0) {
7696 return PSA_ERROR_BAD_STATE;
7697 }
7698
Przemek Stekielc0e62502023-03-14 11:49:36 +01007699 if (user_id_size < inputs->user_len) {
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007700 return PSA_ERROR_BUFFER_TOO_SMALL;
7701 }
7702
Przemek Stekielc0e62502023-03-14 11:49:36 +01007703 memcpy(user_id, inputs->user, inputs->user_len);
7704 *user_id_len = inputs->user_len;
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007705
7706 return PSA_SUCCESS;
7707}
7708
7709psa_status_t psa_crypto_driver_pake_get_peer_len(
7710 const psa_crypto_driver_pake_inputs_t *inputs,
7711 size_t *peer_len)
7712{
7713 if (inputs->peer_len == 0) {
7714 return PSA_ERROR_BAD_STATE;
7715 }
7716
7717 *peer_len = inputs->peer_len;
7718
7719 return PSA_SUCCESS;
7720}
7721
7722psa_status_t psa_crypto_driver_pake_get_peer(
7723 const psa_crypto_driver_pake_inputs_t *inputs,
Przemek Stekielc0e62502023-03-14 11:49:36 +01007724 uint8_t *peer_id, size_t peer_id_size, size_t *peer_id_length)
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007725{
7726 if (inputs->peer_len == 0) {
7727 return PSA_ERROR_BAD_STATE;
7728 }
7729
Przemek Stekielc0e62502023-03-14 11:49:36 +01007730 if (peer_id_size < inputs->peer_len) {
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007731 return PSA_ERROR_BUFFER_TOO_SMALL;
7732 }
7733
Przemek Stekielc0e62502023-03-14 11:49:36 +01007734 memcpy(peer_id, inputs->peer, inputs->peer_len);
7735 *peer_id_length = inputs->peer_len;
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01007736
7737 return PSA_SUCCESS;
7738}
7739
Przemek Stekielca8d2b22023-01-17 16:21:33 +01007740psa_status_t psa_crypto_driver_pake_get_cipher_suite(
7741 const psa_crypto_driver_pake_inputs_t *inputs,
7742 psa_pake_cipher_suite_t *cipher_suite)
7743{
7744 if (inputs->cipher_suite.algorithm == PSA_ALG_NONE) {
7745 return PSA_ERROR_BAD_STATE;
7746 }
7747
7748 *cipher_suite = inputs->cipher_suite;
7749
7750 return PSA_SUCCESS;
7751}
7752
Neil Armstronga7d08c32022-06-01 18:21:20 +02007753psa_status_t psa_pake_setup(
7754 psa_pake_operation_t *operation,
7755 const psa_pake_cipher_suite_t *cipher_suite)
7756{
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007757 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007758
Przemek Stekiel1c3cfb42023-01-26 10:35:02 +01007759 if (operation->stage != PSA_PAKE_OPERATION_STAGE_SETUP) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007760 status = PSA_ERROR_BAD_STATE;
7761 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007762 }
7763
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01007764 if (PSA_ALG_IS_PAKE(cipher_suite->algorithm) == 0 ||
Przemek Stekiel51eac532022-12-07 11:04:51 +01007765 PSA_ALG_IS_HASH(cipher_suite->hash) == 0) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007766 status = PSA_ERROR_INVALID_ARGUMENT;
7767 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007768 }
7769
Przemek Stekiel51eac532022-12-07 11:04:51 +01007770 memset(&operation->data.inputs, 0, sizeof(operation->data.inputs));
7771
Przemek Stekiele12ed362022-12-21 12:54:46 +01007772 operation->alg = cipher_suite->algorithm;
Przemek Stekiel656b2592023-03-22 13:15:33 +01007773 operation->primitive = PSA_PAKE_PRIMITIVE(cipher_suite->type,
7774 cipher_suite->family, cipher_suite->bits);
Przemek Stekiel51eac532022-12-07 11:04:51 +01007775 operation->data.inputs.cipher_suite = *cipher_suite;
7776
Przemek Stekiel4aa99402023-02-27 13:00:57 +01007777#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01007778 if (operation->alg == PSA_ALG_JPAKE) {
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01007779 psa_jpake_computation_stage_t *computation_stage =
Przemek Stekieldde6a912023-01-26 08:46:37 +01007780 &operation->computation_stage.jpake;
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01007781
David Horstmann16f01512023-06-14 17:21:07 +01007782 memset(computation_stage, 0, sizeof(*computation_stage));
David Horstmanne7f21e62023-05-12 18:17:21 +01007783 computation_stage->step = PSA_PAKE_STEP_KEY_SHARE;
Przemek Stekiel80a88492023-02-20 13:32:22 +01007784 } else
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007785#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiel80a88492023-02-20 13:32:22 +01007786 {
7787 status = PSA_ERROR_NOT_SUPPORTED;
7788 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01007789 }
7790
Przemek Stekiel1c3cfb42023-01-26 10:35:02 +01007791 operation->stage = PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS;
7792
Przemek Stekiel51eac532022-12-07 11:04:51 +01007793 return PSA_SUCCESS;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007794exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007795 psa_pake_abort(operation);
7796 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02007797}
7798
7799psa_status_t psa_pake_set_password_key(
7800 psa_pake_operation_t *operation,
7801 mbedtls_svc_key_id_t password)
7802{
Neil Armstrong5ae60962022-09-15 11:29:46 +02007803 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel6c764412022-11-22 14:05:12 +01007804 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
7805 psa_key_slot_t *slot = NULL;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01007806 psa_key_attributes_t attributes;
7807 psa_key_type_t type;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007808
Przemek Stekiel51eac532022-12-07 11:04:51 +01007809 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007810 status = PSA_ERROR_BAD_STATE;
7811 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007812 }
7813
Przemek Stekiel6c764412022-11-22 14:05:12 +01007814 status = psa_get_and_lock_key_slot_with_policy(password, &slot,
7815 PSA_KEY_USAGE_DERIVE,
Przemek Stekield5d28a22023-01-26 10:46:05 +01007816 operation->alg);
Neil Armstrong5ae60962022-09-15 11:29:46 +02007817 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007818 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007819 }
7820
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01007821 attributes = (psa_key_attributes_t) {
Przemek Stekiel6c764412022-11-22 14:05:12 +01007822 .core = slot->attr
7823 };
Neil Armstrong5ae60962022-09-15 11:29:46 +02007824
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01007825 type = psa_get_key_type(&attributes);
Neil Armstrong5ae60962022-09-15 11:29:46 +02007826
Przemek Stekiel51eac532022-12-07 11:04:51 +01007827 if (type != PSA_KEY_TYPE_PASSWORD &&
7828 type != PSA_KEY_TYPE_PASSWORD_HASH) {
7829 status = PSA_ERROR_INVALID_ARGUMENT;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007830 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007831 }
7832
Przemek Stekiel51eac532022-12-07 11:04:51 +01007833 operation->data.inputs.password = mbedtls_calloc(1, slot->key.bytes);
7834 if (operation->data.inputs.password == NULL) {
Przemek Stekiele12ed362022-12-21 12:54:46 +01007835 status = PSA_ERROR_INSUFFICIENT_MEMORY;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007836 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007837 }
7838
7839 memcpy(operation->data.inputs.password, slot->key.data, slot->key.bytes);
7840 operation->data.inputs.password_len = slot->key.bytes;
Przemek Stekiel9dd24402023-01-26 15:06:09 +01007841 operation->data.inputs.attributes = attributes;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007842exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007843 if (status != PSA_SUCCESS) {
7844 psa_pake_abort(operation);
7845 }
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007846 unlock_status = psa_unlock_key_slot(slot);
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007847 return (status == PSA_SUCCESS) ? unlock_status : status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02007848}
7849
7850psa_status_t psa_pake_set_user(
7851 psa_pake_operation_t *operation,
7852 const uint8_t *user_id,
7853 size_t user_id_len)
7854{
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007855 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007856
7857 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007858 status = PSA_ERROR_BAD_STATE;
7859 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007860 }
7861
Przemek Stekiel51eac532022-12-07 11:04:51 +01007862 if (user_id_len == 0) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007863 status = PSA_ERROR_INVALID_ARGUMENT;
7864 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007865 }
7866
Przemek Stekielf309d6b2023-03-10 09:54:45 +01007867 if (operation->data.inputs.user_len != 0) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007868 status = PSA_ERROR_BAD_STATE;
7869 goto exit;
7870 }
7871
Przemek Stekielf309d6b2023-03-10 09:54:45 +01007872 operation->data.inputs.user = mbedtls_calloc(1, user_id_len);
7873 if (operation->data.inputs.user == NULL) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007874 status = PSA_ERROR_INSUFFICIENT_MEMORY;
7875 goto exit;
7876 }
7877
Przemek Stekielf309d6b2023-03-10 09:54:45 +01007878 memcpy(operation->data.inputs.user, user_id, user_id_len);
7879 operation->data.inputs.user_len = user_id_len;
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007880
7881 return PSA_SUCCESS;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007882exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007883 psa_pake_abort(operation);
7884 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02007885}
7886
7887psa_status_t psa_pake_set_peer(
7888 psa_pake_operation_t *operation,
7889 const uint8_t *peer_id,
7890 size_t peer_id_len)
7891{
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007892 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007893
7894 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007895 status = PSA_ERROR_BAD_STATE;
7896 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007897 }
7898
Przemek Stekiel51eac532022-12-07 11:04:51 +01007899 if (peer_id_len == 0) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007900 status = PSA_ERROR_INVALID_ARGUMENT;
7901 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007902 }
7903
Przemek Stekielf309d6b2023-03-10 09:54:45 +01007904 if (operation->data.inputs.peer_len != 0) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007905 status = PSA_ERROR_BAD_STATE;
7906 goto exit;
7907 }
7908
Przemek Stekielf309d6b2023-03-10 09:54:45 +01007909 operation->data.inputs.peer = mbedtls_calloc(1, peer_id_len);
7910 if (operation->data.inputs.peer == NULL) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007911 status = PSA_ERROR_INSUFFICIENT_MEMORY;
7912 goto exit;
7913 }
7914
Przemek Stekielf309d6b2023-03-10 09:54:45 +01007915 memcpy(operation->data.inputs.peer, peer_id, peer_id_len);
7916 operation->data.inputs.peer_len = peer_id_len;
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007917
7918 return PSA_SUCCESS;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007919exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007920 psa_pake_abort(operation);
7921 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02007922}
7923
7924psa_status_t psa_pake_set_role(
7925 psa_pake_operation_t *operation,
7926 psa_pake_role_t role)
7927{
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007928 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007929
Przemek Stekiel51eac532022-12-07 11:04:51 +01007930 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007931 status = PSA_ERROR_BAD_STATE;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007932 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01007933 }
7934
Przemek Stekiel09104b82023-03-06 14:11:51 +01007935 switch (operation->alg) {
7936#if defined(PSA_WANT_ALG_JPAKE)
7937 case PSA_ALG_JPAKE:
7938 if (role == PSA_PAKE_ROLE_NONE) {
7939 return PSA_SUCCESS;
7940 }
7941 status = PSA_ERROR_INVALID_ARGUMENT;
7942 break;
7943#endif
7944 default:
7945 (void) role;
7946 status = PSA_ERROR_NOT_SUPPORTED;
7947 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02007948 }
Przemek Stekiel3e784d82023-02-08 09:12:42 +01007949exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007950 psa_pake_abort(operation);
7951 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02007952}
7953
David Horstmanne7f21e62023-05-12 18:17:21 +01007954/* Auxiliary function to convert core computation stage to single driver step. */
Przemek Stekiel4aa99402023-02-27 13:00:57 +01007955#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiel251e86a2023-02-17 14:30:50 +01007956static psa_crypto_driver_pake_step_t convert_jpake_computation_stage_to_driver_step(
Przemek Stekieldde6a912023-01-26 08:46:37 +01007957 psa_jpake_computation_stage_t *stage)
Przemek Stekielb09c4872023-01-17 12:05:38 +01007958{
David Horstmann74a3d8c2023-06-14 18:28:19 +01007959 psa_crypto_driver_pake_step_t key_share_step;
David Horstmann5da95602023-06-08 15:37:12 +01007960 if (stage->round == PSA_JPAKE_FIRST) {
David Horstmanne7f21e62023-05-12 18:17:21 +01007961 int is_x1;
David Horstmann74a3d8c2023-06-14 18:28:19 +01007962
David Horstmann024e5c52023-06-14 15:48:21 +01007963 if (stage->io_mode == PSA_JPAKE_OUTPUT) {
David Horstmanne7f21e62023-05-12 18:17:21 +01007964 is_x1 = (stage->outputs < 1);
7965 } else {
7966 is_x1 = (stage->inputs < 1);
7967 }
7968
David Horstmann74a3d8c2023-06-14 18:28:19 +01007969 key_share_step = is_x1 ?
7970 PSA_JPAKE_X1_STEP_KEY_SHARE :
7971 PSA_JPAKE_X2_STEP_KEY_SHARE;
David Horstmann5da95602023-06-08 15:37:12 +01007972 } else if (stage->round == PSA_JPAKE_SECOND) {
David Horstmann74a3d8c2023-06-14 18:28:19 +01007973 key_share_step = (stage->io_mode == PSA_JPAKE_OUTPUT) ?
7974 PSA_JPAKE_X2S_STEP_KEY_SHARE :
7975 PSA_JPAKE_X4S_STEP_KEY_SHARE;
7976 } else {
7977 return PSA_JPAKE_STEP_INVALID;
Przemek Stekielb09c4872023-01-17 12:05:38 +01007978 }
Agathiyan Bragadeesh387bfa52023-07-17 17:01:33 +01007979 return (psa_crypto_driver_pake_step_t) (key_share_step + stage->step - PSA_PAKE_STEP_KEY_SHARE);
Przemek Stekielb09c4872023-01-17 12:05:38 +01007980}
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01007981#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekielb09c4872023-01-17 12:05:38 +01007982
Przemek Stekiel2797d372022-12-22 11:19:22 +01007983static psa_status_t psa_pake_complete_inputs(
7984 psa_pake_operation_t *operation)
7985{
Przemek Stekiel2797d372022-12-22 11:19:22 +01007986 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel18620a32023-01-17 16:34:52 +01007987 /* Create copy of the inputs on stack as inputs share memory
7988 with the driver context which will be setup by the driver. */
7989 psa_crypto_driver_pake_inputs_t inputs = operation->data.inputs;
Przemek Stekiel2797d372022-12-22 11:19:22 +01007990
Przemek Stekielfde11282023-03-13 16:06:09 +01007991 if (inputs.password_len == 0) {
Przemek Stekiel2797d372022-12-22 11:19:22 +01007992 return PSA_ERROR_BAD_STATE;
7993 }
7994
Przemek Stekiel26c909d2023-02-28 12:34:03 +01007995 if (operation->alg == PSA_ALG_JPAKE) {
Przemek Stekielfde11282023-03-13 16:06:09 +01007996 if (inputs.user_len == 0 || inputs.peer_len == 0) {
7997 return PSA_ERROR_BAD_STATE;
7998 }
Przemek Stekieldff21d32023-02-14 20:09:10 +01007999 }
8000
Przemek Stekiel18620a32023-01-17 16:34:52 +01008001 /* Clear driver context */
8002 mbedtls_platform_zeroize(&operation->data, sizeof(operation->data));
8003
8004 status = psa_driver_wrapper_pake_setup(operation, &inputs);
Przemek Stekiel2797d372022-12-22 11:19:22 +01008005
8006 /* Driver is responsible for creating its own copy of the password. */
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01008007 mbedtls_zeroize_and_free(inputs.password, inputs.password_len);
Przemek Stekiel2797d372022-12-22 11:19:22 +01008008
Przemek Stekiel26c909d2023-02-28 12:34:03 +01008009 /* User and peer are translated to role. */
8010 mbedtls_free(inputs.user);
8011 mbedtls_free(inputs.peer);
8012
Przemek Stekiel2797d372022-12-22 11:19:22 +01008013 if (status == PSA_SUCCESS) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008014#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiel2797d372022-12-22 11:19:22 +01008015 if (operation->alg == PSA_ALG_JPAKE) {
Przemek Stekield93de322023-02-24 08:39:04 +01008016 operation->stage = PSA_PAKE_OPERATION_STAGE_COMPUTATION;
Przemek Stekiel80a88492023-02-20 13:32:22 +01008017 } else
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008018#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiel80a88492023-02-20 13:32:22 +01008019 {
8020 status = PSA_ERROR_NOT_SUPPORTED;
Przemek Stekiel2797d372022-12-22 11:19:22 +01008021 }
Przemek Stekiel2797d372022-12-22 11:19:22 +01008022 }
Przemek Stekiel2797d372022-12-22 11:19:22 +01008023 return status;
8024}
8025
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008026#if defined(PSA_WANT_ALG_JPAKE)
David Horstmanne7f21e62023-05-12 18:17:21 +01008027static psa_status_t psa_jpake_prologue(
Przemek Stekiele12ed362022-12-21 12:54:46 +01008028 psa_pake_operation_t *operation,
David Horstmanne7f21e62023-05-12 18:17:21 +01008029 psa_pake_step_t step,
David Horstmann00ad6bf2023-06-14 15:44:24 +01008030 psa_jpake_io_mode_t io_mode)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008031{
Przemek Stekiele12ed362022-12-21 12:54:46 +01008032 if (step != PSA_PAKE_STEP_KEY_SHARE &&
8033 step != PSA_PAKE_STEP_ZK_PUBLIC &&
8034 step != PSA_PAKE_STEP_ZK_PROOF) {
8035 return PSA_ERROR_INVALID_ARGUMENT;
8036 }
8037
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008038 psa_jpake_computation_stage_t *computation_stage =
8039 &operation->computation_stage.jpake;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008040
David Horstmann5da95602023-06-08 15:37:12 +01008041 if (computation_stage->round != PSA_JPAKE_FIRST &&
8042 computation_stage->round != PSA_JPAKE_SECOND) {
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008043 return PSA_ERROR_BAD_STATE;
8044 }
8045
David Horstmanne7f21e62023-05-12 18:17:21 +01008046 /* Check that the step we are given is the one we were expecting */
8047 if (step != computation_stage->step) {
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008048 return PSA_ERROR_BAD_STATE;
8049 }
8050
David Horstmanne7f21e62023-05-12 18:17:21 +01008051 if (step == PSA_PAKE_STEP_KEY_SHARE &&
8052 computation_stage->inputs == 0 &&
8053 computation_stage->outputs == 0) {
8054 /* Start of the round, so function decides whether we are inputting
8055 * or outputting */
David Horstmann024e5c52023-06-14 15:48:21 +01008056 computation_stage->io_mode = io_mode;
8057 } else if (computation_stage->io_mode != io_mode) {
David Horstmanne7f21e62023-05-12 18:17:21 +01008058 /* Middle of the round so the mode we are in must match the function
8059 * called by the user */
8060 return PSA_ERROR_BAD_STATE;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008061 }
8062
8063 return PSA_SUCCESS;
8064}
8065
David Horstmanne7f21e62023-05-12 18:17:21 +01008066static psa_status_t psa_jpake_epilogue(
8067 psa_pake_operation_t *operation,
David Horstmann00ad6bf2023-06-14 15:44:24 +01008068 psa_jpake_io_mode_t io_mode)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008069{
David Horstmanne7f21e62023-05-12 18:17:21 +01008070 psa_jpake_computation_stage_t *stage =
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008071 &operation->computation_stage.jpake;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008072
David Horstmanne7f21e62023-05-12 18:17:21 +01008073 if (stage->step == PSA_PAKE_STEP_ZK_PROOF) {
8074 /* End of an input/output */
David Horstmann00ad6bf2023-06-14 15:44:24 +01008075 if (io_mode == PSA_JPAKE_INPUT) {
David Horstmanne7f21e62023-05-12 18:17:21 +01008076 stage->inputs++;
David Horstmann246ec5a2023-06-27 10:33:06 +01008077 if (stage->inputs == PSA_JPAKE_EXPECTED_INPUTS(stage->round)) {
David Horstmann024e5c52023-06-14 15:48:21 +01008078 stage->io_mode = PSA_JPAKE_OUTPUT;
David Horstmanne7f21e62023-05-12 18:17:21 +01008079 }
8080 }
David Horstmann00ad6bf2023-06-14 15:44:24 +01008081 if (io_mode == PSA_JPAKE_OUTPUT) {
David Horstmanne7f21e62023-05-12 18:17:21 +01008082 stage->outputs++;
David Horstmann246ec5a2023-06-27 10:33:06 +01008083 if (stage->outputs == PSA_JPAKE_EXPECTED_OUTPUTS(stage->round)) {
David Horstmann024e5c52023-06-14 15:48:21 +01008084 stage->io_mode = PSA_JPAKE_INPUT;
David Horstmanne7f21e62023-05-12 18:17:21 +01008085 }
8086 }
David Horstmann246ec5a2023-06-27 10:33:06 +01008087 if (stage->inputs == PSA_JPAKE_EXPECTED_INPUTS(stage->round) &&
8088 stage->outputs == PSA_JPAKE_EXPECTED_OUTPUTS(stage->round)) {
David Horstmanne7f21e62023-05-12 18:17:21 +01008089 /* End of a round, move to the next round */
8090 stage->inputs = 0;
8091 stage->outputs = 0;
8092 stage->round++;
8093 }
8094 stage->step = PSA_PAKE_STEP_KEY_SHARE;
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008095 } else {
David Horstmanne7f21e62023-05-12 18:17:21 +01008096 stage->step++;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008097 }
Przemek Stekiele12ed362022-12-21 12:54:46 +01008098 return PSA_SUCCESS;
8099}
David Horstmanne7f21e62023-05-12 18:17:21 +01008100
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008101#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008102
Neil Armstronga7d08c32022-06-01 18:21:20 +02008103psa_status_t psa_pake_output(
8104 psa_pake_operation_t *operation,
8105 psa_pake_step_t step,
8106 uint8_t *output,
8107 size_t output_size,
8108 size_t *output_length)
8109{
Przemek Stekiel51eac532022-12-07 11:04:51 +01008110 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008111 psa_crypto_driver_pake_step_t driver_step = PSA_JPAKE_STEP_INVALID;
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01008112 *output_length = 0;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008113
8114 if (operation->stage == PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel2797d372022-12-22 11:19:22 +01008115 status = psa_pake_complete_inputs(operation);
8116 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008117 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008118 }
8119 }
8120
8121 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COMPUTATION) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008122 status = PSA_ERROR_BAD_STATE;
8123 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008124 }
8125
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01008126 if (output_size == 0) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008127 status = PSA_ERROR_INVALID_ARGUMENT;
8128 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008129 }
8130
Przemek Stekiele12ed362022-12-21 12:54:46 +01008131 switch (operation->alg) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008132#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008133 case PSA_ALG_JPAKE:
David Horstmann5da95602023-06-08 15:37:12 +01008134 status = psa_jpake_prologue(operation, step, PSA_JPAKE_OUTPUT);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008135 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008136 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008137 }
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008138 driver_step = convert_jpake_computation_stage_to_driver_step(
8139 &operation->computation_stage.jpake);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008140 break;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008141#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008142 default:
Przemek Stekiel80a88492023-02-20 13:32:22 +01008143 (void) step;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008144 status = PSA_ERROR_NOT_SUPPORTED;
8145 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008146 }
8147
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008148 status = psa_driver_wrapper_pake_output(operation, driver_step,
8149 output, output_size, output_length);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008150
8151 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008152 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008153 }
8154
8155 switch (operation->alg) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008156#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008157 case PSA_ALG_JPAKE:
David Horstmann5da95602023-06-08 15:37:12 +01008158 status = psa_jpake_epilogue(operation, PSA_JPAKE_OUTPUT);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008159 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008160 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008161 }
8162 break;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008163#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008164 default:
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008165 status = PSA_ERROR_NOT_SUPPORTED;
8166 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008167 }
8168
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008169 return PSA_SUCCESS;
8170exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008171 psa_pake_abort(operation);
8172 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008173}
8174
8175psa_status_t psa_pake_input(
8176 psa_pake_operation_t *operation,
8177 psa_pake_step_t step,
8178 const uint8_t *input,
8179 size_t input_length)
8180{
Przemek Stekiel51eac532022-12-07 11:04:51 +01008181 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008182 psa_crypto_driver_pake_step_t driver_step = PSA_JPAKE_STEP_INVALID;
Przemek Stekiel256c75d2023-03-23 14:09:34 +01008183 const size_t max_input_length = (size_t) PSA_PAKE_INPUT_SIZE(operation->alg,
8184 operation->primitive,
8185 step);
Przemek Stekiel51eac532022-12-07 11:04:51 +01008186
8187 if (operation->stage == PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel2797d372022-12-22 11:19:22 +01008188 status = psa_pake_complete_inputs(operation);
8189 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008190 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008191 }
8192 }
8193
8194 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COMPUTATION) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008195 status = PSA_ERROR_BAD_STATE;
8196 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008197 }
8198
Przemek Stekiel256c75d2023-03-23 14:09:34 +01008199 if (input_length == 0 || input_length > max_input_length) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008200 status = PSA_ERROR_INVALID_ARGUMENT;
8201 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008202 }
8203
Przemek Stekiele12ed362022-12-21 12:54:46 +01008204 switch (operation->alg) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008205#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008206 case PSA_ALG_JPAKE:
David Horstmann5da95602023-06-08 15:37:12 +01008207 status = psa_jpake_prologue(operation, step, PSA_JPAKE_INPUT);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008208 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008209 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008210 }
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008211 driver_step = convert_jpake_computation_stage_to_driver_step(
8212 &operation->computation_stage.jpake);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008213 break;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008214#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008215 default:
Przemek Stekiel80a88492023-02-20 13:32:22 +01008216 (void) step;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008217 status = PSA_ERROR_NOT_SUPPORTED;
8218 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008219 }
8220
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008221 status = psa_driver_wrapper_pake_input(operation, driver_step,
8222 input, input_length);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008223
8224 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008225 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008226 }
8227
8228 switch (operation->alg) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008229#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008230 case PSA_ALG_JPAKE:
David Horstmann5da95602023-06-08 15:37:12 +01008231 status = psa_jpake_epilogue(operation, PSA_JPAKE_INPUT);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008232 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008233 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008234 }
8235 break;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008236#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008237 default:
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008238 status = PSA_ERROR_NOT_SUPPORTED;
8239 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008240 }
8241
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008242 return PSA_SUCCESS;
8243exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008244 psa_pake_abort(operation);
8245 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008246}
8247
8248psa_status_t psa_pake_get_implicit_key(
8249 psa_pake_operation_t *operation,
8250 psa_key_derivation_operation_t *output)
8251{
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01008252 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008253 psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel251e86a2023-02-17 14:30:50 +01008254 uint8_t shared_key[MBEDTLS_PSA_JPAKE_BUFFER_SIZE];
Przemek Stekiel0c781802022-11-29 14:53:13 +01008255 size_t shared_key_len = 0;
8256
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01008257 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COMPUTATION) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008258 status = PSA_ERROR_BAD_STATE;
8259 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008260 }
8261
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008262#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008263 if (operation->alg == PSA_ALG_JPAKE) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008264 psa_jpake_computation_stage_t *computation_stage =
Przemek Stekiel083745e2023-02-23 17:28:23 +01008265 &operation->computation_stage.jpake;
David Horstmann5da95602023-06-08 15:37:12 +01008266 if (computation_stage->round != PSA_JPAKE_FINISHED) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008267 status = PSA_ERROR_BAD_STATE;
8268 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008269 }
Przemek Stekiel80a88492023-02-20 13:32:22 +01008270 } else
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008271#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiel80a88492023-02-20 13:32:22 +01008272 {
8273 status = PSA_ERROR_NOT_SUPPORTED;
8274 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008275 }
8276
Przemek Stekiel0c781802022-11-29 14:53:13 +01008277 status = psa_driver_wrapper_pake_get_implicit_key(operation,
8278 shared_key,
Przemek Stekiel6b648622023-02-19 22:55:33 +01008279 sizeof(shared_key),
Przemek Stekiel0c781802022-11-29 14:53:13 +01008280 &shared_key_len);
8281
8282 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008283 goto exit;
Przemek Stekiel0c781802022-11-29 14:53:13 +01008284 }
8285
8286 status = psa_key_derivation_input_bytes(output,
8287 PSA_KEY_DERIVATION_INPUT_SECRET,
8288 shared_key,
8289 shared_key_len);
8290
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008291 mbedtls_platform_zeroize(shared_key, sizeof(shared_key));
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008292exit:
8293 abort_status = psa_pake_abort(operation);
8294 return status == PSA_SUCCESS ? abort_status : status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008295}
8296
8297psa_status_t psa_pake_abort(
8298 psa_pake_operation_t *operation)
8299{
Przemek Stekield69dca92023-01-31 19:59:20 +01008300 psa_status_t status = PSA_SUCCESS;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008301
Przemek Stekield69dca92023-01-31 19:59:20 +01008302 if (operation->stage == PSA_PAKE_OPERATION_STAGE_COMPUTATION) {
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01008303 status = psa_driver_wrapper_pake_abort(operation);
Neil Armstrong5ae60962022-09-15 11:29:46 +02008304 }
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01008305
Przemek Stekiel26c909d2023-02-28 12:34:03 +01008306 if (operation->stage == PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
8307 if (operation->data.inputs.password != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01008308 mbedtls_zeroize_and_free(operation->data.inputs.password,
Przemek Stekielaa183422023-03-06 14:21:44 +01008309 operation->data.inputs.password_len);
Przemek Stekiel26c909d2023-02-28 12:34:03 +01008310 }
8311 if (operation->data.inputs.user != NULL) {
8312 mbedtls_free(operation->data.inputs.user);
8313 }
8314 if (operation->data.inputs.peer != NULL) {
8315 mbedtls_free(operation->data.inputs.peer);
8316 }
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01008317 }
Przemek Stekield69dca92023-01-31 19:59:20 +01008318 memset(operation, 0, sizeof(psa_pake_operation_t));
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01008319
Przemek Stekield69dca92023-01-31 19:59:20 +01008320 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008321}
Tom Cosgrove6d62fac2023-05-10 14:40:05 +01008322#endif /* PSA_WANT_ALG_SOME_PAKE */
Neil Armstronga7d08c32022-06-01 18:21:20 +02008323
Gilles Peskinee59236f2018-01-27 23:32:46 +01008324#endif /* MBEDTLS_PSA_CRYPTO_C */