blob: 696e830b8e29cf70230fa8139fcf7d71904c9d1a [file] [log] [blame]
Gilles Peskinee59236f2018-01-27 23:32:46 +01001/*
2 * PSA crypto layer on top of Mbed TLS crypto
3 */
Bence Szépkúti86974652020-06-15 11:59:37 +02004/*
Bence Szépkúti1e148272020-08-07 13:07:28 +02005 * Copyright The Mbed TLS Contributors
Dave Rodgman16799db2023-11-02 19:47:20 +00006 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
Gilles Peskinee59236f2018-01-27 23:32:46 +01007 */
8
Gilles Peskinedb09ef62020-06-03 01:43:33 +02009#include "common.h"
Ronald Cronafbc7ed2023-01-24 16:02:04 +010010#include "psa_crypto_core_common.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010011
12#if defined(MBEDTLS_PSA_CRYPTO_C)
mohammad160327010052018-07-03 13:16:15 +030013
John Durkop07cc04a2020-11-16 22:08:34 -080014#if defined(MBEDTLS_PSA_CRYPTO_CONFIG)
15#include "check_crypto_config.h"
16#endif
17
Gilles Peskinee59236f2018-01-27 23:32:46 +010018#include "psa/crypto.h"
Przemyslaw Stekiel705fb0f2021-11-24 08:47:29 +010019#include "psa/crypto_values.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010020
Ronald Crond6d28882020-12-14 14:56:02 +010021#include "psa_crypto_cipher.h"
Gilles Peskine039b90c2018-12-07 18:24:41 +010022#include "psa_crypto_core.h"
Gilles Peskine5e769522018-11-20 21:59:56 +010023#include "psa_crypto_invasive.h"
Xiaokang Qiane9c39c42023-08-09 08:50:19 +000024#include "psa_crypto_driver_wrappers.h"
Xiaokang Qianfe9666b2023-09-11 10:36:20 +000025#include "psa_crypto_driver_wrappers_no_static.h"
Ronald Cron00b7bfc2020-11-25 15:25:26 +010026#include "psa_crypto_ecp.h"
Przemek Stekiel359f4622022-12-05 14:11:55 +010027#include "psa_crypto_ffdh.h"
Steven Cooreman5f88e772021-03-15 11:07:12 +010028#include "psa_crypto_hash.h"
Steven Cooreman82c66b62021-03-19 17:39:17 +010029#include "psa_crypto_mac.h"
Ronald Cron00b7bfc2020-11-25 15:25:26 +010030#include "psa_crypto_rsa.h"
Ronald Cron7023db52020-11-20 18:17:42 +010031#include "psa_crypto_ecp.h"
Gilles Peskinea8ade162019-06-26 11:24:49 +020032#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined0890212019-06-24 14:34:43 +020033#include "psa_crypto_se.h"
Gilles Peskinea8ade162019-06-26 11:24:49 +020034#endif
Gilles Peskine961849f2018-11-30 18:54:54 +010035#include "psa_crypto_slot_management.h"
Darryl Greend49a4992018-06-18 17:27:26 +010036/* Include internal declarations that are useful for implementing persistently
37 * stored keys. */
38#include "psa_crypto_storage.h"
39
Gilles Peskineb2b64d32020-12-14 16:43:58 +010040#include "psa_crypto_random_impl.h"
Gilles Peskine90edc992020-11-13 15:39:19 +010041
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010042#include <stdlib.h>
43#include <string.h>
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010044#include "mbedtls/platform.h"
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010045
Gilles Peskine1c49f1a2020-11-13 18:46:25 +010046#include "mbedtls/aes.h"
Gilles Peskine9a944802018-06-21 09:35:35 +020047#include "mbedtls/asn1.h"
Jaeden Amero25384a22019-01-10 10:23:21 +000048#include "mbedtls/asn1write.h"
Gilles Peskinea81d85b2018-06-26 16:10:23 +020049#include "mbedtls/bignum.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010050#include "mbedtls/camellia.h"
Gilles Peskine26869f22019-05-06 15:25:00 +020051#include "mbedtls/chacha20.h"
52#include "mbedtls/chachapoly.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010053#include "mbedtls/cipher.h"
54#include "mbedtls/ccm.h"
55#include "mbedtls/cmac.h"
Dave Rodgman78701152023-08-29 14:20:18 +010056#include "mbedtls/constant_time.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010057#include "mbedtls/des.h"
Gilles Peskineb7ecdf02018-09-18 12:11:27 +020058#include "mbedtls/ecdh.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010059#include "mbedtls/ecp.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010060#include "mbedtls/entropy.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010061#include "mbedtls/error.h"
62#include "mbedtls/gcm.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010063#include "mbedtls/md5.h"
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010064#include "mbedtls/pk.h"
Chris Jonesdaacb592021-03-09 17:03:29 +000065#include "pk_wrap.h"
Gilles Peskine3f108122018-12-07 18:14:53 +010066#include "mbedtls/platform_util.h"
Janos Follath24eed8d2019-11-22 13:21:35 +000067#include "mbedtls/error.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010068#include "mbedtls/ripemd160.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010069#include "mbedtls/rsa.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010070#include "mbedtls/sha1.h"
71#include "mbedtls/sha256.h"
72#include "mbedtls/sha512.h"
Valerio Setti384fbde2024-01-02 13:26:40 +010073#include "mbedtls/psa_util.h"
Paul Elliott600472b2024-02-23 17:26:58 +000074#include "mbedtls/threading.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010075
Przemek Stekiel75fe3fb2022-06-09 14:44:55 +020076#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF) || \
77 defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) || \
78 defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Przemek Stekiel69c46792022-06-10 12:59:51 +020079#define BUILTIN_ALG_ANY_HKDF 1
Przemek Stekiel75fe3fb2022-06-09 14:44:55 +020080#endif
81
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010082/****************************************************************/
83/* Global data, support functions and library management */
84/****************************************************************/
85
Gilles Peskine449bd832023-01-11 14:50:10 +010086static int key_type_is_raw_bytes(psa_key_type_t type)
Gilles Peskine48c0ea12018-06-21 14:15:31 +020087{
Gilles Peskine449bd832023-01-11 14:50:10 +010088 return PSA_KEY_TYPE_IS_UNSTRUCTURED(type);
Gilles Peskine48c0ea12018-06-21 14:15:31 +020089}
90
Gilles Peskine5a3c50e2018-12-04 12:27:09 +010091/* Values for psa_global_data_t::rng_state */
92#define RNG_NOT_INITIALIZED 0
93#define RNG_INITIALIZED 1
94#define RNG_SEEDED 2
Gilles Peskinec6b69072018-11-20 21:42:52 +010095
Paul Elliott0db6a902024-03-15 13:48:20 +000096/* IDs for PSA crypto subsystems. Starts at 1 to catch potential uninitialized
97 * variables as arguments. */
Paul Elliott47cee8e2024-03-08 21:38:02 +000098typedef enum {
Paul Elliott0db6a902024-03-15 13:48:20 +000099 PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS = 1,
Paul Elliott47cee8e2024-03-08 21:38:02 +0000100 PSA_CRYPTO_SUBSYSTEM_KEY_SLOTS,
101 PSA_CRYPTO_SUBSYSTEM_RNG,
102 PSA_CRYPTO_SUBSYSTEM_TRANSACTION,
103} mbedtls_psa_crypto_subsystem;
104
Paul Elliottb24e36d2024-03-15 16:25:48 +0000105/* Initialization flags for global_data::initialized */
Paul Elliott47cee8e2024-03-08 21:38:02 +0000106#define PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS_INITIALIZED 0x01
107#define PSA_CRYPTO_SUBSYSTEM_KEY_SLOTS_INITIALIZED 0x02
108#define PSA_CRYPTO_SUBSYSTEM_TRANSACTION_INITIALIZED 0x04
109
110#define PSA_CRYPTO_SUBSYSTEM_ALL_INITIALISED ( \
111 PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS_INITIALIZED | \
112 PSA_CRYPTO_SUBSYSTEM_KEY_SLOTS_INITIALIZED | \
113 PSA_CRYPTO_SUBSYSTEM_TRANSACTION_INITIALIZED)
114
Gilles Peskine449bd832023-01-11 14:50:10 +0100115typedef struct {
Dave Rodgman864f5942023-08-16 18:04:44 +0100116 uint8_t initialized;
117 uint8_t rng_state;
Gilles Peskine2d8a1822021-11-08 22:20:03 +0100118 mbedtls_psa_random_context_t rng;
Gilles Peskinee59236f2018-01-27 23:32:46 +0100119} psa_global_data_t;
120
121static psa_global_data_t global_data;
122
Paul Elliott600472b2024-02-23 17:26:58 +0000123static uint8_t psa_get_initialized(void)
124{
125 uint8_t initialized;
126
127#if defined(MBEDTLS_THREADING_C)
Paul Elliott47cee8e2024-03-08 21:38:02 +0000128 mbedtls_mutex_lock(&mbedtls_threading_psa_rngdata_mutex);
129#endif /* defined(MBEDTLS_THREADING_C) */
130
131 initialized = global_data.rng_state == RNG_SEEDED;
132
133#if defined(MBEDTLS_THREADING_C)
134 mbedtls_mutex_unlock(&mbedtls_threading_psa_rngdata_mutex);
135#endif /* defined(MBEDTLS_THREADING_C) */
136
137#if defined(MBEDTLS_THREADING_C)
Paul Elliott600472b2024-02-23 17:26:58 +0000138 mbedtls_mutex_lock(&mbedtls_threading_psa_globaldata_mutex);
139#endif /* defined(MBEDTLS_THREADING_C) */
140
Paul Elliott47cee8e2024-03-08 21:38:02 +0000141 initialized =
142 (initialized && (global_data.initialized == PSA_CRYPTO_SUBSYSTEM_ALL_INITIALISED));
Paul Elliott600472b2024-02-23 17:26:58 +0000143
144#if defined(MBEDTLS_THREADING_C)
145 mbedtls_mutex_unlock(&mbedtls_threading_psa_globaldata_mutex);
146#endif /* defined(MBEDTLS_THREADING_C) */
147
148 return initialized;
149}
150
Paul Elliott35816522024-02-23 17:47:42 +0000151static uint8_t psa_get_drivers_initialized(void)
152{
153 uint8_t initialized;
154
155#if defined(MBEDTLS_THREADING_C)
156 mbedtls_mutex_lock(&mbedtls_threading_psa_globaldata_mutex);
157#endif /* defined(MBEDTLS_THREADING_C) */
158
Paul Elliott47cee8e2024-03-08 21:38:02 +0000159 initialized = (global_data.initialized & PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS_INITIALIZED) != 0;
Paul Elliott35816522024-02-23 17:47:42 +0000160
161#if defined(MBEDTLS_THREADING_C)
162 mbedtls_mutex_unlock(&mbedtls_threading_psa_globaldata_mutex);
163#endif /* defined(MBEDTLS_THREADING_C) */
164
165 return initialized;
166}
167
itayzafrir0adf0fc2018-09-06 16:24:41 +0300168#define GUARD_MODULE_INITIALIZED \
Paul Elliott600472b2024-02-23 17:26:58 +0000169 if (psa_get_initialized() == 0) \
Gilles Peskine449bd832023-01-11 14:50:10 +0100170 return PSA_ERROR_BAD_STATE;
itayzafrir0adf0fc2018-09-06 16:24:41 +0300171
David Horstmann4a48bec2024-03-13 15:42:31 +0000172#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
David Horstmann36df4b22023-12-13 15:55:25 +0000173
David Horstmann62a56d92023-12-14 18:12:47 +0000174/* Declare a local copy of an input buffer and a variable that will be used
175 * to store a pointer to the start of the buffer.
David Horstmann36df4b22023-12-13 15:55:25 +0000176 *
177 * Note: This macro must be called before any operations which may jump to
178 * the exit label, so that the local input copy object is safe to be freed.
179 *
180 * Assumptions:
181 * - input is the name of a pointer to the buffer to be copied
182 * - The name LOCAL_INPUT_COPY_OF_input is unused in the current scope
David Horstmann62a56d92023-12-14 18:12:47 +0000183 * - input_copy_name is a name that is unused in the current scope
David Horstmann36df4b22023-12-13 15:55:25 +0000184 */
David Horstmann62a56d92023-12-14 18:12:47 +0000185#define LOCAL_INPUT_DECLARE(input, input_copy_name) \
186 psa_crypto_local_input_t LOCAL_INPUT_COPY_OF_##input = PSA_CRYPTO_LOCAL_INPUT_INIT; \
187 const uint8_t *input_copy_name = NULL;
David Horstmann36df4b22023-12-13 15:55:25 +0000188
David Horstmann62a56d92023-12-14 18:12:47 +0000189/* Allocate a copy of the buffer input and set the pointer input_copy to
190 * point to the start of the copy.
David Horstmann36df4b22023-12-13 15:55:25 +0000191 *
David Horstmanne9a88ab2023-11-29 17:07:13 +0000192 * Assumptions:
193 * - psa_status_t status exists
194 * - An exit label is declared
David Horstmann36df4b22023-12-13 15:55:25 +0000195 * - input is the name of a pointer to the buffer to be copied
David Horstmann62a56d92023-12-14 18:12:47 +0000196 * - LOCAL_INPUT_DECLARE(input, input_copy) has previously been called
David Horstmanne9a88ab2023-11-29 17:07:13 +0000197 */
David Horstmann62a56d92023-12-14 18:12:47 +0000198#define LOCAL_INPUT_ALLOC(input, length, input_copy) \
David Horstmann36df4b22023-12-13 15:55:25 +0000199 status = psa_crypto_local_input_alloc(input, length, \
200 &LOCAL_INPUT_COPY_OF_##input); \
David Horstmanne9a88ab2023-11-29 17:07:13 +0000201 if (status != PSA_SUCCESS) { \
202 goto exit; \
203 } \
David Horstmann62a56d92023-12-14 18:12:47 +0000204 input_copy = LOCAL_INPUT_COPY_OF_##input.buffer;
David Horstmanne9a88ab2023-11-29 17:07:13 +0000205
David Horstmann36df4b22023-12-13 15:55:25 +0000206/* Free the local input copy allocated previously by LOCAL_INPUT_ALLOC()
207 *
David Horstmann3e72db42023-12-08 14:08:18 +0000208 * Assumptions:
David Horstmann62a56d92023-12-14 18:12:47 +0000209 * - input_copy is the name of the input copy pointer set by LOCAL_INPUT_ALLOC()
David Horstmann36df4b22023-12-13 15:55:25 +0000210 * - input is the name of the original buffer that was copied
David Horstmann3e72db42023-12-08 14:08:18 +0000211 */
David Horstmann62a56d92023-12-14 18:12:47 +0000212#define LOCAL_INPUT_FREE(input, input_copy) \
213 input_copy = NULL; \
David Horstmann36df4b22023-12-13 15:55:25 +0000214 psa_crypto_local_input_free(&LOCAL_INPUT_COPY_OF_##input);
David Horstmanne9a88ab2023-11-29 17:07:13 +0000215
David Horstmann62a56d92023-12-14 18:12:47 +0000216/* Declare a local copy of an output buffer and a variable that will be used
217 * to store a pointer to the start of the buffer.
David Horstmann36df4b22023-12-13 15:55:25 +0000218 *
219 * Note: This macro must be called before any operations which may jump to
220 * the exit label, so that the local output copy object is safe to be freed.
221 *
222 * Assumptions:
223 * - output is the name of a pointer to the buffer to be copied
224 * - The name LOCAL_OUTPUT_COPY_OF_output is unused in the current scope
David Horstmann62a56d92023-12-14 18:12:47 +0000225 * - output_copy_name is a name that is unused in the current scope
David Horstmann36df4b22023-12-13 15:55:25 +0000226 */
David Horstmann62a56d92023-12-14 18:12:47 +0000227#define LOCAL_OUTPUT_DECLARE(output, output_copy_name) \
228 psa_crypto_local_output_t LOCAL_OUTPUT_COPY_OF_##output = PSA_CRYPTO_LOCAL_OUTPUT_INIT; \
229 uint8_t *output_copy_name = NULL;
David Horstmann36df4b22023-12-13 15:55:25 +0000230
David Horstmann62a56d92023-12-14 18:12:47 +0000231/* Allocate a copy of the buffer output and set the pointer output_copy to
232 * point to the start of the copy.
David Horstmann36df4b22023-12-13 15:55:25 +0000233 *
David Horstmanne9a88ab2023-11-29 17:07:13 +0000234 * Assumptions:
235 * - psa_status_t status exists
236 * - An exit label is declared
David Horstmann36df4b22023-12-13 15:55:25 +0000237 * - output is the name of a pointer to the buffer to be copied
David Horstmann62a56d92023-12-14 18:12:47 +0000238 * - LOCAL_OUTPUT_DECLARE(output, output_copy) has previously been called
David Horstmanne9a88ab2023-11-29 17:07:13 +0000239 */
David Horstmann62a56d92023-12-14 18:12:47 +0000240#define LOCAL_OUTPUT_ALLOC(output, length, output_copy) \
David Horstmann36df4b22023-12-13 15:55:25 +0000241 status = psa_crypto_local_output_alloc(output, length, \
242 &LOCAL_OUTPUT_COPY_OF_##output); \
David Horstmanne9a88ab2023-11-29 17:07:13 +0000243 if (status != PSA_SUCCESS) { \
244 goto exit; \
245 } \
David Horstmann62a56d92023-12-14 18:12:47 +0000246 output_copy = LOCAL_OUTPUT_COPY_OF_##output.buffer;
David Horstmanne9a88ab2023-11-29 17:07:13 +0000247
David Horstmann62a56d92023-12-14 18:12:47 +0000248/* Free the local output copy allocated previously by LOCAL_OUTPUT_ALLOC()
David Horstmann3e72db42023-12-08 14:08:18 +0000249 * after first copying back its contents to the original buffer.
David Horstmann36df4b22023-12-13 15:55:25 +0000250 *
David Horstmann3e72db42023-12-08 14:08:18 +0000251 * Assumptions:
David Horstmann3e72db42023-12-08 14:08:18 +0000252 * - psa_status_t status exists
David Horstmann62a56d92023-12-14 18:12:47 +0000253 * - output_copy is the name of the output copy pointer set by LOCAL_OUTPUT_ALLOC()
254 * - output is the name of the original buffer that was copied
David Horstmann3e72db42023-12-08 14:08:18 +0000255 */
David Horstmann62a56d92023-12-14 18:12:47 +0000256#define LOCAL_OUTPUT_FREE(output, output_copy) \
257 output_copy = NULL; \
David Horstmann5a945f52023-12-13 14:09:08 +0000258 do { \
259 psa_status_t local_output_status; \
David Horstmann36df4b22023-12-13 15:55:25 +0000260 local_output_status = psa_crypto_local_output_free(&LOCAL_OUTPUT_COPY_OF_##output); \
David Horstmann5a945f52023-12-13 14:09:08 +0000261 if (local_output_status != PSA_SUCCESS) { \
262 /* Since this error case is an internal error, it's more serious than \
263 * any existing error code and so it's fine to overwrite the existing \
264 * status. */ \
265 status = local_output_status; \
266 } \
267 } while (0)
David Horstmann4a48bec2024-03-13 15:42:31 +0000268#else /* !MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS */
David Horstmann62a56d92023-12-14 18:12:47 +0000269#define LOCAL_INPUT_DECLARE(input, input_copy_name) \
270 const uint8_t *input_copy_name = NULL;
271#define LOCAL_INPUT_ALLOC(input, length, input_copy) \
272 input_copy = input;
273#define LOCAL_INPUT_FREE(input, input_copy) \
274 input_copy = NULL;
275#define LOCAL_OUTPUT_DECLARE(output, output_copy_name) \
276 uint8_t *output_copy_name = NULL;
277#define LOCAL_OUTPUT_ALLOC(output, length, output_copy) \
278 output_copy = output;
279#define LOCAL_OUTPUT_FREE(output, output_copy) \
280 output_copy = NULL;
David Horstmann4a48bec2024-03-13 15:42:31 +0000281#endif /* !MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS */
David Horstmanne9a88ab2023-11-29 17:07:13 +0000282
283
Manuel Pégourié-Gonnard7abdf7e2023-03-09 11:17:43 +0100284int psa_can_do_hash(psa_algorithm_t hash_alg)
285{
286 (void) hash_alg;
Paul Elliott35816522024-02-23 17:47:42 +0000287 return psa_get_drivers_initialized();
Manuel Pégourié-Gonnard7abdf7e2023-03-09 11:17:43 +0100288}
Valerio Settic6f004f2023-12-12 11:27:36 +0100289
Valerio Setti1fff4f22023-12-28 14:19:34 +0100290int psa_can_do_cipher(psa_key_type_t key_type, psa_algorithm_t cipher_alg)
Valerio Settic6f004f2023-12-12 11:27:36 +0100291{
Valerio Setti1fff4f22023-12-28 14:19:34 +0100292 (void) key_type;
Valerio Settic6f004f2023-12-12 11:27:36 +0100293 (void) cipher_alg;
Paul Elliott35816522024-02-23 17:47:42 +0000294 return psa_get_drivers_initialized();
Valerio Settic6f004f2023-12-12 11:27:36 +0100295}
296
297
Valerio Settia55f0422023-07-10 15:34:41 +0200298#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT) || \
Przemek Stekiel53410502023-04-28 13:18:43 +0200299 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) || \
Valerio Settia55f0422023-07-10 15:34:41 +0200300 defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE)
Przemek Stekiel134cc2e2023-05-05 10:13:37 +0200301static int psa_is_dh_key_size_valid(size_t bits)
302{
Valerio Setti504a1022024-01-17 15:19:30 +0100303 switch (bits) {
304#if defined(PSA_WANT_DH_RFC7919_2048)
305 case 2048:
306 return 1;
307#endif /* PSA_WANT_DH_RFC7919_2048 */
308#if defined(PSA_WANT_DH_RFC7919_3072)
309 case 3072:
310 return 1;
311#endif /* PSA_WANT_DH_RFC7919_3072 */
312#if defined(PSA_WANT_DH_RFC7919_4096)
313 case 4096:
314 return 1;
315#endif /* PSA_WANT_DH_RFC7919_4096 */
316#if defined(PSA_WANT_DH_RFC7919_6144)
317 case 6144:
318 return 1;
319#endif /* PSA_WANT_DH_RFC7919_6144 */
320#if defined(PSA_WANT_DH_RFC7919_8192)
321 case 8192:
322 return 1;
323#endif /* PSA_WANT_DH_RFC7919_8192 */
324 default:
325 return 0;
Przemek Stekield1cf1ba2023-04-27 12:04:21 +0200326 }
Przemek Stekield1cf1ba2023-04-27 12:04:21 +0200327}
Valerio Settia55f0422023-07-10 15:34:41 +0200328#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT ||
Przemek Stekiel53410502023-04-28 13:18:43 +0200329 MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY ||
Valerio Settia55f0422023-07-10 15:34:41 +0200330 PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE */
Manuel Pégourié-Gonnard7abdf7e2023-03-09 11:17:43 +0100331
Gilles Peskine449bd832023-01-11 14:50:10 +0100332psa_status_t mbedtls_to_psa_error(int ret)
Gilles Peskinee59236f2018-01-27 23:32:46 +0100333{
Gilles Peskinedbf68962021-01-06 20:04:23 +0100334 /* Mbed TLS error codes can combine a high-level error code and a
335 * low-level error code. The low-level error usually reflects the
336 * root cause better, so dispatch on that preferably. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100337 int low_level_ret = -(-ret & 0x007f);
338 switch (low_level_ret != 0 ? low_level_ret : ret) {
Gilles Peskinee59236f2018-01-27 23:32:46 +0100339 case 0:
Gilles Peskine449bd832023-01-11 14:50:10 +0100340 return PSA_SUCCESS;
Gilles Peskinea5905292018-02-07 20:59:33 +0100341
Dave Rodgman4f47f3d2023-08-31 12:10:00 +0100342#if defined(MBEDTLS_AES_C)
Gilles Peskinea5905292018-02-07 20:59:33 +0100343 case MBEDTLS_ERR_AES_INVALID_KEY_LENGTH:
344 case MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100345 return PSA_ERROR_NOT_SUPPORTED;
Dave Rodgman09a9e582023-08-31 11:05:22 +0100346 case MBEDTLS_ERR_AES_BAD_INPUT_DATA:
347 return PSA_ERROR_INVALID_ARGUMENT;
Dave Rodgman509b5672023-08-16 19:26:23 +0100348#endif
349
350#if defined(MBEDTLS_ASN1_PARSE_C) || defined(MBEDTLS_ASN1_WRITE_C)
Gilles Peskine9a944802018-06-21 09:35:35 +0200351 case MBEDTLS_ERR_ASN1_OUT_OF_DATA:
352 case MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:
353 case MBEDTLS_ERR_ASN1_INVALID_LENGTH:
354 case MBEDTLS_ERR_ASN1_LENGTH_MISMATCH:
355 case MBEDTLS_ERR_ASN1_INVALID_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100356 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine9a944802018-06-21 09:35:35 +0200357 case MBEDTLS_ERR_ASN1_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100358 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskine9a944802018-06-21 09:35:35 +0200359 case MBEDTLS_ERR_ASN1_BUF_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100360 return PSA_ERROR_BUFFER_TOO_SMALL;
Dave Rodgman509b5672023-08-16 19:26:23 +0100361#endif
Gilles Peskine9a944802018-06-21 09:35:35 +0200362
Dave Rodgman4f47f3d2023-08-31 12:10:00 +0100363#if defined(MBEDTLS_CAMELLIA_C)
Jaeden Amero892cd6d2019-02-11 12:21:12 +0000364 case MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA:
Gilles Peskinea5905292018-02-07 20:59:33 +0100365 case MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100366 return PSA_ERROR_NOT_SUPPORTED;
Dave Rodgman509b5672023-08-16 19:26:23 +0100367#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100368
Dave Rodgman4f47f3d2023-08-31 12:10:00 +0100369#if defined(MBEDTLS_CCM_C)
Gilles Peskinea5905292018-02-07 20:59:33 +0100370 case MBEDTLS_ERR_CCM_BAD_INPUT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100371 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100372 case MBEDTLS_ERR_CCM_AUTH_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100373 return PSA_ERROR_INVALID_SIGNATURE;
Dave Rodgman509b5672023-08-16 19:26:23 +0100374#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100375
Dave Rodgman4f47f3d2023-08-31 12:10:00 +0100376#if defined(MBEDTLS_CHACHA20_C)
Gilles Peskine26869f22019-05-06 15:25:00 +0200377 case MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100378 return PSA_ERROR_INVALID_ARGUMENT;
Dave Rodgman509b5672023-08-16 19:26:23 +0100379#endif
Gilles Peskine26869f22019-05-06 15:25:00 +0200380
Dave Rodgman4f47f3d2023-08-31 12:10:00 +0100381#if defined(MBEDTLS_CHACHAPOLY_C)
Gilles Peskine26869f22019-05-06 15:25:00 +0200382 case MBEDTLS_ERR_CHACHAPOLY_BAD_STATE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100383 return PSA_ERROR_BAD_STATE;
Gilles Peskine26869f22019-05-06 15:25:00 +0200384 case MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100385 return PSA_ERROR_INVALID_SIGNATURE;
Dave Rodgman509b5672023-08-16 19:26:23 +0100386#endif
Gilles Peskine26869f22019-05-06 15:25:00 +0200387
Dave Rodgman509b5672023-08-16 19:26:23 +0100388#if defined(MBEDTLS_CIPHER_C)
Gilles Peskinea5905292018-02-07 20:59:33 +0100389 case MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100390 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100391 case MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100392 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100393 case MBEDTLS_ERR_CIPHER_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100394 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskinea5905292018-02-07 20:59:33 +0100395 case MBEDTLS_ERR_CIPHER_INVALID_PADDING:
Gilles Peskine449bd832023-01-11 14:50:10 +0100396 return PSA_ERROR_INVALID_PADDING;
Gilles Peskinea5905292018-02-07 20:59:33 +0100397 case MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100398 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100399 case MBEDTLS_ERR_CIPHER_AUTH_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100400 return PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskinea5905292018-02-07 20:59:33 +0100401 case MBEDTLS_ERR_CIPHER_INVALID_CONTEXT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100402 return PSA_ERROR_CORRUPTION_DETECTED;
Dave Rodgman509b5672023-08-16 19:26:23 +0100403#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100404
Gilles Peskine449bd832023-01-11 14:50:10 +0100405#if !(defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) || \
406 defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE))
Gilles Peskinebee96c82020-11-23 21:00:09 +0100407 /* Only check CTR_DRBG error codes if underlying mbedtls_xxx
408 * functions are passed a CTR_DRBG instance. */
Gilles Peskinea5905292018-02-07 20:59:33 +0100409 case MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100410 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskinea5905292018-02-07 20:59:33 +0100411 case MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG:
412 case MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG:
Gilles Peskine449bd832023-01-11 14:50:10 +0100413 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100414 case MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100415 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskine82e57d12020-11-13 21:31:17 +0100416#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100417
Dave Rodgman4f47f3d2023-08-31 12:10:00 +0100418#if defined(MBEDTLS_DES_C)
Gilles Peskinea5905292018-02-07 20:59:33 +0100419 case MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100420 return PSA_ERROR_NOT_SUPPORTED;
Dave Rodgman509b5672023-08-16 19:26:23 +0100421#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100422
Gilles Peskinee59236f2018-01-27 23:32:46 +0100423 case MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED:
424 case MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE:
425 case MBEDTLS_ERR_ENTROPY_SOURCE_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100426 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskinea5905292018-02-07 20:59:33 +0100427
Dave Rodgman4f47f3d2023-08-31 12:10:00 +0100428#if defined(MBEDTLS_GCM_C)
Gilles Peskinea5905292018-02-07 20:59:33 +0100429 case MBEDTLS_ERR_GCM_AUTH_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100430 return PSA_ERROR_INVALID_SIGNATURE;
Mateusz Starzykf28261f2021-09-30 16:39:07 +0200431 case MBEDTLS_ERR_GCM_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100432 return PSA_ERROR_BUFFER_TOO_SMALL;
Gilles Peskinea5905292018-02-07 20:59:33 +0100433 case MBEDTLS_ERR_GCM_BAD_INPUT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100434 return PSA_ERROR_INVALID_ARGUMENT;
Dave Rodgman509b5672023-08-16 19:26:23 +0100435#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100436
Gilles Peskine82e57d12020-11-13 21:31:17 +0100437#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) && \
Gilles Peskine449bd832023-01-11 14:50:10 +0100438 defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE)
Gilles Peskinebee96c82020-11-23 21:00:09 +0100439 /* Only check HMAC_DRBG error codes if underlying mbedtls_xxx
440 * functions are passed a HMAC_DRBG instance. */
Gilles Peskine82e57d12020-11-13 21:31:17 +0100441 case MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100442 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskine82e57d12020-11-13 21:31:17 +0100443 case MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG:
444 case MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG:
Gilles Peskine449bd832023-01-11 14:50:10 +0100445 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine82e57d12020-11-13 21:31:17 +0100446 case MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100447 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskine82e57d12020-11-13 21:31:17 +0100448#endif
449
Dave Rodgmandea266f2023-08-31 11:52:43 +0100450#if defined(MBEDTLS_MD_LIGHT)
Gilles Peskinea5905292018-02-07 20:59:33 +0100451 case MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100452 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100453 case MBEDTLS_ERR_MD_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100454 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100455 case MBEDTLS_ERR_MD_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100456 return PSA_ERROR_INSUFFICIENT_MEMORY;
Dave Rodgman509b5672023-08-16 19:26:23 +0100457#if defined(MBEDTLS_FS_IO)
Gilles Peskinea5905292018-02-07 20:59:33 +0100458 case MBEDTLS_ERR_MD_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100459 return PSA_ERROR_STORAGE_FAILURE;
Dave Rodgman509b5672023-08-16 19:26:23 +0100460#endif
461#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100462
Dave Rodgman509b5672023-08-16 19:26:23 +0100463#if defined(MBEDTLS_BIGNUM_C)
464#if defined(MBEDTLS_FS_IO)
Gilles Peskinef76aa772018-10-29 19:24:33 +0100465 case MBEDTLS_ERR_MPI_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100466 return PSA_ERROR_STORAGE_FAILURE;
Dave Rodgman509b5672023-08-16 19:26:23 +0100467#endif
Gilles Peskinef76aa772018-10-29 19:24:33 +0100468 case MBEDTLS_ERR_MPI_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100469 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100470 case MBEDTLS_ERR_MPI_INVALID_CHARACTER:
Gilles Peskine449bd832023-01-11 14:50:10 +0100471 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100472 case MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100473 return PSA_ERROR_BUFFER_TOO_SMALL;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100474 case MBEDTLS_ERR_MPI_NEGATIVE_VALUE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100475 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100476 case MBEDTLS_ERR_MPI_DIVISION_BY_ZERO:
Gilles Peskine449bd832023-01-11 14:50:10 +0100477 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100478 case MBEDTLS_ERR_MPI_NOT_ACCEPTABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100479 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100480 case MBEDTLS_ERR_MPI_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100481 return PSA_ERROR_INSUFFICIENT_MEMORY;
Dave Rodgman509b5672023-08-16 19:26:23 +0100482#endif
Gilles Peskinef76aa772018-10-29 19:24:33 +0100483
Dave Rodgman509b5672023-08-16 19:26:23 +0100484#if defined(MBEDTLS_PK_C)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100485 case MBEDTLS_ERR_PK_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100486 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100487 case MBEDTLS_ERR_PK_TYPE_MISMATCH:
488 case MBEDTLS_ERR_PK_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100489 return PSA_ERROR_INVALID_ARGUMENT;
Dave Rodgman509b5672023-08-16 19:26:23 +0100490#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) || defined(MBEDTLS_FS_IO) || \
491 defined(MBEDTLS_PSA_ITS_FILE_C)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100492 case MBEDTLS_ERR_PK_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100493 return PSA_ERROR_STORAGE_FAILURE;
Dave Rodgman509b5672023-08-16 19:26:23 +0100494#endif
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100495 case MBEDTLS_ERR_PK_KEY_INVALID_VERSION:
496 case MBEDTLS_ERR_PK_KEY_INVALID_FORMAT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100497 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100498 case MBEDTLS_ERR_PK_UNKNOWN_PK_ALG:
Gilles Peskine449bd832023-01-11 14:50:10 +0100499 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100500 case MBEDTLS_ERR_PK_PASSWORD_REQUIRED:
501 case MBEDTLS_ERR_PK_PASSWORD_MISMATCH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100502 return PSA_ERROR_NOT_PERMITTED;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100503 case MBEDTLS_ERR_PK_INVALID_PUBKEY:
Gilles Peskine449bd832023-01-11 14:50:10 +0100504 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100505 case MBEDTLS_ERR_PK_INVALID_ALG:
506 case MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE:
507 case MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100508 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100509 case MBEDTLS_ERR_PK_SIG_LEN_MISMATCH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100510 return PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskinef9f1bdf2021-06-23 20:32:27 +0200511 case MBEDTLS_ERR_PK_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100512 return PSA_ERROR_BUFFER_TOO_SMALL;
Dave Rodgman509b5672023-08-16 19:26:23 +0100513#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100514
Gilles Peskineff2d2002019-05-06 15:26:23 +0200515 case MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100516 return PSA_ERROR_HARDWARE_FAILURE;
Gilles Peskineff2d2002019-05-06 15:26:23 +0200517 case MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100518 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskineff2d2002019-05-06 15:26:23 +0200519
Dave Rodgman509b5672023-08-16 19:26:23 +0100520#if defined(MBEDTLS_RSA_C)
Gilles Peskinea5905292018-02-07 20:59:33 +0100521 case MBEDTLS_ERR_RSA_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100522 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100523 case MBEDTLS_ERR_RSA_INVALID_PADDING:
Gilles Peskine449bd832023-01-11 14:50:10 +0100524 return PSA_ERROR_INVALID_PADDING;
Gilles Peskinea5905292018-02-07 20:59:33 +0100525 case MBEDTLS_ERR_RSA_KEY_GEN_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100526 return PSA_ERROR_HARDWARE_FAILURE;
Gilles Peskinea5905292018-02-07 20:59:33 +0100527 case MBEDTLS_ERR_RSA_KEY_CHECK_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100528 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100529 case MBEDTLS_ERR_RSA_PUBLIC_FAILED:
530 case MBEDTLS_ERR_RSA_PRIVATE_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100531 return PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100532 case MBEDTLS_ERR_RSA_VERIFY_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100533 return PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskinea5905292018-02-07 20:59:33 +0100534 case MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100535 return PSA_ERROR_BUFFER_TOO_SMALL;
Gilles Peskinea5905292018-02-07 20:59:33 +0100536 case MBEDTLS_ERR_RSA_RNG_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100537 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Dave Rodgman509b5672023-08-16 19:26:23 +0100538#endif
Manuel Pégourié-Gonnard93c08472021-04-15 12:23:55 +0200539
Dave Rodgman1dab4452023-09-01 09:59:51 +0100540#if defined(MBEDTLS_ECP_LIGHT)
itayzafrir5c753392018-05-08 11:18:38 +0300541 case MBEDTLS_ERR_ECP_BAD_INPUT_DATA:
itayzafrir7b30f8b2018-05-09 16:07:36 +0300542 case MBEDTLS_ERR_ECP_INVALID_KEY:
Gilles Peskine449bd832023-01-11 14:50:10 +0100543 return PSA_ERROR_INVALID_ARGUMENT;
itayzafrir7b30f8b2018-05-09 16:07:36 +0300544 case MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100545 return PSA_ERROR_BUFFER_TOO_SMALL;
itayzafrir7b30f8b2018-05-09 16:07:36 +0300546 case MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100547 return PSA_ERROR_NOT_SUPPORTED;
itayzafrir7b30f8b2018-05-09 16:07:36 +0300548 case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH:
549 case MBEDTLS_ERR_ECP_VERIFY_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100550 return PSA_ERROR_INVALID_SIGNATURE;
itayzafrir7b30f8b2018-05-09 16:07:36 +0300551 case MBEDTLS_ERR_ECP_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100552 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskine40d81602020-11-25 00:09:47 +0100553 case MBEDTLS_ERR_ECP_RANDOM_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100554 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskine40d81602020-11-25 00:09:47 +0100555
Dave Rodgman509b5672023-08-16 19:26:23 +0100556#if defined(MBEDTLS_ECP_RESTARTABLE)
Paul Elliott588f8ed2022-12-02 18:10:26 +0000557 case MBEDTLS_ERR_ECP_IN_PROGRESS:
558 return PSA_OPERATION_INCOMPLETE;
Dave Rodgman509b5672023-08-16 19:26:23 +0100559#endif
560#endif
Paul Elliott588f8ed2022-12-02 18:10:26 +0000561
Janos Follatha13b9052019-11-22 12:48:59 +0000562 case MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100563 return PSA_ERROR_CORRUPTION_DETECTED;
itayzafrir5c753392018-05-08 11:18:38 +0300564
Gilles Peskinee59236f2018-01-27 23:32:46 +0100565 default:
Gilles Peskine449bd832023-01-11 14:50:10 +0100566 return PSA_ERROR_GENERIC_ERROR;
Gilles Peskinee59236f2018-01-27 23:32:46 +0100567 }
568}
569
Paul Elliottdc42ca82023-02-24 18:11:59 +0000570/**
571 * \brief For output buffers which contain "tags"
572 * (outputs that may be checked for validity like
573 * hashes, MACs and signatures), fill the unused
574 * part of the output buffer (the whole buffer on
575 * error, the trailing part on success) with
576 * something that isn't a valid tag (barring an
577 * attack on the tag and deliberately-crafted
578 * input), in case the caller doesn't check the
579 * return status properly.
580 *
581 * \param output_buffer Pointer to buffer to wipe. May not be NULL
582 * unless \p output_buffer_size is zero.
583 * \param status Status of function called to generate
584 * output_buffer originally
585 * \param output_buffer_size Size of output buffer. If zero, \p output_buffer
586 * could be NULL.
587 * \param output_buffer_length Length of data written to output_buffer, must be
588 * less than \p output_buffer_size
589 */
590static void psa_wipe_tag_output_buffer(uint8_t *output_buffer, psa_status_t status,
Paul Elliott7118d172023-02-26 16:57:05 +0000591 size_t output_buffer_size, size_t output_buffer_length)
592{
Paul Elliottdc42ca82023-02-24 18:11:59 +0000593 size_t offset = 0;
594
595 if (output_buffer_size == 0) {
596 /* If output_buffer_size is 0 then we have nothing to do. We must not
597 call memset because output_buffer may be NULL in this case */
598 return;
599 }
600
601 if (status == PSA_SUCCESS) {
602 offset = output_buffer_length;
603 }
604
605 memset(output_buffer + offset, '!', output_buffer_size - offset);
606}
607
Gilles Peskineb0b255c2018-07-06 17:01:38 +0200608
Gilles Peskine449bd832023-01-11 14:50:10 +0100609psa_status_t psa_validate_unstructured_key_bit_size(psa_key_type_t type,
610 size_t bits)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200611{
612 /* Check that the bit size is acceptable for the key type */
Gilles Peskine449bd832023-01-11 14:50:10 +0100613 switch (type) {
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200614 case PSA_KEY_TYPE_RAW_DATA:
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200615 case PSA_KEY_TYPE_HMAC:
Gilles Peskineea0fb492018-07-12 17:17:20 +0200616 case PSA_KEY_TYPE_DERIVE:
Neil Armstrong4b5710f2022-05-25 11:30:27 +0200617 case PSA_KEY_TYPE_PASSWORD:
618 case PSA_KEY_TYPE_PASSWORD_HASH:
Gilles Peskineea0fb492018-07-12 17:17:20 +0200619 break;
Ronald Cron1f0db802021-03-12 09:59:30 +0100620#if defined(PSA_WANT_KEY_TYPE_AES)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200621 case PSA_KEY_TYPE_AES:
Gilles Peskine449bd832023-01-11 14:50:10 +0100622 if (bits != 128 && bits != 192 && bits != 256) {
623 return PSA_ERROR_INVALID_ARGUMENT;
624 }
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200625 break;
626#endif
Gilles Peskine6c12a1e2021-09-21 11:59:39 +0200627#if defined(PSA_WANT_KEY_TYPE_ARIA)
628 case PSA_KEY_TYPE_ARIA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100629 if (bits != 128 && bits != 192 && bits != 256) {
630 return PSA_ERROR_INVALID_ARGUMENT;
631 }
Gilles Peskine6c12a1e2021-09-21 11:59:39 +0200632 break;
633#endif
Ronald Cron1f0db802021-03-12 09:59:30 +0100634#if defined(PSA_WANT_KEY_TYPE_CAMELLIA)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200635 case PSA_KEY_TYPE_CAMELLIA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100636 if (bits != 128 && bits != 192 && bits != 256) {
637 return PSA_ERROR_INVALID_ARGUMENT;
638 }
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200639 break;
640#endif
Ronald Cron1f0db802021-03-12 09:59:30 +0100641#if defined(PSA_WANT_KEY_TYPE_DES)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200642 case PSA_KEY_TYPE_DES:
Gilles Peskine449bd832023-01-11 14:50:10 +0100643 if (bits != 64 && bits != 128 && bits != 192) {
644 return PSA_ERROR_INVALID_ARGUMENT;
645 }
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200646 break;
647#endif
Ronald Cron1f0db802021-03-12 09:59:30 +0100648#if defined(PSA_WANT_KEY_TYPE_CHACHA20)
Gilles Peskine26869f22019-05-06 15:25:00 +0200649 case PSA_KEY_TYPE_CHACHA20:
Gilles Peskine449bd832023-01-11 14:50:10 +0100650 if (bits != 256) {
651 return PSA_ERROR_INVALID_ARGUMENT;
652 }
Gilles Peskine26869f22019-05-06 15:25:00 +0200653 break;
654#endif
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200655 default:
Gilles Peskine449bd832023-01-11 14:50:10 +0100656 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200657 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100658 if (bits % 8 != 0) {
659 return PSA_ERROR_INVALID_ARGUMENT;
660 }
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200661
Gilles Peskine449bd832023-01-11 14:50:10 +0100662 return PSA_SUCCESS;
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200663}
664
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100665/** Check whether a given key type is valid for use with a given MAC algorithm
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100666 *
Steven Cooremancd640932021-03-08 12:00:27 +0100667 * Upon successful return of this function, the behavior of #PSA_MAC_LENGTH
668 * when called with the validated \p algorithm and \p key_type is well-defined.
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100669 *
670 * \param[in] algorithm The specific MAC algorithm (can be wildcard).
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100671 * \param[in] key_type The key type of the key to be used with the
672 * \p algorithm.
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100673 *
674 * \retval #PSA_SUCCESS
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100675 * The \p key_type is valid for use with the \p algorithm
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100676 * \retval #PSA_ERROR_INVALID_ARGUMENT
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100677 * The \p key_type is not valid for use with the \p algorithm
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100678 */
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100679MBEDTLS_STATIC_TESTABLE psa_status_t psa_mac_key_can_do(
Steven Cooreman58c94d32021-03-02 21:31:17 +0100680 psa_algorithm_t algorithm,
Gilles Peskine449bd832023-01-11 14:50:10 +0100681 psa_key_type_t key_type)
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100682{
Gilles Peskine449bd832023-01-11 14:50:10 +0100683 if (PSA_ALG_IS_HMAC(algorithm)) {
684 if (key_type == PSA_KEY_TYPE_HMAC) {
685 return PSA_SUCCESS;
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100686 }
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100687 }
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100688
Gilles Peskine449bd832023-01-11 14:50:10 +0100689 if (PSA_ALG_IS_BLOCK_CIPHER_MAC(algorithm)) {
690 /* Check that we're calling PSA_BLOCK_CIPHER_BLOCK_LENGTH with a cipher
691 * key. */
692 if ((key_type & PSA_KEY_TYPE_CATEGORY_MASK) ==
693 PSA_KEY_TYPE_CATEGORY_SYMMETRIC) {
694 /* PSA_BLOCK_CIPHER_BLOCK_LENGTH returns 1 for stream ciphers and
695 * the block length (larger than 1) for block ciphers. */
696 if (PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type) > 1) {
697 return PSA_SUCCESS;
698 }
699 }
700 }
701
702 return PSA_ERROR_INVALID_ARGUMENT;
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100703}
704
Gilles Peskine449bd832023-01-11 14:50:10 +0100705psa_status_t psa_allocate_buffer_to_slot(psa_key_slot_t *slot,
706 size_t buffer_length)
Steven Cooreman75b74362020-07-28 14:30:13 +0200707{
Valerio Setti8d4f1502024-06-14 07:49:05 +0200708#if defined(MBEDTLS_PSA_STATIC_KEY_SLOTS)
709 if (slot->key.in_use) {
710 return PSA_ERROR_ALREADY_EXISTS;
711 }
712
713 if (buffer_length > ((size_t) MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE)) {
714 return PSA_ERROR_NOT_SUPPORTED;
715 }
716
717 slot->key.in_use = 1;
718#else
Gilles Peskine449bd832023-01-11 14:50:10 +0100719 if (slot->key.data != NULL) {
720 return PSA_ERROR_ALREADY_EXISTS;
721 }
Steven Cooreman75b74362020-07-28 14:30:13 +0200722
Gilles Peskine449bd832023-01-11 14:50:10 +0100723 slot->key.data = mbedtls_calloc(1, buffer_length);
724 if (slot->key.data == NULL) {
725 return PSA_ERROR_INSUFFICIENT_MEMORY;
726 }
Valerio Setti8d4f1502024-06-14 07:49:05 +0200727#endif
Steven Cooreman75b74362020-07-28 14:30:13 +0200728
Ronald Cronea0f8a62020-11-25 17:52:23 +0100729 slot->key.bytes = buffer_length;
Gilles Peskine449bd832023-01-11 14:50:10 +0100730 return PSA_SUCCESS;
Steven Cooreman75b74362020-07-28 14:30:13 +0200731}
732
Gilles Peskine449bd832023-01-11 14:50:10 +0100733psa_status_t psa_copy_key_material_into_slot(psa_key_slot_t *slot,
734 const uint8_t *data,
735 size_t data_length)
Steven Cooremanf7cebd42020-10-13 20:27:40 +0200736{
Gilles Peskine449bd832023-01-11 14:50:10 +0100737 psa_status_t status = psa_allocate_buffer_to_slot(slot,
738 data_length);
739 if (status != PSA_SUCCESS) {
740 return status;
741 }
Steven Cooremanf7cebd42020-10-13 20:27:40 +0200742
Gilles Peskine449bd832023-01-11 14:50:10 +0100743 memcpy(slot->key.data, data, data_length);
744 return PSA_SUCCESS;
Steven Cooremanf7cebd42020-10-13 20:27:40 +0200745}
746
Ronald Crona0fe59f2020-11-29 11:14:53 +0100747psa_status_t psa_import_key_into_slot(
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100748 const psa_key_attributes_t *attributes,
749 const uint8_t *data, size_t data_length,
750 uint8_t *key_buffer, size_t key_buffer_size,
Gilles Peskine449bd832023-01-11 14:50:10 +0100751 size_t *key_buffer_length, size_t *bits)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100752{
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100753 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f107ae2024-02-28 01:26:46 +0100754 psa_key_type_t type = attributes->type;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100755
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200756 /* zero-length keys are never supported. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100757 if (data_length == 0) {
758 return PSA_ERROR_NOT_SUPPORTED;
759 }
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200760
Gilles Peskine449bd832023-01-11 14:50:10 +0100761 if (key_type_is_raw_bytes(type)) {
762 *bits = PSA_BYTES_TO_BITS(data_length);
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200763
Gilles Peskine2f107ae2024-02-28 01:26:46 +0100764 status = psa_validate_unstructured_key_bit_size(attributes->type,
Gilles Peskine449bd832023-01-11 14:50:10 +0100765 *bits);
766 if (status != PSA_SUCCESS) {
767 return status;
768 }
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200769
Ronald Crondd04d422020-11-28 15:14:42 +0100770 /* Copy the key material. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100771 memcpy(key_buffer, data, data_length);
Ronald Crondd04d422020-11-28 15:14:42 +0100772 *key_buffer_length = data_length;
Gilles Peskine449bd832023-01-11 14:50:10 +0100773 (void) key_buffer_size;
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200774
Gilles Peskine449bd832023-01-11 14:50:10 +0100775 return PSA_SUCCESS;
776 } else if (PSA_KEY_TYPE_IS_ASYMMETRIC(type)) {
Valerio Settia55f0422023-07-10 15:34:41 +0200777#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT) || \
Przemek Stekiel6d85afa2023-04-28 11:42:17 +0200778 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY)
Przemek Stekiel472b3f32022-12-01 14:38:49 +0100779 if (PSA_KEY_TYPE_IS_DH(type)) {
Przemek Stekield1cf1ba2023-04-27 12:04:21 +0200780 if (psa_is_dh_key_size_valid(PSA_BYTES_TO_BITS(data_length)) == 0) {
Valerio Setti504a1022024-01-17 15:19:30 +0100781 return PSA_ERROR_NOT_SUPPORTED;
Przemek Stekiel472b3f32022-12-01 14:38:49 +0100782 }
Przemek Stekiel33c91eb2023-05-30 15:16:35 +0200783 return mbedtls_psa_ffdh_import_key(attributes,
784 data, data_length,
785 key_buffer, key_buffer_size,
786 key_buffer_length,
787 bits);
Przemek Stekiel472b3f32022-12-01 14:38:49 +0100788 }
Valerio Settia55f0422023-07-10 15:34:41 +0200789#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT) ||
Przemek Stekiel6d85afa2023-04-28 11:42:17 +0200790 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) */
Valerio Setti27c501a2023-06-27 16:58:52 +0200791#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT) || \
Gilles Peskine449bd832023-01-11 14:50:10 +0100792 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
793 if (PSA_KEY_TYPE_IS_ECC(type)) {
794 return mbedtls_psa_ecp_import_key(attributes,
795 data, data_length,
796 key_buffer, key_buffer_size,
797 key_buffer_length,
798 bits);
Steven Cooreman40120f62020-10-29 11:42:22 +0100799 }
Valerio Setti27c501a2023-06-27 16:58:52 +0200800#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT) ||
John Durkop9814fa22020-11-04 12:28:15 -0800801 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
Valerio Settife478902023-07-25 12:27:19 +0200802#if (defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT) && \
803 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT)) || \
Gilles Peskine449bd832023-01-11 14:50:10 +0100804 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
805 if (PSA_KEY_TYPE_IS_RSA(type)) {
806 return mbedtls_psa_rsa_import_key(attributes,
807 data, data_length,
808 key_buffer, key_buffer_size,
809 key_buffer_length,
810 bits);
Steven Cooreman3ea0ce42020-10-23 11:37:05 +0200811 }
Valerio Settife478902023-07-25 12:27:19 +0200812#endif /* (defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT) &&
813 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT)) ||
John Durkop9814fa22020-11-04 12:28:15 -0800814 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100815 }
Steven Cooreman40120f62020-10-29 11:42:22 +0100816
Gilles Peskine449bd832023-01-11 14:50:10 +0100817 return PSA_ERROR_NOT_SUPPORTED;
Darryl Green06fd18d2018-07-16 11:21:11 +0100818}
819
Gilles Peskinef603c712019-01-19 13:40:11 +0100820/** Calculate the intersection of two algorithm usage policies.
821 *
822 * Return 0 (which allows no operation) on incompatibility.
823 */
824static psa_algorithm_t psa_key_policy_algorithm_intersection(
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100825 psa_key_type_t key_type,
Gilles Peskinef603c712019-01-19 13:40:11 +0100826 psa_algorithm_t alg1,
Gilles Peskine449bd832023-01-11 14:50:10 +0100827 psa_algorithm_t alg2)
Gilles Peskinef603c712019-01-19 13:40:11 +0100828{
Gilles Peskine549ea862019-05-22 11:45:59 +0200829 /* Common case: both sides actually specify the same policy. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100830 if (alg1 == alg2) {
831 return alg1;
832 }
Steven Cooreman03488022021-02-18 12:07:20 +0100833 /* If the policies are from the same hash-and-sign family, check
834 * if one is a wildcard. If so the other has the specific algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100835 if (PSA_ALG_IS_SIGN_HASH(alg1) &&
836 PSA_ALG_IS_SIGN_HASH(alg2) &&
837 (alg1 & ~PSA_ALG_HASH_MASK) == (alg2 & ~PSA_ALG_HASH_MASK)) {
838 if (PSA_ALG_SIGN_GET_HASH(alg1) == PSA_ALG_ANY_HASH) {
839 return alg2;
840 }
841 if (PSA_ALG_SIGN_GET_HASH(alg2) == PSA_ALG_ANY_HASH) {
842 return alg1;
843 }
Steven Cooreman03488022021-02-18 12:07:20 +0100844 }
845 /* If the policies are from the same AEAD family, check whether
Steven Cooreman7de9e2d2021-02-22 17:05:56 +0100846 * one of them is a minimum-tag-length wildcard. Calculate the most
Steven Cooreman03488022021-02-18 12:07:20 +0100847 * restrictive tag length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100848 if (PSA_ALG_IS_AEAD(alg1) && PSA_ALG_IS_AEAD(alg2) &&
849 (PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg1, 0) ==
850 PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg2, 0))) {
851 size_t alg1_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg1);
852 size_t alg2_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg2);
Steven Cooremancd640932021-03-08 12:00:27 +0100853 size_t restricted_len = alg1_len > alg2_len ? alg1_len : alg2_len;
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100854
Steven Cooreman7de9e2d2021-02-22 17:05:56 +0100855 /* If both are wildcards, return most restrictive wildcard */
Gilles Peskine449bd832023-01-11 14:50:10 +0100856 if (((alg1 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
857 ((alg2 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0)) {
858 return PSA_ALG_AEAD_WITH_AT_LEAST_THIS_LENGTH_TAG(
859 alg1, restricted_len);
Steven Cooreman03488022021-02-18 12:07:20 +0100860 }
861 /* If only one is a wildcard, return specific algorithm if compatible. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100862 if (((alg1 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
863 (alg1_len <= alg2_len)) {
864 return alg2;
Steven Cooreman03488022021-02-18 12:07:20 +0100865 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100866 if (((alg2 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
867 (alg2_len <= alg1_len)) {
868 return alg1;
Steven Cooreman03488022021-02-18 12:07:20 +0100869 }
870 }
871 /* If the policies are from the same MAC family, check whether one
872 * of them is a minimum-MAC-length policy. Calculate the most
873 * restrictive tag length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100874 if (PSA_ALG_IS_MAC(alg1) && PSA_ALG_IS_MAC(alg2) &&
875 (PSA_ALG_FULL_LENGTH_MAC(alg1) ==
876 PSA_ALG_FULL_LENGTH_MAC(alg2))) {
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100877 /* Validate the combination of key type and algorithm. Since the base
878 * algorithm of alg1 and alg2 are the same, we only need this once. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100879 if (PSA_SUCCESS != psa_mac_key_can_do(alg1, key_type)) {
880 return 0;
881 }
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100882
Steven Cooreman31a876d2021-03-03 20:47:40 +0100883 /* Get the (exact or at-least) output lengths for both sides of the
884 * requested intersection. None of the currently supported algorithms
885 * have an output length dependent on the actual key size, so setting it
886 * to a bogus value of 0 is currently OK.
887 *
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100888 * Note that for at-least-this-length wildcard algorithms, the output
889 * length is set to the shortest allowed length, which allows us to
890 * calculate the most restrictive tag length for the intersection. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100891 size_t alg1_len = PSA_MAC_LENGTH(key_type, 0, alg1);
892 size_t alg2_len = PSA_MAC_LENGTH(key_type, 0, alg2);
Steven Cooremancd640932021-03-08 12:00:27 +0100893 size_t restricted_len = alg1_len > alg2_len ? alg1_len : alg2_len;
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100894
Steven Cooremana1d83222021-02-25 10:20:29 +0100895 /* If both are wildcards, return most restrictive wildcard */
Gilles Peskine449bd832023-01-11 14:50:10 +0100896 if (((alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
897 ((alg2 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0)) {
898 return PSA_ALG_AT_LEAST_THIS_LENGTH_MAC(alg1, restricted_len);
Steven Cooreman03488022021-02-18 12:07:20 +0100899 }
Steven Cooreman31a876d2021-03-03 20:47:40 +0100900
901 /* If only one is an at-least-this-length policy, the intersection would
902 * be the other (fixed-length) policy as long as said fixed length is
903 * equal to or larger than the shortest allowed length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100904 if ((alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) {
905 return (alg1_len <= alg2_len) ? alg2 : 0;
Steven Cooreman03488022021-02-18 12:07:20 +0100906 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100907 if ((alg2 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) {
908 return (alg2_len <= alg1_len) ? alg1 : 0;
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100909 }
Steven Cooreman31a876d2021-03-03 20:47:40 +0100910
Steven Cooremancd640932021-03-08 12:00:27 +0100911 /* If none of them are wildcards, check whether they define the same tag
912 * length. This is still possible here when one is default-length and
913 * the other specific-length. Ensure to always return the
914 * specific-length version for the intersection. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100915 if (alg1_len == alg2_len) {
916 return PSA_ALG_TRUNCATED_MAC(alg1, alg1_len);
917 }
Gilles Peskinef603c712019-01-19 13:40:11 +0100918 }
919 /* If the policies are incompatible, allow nothing. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100920 return 0;
Gilles Peskinef603c712019-01-19 13:40:11 +0100921}
922
Gilles Peskine449bd832023-01-11 14:50:10 +0100923static int psa_key_algorithm_permits(psa_key_type_t key_type,
924 psa_algorithm_t policy_alg,
925 psa_algorithm_t requested_alg)
Gilles Peskined6f371b2019-05-10 19:33:38 +0200926{
Gilles Peskine549ea862019-05-22 11:45:59 +0200927 /* Common case: the policy only allows requested_alg. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100928 if (requested_alg == policy_alg) {
929 return 1;
930 }
Steven Cooreman03488022021-02-18 12:07:20 +0100931 /* If policy_alg is a hash-and-sign with a wildcard for the hash,
932 * and requested_alg is the same hash-and-sign family with any hash,
933 * then requested_alg is compliant with policy_alg. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100934 if (PSA_ALG_IS_SIGN_HASH(requested_alg) &&
935 PSA_ALG_SIGN_GET_HASH(policy_alg) == PSA_ALG_ANY_HASH) {
936 return (policy_alg & ~PSA_ALG_HASH_MASK) ==
937 (requested_alg & ~PSA_ALG_HASH_MASK);
Steven Cooreman03488022021-02-18 12:07:20 +0100938 }
939 /* If policy_alg is a wildcard AEAD algorithm of the same base as
940 * the requested algorithm, check the requested tag length to be
941 * equal-length or longer than the wildcard-specified length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100942 if (PSA_ALG_IS_AEAD(policy_alg) &&
943 PSA_ALG_IS_AEAD(requested_alg) &&
944 (PSA_ALG_AEAD_WITH_SHORTENED_TAG(policy_alg, 0) ==
945 PSA_ALG_AEAD_WITH_SHORTENED_TAG(requested_alg, 0)) &&
946 ((policy_alg & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0)) {
947 return PSA_ALG_AEAD_GET_TAG_LENGTH(policy_alg) <=
948 PSA_ALG_AEAD_GET_TAG_LENGTH(requested_alg);
Steven Cooreman03488022021-02-18 12:07:20 +0100949 }
Steven Cooremancd640932021-03-08 12:00:27 +0100950 /* If policy_alg is a MAC algorithm of the same base as the requested
951 * algorithm, check whether their MAC lengths are compatible. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100952 if (PSA_ALG_IS_MAC(policy_alg) &&
953 PSA_ALG_IS_MAC(requested_alg) &&
954 (PSA_ALG_FULL_LENGTH_MAC(policy_alg) ==
955 PSA_ALG_FULL_LENGTH_MAC(requested_alg))) {
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100956 /* Validate the combination of key type and algorithm. Since the policy
957 * and requested algorithms are the same, we only need this once. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100958 if (PSA_SUCCESS != psa_mac_key_can_do(policy_alg, key_type)) {
959 return 0;
960 }
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100961
Steven Cooreman31a876d2021-03-03 20:47:40 +0100962 /* Get both the requested output length for the algorithm which is to be
963 * verified, and the default output length for the base algorithm.
964 * Note that none of the currently supported algorithms have an output
965 * length dependent on actual key size, so setting it to a bogus value
966 * of 0 is currently OK. */
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100967 size_t requested_output_length = PSA_MAC_LENGTH(
Gilles Peskine449bd832023-01-11 14:50:10 +0100968 key_type, 0, requested_alg);
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100969 size_t default_output_length = PSA_MAC_LENGTH(
Gilles Peskine449bd832023-01-11 14:50:10 +0100970 key_type, 0,
971 PSA_ALG_FULL_LENGTH_MAC(requested_alg));
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100972
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100973 /* If the policy is default-length, only allow an algorithm with
974 * a declared exact-length matching the default. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100975 if (PSA_MAC_TRUNCATED_LENGTH(policy_alg) == 0) {
976 return requested_output_length == default_output_length;
977 }
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100978
979 /* If the requested algorithm is default-length, allow it if the policy
Steven Cooremancd640932021-03-08 12:00:27 +0100980 * length exactly matches the default length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100981 if (PSA_MAC_TRUNCATED_LENGTH(requested_alg) == 0 &&
982 PSA_MAC_TRUNCATED_LENGTH(policy_alg) == default_output_length) {
983 return 1;
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100984 }
985
Steven Cooremancd640932021-03-08 12:00:27 +0100986 /* If policy_alg is an at-least-this-length wildcard MAC algorithm,
987 * check for the requested MAC length to be equal to or longer than the
988 * minimum allowed length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100989 if ((policy_alg & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) {
990 return PSA_MAC_TRUNCATED_LENGTH(policy_alg) <=
991 requested_output_length;
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100992 }
Gilles Peskined6f371b2019-05-10 19:33:38 +0200993 }
Steven Cooremance48e852020-10-05 16:02:45 +0200994 /* If policy_alg is a generic key agreement operation, then using it for
Steven Cooremanfa5e6312020-10-15 17:07:12 +0200995 * a key derivation with that key agreement should also be allowed. This
996 * behaviour is expected to be defined in a future specification version. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100997 if (PSA_ALG_IS_RAW_KEY_AGREEMENT(policy_alg) &&
998 PSA_ALG_IS_KEY_AGREEMENT(requested_alg)) {
999 return PSA_ALG_KEY_AGREEMENT_GET_BASE(requested_alg) ==
1000 policy_alg;
Steven Cooremance48e852020-10-05 16:02:45 +02001001 }
Steven Cooremanb3ce8152021-02-18 12:03:50 +01001002 /* If it isn't explicitly permitted, it's forbidden. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001003 return 0;
Gilles Peskined6f371b2019-05-10 19:33:38 +02001004}
1005
Gilles Peskine30f77cd2019-01-14 16:06:39 +01001006/** Test whether a policy permits an algorithm.
1007 *
1008 * The caller must test usage flags separately.
Steven Cooreman7e39f052021-02-23 14:18:32 +01001009 *
Steven Cooreman5a172672021-03-02 21:27:42 +01001010 * \note This function requires providing the key type for which the policy is
1011 * being validated, since some algorithm policy definitions (e.g. MAC)
1012 * have different properties depending on what kind of cipher it is
1013 * combined with.
1014 *
Steven Cooreman7e39f052021-02-23 14:18:32 +01001015 * \retval PSA_SUCCESS When \p alg is a specific algorithm
1016 * allowed by the \p policy.
1017 * \retval PSA_ERROR_INVALID_ARGUMENT When \p alg is not a specific algorithm
1018 * \retval PSA_ERROR_NOT_PERMITTED When \p alg is a specific algorithm, but
1019 * the \p policy does not allow it.
Gilles Peskine30f77cd2019-01-14 16:06:39 +01001020 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001021static psa_status_t psa_key_policy_permits(const psa_key_policy_t *policy,
1022 psa_key_type_t key_type,
1023 psa_algorithm_t alg)
Gilles Peskine30f77cd2019-01-14 16:06:39 +01001024{
Steven Cooremand788fab2021-02-25 11:29:17 +01001025 /* '0' is not a valid algorithm */
Gilles Peskine449bd832023-01-11 14:50:10 +01001026 if (alg == 0) {
1027 return PSA_ERROR_INVALID_ARGUMENT;
1028 }
Steven Cooremand788fab2021-02-25 11:29:17 +01001029
Steven Cooreman7e39f052021-02-23 14:18:32 +01001030 /* A requested algorithm cannot be a wildcard. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001031 if (PSA_ALG_IS_WILDCARD(alg)) {
1032 return PSA_ERROR_INVALID_ARGUMENT;
1033 }
Steven Cooreman7e39f052021-02-23 14:18:32 +01001034
Gilles Peskine449bd832023-01-11 14:50:10 +01001035 if (psa_key_algorithm_permits(key_type, policy->alg, alg) ||
1036 psa_key_algorithm_permits(key_type, policy->alg2, alg)) {
1037 return PSA_SUCCESS;
1038 } else {
1039 return PSA_ERROR_NOT_PERMITTED;
1040 }
Gilles Peskine30f77cd2019-01-14 16:06:39 +01001041}
1042
Gilles Peskinef603c712019-01-19 13:40:11 +01001043/** Restrict a key policy based on a constraint.
1044 *
Steven Cooreman5a172672021-03-02 21:27:42 +01001045 * \note This function requires providing the key type for which the policy is
1046 * being restricted, since some algorithm policy definitions (e.g. MAC)
1047 * have different properties depending on what kind of cipher it is
1048 * combined with.
1049 *
Steven Cooreman1ac5ce32021-03-02 16:34:49 +01001050 * \param[in] key_type The key type for which to restrict the policy
Gilles Peskinef603c712019-01-19 13:40:11 +01001051 * \param[in,out] policy The policy to restrict.
1052 * \param[in] constraint The policy constraint to apply.
1053 *
1054 * \retval #PSA_SUCCESS
1055 * \c *policy contains the intersection of the original value of
1056 * \c *policy and \c *constraint.
1057 * \retval #PSA_ERROR_INVALID_ARGUMENT
Steven Cooreman1ac5ce32021-03-02 16:34:49 +01001058 * \c key_type, \c *policy and \c *constraint are incompatible.
Gilles Peskinef603c712019-01-19 13:40:11 +01001059 * \c *policy is unchanged.
1060 */
1061static psa_status_t psa_restrict_key_policy(
Steven Cooreman1ac5ce32021-03-02 16:34:49 +01001062 psa_key_type_t key_type,
Gilles Peskinef603c712019-01-19 13:40:11 +01001063 psa_key_policy_t *policy,
Gilles Peskine449bd832023-01-11 14:50:10 +01001064 const psa_key_policy_t *constraint)
Gilles Peskinef603c712019-01-19 13:40:11 +01001065{
1066 psa_algorithm_t intersection_alg =
Gilles Peskine449bd832023-01-11 14:50:10 +01001067 psa_key_policy_algorithm_intersection(key_type, policy->alg,
1068 constraint->alg);
Gilles Peskined6f371b2019-05-10 19:33:38 +02001069 psa_algorithm_t intersection_alg2 =
Gilles Peskine449bd832023-01-11 14:50:10 +01001070 psa_key_policy_algorithm_intersection(key_type, policy->alg2,
1071 constraint->alg2);
1072 if (intersection_alg == 0 && policy->alg != 0 && constraint->alg != 0) {
1073 return PSA_ERROR_INVALID_ARGUMENT;
1074 }
1075 if (intersection_alg2 == 0 && policy->alg2 != 0 && constraint->alg2 != 0) {
1076 return PSA_ERROR_INVALID_ARGUMENT;
1077 }
Gilles Peskinef603c712019-01-19 13:40:11 +01001078 policy->usage &= constraint->usage;
1079 policy->alg = intersection_alg;
Gilles Peskined6f371b2019-05-10 19:33:38 +02001080 policy->alg2 = intersection_alg2;
Gilles Peskine449bd832023-01-11 14:50:10 +01001081 return PSA_SUCCESS;
Gilles Peskinef603c712019-01-19 13:40:11 +01001082}
1083
Przemek Stekiel061f6942022-11-30 10:51:35 +01001084/** Get the description of a key given its identifier and policy constraints
1085 * and lock it.
1086 *
1087 * The key must have allow all the usage flags set in \p usage. If \p alg is
1088 * nonzero, the key must allow operations with this algorithm. If \p alg is
1089 * zero, the algorithm is not checked.
1090 *
1091 * In case of a persistent key, the function loads the description of the key
1092 * into a key slot if not already done.
1093 *
Ryan Everett098c6652024-01-03 13:03:36 +00001094 * On success, the returned key slot has been registered for reading.
Ryan Everett93cea572024-02-20 18:01:29 +00001095 * It is the responsibility of the caller to then unregister
1096 * once they have finished reading the contents of the slot.
1097 * The caller unregisters by calling psa_unregister_read() or
1098 * psa_unregister_read_under_mutex(). psa_unregister_read() must be called
1099 * if and only if the caller already holds the global key slot mutex
1100 * (when mutexes are enabled). psa_unregister_read_under_mutex() encapsulates
1101 * the unregister with mutex lock and unlock operations.
Przemek Stekiel061f6942022-11-30 10:51:35 +01001102 */
1103static psa_status_t psa_get_and_lock_key_slot_with_policy(
Ronald Cron5c522922020-11-14 16:35:34 +01001104 mbedtls_svc_key_id_t key,
1105 psa_key_slot_t **p_slot,
1106 psa_key_usage_t usage,
Gilles Peskine449bd832023-01-11 14:50:10 +01001107 psa_algorithm_t alg)
Darryl Green06fd18d2018-07-16 11:21:11 +01001108{
Ronald Cronf95a2b12020-10-22 15:24:49 +02001109 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01001110 psa_key_slot_t *slot = NULL;
Darryl Green06fd18d2018-07-16 11:21:11 +01001111
Gilles Peskine449bd832023-01-11 14:50:10 +01001112 status = psa_get_and_lock_key_slot(key, p_slot);
1113 if (status != PSA_SUCCESS) {
1114 return status;
1115 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02001116 slot = *p_slot;
Darryl Green06fd18d2018-07-16 11:21:11 +01001117
1118 /* Enforce that usage policy for the key slot contains all the flags
1119 * required by the usage parameter. There is one exception: public
1120 * keys can always be exported, so we treat public key objects as
1121 * if they had the export flag. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001122 if (PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type)) {
Darryl Green06fd18d2018-07-16 11:21:11 +01001123 usage &= ~PSA_KEY_USAGE_EXPORT;
Gilles Peskine449bd832023-01-11 14:50:10 +01001124 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02001125
Gilles Peskine449bd832023-01-11 14:50:10 +01001126 if ((slot->attr.policy.usage & usage) != usage) {
Steven Cooreman328f11c2021-03-02 11:44:51 +01001127 status = PSA_ERROR_NOT_PERMITTED;
Ronald Cronf95a2b12020-10-22 15:24:49 +02001128 goto error;
Steven Cooreman328f11c2021-03-02 11:44:51 +01001129 }
Gilles Peskine30f77cd2019-01-14 16:06:39 +01001130
Shaun Case8b0ecbc2021-12-20 21:14:10 -08001131 /* Enforce that the usage policy permits the requested algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001132 if (alg != 0) {
1133 status = psa_key_policy_permits(&slot->attr.policy,
1134 slot->attr.type,
1135 alg);
1136 if (status != PSA_SUCCESS) {
Steven Cooreman7e39f052021-02-23 14:18:32 +01001137 goto error;
Gilles Peskine449bd832023-01-11 14:50:10 +01001138 }
Steven Cooreman7e39f052021-02-23 14:18:32 +01001139 }
Darryl Green06fd18d2018-07-16 11:21:11 +01001140
Gilles Peskine449bd832023-01-11 14:50:10 +01001141 return PSA_SUCCESS;
Ronald Cronf95a2b12020-10-22 15:24:49 +02001142
1143error:
1144 *p_slot = NULL;
Ryan Everettfb792ca2024-01-31 13:40:05 +00001145 psa_unregister_read_under_mutex(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02001146
Gilles Peskine449bd832023-01-11 14:50:10 +01001147 return status;
Darryl Green06fd18d2018-07-16 11:21:11 +01001148}
Darryl Green940d72c2018-07-13 13:18:51 +01001149
Ronald Cron5c522922020-11-14 16:35:34 +01001150/** Get a key slot containing a transparent key and lock it.
Gilles Peskine28f8f302019-07-24 13:30:31 +02001151 *
1152 * A transparent key is a key for which the key material is directly
Ronald Cronddae0f52021-08-24 15:39:44 +02001153 * available, as opposed to a key in a secure element and/or to be used
1154 * by a secure element.
Gilles Peskine28f8f302019-07-24 13:30:31 +02001155 *
Ronald Cronddae0f52021-08-24 15:39:44 +02001156 * This is a temporary function that may be used instead of
1157 * psa_get_and_lock_key_slot_with_policy() when there is no opaque key support
1158 * for a cryptographic operation.
Ronald Cronf95a2b12020-10-22 15:24:49 +02001159 *
Ryan Everett098c6652024-01-03 13:03:36 +00001160 * On success, the returned key slot has been registered for reading.
Ryan Everett93cea572024-02-20 18:01:29 +00001161 * It is the responsibility of the caller to then unregister
1162 * once they have finished reading the contents of the slot.
1163 * The caller unregisters by calling psa_unregister_read() or
1164 * psa_unregister_read_under_mutex(). psa_unregister_read() must be called
1165 * if and only if the caller already holds the global key slot mutex
1166 * (when mutexes are enabled). psa_unregister_read_under_mutex() encapsulates
1167 * psa_unregister_read() with mutex lock and unlock operations.
Gilles Peskine28f8f302019-07-24 13:30:31 +02001168 */
Ronald Cron5c522922020-11-14 16:35:34 +01001169static psa_status_t psa_get_and_lock_transparent_key_slot_with_policy(
1170 mbedtls_svc_key_id_t key,
1171 psa_key_slot_t **p_slot,
1172 psa_key_usage_t usage,
Gilles Peskine449bd832023-01-11 14:50:10 +01001173 psa_algorithm_t alg)
Gilles Peskine28f8f302019-07-24 13:30:31 +02001174{
Gilles Peskine449bd832023-01-11 14:50:10 +01001175 psa_status_t status = psa_get_and_lock_key_slot_with_policy(key, p_slot,
1176 usage, alg);
1177 if (status != PSA_SUCCESS) {
1178 return status;
Gilles Peskine28f8f302019-07-24 13:30:31 +02001179 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02001180
Gilles Peskine449bd832023-01-11 14:50:10 +01001181 if (psa_key_lifetime_is_external((*p_slot)->attr.lifetime)) {
Ryan Everettfb792ca2024-01-31 13:40:05 +00001182 psa_unregister_read_under_mutex(*p_slot);
Gilles Peskine449bd832023-01-11 14:50:10 +01001183 *p_slot = NULL;
1184 return PSA_ERROR_NOT_SUPPORTED;
1185 }
1186
1187 return PSA_SUCCESS;
Gilles Peskine28f8f302019-07-24 13:30:31 +02001188}
Gilles Peskine28f8f302019-07-24 13:30:31 +02001189
Gilles Peskine449bd832023-01-11 14:50:10 +01001190psa_status_t psa_remove_key_data_from_memory(psa_key_slot_t *slot)
Darryl Green40225ba2018-11-15 14:48:15 +00001191{
Valerio Setti8d4f1502024-06-14 07:49:05 +02001192#if defined(MBEDTLS_PSA_STATIC_KEY_SLOTS)
1193 slot->key.in_use = 0;
1194#else /* MBEDTLS_PSA_STATIC_KEY_SLOTS */
Gilles Peskine449bd832023-01-11 14:50:10 +01001195 if (slot->key.data != NULL) {
Tom Cosgrove52f7e182023-08-01 09:08:48 +01001196 mbedtls_zeroize_and_free(slot->key.data, slot->key.bytes);
Gilles Peskine449bd832023-01-11 14:50:10 +01001197 }
Ronald Cronea0f8a62020-11-25 17:52:23 +01001198
Ronald Cronea0f8a62020-11-25 17:52:23 +01001199 slot->key.data = NULL;
Valerio Setti8d4f1502024-06-14 07:49:05 +02001200#endif /* MBEDTLS_PSA_STATIC_KEY_SLOTS */
1201
Ronald Cronea0f8a62020-11-25 17:52:23 +01001202 slot->key.bytes = 0;
Darryl Green40225ba2018-11-15 14:48:15 +00001203
Gilles Peskine449bd832023-01-11 14:50:10 +01001204 return PSA_SUCCESS;
Darryl Green40225ba2018-11-15 14:48:15 +00001205}
1206
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001207/** Completely wipe a slot in memory, including its policy.
1208 * Persistent storage is not affected. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001209psa_status_t psa_wipe_key_slot(psa_key_slot_t *slot)
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001210{
Gilles Peskine449bd832023-01-11 14:50:10 +01001211 psa_status_t status = psa_remove_key_data_from_memory(slot);
Ronald Cronddd3d052020-10-30 14:07:07 +01001212
Gilles Peskine449bd832023-01-11 14:50:10 +01001213 /*
1214 * As the return error code may not be handled in case of multiple errors,
Ryan Everett7ed542e2024-01-17 11:39:09 +00001215 * do our best to report an unexpected amount of registered readers or
1216 * an unexpected state.
1217 * Assert with MBEDTLS_TEST_HOOK_TEST_ASSERT that the slot is valid for
1218 * wiping.
Gilles Peskine449bd832023-01-11 14:50:10 +01001219 * if the MBEDTLS_TEST_HOOKS configuration option is enabled and the
1220 * function is called as part of the execution of a test suite, the
1221 * execution of the test suite is stopped in error if the assertion fails.
1222 */
Ryan Everett7ed542e2024-01-17 11:39:09 +00001223 switch (slot->state) {
1224 case PSA_SLOT_FULL:
1225 /* In this state psa_wipe_key_slot() must only be called if the
1226 * caller is the last reader. */
1227 case PSA_SLOT_PENDING_DELETION:
1228 /* In this state psa_wipe_key_slot() must only be called if the
1229 * caller is the last reader. */
Gilles Peskine47ad2f72024-06-10 11:42:41 +02001230 if (slot->var.occupied.registered_readers != 1) {
1231 MBEDTLS_TEST_HOOK_TEST_ASSERT(slot->var.occupied.registered_readers == 1);
Ryan Everett7ed542e2024-01-17 11:39:09 +00001232 status = PSA_ERROR_CORRUPTION_DETECTED;
1233 }
1234 break;
1235 case PSA_SLOT_FILLING:
1236 /* In this state registered_readers must be 0. */
Gilles Peskine47ad2f72024-06-10 11:42:41 +02001237 if (slot->var.occupied.registered_readers != 0) {
1238 MBEDTLS_TEST_HOOK_TEST_ASSERT(slot->var.occupied.registered_readers == 0);
Ryan Everett7ed542e2024-01-17 11:39:09 +00001239 status = PSA_ERROR_CORRUPTION_DETECTED;
1240 }
1241 break;
1242 case PSA_SLOT_EMPTY:
1243 /* The slot is already empty, it cannot be wiped. */
1244 MBEDTLS_TEST_HOOK_TEST_ASSERT(slot->state != PSA_SLOT_EMPTY);
1245 status = PSA_ERROR_CORRUPTION_DETECTED;
1246 break;
1247 default:
1248 /* The slot's state is invalid. */
1249 status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cronddd3d052020-10-30 14:07:07 +01001250 }
1251
Gilles Peskinee8199f52024-06-10 11:53:33 +02001252#if defined(MBEDTLS_PSA_KEY_STORE_DYNAMIC)
1253 size_t slice_index = slot->slice_index;
1254#endif /* MBEDTLS_PSA_KEY_STORE_DYNAMIC */
1255
1256
Gilles Peskine3f7cd622019-08-13 15:01:08 +02001257 /* Multipart operations may still be using the key. This is safe
1258 * because all multipart operation objects are independent from
1259 * the key slot: if they need to access the key after the setup
1260 * phase, they have a copy of the key. Note that this means that
1261 * key material can linger until all operations are completed. */
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001262 /* At this point, key material and other type-specific content has
1263 * been wiped. Clear remaining metadata. We can call memset and not
Ryan Everettaa33c512023-12-21 17:32:07 +00001264 * zeroize because the metadata is not particularly sensitive.
1265 * This memset also sets the slot's state to PSA_SLOT_EMPTY. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001266 memset(slot, 0, sizeof(*slot));
Gilles Peskinee8199f52024-06-10 11:53:33 +02001267
1268#if defined(MBEDTLS_PSA_KEY_STORE_DYNAMIC)
1269 /* If the slot is already corrupted, something went deeply wrong,
1270 * like a thread still using the slot or a stray pointer leading
1271 * to the slot's memory being used for another object. Let the slot
1272 * leak rather than make the corruption worse. */
1273 if (status == PSA_SUCCESS) {
1274 status = psa_free_key_slot(slice_index, slot);
1275 }
1276#endif /* MBEDTLS_PSA_KEY_STORE_DYNAMIC */
1277
Gilles Peskine449bd832023-01-11 14:50:10 +01001278 return status;
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001279}
1280
Gilles Peskine449bd832023-01-11 14:50:10 +01001281psa_status_t psa_destroy_key(mbedtls_svc_key_id_t key)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001282{
Gilles Peskine2f060a82018-12-04 17:12:32 +01001283 psa_key_slot_t *slot;
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001284 psa_status_t status; /* status of the last operation */
1285 psa_status_t overall_status = PSA_SUCCESS;
Gilles Peskine354f7672019-07-12 23:46:38 +02001286#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1287 psa_se_drv_table_entry_t *driver;
1288#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001289
Gilles Peskine449bd832023-01-11 14:50:10 +01001290 if (mbedtls_svc_key_id_is_null(key)) {
1291 return PSA_SUCCESS;
1292 }
Gilles Peskine1841cf42019-10-08 15:48:25 +02001293
Ronald Cronf2911112020-10-29 17:51:10 +01001294 /*
Ryan Everett7ed542e2024-01-17 11:39:09 +00001295 * Get the description of the key in a key slot, and register to read it.
1296 * In the case of a persistent key, this will load the key description
1297 * from persistent memory if not done yet.
1298 * We cannot avoid this loading as without it we don't know if
Ronald Cronf2911112020-10-29 17:51:10 +01001299 * the key is operated by an SE or not and this information is needed by
Ryan Everett7ed542e2024-01-17 11:39:09 +00001300 * the current implementation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001301 status = psa_get_and_lock_key_slot(key, &slot);
1302 if (status != PSA_SUCCESS) {
1303 return status;
1304 }
Gilles Peskine354f7672019-07-12 23:46:38 +02001305
Ryan Everettc053d962024-01-25 17:56:32 +00001306#if defined(MBEDTLS_THREADING_C)
Ryan Everett763971f2024-01-29 17:13:36 +00001307 /* We cannot unlock between setting the state to PENDING_DELETION
1308 * and destroying the key in storage, as otherwise another thread
1309 * could load the key into a new slot and the key will not be
1310 * fully destroyed. */
Ryan Everettc053d962024-01-25 17:56:32 +00001311 PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_lock(
1312 &mbedtls_threading_key_slot_mutex));
Ryan Everettd868b742024-03-08 18:35:09 +00001313
1314 if (slot->state == PSA_SLOT_PENDING_DELETION) {
1315 /* Another thread has destroyed the key between us locking the slot
1316 * and us gaining the mutex. Unregister from the slot,
1317 * and report that the key does not exist. */
1318 status = psa_unregister_read(slot);
1319
1320 PSA_THREADING_CHK_RET(mbedtls_mutex_unlock(
1321 &mbedtls_threading_key_slot_mutex));
1322 return (status == PSA_SUCCESS) ? PSA_ERROR_INVALID_HANDLE : status;
1323 }
Ryan Everettc053d962024-01-25 17:56:32 +00001324#endif
Ryan Everett7ed542e2024-01-17 11:39:09 +00001325 /* Set the key slot containing the key description's state to
1326 * PENDING_DELETION. This stops new operations from registering
1327 * to read the slot. Current readers can safely continue to access
1328 * the key within the slot; the last registered reader will
1329 * automatically wipe the slot when they call psa_unregister_read().
1330 * If the key is persistent, we can now delete the copy of the key
1331 * from memory. If the key is opaque, we require the driver to
1332 * deal with the deletion. */
Ryan Everettd868b742024-03-08 18:35:09 +00001333 overall_status = psa_key_slot_state_transition(slot, PSA_SLOT_FULL,
1334 PSA_SLOT_PENDING_DELETION);
Ryan Everettc053d962024-01-25 17:56:32 +00001335
Ryan Everettd868b742024-03-08 18:35:09 +00001336 if (overall_status != PSA_SUCCESS) {
Ryan Everettc053d962024-01-25 17:56:32 +00001337 goto exit;
1338 }
Ronald Cronf2911112020-10-29 17:51:10 +01001339
Gilles Peskine449bd832023-01-11 14:50:10 +01001340 if (PSA_KEY_LIFETIME_IS_READ_ONLY(slot->attr.lifetime)) {
Gilles Peskine6687cd02021-04-21 22:32:05 +02001341 /* Refuse the destruction of a read-only key (which may or may not work
1342 * if we attempt it, depending on whether the key is merely read-only
1343 * by policy or actually physically read-only).
Gilles Peskinef9a046e2021-06-07 23:27:54 +02001344 * Just do the best we can, which is to wipe the copy in memory
1345 * (done in this function's cleanup code). */
1346 overall_status = PSA_ERROR_NOT_PERMITTED;
1347 goto exit;
Gilles Peskine6687cd02021-04-21 22:32:05 +02001348 }
1349
Gilles Peskine354f7672019-07-12 23:46:38 +02001350#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001351 driver = psa_get_se_driver_entry(slot->attr.lifetime);
1352 if (driver != NULL) {
Gilles Peskine60450a42019-07-25 11:32:45 +02001353 /* For a key in a secure element, we need to do three things:
1354 * remove the key file in internal storage, destroy the
1355 * key inside the secure element, and update the driver's
1356 * persistent data. Start a transaction that will encompass these
1357 * three actions. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001358 psa_crypto_prepare_transaction(PSA_CRYPTO_TRANSACTION_DESTROY_KEY);
Gilles Peskine8e338702019-07-30 20:06:31 +02001359 psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
Gilles Peskine449bd832023-01-11 14:50:10 +01001360 psa_crypto_transaction.key.slot = psa_key_slot_get_slot_number(slot);
Gilles Peskine8e338702019-07-30 20:06:31 +02001361 psa_crypto_transaction.key.id = slot->attr.id;
Gilles Peskine449bd832023-01-11 14:50:10 +01001362 status = psa_crypto_save_transaction();
1363 if (status != PSA_SUCCESS) {
1364 (void) psa_crypto_stop_transaction();
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001365 /* We should still try to destroy the key in the secure
1366 * element and the key metadata in storage. This is especially
1367 * important if the error is that the storage is full.
1368 * But how to do it exactly without risking an inconsistent
1369 * state after a reset?
1370 * https://github.com/ARMmbed/mbed-crypto/issues/215
1371 */
1372 overall_status = status;
1373 goto exit;
Gilles Peskinefc762652019-07-22 19:30:34 +02001374 }
1375
Gilles Peskine449bd832023-01-11 14:50:10 +01001376 status = psa_destroy_se_key(driver,
1377 psa_key_slot_get_slot_number(slot));
1378 if (overall_status == PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001379 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001380 }
Gilles Peskinefc762652019-07-22 19:30:34 +02001381 }
Gilles Peskine354f7672019-07-12 23:46:38 +02001382#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1383
Darryl Greend49a4992018-06-18 17:27:26 +01001384#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001385 if (!PSA_KEY_LIFETIME_IS_VOLATILE(slot->attr.lifetime)) {
Ryan Everett4a0ba802024-01-17 14:12:33 +00001386 /* Destroy the copy of the persistent key from storage.
Ryan Everett7ed542e2024-01-17 11:39:09 +00001387 * The slot will still hold a copy of the key until the last reader
1388 * unregisters. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001389 status = psa_destroy_persistent_key(slot->attr.id);
1390 if (overall_status == PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001391 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001392 }
Darryl Greend49a4992018-06-18 17:27:26 +01001393 }
1394#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
Gilles Peskine354f7672019-07-12 23:46:38 +02001395
Gilles Peskinefc762652019-07-22 19:30:34 +02001396#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001397 if (driver != NULL) {
1398 status = psa_save_se_persistent_data(driver);
1399 if (overall_status == PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001400 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001401 }
1402 status = psa_crypto_stop_transaction();
1403 if (overall_status == PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001404 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001405 }
Gilles Peskinefc762652019-07-22 19:30:34 +02001406 }
1407#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1408
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001409exit:
Ryan Everett7ed542e2024-01-17 11:39:09 +00001410 /* Unregister from reading the slot. If we are the last active reader
1411 * then this will wipe the slot. */
1412 status = psa_unregister_read(slot);
1413 /* Prioritize CORRUPTION_DETECTED from unregistering over
1414 * a storage error. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001415 if (status != PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001416 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001417 }
Ryan Everettc053d962024-01-25 17:56:32 +00001418
1419#if defined(MBEDTLS_THREADING_C)
Ryan Everett7fee4f72024-02-09 14:11:27 +00001420 /* Don't overwrite existing errors if the unlock fails. */
1421 status = overall_status;
Ryan Everettc053d962024-01-25 17:56:32 +00001422 PSA_THREADING_CHK_RET(mbedtls_mutex_unlock(
1423 &mbedtls_threading_key_slot_mutex));
1424#endif
1425
Gilles Peskine449bd832023-01-11 14:50:10 +01001426 return overall_status;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001427}
1428
Gilles Peskinebfd322f2019-07-23 11:58:03 +02001429/** Retrieve all the publicly-accessible attributes of a key.
1430 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001431psa_status_t psa_get_key_attributes(mbedtls_svc_key_id_t key,
1432 psa_key_attributes_t *attributes)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001433{
Ronald Cronf95a2b12020-10-22 15:24:49 +02001434 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01001435 psa_key_slot_t *slot;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001436
Gilles Peskine449bd832023-01-11 14:50:10 +01001437 psa_reset_key_attributes(attributes);
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001438
Gilles Peskine449bd832023-01-11 14:50:10 +01001439 status = psa_get_and_lock_key_slot_with_policy(key, &slot, 0, 0);
1440 if (status != PSA_SUCCESS) {
1441 return status;
1442 }
Gilles Peskineb870b182018-07-06 16:02:09 +02001443
Gilles Peskine7fad3ef2024-02-28 01:08:27 +01001444 *attributes = slot->attr;
Gilles Peskinec8000c02019-08-02 20:15:51 +02001445
1446#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001447 if (psa_get_se_driver_entry(slot->attr.lifetime) != NULL) {
1448 psa_set_key_slot_number(attributes,
1449 psa_key_slot_get_slot_number(slot));
1450 }
Gilles Peskinec8000c02019-08-02 20:15:51 +02001451#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskineb699f072019-04-26 16:06:02 +02001452
Gilles Peskine97c0b2f2024-02-16 00:49:46 +01001453 return psa_unregister_read_under_mutex(slot);
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001454}
1455
Gilles Peskinec8000c02019-08-02 20:15:51 +02001456#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1457psa_status_t psa_get_key_slot_number(
1458 const psa_key_attributes_t *attributes,
Gilles Peskine449bd832023-01-11 14:50:10 +01001459 psa_key_slot_number_t *slot_number)
Gilles Peskinec8000c02019-08-02 20:15:51 +02001460{
Gilles Peskine972539c2024-02-28 01:49:45 +01001461 if (attributes->has_slot_number) {
Gilles Peskinec8000c02019-08-02 20:15:51 +02001462 *slot_number = attributes->slot_number;
Gilles Peskine449bd832023-01-11 14:50:10 +01001463 return PSA_SUCCESS;
1464 } else {
1465 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinec8000c02019-08-02 20:15:51 +02001466 }
Gilles Peskinec8000c02019-08-02 20:15:51 +02001467}
1468#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1469
Gilles Peskine449bd832023-01-11 14:50:10 +01001470static psa_status_t psa_export_key_buffer_internal(const uint8_t *key_buffer,
1471 size_t key_buffer_size,
1472 uint8_t *data,
1473 size_t data_size,
1474 size_t *data_length)
Steven Cooremana01795d2020-07-24 22:48:15 +02001475{
Gilles Peskine449bd832023-01-11 14:50:10 +01001476 if (key_buffer_size > data_size) {
1477 return PSA_ERROR_BUFFER_TOO_SMALL;
1478 }
1479 memcpy(data, key_buffer, key_buffer_size);
1480 memset(data + key_buffer_size, 0,
1481 data_size - key_buffer_size);
Ronald Crond18b5f82020-11-25 16:46:05 +01001482 *data_length = key_buffer_size;
Gilles Peskine449bd832023-01-11 14:50:10 +01001483 return PSA_SUCCESS;
Steven Cooremana01795d2020-07-24 22:48:15 +02001484}
1485
Ronald Cron7285cda2020-11-26 14:46:37 +01001486psa_status_t psa_export_key_internal(
Ronald Crond18b5f82020-11-25 16:46:05 +01001487 const psa_key_attributes_t *attributes,
1488 const uint8_t *key_buffer, size_t key_buffer_size,
Gilles Peskine449bd832023-01-11 14:50:10 +01001489 uint8_t *data, size_t data_size, size_t *data_length)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001490{
Gilles Peskine2f107ae2024-02-28 01:26:46 +01001491 psa_key_type_t type = attributes->type;
Ronald Crond18b5f82020-11-25 16:46:05 +01001492
Gilles Peskine449bd832023-01-11 14:50:10 +01001493 if (key_type_is_raw_bytes(type) ||
1494 PSA_KEY_TYPE_IS_RSA(type) ||
Przemek Stekiel472b3f32022-12-01 14:38:49 +01001495 PSA_KEY_TYPE_IS_ECC(type) ||
1496 PSA_KEY_TYPE_IS_DH(type)) {
Gilles Peskine449bd832023-01-11 14:50:10 +01001497 return psa_export_key_buffer_internal(
1498 key_buffer, key_buffer_size,
1499 data, data_size, data_length);
1500 } else {
Ronald Cron9486f9d2020-11-26 13:36:23 +01001501 /* This shouldn't happen in the reference implementation, but
1502 it is valid for a special-purpose implementation to omit
1503 support for exporting certain key types. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001504 return PSA_ERROR_NOT_SUPPORTED;
Ronald Cron9486f9d2020-11-26 13:36:23 +01001505 }
1506}
1507
Gilles Peskine449bd832023-01-11 14:50:10 +01001508psa_status_t psa_export_key(mbedtls_svc_key_id_t key,
Ryan Everett45ac5262024-01-08 17:15:19 +00001509 uint8_t *data_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01001510 size_t data_size,
1511 size_t *data_length)
Ronald Cron9486f9d2020-11-26 13:36:23 +01001512{
1513 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
1514 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
1515 psa_key_slot_t *slot;
Ryan Everett45ac5262024-01-08 17:15:19 +00001516 LOCAL_OUTPUT_DECLARE(data_external, data);
Ronald Cron9486f9d2020-11-26 13:36:23 +01001517
Ronald Crone907e552021-01-18 13:22:38 +01001518 /* Reject a zero-length output buffer now, since this can never be a
1519 * valid key representation. This way we know that data must be a valid
1520 * pointer and we can do things like memset(data, ..., data_size). */
Gilles Peskine449bd832023-01-11 14:50:10 +01001521 if (data_size == 0) {
1522 return PSA_ERROR_BUFFER_TOO_SMALL;
1523 }
Ronald Crone907e552021-01-18 13:22:38 +01001524
Ronald Cron9486f9d2020-11-26 13:36:23 +01001525 /* Set the key to empty now, so that even when there are errors, we always
1526 * set data_length to a value between 0 and data_size. On error, setting
1527 * the key to empty is a good choice because an empty key representation is
1528 * unlikely to be accepted anywhere. */
Jaeden Amerof24c7f82018-06-27 17:20:43 +01001529 *data_length = 0;
1530
Ronald Cron9486f9d2020-11-26 13:36:23 +01001531 /* Export requires the EXPORT flag. There is an exception for public keys,
1532 * which don't require any flag, but
1533 * psa_get_and_lock_key_slot_with_policy() takes care of this.
1534 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001535 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
1536 PSA_KEY_USAGE_EXPORT, 0);
1537 if (status != PSA_SUCCESS) {
1538 return status;
1539 }
mohammad160306e79202018-03-28 13:17:44 +03001540
Ryan Everett45ac5262024-01-08 17:15:19 +00001541 LOCAL_OUTPUT_ALLOC(data_external, data_size, data);
1542
Gilles Peskine7a5d9202024-02-28 01:18:23 +01001543 status = psa_driver_wrapper_export_key(&slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01001544 slot->key.data, slot->key.bytes,
1545 data, data_size, data_length);
Ronald Cron9486f9d2020-11-26 13:36:23 +01001546
David Horstmann4a48bec2024-03-13 15:42:31 +00001547#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
Ryan Everett45ac5262024-01-08 17:15:19 +00001548exit:
Ryan Everett35f68532024-01-25 12:02:03 +00001549#endif
Ryan Everetta103ec92024-01-31 13:59:57 +00001550 unlock_status = psa_unregister_read_under_mutex(slot);
Ronald Cron9486f9d2020-11-26 13:36:23 +01001551
Ryan Everett45ac5262024-01-08 17:15:19 +00001552 LOCAL_OUTPUT_FREE(data_external, data);
Gilles Peskine449bd832023-01-11 14:50:10 +01001553 return (status == PSA_SUCCESS) ? unlock_status : status;
Ronald Cron9486f9d2020-11-26 13:36:23 +01001554}
1555
Ronald Cron7285cda2020-11-26 14:46:37 +01001556psa_status_t psa_export_public_key_internal(
Ronald Crond18b5f82020-11-25 16:46:05 +01001557 const psa_key_attributes_t *attributes,
1558 const uint8_t *key_buffer,
1559 size_t key_buffer_size,
1560 uint8_t *data,
1561 size_t data_size,
Gilles Peskine449bd832023-01-11 14:50:10 +01001562 size_t *data_length)
Ronald Cron9486f9d2020-11-26 13:36:23 +01001563{
Gilles Peskine2f107ae2024-02-28 01:26:46 +01001564 psa_key_type_t type = attributes->type;
Ronald Crond18b5f82020-11-25 16:46:05 +01001565
Przemek Stekiel6fd72b62023-04-27 10:20:56 +02001566 if (PSA_KEY_TYPE_IS_PUBLIC_KEY(type) &&
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001567 (PSA_KEY_TYPE_IS_RSA(type) || PSA_KEY_TYPE_IS_ECC(type) ||
1568 PSA_KEY_TYPE_IS_DH(type))) {
Przemek Stekiel6fd72b62023-04-27 10:20:56 +02001569 /* Exporting public -> public */
1570 return psa_export_key_buffer_internal(
1571 key_buffer, key_buffer_size,
1572 data, data_size, data_length);
1573 } else if (PSA_KEY_TYPE_IS_RSA(type)) {
Valerio Settib2bcedb2023-07-10 11:24:00 +02001574#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT) || \
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001575 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
1576 return mbedtls_psa_rsa_export_public_key(attributes,
1577 key_buffer,
1578 key_buffer_size,
1579 data,
1580 data_size,
1581 data_length);
Darryl Green9e2d7a02018-07-24 16:33:30 +01001582#else
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001583 /* We don't know how to convert a private RSA key to public. */
1584 return PSA_ERROR_NOT_SUPPORTED;
Valerio Settib2bcedb2023-07-10 11:24:00 +02001585#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT) ||
John Durkop9814fa22020-11-04 12:28:15 -08001586 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Przemek Stekiel6fd72b62023-04-27 10:20:56 +02001587 } else if (PSA_KEY_TYPE_IS_ECC(type)) {
Valerio Setti27c501a2023-06-27 16:58:52 +02001588#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT) || \
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001589 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
1590 return mbedtls_psa_ecp_export_public_key(attributes,
1591 key_buffer,
1592 key_buffer_size,
1593 data,
1594 data_size,
1595 data_length);
Steven Cooreman560c28a2020-07-24 23:20:24 +02001596#else
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001597 /* We don't know how to convert a private ECC key to public */
1598 return PSA_ERROR_NOT_SUPPORTED;
Valerio Setti27c501a2023-06-27 16:58:52 +02001599#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT) ||
John Durkop9814fa22020-11-04 12:28:15 -08001600 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
Przemek Stekiel6fd72b62023-04-27 10:20:56 +02001601 } else if (PSA_KEY_TYPE_IS_DH(type)) {
Valerio Settia55f0422023-07-10 15:34:41 +02001602#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT) || \
Przemek Stekiel6d85afa2023-04-28 11:42:17 +02001603 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY)
Przemek Stekiel152bb462023-06-01 11:52:39 +02001604 return mbedtls_psa_ffdh_export_public_key(attributes,
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001605 key_buffer,
1606 key_buffer_size,
1607 data, data_size,
1608 data_length);
Przemek Stekiel472b3f32022-12-01 14:38:49 +01001609#else
Przemek Stekiel472b3f32022-12-01 14:38:49 +01001610 return PSA_ERROR_NOT_SUPPORTED;
Valerio Settia55f0422023-07-10 15:34:41 +02001611#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT) ||
Przemek Stekiel6d85afa2023-04-28 11:42:17 +02001612 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) */
Gilles Peskine449bd832023-01-11 14:50:10 +01001613 } else {
Przemek Stekiel0b11ee02023-05-16 13:26:06 +02001614 (void) key_buffer;
1615 (void) key_buffer_size;
1616 (void) data;
1617 (void) data_size;
1618 (void) data_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01001619 return PSA_ERROR_NOT_SUPPORTED;
Steven Cooreman560c28a2020-07-24 23:20:24 +02001620 }
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001621}
Ronald Crond18b5f82020-11-25 16:46:05 +01001622
Gilles Peskine449bd832023-01-11 14:50:10 +01001623psa_status_t psa_export_public_key(mbedtls_svc_key_id_t key,
Ryan Everettb1d2c672024-01-08 17:19:30 +00001624 uint8_t *data_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01001625 size_t data_size,
1626 size_t *data_length)
Moran Pekerdd4ea382018-04-03 15:30:03 +03001627{
Ronald Cronf95a2b12020-10-22 15:24:49 +02001628 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01001629 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01001630 psa_key_slot_t *slot;
Darryl Greendd8fb772018-11-07 16:00:44 +00001631
Ryan Everettb1d2c672024-01-08 17:19:30 +00001632 LOCAL_OUTPUT_DECLARE(data_external, data);
Darryl Greendd8fb772018-11-07 16:00:44 +00001633
Ronald Crone907e552021-01-18 13:22:38 +01001634 /* Reject a zero-length output buffer now, since this can never be a
1635 * valid key representation. This way we know that data must be a valid
1636 * pointer and we can do things like memset(data, ..., data_size). */
Gilles Peskine449bd832023-01-11 14:50:10 +01001637 if (data_size == 0) {
1638 return PSA_ERROR_BUFFER_TOO_SMALL;
1639 }
Ronald Crone907e552021-01-18 13:22:38 +01001640
Darryl Greendd8fb772018-11-07 16:00:44 +00001641 /* Set the key to empty now, so that even when there are errors, we always
1642 * set data_length to a value between 0 and data_size. On error, setting
1643 * the key to empty is a good choice because an empty key representation is
1644 * unlikely to be accepted anywhere. */
1645 *data_length = 0;
1646
1647 /* Exporting a public key doesn't require a usage flag. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001648 status = psa_get_and_lock_key_slot_with_policy(key, &slot, 0, 0);
1649 if (status != PSA_SUCCESS) {
1650 return status;
1651 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02001652
Ryan Everettb1d2c672024-01-08 17:19:30 +00001653 LOCAL_OUTPUT_ALLOC(data_external, data_size, data);
1654
Gilles Peskine449bd832023-01-11 14:50:10 +01001655 if (!PSA_KEY_TYPE_IS_ASYMMETRIC(slot->attr.type)) {
1656 status = PSA_ERROR_INVALID_ARGUMENT;
1657 goto exit;
Ronald Cron9486f9d2020-11-26 13:36:23 +01001658 }
1659
Ronald Cron67227982020-11-26 15:16:05 +01001660 status = psa_driver_wrapper_export_public_key(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01001661 &slot->attr, slot->key.data, slot->key.bytes,
Gilles Peskine449bd832023-01-11 14:50:10 +01001662 data, data_size, data_length);
Ronald Cron9486f9d2020-11-26 13:36:23 +01001663
1664exit:
Ryan Everetta103ec92024-01-31 13:59:57 +00001665 unlock_status = psa_unregister_read_under_mutex(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02001666
Ryan Everettb1d2c672024-01-08 17:19:30 +00001667 LOCAL_OUTPUT_FREE(data_external, data);
Gilles Peskine449bd832023-01-11 14:50:10 +01001668 return (status == PSA_SUCCESS) ? unlock_status : status;
Moran Pekerdd4ea382018-04-03 15:30:03 +03001669}
1670
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001671/** Validate that a key policy is internally well-formed.
1672 *
1673 * This function only rejects invalid policies. It does not validate the
1674 * consistency of the policy with respect to other attributes of the key
1675 * such as the key type.
1676 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001677static psa_status_t psa_validate_key_policy(const psa_key_policy_t *policy)
Gilles Peskine4747d192019-04-17 15:05:45 +02001678{
Gilles Peskine449bd832023-01-11 14:50:10 +01001679 if ((policy->usage & ~(PSA_KEY_USAGE_EXPORT |
1680 PSA_KEY_USAGE_COPY |
1681 PSA_KEY_USAGE_ENCRYPT |
1682 PSA_KEY_USAGE_DECRYPT |
1683 PSA_KEY_USAGE_SIGN_MESSAGE |
1684 PSA_KEY_USAGE_VERIFY_MESSAGE |
1685 PSA_KEY_USAGE_SIGN_HASH |
1686 PSA_KEY_USAGE_VERIFY_HASH |
1687 PSA_KEY_USAGE_VERIFY_DERIVATION |
1688 PSA_KEY_USAGE_DERIVE)) != 0) {
1689 return PSA_ERROR_INVALID_ARGUMENT;
1690 }
Gilles Peskine4747d192019-04-17 15:05:45 +02001691
Gilles Peskine449bd832023-01-11 14:50:10 +01001692 return PSA_SUCCESS;
Gilles Peskine4747d192019-04-17 15:05:45 +02001693}
1694
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001695/** Validate the internal consistency of key attributes.
1696 *
1697 * This function only rejects invalid attribute values. If does not
1698 * validate the consistency of the attributes with any key data that may
1699 * be involved in the creation of the key.
1700 *
1701 * Call this function early in the key creation process.
1702 *
1703 * \param[in] attributes Key attributes for the new key.
1704 * \param[out] p_drv On any return, the driver for the key, if any.
1705 * NULL for a transparent key.
1706 *
1707 */
1708static psa_status_t psa_validate_key_attributes(
1709 const psa_key_attributes_t *attributes,
Gilles Peskine449bd832023-01-11 14:50:10 +01001710 psa_se_drv_table_entry_t **p_drv)
Darryl Green0c6575a2018-11-07 16:05:30 +00001711{
Steven Cooreman81fe7c32020-06-08 18:37:19 +02001712 psa_status_t status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine449bd832023-01-11 14:50:10 +01001713 psa_key_lifetime_t lifetime = psa_get_key_lifetime(attributes);
1714 mbedtls_svc_key_id_t key = psa_get_key_id(attributes);
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001715
Gilles Peskine449bd832023-01-11 14:50:10 +01001716 status = psa_validate_key_location(lifetime, p_drv);
1717 if (status != PSA_SUCCESS) {
1718 return status;
Ronald Crond2ed4812020-07-17 16:11:30 +02001719 }
1720
Gilles Peskine449bd832023-01-11 14:50:10 +01001721 status = psa_validate_key_persistence(lifetime);
1722 if (status != PSA_SUCCESS) {
1723 return status;
1724 }
1725
1726 if (PSA_KEY_LIFETIME_IS_VOLATILE(lifetime)) {
1727 if (MBEDTLS_SVC_KEY_ID_GET_KEY_ID(key) != 0) {
1728 return PSA_ERROR_INVALID_ARGUMENT;
1729 }
1730 } else {
1731 if (!psa_is_valid_key_id(psa_get_key_id(attributes), 0)) {
1732 return PSA_ERROR_INVALID_ARGUMENT;
1733 }
1734 }
1735
Gilles Peskine2f107ae2024-02-28 01:26:46 +01001736 status = psa_validate_key_policy(&attributes->policy);
Gilles Peskine449bd832023-01-11 14:50:10 +01001737 if (status != PSA_SUCCESS) {
1738 return status;
1739 }
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001740
1741 /* Refuse to create overly large keys.
1742 * Note that this doesn't trigger on import if the attributes don't
1743 * explicitly specify a size (so psa_get_key_bits returns 0), so
1744 * psa_import_key() needs its own checks. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001745 if (psa_get_key_bits(attributes) > PSA_MAX_KEY_BITS) {
1746 return PSA_ERROR_NOT_SUPPORTED;
1747 }
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001748
Gilles Peskine449bd832023-01-11 14:50:10 +01001749 return PSA_SUCCESS;
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001750}
1751
Gilles Peskine4747d192019-04-17 15:05:45 +02001752/** Prepare a key slot to receive key material.
1753 *
1754 * This function allocates a key slot and sets its metadata.
1755 *
1756 * If this function fails, call psa_fail_key_creation().
1757 *
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001758 * This function is intended to be used as follows:
1759 * -# Call psa_start_key_creation() to allocate a key slot, prepare
Ronald Croncf56a0a2020-08-04 09:51:30 +02001760 * it with the specified attributes, and in case of a volatile key assign it
1761 * a volatile key identifier.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001762 * -# Populate the slot with the key material.
1763 * -# Call psa_finish_key_creation() to finalize the creation of the slot.
1764 * In case of failure at any step, stop the sequence and call
1765 * psa_fail_key_creation().
1766 *
Ryan Everettb69118e2024-01-02 15:54:32 +00001767 * On success, the key slot's state is PSA_SLOT_FILLING.
1768 * It is the responsibility of the caller to change the slot's state to
1769 * PSA_SLOT_EMPTY/FULL once key creation has finished.
Ronald Cronf95a2b12020-10-22 15:24:49 +02001770 *
Gilles Peskinedf179142019-07-15 22:02:14 +02001771 * \param method An identification of the calling function.
Gilles Peskine011e4282019-06-26 18:34:38 +02001772 * \param[in] attributes Key attributes for the new key.
Gilles Peskine011e4282019-06-26 18:34:38 +02001773 * \param[out] p_slot On success, a pointer to the prepared slot.
1774 * \param[out] p_drv On any return, the driver for the key, if any.
1775 * NULL for a transparent key.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001776 *
1777 * \retval #PSA_SUCCESS
1778 * The key slot is ready to receive key material.
1779 * \return If this function fails, the key slot is an invalid state.
1780 * You must call psa_fail_key_creation() to wipe and free the slot.
Gilles Peskine4747d192019-04-17 15:05:45 +02001781 */
1782static psa_status_t psa_start_key_creation(
Gilles Peskinedf179142019-07-15 22:02:14 +02001783 psa_key_creation_method_t method,
Gilles Peskine4747d192019-04-17 15:05:45 +02001784 const psa_key_attributes_t *attributes,
Gilles Peskine011e4282019-06-26 18:34:38 +02001785 psa_key_slot_t **p_slot,
Gilles Peskine449bd832023-01-11 14:50:10 +01001786 psa_se_drv_table_entry_t **p_drv)
Gilles Peskine4747d192019-04-17 15:05:45 +02001787{
1788 psa_status_t status;
Gilles Peskine4747d192019-04-17 15:05:45 +02001789
Gilles Peskinedf179142019-07-15 22:02:14 +02001790 (void) method;
Gilles Peskine011e4282019-06-26 18:34:38 +02001791 *p_drv = NULL;
1792
Gilles Peskine449bd832023-01-11 14:50:10 +01001793 status = psa_validate_key_attributes(attributes, p_drv);
1794 if (status != PSA_SUCCESS) {
1795 return status;
1796 }
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001797
Gilles Peskinee8199f52024-06-10 11:53:33 +02001798 int key_is_volatile = PSA_KEY_LIFETIME_IS_VOLATILE(attributes->lifetime);
1799 psa_key_id_t volatile_key_id;
1800
Ryan Everett3d8118d2024-01-30 16:58:47 +00001801#if defined(MBEDTLS_THREADING_C)
1802 PSA_THREADING_CHK_RET(mbedtls_mutex_lock(
1803 &mbedtls_threading_key_slot_mutex));
1804#endif
Gilles Peskinee8199f52024-06-10 11:53:33 +02001805 status = psa_reserve_free_key_slot(
1806 key_is_volatile ? &volatile_key_id : NULL,
1807 p_slot);
Ryan Everett3d8118d2024-01-30 16:58:47 +00001808#if defined(MBEDTLS_THREADING_C)
1809 PSA_THREADING_CHK_RET(mbedtls_mutex_unlock(
1810 &mbedtls_threading_key_slot_mutex));
1811#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01001812 if (status != PSA_SUCCESS) {
1813 return status;
1814 }
Gilles Peskinee8199f52024-06-10 11:53:33 +02001815 psa_key_slot_t *slot = *p_slot;
Gilles Peskine4747d192019-04-17 15:05:45 +02001816
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001817 /* We're storing the declared bit-size of the key. It's up to each
1818 * creation mechanism to verify that this information is correct.
1819 * It's automatically correct for mechanisms that use the bit-size as
Gilles Peskineb46bef22019-07-30 21:32:04 +02001820 * an input (generate, device) but not for those where the bit-size
Ronald Cronc4d1b512020-07-31 11:26:37 +02001821 * is optional (import, copy). In case of a volatile key, assign it the
1822 * volatile key identifier associated to the slot returned to contain its
1823 * definition. */
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001824
Gilles Peskine7fad3ef2024-02-28 01:08:27 +01001825 slot->attr = *attributes;
Gilles Peskinee8199f52024-06-10 11:53:33 +02001826 if (key_is_volatile) {
Ronald Cronc4d1b512020-07-31 11:26:37 +02001827#if !defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER)
1828 slot->attr.id = volatile_key_id;
1829#else
1830 slot->attr.id.key_id = volatile_key_id;
1831#endif
1832 }
Gilles Peskinec744d992019-07-30 17:26:54 +02001833
Gilles Peskinecbaff462019-07-12 23:46:04 +02001834#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined7729582019-08-05 15:55:54 +02001835 /* For a key in a secure element, we need to do three things
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001836 * when creating or registering a persistent key:
Gilles Peskine60450a42019-07-25 11:32:45 +02001837 * create the key file in internal storage, create the
1838 * key inside the secure element, and update the driver's
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001839 * persistent data. This is done by starting a transaction that will
1840 * encompass these three actions.
1841 * For registering a volatile key, we just need to find an appropriate
1842 * slot number inside the SE. Since the key is designated volatile, creating
1843 * a transaction is not required. */
Gilles Peskine60450a42019-07-25 11:32:45 +02001844 /* The first thing to do is to find a slot number for the new key.
1845 * We save the slot number in persistent storage as part of the
1846 * transaction data. It will be needed to recover if the power
1847 * fails during the key creation process, to clean up on the secure
1848 * element side after restarting. Obtaining a slot number from the
1849 * secure element driver updates its persistent state, but we do not yet
1850 * save the driver's persistent state, so that if the power fails,
Gilles Peskinefc762652019-07-22 19:30:34 +02001851 * we can roll back to a state where the key doesn't exist. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001852 if (*p_drv != NULL) {
Ronald Cronea0f8a62020-11-25 17:52:23 +01001853 psa_key_slot_number_t slot_number;
Gilles Peskine449bd832023-01-11 14:50:10 +01001854 status = psa_find_se_slot_for_key(attributes, method, *p_drv,
1855 &slot_number);
1856 if (status != PSA_SUCCESS) {
1857 return status;
1858 }
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001859
Gilles Peskine2f107ae2024-02-28 01:26:46 +01001860 if (!PSA_KEY_LIFETIME_IS_VOLATILE(attributes->lifetime)) {
Gilles Peskine449bd832023-01-11 14:50:10 +01001861 psa_crypto_prepare_transaction(PSA_CRYPTO_TRANSACTION_CREATE_KEY);
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001862 psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
Ronald Cronea0f8a62020-11-25 17:52:23 +01001863 psa_crypto_transaction.key.slot = slot_number;
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001864 psa_crypto_transaction.key.id = slot->attr.id;
Gilles Peskine449bd832023-01-11 14:50:10 +01001865 status = psa_crypto_save_transaction();
1866 if (status != PSA_SUCCESS) {
1867 (void) psa_crypto_stop_transaction();
1868 return status;
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001869 }
Gilles Peskine66be51c2019-07-25 18:02:52 +02001870 }
Ronald Cronea0f8a62020-11-25 17:52:23 +01001871
1872 status = psa_copy_key_material_into_slot(
Gilles Peskine449bd832023-01-11 14:50:10 +01001873 slot, (uint8_t *) (&slot_number), sizeof(slot_number));
Ryan Everettb5a20d32023-11-15 16:26:01 +00001874 if (status != PSA_SUCCESS) {
1875 return status;
1876 }
Darryl Green0c6575a2018-11-07 16:05:30 +00001877 }
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001878
Gilles Peskine449bd832023-01-11 14:50:10 +01001879 if (*p_drv == NULL && method == PSA_KEY_CREATION_REGISTER) {
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001880 /* Key registration only makes sense with a secure element. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001881 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001882 }
Gilles Peskinecbaff462019-07-12 23:46:04 +02001883#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1884
Gilles Peskine449bd832023-01-11 14:50:10 +01001885 return PSA_SUCCESS;
Darryl Green0c6575a2018-11-07 16:05:30 +00001886}
Gilles Peskine4747d192019-04-17 15:05:45 +02001887
1888/** Finalize the creation of a key once its key material has been set.
1889 *
1890 * This entails writing the key to persistent storage.
1891 *
1892 * If this function fails, call psa_fail_key_creation().
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001893 * See the documentation of psa_start_key_creation() for the intended use
1894 * of this function.
Gilles Peskine4747d192019-04-17 15:05:45 +02001895 *
Ryan Everettb69118e2024-01-02 15:54:32 +00001896 * If the finalization succeeds, the function sets the key slot's state to
1897 * PSA_SLOT_FULL, and the key slot can no longer be accessed as part of the
1898 * key creation process.
Ronald Cron50972942020-11-14 11:28:25 +01001899 *
Gilles Peskine011e4282019-06-26 18:34:38 +02001900 * \param[in,out] slot Pointer to the slot with key material.
1901 * \param[in] driver The secure element driver for the key,
1902 * or NULL for a transparent key.
Ronald Cron81709fc2020-11-14 12:10:32 +01001903 * \param[out] key On success, identifier of the key. Note that the
1904 * key identifier is also stored in the key slot.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001905 *
1906 * \retval #PSA_SUCCESS
Ronald Croncf56a0a2020-08-04 09:51:30 +02001907 * The key was successfully created.
Gilles Peskineed733552023-02-14 19:21:09 +01001908 * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription
1909 * \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription
1910 * \retval #PSA_ERROR_ALREADY_EXISTS \emptydescription
1911 * \retval #PSA_ERROR_DATA_INVALID \emptydescription
1912 * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription
1913 * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription
gabor-mezei-arm452b0a32020-11-09 17:42:55 +01001914 *
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001915 * \return If this function fails, the key slot is an invalid state.
1916 * You must call psa_fail_key_creation() to wipe and free the slot.
Gilles Peskine4747d192019-04-17 15:05:45 +02001917 */
Gilles Peskine011e4282019-06-26 18:34:38 +02001918static psa_status_t psa_finish_key_creation(
1919 psa_key_slot_t *slot,
Ronald Cron81709fc2020-11-14 12:10:32 +01001920 psa_se_drv_table_entry_t *driver,
1921 mbedtls_svc_key_id_t *key)
Gilles Peskine4747d192019-04-17 15:05:45 +02001922{
1923 psa_status_t status = PSA_SUCCESS;
Gilles Peskine30afafd2019-04-25 13:47:40 +02001924 (void) slot;
Gilles Peskine011e4282019-06-26 18:34:38 +02001925 (void) driver;
Gilles Peskine4747d192019-04-17 15:05:45 +02001926
Ryan Everett91ffe5b2024-01-23 20:05:42 +00001927#if defined(MBEDTLS_THREADING_C)
1928 PSA_THREADING_CHK_RET(mbedtls_mutex_lock(
1929 &mbedtls_threading_key_slot_mutex));
1930#endif
1931
Gilles Peskine4747d192019-04-17 15:05:45 +02001932#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001933 if (!PSA_KEY_LIFETIME_IS_VOLATILE(slot->attr.lifetime)) {
Gilles Peskine1df83d42019-07-23 16:13:14 +02001934#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001935 if (driver != NULL) {
Gilles Peskineb46bef22019-07-30 21:32:04 +02001936 psa_se_key_data_storage_t data;
Ronald Cronea0f8a62020-11-25 17:52:23 +01001937 psa_key_slot_number_t slot_number =
Gilles Peskine449bd832023-01-11 14:50:10 +01001938 psa_key_slot_get_slot_number(slot);
Ronald Cronea0f8a62020-11-25 17:52:23 +01001939
Tom Cosgrove6ef9bb32023-03-08 14:19:51 +00001940 MBEDTLS_STATIC_ASSERT(sizeof(slot_number) ==
1941 sizeof(data.slot_number),
1942 "Slot number size does not match psa_se_key_data_storage_t");
1943
Gilles Peskine449bd832023-01-11 14:50:10 +01001944 memcpy(&data.slot_number, &slot_number, sizeof(slot_number));
1945 status = psa_save_persistent_key(&slot->attr,
1946 (uint8_t *) &data,
1947 sizeof(data));
1948 } else
Gilles Peskine1df83d42019-07-23 16:13:14 +02001949#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1950 {
Steven Cooreman40120f62020-10-29 11:42:22 +01001951 /* Key material is saved in export representation in the slot, so
1952 * just pass the slot buffer for storage. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001953 status = psa_save_persistent_key(&slot->attr,
1954 slot->key.data,
1955 slot->key.bytes);
Gilles Peskine1df83d42019-07-23 16:13:14 +02001956 }
Gilles Peskine4747d192019-04-17 15:05:45 +02001957 }
Darryl Green0c6575a2018-11-07 16:05:30 +00001958#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
1959
Gilles Peskinecbaff462019-07-12 23:46:04 +02001960#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined7729582019-08-05 15:55:54 +02001961 /* Finish the transaction for a key creation. This does not
1962 * happen when registering an existing key. Detect this case
1963 * by checking whether a transaction is in progress (actual
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001964 * creation of a persistent key in a secure element requires a transaction,
1965 * but registration or volatile key creation doesn't use one). */
Gilles Peskine449bd832023-01-11 14:50:10 +01001966 if (driver != NULL &&
1967 psa_crypto_transaction.unknown.type == PSA_CRYPTO_TRANSACTION_CREATE_KEY) {
1968 status = psa_save_se_persistent_data(driver);
1969 if (status != PSA_SUCCESS) {
1970 psa_destroy_persistent_key(slot->attr.id);
Ryan Everett91ffe5b2024-01-23 20:05:42 +00001971
1972#if defined(MBEDTLS_THREADING_C)
1973 PSA_THREADING_CHK_RET(mbedtls_mutex_unlock(
1974 &mbedtls_threading_key_slot_mutex));
1975#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01001976 return status;
Gilles Peskinecbaff462019-07-12 23:46:04 +02001977 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001978 status = psa_crypto_stop_transaction();
Gilles Peskinecbaff462019-07-12 23:46:04 +02001979 }
1980#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1981
Gilles Peskine449bd832023-01-11 14:50:10 +01001982 if (status == PSA_SUCCESS) {
Ronald Cron81709fc2020-11-14 12:10:32 +01001983 *key = slot->attr.id;
Ryan Everettb69118e2024-01-02 15:54:32 +00001984 status = psa_key_slot_state_transition(slot, PSA_SLOT_FILLING,
1985 PSA_SLOT_FULL);
Gilles Peskine449bd832023-01-11 14:50:10 +01001986 if (status != PSA_SUCCESS) {
Ronald Cron81709fc2020-11-14 12:10:32 +01001987 *key = MBEDTLS_SVC_KEY_ID_INIT;
Gilles Peskine449bd832023-01-11 14:50:10 +01001988 }
Ronald Cron81709fc2020-11-14 12:10:32 +01001989 }
Ronald Cron50972942020-11-14 11:28:25 +01001990
Ryan Everett91ffe5b2024-01-23 20:05:42 +00001991#if defined(MBEDTLS_THREADING_C)
1992 PSA_THREADING_CHK_RET(mbedtls_mutex_unlock(
1993 &mbedtls_threading_key_slot_mutex));
1994#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01001995 return status;
Gilles Peskine4747d192019-04-17 15:05:45 +02001996}
1997
1998/** Abort the creation of a key.
1999 *
2000 * You may call this function after calling psa_start_key_creation(),
2001 * or after psa_finish_key_creation() fails. In other circumstances, this
2002 * function may not clean up persistent storage.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02002003 * See the documentation of psa_start_key_creation() for the intended use
Ryan Everettb69118e2024-01-02 15:54:32 +00002004 * of this function. Sets the slot's state to PSA_SLOT_EMPTY.
Gilles Peskine4747d192019-04-17 15:05:45 +02002005 *
Gilles Peskine011e4282019-06-26 18:34:38 +02002006 * \param[in,out] slot Pointer to the slot with key material.
2007 * \param[in] driver The secure element driver for the key,
2008 * or NULL for a transparent key.
Gilles Peskine4747d192019-04-17 15:05:45 +02002009 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002010static void psa_fail_key_creation(psa_key_slot_t *slot,
2011 psa_se_drv_table_entry_t *driver)
Gilles Peskine4747d192019-04-17 15:05:45 +02002012{
Gilles Peskine011e4282019-06-26 18:34:38 +02002013 (void) driver;
2014
Gilles Peskine449bd832023-01-11 14:50:10 +01002015 if (slot == NULL) {
Gilles Peskine4747d192019-04-17 15:05:45 +02002016 return;
Gilles Peskine449bd832023-01-11 14:50:10 +01002017 }
Gilles Peskine011e4282019-06-26 18:34:38 +02002018
Ryan Everettb7101442024-01-23 20:09:49 +00002019#if defined(MBEDTLS_THREADING_C)
Ryan Everett73feaf22024-02-14 11:36:41 +00002020 /* If the lock operation fails we still wipe the slot.
2021 * Operations will no longer work after a failed lock,
2022 * but we still need to wipe the slot of confidential data. */
Ryan Everettb7101442024-01-23 20:09:49 +00002023 mbedtls_mutex_lock(&mbedtls_threading_key_slot_mutex);
2024#endif
2025
Gilles Peskine011e4282019-06-26 18:34:38 +02002026#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Janos Follath1d57a202019-08-13 12:15:34 +01002027 /* TODO: If the key has already been created in the secure
Gilles Peskine011e4282019-06-26 18:34:38 +02002028 * element, and the failure happened later (when saving metadata
2029 * to internal storage), we need to destroy the key in the secure
Gilles Peskinec9d7f942019-08-13 16:17:16 +02002030 * element.
2031 * https://github.com/ARMmbed/mbed-crypto/issues/217
2032 */
Gilles Peskinefc762652019-07-22 19:30:34 +02002033
Gilles Peskined7729582019-08-05 15:55:54 +02002034 /* Abort the ongoing transaction if any (there may not be one if
2035 * the creation process failed before starting one, or if the
2036 * key creation is a registration of a key in a secure element).
2037 * Earlier functions must already have done what it takes to undo any
2038 * partial creation. All that's left is to update the transaction data
2039 * itself. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002040 (void) psa_crypto_stop_transaction();
Gilles Peskine011e4282019-06-26 18:34:38 +02002041#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
2042
Gilles Peskine449bd832023-01-11 14:50:10 +01002043 psa_wipe_key_slot(slot);
Ryan Everettb7101442024-01-23 20:09:49 +00002044
2045#if defined(MBEDTLS_THREADING_C)
2046 mbedtls_mutex_unlock(&mbedtls_threading_key_slot_mutex);
2047#endif
Gilles Peskine4747d192019-04-17 15:05:45 +02002048}
2049
Gilles Peskine1b8594a2019-07-31 17:21:46 +02002050/** Validate optional attributes during key creation.
2051 *
2052 * Some key attributes are optional during key creation. If they are
2053 * specified in the attributes structure, check that they are consistent
2054 * with the data in the slot.
2055 *
2056 * This function should be called near the end of key creation, after
2057 * the slot in memory is fully populated but before saving persistent data.
2058 */
2059static psa_status_t psa_validate_optional_attributes(
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002060 const psa_key_slot_t *slot,
Gilles Peskine449bd832023-01-11 14:50:10 +01002061 const psa_key_attributes_t *attributes)
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002062{
Gilles Peskine2f107ae2024-02-28 01:26:46 +01002063 if (attributes->type != 0) {
2064 if (attributes->type != slot->attr.type) {
Gilles Peskine449bd832023-01-11 14:50:10 +01002065 return PSA_ERROR_INVALID_ARGUMENT;
2066 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002067 }
2068
Gilles Peskine2f107ae2024-02-28 01:26:46 +01002069 if (attributes->bits != 0) {
2070 if (attributes->bits != slot->attr.bits) {
Gilles Peskine449bd832023-01-11 14:50:10 +01002071 return PSA_ERROR_INVALID_ARGUMENT;
2072 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002073 }
2074
Gilles Peskine449bd832023-01-11 14:50:10 +01002075 return PSA_SUCCESS;
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002076}
2077
Gilles Peskine449bd832023-01-11 14:50:10 +01002078psa_status_t psa_import_key(const psa_key_attributes_t *attributes,
Ryan Everettf028fe12024-01-08 17:14:44 +00002079 const uint8_t *data_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01002080 size_t data_length,
2081 mbedtls_svc_key_id_t *key)
Gilles Peskine4747d192019-04-17 15:05:45 +02002082{
2083 psa_status_t status;
Ryan Everettf028fe12024-01-08 17:14:44 +00002084 LOCAL_INPUT_DECLARE(data_external, data);
Gilles Peskine4747d192019-04-17 15:05:45 +02002085 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02002086 psa_se_drv_table_entry_t *driver = NULL;
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01002087 size_t bits;
Archanad8a83dc2021-06-14 10:04:16 +05302088 size_t storage_size = data_length;
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002089
Ronald Cron81709fc2020-11-14 12:10:32 +01002090 *key = MBEDTLS_SVC_KEY_ID_INIT;
2091
Gilles Peskine0f84d622019-09-12 19:03:13 +02002092 /* Reject zero-length symmetric keys (including raw data key objects).
2093 * This also rejects any key which might be encoded as an empty string,
2094 * which is never valid. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002095 if (data_length == 0) {
2096 return PSA_ERROR_INVALID_ARGUMENT;
2097 }
Gilles Peskine0f84d622019-09-12 19:03:13 +02002098
Archana449608b2021-09-08 15:36:05 +05302099 /* Ensure that the bytes-to-bits conversion cannot overflow. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002100 if (data_length > SIZE_MAX / 8) {
2101 return PSA_ERROR_NOT_SUPPORTED;
2102 }
Archana6ed4bda2021-08-04 10:47:15 +05302103
Ryan Everettf028fe12024-01-08 17:14:44 +00002104 LOCAL_INPUT_ALLOC(data_external, data_length, data);
2105
Gilles Peskine449bd832023-01-11 14:50:10 +01002106 status = psa_start_key_creation(PSA_KEY_CREATION_IMPORT, attributes,
2107 &slot, &driver);
2108 if (status != PSA_SUCCESS) {
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002109 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002110 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002111
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01002112 /* In the case of a transparent key or an opaque key stored in local
Archana449608b2021-09-08 15:36:05 +05302113 * storage ( thus not in the case of importing a key in a secure element
2114 * with storage ( MBEDTLS_PSA_CRYPTO_SE_C ) ),we have to allocate a
2115 * buffer to hold the imported key material. */
Valerio Setti8d4f1502024-06-14 07:49:05 +02002116#if defined(MBEDTLS_PSA_STATIC_KEY_SLOTS)
2117 int is_slot_unused = (slot->key.in_use == 0);
2118#else
2119 int is_slot_unused = (slot->key.data == NULL);
2120#endif
2121
2122 if (is_slot_unused) {
Gilles Peskine2f107ae2024-02-28 01:26:46 +01002123 if (psa_key_lifetime_is_external(attributes->lifetime)) {
Archana449608b2021-09-08 15:36:05 +05302124 status = psa_driver_wrapper_get_key_buffer_size_from_key_data(
Gilles Peskine449bd832023-01-11 14:50:10 +01002125 attributes, data, data_length, &storage_size);
2126 if (status != PSA_SUCCESS) {
Archanad8a83dc2021-06-14 10:04:16 +05302127 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002128 }
Archanad8a83dc2021-06-14 10:04:16 +05302129 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002130 status = psa_allocate_buffer_to_slot(slot, storage_size);
2131 if (status != PSA_SUCCESS) {
Gilles Peskineb46bef22019-07-30 21:32:04 +02002132 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002133 }
Gilles Peskine5d309672019-07-12 23:47:28 +02002134 }
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01002135
2136 bits = slot->attr.bits;
Gilles Peskine449bd832023-01-11 14:50:10 +01002137 status = psa_driver_wrapper_import_key(attributes,
2138 data, data_length,
2139 slot->key.data,
2140 slot->key.bytes,
2141 &slot->key.bytes, &bits);
2142 if (status != PSA_SUCCESS) {
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01002143 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002144 }
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01002145
Gilles Peskine449bd832023-01-11 14:50:10 +01002146 if (slot->attr.bits == 0) {
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01002147 slot->attr.bits = (psa_key_bits_t) bits;
Gilles Peskine449bd832023-01-11 14:50:10 +01002148 } else if (bits != slot->attr.bits) {
Steven Cooremanac3434f2021-01-15 17:36:02 +01002149 status = PSA_ERROR_INVALID_ARGUMENT;
2150 goto exit;
Gilles Peskine5d309672019-07-12 23:47:28 +02002151 }
Ronald Cron2ebfdcc2020-11-28 15:54:54 +01002152
Archana6ed4bda2021-08-04 10:47:15 +05302153 /* Enforce a size limit, and in particular ensure that the bit
2154 * size fits in its representation type.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01002155 if (bits > PSA_MAX_KEY_BITS) {
Archana6ed4bda2021-08-04 10:47:15 +05302156 status = PSA_ERROR_NOT_SUPPORTED;
2157 goto exit;
2158 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002159 status = psa_validate_optional_attributes(slot, attributes);
2160 if (status != PSA_SUCCESS) {
Gilles Peskine18017402019-07-24 20:25:59 +02002161 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002162 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002163
Gilles Peskine449bd832023-01-11 14:50:10 +01002164 status = psa_finish_key_creation(slot, driver, key);
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002165exit:
Ryan Everettf028fe12024-01-08 17:14:44 +00002166 LOCAL_INPUT_FREE(data_external, data);
Gilles Peskine449bd832023-01-11 14:50:10 +01002167 if (status != PSA_SUCCESS) {
2168 psa_fail_key_creation(slot, driver);
2169 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02002170
Gilles Peskine449bd832023-01-11 14:50:10 +01002171 return status;
Gilles Peskine4747d192019-04-17 15:05:45 +02002172}
2173
Gilles Peskined7729582019-08-05 15:55:54 +02002174#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
2175psa_status_t mbedtls_psa_register_se_key(
Gilles Peskine449bd832023-01-11 14:50:10 +01002176 const psa_key_attributes_t *attributes)
Gilles Peskined7729582019-08-05 15:55:54 +02002177{
2178 psa_status_t status;
2179 psa_key_slot_t *slot = NULL;
2180 psa_se_drv_table_entry_t *driver = NULL;
Ronald Croncf56a0a2020-08-04 09:51:30 +02002181 mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT;
Gilles Peskined7729582019-08-05 15:55:54 +02002182
2183 /* Leaving attributes unspecified is not currently supported.
2184 * It could make sense to query the key type and size from the
2185 * secure element, but not all secure elements support this
2186 * and the driver HAL doesn't currently support it. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002187 if (psa_get_key_type(attributes) == PSA_KEY_TYPE_NONE) {
2188 return PSA_ERROR_NOT_SUPPORTED;
2189 }
2190 if (psa_get_key_bits(attributes) == 0) {
2191 return PSA_ERROR_NOT_SUPPORTED;
2192 }
Gilles Peskined7729582019-08-05 15:55:54 +02002193
Gilles Peskined72ad732024-06-13 16:06:45 +02002194 /* Not usable with volatile keys, even with an appropriate location,
2195 * due to the API design.
2196 * https://github.com/Mbed-TLS/mbedtls/issues/9253
2197 */
2198 if (PSA_KEY_LIFETIME_IS_VOLATILE(psa_get_key_lifetime(attributes))) {
2199 return PSA_ERROR_INVALID_ARGUMENT;
2200 }
2201
Gilles Peskine449bd832023-01-11 14:50:10 +01002202 status = psa_start_key_creation(PSA_KEY_CREATION_REGISTER, attributes,
2203 &slot, &driver);
2204 if (status != PSA_SUCCESS) {
Gilles Peskined7729582019-08-05 15:55:54 +02002205 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002206 }
Gilles Peskined7729582019-08-05 15:55:54 +02002207
Gilles Peskine449bd832023-01-11 14:50:10 +01002208 status = psa_finish_key_creation(slot, driver, &key);
Gilles Peskined7729582019-08-05 15:55:54 +02002209
2210exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002211 if (status != PSA_SUCCESS) {
2212 psa_fail_key_creation(slot, driver);
2213 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02002214
Gilles Peskined7729582019-08-05 15:55:54 +02002215 /* Registration doesn't keep the key in RAM. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002216 psa_close_key(key);
2217 return status;
Gilles Peskined7729582019-08-05 15:55:54 +02002218}
2219#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
2220
Gilles Peskine449bd832023-01-11 14:50:10 +01002221psa_status_t psa_copy_key(mbedtls_svc_key_id_t source_key,
2222 const psa_key_attributes_t *specified_attributes,
2223 mbedtls_svc_key_id_t *target_key)
Gilles Peskinef603c712019-01-19 13:40:11 +01002224{
Ronald Cronf95a2b12020-10-22 15:24:49 +02002225 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01002226 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinef603c712019-01-19 13:40:11 +01002227 psa_key_slot_t *source_slot = NULL;
2228 psa_key_slot_t *target_slot = NULL;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002229 psa_key_attributes_t actual_attributes = *specified_attributes;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02002230 psa_se_drv_table_entry_t *driver = NULL;
Archana8a180362021-07-05 02:18:48 +05302231 size_t storage_size = 0;
Gilles Peskinef603c712019-01-19 13:40:11 +01002232
Ronald Cron81709fc2020-11-14 12:10:32 +01002233 *target_key = MBEDTLS_SVC_KEY_ID_INIT;
2234
Archana8a180362021-07-05 02:18:48 +05302235 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002236 source_key, &source_slot, PSA_KEY_USAGE_COPY, 0);
2237 if (status != PSA_SUCCESS) {
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002238 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002239 }
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002240
Gilles Peskine449bd832023-01-11 14:50:10 +01002241 status = psa_validate_optional_attributes(source_slot,
2242 specified_attributes);
2243 if (status != PSA_SUCCESS) {
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002244 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002245 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002246
Archana9d17bf42021-09-10 06:22:44 +05302247 /* The target key type and number of bits have been validated by
2248 * psa_validate_optional_attributes() to be either equal to zero or
2249 * equal to the ones of the source key. So it is safe to inherit
2250 * them from the source key now."
Archana374fe5b2021-09-08 15:50:28 +05302251 * */
Gilles Peskine2f107ae2024-02-28 01:26:46 +01002252 actual_attributes.bits = source_slot->attr.bits;
2253 actual_attributes.type = source_slot->attr.type;
Archana374fe5b2021-09-08 15:50:28 +05302254
2255
Gilles Peskine449bd832023-01-11 14:50:10 +01002256 status = psa_restrict_key_policy(source_slot->attr.type,
Gilles Peskine2f107ae2024-02-28 01:26:46 +01002257 &actual_attributes.policy,
Gilles Peskine449bd832023-01-11 14:50:10 +01002258 &source_slot->attr.policy);
2259 if (status != PSA_SUCCESS) {
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002260 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002261 }
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002262
Gilles Peskine449bd832023-01-11 14:50:10 +01002263 status = psa_start_key_creation(PSA_KEY_CREATION_COPY, &actual_attributes,
2264 &target_slot, &driver);
2265 if (status != PSA_SUCCESS) {
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002266 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002267 }
2268 if (PSA_KEY_LIFETIME_GET_LOCATION(target_slot->attr.lifetime) !=
2269 PSA_KEY_LIFETIME_GET_LOCATION(source_slot->attr.lifetime)) {
Archana8a180362021-07-05 02:18:48 +05302270 /*
Archana9d17bf42021-09-10 06:22:44 +05302271 * If the source and target keys are stored in different locations,
Archana8a180362021-07-05 02:18:48 +05302272 * the source key would need to be exported as plaintext and re-imported
2273 * in the other location. This has security implications which have not
Archana449608b2021-09-08 15:36:05 +05302274 * been fully mapped. For now, this can be achieved through
Archana8a180362021-07-05 02:18:48 +05302275 * appropriate API invocations from the application, if needed.
2276 * */
Gilles Peskinef4ee6622019-07-24 13:44:30 +02002277 status = PSA_ERROR_NOT_SUPPORTED;
2278 goto exit;
Gilles Peskinef603c712019-01-19 13:40:11 +01002279 }
Archana8a180362021-07-05 02:18:48 +05302280 /*
2281 * When the source and target keys are within the same location,
Archana449608b2021-09-08 15:36:05 +05302282 * - For transparent keys it is a blind copy without any driver invocation,
Archana8a180362021-07-05 02:18:48 +05302283 * - For opaque keys this translates to an invocation of the drivers'
2284 * copy_key entry point through the dispatch layer.
2285 * */
Gilles Peskine2f107ae2024-02-28 01:26:46 +01002286 if (psa_key_lifetime_is_external(actual_attributes.lifetime)) {
Gilles Peskine449bd832023-01-11 14:50:10 +01002287 status = psa_driver_wrapper_get_key_buffer_size(&actual_attributes,
2288 &storage_size);
2289 if (status != PSA_SUCCESS) {
Archana8a180362021-07-05 02:18:48 +05302290 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002291 }
Archana374fe5b2021-09-08 15:50:28 +05302292
Gilles Peskine449bd832023-01-11 14:50:10 +01002293 status = psa_allocate_buffer_to_slot(target_slot, storage_size);
2294 if (status != PSA_SUCCESS) {
Archana8a180362021-07-05 02:18:48 +05302295 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002296 }
Archana374fe5b2021-09-08 15:50:28 +05302297
Gilles Peskine449bd832023-01-11 14:50:10 +01002298 status = psa_driver_wrapper_copy_key(&actual_attributes,
2299 source_slot->key.data,
2300 source_slot->key.bytes,
2301 target_slot->key.data,
2302 target_slot->key.bytes,
2303 &target_slot->key.bytes);
2304 if (status != PSA_SUCCESS) {
Archana8a180362021-07-05 02:18:48 +05302305 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002306 }
2307 } else {
2308 status = psa_copy_key_material_into_slot(target_slot,
Archana9d17bf42021-09-10 06:22:44 +05302309 source_slot->key.data,
Gilles Peskine449bd832023-01-11 14:50:10 +01002310 source_slot->key.bytes);
2311 if (status != PSA_SUCCESS) {
Archana8a180362021-07-05 02:18:48 +05302312 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002313 }
Archana8a180362021-07-05 02:18:48 +05302314 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002315 status = psa_finish_key_creation(target_slot, driver, target_key);
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002316exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002317 if (status != PSA_SUCCESS) {
2318 psa_fail_key_creation(target_slot, driver);
2319 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02002320
Ryan Everetta103ec92024-01-31 13:59:57 +00002321 unlock_status = psa_unregister_read_under_mutex(source_slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02002322
Gilles Peskine449bd832023-01-11 14:50:10 +01002323 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskinef603c712019-01-19 13:40:11 +01002324}
2325
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02002326
2327
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01002328/****************************************************************/
Gilles Peskine20035e32018-02-03 22:44:14 +01002329/* Message digests */
2330/****************************************************************/
2331
Gilles Peskine449bd832023-01-11 14:50:10 +01002332psa_status_t psa_hash_abort(psa_hash_operation_t *operation)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002333{
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002334 /* Aborting a non-active operation is allowed */
Gilles Peskine449bd832023-01-11 14:50:10 +01002335 if (operation->id == 0) {
2336 return PSA_SUCCESS;
2337 }
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002338
Gilles Peskine449bd832023-01-11 14:50:10 +01002339 psa_status_t status = psa_driver_wrapper_hash_abort(operation);
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002340 operation->id = 0;
2341
Gilles Peskine449bd832023-01-11 14:50:10 +01002342 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002343}
2344
Gilles Peskine449bd832023-01-11 14:50:10 +01002345psa_status_t psa_hash_setup(psa_hash_operation_t *operation,
2346 psa_algorithm_t alg)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002347{
Dave Rodgman685b6a72021-06-24 11:49:14 +01002348 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002349
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002350 /* A context must be freshly initialized before it can be set up. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002351 if (operation->id != 0) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002352 status = PSA_ERROR_BAD_STATE;
2353 goto exit;
2354 }
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002355
Gilles Peskine449bd832023-01-11 14:50:10 +01002356 if (!PSA_ALG_IS_HASH(alg)) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002357 status = PSA_ERROR_INVALID_ARGUMENT;
2358 goto exit;
2359 }
Jaeden Amero36ee5d02019-02-19 09:25:10 +00002360
Steven Cooremanb6bf4bb2021-03-15 19:00:14 +01002361 /* Ensure all of the context is zeroized, since PSA_HASH_OPERATION_INIT only
2362 * directly zeroes the int-sized dummy member of the context union. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002363 memset(&operation->ctx, 0, sizeof(operation->ctx));
Steven Cooreman893232f2021-03-15 12:23:37 +01002364
Gilles Peskine449bd832023-01-11 14:50:10 +01002365 status = psa_driver_wrapper_hash_setup(operation, alg);
Dave Rodgman685b6a72021-06-24 11:49:14 +01002366
2367exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002368 if (status != PSA_SUCCESS) {
2369 psa_hash_abort(operation);
2370 }
Dave Rodgman685b6a72021-06-24 11:49:14 +01002371
2372 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002373}
2374
Gilles Peskine449bd832023-01-11 14:50:10 +01002375psa_status_t psa_hash_update(psa_hash_operation_t *operation,
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002376 const uint8_t *input_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01002377 size_t input_length)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002378{
Dave Rodgman685b6a72021-06-24 11:49:14 +01002379 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002380 LOCAL_INPUT_DECLARE(input_external, input);
Dave Rodgman685b6a72021-06-24 11:49:14 +01002381
Gilles Peskine449bd832023-01-11 14:50:10 +01002382 if (operation->id == 0) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002383 status = PSA_ERROR_BAD_STATE;
2384 goto exit;
2385 }
Gilles Peskine94e44542018-07-12 16:58:43 +02002386
Steven Cooremanc8288352021-03-04 14:02:19 +01002387 /* Don't require hash implementations to behave correctly on a
2388 * zero-length input, which may have an invalid pointer. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002389 if (input_length == 0) {
2390 return PSA_SUCCESS;
2391 }
Steven Cooremanc8288352021-03-04 14:02:19 +01002392
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002393 LOCAL_INPUT_ALLOC(input_external, input_length, input);
Gilles Peskine449bd832023-01-11 14:50:10 +01002394 status = psa_driver_wrapper_hash_update(operation, input, input_length);
Dave Rodgman685b6a72021-06-24 11:49:14 +01002395
2396exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002397 if (status != PSA_SUCCESS) {
2398 psa_hash_abort(operation);
2399 }
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002400
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002401 LOCAL_INPUT_FREE(input_external, input);
Gilles Peskine449bd832023-01-11 14:50:10 +01002402 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002403}
2404
Thomas Daubney31d8c0b2024-01-18 15:26:59 +00002405static psa_status_t psa_hash_finish_internal(psa_hash_operation_t *operation,
Thomas Daubneyd2411562024-01-25 17:25:07 +00002406 uint8_t *hash,
2407 size_t hash_size,
2408 size_t *hash_length)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002409{
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002410 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2411
Steven Cooremanfbe09282021-03-08 18:41:12 +01002412 *hash_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01002413 if (operation->id == 0) {
2414 return PSA_ERROR_BAD_STATE;
2415 }
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002416
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002417 status = psa_driver_wrapper_hash_finish(
Gilles Peskine449bd832023-01-11 14:50:10 +01002418 operation, hash, hash_size, hash_length);
2419 psa_hash_abort(operation);
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002420
2421 return status;
2422}
2423
2424psa_status_t psa_hash_finish(psa_hash_operation_t *operation,
2425 uint8_t *hash_external,
2426 size_t hash_size,
2427 size_t *hash_length)
2428{
2429 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2430 LOCAL_OUTPUT_DECLARE(hash_external, hash);
2431
2432 LOCAL_OUTPUT_ALLOC(hash_external, hash_size, hash);
2433 status = psa_hash_finish_internal(operation, hash, hash_size, hash_length);
2434
David Horstmann4a48bec2024-03-13 15:42:31 +00002435#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002436exit:
Thomas Daubneydedd1002024-01-25 16:52:50 +00002437#endif
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002438 LOCAL_OUTPUT_FREE(hash_external, hash);
Gilles Peskine449bd832023-01-11 14:50:10 +01002439 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002440}
2441
Gilles Peskine449bd832023-01-11 14:50:10 +01002442psa_status_t psa_hash_verify(psa_hash_operation_t *operation,
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002443 const uint8_t *hash_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01002444 size_t hash_length)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002445{
Ronald Cron69a63422021-10-18 09:47:58 +02002446 uint8_t actual_hash[PSA_HASH_MAX_SIZE];
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002447 size_t actual_hash_length;
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002448 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2449 LOCAL_INPUT_DECLARE(hash_external, hash);
2450
2451 status = psa_hash_finish_internal(
Gilles Peskine449bd832023-01-11 14:50:10 +01002452 operation,
2453 actual_hash, sizeof(actual_hash),
2454 &actual_hash_length);
Dave Rodgman685b6a72021-06-24 11:49:14 +01002455
Gilles Peskine449bd832023-01-11 14:50:10 +01002456 if (status != PSA_SUCCESS) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002457 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002458 }
Dave Rodgman685b6a72021-06-24 11:49:14 +01002459
Gilles Peskine449bd832023-01-11 14:50:10 +01002460 if (actual_hash_length != hash_length) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002461 status = PSA_ERROR_INVALID_SIGNATURE;
2462 goto exit;
2463 }
2464
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002465 LOCAL_INPUT_ALLOC(hash_external, hash_length, hash);
Dave Rodgman78701152023-08-29 14:20:18 +01002466 if (mbedtls_ct_memcmp(hash, actual_hash, actual_hash_length) != 0) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002467 status = PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskine449bd832023-01-11 14:50:10 +01002468 }
Dave Rodgman685b6a72021-06-24 11:49:14 +01002469
2470exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002471 mbedtls_platform_zeroize(actual_hash, sizeof(actual_hash));
2472 if (status != PSA_SUCCESS) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002473 psa_hash_abort(operation);
Gilles Peskine449bd832023-01-11 14:50:10 +01002474 }
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002475 LOCAL_INPUT_FREE(hash_external, hash);
Gilles Peskine449bd832023-01-11 14:50:10 +01002476 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002477}
2478
Gilles Peskine449bd832023-01-11 14:50:10 +01002479psa_status_t psa_hash_compute(psa_algorithm_t alg,
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002480 const uint8_t *input_external, size_t input_length,
2481 uint8_t *hash_external, size_t hash_size,
Gilles Peskine449bd832023-01-11 14:50:10 +01002482 size_t *hash_length)
Gilles Peskine0a749c82019-11-28 19:33:58 +01002483{
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002484 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2485 LOCAL_INPUT_DECLARE(input_external, input);
2486 LOCAL_OUTPUT_DECLARE(hash_external, hash);
2487
Steven Cooremanfbe09282021-03-08 18:41:12 +01002488 *hash_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01002489 if (!PSA_ALG_IS_HASH(alg)) {
2490 return PSA_ERROR_INVALID_ARGUMENT;
2491 }
Steven Cooremanf66d5fd2021-03-08 18:40:40 +01002492
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002493 LOCAL_INPUT_ALLOC(input_external, input_length, input);
2494 LOCAL_OUTPUT_ALLOC(hash_external, hash_size, hash);
2495 status = psa_driver_wrapper_hash_compute(alg, input, input_length,
Thomas Daubneyd2411562024-01-25 17:25:07 +00002496 hash, hash_size, hash_length);
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002497
David Horstmann4a48bec2024-03-13 15:42:31 +00002498#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002499exit:
Thomas Daubneydedd1002024-01-25 16:52:50 +00002500#endif
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002501 LOCAL_INPUT_FREE(input_external, input);
2502 LOCAL_OUTPUT_FREE(hash_external, hash);
2503 return status;
Gilles Peskine0a749c82019-11-28 19:33:58 +01002504}
2505
Gilles Peskine449bd832023-01-11 14:50:10 +01002506psa_status_t psa_hash_compare(psa_algorithm_t alg,
Thomas Daubney51ffac92024-01-18 15:46:26 +00002507 const uint8_t *input_external, size_t input_length,
2508 const uint8_t *hash_external, size_t hash_length)
Gilles Peskine0a749c82019-11-28 19:33:58 +01002509{
Ronald Cron69a63422021-10-18 09:47:58 +02002510 uint8_t actual_hash[PSA_HASH_MAX_SIZE];
Steven Cooreman84d670d2021-02-18 16:22:53 +01002511 size_t actual_hash_length;
Thomas Daubney51ffac92024-01-18 15:46:26 +00002512 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2513
2514 LOCAL_INPUT_DECLARE(input_external, input);
2515 LOCAL_INPUT_DECLARE(hash_external, hash);
Steven Cooremanf66d5fd2021-03-08 18:40:40 +01002516
Gilles Peskine449bd832023-01-11 14:50:10 +01002517 if (!PSA_ALG_IS_HASH(alg)) {
Thomas Daubney51ffac92024-01-18 15:46:26 +00002518 status = PSA_ERROR_INVALID_ARGUMENT;
2519 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01002520 }
Steven Cooremanf66d5fd2021-03-08 18:40:40 +01002521
Thomas Daubney51ffac92024-01-18 15:46:26 +00002522 LOCAL_INPUT_ALLOC(input_external, input_length, input);
2523 status = psa_driver_wrapper_hash_compute(
Gilles Peskine449bd832023-01-11 14:50:10 +01002524 alg, input, input_length,
2525 actual_hash, sizeof(actual_hash),
2526 &actual_hash_length);
2527 if (status != PSA_SUCCESS) {
Gilles Peskine60aebec2021-12-13 12:33:18 +01002528 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002529 }
2530 if (actual_hash_length != hash_length) {
Gilles Peskine60aebec2021-12-13 12:33:18 +01002531 status = PSA_ERROR_INVALID_SIGNATURE;
2532 goto exit;
2533 }
Thomas Daubney51ffac92024-01-18 15:46:26 +00002534
2535 LOCAL_INPUT_ALLOC(hash_external, hash_length, hash);
Dave Rodgman78701152023-08-29 14:20:18 +01002536 if (mbedtls_ct_memcmp(hash, actual_hash, actual_hash_length) != 0) {
Gilles Peskine60aebec2021-12-13 12:33:18 +01002537 status = PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskine449bd832023-01-11 14:50:10 +01002538 }
Gilles Peskine60aebec2021-12-13 12:33:18 +01002539
2540exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002541 mbedtls_platform_zeroize(actual_hash, sizeof(actual_hash));
Thomas Daubney51ffac92024-01-18 15:46:26 +00002542
2543 LOCAL_INPUT_FREE(input_external, input);
2544 LOCAL_INPUT_FREE(hash_external, hash);
2545
Gilles Peskine449bd832023-01-11 14:50:10 +01002546 return status;
Gilles Peskine0a749c82019-11-28 19:33:58 +01002547}
2548
Gilles Peskine449bd832023-01-11 14:50:10 +01002549psa_status_t psa_hash_clone(const psa_hash_operation_t *source_operation,
2550 psa_hash_operation_t *target_operation)
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002551{
Gilles Peskine449bd832023-01-11 14:50:10 +01002552 if (source_operation->id == 0 ||
2553 target_operation->id != 0) {
2554 return PSA_ERROR_BAD_STATE;
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002555 }
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002556
Gilles Peskine449bd832023-01-11 14:50:10 +01002557 psa_status_t status = psa_driver_wrapper_hash_clone(source_operation,
2558 target_operation);
2559 if (status != PSA_SUCCESS) {
2560 psa_hash_abort(target_operation);
2561 }
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002562
Gilles Peskine449bd832023-01-11 14:50:10 +01002563 return status;
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002564}
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002565
2566
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002567/****************************************************************/
Gilles Peskine8c9def32018-02-08 10:02:12 +01002568/* MAC */
2569/****************************************************************/
2570
Gilles Peskine449bd832023-01-11 14:50:10 +01002571psa_status_t psa_mac_abort(psa_mac_operation_t *operation)
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002572{
Steven Cooremane6804192021-03-19 18:28:56 +01002573 /* Aborting a non-active operation is allowed */
Gilles Peskine449bd832023-01-11 14:50:10 +01002574 if (operation->id == 0) {
2575 return PSA_SUCCESS;
2576 }
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002577
Gilles Peskine449bd832023-01-11 14:50:10 +01002578 psa_status_t status = psa_driver_wrapper_mac_abort(operation);
Steven Cooreman72f736a2021-05-07 14:14:37 +02002579 operation->mac_size = 0;
2580 operation->is_sign = 0;
Steven Cooremane6804192021-03-19 18:28:56 +01002581 operation->id = 0;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002582
Gilles Peskine449bd832023-01-11 14:50:10 +01002583 return status;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002584}
2585
Ronald Cron2dff3b22021-06-17 16:33:22 +02002586static psa_status_t psa_mac_finalize_alg_and_key_validation(
2587 psa_algorithm_t alg,
Ronald Cron79bdd822021-06-17 16:46:44 +02002588 const psa_key_attributes_t *attributes,
Gilles Peskine449bd832023-01-11 14:50:10 +01002589 uint8_t *mac_size)
Gilles Peskine8c9def32018-02-08 10:02:12 +01002590{
Ronald Cronf95a2b12020-10-22 15:24:49 +02002591 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine449bd832023-01-11 14:50:10 +01002592 psa_key_type_t key_type = psa_get_key_type(attributes);
2593 size_t key_bits = psa_get_key_bits(attributes);
Steven Cooreman77e2cc52021-03-19 17:05:52 +01002594
Gilles Peskine449bd832023-01-11 14:50:10 +01002595 if (!PSA_ALG_IS_MAC(alg)) {
2596 return PSA_ERROR_INVALID_ARGUMENT;
2597 }
Steven Cooremane6804192021-03-19 18:28:56 +01002598
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +01002599 /* Validate the combination of key type and algorithm */
Gilles Peskine449bd832023-01-11 14:50:10 +01002600 status = psa_mac_key_can_do(alg, key_type);
2601 if (status != PSA_SUCCESS) {
2602 return status;
2603 }
Steven Cooreman15472f82021-03-02 16:16:22 +01002604
Steven Cooremand1a68f12021-05-10 11:13:41 +02002605 /* Get the output length for the algorithm and key combination */
Gilles Peskine449bd832023-01-11 14:50:10 +01002606 *mac_size = PSA_MAC_LENGTH(key_type, key_bits, alg);
Steven Cooreman15472f82021-03-02 16:16:22 +01002607
Gilles Peskine449bd832023-01-11 14:50:10 +01002608 if (*mac_size < 4) {
Steven Cooreman15472f82021-03-02 16:16:22 +01002609 /* A very short MAC is too short for security since it can be
2610 * brute-forced. Ancient protocols with 32-bit MACs do exist,
2611 * so we make this our minimum, even though 32 bits is still
2612 * too small for security. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002613 return PSA_ERROR_NOT_SUPPORTED;
Steven Cooreman15472f82021-03-02 16:16:22 +01002614 }
Gilles Peskineab1d7ab2018-07-06 16:07:47 +02002615
Gilles Peskine449bd832023-01-11 14:50:10 +01002616 if (*mac_size > PSA_MAC_LENGTH(key_type, key_bits,
2617 PSA_ALG_FULL_LENGTH_MAC(alg))) {
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +01002618 /* It's impossible to "truncate" to a larger length than the full length
2619 * of the algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002620 return PSA_ERROR_INVALID_ARGUMENT;
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +01002621 }
2622
Gilles Peskine449bd832023-01-11 14:50:10 +01002623 if (*mac_size > PSA_MAC_MAX_SIZE) {
Gilles Peskinea9b6c802022-03-16 13:54:49 +01002624 /* PSA_MAC_LENGTH returns the correct length even for a MAC algorithm
2625 * that is disabled in the compile-time configuration. The result can
2626 * therefore be larger than PSA_MAC_MAX_SIZE, which does take the
2627 * configuration into account. In this case, force a return of
2628 * PSA_ERROR_NOT_SUPPORTED here. Otherwise psa_mac_verify(), or
2629 * psa_mac_compute(mac_size=PSA_MAC_MAX_SIZE), would return
2630 * PSA_ERROR_BUFFER_TOO_SMALL for an unsupported algorithm whose MAC size
2631 * is larger than PSA_MAC_MAX_SIZE, which is misleading and which breaks
2632 * systematically generated tests. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002633 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea9b6c802022-03-16 13:54:49 +01002634 }
2635
Gilles Peskine449bd832023-01-11 14:50:10 +01002636 return PSA_SUCCESS;
Ronald Cron2dff3b22021-06-17 16:33:22 +02002637}
2638
Gilles Peskine449bd832023-01-11 14:50:10 +01002639static psa_status_t psa_mac_setup(psa_mac_operation_t *operation,
2640 mbedtls_svc_key_id_t key,
2641 psa_algorithm_t alg,
2642 int is_sign)
Gilles Peskinee59236f2018-01-27 23:32:46 +01002643{
2644 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2645 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Dave Rodgman54648242021-06-24 11:49:45 +01002646 psa_key_slot_t *slot = NULL;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002647
2648 /* A context must be freshly initialized before it can be set up. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002649 if (operation->id != 0) {
Dave Rodgman54648242021-06-24 11:49:45 +01002650 status = PSA_ERROR_BAD_STATE;
2651 goto exit;
2652 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002653
2654 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002655 key,
2656 &slot,
2657 is_sign ? PSA_KEY_USAGE_SIGN_MESSAGE : PSA_KEY_USAGE_VERIFY_MESSAGE,
2658 alg);
2659 if (status != PSA_SUCCESS) {
Dave Rodgman54648242021-06-24 11:49:45 +01002660 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002661 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002662
Gilles Peskine7a5d9202024-02-28 01:18:23 +01002663 status = psa_mac_finalize_alg_and_key_validation(alg, &slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01002664 &operation->mac_size);
2665 if (status != PSA_SUCCESS) {
Gilles Peskine8c9def32018-02-08 10:02:12 +01002666 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002667 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002668
2669 operation->is_sign = is_sign;
Steven Cooremane6804192021-03-19 18:28:56 +01002670 /* Dispatch the MAC setup call with validated input */
Gilles Peskine449bd832023-01-11 14:50:10 +01002671 if (is_sign) {
2672 status = psa_driver_wrapper_mac_sign_setup(operation,
Gilles Peskine7a5d9202024-02-28 01:18:23 +01002673 &slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01002674 slot->key.data,
2675 slot->key.bytes,
2676 alg);
2677 } else {
2678 status = psa_driver_wrapper_mac_verify_setup(operation,
Gilles Peskine7a5d9202024-02-28 01:18:23 +01002679 &slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01002680 slot->key.data,
2681 slot->key.bytes,
2682 alg);
Gilles Peskine8c9def32018-02-08 10:02:12 +01002683 }
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002684
Gilles Peskinefbfac682018-07-08 20:51:54 +02002685exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002686 if (status != PSA_SUCCESS) {
2687 psa_mac_abort(operation);
2688 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02002689
Ryan Everettfb9857f2024-02-14 12:16:41 +00002690 unlock_status = psa_unregister_read_under_mutex(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02002691
Gilles Peskine449bd832023-01-11 14:50:10 +01002692 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002693}
2694
Gilles Peskine449bd832023-01-11 14:50:10 +01002695psa_status_t psa_mac_sign_setup(psa_mac_operation_t *operation,
2696 mbedtls_svc_key_id_t key,
2697 psa_algorithm_t alg)
Gilles Peskine89167cb2018-07-08 20:12:23 +02002698{
Gilles Peskine449bd832023-01-11 14:50:10 +01002699 return psa_mac_setup(operation, key, alg, 1);
Gilles Peskine89167cb2018-07-08 20:12:23 +02002700}
2701
Gilles Peskine449bd832023-01-11 14:50:10 +01002702psa_status_t psa_mac_verify_setup(psa_mac_operation_t *operation,
2703 mbedtls_svc_key_id_t key,
2704 psa_algorithm_t alg)
Gilles Peskine89167cb2018-07-08 20:12:23 +02002705{
Gilles Peskine449bd832023-01-11 14:50:10 +01002706 return psa_mac_setup(operation, key, alg, 0);
Gilles Peskine89167cb2018-07-08 20:12:23 +02002707}
2708
Gilles Peskine449bd832023-01-11 14:50:10 +01002709psa_status_t psa_mac_update(psa_mac_operation_t *operation,
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002710 const uint8_t *input_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01002711 size_t input_length)
Gilles Peskine8c9def32018-02-08 10:02:12 +01002712{
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002713 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2714 LOCAL_INPUT_DECLARE(input_external, input);
2715
Gilles Peskine449bd832023-01-11 14:50:10 +01002716 if (operation->id == 0) {
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002717 status = PSA_ERROR_BAD_STATE;
2718 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01002719 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002720
Steven Cooreman6e7f2912021-03-19 18:38:46 +01002721 /* Don't require hash implementations to behave correctly on a
2722 * zero-length input, which may have an invalid pointer. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002723 if (input_length == 0) {
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002724 status = PSA_SUCCESS;
2725 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01002726 }
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03002727
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002728 LOCAL_INPUT_ALLOC(input_external, input_length, input);
2729 status = psa_driver_wrapper_mac_update(operation, input, input_length);
2730
Gilles Peskine449bd832023-01-11 14:50:10 +01002731 if (status != PSA_SUCCESS) {
2732 psa_mac_abort(operation);
2733 }
Steven Cooreman6e7f2912021-03-19 18:38:46 +01002734
David Horstmann4a48bec2024-03-13 15:42:31 +00002735#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002736exit:
Thomas Daubneyc6705c62024-01-30 11:21:47 +00002737#endif
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002738 LOCAL_INPUT_FREE(input_external, input);
2739
Gilles Peskine449bd832023-01-11 14:50:10 +01002740 return status;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002741}
2742
Gilles Peskine449bd832023-01-11 14:50:10 +01002743psa_status_t psa_mac_sign_finish(psa_mac_operation_t *operation,
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002744 uint8_t *mac_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01002745 size_t mac_size,
2746 size_t *mac_length)
mohammad16036df908f2018-04-02 08:34:15 -07002747{
Steven Cooremana5b860a2021-03-19 19:04:39 +01002748 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2749 psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED;
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002750 LOCAL_OUTPUT_DECLARE(mac_external, mac);
Thomas Daubney1ffc5cb2024-01-31 18:09:36 +00002751 LOCAL_OUTPUT_ALLOC(mac_external, mac_size, mac);
Steven Cooreman77e2cc52021-03-19 17:05:52 +01002752
Gilles Peskine449bd832023-01-11 14:50:10 +01002753 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002754 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002755 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002756 }
Jaeden Amero252ef282019-02-15 14:05:35 +00002757
Gilles Peskine449bd832023-01-11 14:50:10 +01002758 if (!operation->is_sign) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002759 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002760 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002761 }
Steven Cooreman72f736a2021-05-07 14:14:37 +02002762
Steven Cooreman8af5c5c2021-05-11 11:09:13 +02002763 /* Sanity check. This will guarantee that mac_size != 0 (and so mac != NULL)
2764 * once all the error checks are done. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002765 if (operation->mac_size == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002766 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002767 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002768 }
Steven Cooreman8af5c5c2021-05-11 11:09:13 +02002769
Gilles Peskine449bd832023-01-11 14:50:10 +01002770 if (mac_size < operation->mac_size) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002771 status = PSA_ERROR_BUFFER_TOO_SMALL;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002772 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002773 }
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002774
Thomas Daubney1ffc5cb2024-01-31 18:09:36 +00002775
Gilles Peskine449bd832023-01-11 14:50:10 +01002776 status = psa_driver_wrapper_mac_sign_finish(operation,
2777 mac, operation->mac_size,
2778 mac_length);
Steven Cooreman72f736a2021-05-07 14:14:37 +02002779
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002780exit:
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002781 /* In case of success, set the potential excess room in the output buffer
2782 * to an invalid value, to avoid potentially leaking a longer MAC.
2783 * In case of error, set the output length and content to a safe default,
2784 * such that in case the caller misses an error check, the output would be
2785 * an unachievable MAC.
2786 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002787 if (status != PSA_SUCCESS) {
Steven Cooreman72f736a2021-05-07 14:14:37 +02002788 *mac_length = mac_size;
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002789 operation->mac_size = 0;
Steven Cooreman72f736a2021-05-07 14:14:37 +02002790 }
mohammad16036df908f2018-04-02 08:34:15 -07002791
Thomas Daubney03f1ea32024-02-01 16:16:27 +00002792 if (mac != NULL) {
Thomas Daubney1ffc5cb2024-01-31 18:09:36 +00002793 psa_wipe_tag_output_buffer(mac, status, mac_size, *mac_length);
2794 }
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002795
Gilles Peskine449bd832023-01-11 14:50:10 +01002796 abort_status = psa_mac_abort(operation);
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002797 LOCAL_OUTPUT_FREE(mac_external, mac);
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002798
Gilles Peskine449bd832023-01-11 14:50:10 +01002799 return status == PSA_SUCCESS ? abort_status : status;
mohammad16036df908f2018-04-02 08:34:15 -07002800}
2801
Gilles Peskine449bd832023-01-11 14:50:10 +01002802psa_status_t psa_mac_verify_finish(psa_mac_operation_t *operation,
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002803 const uint8_t *mac_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01002804 size_t mac_length)
Gilles Peskine8c9def32018-02-08 10:02:12 +01002805{
Steven Cooremana5b860a2021-03-19 19:04:39 +01002806 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2807 psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED;
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002808 LOCAL_INPUT_DECLARE(mac_external, mac);
Steven Cooreman77e2cc52021-03-19 17:05:52 +01002809
Gilles Peskine449bd832023-01-11 14:50:10 +01002810 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002811 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002812 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002813 }
Jaeden Amero252ef282019-02-15 14:05:35 +00002814
Gilles Peskine449bd832023-01-11 14:50:10 +01002815 if (operation->is_sign) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002816 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002817 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002818 }
Steven Cooreman72f736a2021-05-07 14:14:37 +02002819
Gilles Peskine449bd832023-01-11 14:50:10 +01002820 if (operation->mac_size != mac_length) {
Steven Cooreman72f736a2021-05-07 14:14:37 +02002821 status = PSA_ERROR_INVALID_SIGNATURE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002822 goto exit;
Steven Cooreman72f736a2021-05-07 14:14:37 +02002823 }
2824
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002825 LOCAL_INPUT_ALLOC(mac_external, mac_length, mac);
Gilles Peskine449bd832023-01-11 14:50:10 +01002826 status = psa_driver_wrapper_mac_verify_finish(operation,
2827 mac, mac_length);
Steven Cooreman72f736a2021-05-07 14:14:37 +02002828
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002829exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002830 abort_status = psa_mac_abort(operation);
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002831 LOCAL_INPUT_FREE(mac_external, mac);
mohammad16036df908f2018-04-02 08:34:15 -07002832
Gilles Peskine449bd832023-01-11 14:50:10 +01002833 return status == PSA_SUCCESS ? abort_status : status;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002834}
2835
Gilles Peskine449bd832023-01-11 14:50:10 +01002836static psa_status_t psa_mac_compute_internal(mbedtls_svc_key_id_t key,
2837 psa_algorithm_t alg,
2838 const uint8_t *input,
2839 size_t input_length,
2840 uint8_t *mac,
2841 size_t mac_size,
2842 size_t *mac_length,
2843 int is_sign)
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002844{
2845 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron51131b52021-06-17 17:17:20 +02002846 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
2847 psa_key_slot_t *slot;
2848 uint8_t operation_mac_size = 0;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002849
Ronald Cron51131b52021-06-17 17:17:20 +02002850 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002851 key,
2852 &slot,
2853 is_sign ? PSA_KEY_USAGE_SIGN_MESSAGE : PSA_KEY_USAGE_VERIFY_MESSAGE,
2854 alg);
2855 if (status != PSA_SUCCESS) {
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002856 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002857 }
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002858
Gilles Peskine7a5d9202024-02-28 01:18:23 +01002859 status = psa_mac_finalize_alg_and_key_validation(alg, &slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01002860 &operation_mac_size);
2861 if (status != PSA_SUCCESS) {
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002862 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002863 }
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002864
Gilles Peskine449bd832023-01-11 14:50:10 +01002865 if (mac_size < operation_mac_size) {
Ronald Cron51131b52021-06-17 17:17:20 +02002866 status = PSA_ERROR_BUFFER_TOO_SMALL;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002867 goto exit;
Ronald Cron51131b52021-06-17 17:17:20 +02002868 }
2869
2870 status = psa_driver_wrapper_mac_compute(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01002871 &slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01002872 slot->key.data, slot->key.bytes,
2873 alg,
2874 input, input_length,
2875 mac, operation_mac_size, mac_length);
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002876
2877exit:
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002878 /* In case of success, set the potential excess room in the output buffer
2879 * to an invalid value, to avoid potentially leaking a longer MAC.
2880 * In case of error, set the output length and content to a safe default,
2881 * such that in case the caller misses an error check, the output would be
2882 * an unachievable MAC.
2883 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002884 if (status != PSA_SUCCESS) {
Ronald Cron51131b52021-06-17 17:17:20 +02002885 *mac_length = mac_size;
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002886 operation_mac_size = 0;
Ronald Cron51131b52021-06-17 17:17:20 +02002887 }
Paul Elliottdc42ca82023-02-24 18:11:59 +00002888
2889 psa_wipe_tag_output_buffer(mac, status, mac_size, *mac_length);
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002890
Ryan Everetta103ec92024-01-31 13:59:57 +00002891 unlock_status = psa_unregister_read_under_mutex(slot);
Ronald Cron51131b52021-06-17 17:17:20 +02002892
Gilles Peskine449bd832023-01-11 14:50:10 +01002893 return (status == PSA_SUCCESS) ? unlock_status : status;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002894}
2895
Gilles Peskine449bd832023-01-11 14:50:10 +01002896psa_status_t psa_mac_compute(mbedtls_svc_key_id_t key,
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002897 psa_algorithm_t alg,
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002898 const uint8_t *input_external,
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002899 size_t input_length,
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002900 uint8_t *mac_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01002901 size_t mac_size,
2902 size_t *mac_length)
2903{
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002904 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2905 LOCAL_INPUT_DECLARE(input_external, input);
2906 LOCAL_OUTPUT_DECLARE(mac_external, mac);
2907
2908 LOCAL_INPUT_ALLOC(input_external, input_length, input);
2909 LOCAL_OUTPUT_ALLOC(mac_external, mac_size, mac);
2910 status = psa_mac_compute_internal(key, alg,
Thomas Daubney7480a742024-01-30 11:29:47 +00002911 input, input_length,
2912 mac, mac_size, mac_length, 1);
Thomas Daubneyc6705c62024-01-30 11:21:47 +00002913
David Horstmann4a48bec2024-03-13 15:42:31 +00002914#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002915exit:
Thomas Daubneyc6705c62024-01-30 11:21:47 +00002916#endif
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002917 LOCAL_INPUT_FREE(input_external, input);
2918 LOCAL_OUTPUT_FREE(mac_external, mac);
2919
2920 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01002921}
2922
2923psa_status_t psa_mac_verify(mbedtls_svc_key_id_t key,
2924 psa_algorithm_t alg,
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002925 const uint8_t *input_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01002926 size_t input_length,
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002927 const uint8_t *mac_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01002928 size_t mac_length)
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002929{
2930 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Crona587cbc2021-06-18 14:51:29 +02002931 uint8_t actual_mac[PSA_MAC_MAX_SIZE];
2932 size_t actual_mac_length;
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002933 LOCAL_INPUT_DECLARE(input_external, input);
2934 LOCAL_INPUT_DECLARE(mac_external, mac);
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002935
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002936 LOCAL_INPUT_ALLOC(input_external, input_length, input);
Gilles Peskine449bd832023-01-11 14:50:10 +01002937 status = psa_mac_compute_internal(key, alg,
2938 input, input_length,
2939 actual_mac, sizeof(actual_mac),
2940 &actual_mac_length, 0);
2941 if (status != PSA_SUCCESS) {
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002942 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002943 }
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002944
Gilles Peskine449bd832023-01-11 14:50:10 +01002945 if (mac_length != actual_mac_length) {
Ronald Crona587cbc2021-06-18 14:51:29 +02002946 status = PSA_ERROR_INVALID_SIGNATURE;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002947 goto exit;
Ronald Crona587cbc2021-06-18 14:51:29 +02002948 }
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002949
2950 LOCAL_INPUT_ALLOC(mac_external, mac_length, mac);
Dave Rodgman78701152023-08-29 14:20:18 +01002951 if (mbedtls_ct_memcmp(mac, actual_mac, actual_mac_length) != 0) {
Ronald Crona587cbc2021-06-18 14:51:29 +02002952 status = PSA_ERROR_INVALID_SIGNATURE;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002953 goto exit;
Ronald Crona587cbc2021-06-18 14:51:29 +02002954 }
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002955
2956exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002957 mbedtls_platform_zeroize(actual_mac, sizeof(actual_mac));
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002958 LOCAL_INPUT_FREE(input_external, input);
2959 LOCAL_INPUT_FREE(mac_external, mac);
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002960
Gilles Peskine449bd832023-01-11 14:50:10 +01002961 return status;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002962}
Gilles Peskinee59236f2018-01-27 23:32:46 +01002963
Gilles Peskinee59236f2018-01-27 23:32:46 +01002964/****************************************************************/
2965/* Asymmetric cryptography */
2966/****************************************************************/
2967
Gilles Peskine449bd832023-01-11 14:50:10 +01002968static psa_status_t psa_sign_verify_check_alg(int input_is_message,
2969 psa_algorithm_t alg)
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002970{
Gilles Peskine449bd832023-01-11 14:50:10 +01002971 if (input_is_message) {
2972 if (!PSA_ALG_IS_SIGN_MESSAGE(alg)) {
2973 return PSA_ERROR_INVALID_ARGUMENT;
2974 }
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002975
Gilles Peskine449bd832023-01-11 14:50:10 +01002976 if (PSA_ALG_IS_SIGN_HASH(alg)) {
2977 if (!PSA_ALG_IS_HASH(PSA_ALG_SIGN_GET_HASH(alg))) {
2978 return PSA_ERROR_INVALID_ARGUMENT;
2979 }
2980 }
2981 } else {
2982 if (!PSA_ALG_IS_SIGN_HASH(alg)) {
2983 return PSA_ERROR_INVALID_ARGUMENT;
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002984 }
2985 }
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002986
Gilles Peskine449bd832023-01-11 14:50:10 +01002987 return PSA_SUCCESS;
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002988}
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002989
Gilles Peskine449bd832023-01-11 14:50:10 +01002990static psa_status_t psa_sign_internal(mbedtls_svc_key_id_t key,
2991 int input_is_message,
2992 psa_algorithm_t alg,
2993 const uint8_t *input,
2994 size_t input_length,
2995 uint8_t *signature,
2996 size_t signature_size,
2997 size_t *signature_length)
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002998{
2999 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3000 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
3001 psa_key_slot_t *slot;
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003002
3003 *signature_length = 0;
3004
Gilles Peskine449bd832023-01-11 14:50:10 +01003005 status = psa_sign_verify_check_alg(input_is_message, alg);
3006 if (status != PSA_SUCCESS) {
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02003007 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01003008 }
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003009
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003010 /* Immediately reject a zero-length signature buffer. This guarantees
gabor-mezei-arm12b4f342021-05-05 13:54:55 +02003011 * that signature must be a valid pointer. (On the other hand, the input
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003012 * buffer can in principle be empty since it doesn't actually have
3013 * to be a hash.) */
Gilles Peskine449bd832023-01-11 14:50:10 +01003014 if (signature_size == 0) {
3015 return PSA_ERROR_BUFFER_TOO_SMALL;
3016 }
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003017
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003018 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01003019 key, &slot,
3020 input_is_message ? PSA_KEY_USAGE_SIGN_MESSAGE :
3021 PSA_KEY_USAGE_SIGN_HASH,
3022 alg);
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003023
Gilles Peskine449bd832023-01-11 14:50:10 +01003024 if (status != PSA_SUCCESS) {
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003025 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01003026 }
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003027
Gilles Peskine449bd832023-01-11 14:50:10 +01003028 if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) {
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003029 status = PSA_ERROR_INVALID_ARGUMENT;
3030 goto exit;
3031 }
3032
Gilles Peskine449bd832023-01-11 14:50:10 +01003033 if (input_is_message) {
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003034 status = psa_driver_wrapper_sign_message(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01003035 &slot->attr, slot->key.data, slot->key.bytes,
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003036 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003037 signature, signature_size, signature_length);
3038 } else {
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003039
3040 status = psa_driver_wrapper_sign_hash(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01003041 &slot->attr, slot->key.data, slot->key.bytes,
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003042 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003043 signature, signature_size, signature_length);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003044 }
3045
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003046
3047exit:
Paul Elliott59200a22023-02-21 15:07:40 +00003048 psa_wipe_tag_output_buffer(signature, status, signature_size,
3049 *signature_length);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003050
Ryan Everetta103ec92024-01-31 13:59:57 +00003051 unlock_status = psa_unregister_read_under_mutex(slot);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003052
Gilles Peskine449bd832023-01-11 14:50:10 +01003053 return (status == PSA_SUCCESS) ? unlock_status : status;
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003054}
3055
Gilles Peskine449bd832023-01-11 14:50:10 +01003056static psa_status_t psa_verify_internal(mbedtls_svc_key_id_t key,
3057 int input_is_message,
3058 psa_algorithm_t alg,
3059 const uint8_t *input,
3060 size_t input_length,
3061 const uint8_t *signature,
3062 size_t signature_length)
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003063{
3064 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3065 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
3066 psa_key_slot_t *slot;
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003067
Gilles Peskine449bd832023-01-11 14:50:10 +01003068 status = psa_sign_verify_check_alg(input_is_message, alg);
3069 if (status != PSA_SUCCESS) {
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02003070 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01003071 }
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003072
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003073 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01003074 key, &slot,
3075 input_is_message ? PSA_KEY_USAGE_VERIFY_MESSAGE :
3076 PSA_KEY_USAGE_VERIFY_HASH,
3077 alg);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003078
Gilles Peskine449bd832023-01-11 14:50:10 +01003079 if (status != PSA_SUCCESS) {
3080 return status;
3081 }
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003082
Gilles Peskine449bd832023-01-11 14:50:10 +01003083 if (input_is_message) {
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003084 status = psa_driver_wrapper_verify_message(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01003085 &slot->attr, slot->key.data, slot->key.bytes,
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003086 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003087 signature, signature_length);
3088 } else {
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003089 status = psa_driver_wrapper_verify_hash(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01003090 &slot->attr, slot->key.data, slot->key.bytes,
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003091 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003092 signature, signature_length);
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003093 }
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003094
Ryan Everetta103ec92024-01-31 13:59:57 +00003095 unlock_status = psa_unregister_read_under_mutex(slot);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003096
Gilles Peskine449bd832023-01-11 14:50:10 +01003097 return (status == PSA_SUCCESS) ? unlock_status : status;
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003098
3099}
3100
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02003101psa_status_t psa_sign_message_builtin(
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003102 const psa_key_attributes_t *attributes,
3103 const uint8_t *key_buffer,
3104 size_t key_buffer_size,
3105 psa_algorithm_t alg,
3106 const uint8_t *input,
3107 size_t input_length,
3108 uint8_t *signature,
3109 size_t signature_size,
Gilles Peskine449bd832023-01-11 14:50:10 +01003110 size_t *signature_length)
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003111{
3112 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003113
Gilles Peskine449bd832023-01-11 14:50:10 +01003114 if (PSA_ALG_IS_SIGN_HASH(alg)) {
gabor-mezei-armf9820f92021-05-03 16:26:20 +02003115 size_t hash_length;
3116 uint8_t hash[PSA_HASH_MAX_SIZE];
3117
gabor-mezei-arm0f622402021-04-29 16:48:44 +02003118 status = psa_driver_wrapper_hash_compute(
Gilles Peskine449bd832023-01-11 14:50:10 +01003119 PSA_ALG_SIGN_GET_HASH(alg),
3120 input, input_length,
3121 hash, sizeof(hash), &hash_length);
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003122
Gilles Peskine449bd832023-01-11 14:50:10 +01003123 if (status != PSA_SUCCESS) {
gabor-mezei-arm0f622402021-04-29 16:48:44 +02003124 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01003125 }
gabor-mezei-armf9820f92021-05-03 16:26:20 +02003126
3127 return psa_driver_wrapper_sign_hash(
Gilles Peskine449bd832023-01-11 14:50:10 +01003128 attributes, key_buffer, key_buffer_size,
3129 alg, hash, hash_length,
3130 signature, signature_size, signature_length);
gabor-mezei-arm0f622402021-04-29 16:48:44 +02003131 }
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003132
Gilles Peskine449bd832023-01-11 14:50:10 +01003133 return PSA_ERROR_NOT_SUPPORTED;
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003134}
3135
Gilles Peskine449bd832023-01-11 14:50:10 +01003136psa_status_t psa_sign_message(mbedtls_svc_key_id_t key,
3137 psa_algorithm_t alg,
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003138 const uint8_t *input_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01003139 size_t input_length,
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003140 uint8_t *signature_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01003141 size_t signature_size,
3142 size_t *signature_length)
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003143{
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003144 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3145 LOCAL_INPUT_DECLARE(input_external, input);
3146 LOCAL_OUTPUT_DECLARE(signature_external, signature);
3147
3148 LOCAL_INPUT_ALLOC(input_external, input_length, input);
3149 LOCAL_OUTPUT_ALLOC(signature_external, signature_size, signature);
3150 status = psa_sign_internal(key, 1, alg, input, input_length, signature,
3151 signature_size, signature_length);
3152
David Horstmann4a48bec2024-03-13 15:42:31 +00003153#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003154exit:
Thomas Daubney3e65f522024-01-30 12:37:25 +00003155#endif
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003156 LOCAL_INPUT_FREE(input_external, input);
3157 LOCAL_OUTPUT_FREE(signature_external, signature);
3158 return status;
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003159}
3160
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02003161psa_status_t psa_verify_message_builtin(
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003162 const psa_key_attributes_t *attributes,
3163 const uint8_t *key_buffer,
3164 size_t key_buffer_size,
3165 psa_algorithm_t alg,
3166 const uint8_t *input,
3167 size_t input_length,
3168 const uint8_t *signature,
Gilles Peskine449bd832023-01-11 14:50:10 +01003169 size_t signature_length)
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003170{
3171 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003172
Gilles Peskine449bd832023-01-11 14:50:10 +01003173 if (PSA_ALG_IS_SIGN_HASH(alg)) {
gabor-mezei-armf9820f92021-05-03 16:26:20 +02003174 size_t hash_length;
3175 uint8_t hash[PSA_HASH_MAX_SIZE];
3176
gabor-mezei-arm0f622402021-04-29 16:48:44 +02003177 status = psa_driver_wrapper_hash_compute(
Gilles Peskine449bd832023-01-11 14:50:10 +01003178 PSA_ALG_SIGN_GET_HASH(alg),
3179 input, input_length,
3180 hash, sizeof(hash), &hash_length);
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003181
Gilles Peskine449bd832023-01-11 14:50:10 +01003182 if (status != PSA_SUCCESS) {
gabor-mezei-arm0f622402021-04-29 16:48:44 +02003183 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01003184 }
gabor-mezei-armf9820f92021-05-03 16:26:20 +02003185
3186 return psa_driver_wrapper_verify_hash(
Gilles Peskine449bd832023-01-11 14:50:10 +01003187 attributes, key_buffer, key_buffer_size,
3188 alg, hash, hash_length,
3189 signature, signature_length);
gabor-mezei-arm0f622402021-04-29 16:48:44 +02003190 }
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003191
Gilles Peskine449bd832023-01-11 14:50:10 +01003192 return PSA_ERROR_NOT_SUPPORTED;
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003193}
3194
Gilles Peskine449bd832023-01-11 14:50:10 +01003195psa_status_t psa_verify_message(mbedtls_svc_key_id_t key,
3196 psa_algorithm_t alg,
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003197 const uint8_t *input_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01003198 size_t input_length,
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003199 const uint8_t *signature_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01003200 size_t signature_length)
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003201{
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003202 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3203 LOCAL_INPUT_DECLARE(input_external, input);
3204 LOCAL_INPUT_DECLARE(signature_external, signature);
3205
3206 LOCAL_INPUT_ALLOC(input_external, input_length, input);
3207 LOCAL_INPUT_ALLOC(signature_external, signature_length, signature);
3208 status = psa_verify_internal(key, 1, alg, input, input_length, signature,
3209 signature_length);
3210
David Horstmann4a48bec2024-03-13 15:42:31 +00003211#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003212exit:
Thomas Daubney3e65f522024-01-30 12:37:25 +00003213#endif
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003214 LOCAL_INPUT_FREE(input_external, input);
3215 LOCAL_INPUT_FREE(signature_external, signature);
3216
3217 return status;
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003218}
3219
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02003220psa_status_t psa_sign_hash_builtin(
Ronald Cron18659932020-12-08 16:32:23 +01003221 const psa_key_attributes_t *attributes,
3222 const uint8_t *key_buffer, size_t key_buffer_size,
3223 psa_algorithm_t alg, const uint8_t *hash, size_t hash_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003224 uint8_t *signature, size_t signature_size, size_t *signature_length)
Gilles Peskinee59236f2018-01-27 23:32:46 +01003225{
Gilles Peskine2f107ae2024-02-28 01:26:46 +01003226 if (attributes->type == PSA_KEY_TYPE_RSA_KEY_PAIR) {
Gilles Peskine449bd832023-01-11 14:50:10 +01003227 if (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) ||
3228 PSA_ALG_IS_RSA_PSS(alg)) {
Ronald Cron4501c982021-03-19 20:09:32 +01003229#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01003230 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
3231 return mbedtls_psa_rsa_sign_hash(
3232 attributes,
3233 key_buffer, key_buffer_size,
3234 alg, hash, hash_length,
3235 signature, signature_size, signature_length);
Ronald Cron4501c982021-03-19 20:09:32 +01003236#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
3237 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
Gilles Peskine449bd832023-01-11 14:50:10 +01003238 } else {
3239 return PSA_ERROR_INVALID_ARGUMENT;
Steven Cooremanacda8342020-07-24 23:09:52 +02003240 }
Gilles Peskine2f107ae2024-02-28 01:26:46 +01003241 } else if (PSA_KEY_TYPE_IS_ECC(attributes->type)) {
Gilles Peskine449bd832023-01-11 14:50:10 +01003242 if (PSA_ALG_IS_ECDSA(alg)) {
Ronald Cron4501c982021-03-19 20:09:32 +01003243#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01003244 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
3245 return mbedtls_psa_ecdsa_sign_hash(
3246 attributes,
3247 key_buffer, key_buffer_size,
3248 alg, hash, hash_length,
3249 signature, signature_size, signature_length);
Gilles Peskinee59236f2018-01-27 23:32:46 +01003250#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3251 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Gilles Peskine449bd832023-01-11 14:50:10 +01003252 } else {
3253 return PSA_ERROR_INVALID_ARGUMENT;
Ronald Cron4501c982021-03-19 20:09:32 +01003254 }
Ronald Cron8a494f32021-02-17 09:49:51 +01003255 }
Ronald Cron4501c982021-03-19 20:09:32 +01003256
Gilles Peskine449bd832023-01-11 14:50:10 +01003257 (void) key_buffer;
3258 (void) key_buffer_size;
3259 (void) hash;
3260 (void) hash_length;
3261 (void) signature;
3262 (void) signature_size;
3263 (void) signature_length;
Ronald Cron4501c982021-03-19 20:09:32 +01003264
Gilles Peskine449bd832023-01-11 14:50:10 +01003265 return PSA_ERROR_NOT_SUPPORTED;
Ronald Cron18659932020-12-08 16:32:23 +01003266}
Gilles Peskinee59236f2018-01-27 23:32:46 +01003267
Gilles Peskine449bd832023-01-11 14:50:10 +01003268psa_status_t psa_sign_hash(mbedtls_svc_key_id_t key,
3269 psa_algorithm_t alg,
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003270 const uint8_t *hash_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01003271 size_t hash_length,
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003272 uint8_t *signature_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01003273 size_t signature_size,
3274 size_t *signature_length)
Gilles Peskinee59236f2018-01-27 23:32:46 +01003275{
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003276 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3277 LOCAL_INPUT_DECLARE(hash_external, hash);
3278 LOCAL_OUTPUT_DECLARE(signature_external, signature);
3279
3280 LOCAL_INPUT_ALLOC(hash_external, hash_length, hash);
3281 LOCAL_OUTPUT_ALLOC(signature_external, signature_size, signature);
3282 status = psa_sign_internal(key, 0, alg, hash, hash_length, signature,
3283 signature_size, signature_length);
3284
David Horstmann4a48bec2024-03-13 15:42:31 +00003285#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003286exit:
Thomas Daubney3e65f522024-01-30 12:37:25 +00003287#endif
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003288 LOCAL_INPUT_FREE(hash_external, hash);
3289 LOCAL_OUTPUT_FREE(signature_external, signature);
3290
3291 return status;
itayzafrir5c753392018-05-08 11:18:38 +03003292}
3293
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02003294psa_status_t psa_verify_hash_builtin(
Ronald Cron18659932020-12-08 16:32:23 +01003295 const psa_key_attributes_t *attributes,
3296 const uint8_t *key_buffer, size_t key_buffer_size,
3297 psa_algorithm_t alg, const uint8_t *hash, size_t hash_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003298 const uint8_t *signature, size_t signature_length)
itayzafrir5c753392018-05-08 11:18:38 +03003299{
Gilles Peskine2f107ae2024-02-28 01:26:46 +01003300 if (PSA_KEY_TYPE_IS_RSA(attributes->type)) {
Gilles Peskine449bd832023-01-11 14:50:10 +01003301 if (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) ||
3302 PSA_ALG_IS_RSA_PSS(alg)) {
Ronald Cron4501c982021-03-19 20:09:32 +01003303#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01003304 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
3305 return mbedtls_psa_rsa_verify_hash(
3306 attributes,
3307 key_buffer, key_buffer_size,
3308 alg, hash, hash_length,
3309 signature, signature_length);
Ronald Cron4501c982021-03-19 20:09:32 +01003310#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
3311 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
Gilles Peskine449bd832023-01-11 14:50:10 +01003312 } else {
3313 return PSA_ERROR_INVALID_ARGUMENT;
Steven Cooremanacda8342020-07-24 23:09:52 +02003314 }
Gilles Peskine2f107ae2024-02-28 01:26:46 +01003315 } else if (PSA_KEY_TYPE_IS_ECC(attributes->type)) {
Gilles Peskine449bd832023-01-11 14:50:10 +01003316 if (PSA_ALG_IS_ECDSA(alg)) {
Ronald Cron4501c982021-03-19 20:09:32 +01003317#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01003318 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
3319 return mbedtls_psa_ecdsa_verify_hash(
3320 attributes,
3321 key_buffer, key_buffer_size,
3322 alg, hash, hash_length,
3323 signature, signature_length);
Ronald Cron4501c982021-03-19 20:09:32 +01003324#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3325 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Gilles Peskine449bd832023-01-11 14:50:10 +01003326 } else {
3327 return PSA_ERROR_INVALID_ARGUMENT;
Ronald Cron4501c982021-03-19 20:09:32 +01003328 }
Ronald Cron8a494f32021-02-17 09:49:51 +01003329 }
Ronald Cron4501c982021-03-19 20:09:32 +01003330
Gilles Peskine449bd832023-01-11 14:50:10 +01003331 (void) key_buffer;
3332 (void) key_buffer_size;
3333 (void) hash;
3334 (void) hash_length;
3335 (void) signature;
3336 (void) signature_length;
Ronald Cron4501c982021-03-19 20:09:32 +01003337
Gilles Peskine449bd832023-01-11 14:50:10 +01003338 return PSA_ERROR_NOT_SUPPORTED;
Ronald Cron18659932020-12-08 16:32:23 +01003339}
3340
Gilles Peskine449bd832023-01-11 14:50:10 +01003341psa_status_t psa_verify_hash(mbedtls_svc_key_id_t key,
3342 psa_algorithm_t alg,
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003343 const uint8_t *hash_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01003344 size_t hash_length,
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003345 const uint8_t *signature_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01003346 size_t signature_length)
itayzafrir5c753392018-05-08 11:18:38 +03003347{
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003348 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3349 LOCAL_INPUT_DECLARE(hash_external, hash);
3350 LOCAL_INPUT_DECLARE(signature_external, signature);
3351
3352 LOCAL_INPUT_ALLOC(hash_external, hash_length, hash);
3353 LOCAL_INPUT_ALLOC(signature_external, signature_length, signature);
3354 status = psa_verify_internal(key, 0, alg, hash, hash_length, signature,
3355 signature_length);
3356
David Horstmann4a48bec2024-03-13 15:42:31 +00003357#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003358exit:
Thomas Daubney3e65f522024-01-30 12:37:25 +00003359#endif
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003360 LOCAL_INPUT_FREE(hash_external, hash);
3361 LOCAL_INPUT_FREE(signature_external, signature);
3362
3363 return status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01003364}
3365
Gilles Peskine449bd832023-01-11 14:50:10 +01003366psa_status_t psa_asymmetric_encrypt(mbedtls_svc_key_id_t key,
3367 psa_algorithm_t alg,
Thomas Daubney6adbb2a2024-01-18 18:10:32 +00003368 const uint8_t *input_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01003369 size_t input_length,
Thomas Daubney6adbb2a2024-01-18 18:10:32 +00003370 const uint8_t *salt_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01003371 size_t salt_length,
Thomas Daubney6adbb2a2024-01-18 18:10:32 +00003372 uint8_t *output_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01003373 size_t output_size,
3374 size_t *output_length)
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003375{
Ronald Cronf95a2b12020-10-22 15:24:49 +02003376 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01003377 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01003378 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003379
Thomas Daubney6adbb2a2024-01-18 18:10:32 +00003380 LOCAL_INPUT_DECLARE(input_external, input);
3381 LOCAL_INPUT_DECLARE(salt_external, salt);
3382 LOCAL_OUTPUT_DECLARE(output_external, output);
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003383
Darryl Green5cc689a2018-07-24 15:34:10 +01003384 (void) input;
3385 (void) input_length;
3386 (void) salt;
3387 (void) output;
3388 (void) output_size;
3389
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03003390 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003391
Gilles Peskine449bd832023-01-11 14:50:10 +01003392 if (!PSA_ALG_IS_RSA_OAEP(alg) && salt_length != 0) {
3393 return PSA_ERROR_INVALID_ARGUMENT;
3394 }
Gilles Peskineb3fc05d2018-06-30 19:04:35 +02003395
Valerio Setti5bb454a2024-01-15 10:43:16 +01003396 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01003397 key, &slot, PSA_KEY_USAGE_ENCRYPT, alg);
3398 if (status != PSA_SUCCESS) {
3399 return status;
3400 }
3401 if (!(PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type) ||
3402 PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type))) {
Ronald Cronf95a2b12020-10-22 15:24:49 +02003403 status = PSA_ERROR_INVALID_ARGUMENT;
3404 goto exit;
3405 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003406
Thomas Daubney6adbb2a2024-01-18 18:10:32 +00003407 LOCAL_INPUT_ALLOC(input_external, input_length, input);
3408 LOCAL_INPUT_ALLOC(salt_external, salt_length, salt);
3409 LOCAL_OUTPUT_ALLOC(output_external, output_size, output);
David Horstmann93fa4e12024-03-12 15:02:28 +00003410
Przemyslaw Stekiel19e61422021-12-09 11:09:11 +01003411 status = psa_driver_wrapper_asymmetric_encrypt(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01003412 &slot->attr, slot->key.data, slot->key.bytes,
Przemyslaw Stekiel19e61422021-12-09 11:09:11 +01003413 alg, input, input_length, salt, salt_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003414 output, output_size, output_length);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003415exit:
Ryan Everetta103ec92024-01-31 13:59:57 +00003416 unlock_status = psa_unregister_read_under_mutex(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003417
Thomas Daubney6adbb2a2024-01-18 18:10:32 +00003418 LOCAL_INPUT_FREE(input_external, input);
3419 LOCAL_INPUT_FREE(salt_external, salt);
3420 LOCAL_OUTPUT_FREE(output_external, output);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003421
Gilles Peskine449bd832023-01-11 14:50:10 +01003422 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine5b051bc2018-05-31 13:25:48 +02003423}
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003424
Gilles Peskine449bd832023-01-11 14:50:10 +01003425psa_status_t psa_asymmetric_decrypt(mbedtls_svc_key_id_t key,
3426 psa_algorithm_t alg,
Thomas Daubney6adbb2a2024-01-18 18:10:32 +00003427 const uint8_t *input_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01003428 size_t input_length,
Thomas Daubney6adbb2a2024-01-18 18:10:32 +00003429 const uint8_t *salt_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01003430 size_t salt_length,
Thomas Daubney6adbb2a2024-01-18 18:10:32 +00003431 uint8_t *output_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01003432 size_t output_size,
3433 size_t *output_length)
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003434{
Ronald Cronf95a2b12020-10-22 15:24:49 +02003435 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01003436 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01003437 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003438
Thomas Daubney6adbb2a2024-01-18 18:10:32 +00003439 LOCAL_INPUT_DECLARE(input_external, input);
3440 LOCAL_INPUT_DECLARE(salt_external, salt);
3441 LOCAL_OUTPUT_DECLARE(output_external, output);
3442
Darryl Green5cc689a2018-07-24 15:34:10 +01003443 (void) input;
3444 (void) input_length;
3445 (void) salt;
3446 (void) output;
3447 (void) output_size;
3448
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03003449 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003450
Gilles Peskine449bd832023-01-11 14:50:10 +01003451 if (!PSA_ALG_IS_RSA_OAEP(alg) && salt_length != 0) {
3452 return PSA_ERROR_INVALID_ARGUMENT;
3453 }
Gilles Peskineb3fc05d2018-06-30 19:04:35 +02003454
Valerio Setti5bb454a2024-01-15 10:43:16 +01003455 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01003456 key, &slot, PSA_KEY_USAGE_DECRYPT, alg);
3457 if (status != PSA_SUCCESS) {
3458 return status;
3459 }
3460 if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) {
Ronald Cronf95a2b12020-10-22 15:24:49 +02003461 status = PSA_ERROR_INVALID_ARGUMENT;
3462 goto exit;
3463 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003464
Thomas Daubney6adbb2a2024-01-18 18:10:32 +00003465 LOCAL_INPUT_ALLOC(input_external, input_length, input);
3466 LOCAL_INPUT_ALLOC(salt_external, salt_length, salt);
3467 LOCAL_OUTPUT_ALLOC(output_external, output_size, output);
David Horstmann93fa4e12024-03-12 15:02:28 +00003468
Przemyslaw Stekiel8d45c002021-12-13 08:58:19 +01003469 status = psa_driver_wrapper_asymmetric_decrypt(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01003470 &slot->attr, slot->key.data, slot->key.bytes,
Przemyslaw Stekiel8d45c002021-12-13 08:58:19 +01003471 alg, input, input_length, salt, salt_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003472 output, output_size, output_length);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003473
3474exit:
Ryan Everetta103ec92024-01-31 13:59:57 +00003475 unlock_status = psa_unregister_read_under_mutex(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003476
Thomas Daubney6adbb2a2024-01-18 18:10:32 +00003477 LOCAL_INPUT_FREE(input_external, input);
3478 LOCAL_INPUT_FREE(salt_external, salt);
3479 LOCAL_OUTPUT_FREE(output_external, output);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003480
Gilles Peskine449bd832023-01-11 14:50:10 +01003481 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine5b051bc2018-05-31 13:25:48 +02003482}
Gilles Peskinee59236f2018-01-27 23:32:46 +01003483
Paul Elliott9fe12f62022-11-30 19:16:02 +00003484/****************************************************************/
3485/* Asymmetric interruptible cryptography */
3486/****************************************************************/
3487
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003488static uint32_t psa_interruptible_max_ops = PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED;
3489
Paul Elliott9fe12f62022-11-30 19:16:02 +00003490void psa_interruptible_set_max_ops(uint32_t max_ops)
3491{
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003492 psa_interruptible_max_ops = max_ops;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003493}
3494
3495uint32_t psa_interruptible_get_max_ops(void)
3496{
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003497 return psa_interruptible_max_ops;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003498}
3499
Paul Elliott9fe12f62022-11-30 19:16:02 +00003500uint32_t psa_sign_hash_get_num_ops(
3501 const psa_sign_hash_interruptible_operation_t *operation)
3502{
Paul Elliott296ede92022-12-15 17:00:30 +00003503 return operation->num_ops;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003504}
3505
3506uint32_t psa_verify_hash_get_num_ops(
3507 const psa_verify_hash_interruptible_operation_t *operation)
3508{
Paul Elliott296ede92022-12-15 17:00:30 +00003509 return operation->num_ops;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003510}
3511
Paul Elliott59ad9452022-12-18 15:09:02 +00003512static psa_status_t psa_sign_hash_abort_internal(
3513 psa_sign_hash_interruptible_operation_t *operation)
3514{
3515 if (operation->id == 0) {
3516 /* The object has (apparently) been initialized but it is not (yet)
3517 * in use. It's ok to call abort on such an object, and there's
3518 * nothing to do. */
3519 return PSA_SUCCESS;
3520 }
3521
3522 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3523
3524 status = psa_driver_wrapper_sign_hash_abort(operation);
3525
3526 operation->id = 0;
3527
Paul Elliotte6145dc2023-02-07 12:51:21 +00003528 /* Do not clear either the error_occurred or num_ops elements here as they
3529 * only want to be cleared by the application calling abort, not by abort
3530 * being called at completion of an operation. */
3531
Paul Elliott59ad9452022-12-18 15:09:02 +00003532 return status;
3533}
3534
Paul Elliott9fe12f62022-11-30 19:16:02 +00003535psa_status_t psa_sign_hash_start(
3536 psa_sign_hash_interruptible_operation_t *operation,
3537 mbedtls_svc_key_id_t key, psa_algorithm_t alg,
David Horstmann4a523a62024-03-11 13:32:16 +00003538 const uint8_t *hash_external, size_t hash_length)
Paul Elliott9fe12f62022-11-30 19:16:02 +00003539{
3540 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3541 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
3542 psa_key_slot_t *slot;
3543
David Horstmann4a523a62024-03-11 13:32:16 +00003544 LOCAL_INPUT_DECLARE(hash_external, hash);
3545
Paul Elliottc9774412023-02-06 15:14:07 +00003546 /* Check that start has not been previously called, or operation has not
3547 * previously errored. */
3548 if (operation->id != 0 || operation->error_occurred) {
Paul Elliott9fe12f62022-11-30 19:16:02 +00003549 return PSA_ERROR_BAD_STATE;
3550 }
3551
Paul Elliott9fe12f62022-11-30 19:16:02 +00003552 status = psa_sign_verify_check_alg(0, alg);
3553 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003554 operation->error_occurred = 1;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003555 return status;
3556 }
3557
3558 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
3559 PSA_KEY_USAGE_SIGN_HASH,
3560 alg);
3561
3562 if (status != PSA_SUCCESS) {
3563 goto exit;
3564 }
3565
3566 if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) {
3567 status = PSA_ERROR_INVALID_ARGUMENT;
3568 goto exit;
3569 }
3570
David Horstmann4a523a62024-03-11 13:32:16 +00003571 LOCAL_INPUT_ALLOC(hash_external, hash_length, hash);
3572
Paul Elliott296ede92022-12-15 17:00:30 +00003573 /* Ensure ops count gets reset, in case of operation re-use. */
3574 operation->num_ops = 0;
3575
Gilles Peskine7a5d9202024-02-28 01:18:23 +01003576 status = psa_driver_wrapper_sign_hash_start(operation, &slot->attr,
Paul Elliott9fe12f62022-11-30 19:16:02 +00003577 slot->key.data,
3578 slot->key.bytes, alg,
3579 hash, hash_length);
3580exit:
3581
3582 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003583 operation->error_occurred = 1;
Paul Elliott59ad9452022-12-18 15:09:02 +00003584 psa_sign_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003585 }
3586
Ryan Everettdcc03d52024-02-14 15:44:13 +00003587 unlock_status = psa_unregister_read_under_mutex(slot);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003588
Paul Elliottc9774412023-02-06 15:14:07 +00003589 if (unlock_status != PSA_SUCCESS) {
3590 operation->error_occurred = 1;
3591 }
Paul Elliott9fe12f62022-11-30 19:16:02 +00003592
David Horstmann4a523a62024-03-11 13:32:16 +00003593 LOCAL_INPUT_FREE(hash_external, hash);
3594
Paul Elliottc9774412023-02-06 15:14:07 +00003595 return (status == PSA_SUCCESS) ? unlock_status : status;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003596}
3597
3598
3599psa_status_t psa_sign_hash_complete(
3600 psa_sign_hash_interruptible_operation_t *operation,
David Horstmann4a523a62024-03-11 13:32:16 +00003601 uint8_t *signature_external, size_t signature_size,
Paul Elliott9fe12f62022-11-30 19:16:02 +00003602 size_t *signature_length)
3603{
3604 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3605
David Horstmann4a523a62024-03-11 13:32:16 +00003606 LOCAL_OUTPUT_DECLARE(signature_external, signature);
3607
Paul Elliott9fe12f62022-11-30 19:16:02 +00003608 *signature_length = 0;
3609
Paul Elliottc9774412023-02-06 15:14:07 +00003610 /* Check that start has been called first, and that operation has not
3611 * previously errored. */
3612 if (operation->id == 0 || operation->error_occurred) {
Paul Elliott9fe12f62022-11-30 19:16:02 +00003613 status = PSA_ERROR_BAD_STATE;
3614 goto exit;
3615 }
3616
Paul Elliott096abc42023-02-03 18:33:23 +00003617 /* Immediately reject a zero-length signature buffer. This guarantees that
3618 * signature must be a valid pointer. */
Paul Elliott9fe12f62022-11-30 19:16:02 +00003619 if (signature_size == 0) {
3620 status = PSA_ERROR_BUFFER_TOO_SMALL;
3621 goto exit;
3622 }
3623
David Horstmann4a523a62024-03-11 13:32:16 +00003624 LOCAL_OUTPUT_ALLOC(signature_external, signature_size, signature);
3625
Paul Elliott9fe12f62022-11-30 19:16:02 +00003626 status = psa_driver_wrapper_sign_hash_complete(operation, signature,
3627 signature_size,
3628 signature_length);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003629
Paul Elliott296ede92022-12-15 17:00:30 +00003630 /* Update ops count with work done. */
Paul Elliottde1114c2023-02-07 12:43:11 +00003631 operation->num_ops = psa_driver_wrapper_sign_hash_get_num_ops(operation);
Paul Elliott296ede92022-12-15 17:00:30 +00003632
Paul Elliottebe225c2023-02-10 14:32:53 +00003633exit:
3634
David Horstmannc5064c82024-03-11 17:02:03 +00003635 if (signature != NULL) {
3636 psa_wipe_tag_output_buffer(signature, status, signature_size,
3637 *signature_length);
3638 }
Paul Elliott9fe12f62022-11-30 19:16:02 +00003639
Paul Elliott53bb3122023-02-10 14:22:22 +00003640 if (status != PSA_OPERATION_INCOMPLETE) {
Paul Elliottc9774412023-02-06 15:14:07 +00003641 if (status != PSA_SUCCESS) {
3642 operation->error_occurred = 1;
3643 }
3644
Paul Elliott59ad9452022-12-18 15:09:02 +00003645 psa_sign_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003646 }
3647
David Horstmann4a523a62024-03-11 13:32:16 +00003648 LOCAL_OUTPUT_FREE(signature_external, signature);
3649
Paul Elliott9fe12f62022-11-30 19:16:02 +00003650 return status;
3651}
3652
3653psa_status_t psa_sign_hash_abort(
3654 psa_sign_hash_interruptible_operation_t *operation)
3655{
Paul Elliott59ad9452022-12-18 15:09:02 +00003656 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3657
3658 status = psa_sign_hash_abort_internal(operation);
3659
3660 /* We clear the number of ops done here, so that it is not cleared when
3661 * the operation fails or succeeds, only on manual abort. */
3662 operation->num_ops = 0;
3663
Paul Elliottc9774412023-02-06 15:14:07 +00003664 /* Likewise, failure state. */
3665 operation->error_occurred = 0;
3666
Paul Elliott59ad9452022-12-18 15:09:02 +00003667 return status;
3668}
3669
3670static psa_status_t psa_verify_hash_abort_internal(
3671 psa_verify_hash_interruptible_operation_t *operation)
3672{
Paul Elliott9fe12f62022-11-30 19:16:02 +00003673 if (operation->id == 0) {
3674 /* The object has (apparently) been initialized but it is not (yet)
3675 * in use. It's ok to call abort on such an object, and there's
3676 * nothing to do. */
3677 return PSA_SUCCESS;
3678 }
3679
Paul Elliott59ad9452022-12-18 15:09:02 +00003680 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3681
3682 status = psa_driver_wrapper_verify_hash_abort(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003683
3684 operation->id = 0;
3685
Paul Elliotte6145dc2023-02-07 12:51:21 +00003686 /* Do not clear either the error_occurred or num_ops elements here as they
3687 * only want to be cleared by the application calling abort, not by abort
3688 * being called at completion of an operation. */
3689
Paul Elliott59ad9452022-12-18 15:09:02 +00003690 return status;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003691}
3692
3693psa_status_t psa_verify_hash_start(
3694 psa_verify_hash_interruptible_operation_t *operation,
3695 mbedtls_svc_key_id_t key, psa_algorithm_t alg,
David Horstmann0fea6a52024-03-11 13:41:05 +00003696 const uint8_t *hash_external, size_t hash_length,
3697 const uint8_t *signature_external, size_t signature_length)
Paul Elliott9fe12f62022-11-30 19:16:02 +00003698{
3699 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3700 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
3701 psa_key_slot_t *slot;
3702
David Horstmann0fea6a52024-03-11 13:41:05 +00003703 LOCAL_INPUT_DECLARE(hash_external, hash);
3704 LOCAL_INPUT_DECLARE(signature_external, signature);
3705
Paul Elliottc9774412023-02-06 15:14:07 +00003706 /* Check that start has not been previously called, or operation has not
3707 * previously errored. */
3708 if (operation->id != 0 || operation->error_occurred) {
Paul Elliott9fe12f62022-11-30 19:16:02 +00003709 return PSA_ERROR_BAD_STATE;
3710 }
3711
3712 status = psa_sign_verify_check_alg(0, alg);
3713 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003714 operation->error_occurred = 1;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003715 return status;
3716 }
3717
3718 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
3719 PSA_KEY_USAGE_VERIFY_HASH,
3720 alg);
3721
3722 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003723 operation->error_occurred = 1;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003724 return status;
3725 }
3726
David Horstmann0fea6a52024-03-11 13:41:05 +00003727 LOCAL_INPUT_ALLOC(hash_external, hash_length, hash);
3728 LOCAL_INPUT_ALLOC(signature_external, signature_length, signature);
3729
Paul Elliott296ede92022-12-15 17:00:30 +00003730 /* Ensure ops count gets reset, in case of operation re-use. */
3731 operation->num_ops = 0;
3732
Gilles Peskine7a5d9202024-02-28 01:18:23 +01003733 status = psa_driver_wrapper_verify_hash_start(operation, &slot->attr,
Paul Elliott9fe12f62022-11-30 19:16:02 +00003734 slot->key.data,
3735 slot->key.bytes,
3736 alg, hash, hash_length,
3737 signature, signature_length);
David Horstmann4a48bec2024-03-13 15:42:31 +00003738#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
David Horstmann0fea6a52024-03-11 13:41:05 +00003739exit:
3740#endif
Paul Elliott9fe12f62022-11-30 19:16:02 +00003741
3742 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003743 operation->error_occurred = 1;
Paul Elliott59ad9452022-12-18 15:09:02 +00003744 psa_verify_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003745 }
3746
Ryan Everett291267f2024-02-14 15:59:15 +00003747 unlock_status = psa_unregister_read_under_mutex(slot);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003748
Paul Elliottc9774412023-02-06 15:14:07 +00003749 if (unlock_status != PSA_SUCCESS) {
3750 operation->error_occurred = 1;
3751 }
Paul Elliott9fe12f62022-11-30 19:16:02 +00003752
David Horstmann0fea6a52024-03-11 13:41:05 +00003753 LOCAL_INPUT_FREE(hash_external, hash);
3754 LOCAL_INPUT_FREE(signature_external, signature);
3755
Paul Elliottc9774412023-02-06 15:14:07 +00003756 return (status == PSA_SUCCESS) ? unlock_status : status;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003757}
3758
3759psa_status_t psa_verify_hash_complete(
3760 psa_verify_hash_interruptible_operation_t *operation)
3761{
3762 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3763
Paul Elliottc9774412023-02-06 15:14:07 +00003764 /* Check that start has been called first, and that operation has not
3765 * previously errored. */
3766 if (operation->id == 0 || operation->error_occurred) {
Paul Elliott9fe12f62022-11-30 19:16:02 +00003767 status = PSA_ERROR_BAD_STATE;
3768 goto exit;
3769 }
3770
3771 status = psa_driver_wrapper_verify_hash_complete(operation);
3772
Paul Elliott296ede92022-12-15 17:00:30 +00003773 /* Update ops count with work done. */
Paul Elliottde1114c2023-02-07 12:43:11 +00003774 operation->num_ops = psa_driver_wrapper_verify_hash_get_num_ops(
Paul Elliott296ede92022-12-15 17:00:30 +00003775 operation);
3776
Paul Elliottebe225c2023-02-10 14:32:53 +00003777exit:
3778
Paul Elliott9fe12f62022-11-30 19:16:02 +00003779 if (status != PSA_OPERATION_INCOMPLETE) {
Paul Elliottc9774412023-02-06 15:14:07 +00003780 if (status != PSA_SUCCESS) {
3781 operation->error_occurred = 1;
3782 }
3783
Paul Elliott59ad9452022-12-18 15:09:02 +00003784 psa_verify_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003785 }
3786
3787 return status;
3788}
3789
3790psa_status_t psa_verify_hash_abort(
3791 psa_verify_hash_interruptible_operation_t *operation)
3792{
Paul Elliott59ad9452022-12-18 15:09:02 +00003793 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003794
Paul Elliott59ad9452022-12-18 15:09:02 +00003795 status = psa_verify_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003796
Paul Elliott59ad9452022-12-18 15:09:02 +00003797 /* We clear the number of ops done here, so that it is not cleared when
3798 * the operation fails or succeeds, only on manual abort. */
3799 operation->num_ops = 0;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003800
Paul Elliottc9774412023-02-06 15:14:07 +00003801 /* Likewise, failure state. */
3802 operation->error_occurred = 0;
3803
Paul Elliott59ad9452022-12-18 15:09:02 +00003804 return status;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003805}
3806
Paul Elliott588f8ed2022-12-02 18:10:26 +00003807/****************************************************************/
3808/* Asymmetric interruptible cryptography internal */
3809/* implementations */
3810/****************************************************************/
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02003811
Paul Elliott588f8ed2022-12-02 18:10:26 +00003812void mbedtls_psa_interruptible_set_max_ops(uint32_t max_ops)
3813{
Paul Elliott7cc4e812023-01-10 17:14:11 +00003814
Paul Elliott588f8ed2022-12-02 18:10:26 +00003815#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3816 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3817 defined(MBEDTLS_ECP_RESTARTABLE)
3818
3819 /* Internal implementation uses zero to indicate infinite number max ops,
3820 * therefore avoid this value, and set to minimum possible. */
3821 if (max_ops == 0) {
3822 max_ops = 1;
3823 }
3824
Paul Elliott588f8ed2022-12-02 18:10:26 +00003825 mbedtls_ecp_set_max_ops(max_ops);
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003826#else
3827 (void) max_ops;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003828#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3829 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3830 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3831}
3832
Paul Elliott588f8ed2022-12-02 18:10:26 +00003833uint32_t mbedtls_psa_sign_hash_get_num_ops(
Paul Elliottf8e5b562023-02-19 18:43:45 +00003834 const mbedtls_psa_sign_hash_interruptible_operation_t *operation)
Paul Elliott588f8ed2022-12-02 18:10:26 +00003835{
3836#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3837 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3838 defined(MBEDTLS_ECP_RESTARTABLE)
3839
Paul Elliott93d9ca82023-02-15 18:14:21 +00003840 return operation->num_ops;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003841#else
3842 (void) operation;
3843 return 0;
3844#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3845 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3846 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3847}
3848
3849uint32_t mbedtls_psa_verify_hash_get_num_ops(
Paul Elliottf8e5b562023-02-19 18:43:45 +00003850 const mbedtls_psa_verify_hash_interruptible_operation_t *operation)
Paul Elliott588f8ed2022-12-02 18:10:26 +00003851{
3852 #if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3853 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3854 defined(MBEDTLS_ECP_RESTARTABLE)
3855
Paul Elliott93d9ca82023-02-15 18:14:21 +00003856 return operation->num_ops;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003857#else
3858 (void) operation;
3859 return 0;
3860#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3861 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3862 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3863}
3864
3865psa_status_t mbedtls_psa_sign_hash_start(
3866 mbedtls_psa_sign_hash_interruptible_operation_t *operation,
3867 const psa_key_attributes_t *attributes, const uint8_t *key_buffer,
3868 size_t key_buffer_size, psa_algorithm_t alg,
3869 const uint8_t *hash, size_t hash_length)
3870{
3871 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott0290a762023-02-09 14:30:24 +00003872 size_t required_hash_length;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003873
Gilles Peskine2f107ae2024-02-28 01:26:46 +01003874 if (!PSA_KEY_TYPE_IS_ECC(attributes->type)) {
Paul Elliott068fe072023-01-16 13:59:15 +00003875 return PSA_ERROR_NOT_SUPPORTED;
3876 }
3877
3878 if (!PSA_ALG_IS_ECDSA(alg)) {
Paul Elliott813f9cd2023-02-05 15:28:46 +00003879 return PSA_ERROR_NOT_SUPPORTED;
Paul Elliott068fe072023-01-16 13:59:15 +00003880 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003881
3882#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
Paul Elliott068fe072023-01-16 13:59:15 +00003883 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3884 defined(MBEDTLS_ECP_RESTARTABLE)
Paul Elliott588f8ed2022-12-02 18:10:26 +00003885
Paul Elliotta1c94092023-02-15 16:38:04 +00003886 mbedtls_ecdsa_restart_init(&operation->restart_ctx);
3887
Paul Elliott93d9ca82023-02-15 18:14:21 +00003888 /* Ensure num_ops is zero'ed in case of context re-use. */
3889 operation->num_ops = 0;
3890
Gilles Peskine2f107ae2024-02-28 01:26:46 +01003891 status = mbedtls_psa_ecp_load_representation(attributes->type,
3892 attributes->bits,
Paul Elliott068fe072023-01-16 13:59:15 +00003893 key_buffer,
3894 key_buffer_size,
3895 &operation->ctx);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003896
Paul Elliott068fe072023-01-16 13:59:15 +00003897 if (status != PSA_SUCCESS) {
3898 return status;
3899 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003900
Paul Elliott1bc59df2023-02-05 13:41:57 +00003901 operation->coordinate_bytes = PSA_BITS_TO_BYTES(
Paul Elliottc569fc22023-02-10 13:02:54 +00003902 operation->ctx->grp.nbits);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003903
Paul Elliott068fe072023-01-16 13:59:15 +00003904 psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH(alg);
Manuel Pégourié-Gonnard2d6d9932023-03-28 11:38:08 +02003905 operation->md_alg = mbedtls_md_type_from_psa_alg(hash_alg);
Paul Elliott068fe072023-01-16 13:59:15 +00003906 operation->alg = alg;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003907
Paul Elliott0290a762023-02-09 14:30:24 +00003908 /* We only need to store the same length of hash as the private key size
3909 * here, it would be truncated by the internal implementation anyway. */
3910 required_hash_length = (hash_length < operation->coordinate_bytes ?
3911 hash_length : operation->coordinate_bytes);
3912
Paul Elliottba70ad42023-02-15 18:23:53 +00003913 if (required_hash_length > sizeof(operation->hash)) {
3914 /* Shouldn't happen, but better safe than sorry. */
3915 return PSA_ERROR_CORRUPTION_DETECTED;
3916 }
3917
Paul Elliott0290a762023-02-09 14:30:24 +00003918 memcpy(operation->hash, hash, required_hash_length);
3919 operation->hash_length = required_hash_length;
Paul Elliott068fe072023-01-16 13:59:15 +00003920
3921 return PSA_SUCCESS;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003922
3923#else
Paul Elliott068fe072023-01-16 13:59:15 +00003924 (void) operation;
3925 (void) key_buffer;
3926 (void) key_buffer_size;
3927 (void) alg;
3928 (void) hash;
3929 (void) hash_length;
3930 (void) status;
Paul Elliott0290a762023-02-09 14:30:24 +00003931 (void) required_hash_length;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003932
Paul Elliott068fe072023-01-16 13:59:15 +00003933 return PSA_ERROR_NOT_SUPPORTED;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003934#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3935 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3936 * defined( MBEDTLS_ECP_RESTARTABLE ) */
Paul Elliott588f8ed2022-12-02 18:10:26 +00003937}
3938
3939psa_status_t mbedtls_psa_sign_hash_complete(
3940 mbedtls_psa_sign_hash_interruptible_operation_t *operation,
3941 uint8_t *signature, size_t signature_size,
3942 size_t *signature_length)
3943{
Paul Elliott588f8ed2022-12-02 18:10:26 +00003944#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3945 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3946 defined(MBEDTLS_ECP_RESTARTABLE)
3947
Paul Elliotta1c94092023-02-15 16:38:04 +00003948 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott1243f932023-02-07 11:21:10 +00003949 mbedtls_mpi r;
3950 mbedtls_mpi s;
3951
Paul Elliott46845252023-02-03 14:59:11 +00003952 mbedtls_mpi_init(&r);
3953 mbedtls_mpi_init(&s);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003954
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003955 /* Ensure max_ops is set to the current value (or default). */
3956 mbedtls_psa_interruptible_set_max_ops(psa_interruptible_get_max_ops());
3957
Paul Elliotta1c94092023-02-15 16:38:04 +00003958 if (signature_size < 2 * operation->coordinate_bytes) {
3959 status = PSA_ERROR_BUFFER_TOO_SMALL;
3960 goto exit;
3961 }
3962
Paul Elliott588f8ed2022-12-02 18:10:26 +00003963 if (PSA_ALG_ECDSA_IS_DETERMINISTIC(operation->alg)) {
Paul Elliott46845252023-02-03 14:59:11 +00003964
Paul Elliott588f8ed2022-12-02 18:10:26 +00003965#if defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
3966 status = mbedtls_to_psa_error(
3967 mbedtls_ecdsa_sign_det_restartable(&operation->ctx->grp,
Paul Elliott46845252023-02-03 14:59:11 +00003968 &r,
3969 &s,
Paul Elliott588f8ed2022-12-02 18:10:26 +00003970 &operation->ctx->d,
3971 operation->hash,
3972 operation->hash_length,
3973 operation->md_alg,
3974 mbedtls_psa_get_random,
3975 MBEDTLS_PSA_RANDOM_STATE,
3976 &operation->restart_ctx));
3977#else /* defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Paul Elliott724bd252023-02-08 12:35:08 +00003978 status = PSA_ERROR_NOT_SUPPORTED;
3979 goto exit;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003980#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
3981 } else {
Paul Elliott588f8ed2022-12-02 18:10:26 +00003982 status = mbedtls_to_psa_error(
3983 mbedtls_ecdsa_sign_restartable(&operation->ctx->grp,
Paul Elliott46845252023-02-03 14:59:11 +00003984 &r,
3985 &s,
Paul Elliott588f8ed2022-12-02 18:10:26 +00003986 &operation->ctx->d,
3987 operation->hash,
3988 operation->hash_length,
3989 mbedtls_psa_get_random,
3990 MBEDTLS_PSA_RANDOM_STATE,
3991 mbedtls_psa_get_random,
3992 MBEDTLS_PSA_RANDOM_STATE,
3993 &operation->restart_ctx));
3994 }
3995
Paul Elliottf8e5b562023-02-19 18:43:45 +00003996 /* Hide the fact that the restart context only holds a delta of number of
3997 * ops done during the last operation, not an absolute value. */
3998 operation->num_ops += operation->restart_ctx.ecp.ops_done;
3999
Paul Elliott724bd252023-02-08 12:35:08 +00004000 if (status == PSA_SUCCESS) {
Paul Elliott588f8ed2022-12-02 18:10:26 +00004001 status = mbedtls_to_psa_error(
Paul Elliott46845252023-02-03 14:59:11 +00004002 mbedtls_mpi_write_binary(&r,
Paul Elliott588f8ed2022-12-02 18:10:26 +00004003 signature,
Paul Elliott1bc59df2023-02-05 13:41:57 +00004004 operation->coordinate_bytes)
4005 );
Paul Elliott588f8ed2022-12-02 18:10:26 +00004006
4007 if (status != PSA_SUCCESS) {
Paul Elliott724bd252023-02-08 12:35:08 +00004008 goto exit;
Paul Elliott588f8ed2022-12-02 18:10:26 +00004009 }
4010
4011 status = mbedtls_to_psa_error(
Paul Elliott46845252023-02-03 14:59:11 +00004012 mbedtls_mpi_write_binary(&s,
Paul Elliott588f8ed2022-12-02 18:10:26 +00004013 signature +
Paul Elliott1bc59df2023-02-05 13:41:57 +00004014 operation->coordinate_bytes,
4015 operation->coordinate_bytes)
4016 );
Paul Elliott588f8ed2022-12-02 18:10:26 +00004017
4018 if (status != PSA_SUCCESS) {
Paul Elliott724bd252023-02-08 12:35:08 +00004019 goto exit;
Paul Elliott588f8ed2022-12-02 18:10:26 +00004020 }
4021
Paul Elliott1bc59df2023-02-05 13:41:57 +00004022 *signature_length = operation->coordinate_bytes * 2;
Paul Elliott588f8ed2022-12-02 18:10:26 +00004023
Paul Elliott724bd252023-02-08 12:35:08 +00004024 status = PSA_SUCCESS;
Paul Elliott588f8ed2022-12-02 18:10:26 +00004025 }
Paul Elliott724bd252023-02-08 12:35:08 +00004026
4027exit:
4028
4029 mbedtls_mpi_free(&r);
4030 mbedtls_mpi_free(&s);
4031 return status;
4032
Paul Elliott588f8ed2022-12-02 18:10:26 +00004033 #else
4034
4035 (void) operation;
Paul Elliott588f8ed2022-12-02 18:10:26 +00004036 (void) signature;
4037 (void) signature_size;
4038 (void) signature_length;
4039
4040 return PSA_ERROR_NOT_SUPPORTED;
4041
4042#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
4043 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
4044 * defined( MBEDTLS_ECP_RESTARTABLE ) */
4045}
4046
4047psa_status_t mbedtls_psa_sign_hash_abort(
4048 mbedtls_psa_sign_hash_interruptible_operation_t *operation)
4049{
4050
4051#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
4052 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
4053 defined(MBEDTLS_ECP_RESTARTABLE)
4054
4055 if (operation->ctx) {
4056 mbedtls_ecdsa_free(operation->ctx);
4057 mbedtls_free(operation->ctx);
Paul Elliottf9c91a72023-02-05 18:06:38 +00004058 operation->ctx = NULL;
Paul Elliott588f8ed2022-12-02 18:10:26 +00004059 }
4060
4061 mbedtls_ecdsa_restart_free(&operation->restart_ctx);
4062
Paul Elliott93d9ca82023-02-15 18:14:21 +00004063 operation->num_ops = 0;
4064
Paul Elliott588f8ed2022-12-02 18:10:26 +00004065 return PSA_SUCCESS;
4066
4067#else
4068
4069 (void) operation;
4070
4071 return PSA_ERROR_NOT_SUPPORTED;
4072
4073#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
4074 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
4075 * defined( MBEDTLS_ECP_RESTARTABLE ) */
4076}
4077
4078psa_status_t mbedtls_psa_verify_hash_start(
4079 mbedtls_psa_verify_hash_interruptible_operation_t *operation,
4080 const psa_key_attributes_t *attributes,
4081 const uint8_t *key_buffer, size_t key_buffer_size,
4082 psa_algorithm_t alg,
4083 const uint8_t *hash, size_t hash_length,
4084 const uint8_t *signature, size_t signature_length)
4085{
4086 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott1bc59df2023-02-05 13:41:57 +00004087 size_t coordinate_bytes = 0;
Paul Elliott0290a762023-02-09 14:30:24 +00004088 size_t required_hash_length = 0;
Paul Elliott588f8ed2022-12-02 18:10:26 +00004089
Gilles Peskine2f107ae2024-02-28 01:26:46 +01004090 if (!PSA_KEY_TYPE_IS_ECC(attributes->type)) {
Paul Elliott068fe072023-01-16 13:59:15 +00004091 return PSA_ERROR_NOT_SUPPORTED;
4092 }
4093
4094 if (!PSA_ALG_IS_ECDSA(alg)) {
Paul Elliott813f9cd2023-02-05 15:28:46 +00004095 return PSA_ERROR_NOT_SUPPORTED;
Paul Elliott068fe072023-01-16 13:59:15 +00004096 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00004097
4098#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
Paul Elliott068fe072023-01-16 13:59:15 +00004099 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
4100 defined(MBEDTLS_ECP_RESTARTABLE)
Paul Elliott588f8ed2022-12-02 18:10:26 +00004101
Paul Elliotta1c94092023-02-15 16:38:04 +00004102 mbedtls_ecdsa_restart_init(&operation->restart_ctx);
4103 mbedtls_mpi_init(&operation->r);
4104 mbedtls_mpi_init(&operation->s);
4105
Paul Elliott93d9ca82023-02-15 18:14:21 +00004106 /* Ensure num_ops is zero'ed in case of context re-use. */
4107 operation->num_ops = 0;
4108
Gilles Peskine2f107ae2024-02-28 01:26:46 +01004109 status = mbedtls_psa_ecp_load_representation(attributes->type,
4110 attributes->bits,
Paul Elliott068fe072023-01-16 13:59:15 +00004111 key_buffer,
4112 key_buffer_size,
4113 &operation->ctx);
Paul Elliott588f8ed2022-12-02 18:10:26 +00004114
Paul Elliott068fe072023-01-16 13:59:15 +00004115 if (status != PSA_SUCCESS) {
4116 return status;
4117 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00004118
Paul Elliottc569fc22023-02-10 13:02:54 +00004119 coordinate_bytes = PSA_BITS_TO_BYTES(operation->ctx->grp.nbits);
Paul Elliott588f8ed2022-12-02 18:10:26 +00004120
Paul Elliott1bc59df2023-02-05 13:41:57 +00004121 if (signature_length != 2 * coordinate_bytes) {
Paul Elliott068fe072023-01-16 13:59:15 +00004122 return PSA_ERROR_INVALID_SIGNATURE;
4123 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00004124
Paul Elliott068fe072023-01-16 13:59:15 +00004125 status = mbedtls_to_psa_error(
4126 mbedtls_mpi_read_binary(&operation->r,
4127 signature,
Paul Elliott1bc59df2023-02-05 13:41:57 +00004128 coordinate_bytes));
Paul Elliott588f8ed2022-12-02 18:10:26 +00004129
Paul Elliott068fe072023-01-16 13:59:15 +00004130 if (status != PSA_SUCCESS) {
4131 return status;
4132 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00004133
Paul Elliott068fe072023-01-16 13:59:15 +00004134 status = mbedtls_to_psa_error(
4135 mbedtls_mpi_read_binary(&operation->s,
4136 signature +
Paul Elliott1bc59df2023-02-05 13:41:57 +00004137 coordinate_bytes,
4138 coordinate_bytes));
Paul Elliott588f8ed2022-12-02 18:10:26 +00004139
Paul Elliott068fe072023-01-16 13:59:15 +00004140 if (status != PSA_SUCCESS) {
4141 return status;
4142 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00004143
Paul Elliott2c9843f2023-02-15 17:32:42 +00004144 status = mbedtls_psa_ecp_load_public_part(operation->ctx);
Paul Elliott588f8ed2022-12-02 18:10:26 +00004145
Paul Elliott2c9843f2023-02-15 17:32:42 +00004146 if (status != PSA_SUCCESS) {
4147 return status;
Paul Elliott068fe072023-01-16 13:59:15 +00004148 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00004149
Paul Elliott0290a762023-02-09 14:30:24 +00004150 /* We only need to store the same length of hash as the private key size
4151 * here, it would be truncated by the internal implementation anyway. */
4152 required_hash_length = (hash_length < coordinate_bytes ? hash_length :
4153 coordinate_bytes);
4154
Paul Elliottba70ad42023-02-15 18:23:53 +00004155 if (required_hash_length > sizeof(operation->hash)) {
4156 /* Shouldn't happen, but better safe than sorry. */
4157 return PSA_ERROR_CORRUPTION_DETECTED;
4158 }
4159
Paul Elliott0290a762023-02-09 14:30:24 +00004160 memcpy(operation->hash, hash, required_hash_length);
4161 operation->hash_length = required_hash_length;
Paul Elliott068fe072023-01-16 13:59:15 +00004162
4163 return PSA_SUCCESS;
Paul Elliott588f8ed2022-12-02 18:10:26 +00004164#else
Paul Elliott068fe072023-01-16 13:59:15 +00004165 (void) operation;
4166 (void) key_buffer;
4167 (void) key_buffer_size;
4168 (void) alg;
4169 (void) hash;
4170 (void) hash_length;
4171 (void) signature;
4172 (void) signature_length;
4173 (void) status;
Paul Elliott1243f932023-02-07 11:21:10 +00004174 (void) coordinate_bytes;
Paul Elliott0290a762023-02-09 14:30:24 +00004175 (void) required_hash_length;
Paul Elliott588f8ed2022-12-02 18:10:26 +00004176
Paul Elliott068fe072023-01-16 13:59:15 +00004177 return PSA_ERROR_NOT_SUPPORTED;
Paul Elliott588f8ed2022-12-02 18:10:26 +00004178#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
4179 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
4180 * defined( MBEDTLS_ECP_RESTARTABLE ) */
Paul Elliott588f8ed2022-12-02 18:10:26 +00004181}
4182
4183psa_status_t mbedtls_psa_verify_hash_complete(
4184 mbedtls_psa_verify_hash_interruptible_operation_t *operation)
4185{
4186
4187#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
4188 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
4189 defined(MBEDTLS_ECP_RESTARTABLE)
4190
Paul Elliottf8e5b562023-02-19 18:43:45 +00004191 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4192
Paul Elliotta16ce9f2023-02-21 14:19:23 +00004193 /* Ensure max_ops is set to the current value (or default). */
4194 mbedtls_psa_interruptible_set_max_ops(psa_interruptible_get_max_ops());
4195
Paul Elliottf8e5b562023-02-19 18:43:45 +00004196 status = mbedtls_to_psa_error(
Paul Elliott588f8ed2022-12-02 18:10:26 +00004197 mbedtls_ecdsa_verify_restartable(&operation->ctx->grp,
4198 operation->hash,
4199 operation->hash_length,
4200 &operation->ctx->Q,
4201 &operation->r,
4202 &operation->s,
4203 &operation->restart_ctx));
4204
Paul Elliottf8e5b562023-02-19 18:43:45 +00004205 /* Hide the fact that the restart context only holds a delta of number of
4206 * ops done during the last operation, not an absolute value. */
4207 operation->num_ops += operation->restart_ctx.ecp.ops_done;
4208
4209 return status;
Paul Elliott588f8ed2022-12-02 18:10:26 +00004210#else
4211 (void) operation;
4212
4213 return PSA_ERROR_NOT_SUPPORTED;
4214
4215#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
4216 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
4217 * defined( MBEDTLS_ECP_RESTARTABLE ) */
4218}
4219
4220psa_status_t mbedtls_psa_verify_hash_abort(
4221 mbedtls_psa_verify_hash_interruptible_operation_t *operation)
4222{
4223
4224#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
4225 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
4226 defined(MBEDTLS_ECP_RESTARTABLE)
4227
4228 if (operation->ctx) {
4229 mbedtls_ecdsa_free(operation->ctx);
4230 mbedtls_free(operation->ctx);
Paul Elliottf9c91a72023-02-05 18:06:38 +00004231 operation->ctx = NULL;
Paul Elliott588f8ed2022-12-02 18:10:26 +00004232 }
4233
4234 mbedtls_ecdsa_restart_free(&operation->restart_ctx);
4235
Paul Elliott93d9ca82023-02-15 18:14:21 +00004236 operation->num_ops = 0;
4237
Paul Elliott588f8ed2022-12-02 18:10:26 +00004238 mbedtls_mpi_free(&operation->r);
4239 mbedtls_mpi_free(&operation->s);
4240
4241 return PSA_SUCCESS;
4242
4243#else
4244 (void) operation;
4245
4246 return PSA_ERROR_NOT_SUPPORTED;
4247
4248#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
4249 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
4250 * defined( MBEDTLS_ECP_RESTARTABLE ) */
4251}
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02004252
David Horstmann6e99bb22024-02-06 15:27:49 +00004253static psa_status_t psa_generate_random_internal(uint8_t *output,
4254 size_t output_size)
4255{
4256 GUARD_MODULE_INITIALIZED;
4257
David Horstmann6e99bb22024-02-06 15:27:49 +00004258#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
4259
David Horstmanndb909142024-03-12 16:07:08 +00004260 psa_status_t status;
David Horstmann6e99bb22024-02-06 15:27:49 +00004261 size_t output_length = 0;
4262 status = mbedtls_psa_external_get_random(&global_data.rng,
4263 output, output_size,
4264 &output_length);
4265 if (status != PSA_SUCCESS) {
David Horstmanndb909142024-03-12 16:07:08 +00004266 return status;
David Horstmann6e99bb22024-02-06 15:27:49 +00004267 }
4268 /* Breaking up a request into smaller chunks is currently not supported
4269 * for the external RNG interface. */
4270 if (output_length != output_size) {
David Horstmanndb909142024-03-12 16:07:08 +00004271 return PSA_ERROR_INSUFFICIENT_ENTROPY;
David Horstmann6e99bb22024-02-06 15:27:49 +00004272 }
David Horstmanndb909142024-03-12 16:07:08 +00004273 return PSA_SUCCESS;
David Horstmann6e99bb22024-02-06 15:27:49 +00004274
4275#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
4276
4277 while (output_size > 0) {
David Horstmann93fa4e12024-03-12 15:02:28 +00004278 int ret = MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED;
David Horstmann6e99bb22024-02-06 15:27:49 +00004279 size_t request_size =
4280 (output_size > MBEDTLS_PSA_RANDOM_MAX_REQUEST ?
4281 MBEDTLS_PSA_RANDOM_MAX_REQUEST :
4282 output_size);
David Horstmann93fa4e12024-03-12 15:02:28 +00004283#if defined(MBEDTLS_CTR_DRBG_C)
4284 ret = mbedtls_ctr_drbg_random(&global_data.rng.drbg, output, request_size);
4285#elif defined(MBEDTLS_HMAC_DRBG_C)
4286 ret = mbedtls_hmac_drbg_random(&global_data.rng.drbg, output, request_size);
4287#endif /* !MBEDTLS_CTR_DRBG_C && !MBEDTLS_HMAC_DRBG_C */
David Horstmann6e99bb22024-02-06 15:27:49 +00004288 if (ret != 0) {
David Horstmann93fa4e12024-03-12 15:02:28 +00004289 return mbedtls_to_psa_error(ret);
David Horstmann6e99bb22024-02-06 15:27:49 +00004290 }
4291 output_size -= request_size;
4292 output += request_size;
4293 }
David Horstmann93fa4e12024-03-12 15:02:28 +00004294 return PSA_SUCCESS;
David Horstmann6e99bb22024-02-06 15:27:49 +00004295#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
David Horstmann6e99bb22024-02-06 15:27:49 +00004296}
4297
4298
mohammad1603503973b2018-03-12 15:59:30 +02004299/****************************************************************/
4300/* Symmetric cryptography */
4301/****************************************************************/
4302
Gilles Peskine449bd832023-01-11 14:50:10 +01004303static psa_status_t psa_cipher_setup(psa_cipher_operation_t *operation,
4304 mbedtls_svc_key_id_t key,
4305 psa_algorithm_t alg,
4306 mbedtls_operation_t cipher_operation)
Ronald Cronab99ac22020-10-01 16:38:28 +02004307{
4308 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4309 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Dave Rodgman54648242021-06-24 11:49:45 +01004310 psa_key_slot_t *slot = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01004311 psa_key_usage_t usage = (cipher_operation == MBEDTLS_ENCRYPT ?
4312 PSA_KEY_USAGE_ENCRYPT :
4313 PSA_KEY_USAGE_DECRYPT);
Ronald Cronab99ac22020-10-01 16:38:28 +02004314
4315 /* A context must be freshly initialized before it can be set up. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004316 if (operation->id != 0) {
Dave Rodgman54648242021-06-24 11:49:45 +01004317 status = PSA_ERROR_BAD_STATE;
4318 goto exit;
4319 }
Ronald Cronab99ac22020-10-01 16:38:28 +02004320
Gilles Peskine449bd832023-01-11 14:50:10 +01004321 if (!PSA_ALG_IS_CIPHER(alg)) {
Dave Rodgman54648242021-06-24 11:49:45 +01004322 status = PSA_ERROR_INVALID_ARGUMENT;
4323 goto exit;
4324 }
Ronald Cronab99ac22020-10-01 16:38:28 +02004325
Gilles Peskine449bd832023-01-11 14:50:10 +01004326 status = psa_get_and_lock_key_slot_with_policy(key, &slot, usage, alg);
4327 if (status != PSA_SUCCESS) {
Ronald Cronab99ac22020-10-01 16:38:28 +02004328 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004329 }
Ronald Cronab99ac22020-10-01 16:38:28 +02004330
Ronald Cron49fafa92021-03-10 08:34:23 +01004331 /* Initialize the operation struct members, except for id. The id member
Ronald Cronab99ac22020-10-01 16:38:28 +02004332 * is used to indicate to psa_cipher_abort that there are resources to free,
Ronald Cron49fafa92021-03-10 08:34:23 +01004333 * so we only set it (in the driver wrapper) after resources have been
4334 * allocated/initialized. */
Ronald Cronab99ac22020-10-01 16:38:28 +02004335 operation->iv_set = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01004336 if (alg == PSA_ALG_ECB_NO_PADDING) {
Ronald Cronab99ac22020-10-01 16:38:28 +02004337 operation->iv_required = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01004338 } else {
Ronald Cronab99ac22020-10-01 16:38:28 +02004339 operation->iv_required = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004340 }
4341 operation->default_iv_length = PSA_CIPHER_IV_LENGTH(slot->attr.type, alg);
Ronald Cronab99ac22020-10-01 16:38:28 +02004342
4343 /* Try doing the operation through a driver before using software fallback. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004344 if (cipher_operation == MBEDTLS_ENCRYPT) {
4345 status = psa_driver_wrapper_cipher_encrypt_setup(operation,
Gilles Peskine7a5d9202024-02-28 01:18:23 +01004346 &slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01004347 slot->key.data,
4348 slot->key.bytes,
4349 alg);
4350 } else {
4351 status = psa_driver_wrapper_cipher_decrypt_setup(operation,
Gilles Peskine7a5d9202024-02-28 01:18:23 +01004352 &slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01004353 slot->key.data,
4354 slot->key.bytes,
4355 alg);
4356 }
Ronald Cronab99ac22020-10-01 16:38:28 +02004357
Gilles Peskine9ab61b62019-02-25 17:43:14 +01004358exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004359 if (status != PSA_SUCCESS) {
4360 psa_cipher_abort(operation);
4361 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02004362
Ryan Everettc0053cc2024-02-14 16:27:13 +00004363 unlock_status = psa_unregister_read_under_mutex(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02004364
Gilles Peskine449bd832023-01-11 14:50:10 +01004365 return (status == PSA_SUCCESS) ? unlock_status : status;
mohammad1603503973b2018-03-12 15:59:30 +02004366}
4367
Gilles Peskine449bd832023-01-11 14:50:10 +01004368psa_status_t psa_cipher_encrypt_setup(psa_cipher_operation_t *operation,
4369 mbedtls_svc_key_id_t key,
4370 psa_algorithm_t alg)
mohammad16038481e742018-03-18 13:57:31 +02004371{
Gilles Peskine449bd832023-01-11 14:50:10 +01004372 return psa_cipher_setup(operation, key, alg, MBEDTLS_ENCRYPT);
mohammad16038481e742018-03-18 13:57:31 +02004373}
4374
Gilles Peskine449bd832023-01-11 14:50:10 +01004375psa_status_t psa_cipher_decrypt_setup(psa_cipher_operation_t *operation,
4376 mbedtls_svc_key_id_t key,
4377 psa_algorithm_t alg)
mohammad16038481e742018-03-18 13:57:31 +02004378{
Gilles Peskine449bd832023-01-11 14:50:10 +01004379 return psa_cipher_setup(operation, key, alg, MBEDTLS_DECRYPT);
mohammad16038481e742018-03-18 13:57:31 +02004380}
4381
Gilles Peskine449bd832023-01-11 14:50:10 +01004382psa_status_t psa_cipher_generate_iv(psa_cipher_operation_t *operation,
Gabor Mezei358eb212024-02-07 18:10:13 +01004383 uint8_t *iv_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004384 size_t iv_size,
4385 size_t *iv_length)
mohammad1603503973b2018-03-12 15:59:30 +02004386{
Ronald Cron6d051732020-10-01 14:10:20 +02004387 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Sergeybef1f632023-03-06 15:25:06 -07004388 size_t default_iv_length = 0;
Ronald Cron5618a392021-03-26 09:52:26 +01004389
Gabor Mezei358eb212024-02-07 18:10:13 +01004390 LOCAL_OUTPUT_DECLARE(iv_external, iv);
4391
Gilles Peskine449bd832023-01-11 14:50:10 +01004392 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004393 status = PSA_ERROR_BAD_STATE;
4394 goto exit;
Ronald Cronc45b4af2020-09-29 16:18:05 +02004395 }
4396
Gilles Peskine449bd832023-01-11 14:50:10 +01004397 if (operation->iv_set || !operation->iv_required) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004398 status = PSA_ERROR_BAD_STATE;
4399 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004400 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004401
Ronald Cron2fb90522021-07-05 12:31:44 +02004402 default_iv_length = operation->default_iv_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01004403 if (iv_size < default_iv_length) {
Ronald Cron5618a392021-03-26 09:52:26 +01004404 status = PSA_ERROR_BUFFER_TOO_SMALL;
4405 goto exit;
4406 }
Gilles Peskinee553c652018-06-04 16:22:46 +02004407
Gilles Peskine449bd832023-01-11 14:50:10 +01004408 if (default_iv_length > PSA_CIPHER_IV_MAX_SIZE) {
Ronald Cron2fb90522021-07-05 12:31:44 +02004409 status = PSA_ERROR_GENERIC_ERROR;
4410 goto exit;
4411 }
4412
Gabor Mezei358eb212024-02-07 18:10:13 +01004413 LOCAL_OUTPUT_ALLOC(iv_external, default_iv_length, iv);
4414
Gabor Mezei1b5b58d2024-03-04 17:15:08 +01004415 status = psa_generate_random_internal(iv, default_iv_length);
Gilles Peskine449bd832023-01-11 14:50:10 +01004416 if (status != PSA_SUCCESS) {
Ronald Cron5618a392021-03-26 09:52:26 +01004417 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004418 }
Ronald Cron5618a392021-03-26 09:52:26 +01004419
Gilles Peskine449bd832023-01-11 14:50:10 +01004420 status = psa_driver_wrapper_cipher_set_iv(operation,
Gabor Mezei358eb212024-02-07 18:10:13 +01004421 iv, default_iv_length);
Ronald Cron5618a392021-03-26 09:52:26 +01004422
4423exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004424 if (status == PSA_SUCCESS) {
Ronald Cron2fb90522021-07-05 12:31:44 +02004425 *iv_length = default_iv_length;
Steven Cooreman7df02922020-09-09 15:28:49 +02004426 operation->iv_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004427 } else {
Ronald Cron2fb90522021-07-05 12:31:44 +02004428 *iv_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01004429 psa_cipher_abort(operation);
Gabor Mezei358eb212024-02-07 18:10:13 +01004430 if (iv != NULL) {
4431 mbedtls_platform_zeroize(iv, default_iv_length);
4432 }
Ronald Cron2fb90522021-07-05 12:31:44 +02004433 }
Ronald Cron6d051732020-10-01 14:10:20 +02004434
Gabor Mezei358eb212024-02-07 18:10:13 +01004435 LOCAL_OUTPUT_FREE(iv_external, iv);
Gilles Peskine449bd832023-01-11 14:50:10 +01004436 return status;
mohammad1603503973b2018-03-12 15:59:30 +02004437}
4438
Gilles Peskine449bd832023-01-11 14:50:10 +01004439psa_status_t psa_cipher_set_iv(psa_cipher_operation_t *operation,
Gabor Mezei7abf8ee2024-02-01 10:39:26 +01004440 const uint8_t *iv_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004441 size_t iv_length)
mohammad1603503973b2018-03-12 15:59:30 +02004442{
Ronald Cron6d051732020-10-01 14:10:20 +02004443 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cronc45b4af2020-09-29 16:18:05 +02004444
Gabor Mezei7abf8ee2024-02-01 10:39:26 +01004445 LOCAL_INPUT_DECLARE(iv_external, iv);
4446
Gilles Peskine449bd832023-01-11 14:50:10 +01004447 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004448 status = PSA_ERROR_BAD_STATE;
4449 goto exit;
4450 }
Ronald Cronc45b4af2020-09-29 16:18:05 +02004451
Gilles Peskine449bd832023-01-11 14:50:10 +01004452 if (operation->iv_set || !operation->iv_required) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004453 status = PSA_ERROR_BAD_STATE;
4454 goto exit;
4455 }
Ronald Crona0d68172021-03-26 10:15:08 +01004456
Gilles Peskine449bd832023-01-11 14:50:10 +01004457 if (iv_length > PSA_CIPHER_IV_MAX_SIZE) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004458 status = PSA_ERROR_INVALID_ARGUMENT;
4459 goto exit;
4460 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004461
Gabor Mezei7abf8ee2024-02-01 10:39:26 +01004462 LOCAL_INPUT_ALLOC(iv_external, iv_length, iv);
4463
Gilles Peskine449bd832023-01-11 14:50:10 +01004464 status = psa_driver_wrapper_cipher_set_iv(operation,
4465 iv,
4466 iv_length);
Steven Cooremand3feccd2020-09-01 15:56:14 +02004467
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004468exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004469 if (status == PSA_SUCCESS) {
itayzafrir534bd7c2018-08-02 13:56:32 +03004470 operation->iv_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004471 } else {
4472 psa_cipher_abort(operation);
4473 }
Gabor Mezei7abf8ee2024-02-01 10:39:26 +01004474
4475 LOCAL_INPUT_FREE(iv_external, iv);
4476
Gilles Peskine449bd832023-01-11 14:50:10 +01004477 return status;
mohammad1603503973b2018-03-12 15:59:30 +02004478}
4479
Gilles Peskine449bd832023-01-11 14:50:10 +01004480psa_status_t psa_cipher_update(psa_cipher_operation_t *operation,
Gabor Mezei212eb082024-01-24 16:56:00 +01004481 const uint8_t *input_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004482 size_t input_length,
Gabor Mezei212eb082024-01-24 16:56:00 +01004483 uint8_t *output_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004484 size_t output_size,
4485 size_t *output_length)
mohammad1603503973b2018-03-12 15:59:30 +02004486{
Steven Cooremanffecb7b2020-08-25 15:13:13 +02004487 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron6d051732020-10-01 14:10:20 +02004488
Gabor Mezei212eb082024-01-24 16:56:00 +01004489 LOCAL_INPUT_DECLARE(input_external, input);
4490 LOCAL_OUTPUT_DECLARE(output_external, output);
4491
Gilles Peskine449bd832023-01-11 14:50:10 +01004492 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004493 status = PSA_ERROR_BAD_STATE;
4494 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004495 }
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004496
Gilles Peskine449bd832023-01-11 14:50:10 +01004497 if (operation->iv_required && !operation->iv_set) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004498 status = PSA_ERROR_BAD_STATE;
4499 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004500 }
Jaeden Ameroab439972019-02-15 14:12:05 +00004501
Gabor Mezei8b8e4852024-01-31 17:45:29 +01004502 LOCAL_INPUT_ALLOC(input_external, input_length, input);
Gabor Mezei0b041162024-02-29 10:08:16 +00004503 LOCAL_OUTPUT_ALLOC(output_external, output_size, output);
Gabor Mezei8b8e4852024-01-31 17:45:29 +01004504
Gilles Peskine449bd832023-01-11 14:50:10 +01004505 status = psa_driver_wrapper_cipher_update(operation,
4506 input,
4507 input_length,
4508 output,
4509 output_size,
4510 output_length);
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004511
4512exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004513 if (status != PSA_SUCCESS) {
4514 psa_cipher_abort(operation);
4515 }
Ronald Cron6d051732020-10-01 14:10:20 +02004516
Gabor Mezei212eb082024-01-24 16:56:00 +01004517 LOCAL_INPUT_FREE(input_external, input);
4518 LOCAL_OUTPUT_FREE(output_external, output);
4519
Gilles Peskine449bd832023-01-11 14:50:10 +01004520 return status;
mohammad1603503973b2018-03-12 15:59:30 +02004521}
4522
Gilles Peskine449bd832023-01-11 14:50:10 +01004523psa_status_t psa_cipher_finish(psa_cipher_operation_t *operation,
Gabor Mezei212eb082024-01-24 16:56:00 +01004524 uint8_t *output_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004525 size_t output_size,
4526 size_t *output_length)
mohammad1603503973b2018-03-12 15:59:30 +02004527{
David Saadab4ecc272019-02-14 13:48:10 +02004528 psa_status_t status = PSA_ERROR_GENERIC_ERROR;
Ronald Cron6d051732020-10-01 14:10:20 +02004529
Gabor Mezei212eb082024-01-24 16:56:00 +01004530 LOCAL_OUTPUT_DECLARE(output_external, output);
4531
Gilles Peskine449bd832023-01-11 14:50:10 +01004532 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004533 status = PSA_ERROR_BAD_STATE;
4534 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004535 }
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004536
Gilles Peskine449bd832023-01-11 14:50:10 +01004537 if (operation->iv_required && !operation->iv_set) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004538 status = PSA_ERROR_BAD_STATE;
4539 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004540 }
Moran Pekerbed71a22018-04-22 20:19:20 +03004541
Gabor Mezei0b041162024-02-29 10:08:16 +00004542 LOCAL_OUTPUT_ALLOC(output_external, output_size, output);
Gabor Mezei8b8e4852024-01-31 17:45:29 +01004543
Gilles Peskine449bd832023-01-11 14:50:10 +01004544 status = psa_driver_wrapper_cipher_finish(operation,
4545 output,
4546 output_size,
4547 output_length);
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004548
4549exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004550 if (status == PSA_SUCCESS) {
Gabor Mezei212eb082024-01-24 16:56:00 +01004551 status = psa_cipher_abort(operation);
Gilles Peskine449bd832023-01-11 14:50:10 +01004552 } else {
Steven Cooremanef8575e2020-09-11 11:44:50 +02004553 *output_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01004554 (void) psa_cipher_abort(operation);
Steven Cooremanef8575e2020-09-11 11:44:50 +02004555 }
Gabor Mezei212eb082024-01-24 16:56:00 +01004556
4557 LOCAL_OUTPUT_FREE(output_external, output);
4558
4559 return status;
mohammad1603503973b2018-03-12 15:59:30 +02004560}
4561
Gilles Peskine449bd832023-01-11 14:50:10 +01004562psa_status_t psa_cipher_abort(psa_cipher_operation_t *operation)
Gilles Peskinee553c652018-06-04 16:22:46 +02004563{
Gilles Peskine449bd832023-01-11 14:50:10 +01004564 if (operation->id == 0) {
Steven Cooremana07b9972020-09-10 14:54:14 +02004565 /* The object has (apparently) been initialized but it is not (yet)
Gilles Peskine81736312018-06-26 15:04:31 +02004566 * in use. It's ok to call abort on such an object, and there's
4567 * nothing to do. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004568 return PSA_SUCCESS;
Gilles Peskine81736312018-06-26 15:04:31 +02004569 }
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02004570
Gilles Peskine449bd832023-01-11 14:50:10 +01004571 psa_driver_wrapper_cipher_abort(operation);
Gilles Peskinee553c652018-06-04 16:22:46 +02004572
Ronald Cron49fafa92021-03-10 08:34:23 +01004573 operation->id = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03004574 operation->iv_set = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03004575 operation->iv_required = 0;
Moran Peker41deec42018-04-04 15:43:05 +03004576
Gilles Peskine449bd832023-01-11 14:50:10 +01004577 return PSA_SUCCESS;
mohammad1603503973b2018-03-12 15:59:30 +02004578}
4579
Gilles Peskine449bd832023-01-11 14:50:10 +01004580psa_status_t psa_cipher_encrypt(mbedtls_svc_key_id_t key,
4581 psa_algorithm_t alg,
David Horstmann36df4b22023-12-13 15:55:25 +00004582 const uint8_t *input_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004583 size_t input_length,
David Horstmann36df4b22023-12-13 15:55:25 +00004584 uint8_t *output_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004585 size_t output_size,
4586 size_t *output_length)
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004587{
4588 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004589 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron23919522021-07-08 19:00:07 +02004590 psa_key_slot_t *slot = NULL;
Ronald Cronc6e6f502021-07-09 18:44:58 +02004591 uint8_t local_iv[PSA_CIPHER_IV_MAX_SIZE];
4592 size_t default_iv_length = 0;
gabor-mezei-arm6f4e5bb2021-06-25 15:21:11 +02004593
David Horstmann62a56d92023-12-14 18:12:47 +00004594 LOCAL_INPUT_DECLARE(input_external, input);
4595 LOCAL_OUTPUT_DECLARE(output_external, output);
4596
Gilles Peskine449bd832023-01-11 14:50:10 +01004597 if (!PSA_ALG_IS_CIPHER(alg)) {
Ronald Cron23919522021-07-08 19:00:07 +02004598 status = PSA_ERROR_INVALID_ARGUMENT;
4599 goto exit;
4600 }
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004601
Gilles Peskine449bd832023-01-11 14:50:10 +01004602 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
4603 PSA_KEY_USAGE_ENCRYPT,
4604 alg);
4605 if (status != PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004606 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004607 }
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004608
Gilles Peskine449bd832023-01-11 14:50:10 +01004609 default_iv_length = PSA_CIPHER_IV_LENGTH(slot->attr.type, alg);
4610 if (default_iv_length > PSA_CIPHER_IV_MAX_SIZE) {
Ronald Cronc6e6f502021-07-09 18:44:58 +02004611 status = PSA_ERROR_GENERIC_ERROR;
4612 goto exit;
4613 }
4614
Gilles Peskine449bd832023-01-11 14:50:10 +01004615 if (default_iv_length > 0) {
4616 if (output_size < default_iv_length) {
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004617 status = PSA_ERROR_BUFFER_TOO_SMALL;
4618 goto exit;
4619 }
4620
David Horstmann6e99bb22024-02-06 15:27:49 +00004621 status = psa_generate_random_internal(local_iv, default_iv_length);
Gilles Peskine449bd832023-01-11 14:50:10 +01004622 if (status != PSA_SUCCESS) {
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004623 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004624 }
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004625 }
4626
Gabor Mezei8b8e4852024-01-31 17:45:29 +01004627 LOCAL_INPUT_ALLOC(input_external, input_length, input);
4628 LOCAL_OUTPUT_ALLOC(output_external, output_size, output);
4629
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004630 status = psa_driver_wrapper_cipher_encrypt(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01004631 &slot->attr, slot->key.data, slot->key.bytes,
Ronald Cronc6e6f502021-07-09 18:44:58 +02004632 alg, local_iv, default_iv_length, input, input_length,
Ronald Cronafbc7ed2023-01-24 16:02:04 +01004633 psa_crypto_buffer_offset(output, default_iv_length),
Gilles Peskine449bd832023-01-11 14:50:10 +01004634 output_size - default_iv_length, output_length);
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004635
4636exit:
Ryan Everetta103ec92024-01-31 13:59:57 +00004637 unlock_status = psa_unregister_read_under_mutex(slot);
Gilles Peskine449bd832023-01-11 14:50:10 +01004638 if (status == PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004639 status = unlock_status;
Ronald Cronc6e6f502021-07-09 18:44:58 +02004640 }
Ronald Cron23919522021-07-08 19:00:07 +02004641
Gilles Peskine449bd832023-01-11 14:50:10 +01004642 if (status == PSA_SUCCESS) {
4643 if (default_iv_length > 0) {
4644 memcpy(output, local_iv, default_iv_length);
4645 }
4646 *output_length += default_iv_length;
4647 } else {
4648 *output_length = 0;
4649 }
4650
David Horstmann62a56d92023-12-14 18:12:47 +00004651 LOCAL_INPUT_FREE(input_external, input);
4652 LOCAL_OUTPUT_FREE(output_external, output);
David Horstmannc6977b42023-11-27 17:43:05 +00004653
Gilles Peskine449bd832023-01-11 14:50:10 +01004654 return status;
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004655}
4656
Gilles Peskine449bd832023-01-11 14:50:10 +01004657psa_status_t psa_cipher_decrypt(mbedtls_svc_key_id_t key,
4658 psa_algorithm_t alg,
Gabor Mezei212eb082024-01-24 16:56:00 +01004659 const uint8_t *input_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004660 size_t input_length,
Gabor Mezei212eb082024-01-24 16:56:00 +01004661 uint8_t *output_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004662 size_t output_size,
4663 size_t *output_length)
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004664{
4665 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004666 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron23919522021-07-08 19:00:07 +02004667 psa_key_slot_t *slot = NULL;
gabor-mezei-arm6f4e5bb2021-06-25 15:21:11 +02004668
Gabor Mezei212eb082024-01-24 16:56:00 +01004669 LOCAL_INPUT_DECLARE(input_external, input);
4670 LOCAL_OUTPUT_DECLARE(output_external, output);
4671
Gilles Peskine449bd832023-01-11 14:50:10 +01004672 if (!PSA_ALG_IS_CIPHER(alg)) {
Ronald Cron23919522021-07-08 19:00:07 +02004673 status = PSA_ERROR_INVALID_ARGUMENT;
4674 goto exit;
4675 }
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004676
Gilles Peskine449bd832023-01-11 14:50:10 +01004677 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
4678 PSA_KEY_USAGE_DECRYPT,
4679 alg);
4680 if (status != PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004681 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004682 }
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004683
Gilles Peskineb47c3b32024-06-26 13:16:33 +02004684 if (input_length < PSA_CIPHER_IV_LENGTH(slot->attr.type, alg)) {
gabor-mezei-arm258ae072021-06-25 15:25:38 +02004685 status = PSA_ERROR_INVALID_ARGUMENT;
4686 goto exit;
4687 }
4688
Gabor Mezei8b8e4852024-01-31 17:45:29 +01004689 LOCAL_INPUT_ALLOC(input_external, input_length, input);
4690 LOCAL_OUTPUT_ALLOC(output_external, output_size, output);
4691
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004692 status = psa_driver_wrapper_cipher_decrypt(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01004693 &slot->attr, slot->key.data, slot->key.bytes,
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004694 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01004695 output, output_size, output_length);
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004696
gabor-mezei-arm258ae072021-06-25 15:25:38 +02004697exit:
Ryan Everetta103ec92024-01-31 13:59:57 +00004698 unlock_status = psa_unregister_read_under_mutex(slot);
Gilles Peskine449bd832023-01-11 14:50:10 +01004699 if (status == PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004700 status = unlock_status;
Gilles Peskine449bd832023-01-11 14:50:10 +01004701 }
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004702
Gilles Peskine449bd832023-01-11 14:50:10 +01004703 if (status != PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004704 *output_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01004705 }
Ronald Cron23919522021-07-08 19:00:07 +02004706
Gabor Mezei212eb082024-01-24 16:56:00 +01004707 LOCAL_INPUT_FREE(input_external, input);
4708 LOCAL_OUTPUT_FREE(output_external, output);
4709
Gilles Peskine449bd832023-01-11 14:50:10 +01004710 return status;
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004711}
4712
4713
mohammad16035955c982018-04-26 00:53:03 +03004714/****************************************************************/
4715/* AEAD */
4716/****************************************************************/
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02004717
Paul Elliottbaff51c2021-09-28 17:44:45 +01004718/* Helper function to get the base algorithm from its variants. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004719static psa_algorithm_t psa_aead_get_base_algorithm(psa_algorithm_t alg)
Paul Elliottbaff51c2021-09-28 17:44:45 +01004720{
Gilles Peskine449bd832023-01-11 14:50:10 +01004721 return PSA_ALG_AEAD_WITH_DEFAULT_LENGTH_TAG(alg);
Paul Elliottbaff51c2021-09-28 17:44:45 +01004722}
4723
4724/* Helper function to perform common nonce length checks. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004725static psa_status_t psa_aead_check_nonce_length(psa_algorithm_t alg,
4726 size_t nonce_length)
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004727{
Gilles Peskine449bd832023-01-11 14:50:10 +01004728 psa_algorithm_t base_alg = psa_aead_get_base_algorithm(alg);
Paul Elliottbaff51c2021-09-28 17:44:45 +01004729
Gilles Peskine449bd832023-01-11 14:50:10 +01004730 switch (base_alg) {
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004731#if defined(PSA_WANT_ALG_GCM)
4732 case PSA_ALG_GCM:
4733 /* Not checking max nonce size here as GCM spec allows almost
Gilles Peskine449bd832023-01-11 14:50:10 +01004734 * arbitrarily large nonces. Please note that we do not generally
4735 * recommend the usage of nonces of greater length than
4736 * PSA_AEAD_NONCE_MAX_SIZE, as large nonces are hashed to a shorter
4737 * size, which can then lead to collisions if you encrypt a very
4738 * large number of messages.*/
4739 if (nonce_length != 0) {
4740 return PSA_SUCCESS;
4741 }
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004742 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004743#endif /* PSA_WANT_ALG_GCM */
4744#if defined(PSA_WANT_ALG_CCM)
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004745 case PSA_ALG_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01004746 if (nonce_length >= 7 && nonce_length <= 13) {
4747 return PSA_SUCCESS;
4748 }
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004749 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004750#endif /* PSA_WANT_ALG_CCM */
4751#if defined(PSA_WANT_ALG_CHACHA20_POLY1305)
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004752 case PSA_ALG_CHACHA20_POLY1305:
Gilles Peskine449bd832023-01-11 14:50:10 +01004753 if (nonce_length == 12) {
4754 return PSA_SUCCESS;
4755 } else if (nonce_length == 8) {
4756 return PSA_ERROR_NOT_SUPPORTED;
4757 }
Bence Szépkúti6d48e202021-11-15 20:04:15 +01004758 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004759#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004760 default:
Przemek Stekiel4c499272022-09-27 13:55:37 +02004761 (void) nonce_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01004762 return PSA_ERROR_NOT_SUPPORTED;
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004763 }
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004764
Gilles Peskine449bd832023-01-11 14:50:10 +01004765 return PSA_ERROR_INVALID_ARGUMENT;
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004766}
4767
Gilles Peskine449bd832023-01-11 14:50:10 +01004768static psa_status_t psa_aead_check_algorithm(psa_algorithm_t alg)
Bence Szépkútiaa3a6e42022-01-13 16:26:03 +01004769{
Gilles Peskine449bd832023-01-11 14:50:10 +01004770 if (!PSA_ALG_IS_AEAD(alg) || PSA_ALG_IS_WILDCARD(alg)) {
4771 return PSA_ERROR_INVALID_ARGUMENT;
4772 }
Bence Szépkúti08f34652021-12-08 21:07:13 +01004773
Gilles Peskine449bd832023-01-11 14:50:10 +01004774 return PSA_SUCCESS;
Bence Szépkúti08f34652021-12-08 21:07:13 +01004775}
4776
Gilles Peskine449bd832023-01-11 14:50:10 +01004777psa_status_t psa_aead_encrypt(mbedtls_svc_key_id_t key,
4778 psa_algorithm_t alg,
David Horstmann9d09a022023-11-28 19:25:00 +00004779 const uint8_t *nonce_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004780 size_t nonce_length,
David Horstmann9d09a022023-11-28 19:25:00 +00004781 const uint8_t *additional_data_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004782 size_t additional_data_length,
David Horstmann9d09a022023-11-28 19:25:00 +00004783 const uint8_t *plaintext_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004784 size_t plaintext_length,
David Horstmann9d09a022023-11-28 19:25:00 +00004785 uint8_t *ciphertext_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004786 size_t ciphertext_size,
4787 size_t *ciphertext_length)
mohammad16035955c982018-04-26 00:53:03 +03004788{
Ronald Cron215633c2021-03-16 17:15:37 +01004789 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4790 psa_key_slot_t *slot;
Gilles Peskine2d277862018-06-18 15:41:12 +02004791
David Horstmann9d09a022023-11-28 19:25:00 +00004792 LOCAL_INPUT_DECLARE(nonce_external, nonce);
4793 LOCAL_INPUT_DECLARE(additional_data_external, additional_data);
4794 LOCAL_INPUT_DECLARE(plaintext_external, plaintext);
4795 LOCAL_OUTPUT_DECLARE(ciphertext_external, ciphertext);
4796
mohammad1603f08a5502018-06-03 15:05:47 +03004797 *ciphertext_length = 0;
mohammad1603e58e6842018-05-09 04:58:32 -07004798
Gilles Peskine449bd832023-01-11 14:50:10 +01004799 status = psa_aead_check_algorithm(alg);
4800 if (status != PSA_SUCCESS) {
4801 return status;
4802 }
Steven Cooremanea7ab132021-03-17 16:28:00 +01004803
Ronald Cron9a986162021-03-26 12:40:07 +01004804 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01004805 key, &slot, PSA_KEY_USAGE_ENCRYPT, alg);
4806 if (status != PSA_SUCCESS) {
4807 return status;
4808 }
mohammad16035955c982018-04-26 00:53:03 +03004809
David Horstmann9d09a022023-11-28 19:25:00 +00004810 LOCAL_INPUT_ALLOC(nonce_external, nonce_length, nonce);
4811 LOCAL_INPUT_ALLOC(additional_data_external, additional_data_length, additional_data);
4812 LOCAL_INPUT_ALLOC(plaintext_external, plaintext_length, plaintext);
4813 LOCAL_OUTPUT_ALLOC(ciphertext_external, ciphertext_size, ciphertext);
4814
Gilles Peskine449bd832023-01-11 14:50:10 +01004815 status = psa_aead_check_nonce_length(alg, nonce_length);
4816 if (status != PSA_SUCCESS) {
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004817 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004818 }
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004819
Ronald Cronde822812021-03-17 16:08:20 +01004820 status = psa_driver_wrapper_aead_encrypt(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01004821 &slot->attr, slot->key.data, slot->key.bytes,
Ronald Cron215633c2021-03-16 17:15:37 +01004822 alg,
4823 nonce, nonce_length,
4824 additional_data, additional_data_length,
4825 plaintext, plaintext_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01004826 ciphertext, ciphertext_size, ciphertext_length);
Gilles Peskine2d277862018-06-18 15:41:12 +02004827
Gilles Peskine449bd832023-01-11 14:50:10 +01004828 if (status != PSA_SUCCESS && ciphertext_size != 0) {
4829 memset(ciphertext, 0, ciphertext_size);
4830 }
Gilles Peskine2d277862018-06-18 15:41:12 +02004831
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004832exit:
David Horstmann9d09a022023-11-28 19:25:00 +00004833 LOCAL_INPUT_FREE(nonce_external, nonce);
4834 LOCAL_INPUT_FREE(additional_data_external, additional_data);
4835 LOCAL_INPUT_FREE(plaintext_external, plaintext);
4836 LOCAL_OUTPUT_FREE(ciphertext_external, ciphertext);
4837
Ryan Everetta103ec92024-01-31 13:59:57 +00004838 psa_unregister_read_under_mutex(slot);
mohammad16035955c982018-04-26 00:53:03 +03004839
Gilles Peskine449bd832023-01-11 14:50:10 +01004840 return status;
Gilles Peskineee652a32018-06-01 19:23:52 +02004841}
4842
Gilles Peskine449bd832023-01-11 14:50:10 +01004843psa_status_t psa_aead_decrypt(mbedtls_svc_key_id_t key,
4844 psa_algorithm_t alg,
David Horstmann7f2e0402023-11-28 19:43:53 +00004845 const uint8_t *nonce_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004846 size_t nonce_length,
David Horstmann7f2e0402023-11-28 19:43:53 +00004847 const uint8_t *additional_data_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004848 size_t additional_data_length,
David Horstmann7f2e0402023-11-28 19:43:53 +00004849 const uint8_t *ciphertext_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004850 size_t ciphertext_length,
David Horstmann7f2e0402023-11-28 19:43:53 +00004851 uint8_t *plaintext_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004852 size_t plaintext_size,
4853 size_t *plaintext_length)
mohammad16035955c982018-04-26 00:53:03 +03004854{
Ronald Cron215633c2021-03-16 17:15:37 +01004855 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4856 psa_key_slot_t *slot;
Gilles Peskine2d277862018-06-18 15:41:12 +02004857
David Horstmann7f2e0402023-11-28 19:43:53 +00004858 LOCAL_INPUT_DECLARE(nonce_external, nonce);
4859 LOCAL_INPUT_DECLARE(additional_data_external, additional_data);
4860 LOCAL_INPUT_DECLARE(ciphertext_external, ciphertext);
4861 LOCAL_OUTPUT_DECLARE(plaintext_external, plaintext);
4862
Gilles Peskineee652a32018-06-01 19:23:52 +02004863 *plaintext_length = 0;
mohammad16039e5a5152018-04-26 12:07:35 +03004864
Gilles Peskine449bd832023-01-11 14:50:10 +01004865 status = psa_aead_check_algorithm(alg);
4866 if (status != PSA_SUCCESS) {
4867 return status;
4868 }
Steven Cooremanea7ab132021-03-17 16:28:00 +01004869
Ronald Cron9a986162021-03-26 12:40:07 +01004870 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01004871 key, &slot, PSA_KEY_USAGE_DECRYPT, alg);
4872 if (status != PSA_SUCCESS) {
4873 return status;
4874 }
mohammad16035955c982018-04-26 00:53:03 +03004875
David Horstmann7f2e0402023-11-28 19:43:53 +00004876 LOCAL_INPUT_ALLOC(nonce_external, nonce_length, nonce);
4877 LOCAL_INPUT_ALLOC(additional_data_external, additional_data_length,
4878 additional_data);
4879 LOCAL_INPUT_ALLOC(ciphertext_external, ciphertext_length, ciphertext);
4880 LOCAL_OUTPUT_ALLOC(plaintext_external, plaintext_size, plaintext);
4881
Gilles Peskine449bd832023-01-11 14:50:10 +01004882 status = psa_aead_check_nonce_length(alg, nonce_length);
4883 if (status != PSA_SUCCESS) {
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004884 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004885 }
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004886
Ronald Cronde822812021-03-17 16:08:20 +01004887 status = psa_driver_wrapper_aead_decrypt(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01004888 &slot->attr, slot->key.data, slot->key.bytes,
Ronald Cron215633c2021-03-16 17:15:37 +01004889 alg,
4890 nonce, nonce_length,
4891 additional_data, additional_data_length,
4892 ciphertext, ciphertext_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01004893 plaintext, plaintext_size, plaintext_length);
Gilles Peskinea40d7742018-06-01 16:28:30 +02004894
Gilles Peskine449bd832023-01-11 14:50:10 +01004895 if (status != PSA_SUCCESS && plaintext_size != 0) {
4896 memset(plaintext, 0, plaintext_size);
4897 }
mohammad160360a64d02018-06-03 17:20:42 +03004898
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004899exit:
David Horstmann7f2e0402023-11-28 19:43:53 +00004900 LOCAL_INPUT_FREE(nonce_external, nonce);
4901 LOCAL_INPUT_FREE(additional_data_external, additional_data);
4902 LOCAL_INPUT_FREE(ciphertext_external, ciphertext);
4903 LOCAL_OUTPUT_FREE(plaintext_external, plaintext);
4904
Ryan Everetta103ec92024-01-31 13:59:57 +00004905 psa_unregister_read_under_mutex(slot);
Ronald Cron215633c2021-03-16 17:15:37 +01004906
Gilles Peskine449bd832023-01-11 14:50:10 +01004907 return status;
mohammad16035955c982018-04-26 00:53:03 +03004908}
4909
Gilles Peskine449bd832023-01-11 14:50:10 +01004910static psa_status_t psa_validate_tag_length(psa_algorithm_t alg)
4911{
4912 const uint8_t tag_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg);
Andrzej Kurekf8816012021-12-19 17:00:12 +01004913
Gilles Peskine449bd832023-01-11 14:50:10 +01004914 switch (PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg, 0)) {
Przemek Stekiel86679c72022-10-06 17:06:56 +02004915#if defined(PSA_WANT_ALG_CCM)
Gilles Peskine449bd832023-01-11 14:50:10 +01004916 case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, 0):
Andrzej Kurekf8816012021-12-19 17:00:12 +01004917 /* CCM allows the following tag lengths: 4, 6, 8, 10, 12, 14, 16.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01004918 if (tag_len < 4 || tag_len > 16 || tag_len % 2) {
4919 return PSA_ERROR_INVALID_ARGUMENT;
4920 }
Andrzej Kurekf8816012021-12-19 17:00:12 +01004921 break;
Przemek Stekiel86679c72022-10-06 17:06:56 +02004922#endif /* PSA_WANT_ALG_CCM */
Andrzej Kurekf8816012021-12-19 17:00:12 +01004923
Przemek Stekiel86679c72022-10-06 17:06:56 +02004924#if defined(PSA_WANT_ALG_GCM)
Gilles Peskine449bd832023-01-11 14:50:10 +01004925 case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_GCM, 0):
Andrzej Kurekf8816012021-12-19 17:00:12 +01004926 /* GCM allows the following tag lengths: 4, 8, 12, 13, 14, 15, 16. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004927 if (tag_len != 4 && tag_len != 8 && (tag_len < 12 || tag_len > 16)) {
4928 return PSA_ERROR_INVALID_ARGUMENT;
4929 }
Andrzej Kurekf8816012021-12-19 17:00:12 +01004930 break;
Przemek Stekiel86679c72022-10-06 17:06:56 +02004931#endif /* PSA_WANT_ALG_GCM */
Andrzej Kurekf8816012021-12-19 17:00:12 +01004932
Przemek Stekiel86679c72022-10-06 17:06:56 +02004933#if defined(PSA_WANT_ALG_CHACHA20_POLY1305)
Gilles Peskine449bd832023-01-11 14:50:10 +01004934 case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CHACHA20_POLY1305, 0):
Andrzej Kurekf8816012021-12-19 17:00:12 +01004935 /* We only support the default tag length. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004936 if (tag_len != 16) {
4937 return PSA_ERROR_INVALID_ARGUMENT;
4938 }
Andrzej Kurekf8816012021-12-19 17:00:12 +01004939 break;
Przemek Stekiel86679c72022-10-06 17:06:56 +02004940#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */
Andrzej Kurekf8816012021-12-19 17:00:12 +01004941
4942 default:
4943 (void) tag_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01004944 return PSA_ERROR_NOT_SUPPORTED;
Andrzej Kurekf8816012021-12-19 17:00:12 +01004945 }
Gilles Peskine449bd832023-01-11 14:50:10 +01004946 return PSA_SUCCESS;
Andrzej Kurekf8816012021-12-19 17:00:12 +01004947}
4948
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004949/* Set the key for a multipart authenticated operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004950static psa_status_t psa_aead_setup(psa_aead_operation_t *operation,
4951 int is_encrypt,
4952 mbedtls_svc_key_id_t key,
4953 psa_algorithm_t alg)
Paul Elliottc2b71442021-06-24 18:17:52 +01004954{
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004955 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4956 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
4957 psa_key_slot_t *slot = NULL;
4958 psa_key_usage_t key_usage = 0;
4959
Gilles Peskine449bd832023-01-11 14:50:10 +01004960 status = psa_aead_check_algorithm(alg);
4961 if (status != PSA_SUCCESS) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004962 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004963 }
Paul Elliottc2b71442021-06-24 18:17:52 +01004964
Gilles Peskine449bd832023-01-11 14:50:10 +01004965 if (operation->id != 0) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004966 status = PSA_ERROR_BAD_STATE;
4967 goto exit;
Paul Elliottc2b71442021-06-24 18:17:52 +01004968 }
4969
Gilles Peskine449bd832023-01-11 14:50:10 +01004970 if (operation->nonce_set || operation->lengths_set ||
4971 operation->ad_started || operation->body_started) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004972 status = PSA_ERROR_BAD_STATE;
4973 goto exit;
Paul Elliottc2b71442021-06-24 18:17:52 +01004974 }
4975
Gilles Peskine449bd832023-01-11 14:50:10 +01004976 if (is_encrypt) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004977 key_usage = PSA_KEY_USAGE_ENCRYPT;
Gilles Peskine449bd832023-01-11 14:50:10 +01004978 } else {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004979 key_usage = PSA_KEY_USAGE_DECRYPT;
Gilles Peskine449bd832023-01-11 14:50:10 +01004980 }
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004981
Gilles Peskine449bd832023-01-11 14:50:10 +01004982 status = psa_get_and_lock_key_slot_with_policy(key, &slot, key_usage,
4983 alg);
4984 if (status != PSA_SUCCESS) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004985 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004986 }
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004987
Gilles Peskine449bd832023-01-11 14:50:10 +01004988 if ((status = psa_validate_tag_length(alg)) != PSA_SUCCESS) {
Przemek Stekiel6ab50762022-10-08 17:54:30 +02004989 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004990 }
Przemek Stekiel6ab50762022-10-08 17:54:30 +02004991
Gilles Peskine449bd832023-01-11 14:50:10 +01004992 if (is_encrypt) {
4993 status = psa_driver_wrapper_aead_encrypt_setup(operation,
Gilles Peskine7a5d9202024-02-28 01:18:23 +01004994 &slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01004995 slot->key.data,
4996 slot->key.bytes,
4997 alg);
4998 } else {
4999 status = psa_driver_wrapper_aead_decrypt_setup(operation,
Gilles Peskine7a5d9202024-02-28 01:18:23 +01005000 &slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01005001 slot->key.data,
5002 slot->key.bytes,
5003 alg);
5004 }
5005 if (status != PSA_SUCCESS) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01005006 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005007 }
Paul Elliotte0a12bd2021-08-19 18:55:56 +01005008
Gilles Peskine7a5d9202024-02-28 01:18:23 +01005009 operation->key_type = psa_get_key_type(&slot->attr);
Paul Elliotte0a12bd2021-08-19 18:55:56 +01005010
5011exit:
Ryan Everett9af70e52024-02-14 18:38:56 +00005012 unlock_status = psa_unregister_read_under_mutex(slot);
Paul Elliotte0a12bd2021-08-19 18:55:56 +01005013
Gilles Peskine449bd832023-01-11 14:50:10 +01005014 if (status == PSA_SUCCESS) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01005015 status = unlock_status;
Gilles Peskine449bd832023-01-11 14:50:10 +01005016 operation->alg = psa_aead_get_base_algorithm(alg);
Paul Elliottd9343f22021-08-23 18:59:49 +01005017 operation->is_encrypt = is_encrypt;
Gilles Peskine449bd832023-01-11 14:50:10 +01005018 } else {
5019 psa_aead_abort(operation);
Paul Elliotte0a12bd2021-08-19 18:55:56 +01005020 }
Paul Elliotte0a12bd2021-08-19 18:55:56 +01005021
Gilles Peskine449bd832023-01-11 14:50:10 +01005022 return status;
Paul Elliottc2b71442021-06-24 18:17:52 +01005023}
5024
Paul Elliott302ff6b2021-04-20 18:10:30 +01005025/* Set the key for a multipart authenticated encryption operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005026psa_status_t psa_aead_encrypt_setup(psa_aead_operation_t *operation,
5027 mbedtls_svc_key_id_t key,
5028 psa_algorithm_t alg)
Paul Elliott302ff6b2021-04-20 18:10:30 +01005029{
Gilles Peskine449bd832023-01-11 14:50:10 +01005030 return psa_aead_setup(operation, 1, key, alg);
Paul Elliott302ff6b2021-04-20 18:10:30 +01005031}
5032
5033/* Set the key for a multipart authenticated decryption operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005034psa_status_t psa_aead_decrypt_setup(psa_aead_operation_t *operation,
5035 mbedtls_svc_key_id_t key,
5036 psa_algorithm_t alg)
Paul Elliott302ff6b2021-04-20 18:10:30 +01005037{
Gilles Peskine449bd832023-01-11 14:50:10 +01005038 return psa_aead_setup(operation, 0, key, alg);
Paul Elliott302ff6b2021-04-20 18:10:30 +01005039}
5040
David Horstmannfed23772023-12-19 17:49:20 +00005041static psa_status_t psa_aead_set_nonce_internal(psa_aead_operation_t *operation,
5042 const uint8_t *nonce,
5043 size_t nonce_length)
5044{
5045 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
5046
5047 if (operation->id == 0) {
5048 status = PSA_ERROR_BAD_STATE;
5049 goto exit;
5050 }
5051
5052 if (operation->nonce_set) {
5053 status = PSA_ERROR_BAD_STATE;
5054 goto exit;
5055 }
5056
5057 status = psa_aead_check_nonce_length(operation->alg, nonce_length);
5058 if (status != PSA_SUCCESS) {
5059 status = PSA_ERROR_INVALID_ARGUMENT;
5060 goto exit;
5061 }
5062
5063 status = psa_driver_wrapper_aead_set_nonce(operation, nonce,
5064 nonce_length);
5065
5066exit:
5067 if (status == PSA_SUCCESS) {
5068 operation->nonce_set = 1;
5069 } else {
5070 psa_aead_abort(operation);
5071 }
5072
5073 return status;
5074}
5075
Paul Elliott302ff6b2021-04-20 18:10:30 +01005076/* Generate a random nonce / IV for multipart AEAD operation */
Gilles Peskine449bd832023-01-11 14:50:10 +01005077psa_status_t psa_aead_generate_nonce(psa_aead_operation_t *operation,
David Horstmannd3cad8b2023-12-11 14:46:04 +00005078 uint8_t *nonce_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01005079 size_t nonce_size,
5080 size_t *nonce_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01005081{
5082 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Croncae59092021-11-26 18:53:58 +01005083 uint8_t local_nonce[PSA_AEAD_NONCE_MAX_SIZE];
Sergeybef1f632023-03-06 15:25:06 -07005084 size_t required_nonce_size = 0;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005085
David Horstmannd3cad8b2023-12-11 14:46:04 +00005086 LOCAL_OUTPUT_DECLARE(nonce_external, nonce);
5087 LOCAL_OUTPUT_ALLOC(nonce_external, nonce_size, nonce);
5088
Paul Elliott8eb9daf2021-06-04 16:42:21 +01005089 *nonce_length = 0;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005090
Gilles Peskine449bd832023-01-11 14:50:10 +01005091 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01005092 status = PSA_ERROR_BAD_STATE;
5093 goto exit;
5094 }
5095
Gilles Peskine449bd832023-01-11 14:50:10 +01005096 if (operation->nonce_set || !operation->is_encrypt) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01005097 status = PSA_ERROR_BAD_STATE;
5098 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005099 }
5100
Paul Elliotte193ea82021-10-01 13:00:16 +01005101 /* For CCM, this size may not be correct according to the PSA
5102 * specification. The PSA Crypto 1.0.1 specification states:
5103 *
5104 * CCM encodes the plaintext length pLen in L octets, with L the smallest
5105 * integer >= 2 where pLen < 2^(8L). The nonce length is then 15 - L bytes.
5106 *
5107 * However this restriction that L has to be the smallest integer is not
5108 * applied in practice, and it is not implementable here since the
5109 * plaintext length may or may not be known at this time. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005110 required_nonce_size = PSA_AEAD_NONCE_LENGTH(operation->key_type,
5111 operation->alg);
5112 if (nonce_size < required_nonce_size) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01005113 status = PSA_ERROR_BUFFER_TOO_SMALL;
5114 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005115 }
5116
David Horstmann6e99bb22024-02-06 15:27:49 +00005117 status = psa_generate_random_internal(local_nonce, required_nonce_size);
Gilles Peskine449bd832023-01-11 14:50:10 +01005118 if (status != PSA_SUCCESS) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01005119 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005120 }
Paul Elliott302ff6b2021-04-20 18:10:30 +01005121
David Horstmannfed23772023-12-19 17:49:20 +00005122 status = psa_aead_set_nonce_internal(operation, local_nonce,
5123 required_nonce_size);
Paul Elliott302ff6b2021-04-20 18:10:30 +01005124
Paul Elliott39dc6b82021-05-11 19:16:09 +01005125exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01005126 if (status == PSA_SUCCESS) {
5127 memcpy(nonce, local_nonce, required_nonce_size);
Paul Elliott39dc6b82021-05-11 19:16:09 +01005128 *nonce_length = required_nonce_size;
Gilles Peskine449bd832023-01-11 14:50:10 +01005129 } else {
5130 psa_aead_abort(operation);
Ronald Croncae59092021-11-26 18:53:58 +01005131 }
Paul Elliott39dc6b82021-05-11 19:16:09 +01005132
David Horstmannd3cad8b2023-12-11 14:46:04 +00005133 LOCAL_OUTPUT_FREE(nonce_external, nonce);
5134
Gilles Peskine449bd832023-01-11 14:50:10 +01005135 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005136}
5137
5138/* Set the nonce for a multipart authenticated encryption or decryption
5139 operation.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01005140psa_status_t psa_aead_set_nonce(psa_aead_operation_t *operation,
David Horstmann8f0ef512023-12-11 15:17:11 +00005141 const uint8_t *nonce_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01005142 size_t nonce_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01005143{
David Horstmannfed23772023-12-19 17:49:20 +00005144 psa_status_t status;
Paul Elliottcbbde5f2021-05-10 18:19:46 +01005145
David Horstmann8f0ef512023-12-11 15:17:11 +00005146 LOCAL_INPUT_DECLARE(nonce_external, nonce);
5147 LOCAL_INPUT_ALLOC(nonce_external, nonce_length, nonce);
Paul Elliottcee785c2021-05-20 14:29:20 +01005148
David Horstmannfed23772023-12-19 17:49:20 +00005149 status = psa_aead_set_nonce_internal(operation, nonce, nonce_length);
Paul Elliott302ff6b2021-04-20 18:10:30 +01005150
David Horstmann18dc0322023-12-20 16:16:43 +00005151/* Exit label is only needed for buffer copying, prevent unused warnings. */
David Horstmann4a48bec2024-03-13 15:42:31 +00005152#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
Paul Elliott39dc6b82021-05-11 19:16:09 +01005153exit:
David Horstmann18dc0322023-12-20 16:16:43 +00005154#endif
Paul Elliottcbbde5f2021-05-10 18:19:46 +01005155
David Horstmann8f0ef512023-12-11 15:17:11 +00005156 LOCAL_INPUT_FREE(nonce_external, nonce);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01005157
Gilles Peskine449bd832023-01-11 14:50:10 +01005158 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005159}
5160
5161/* Declare the lengths of the message and additional data for multipart AEAD. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005162psa_status_t psa_aead_set_lengths(psa_aead_operation_t *operation,
5163 size_t ad_length,
5164 size_t plaintext_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01005165{
Paul Elliottcbbde5f2021-05-10 18:19:46 +01005166 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
5167
Gilles Peskine449bd832023-01-11 14:50:10 +01005168 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01005169 status = PSA_ERROR_BAD_STATE;
5170 goto exit;
5171 }
5172
Gilles Peskine449bd832023-01-11 14:50:10 +01005173 if (operation->lengths_set || operation->ad_started ||
5174 operation->body_started) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01005175 status = PSA_ERROR_BAD_STATE;
5176 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005177 }
5178
Gilles Peskine449bd832023-01-11 14:50:10 +01005179 switch (operation->alg) {
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02005180#if defined(PSA_WANT_ALG_GCM)
5181 case PSA_ALG_GCM:
5182 /* Lengths can only be too large for GCM if size_t is bigger than 32
Gilles Peskine449bd832023-01-11 14:50:10 +01005183 * bits. Without the guard this code will generate warnings on 32bit
5184 * builds. */
Paul Elliott325d3742021-09-27 17:56:28 +01005185#if SIZE_MAX > UINT32_MAX
Gilles Peskine449bd832023-01-11 14:50:10 +01005186 if (((uint64_t) ad_length) >> 61 != 0 ||
5187 ((uint64_t) plaintext_length) > 0xFFFFFFFE0ull) {
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02005188 status = PSA_ERROR_INVALID_ARGUMENT;
5189 goto exit;
5190 }
Paul Elliott325d3742021-09-27 17:56:28 +01005191#endif
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02005192 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01005193#endif /* PSA_WANT_ALG_GCM */
5194#if defined(PSA_WANT_ALG_CCM)
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02005195 case PSA_ALG_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01005196 if (ad_length > 0xFF00) {
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02005197 status = PSA_ERROR_INVALID_ARGUMENT;
5198 goto exit;
5199 }
5200 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01005201#endif /* PSA_WANT_ALG_CCM */
5202#if defined(PSA_WANT_ALG_CHACHA20_POLY1305)
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02005203 case PSA_ALG_CHACHA20_POLY1305:
5204 /* No length restrictions for ChaChaPoly. */
5205 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01005206#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02005207 default:
5208 break;
5209 }
Paul Elliott325d3742021-09-27 17:56:28 +01005210
Gilles Peskine449bd832023-01-11 14:50:10 +01005211 status = psa_driver_wrapper_aead_set_lengths(operation, ad_length,
5212 plaintext_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01005213
Paul Elliott39dc6b82021-05-11 19:16:09 +01005214exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01005215 if (status == PSA_SUCCESS) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01005216 operation->ad_remaining = ad_length;
5217 operation->body_remaining = plaintext_length;
Paul Elliott39dc6b82021-05-11 19:16:09 +01005218 operation->lengths_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01005219 } else {
5220 psa_aead_abort(operation);
Paul Elliottee4ffe02021-05-20 17:25:06 +01005221 }
Paul Elliott39dc6b82021-05-11 19:16:09 +01005222
Gilles Peskine449bd832023-01-11 14:50:10 +01005223 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005224}
Paul Elliott3d7d52c2021-09-01 10:33:14 +01005225
5226/* Pass additional data to an active multipart AEAD operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005227psa_status_t psa_aead_update_ad(psa_aead_operation_t *operation,
David Horstmann25dac6e2023-12-11 15:23:13 +00005228 const uint8_t *input_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01005229 size_t input_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01005230{
Paul Elliottcbbde5f2021-05-10 18:19:46 +01005231 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
5232
David Horstmann25dac6e2023-12-11 15:23:13 +00005233 LOCAL_INPUT_DECLARE(input_external, input);
5234 LOCAL_INPUT_ALLOC(input_external, input_length, input);
5235
Gilles Peskine449bd832023-01-11 14:50:10 +01005236 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01005237 status = PSA_ERROR_BAD_STATE;
5238 goto exit;
5239 }
5240
Gilles Peskine449bd832023-01-11 14:50:10 +01005241 if (!operation->nonce_set || operation->body_started) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01005242 status = PSA_ERROR_BAD_STATE;
5243 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005244 }
5245
Paul Elliott304766f2024-04-26 18:30:11 +01005246 /* No input to add (zero length), nothing to do. */
5247 if (input_length == 0) {
5248 status = PSA_SUCCESS;
5249 goto exit;
5250 }
5251
Gilles Peskine449bd832023-01-11 14:50:10 +01005252 if (operation->lengths_set) {
5253 if (operation->ad_remaining < input_length) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01005254 status = PSA_ERROR_INVALID_ARGUMENT;
5255 goto exit;
5256 }
5257
5258 operation->ad_remaining -= input_length;
5259 }
Paul Elliotte193ea82021-10-01 13:00:16 +01005260#if defined(PSA_WANT_ALG_CCM)
Gilles Peskine449bd832023-01-11 14:50:10 +01005261 else if (operation->alg == PSA_ALG_CCM) {
Paul Elliotte193ea82021-10-01 13:00:16 +01005262 status = PSA_ERROR_BAD_STATE;
5263 goto exit;
5264 }
5265#endif /* PSA_WANT_ALG_CCM */
Paul Elliottee4ffe02021-05-20 17:25:06 +01005266
Gilles Peskine449bd832023-01-11 14:50:10 +01005267 status = psa_driver_wrapper_aead_update_ad(operation, input,
5268 input_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01005269
Paul Elliott39dc6b82021-05-11 19:16:09 +01005270exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01005271 if (status == PSA_SUCCESS) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01005272 operation->ad_started = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01005273 } else {
5274 psa_aead_abort(operation);
5275 }
Paul Elliott39dc6b82021-05-11 19:16:09 +01005276
David Horstmann25dac6e2023-12-11 15:23:13 +00005277 LOCAL_INPUT_FREE(input_external, input);
5278
Gilles Peskine449bd832023-01-11 14:50:10 +01005279 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005280}
5281
5282/* Encrypt or decrypt a message fragment in an active multipart AEAD
5283 operation.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01005284psa_status_t psa_aead_update(psa_aead_operation_t *operation,
David Horstmann2914fac2023-12-11 15:28:37 +00005285 const uint8_t *input_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01005286 size_t input_length,
David Horstmann2914fac2023-12-11 15:28:37 +00005287 uint8_t *output_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01005288 size_t output_size,
5289 size_t *output_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01005290{
Paul Elliottcbbde5f2021-05-10 18:19:46 +01005291 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005292
David Horstmann2914fac2023-12-11 15:28:37 +00005293
5294 LOCAL_INPUT_DECLARE(input_external, input);
5295 LOCAL_OUTPUT_DECLARE(output_external, output);
5296
5297 LOCAL_INPUT_ALLOC(input_external, input_length, input);
5298 LOCAL_OUTPUT_ALLOC(output_external, output_size, output);
5299
Paul Elliott302ff6b2021-04-20 18:10:30 +01005300 *output_length = 0;
5301
Gilles Peskine449bd832023-01-11 14:50:10 +01005302 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01005303 status = PSA_ERROR_BAD_STATE;
5304 goto exit;
5305 }
5306
Gilles Peskine449bd832023-01-11 14:50:10 +01005307 if (!operation->nonce_set) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01005308 status = PSA_ERROR_BAD_STATE;
5309 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005310 }
5311
Gilles Peskine449bd832023-01-11 14:50:10 +01005312 if (operation->lengths_set) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01005313 /* Additional data length was supplied, but not all the additional
5314 data was supplied.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01005315 if (operation->ad_remaining != 0) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01005316 status = PSA_ERROR_INVALID_ARGUMENT;
5317 goto exit;
5318 }
5319
5320 /* Too much data provided. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005321 if (operation->body_remaining < input_length) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01005322 status = PSA_ERROR_INVALID_ARGUMENT;
5323 goto exit;
5324 }
5325
5326 operation->body_remaining -= input_length;
5327 }
Paul Elliotte193ea82021-10-01 13:00:16 +01005328#if defined(PSA_WANT_ALG_CCM)
Gilles Peskine449bd832023-01-11 14:50:10 +01005329 else if (operation->alg == PSA_ALG_CCM) {
Paul Elliotte193ea82021-10-01 13:00:16 +01005330 status = PSA_ERROR_BAD_STATE;
5331 goto exit;
5332 }
5333#endif /* PSA_WANT_ALG_CCM */
Paul Elliottee4ffe02021-05-20 17:25:06 +01005334
Gilles Peskine449bd832023-01-11 14:50:10 +01005335 status = psa_driver_wrapper_aead_update(operation, input, input_length,
5336 output, output_size,
5337 output_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01005338
Paul Elliott39dc6b82021-05-11 19:16:09 +01005339exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01005340 if (status == PSA_SUCCESS) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01005341 operation->body_started = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01005342 } else {
5343 psa_aead_abort(operation);
5344 }
Paul Elliott39dc6b82021-05-11 19:16:09 +01005345
David Horstmann2914fac2023-12-11 15:28:37 +00005346 LOCAL_INPUT_FREE(input_external, input);
5347 LOCAL_OUTPUT_FREE(output_external, output);
5348
Gilles Peskine449bd832023-01-11 14:50:10 +01005349 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005350}
5351
Gilles Peskine449bd832023-01-11 14:50:10 +01005352static psa_status_t psa_aead_final_checks(const psa_aead_operation_t *operation)
Paul Elliottad53dcc2021-06-23 08:50:14 +01005353{
Gilles Peskine449bd832023-01-11 14:50:10 +01005354 if (operation->id == 0 || !operation->nonce_set) {
5355 return PSA_ERROR_BAD_STATE;
5356 }
Paul Elliottad53dcc2021-06-23 08:50:14 +01005357
Gilles Peskine449bd832023-01-11 14:50:10 +01005358 if (operation->lengths_set && (operation->ad_remaining != 0 ||
5359 operation->body_remaining != 0)) {
5360 return PSA_ERROR_INVALID_ARGUMENT;
5361 }
Paul Elliottad53dcc2021-06-23 08:50:14 +01005362
Gilles Peskine449bd832023-01-11 14:50:10 +01005363 return PSA_SUCCESS;
Paul Elliottad53dcc2021-06-23 08:50:14 +01005364}
5365
Paul Elliott302ff6b2021-04-20 18:10:30 +01005366/* Finish encrypting a message in a multipart AEAD operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005367psa_status_t psa_aead_finish(psa_aead_operation_t *operation,
David Horstmann6db0e732023-12-11 15:35:59 +00005368 uint8_t *ciphertext_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01005369 size_t ciphertext_size,
5370 size_t *ciphertext_length,
David Horstmann6db0e732023-12-11 15:35:59 +00005371 uint8_t *tag_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01005372 size_t tag_size,
5373 size_t *tag_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01005374{
Paul Elliott39dc6b82021-05-11 19:16:09 +01005375 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
5376
David Horstmann6db0e732023-12-11 15:35:59 +00005377 LOCAL_OUTPUT_DECLARE(ciphertext_external, ciphertext);
5378 LOCAL_OUTPUT_DECLARE(tag_external, tag);
5379
5380 LOCAL_OUTPUT_ALLOC(ciphertext_external, ciphertext_size, ciphertext);
5381 LOCAL_OUTPUT_ALLOC(tag_external, tag_size, tag);
5382
Paul Elliott302ff6b2021-04-20 18:10:30 +01005383 *ciphertext_length = 0;
Paul Elliottf88a5652021-06-22 17:53:45 +01005384 *tag_length = tag_size;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005385
Gilles Peskine449bd832023-01-11 14:50:10 +01005386 status = psa_aead_final_checks(operation);
5387 if (status != PSA_SUCCESS) {
Paul Elliottad53dcc2021-06-23 08:50:14 +01005388 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005389 }
Paul Elliottad53dcc2021-06-23 08:50:14 +01005390
Gilles Peskine449bd832023-01-11 14:50:10 +01005391 if (!operation->is_encrypt) {
Paul Elliottcee785c2021-05-20 14:29:20 +01005392 status = PSA_ERROR_BAD_STATE;
5393 goto exit;
5394 }
5395
Gilles Peskine449bd832023-01-11 14:50:10 +01005396 status = psa_driver_wrapper_aead_finish(operation, ciphertext,
5397 ciphertext_size,
5398 ciphertext_length,
5399 tag, tag_size, tag_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01005400
Paul Elliott39dc6b82021-05-11 19:16:09 +01005401exit:
Paul Elliottdc42ca82023-02-24 18:11:59 +00005402
5403
Paul Elliottf47b0952021-05-21 18:02:33 +01005404 /* In case the operation fails and the user fails to check for failure or
Paul Elliott4c916e82021-09-19 18:34:50 +01005405 * the zero tag size, make sure the tag is set to something implausible.
5406 * Even if the operation succeeds, make sure we clear the rest of the
5407 * buffer to prevent potential leakage of anything previously placed in
5408 * the same buffer.*/
Paul Elliottdc42ca82023-02-24 18:11:59 +00005409 psa_wipe_tag_output_buffer(tag, status, tag_size, *tag_length);
Paul Elliottf47b0952021-05-21 18:02:33 +01005410
Gilles Peskine449bd832023-01-11 14:50:10 +01005411 psa_aead_abort(operation);
Paul Elliott39dc6b82021-05-11 19:16:09 +01005412
David Horstmann6db0e732023-12-11 15:35:59 +00005413 LOCAL_OUTPUT_FREE(ciphertext_external, ciphertext);
5414 LOCAL_OUTPUT_FREE(tag_external, tag);
5415
Gilles Peskine449bd832023-01-11 14:50:10 +01005416 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005417}
5418
5419/* Finish authenticating and decrypting a message in a multipart AEAD
5420 operation.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01005421psa_status_t psa_aead_verify(psa_aead_operation_t *operation,
David Horstmanne000a0a2023-12-11 16:37:04 +00005422 uint8_t *plaintext_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01005423 size_t plaintext_size,
5424 size_t *plaintext_length,
David Horstmanne000a0a2023-12-11 16:37:04 +00005425 const uint8_t *tag_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01005426 size_t tag_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01005427{
Paul Elliott39dc6b82021-05-11 19:16:09 +01005428 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
5429
David Horstmanne000a0a2023-12-11 16:37:04 +00005430 LOCAL_OUTPUT_DECLARE(plaintext_external, plaintext);
5431 LOCAL_INPUT_DECLARE(tag_external, tag);
5432
5433 LOCAL_OUTPUT_ALLOC(plaintext_external, plaintext_size, plaintext);
5434 LOCAL_INPUT_ALLOC(tag_external, tag_length, tag);
5435
Paul Elliott302ff6b2021-04-20 18:10:30 +01005436 *plaintext_length = 0;
5437
Gilles Peskine449bd832023-01-11 14:50:10 +01005438 status = psa_aead_final_checks(operation);
5439 if (status != PSA_SUCCESS) {
Paul Elliottad53dcc2021-06-23 08:50:14 +01005440 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005441 }
Paul Elliottad53dcc2021-06-23 08:50:14 +01005442
Gilles Peskine449bd832023-01-11 14:50:10 +01005443 if (operation->is_encrypt) {
Paul Elliottcee785c2021-05-20 14:29:20 +01005444 status = PSA_ERROR_BAD_STATE;
5445 goto exit;
5446 }
5447
Gilles Peskine449bd832023-01-11 14:50:10 +01005448 status = psa_driver_wrapper_aead_verify(operation, plaintext,
5449 plaintext_size,
5450 plaintext_length,
5451 tag, tag_length);
Paul Elliott39dc6b82021-05-11 19:16:09 +01005452
5453exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01005454 psa_aead_abort(operation);
Paul Elliott39dc6b82021-05-11 19:16:09 +01005455
David Horstmanne000a0a2023-12-11 16:37:04 +00005456 LOCAL_OUTPUT_FREE(plaintext_external, plaintext);
5457 LOCAL_INPUT_FREE(tag_external, tag);
5458
Gilles Peskine449bd832023-01-11 14:50:10 +01005459 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005460}
5461
5462/* Abort an AEAD operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005463psa_status_t psa_aead_abort(psa_aead_operation_t *operation)
Paul Elliott302ff6b2021-04-20 18:10:30 +01005464{
5465 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
5466
Gilles Peskine449bd832023-01-11 14:50:10 +01005467 if (operation->id == 0) {
Paul Elliott302ff6b2021-04-20 18:10:30 +01005468 /* The object has (apparently) been initialized but it is not (yet)
5469 * in use. It's ok to call abort on such an object, and there's
5470 * nothing to do. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005471 return PSA_SUCCESS;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005472 }
5473
Gilles Peskine449bd832023-01-11 14:50:10 +01005474 status = psa_driver_wrapper_aead_abort(operation);
Paul Elliott302ff6b2021-04-20 18:10:30 +01005475
Gilles Peskine449bd832023-01-11 14:50:10 +01005476 memset(operation, 0, sizeof(*operation));
Paul Elliott302ff6b2021-04-20 18:10:30 +01005477
Gilles Peskine449bd832023-01-11 14:50:10 +01005478 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005479}
5480
Gilles Peskinee59236f2018-01-27 23:32:46 +01005481/****************************************************************/
Gilles Peskineeab56e42018-07-12 17:12:33 +02005482/* Generators */
5483/****************************************************************/
5484
Przemek Stekiel69c46792022-06-10 12:59:51 +02005485#if defined(BUILTIN_ALG_ANY_HKDF) || \
John Durkop07cc04a2020-11-16 22:08:34 -08005486 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005487 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) || \
Kusumit Ghoderaoaf0b5342023-05-03 11:58:46 +05305488 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) || \
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05305489 defined(PSA_HAVE_SOFT_PBKDF2)
John Durkop07cc04a2020-11-16 22:08:34 -08005490#define AT_LEAST_ONE_BUILTIN_KDF
Steven Cooreman094a77e2021-05-06 17:58:36 +02005491#endif /* At least one builtin KDF */
5492
Przemek Stekiel69c46792022-06-10 12:59:51 +02005493#if defined(BUILTIN_ALG_ANY_HKDF) || \
Steven Cooreman094a77e2021-05-06 17:58:36 +02005494 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
5495 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
5496static psa_status_t psa_key_derivation_start_hmac(
5497 psa_mac_operation_t *operation,
5498 psa_algorithm_t hash_alg,
5499 const uint8_t *hmac_key,
Gilles Peskine449bd832023-01-11 14:50:10 +01005500 size_t hmac_key_length)
Steven Cooreman094a77e2021-05-06 17:58:36 +02005501{
5502 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
5503 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine449bd832023-01-11 14:50:10 +01005504 psa_set_key_type(&attributes, PSA_KEY_TYPE_HMAC);
5505 psa_set_key_bits(&attributes, PSA_BYTES_TO_BITS(hmac_key_length));
5506 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_HASH);
Steven Cooreman094a77e2021-05-06 17:58:36 +02005507
Steven Cooreman72f736a2021-05-07 14:14:37 +02005508 operation->is_sign = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01005509 operation->mac_size = PSA_HASH_LENGTH(hash_alg);
Steven Cooreman72f736a2021-05-07 14:14:37 +02005510
Gilles Peskine449bd832023-01-11 14:50:10 +01005511 status = psa_driver_wrapper_mac_sign_setup(operation,
5512 &attributes,
5513 hmac_key, hmac_key_length,
5514 PSA_ALG_HMAC(hash_alg));
Steven Cooreman094a77e2021-05-06 17:58:36 +02005515
Gilles Peskine449bd832023-01-11 14:50:10 +01005516 psa_reset_key_attributes(&attributes);
5517 return status;
Steven Cooreman094a77e2021-05-06 17:58:36 +02005518}
5519#endif /* KDF algorithms reliant on HMAC */
John Durkop07cc04a2020-11-16 22:08:34 -08005520
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005521#define HKDF_STATE_INIT 0 /* no input yet */
5522#define HKDF_STATE_STARTED 1 /* got salt */
5523#define HKDF_STATE_KEYED 2 /* got key */
5524#define HKDF_STATE_OUTPUT 3 /* output started */
5525
Gilles Peskinecbe66502019-05-16 16:59:18 +02005526static psa_algorithm_t psa_key_derivation_get_kdf_alg(
Gilles Peskine449bd832023-01-11 14:50:10 +01005527 const psa_key_derivation_operation_t *operation)
Gilles Peskine969c5d62019-01-16 15:53:06 +01005528{
Gilles Peskine449bd832023-01-11 14:50:10 +01005529 if (PSA_ALG_IS_KEY_AGREEMENT(operation->alg)) {
5530 return PSA_ALG_KEY_AGREEMENT_GET_KDF(operation->alg);
5531 } else {
5532 return operation->alg;
5533 }
Gilles Peskine969c5d62019-01-16 15:53:06 +01005534}
5535
Gilles Peskine449bd832023-01-11 14:50:10 +01005536psa_status_t psa_key_derivation_abort(psa_key_derivation_operation_t *operation)
Gilles Peskineeab56e42018-07-12 17:12:33 +02005537{
5538 psa_status_t status = PSA_SUCCESS;
Gilles Peskine449bd832023-01-11 14:50:10 +01005539 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation);
5540 if (kdf_alg == 0) {
Gilles Peskineeab56e42018-07-12 17:12:33 +02005541 /* The object has (apparently) been initialized but it is not
5542 * in use. It's ok to call abort on such an object, and there's
5543 * nothing to do. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005544 } else
Przemek Stekiel69c46792022-06-10 12:59:51 +02005545#if defined(BUILTIN_ALG_ANY_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01005546 if (PSA_ALG_IS_ANY_HKDF(kdf_alg)) {
5547 mbedtls_free(operation->ctx.hkdf.info);
5548 status = psa_mac_abort(&operation->ctx.hkdf.hmac);
5549 } else
Przemek Stekiel69c46792022-06-10 12:59:51 +02005550#endif /* BUILTIN_ALG_ANY_HKDF */
John Durkop07cc04a2020-11-16 22:08:34 -08005551#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
5552 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005553 if (PSA_ALG_IS_TLS12_PRF(kdf_alg) ||
5554 /* TLS-1.2 PSK-to-MS KDF uses the same core as TLS-1.2 PRF */
5555 PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
5556 if (operation->ctx.tls12_prf.secret != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01005557 mbedtls_zeroize_and_free(operation->ctx.tls12_prf.secret,
Gilles Peskine449bd832023-01-11 14:50:10 +01005558 operation->ctx.tls12_prf.secret_length);
Steven Cooremana6df6042021-04-29 19:32:25 +02005559 }
5560
Gilles Peskine449bd832023-01-11 14:50:10 +01005561 if (operation->ctx.tls12_prf.seed != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01005562 mbedtls_zeroize_and_free(operation->ctx.tls12_prf.seed,
Gilles Peskine449bd832023-01-11 14:50:10 +01005563 operation->ctx.tls12_prf.seed_length);
Janos Follath6a1d2622019-06-11 10:37:28 +01005564 }
5565
Gilles Peskine449bd832023-01-11 14:50:10 +01005566 if (operation->ctx.tls12_prf.label != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01005567 mbedtls_zeroize_and_free(operation->ctx.tls12_prf.label,
Gilles Peskine449bd832023-01-11 14:50:10 +01005568 operation->ctx.tls12_prf.label_length);
Janos Follath6a1d2622019-06-11 10:37:28 +01005569 }
Przemek Stekiel6c764412022-11-22 14:05:12 +01005570#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005571 if (operation->ctx.tls12_prf.other_secret != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01005572 mbedtls_zeroize_and_free(operation->ctx.tls12_prf.other_secret,
Gilles Peskine449bd832023-01-11 14:50:10 +01005573 operation->ctx.tls12_prf.other_secret_length);
Przemek Stekiele3ee2212022-04-07 14:29:56 +02005574 }
Przemek Stekiel6c764412022-11-22 14:05:12 +01005575#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Steven Cooremana6df6042021-04-29 19:32:25 +02005576 status = PSA_SUCCESS;
Janos Follath6a1d2622019-06-11 10:37:28 +01005577
5578 /* We leave the fields Ai and output_block to be erased safely by the
5579 * mbedtls_platform_zeroize() in the end of this function. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005580 } else
John Durkop07cc04a2020-11-16 22:08:34 -08005581#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) ||
5582 * defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) */
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005583#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005584 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
5585 mbedtls_platform_zeroize(operation->ctx.tls12_ecjpake_to_pms.data,
5586 sizeof(operation->ctx.tls12_ecjpake_to_pms.data));
5587 } else
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005588#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) */
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05305589#if defined(PSA_HAVE_SOFT_PBKDF2)
Kusumit Ghoderao9ab03c32023-07-27 21:14:05 +05305590 if (PSA_ALG_IS_PBKDF2(kdf_alg)) {
Kusumit Ghoderaof5fedf12023-05-03 12:29:48 +05305591 if (operation->ctx.pbkdf2.salt != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01005592 mbedtls_zeroize_and_free(operation->ctx.pbkdf2.salt,
Kusumit Ghoderaof5fedf12023-05-03 12:29:48 +05305593 operation->ctx.pbkdf2.salt_length);
Kusumit Ghoderaof5fedf12023-05-03 12:29:48 +05305594 }
Kusumit Ghoderaof5fedf12023-05-03 12:29:48 +05305595
5596 status = PSA_SUCCESS;
5597 } else
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05305598#endif /* defined(PSA_HAVE_SOFT_PBKDF2) */
Gilles Peskineeab56e42018-07-12 17:12:33 +02005599 {
5600 status = PSA_ERROR_BAD_STATE;
5601 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005602 mbedtls_platform_zeroize(operation, sizeof(*operation));
5603 return status;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005604}
5605
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005606psa_status_t psa_key_derivation_get_capacity(const psa_key_derivation_operation_t *operation,
Gilles Peskine449bd832023-01-11 14:50:10 +01005607 size_t *capacity)
Gilles Peskineeab56e42018-07-12 17:12:33 +02005608{
Gilles Peskine449bd832023-01-11 14:50:10 +01005609 if (operation->alg == 0) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005610 /* This is a blank key derivation operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005611 return PSA_ERROR_BAD_STATE;
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005612 }
5613
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005614 *capacity = operation->capacity;
Gilles Peskine449bd832023-01-11 14:50:10 +01005615 return PSA_SUCCESS;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005616}
5617
Gilles Peskine449bd832023-01-11 14:50:10 +01005618psa_status_t psa_key_derivation_set_capacity(psa_key_derivation_operation_t *operation,
5619 size_t capacity)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005620{
Gilles Peskine449bd832023-01-11 14:50:10 +01005621 if (operation->alg == 0) {
5622 return PSA_ERROR_BAD_STATE;
5623 }
5624 if (capacity > operation->capacity) {
5625 return PSA_ERROR_INVALID_ARGUMENT;
5626 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005627 operation->capacity = capacity;
Gilles Peskine449bd832023-01-11 14:50:10 +01005628 return PSA_SUCCESS;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005629}
5630
Przemek Stekiel69c46792022-06-10 12:59:51 +02005631#if defined(BUILTIN_ALG_ANY_HKDF)
Przemek Stekiel03d948c2022-05-19 11:45:20 +02005632/* Read some bytes from an HKDF-based operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005633static psa_status_t psa_key_derivation_hkdf_read(psa_hkdf_key_derivation_t *hkdf,
5634 psa_algorithm_t kdf_alg,
5635 uint8_t *output,
5636 size_t output_length)
Gilles Peskinebef7f142018-07-12 17:22:21 +02005637{
Gilles Peskine449bd832023-01-11 14:50:10 +01005638 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(kdf_alg);
5639 uint8_t hash_length = PSA_HASH_LENGTH(hash_alg);
Steven Cooremand1ed1d92021-04-29 19:11:25 +02005640 size_t hmac_output_length;
Gilles Peskinebef7f142018-07-12 17:22:21 +02005641 psa_status_t status;
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02005642#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01005643 const uint8_t last_block = PSA_ALG_IS_HKDF_EXTRACT(kdf_alg) ? 0 : 0xff;
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02005644#else
5645 const uint8_t last_block = 0xff;
5646#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Gilles Peskinebef7f142018-07-12 17:22:21 +02005647
Gilles Peskine449bd832023-01-11 14:50:10 +01005648 if (hkdf->state < HKDF_STATE_KEYED ||
5649 (!hkdf->info_set
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02005650#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01005651 && !PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02005652#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Gilles Peskine449bd832023-01-11 14:50:10 +01005653 )) {
5654 return PSA_ERROR_BAD_STATE;
5655 }
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005656 hkdf->state = HKDF_STATE_OUTPUT;
5657
Gilles Peskine449bd832023-01-11 14:50:10 +01005658 while (output_length != 0) {
Gilles Peskinebef7f142018-07-12 17:22:21 +02005659 /* Copy what remains of the current block */
5660 uint8_t n = hash_length - hkdf->offset_in_block;
Gilles Peskine449bd832023-01-11 14:50:10 +01005661 if (n > output_length) {
Gilles Peskinebef7f142018-07-12 17:22:21 +02005662 n = (uint8_t) output_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01005663 }
5664 memcpy(output, hkdf->output_block + hkdf->offset_in_block, n);
Gilles Peskinebef7f142018-07-12 17:22:21 +02005665 output += n;
5666 output_length -= n;
5667 hkdf->offset_in_block += n;
Gilles Peskine449bd832023-01-11 14:50:10 +01005668 if (output_length == 0) {
Gilles Peskinebef7f142018-07-12 17:22:21 +02005669 break;
Gilles Peskine449bd832023-01-11 14:50:10 +01005670 }
Przemek Stekiel03d948c2022-05-19 11:45:20 +02005671 /* We can't be wanting more output after the last block, otherwise
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02005672 * the capacity check in psa_key_derivation_output_bytes() would have
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005673 * prevented this call. It could happen only if the operation
Gilles Peskined54931c2018-07-17 21:06:59 +02005674 * object was corrupted or if this function is called directly
5675 * inside the library. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005676 if (hkdf->block_number == last_block) {
5677 return PSA_ERROR_BAD_STATE;
5678 }
Gilles Peskinebef7f142018-07-12 17:22:21 +02005679
5680 /* We need a new block */
5681 ++hkdf->block_number;
5682 hkdf->offset_in_block = 0;
Steven Cooremand1ed1d92021-04-29 19:11:25 +02005683
Gilles Peskine449bd832023-01-11 14:50:10 +01005684 status = psa_key_derivation_start_hmac(&hkdf->hmac,
5685 hash_alg,
5686 hkdf->prk,
5687 hash_length);
5688 if (status != PSA_SUCCESS) {
5689 return status;
Gilles Peskinebef7f142018-07-12 17:22:21 +02005690 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005691
5692 if (hkdf->block_number != 1) {
5693 status = psa_mac_update(&hkdf->hmac,
5694 hkdf->output_block,
5695 hash_length);
5696 if (status != PSA_SUCCESS) {
5697 return status;
5698 }
5699 }
5700 status = psa_mac_update(&hkdf->hmac,
5701 hkdf->info,
5702 hkdf->info_length);
5703 if (status != PSA_SUCCESS) {
5704 return status;
5705 }
5706 status = psa_mac_update(&hkdf->hmac,
5707 &hkdf->block_number, 1);
5708 if (status != PSA_SUCCESS) {
5709 return status;
5710 }
5711 status = psa_mac_sign_finish(&hkdf->hmac,
5712 hkdf->output_block,
5713 sizeof(hkdf->output_block),
5714 &hmac_output_length);
5715 if (status != PSA_SUCCESS) {
5716 return status;
5717 }
Gilles Peskinebef7f142018-07-12 17:22:21 +02005718 }
5719
Gilles Peskine449bd832023-01-11 14:50:10 +01005720 return PSA_SUCCESS;
Gilles Peskinebef7f142018-07-12 17:22:21 +02005721}
Przemek Stekiel69c46792022-06-10 12:59:51 +02005722#endif /* BUILTIN_ALG_ANY_HKDF */
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005723
John Durkop07cc04a2020-11-16 22:08:34 -08005724#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
5725 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Janos Follath7742fee2019-06-17 12:58:10 +01005726static psa_status_t psa_key_derivation_tls12_prf_generate_next_block(
5727 psa_tls12_prf_key_derivation_t *tls12_prf,
Gilles Peskine449bd832023-01-11 14:50:10 +01005728 psa_algorithm_t alg)
Janos Follath7742fee2019-06-17 12:58:10 +01005729{
Gilles Peskine449bd832023-01-11 14:50:10 +01005730 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(alg);
5731 uint8_t hash_length = PSA_HASH_LENGTH(hash_alg);
Steven Cooremana6df6042021-04-29 19:32:25 +02005732 psa_mac_operation_t hmac = PSA_MAC_OPERATION_INIT;
5733 size_t hmac_output_length;
Janos Follathea29bfb2019-06-19 12:21:20 +01005734 psa_status_t status, cleanup_status;
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005735
Janos Follath7742fee2019-06-17 12:58:10 +01005736 /* We can't be wanting more output after block 0xff, otherwise
5737 * the capacity check in psa_key_derivation_output_bytes() would have
5738 * prevented this call. It could happen only if the operation
5739 * object was corrupted or if this function is called directly
5740 * inside the library. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005741 if (tls12_prf->block_number == 0xff) {
5742 return PSA_ERROR_CORRUPTION_DETECTED;
5743 }
Janos Follath7742fee2019-06-17 12:58:10 +01005744
5745 /* We need a new block */
5746 ++tls12_prf->block_number;
Janos Follath844eb0e2019-06-19 12:10:49 +01005747 tls12_prf->left_in_block = hash_length;
Janos Follath7742fee2019-06-17 12:58:10 +01005748
5749 /* Recall the definition of the TLS-1.2-PRF from RFC 5246:
5750 *
5751 * PRF(secret, label, seed) = P_<hash>(secret, label + seed)
5752 *
5753 * P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
5754 * HMAC_hash(secret, A(2) + seed) +
5755 * HMAC_hash(secret, A(3) + seed) + ...
5756 *
5757 * A(0) = seed
Janos Follathea29bfb2019-06-19 12:21:20 +01005758 * A(i) = HMAC_hash(secret, A(i-1))
Janos Follath7742fee2019-06-17 12:58:10 +01005759 *
Janos Follathea29bfb2019-06-19 12:21:20 +01005760 * The `psa_tls12_prf_key_derivation` structure saves the block
Janos Follath7742fee2019-06-17 12:58:10 +01005761 * `HMAC_hash(secret, A(i) + seed)` from which the output
Janos Follath76c39842019-06-26 12:50:36 +01005762 * is currently extracted as `output_block` and where i is
5763 * `block_number`.
Janos Follath7742fee2019-06-17 12:58:10 +01005764 */
5765
Gilles Peskine449bd832023-01-11 14:50:10 +01005766 status = psa_key_derivation_start_hmac(&hmac,
5767 hash_alg,
5768 tls12_prf->secret,
5769 tls12_prf->secret_length);
5770 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005771 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005772 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005773
5774 /* Calculate A(i) where i = tls12_prf->block_number. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005775 if (tls12_prf->block_number == 1) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005776 /* A(1) = HMAC_hash(secret, A(0)), where A(0) = seed. (The RFC overloads
5777 * the variable seed and in this instance means it in the context of the
5778 * P_hash function, where seed = label + seed.) */
Gilles Peskine449bd832023-01-11 14:50:10 +01005779 status = psa_mac_update(&hmac,
5780 tls12_prf->label,
5781 tls12_prf->label_length);
5782 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005783 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005784 }
5785 status = psa_mac_update(&hmac,
5786 tls12_prf->seed,
5787 tls12_prf->seed_length);
5788 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005789 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005790 }
5791 } else {
Janos Follathea29bfb2019-06-19 12:21:20 +01005792 /* A(i) = HMAC_hash(secret, A(i-1)) */
Gilles Peskine449bd832023-01-11 14:50:10 +01005793 status = psa_mac_update(&hmac, tls12_prf->Ai, hash_length);
5794 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005795 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005796 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005797 }
5798
Gilles Peskine449bd832023-01-11 14:50:10 +01005799 status = psa_mac_sign_finish(&hmac,
5800 tls12_prf->Ai, hash_length,
5801 &hmac_output_length);
5802 if (hmac_output_length != hash_length) {
Steven Cooremana6df6042021-04-29 19:32:25 +02005803 status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine449bd832023-01-11 14:50:10 +01005804 }
5805 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005806 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005807 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005808
5809 /* Calculate HMAC_hash(secret, A(i) + label + seed). */
Gilles Peskine449bd832023-01-11 14:50:10 +01005810 status = psa_key_derivation_start_hmac(&hmac,
5811 hash_alg,
5812 tls12_prf->secret,
5813 tls12_prf->secret_length);
5814 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005815 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005816 }
5817 status = psa_mac_update(&hmac, tls12_prf->Ai, hash_length);
5818 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005819 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005820 }
5821 status = psa_mac_update(&hmac, tls12_prf->label, tls12_prf->label_length);
5822 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005823 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005824 }
5825 status = psa_mac_update(&hmac, tls12_prf->seed, tls12_prf->seed_length);
5826 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005827 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005828 }
5829 status = psa_mac_sign_finish(&hmac,
5830 tls12_prf->output_block, hash_length,
5831 &hmac_output_length);
5832 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005833 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005834 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005835
Janos Follath7742fee2019-06-17 12:58:10 +01005836
5837cleanup:
Gilles Peskine449bd832023-01-11 14:50:10 +01005838 cleanup_status = psa_mac_abort(&hmac);
5839 if (status == PSA_SUCCESS && cleanup_status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005840 status = cleanup_status;
Gilles Peskine449bd832023-01-11 14:50:10 +01005841 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005842
Gilles Peskine449bd832023-01-11 14:50:10 +01005843 return status;
Janos Follath7742fee2019-06-17 12:58:10 +01005844}
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005845
Janos Follath844eb0e2019-06-19 12:10:49 +01005846static psa_status_t psa_key_derivation_tls12_prf_read(
5847 psa_tls12_prf_key_derivation_t *tls12_prf,
5848 psa_algorithm_t alg,
5849 uint8_t *output,
Gilles Peskine449bd832023-01-11 14:50:10 +01005850 size_t output_length)
Janos Follath844eb0e2019-06-19 12:10:49 +01005851{
Gilles Peskine449bd832023-01-11 14:50:10 +01005852 psa_algorithm_t hash_alg = PSA_ALG_TLS12_PRF_GET_HASH(alg);
5853 uint8_t hash_length = PSA_HASH_LENGTH(hash_alg);
Janos Follath844eb0e2019-06-19 12:10:49 +01005854 psa_status_t status;
5855 uint8_t offset, length;
5856
Gilles Peskine449bd832023-01-11 14:50:10 +01005857 switch (tls12_prf->state) {
Gilles Peskineb1edaec2021-06-11 22:41:46 +02005858 case PSA_TLS12_PRF_STATE_LABEL_SET:
5859 tls12_prf->state = PSA_TLS12_PRF_STATE_OUTPUT;
5860 break;
5861 case PSA_TLS12_PRF_STATE_OUTPUT:
5862 break;
5863 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01005864 return PSA_ERROR_BAD_STATE;
Gilles Peskineb1edaec2021-06-11 22:41:46 +02005865 }
5866
Gilles Peskine449bd832023-01-11 14:50:10 +01005867 while (output_length != 0) {
Janos Follath844eb0e2019-06-19 12:10:49 +01005868 /* Check if we have fully processed the current block. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005869 if (tls12_prf->left_in_block == 0) {
5870 status = psa_key_derivation_tls12_prf_generate_next_block(tls12_prf,
5871 alg);
5872 if (status != PSA_SUCCESS) {
5873 return status;
5874 }
Janos Follath844eb0e2019-06-19 12:10:49 +01005875
5876 continue;
5877 }
5878
Gilles Peskine449bd832023-01-11 14:50:10 +01005879 if (tls12_prf->left_in_block > output_length) {
Janos Follath844eb0e2019-06-19 12:10:49 +01005880 length = (uint8_t) output_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01005881 } else {
Janos Follath844eb0e2019-06-19 12:10:49 +01005882 length = tls12_prf->left_in_block;
Gilles Peskine449bd832023-01-11 14:50:10 +01005883 }
Janos Follath844eb0e2019-06-19 12:10:49 +01005884
5885 offset = hash_length - tls12_prf->left_in_block;
Gilles Peskine449bd832023-01-11 14:50:10 +01005886 memcpy(output, tls12_prf->output_block + offset, length);
Janos Follath844eb0e2019-06-19 12:10:49 +01005887 output += length;
5888 output_length -= length;
5889 tls12_prf->left_in_block -= length;
5890 }
5891
Gilles Peskine449bd832023-01-11 14:50:10 +01005892 return PSA_SUCCESS;
Janos Follath844eb0e2019-06-19 12:10:49 +01005893}
John Durkop07cc04a2020-11-16 22:08:34 -08005894#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF ||
5895 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Gilles Peskinebef7f142018-07-12 17:22:21 +02005896
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005897#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
5898static psa_status_t psa_key_derivation_tls12_ecjpake_to_pms_read(
5899 psa_tls12_ecjpake_to_pms_t *ecjpake,
5900 uint8_t *output,
Gilles Peskine449bd832023-01-11 14:50:10 +01005901 size_t output_length)
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005902{
5903 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Andrzej Kurek5603efd2022-09-26 10:49:16 -04005904 size_t output_size = 0;
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005905
Gilles Peskine449bd832023-01-11 14:50:10 +01005906 if (output_length != 32) {
5907 return PSA_ERROR_INVALID_ARGUMENT;
5908 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005909
Gilles Peskine449bd832023-01-11 14:50:10 +01005910 status = psa_hash_compute(PSA_ALG_SHA_256, ecjpake->data,
5911 PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE, output, output_length,
5912 &output_size);
5913 if (status != PSA_SUCCESS) {
5914 return status;
5915 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005916
Gilles Peskine449bd832023-01-11 14:50:10 +01005917 if (output_size != output_length) {
5918 return PSA_ERROR_GENERIC_ERROR;
5919 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005920
Gilles Peskine449bd832023-01-11 14:50:10 +01005921 return PSA_SUCCESS;
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005922}
5923#endif
5924
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05305925#if defined(PSA_HAVE_SOFT_PBKDF2)
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305926static psa_status_t psa_key_derivation_pbkdf2_generate_block(
5927 psa_pbkdf2_key_derivation_t *pbkdf2,
5928 psa_algorithm_t prf_alg,
5929 uint8_t prf_output_length,
5930 psa_key_attributes_t *attributes)
5931{
5932 psa_status_t status;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305933 psa_mac_operation_t mac_operation = PSA_MAC_OPERATION_INIT;
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305934 size_t mac_output_length;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305935 uint8_t U_i[PSA_MAC_MAX_SIZE];
Kusumit Ghoderao257ea002023-06-14 15:55:11 +05305936 uint8_t *U_accumulator = pbkdf2->output_block;
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305937 uint64_t i;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305938 uint8_t block_counter[4];
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305939
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305940 mac_operation.is_sign = 1;
5941 mac_operation.mac_size = prf_output_length;
5942 MBEDTLS_PUT_UINT32_BE(pbkdf2->block_number, block_counter, 0);
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305943
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305944 status = psa_driver_wrapper_mac_sign_setup(&mac_operation,
5945 attributes,
5946 pbkdf2->password,
5947 pbkdf2->password_length,
5948 prf_alg);
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305949 if (status != PSA_SUCCESS) {
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305950 goto cleanup;
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305951 }
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305952 status = psa_mac_update(&mac_operation, pbkdf2->salt, pbkdf2->salt_length);
5953 if (status != PSA_SUCCESS) {
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305954 goto cleanup;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305955 }
Kusumit Ghoderao257ea002023-06-14 15:55:11 +05305956 status = psa_mac_update(&mac_operation, block_counter, sizeof(block_counter));
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305957 if (status != PSA_SUCCESS) {
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305958 goto cleanup;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305959 }
5960 status = psa_mac_sign_finish(&mac_operation, U_i, sizeof(U_i),
5961 &mac_output_length);
5962 if (status != PSA_SUCCESS) {
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305963 goto cleanup;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305964 }
5965
5966 if (mac_output_length != prf_output_length) {
Kusumit Ghoderao257ea002023-06-14 15:55:11 +05305967 status = PSA_ERROR_CORRUPTION_DETECTED;
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305968 goto cleanup;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305969 }
5970
Kusumit Ghoderao257ea002023-06-14 15:55:11 +05305971 memcpy(U_accumulator, U_i, prf_output_length);
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305972
5973 for (i = 1; i < pbkdf2->input_cost; i++) {
Kusumit Ghoderao4536bb62023-06-22 15:42:59 +05305974 /* We are passing prf_output_length as mac_size because the driver
5975 * function directly sets mac_output_length as mac_size upon success.
Kusumit Ghoderao5f3345a2023-07-27 21:21:38 +05305976 * See https://github.com/Mbed-TLS/mbedtls/issues/7801 */
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305977 status = psa_driver_wrapper_mac_compute(attributes,
5978 pbkdf2->password,
5979 pbkdf2->password_length,
5980 prf_alg, U_i, prf_output_length,
Kusumit Ghoderao4536bb62023-06-22 15:42:59 +05305981 U_i, prf_output_length,
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305982 &mac_output_length);
5983 if (status != PSA_SUCCESS) {
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305984 goto cleanup;
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305985 }
5986
Kusumit Ghoderao109ee3d2023-06-08 16:36:45 +05305987 mbedtls_xor(U_accumulator, U_accumulator, U_i, prf_output_length);
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305988 }
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305989
5990cleanup:
5991 /* Zeroise buffers to clear sensitive data from memory. */
5992 mbedtls_platform_zeroize(U_i, PSA_MAC_MAX_SIZE);
5993 return status;
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305994}
Kusumit Ghoderaof6a0d572023-06-05 14:55:56 +05305995
5996static psa_status_t psa_key_derivation_pbkdf2_read(
5997 psa_pbkdf2_key_derivation_t *pbkdf2,
5998 psa_algorithm_t kdf_alg,
5999 uint8_t *output,
6000 size_t output_length)
6001{
6002 psa_status_t status;
6003 psa_algorithm_t prf_alg;
6004 uint8_t prf_output_length;
6005 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
6006 psa_set_key_bits(&attributes, PSA_BYTES_TO_BITS(pbkdf2->password_length));
6007 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_MESSAGE);
6008
6009 if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) {
6010 prf_alg = PSA_ALG_HMAC(PSA_ALG_PBKDF2_HMAC_GET_HASH(kdf_alg));
6011 prf_output_length = PSA_HASH_LENGTH(prf_alg);
6012 psa_set_key_type(&attributes, PSA_KEY_TYPE_HMAC);
Kusumit Ghoderaoa2520a52023-06-22 15:42:19 +05306013 } else if (kdf_alg == PSA_ALG_PBKDF2_AES_CMAC_PRF_128) {
6014 prf_alg = PSA_ALG_CMAC;
Kusumit Ghoderaoa12e2d52023-07-27 21:18:30 +05306015 prf_output_length = PSA_MAC_LENGTH(PSA_KEY_TYPE_AES, 128U, PSA_ALG_CMAC);
Kusumit Ghoderaoa2520a52023-06-22 15:42:19 +05306016 psa_set_key_type(&attributes, PSA_KEY_TYPE_AES);
Kusumit Ghoderaod9ec1af2023-06-08 20:19:51 +05306017 } else {
6018 return PSA_ERROR_INVALID_ARGUMENT;
Kusumit Ghoderaof6a0d572023-06-05 14:55:56 +05306019 }
6020
6021 switch (pbkdf2->state) {
6022 case PSA_PBKDF2_STATE_PASSWORD_SET:
6023 /* Initially we need a new block so bytes_used is equal to block size*/
6024 pbkdf2->bytes_used = prf_output_length;
6025 pbkdf2->state = PSA_PBKDF2_STATE_OUTPUT;
6026 break;
6027 case PSA_PBKDF2_STATE_OUTPUT:
6028 break;
6029 default:
6030 return PSA_ERROR_BAD_STATE;
6031 }
6032
6033 while (output_length != 0) {
6034 uint8_t n = prf_output_length - pbkdf2->bytes_used;
6035 if (n > output_length) {
6036 n = (uint8_t) output_length;
6037 }
6038 memcpy(output, pbkdf2->output_block + pbkdf2->bytes_used, n);
6039 output += n;
6040 output_length -= n;
6041 pbkdf2->bytes_used += n;
6042
6043 if (output_length == 0) {
6044 break;
6045 }
6046
6047 /* We need a new block */
6048 pbkdf2->bytes_used = 0;
6049 pbkdf2->block_number++;
6050
6051 status = psa_key_derivation_pbkdf2_generate_block(pbkdf2, prf_alg,
6052 prf_output_length,
6053 &attributes);
6054 if (status != PSA_SUCCESS) {
6055 return status;
6056 }
6057 }
6058
6059 return PSA_SUCCESS;
6060}
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05306061#endif /* PSA_HAVE_SOFT_PBKDF2 */
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05306062
Janos Follath6c6c8fc2019-06-17 12:38:20 +01006063psa_status_t psa_key_derivation_output_bytes(
6064 psa_key_derivation_operation_t *operation,
Ryan Everettf943e222024-01-19 14:46:39 +00006065 uint8_t *output_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01006066 size_t output_length)
Gilles Peskineeab56e42018-07-12 17:12:33 +02006067{
6068 psa_status_t status;
Ryan Everettf943e222024-01-19 14:46:39 +00006069 LOCAL_OUTPUT_DECLARE(output_external, output);
6070
Gilles Peskine449bd832023-01-11 14:50:10 +01006071 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation);
Gilles Peskineeab56e42018-07-12 17:12:33 +02006072
Gilles Peskine449bd832023-01-11 14:50:10 +01006073 if (operation->alg == 0) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006074 /* This is a blank operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006075 return PSA_ERROR_BAD_STATE;
Jaeden Amerocf2010c2019-02-15 13:05:49 +00006076 }
6077
Gilles Peskine449bd832023-01-11 14:50:10 +01006078 if (output_length == 0 && operation->capacity == 0) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006079 /* Edge case: this is a finished operation, and 0 bytes
Jaeden Amerocf2010c2019-02-15 13:05:49 +00006080 * were requested. The right error in this case could
Gilles Peskineeab56e42018-07-12 17:12:33 +02006081 * be either INSUFFICIENT_CAPACITY or BAD_STATE. Return
6082 * INSUFFICIENT_CAPACITY, which is right for a finished
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006083 * operation, for consistency with the case when
Gilles Peskineeab56e42018-07-12 17:12:33 +02006084 * output_length > 0. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006085 return PSA_ERROR_INSUFFICIENT_DATA;
Gilles Peskineeab56e42018-07-12 17:12:33 +02006086 }
Ryan Everettf943e222024-01-19 14:46:39 +00006087
6088 LOCAL_OUTPUT_ALLOC(output_external, output_length, output);
Ryan Everettda9227d2024-01-25 11:37:22 +00006089 if (output_length > operation->capacity) {
6090 operation->capacity = 0;
6091 /* Go through the error path to wipe all confidential data now
6092 * that the operation object is useless. */
6093 status = PSA_ERROR_INSUFFICIENT_DATA;
6094 goto exit;
6095 }
6096
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006097 operation->capacity -= output_length;
Gilles Peskineeab56e42018-07-12 17:12:33 +02006098
Przemek Stekiel69c46792022-06-10 12:59:51 +02006099#if defined(BUILTIN_ALG_ANY_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006100 if (PSA_ALG_IS_ANY_HKDF(kdf_alg)) {
6101 status = psa_key_derivation_hkdf_read(&operation->ctx.hkdf, kdf_alg,
6102 output, output_length);
6103 } else
Przemek Stekiel69c46792022-06-10 12:59:51 +02006104#endif /* BUILTIN_ALG_ANY_HKDF */
John Durkop07cc04a2020-11-16 22:08:34 -08006105#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
6106 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006107 if (PSA_ALG_IS_TLS12_PRF(kdf_alg) ||
6108 PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
6109 status = psa_key_derivation_tls12_prf_read(&operation->ctx.tls12_prf,
6110 kdf_alg, output,
6111 output_length);
6112 } else
John Durkop07cc04a2020-11-16 22:08:34 -08006113#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF ||
6114 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006115#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006116 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006117 status = psa_key_derivation_tls12_ecjpake_to_pms_read(
Gilles Peskine449bd832023-01-11 14:50:10 +01006118 &operation->ctx.tls12_ecjpake_to_pms, output, output_length);
6119 } else
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006120#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05306121#if defined(PSA_HAVE_SOFT_PBKDF2)
Kusumit Ghoderao9ab03c32023-07-27 21:14:05 +05306122 if (PSA_ALG_IS_PBKDF2(kdf_alg)) {
Kusumit Ghoderaof6a0d572023-06-05 14:55:56 +05306123 status = psa_key_derivation_pbkdf2_read(&operation->ctx.pbkdf2, kdf_alg,
6124 output, output_length);
Kusumit Ghoderao056f0c52023-05-03 15:58:34 +05306125 } else
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05306126#endif /* PSA_HAVE_SOFT_PBKDF2 */
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006127
Gilles Peskineeab56e42018-07-12 17:12:33 +02006128 {
Steven Cooreman74afe472021-02-10 17:19:22 +01006129 (void) kdf_alg;
Ryan Everettf943e222024-01-19 14:46:39 +00006130 status = PSA_ERROR_BAD_STATE;
6131 LOCAL_OUTPUT_FREE(output_external, output);
6132
6133 return status;
Gilles Peskineeab56e42018-07-12 17:12:33 +02006134 }
6135
6136exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01006137 if (status != PSA_SUCCESS) {
Jaeden Amerocf2010c2019-02-15 13:05:49 +00006138 /* Preserve the algorithm upon errors, but clear all sensitive state.
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006139 * This allows us to differentiate between exhausted operations and
6140 * blank operations, so we can return PSA_ERROR_BAD_STATE on blank
6141 * operations. */
6142 psa_algorithm_t alg = operation->alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01006143 psa_key_derivation_abort(operation);
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006144 operation->alg = alg;
Ryan Everettee5920a2024-02-09 15:09:28 +00006145 if (output != NULL) {
6146 memset(output, '!', output_length);
6147 }
Gilles Peskineeab56e42018-07-12 17:12:33 +02006148 }
Ryan Everettda9227d2024-01-25 11:37:22 +00006149
6150 LOCAL_OUTPUT_FREE(output_external, output);
Gilles Peskine449bd832023-01-11 14:50:10 +01006151 return status;
Gilles Peskineeab56e42018-07-12 17:12:33 +02006152}
6153
David Brown7807bf72021-02-09 16:28:23 -07006154#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Gilles Peskine449bd832023-01-11 14:50:10 +01006155static void psa_des_set_key_parity(uint8_t *data, size_t data_size)
Gilles Peskine08542d82018-07-19 17:05:42 +02006156{
Gilles Peskine449bd832023-01-11 14:50:10 +01006157 if (data_size >= 8) {
6158 mbedtls_des_key_set_parity(data);
6159 }
6160 if (data_size >= 16) {
6161 mbedtls_des_key_set_parity(data + 8);
6162 }
6163 if (data_size >= 24) {
6164 mbedtls_des_key_set_parity(data + 16);
6165 }
Gilles Peskine08542d82018-07-19 17:05:42 +02006166}
David Brown7807bf72021-02-09 16:28:23 -07006167#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */
Gilles Peskine08542d82018-07-19 17:05:42 +02006168
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006169/*
Gilles Peskine449bd832023-01-11 14:50:10 +01006170 * ECC keys on a Weierstrass elliptic curve require the generation
6171 * of a private key which is an integer
6172 * in the range [1, N - 1], where N is the boundary of the private key domain:
6173 * N is the prime p for Diffie-Hellman, or the order of the
6174 * curve’s base point for ECC.
6175 *
6176 * Let m be the bit size of N, such that 2^m > N >= 2^(m-1).
6177 * This function generates the private key using the following process:
6178 *
6179 * 1. Draw a byte string of length ceiling(m/8) bytes.
6180 * 2. If m is not a multiple of 8, set the most significant
6181 * (8 * ceiling(m/8) - m) bits of the first byte in the string to zero.
6182 * 3. Convert the string to integer k by decoding it as a big-endian byte string.
6183 * 4. If k > N - 2, discard the result and return to step 1.
6184 * 5. Output k + 1 as the private key.
6185 *
6186 * This method allows compliance to NIST standards, specifically the methods titled
6187 * Key-Pair Generation by Testing Candidates in the following publications:
6188 * - NIST Special Publication 800-56A: Recommendation for Pair-Wise Key-Establishment
6189 * Schemes Using Discrete Logarithm Cryptography [SP800-56A] §5.6.1.1.4 for
6190 * Diffie-Hellman keys.
6191 *
6192 * - [SP800-56A] §5.6.1.2.2 or FIPS Publication 186-4: Digital Signature
6193 * Standard (DSS) [FIPS186-4] §B.4.2 for elliptic curve keys.
6194 *
6195 * Note: Function allocates memory for *data buffer, so given *data should be
6196 * always NULL.
6197 */
Valerio Setti86587ab2023-06-27 13:09:30 +02006198#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE)
6199#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE)
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01006200static psa_status_t psa_generate_derived_ecc_key_weierstrass_helper(
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006201 psa_key_slot_t *slot,
6202 size_t bits,
6203 psa_key_derivation_operation_t *operation,
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01006204 uint8_t **data
6205 )
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006206{
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01006207 unsigned key_out_of_range = 1;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006208 mbedtls_mpi k;
6209 mbedtls_mpi diff_N_2;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006210 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Przemek Stekiela81aed22022-03-01 15:13:30 +01006211 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01006212 size_t m;
6213 size_t m_bytes;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006214
Gilles Peskine449bd832023-01-11 14:50:10 +01006215 mbedtls_mpi_init(&k);
6216 mbedtls_mpi_init(&diff_N_2);
Przemyslaw Stekiel1dfd1222021-11-18 13:35:00 +01006217
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006218 psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY(
Gilles Peskine449bd832023-01-11 14:50:10 +01006219 slot->attr.type);
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006220 mbedtls_ecp_group_id grp_id =
Valerio Settid36c3132023-12-21 14:03:51 +01006221 mbedtls_ecc_group_from_psa(curve, bits);
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006222
Gilles Peskine449bd832023-01-11 14:50:10 +01006223 if (grp_id == MBEDTLS_ECP_DP_NONE) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006224 ret = MBEDTLS_ERR_ASN1_INVALID_DATA;
Przemyslaw Stekiel871a3362021-12-02 08:46:39 +01006225 goto cleanup;
6226 }
6227
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006228 mbedtls_ecp_group ecp_group;
Gilles Peskine449bd832023-01-11 14:50:10 +01006229 mbedtls_ecp_group_init(&ecp_group);
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006230
Gilles Peskine449bd832023-01-11 14:50:10 +01006231 MBEDTLS_MPI_CHK(mbedtls_ecp_group_load(&ecp_group, grp_id));
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006232
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01006233 /* N is the boundary of the private key domain (ecp_group.N). */
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006234 /* Let m be the bit size of N. */
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01006235 m = ecp_group.nbits;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006236
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01006237 m_bytes = PSA_BITS_TO_BYTES(m);
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01006238
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006239 /* Calculate N - 2 - it will be needed later. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006240 MBEDTLS_MPI_CHK(mbedtls_mpi_sub_int(&diff_N_2, &ecp_group.N, 2));
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006241
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01006242 /* Note: This function is always called with *data == NULL and it
6243 * allocates memory for the data buffer. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006244 *data = mbedtls_calloc(1, m_bytes);
6245 if (*data == NULL) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006246 ret = MBEDTLS_ERR_ASN1_ALLOC_FAILED;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006247 goto cleanup;
6248 }
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006249
Gilles Peskine449bd832023-01-11 14:50:10 +01006250 while (key_out_of_range) {
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01006251 /* 1. Draw a byte string of length ceiling(m/8) bytes. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006252 if ((status = psa_key_derivation_output_bytes(operation, *data, m_bytes)) != 0) {
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01006253 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01006254 }
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01006255
6256 /* 2. If m is not a multiple of 8 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006257 if (m % 8 != 0) {
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01006258 /* Set the most significant
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006259 * (8 * ceiling(m/8) - m) bits of the first byte in
6260 * the string to zero.
6261 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006262 uint8_t clear_bit_mask = (1 << (m % 8)) - 1;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006263 (*data)[0] &= clear_bit_mask;
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01006264 }
6265
6266 /* 3. Convert the string to integer k by decoding it as a
Gilles Peskine449bd832023-01-11 14:50:10 +01006267 * big-endian byte string.
6268 */
6269 MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(&k, *data, m_bytes));
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01006270
6271 /* 4. If k > N - 2, discard the result and return to step 1.
Gilles Peskine449bd832023-01-11 14:50:10 +01006272 * Result of comparison is returned. When it indicates error
6273 * then this function is called again.
6274 */
6275 MBEDTLS_MPI_CHK(mbedtls_mpi_lt_mpi_ct(&diff_N_2, &k, &key_out_of_range));
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006276 }
6277
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006278 /* 5. Output k + 1 as the private key. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006279 MBEDTLS_MPI_CHK(mbedtls_mpi_add_int(&k, &k, 1));
6280 MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(&k, *data, m_bytes));
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006281cleanup:
Gilles Peskine449bd832023-01-11 14:50:10 +01006282 if (ret != 0) {
6283 status = mbedtls_to_psa_error(ret);
6284 }
6285 if (status != PSA_SUCCESS) {
6286 mbedtls_free(*data);
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006287 *data = NULL;
6288 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006289 mbedtls_mpi_free(&k);
6290 mbedtls_mpi_free(&diff_N_2);
6291 return status;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006292}
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006293
6294/* ECC keys on a Montgomery elliptic curve draws a byte string whose length
6295 * is determined by the curve, and sets the mandatory bits accordingly. That is:
6296 *
6297 * - Curve25519 (PSA_ECC_FAMILY_MONTGOMERY, 255 bits):
6298 * draw a 32-byte string and process it as specified in
6299 * Elliptic Curves for Security [RFC7748] §5.
6300 *
6301 * - Curve448 (PSA_ECC_FAMILY_MONTGOMERY, 448 bits):
6302 * draw a 56-byte string and process it as specified in [RFC7748] §5.
6303 *
6304 * Note: Function allocates memory for *data buffer, so given *data should be
6305 * always NULL.
6306 */
6307
6308static psa_status_t psa_generate_derived_ecc_key_montgomery_helper(
6309 size_t bits,
6310 psa_key_derivation_operation_t *operation,
6311 uint8_t **data
6312 )
6313{
6314 size_t output_length;
Przemek Stekiela81aed22022-03-01 15:13:30 +01006315 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006316
Gilles Peskine449bd832023-01-11 14:50:10 +01006317 switch (bits) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006318 case 255:
6319 output_length = 32;
6320 break;
6321 case 448:
6322 output_length = 56;
6323 break;
6324 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01006325 return PSA_ERROR_INVALID_ARGUMENT;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006326 break;
6327 }
6328
Gilles Peskine449bd832023-01-11 14:50:10 +01006329 *data = mbedtls_calloc(1, output_length);
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006330
Gilles Peskine449bd832023-01-11 14:50:10 +01006331 if (*data == NULL) {
6332 return PSA_ERROR_INSUFFICIENT_MEMORY;
6333 }
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006334
Gilles Peskine449bd832023-01-11 14:50:10 +01006335 status = psa_key_derivation_output_bytes(operation, *data, output_length);
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006336
Gilles Peskine449bd832023-01-11 14:50:10 +01006337 if (status != PSA_SUCCESS) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006338 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01006339 }
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006340
Gilles Peskine449bd832023-01-11 14:50:10 +01006341 switch (bits) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006342 case 255:
6343 (*data)[0] &= 248;
6344 (*data)[31] &= 127;
6345 (*data)[31] |= 64;
6346 break;
6347 case 448:
6348 (*data)[0] &= 252;
6349 (*data)[55] |= 128;
6350 break;
6351 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01006352 return PSA_ERROR_CORRUPTION_DETECTED;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006353 break;
6354 }
6355
6356 return status;
6357}
Valerio Setti86587ab2023-06-27 13:09:30 +02006358#else /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE */
6359static psa_status_t psa_generate_derived_ecc_key_weierstrass_helper(
6360 psa_key_slot_t *slot, size_t bits,
6361 psa_key_derivation_operation_t *operation, uint8_t **data)
6362{
6363 (void) slot;
6364 (void) bits;
6365 (void) operation;
6366 (void) data;
6367 return PSA_ERROR_NOT_SUPPORTED;
6368}
6369
6370static psa_status_t psa_generate_derived_ecc_key_montgomery_helper(
6371 size_t bits, psa_key_derivation_operation_t *operation, uint8_t **data)
6372{
6373 (void) bits;
6374 (void) operation;
6375 (void) data;
6376 return PSA_ERROR_NOT_SUPPORTED;
6377}
6378#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE */
6379#endif /* PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE */
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006380
Adrian L. Shaw5a5a79a2019-05-03 15:44:28 +01006381static psa_status_t psa_generate_derived_key_internal(
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006382 psa_key_slot_t *slot,
6383 size_t bits,
Gilles Peskine449bd832023-01-11 14:50:10 +01006384 psa_key_derivation_operation_t *operation)
Gilles Peskineeab56e42018-07-12 17:12:33 +02006385{
6386 uint8_t *data = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01006387 size_t bytes = PSA_BITS_TO_BYTES(bits);
Archanad8a83dc2021-06-14 10:04:16 +05306388 size_t storage_size = bytes;
Przemek Stekiela81aed22022-03-01 15:13:30 +01006389 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskineeab56e42018-07-12 17:12:33 +02006390
Gilles Peskine449bd832023-01-11 14:50:10 +01006391 if (PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type)) {
6392 return PSA_ERROR_INVALID_ARGUMENT;
6393 }
Gilles Peskineeab56e42018-07-12 17:12:33 +02006394
Valerio Setti8ffdb5d2023-06-20 13:14:08 +02006395#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE) || \
Valerio Settidd24f292023-06-26 12:21:17 +02006396 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE)
Gilles Peskine449bd832023-01-11 14:50:10 +01006397 if (PSA_KEY_TYPE_IS_ECC(slot->attr.type)) {
6398 psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY(slot->attr.type);
6399 if (PSA_ECC_FAMILY_IS_WEIERSTRASS(curve)) {
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01006400 /* Weierstrass elliptic curve */
Gilles Peskine449bd832023-01-11 14:50:10 +01006401 status = psa_generate_derived_ecc_key_weierstrass_helper(slot, bits, operation, &data);
6402 if (status != PSA_SUCCESS) {
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01006403 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006404 }
6405 } else {
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01006406 /* Montgomery elliptic curve */
Gilles Peskine449bd832023-01-11 14:50:10 +01006407 status = psa_generate_derived_ecc_key_montgomery_helper(bits, operation, &data);
6408 if (status != PSA_SUCCESS) {
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01006409 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006410 }
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01006411 }
Przemyslaw Stekiel1dfd1222021-11-18 13:35:00 +01006412 } else
Valerio Setti8ffdb5d2023-06-20 13:14:08 +02006413#endif /* defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE) ||
Valerio Settidd24f292023-06-26 12:21:17 +02006414 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE) */
Gilles Peskine449bd832023-01-11 14:50:10 +01006415 if (key_type_is_raw_bytes(slot->attr.type)) {
6416 if (bits % 8 != 0) {
6417 return PSA_ERROR_INVALID_ARGUMENT;
6418 }
6419 data = mbedtls_calloc(1, bytes);
6420 if (data == NULL) {
6421 return PSA_ERROR_INSUFFICIENT_MEMORY;
6422 }
Przemyslaw Stekiel1608e332021-11-09 10:46:40 +01006423
Gilles Peskine449bd832023-01-11 14:50:10 +01006424 status = psa_key_derivation_output_bytes(operation, data, bytes);
6425 if (status != PSA_SUCCESS) {
Przemyslaw Stekiel1608e332021-11-09 10:46:40 +01006426 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006427 }
David Brown12ca5032021-02-11 11:02:00 -07006428#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Gilles Peskine449bd832023-01-11 14:50:10 +01006429 if (slot->attr.type == PSA_KEY_TYPE_DES) {
6430 psa_des_set_key_parity(data, bytes);
6431 }
Przemek Stekielf110dc02022-03-01 14:48:05 +01006432#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES) */
Gilles Peskine449bd832023-01-11 14:50:10 +01006433 } else {
6434 return PSA_ERROR_NOT_SUPPORTED;
Przemyslaw Stekiel1608e332021-11-09 10:46:40 +01006435 }
Ronald Crondd04d422020-11-28 15:14:42 +01006436
Ronald Cronbf33c932020-11-28 18:06:53 +01006437 slot->attr.bits = (psa_key_bits_t) bits;
Ronald Cron2ebfdcc2020-11-28 15:54:54 +01006438
Gilles Peskine2f107ae2024-02-28 01:26:46 +01006439 if (psa_key_lifetime_is_external(slot->attr.lifetime)) {
Gilles Peskine7a5d9202024-02-28 01:18:23 +01006440 status = psa_driver_wrapper_get_key_buffer_size(&slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01006441 &storage_size);
6442 if (status != PSA_SUCCESS) {
Archanad8a83dc2021-06-14 10:04:16 +05306443 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006444 }
Archanad8a83dc2021-06-14 10:04:16 +05306445 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006446 status = psa_allocate_buffer_to_slot(slot, storage_size);
6447 if (status != PSA_SUCCESS) {
Archanad8a83dc2021-06-14 10:04:16 +05306448 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006449 }
Archanad8a83dc2021-06-14 10:04:16 +05306450
Gilles Peskine7a5d9202024-02-28 01:18:23 +01006451 status = psa_driver_wrapper_import_key(&slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01006452 data, bytes,
6453 slot->key.data,
6454 slot->key.bytes,
6455 &slot->key.bytes, &bits);
6456 if (bits != slot->attr.bits) {
Ronald Cronbf33c932020-11-28 18:06:53 +01006457 status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine449bd832023-01-11 14:50:10 +01006458 }
Gilles Peskineeab56e42018-07-12 17:12:33 +02006459
6460exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01006461 mbedtls_free(data);
6462 return status;
Gilles Peskineeab56e42018-07-12 17:12:33 +02006463}
6464
Gilles Peskinef36d7852024-06-06 21:11:44 +02006465static const psa_custom_key_parameters_t default_custom_production =
Gilles Peskine4a85ff32024-07-18 18:52:59 +02006466 PSA_CUSTOM_KEY_PARAMETERS_INIT;
Gilles Peskinef0765fa2024-02-12 16:46:16 +01006467
Gilles Peskine52504f82024-06-20 17:19:58 +02006468int psa_custom_key_parameters_are_default(
Gilles Peskinef36d7852024-06-06 21:11:44 +02006469 const psa_custom_key_parameters_t *custom,
6470 size_t custom_data_length)
Gilles Peskinef0765fa2024-02-12 16:46:16 +01006471{
Gilles Peskinef36d7852024-06-06 21:11:44 +02006472 if (custom->flags != 0) {
Gilles Peskinef0765fa2024-02-12 16:46:16 +01006473 return 0;
6474 }
Gilles Peskinef36d7852024-06-06 21:11:44 +02006475 if (custom_data_length != 0) {
Gilles Peskinef0765fa2024-02-12 16:46:16 +01006476 return 0;
6477 }
6478 return 1;
6479}
6480
Gilles Peskinef36d7852024-06-06 21:11:44 +02006481psa_status_t psa_key_derivation_output_key_custom(
Gilles Peskinef0765fa2024-02-12 16:46:16 +01006482 const psa_key_attributes_t *attributes,
6483 psa_key_derivation_operation_t *operation,
Gilles Peskinef36d7852024-06-06 21:11:44 +02006484 const psa_custom_key_parameters_t *custom,
6485 const uint8_t *custom_data,
6486 size_t custom_data_length,
Gilles Peskinef0765fa2024-02-12 16:46:16 +01006487 mbedtls_svc_key_id_t *key)
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006488{
6489 psa_status_t status;
6490 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02006491 psa_se_drv_table_entry_t *driver = NULL;
Gilles Peskine0f84d622019-09-12 19:03:13 +02006492
Ronald Cron81709fc2020-11-14 12:10:32 +01006493 *key = MBEDTLS_SVC_KEY_ID_INIT;
6494
Gilles Peskine0f84d622019-09-12 19:03:13 +02006495 /* Reject any attempt to create a zero-length key so that we don't
6496 * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006497 if (psa_get_key_bits(attributes) == 0) {
6498 return PSA_ERROR_INVALID_ARGUMENT;
6499 }
Gilles Peskine0f84d622019-09-12 19:03:13 +02006500
Gilles Peskinef36d7852024-06-06 21:11:44 +02006501 (void) custom_data; /* We only accept 0-length data */
Gilles Peskine52504f82024-06-20 17:19:58 +02006502 if (!psa_custom_key_parameters_are_default(custom, custom_data_length)) {
Gilles Peskinef0765fa2024-02-12 16:46:16 +01006503 return PSA_ERROR_INVALID_ARGUMENT;
6504 }
6505
Gilles Peskine449bd832023-01-11 14:50:10 +01006506 if (operation->alg == PSA_ALG_NONE) {
6507 return PSA_ERROR_BAD_STATE;
6508 }
Dave Rodgmand69da6c2021-11-16 10:32:48 +00006509
Gilles Peskine449bd832023-01-11 14:50:10 +01006510 if (!operation->can_output_key) {
6511 return PSA_ERROR_NOT_PERMITTED;
6512 }
Gilles Peskine178c9aa2019-09-24 18:21:06 +02006513
Gilles Peskine449bd832023-01-11 14:50:10 +01006514 status = psa_start_key_creation(PSA_KEY_CREATION_DERIVE, attributes,
6515 &slot, &driver);
Gilles Peskinef4ee6622019-07-24 13:44:30 +02006516#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01006517 if (driver != NULL) {
Gilles Peskinef4ee6622019-07-24 13:44:30 +02006518 /* Deriving a key in a secure element is not implemented yet. */
6519 status = PSA_ERROR_NOT_SUPPORTED;
6520 }
6521#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskine449bd832023-01-11 14:50:10 +01006522 if (status == PSA_SUCCESS) {
6523 status = psa_generate_derived_key_internal(slot,
Gilles Peskine2f107ae2024-02-28 01:26:46 +01006524 attributes->bits,
Gilles Peskine449bd832023-01-11 14:50:10 +01006525 operation);
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006526 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006527 if (status == PSA_SUCCESS) {
6528 status = psa_finish_key_creation(slot, driver, key);
6529 }
6530 if (status != PSA_SUCCESS) {
6531 psa_fail_key_creation(slot, driver);
6532 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02006533
Gilles Peskine449bd832023-01-11 14:50:10 +01006534 return status;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006535}
6536
Gilles Peskinef36d7852024-06-06 21:11:44 +02006537psa_status_t psa_key_derivation_output_key_ext(
6538 const psa_key_attributes_t *attributes,
6539 psa_key_derivation_operation_t *operation,
6540 const psa_key_production_parameters_t *params,
6541 size_t params_data_length,
6542 mbedtls_svc_key_id_t *key)
6543{
6544 return psa_key_derivation_output_key_custom(
6545 attributes, operation,
6546 (const psa_custom_key_parameters_t *) params,
6547 params->data, params_data_length,
6548 key);
6549}
6550
Gilles Peskinef0765fa2024-02-12 16:46:16 +01006551psa_status_t psa_key_derivation_output_key(
6552 const psa_key_attributes_t *attributes,
6553 psa_key_derivation_operation_t *operation,
6554 mbedtls_svc_key_id_t *key)
6555{
Gilles Peskinef36d7852024-06-06 21:11:44 +02006556 return psa_key_derivation_output_key_custom(attributes, operation,
6557 &default_custom_production,
6558 NULL, 0,
6559 key);
Gilles Peskinef0765fa2024-02-12 16:46:16 +01006560}
Gilles Peskineeab56e42018-07-12 17:12:33 +02006561
6562
6563/****************************************************************/
Gilles Peskineea0fb492018-07-12 17:17:20 +02006564/* Key derivation */
6565/****************************************************************/
6566
Steven Cooreman932ffb72021-02-15 12:14:32 +01006567#if defined(AT_LEAST_ONE_BUILTIN_KDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006568static int is_kdf_alg_supported(psa_algorithm_t kdf_alg)
Gilles Peskine9efde4f2021-04-29 21:10:00 +02006569{
6570#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006571 if (PSA_ALG_IS_HKDF(kdf_alg)) {
6572 return 1;
6573 }
Gilles Peskine9efde4f2021-04-29 21:10:00 +02006574#endif
Przemek Stekielb57a44b2022-06-06 08:33:45 +02006575#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01006576 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
6577 return 1;
6578 }
Przemek Stekielb57a44b2022-06-06 08:33:45 +02006579#endif
6580#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Gilles Peskine449bd832023-01-11 14:50:10 +01006581 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) {
6582 return 1;
6583 }
Gilles Peskine9efde4f2021-04-29 21:10:00 +02006584#endif
6585#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006586 if (PSA_ALG_IS_TLS12_PRF(kdf_alg)) {
6587 return 1;
6588 }
Gilles Peskine9efde4f2021-04-29 21:10:00 +02006589#endif
6590#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006591 if (PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
6592 return 1;
6593 }
Gilles Peskine9efde4f2021-04-29 21:10:00 +02006594#endif
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006595#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006596 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
6597 return 1;
6598 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006599#endif
Kusumit Ghoderaod132cac2023-05-03 12:00:27 +05306600#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC)
6601 if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) {
6602 return 1;
6603 }
6604#endif
Kusumit Ghoderao2cd64962023-06-22 15:38:57 +05306605#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_AES_CMAC_PRF_128)
6606 if (kdf_alg == PSA_ALG_PBKDF2_AES_CMAC_PRF_128) {
6607 return 1;
6608 }
6609#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01006610 return 0;
Gilles Peskine9efde4f2021-04-29 21:10:00 +02006611}
6612
Gilles Peskine449bd832023-01-11 14:50:10 +01006613static psa_status_t psa_hash_try_support(psa_algorithm_t alg)
Gilles Peskine0cc417d2021-04-29 21:18:14 +02006614{
6615 psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT;
Gilles Peskine449bd832023-01-11 14:50:10 +01006616 psa_status_t status = psa_hash_setup(&operation, alg);
6617 psa_hash_abort(&operation);
6618 return status;
Gilles Peskine0cc417d2021-04-29 21:18:14 +02006619}
6620
Kusumit Ghoderao86e83dd2023-12-01 16:38:26 +05306621static psa_status_t psa_key_derivation_set_maximum_capacity(
6622 psa_key_derivation_operation_t *operation,
6623 psa_algorithm_t kdf_alg)
6624{
6625#if defined(PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS)
6626 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
6627 operation->capacity = PSA_HASH_LENGTH(PSA_ALG_SHA_256);
6628 return PSA_SUCCESS;
6629 }
6630#endif
6631#if defined(PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128)
6632 if (kdf_alg == PSA_ALG_PBKDF2_AES_CMAC_PRF_128) {
6633#if (SIZE_MAX > UINT32_MAX)
Kusumit Ghoderao7d4db632023-12-07 16:17:46 +05306634 operation->capacity = UINT32_MAX * (size_t) PSA_MAC_LENGTH(
Kusumit Ghoderaod3f70d32023-12-06 16:20:04 +05306635 PSA_KEY_TYPE_AES,
6636 128U,
6637 PSA_ALG_CMAC);
Kusumit Ghoderao86e83dd2023-12-01 16:38:26 +05306638#else
6639 operation->capacity = SIZE_MAX;
6640#endif
6641 return PSA_SUCCESS;
6642 }
6643#endif /* PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128 */
6644
6645 /* After this point, if kdf_alg is not valid then value of hash_alg may be
6646 * invalid or meaningless but it does not affect this function */
6647 psa_algorithm_t hash_alg = PSA_ALG_GET_HASH(kdf_alg);
6648 size_t hash_size = PSA_HASH_LENGTH(hash_alg);
Kusumit Ghoderaod3f70d32023-12-06 16:20:04 +05306649 if (hash_size == 0) {
6650 return PSA_ERROR_NOT_SUPPORTED;
6651 }
Kusumit Ghoderao86e83dd2023-12-01 16:38:26 +05306652
6653 /* Make sure that hash_alg is a supported hash algorithm. Otherwise
6654 * we might fail later, which is somewhat unfriendly and potentially
6655 * risk-prone. */
6656 psa_status_t status = psa_hash_try_support(hash_alg);
6657 if (status != PSA_SUCCESS) {
6658 return status;
6659 }
6660
6661#if defined(PSA_WANT_ALG_HKDF)
6662 if (PSA_ALG_IS_HKDF(kdf_alg)) {
6663 operation->capacity = 255 * hash_size;
6664 } else
6665#endif
6666#if defined(PSA_WANT_ALG_HKDF_EXTRACT)
6667 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
6668 operation->capacity = hash_size;
6669 } else
6670#endif
6671#if defined(PSA_WANT_ALG_HKDF_EXPAND)
6672 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) {
6673 operation->capacity = 255 * hash_size;
6674 } else
6675#endif
6676#if defined(PSA_WANT_ALG_TLS12_PRF)
6677 if (PSA_ALG_IS_TLS12_PRF(kdf_alg) &&
6678 (hash_alg == PSA_ALG_SHA_256 || hash_alg == PSA_ALG_SHA_384)) {
6679 operation->capacity = SIZE_MAX;
6680 } else
6681#endif
6682#if defined(PSA_WANT_ALG_TLS12_PSK_TO_MS)
6683 if (PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg) &&
6684 (hash_alg == PSA_ALG_SHA_256 || hash_alg == PSA_ALG_SHA_384)) {
6685 /* Master Secret is always 48 bytes
6686 * https://datatracker.ietf.org/doc/html/rfc5246.html#section-8.1 */
6687 operation->capacity = 48U;
6688 } else
6689#endif
6690#if defined(PSA_WANT_ALG_PBKDF2_HMAC)
6691 if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) {
6692#if (SIZE_MAX > UINT32_MAX)
6693 operation->capacity = UINT32_MAX * hash_size;
6694#else
6695 operation->capacity = SIZE_MAX;
6696#endif
6697 } else
6698#endif /* PSA_WANT_ALG_PBKDF2_HMAC */
6699 {
Kusumit Ghoderaod3f70d32023-12-06 16:20:04 +05306700 (void) hash_size;
Kusumit Ghoderao86e83dd2023-12-01 16:38:26 +05306701 status = PSA_ERROR_NOT_SUPPORTED;
6702 }
6703 return status;
6704}
6705
Gilles Peskine969c5d62019-01-16 15:53:06 +01006706static psa_status_t psa_key_derivation_setup_kdf(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006707 psa_key_derivation_operation_t *operation,
Gilles Peskine449bd832023-01-11 14:50:10 +01006708 psa_algorithm_t kdf_alg)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006709{
Janos Follath5fe19732019-06-20 15:09:30 +01006710 /* Make sure that operation->ctx is properly zero-initialised. (Macro
6711 * initialisers for this union leave some bytes unspecified.) */
Gilles Peskine449bd832023-01-11 14:50:10 +01006712 memset(&operation->ctx, 0, sizeof(operation->ctx));
Janos Follath5fe19732019-06-20 15:09:30 +01006713
Gilles Peskine969c5d62019-01-16 15:53:06 +01006714 /* Make sure that kdf_alg is a supported key derivation algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006715 if (!is_kdf_alg_supported(kdf_alg)) {
6716 return PSA_ERROR_NOT_SUPPORTED;
6717 }
John Durkop07cc04a2020-11-16 22:08:34 -08006718
Kusumit Ghoderao86e83dd2023-12-01 16:38:26 +05306719 psa_status_t status = psa_key_derivation_set_maximum_capacity(operation,
6720 kdf_alg);
Kusumit Ghoderao5f3a9382023-09-13 16:28:12 +05306721 return status;
Gilles Peskine969c5d62019-01-16 15:53:06 +01006722}
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006723
Gilles Peskine449bd832023-01-11 14:50:10 +01006724static psa_status_t psa_key_agreement_try_support(psa_algorithm_t alg)
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006725{
6726#if defined(PSA_WANT_ALG_ECDH)
Gilles Peskine449bd832023-01-11 14:50:10 +01006727 if (alg == PSA_ALG_ECDH) {
6728 return PSA_SUCCESS;
6729 }
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006730#endif
Przemek Stekielfb3dd542022-12-01 14:59:15 +01006731#if defined(PSA_WANT_ALG_FFDH)
6732 if (alg == PSA_ALG_FFDH) {
6733 return PSA_SUCCESS;
6734 }
6735#endif
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006736 (void) alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01006737 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006738}
Gilles Peskinebb3814c2022-12-16 01:12:12 +01006739
6740static int psa_key_derivation_allows_free_form_secret_input(
6741 psa_algorithm_t kdf_alg)
6742{
6743#if defined(PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS)
6744 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
6745 return 0;
6746 }
6747#endif
6748 (void) kdf_alg;
6749 return 1;
6750}
John Durkop07cc04a2020-11-16 22:08:34 -08006751#endif /* AT_LEAST_ONE_BUILTIN_KDF */
Gilles Peskine969c5d62019-01-16 15:53:06 +01006752
Gilles Peskine449bd832023-01-11 14:50:10 +01006753psa_status_t psa_key_derivation_setup(psa_key_derivation_operation_t *operation,
6754 psa_algorithm_t alg)
Gilles Peskine969c5d62019-01-16 15:53:06 +01006755{
6756 psa_status_t status;
6757
Gilles Peskine449bd832023-01-11 14:50:10 +01006758 if (operation->alg != 0) {
6759 return PSA_ERROR_BAD_STATE;
Gilles Peskine969c5d62019-01-16 15:53:06 +01006760 }
Gilles Peskine969c5d62019-01-16 15:53:06 +01006761
Gilles Peskine449bd832023-01-11 14:50:10 +01006762 if (PSA_ALG_IS_RAW_KEY_AGREEMENT(alg)) {
6763 return PSA_ERROR_INVALID_ARGUMENT;
6764 } else if (PSA_ALG_IS_KEY_AGREEMENT(alg)) {
6765#if defined(AT_LEAST_ONE_BUILTIN_KDF)
6766 psa_algorithm_t kdf_alg = PSA_ALG_KEY_AGREEMENT_GET_KDF(alg);
6767 psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE(alg);
6768 status = psa_key_agreement_try_support(ka_alg);
6769 if (status != PSA_SUCCESS) {
6770 return status;
6771 }
Gilles Peskinebb3814c2022-12-16 01:12:12 +01006772 if (!psa_key_derivation_allows_free_form_secret_input(kdf_alg)) {
6773 return PSA_ERROR_INVALID_ARGUMENT;
6774 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006775 status = psa_key_derivation_setup_kdf(operation, kdf_alg);
6776#else
6777 return PSA_ERROR_NOT_SUPPORTED;
6778#endif /* AT_LEAST_ONE_BUILTIN_KDF */
6779 } else if (PSA_ALG_IS_KEY_DERIVATION(alg)) {
6780#if defined(AT_LEAST_ONE_BUILTIN_KDF)
6781 status = psa_key_derivation_setup_kdf(operation, alg);
6782#else
6783 return PSA_ERROR_NOT_SUPPORTED;
6784#endif /* AT_LEAST_ONE_BUILTIN_KDF */
6785 } else {
6786 return PSA_ERROR_INVALID_ARGUMENT;
6787 }
6788
6789 if (status == PSA_SUCCESS) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006790 operation->alg = alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01006791 }
6792 return status;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006793}
6794
Przemek Stekiel69c46792022-06-10 12:59:51 +02006795#if defined(BUILTIN_ALG_ANY_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006796static psa_status_t psa_hkdf_input(psa_hkdf_key_derivation_t *hkdf,
6797 psa_algorithm_t kdf_alg,
6798 psa_key_derivation_step_t step,
6799 const uint8_t *data,
6800 size_t data_length)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006801{
Gilles Peskine449bd832023-01-11 14:50:10 +01006802 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(kdf_alg);
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006803 psa_status_t status;
Gilles Peskine449bd832023-01-11 14:50:10 +01006804 switch (step) {
Gilles Peskine03410b52019-05-16 16:05:19 +02006805 case PSA_KEY_DERIVATION_INPUT_SALT:
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006806#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Gilles Peskine449bd832023-01-11 14:50:10 +01006807 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) {
6808 return PSA_ERROR_INVALID_ARGUMENT;
6809 }
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006810#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND */
Gilles Peskine449bd832023-01-11 14:50:10 +01006811 if (hkdf->state != HKDF_STATE_INIT) {
6812 return PSA_ERROR_BAD_STATE;
6813 } else {
6814 status = psa_key_derivation_start_hmac(&hkdf->hmac,
6815 hash_alg,
6816 data, data_length);
6817 if (status != PSA_SUCCESS) {
6818 return status;
6819 }
Steven Cooremand1ed1d92021-04-29 19:11:25 +02006820 hkdf->state = HKDF_STATE_STARTED;
Gilles Peskine449bd832023-01-11 14:50:10 +01006821 return PSA_SUCCESS;
Steven Cooremand1ed1d92021-04-29 19:11:25 +02006822 }
Gilles Peskine03410b52019-05-16 16:05:19 +02006823 case PSA_KEY_DERIVATION_INPUT_SECRET:
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006824#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Gilles Peskine449bd832023-01-11 14:50:10 +01006825 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) {
Przemek Stekiel2fb0dcd2022-05-19 10:34:37 +02006826 /* We shouldn't be in different state as HKDF_EXPAND only allows
6827 * two inputs: SECRET (this case) and INFO which does not modify
6828 * the state. It could happen only if the hkdf
6829 * object was corrupted. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006830 if (hkdf->state != HKDF_STATE_INIT) {
6831 return PSA_ERROR_BAD_STATE;
6832 }
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006833
Przemek Stekiel2fb0dcd2022-05-19 10:34:37 +02006834 /* Allow only input that fits expected prk size */
Gilles Peskine449bd832023-01-11 14:50:10 +01006835 if (data_length != PSA_HASH_LENGTH(hash_alg)) {
6836 return PSA_ERROR_INVALID_ARGUMENT;
6837 }
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006838
Gilles Peskine449bd832023-01-11 14:50:10 +01006839 memcpy(hkdf->prk, data, data_length);
6840 } else
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006841#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND */
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006842 {
Przemek Stekiel0586f4c2022-06-03 16:00:25 +02006843 /* HKDF: If no salt was provided, use an empty salt.
6844 * HKDF-EXTRACT: salt is mandatory. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006845 if (hkdf->state == HKDF_STATE_INIT) {
Przemek Stekiel0586f4c2022-06-03 16:00:25 +02006846#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01006847 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
6848 return PSA_ERROR_BAD_STATE;
6849 }
Przemek Stekiel0586f4c2022-06-03 16:00:25 +02006850#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Gilles Peskine449bd832023-01-11 14:50:10 +01006851 status = psa_key_derivation_start_hmac(&hkdf->hmac,
6852 hash_alg,
6853 NULL, 0);
6854 if (status != PSA_SUCCESS) {
6855 return status;
6856 }
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006857 hkdf->state = HKDF_STATE_STARTED;
6858 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006859 if (hkdf->state != HKDF_STATE_STARTED) {
6860 return PSA_ERROR_BAD_STATE;
6861 }
6862 status = psa_mac_update(&hkdf->hmac,
6863 data, data_length);
6864 if (status != PSA_SUCCESS) {
6865 return status;
6866 }
6867 status = psa_mac_sign_finish(&hkdf->hmac,
6868 hkdf->prk,
6869 sizeof(hkdf->prk),
6870 &data_length);
6871 if (status != PSA_SUCCESS) {
6872 return status;
6873 }
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006874 }
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006875
Gilles Peskine2b522db2019-04-12 15:11:49 +02006876 hkdf->state = HKDF_STATE_KEYED;
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006877 hkdf->block_number = 0;
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006878#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01006879 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006880 /* The only block of output is the PRK. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006881 memcpy(hkdf->output_block, hkdf->prk, PSA_HASH_LENGTH(hash_alg));
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006882 hkdf->offset_in_block = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01006883 } else
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006884#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006885 {
6886 /* Block 0 is empty, and the next block will be
6887 * generated by psa_key_derivation_hkdf_read(). */
Gilles Peskine449bd832023-01-11 14:50:10 +01006888 hkdf->offset_in_block = PSA_HASH_LENGTH(hash_alg);
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006889 }
6890
Gilles Peskine449bd832023-01-11 14:50:10 +01006891 return PSA_SUCCESS;
Gilles Peskine03410b52019-05-16 16:05:19 +02006892 case PSA_KEY_DERIVATION_INPUT_INFO:
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006893#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01006894 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
6895 return PSA_ERROR_INVALID_ARGUMENT;
6896 }
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006897#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Przemek Stekielcde3f782022-06-03 16:12:27 +02006898#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Gilles Peskine449bd832023-01-11 14:50:10 +01006899 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg) &&
6900 hkdf->state == HKDF_STATE_INIT) {
6901 return PSA_ERROR_BAD_STATE;
6902 }
Przemek Stekielcde3f782022-06-03 16:12:27 +02006903#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Gilles Peskine449bd832023-01-11 14:50:10 +01006904 if (hkdf->state == HKDF_STATE_OUTPUT) {
6905 return PSA_ERROR_BAD_STATE;
6906 }
6907 if (hkdf->info_set) {
6908 return PSA_ERROR_BAD_STATE;
6909 }
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006910 hkdf->info_length = data_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01006911 if (data_length != 0) {
6912 hkdf->info = mbedtls_calloc(1, data_length);
6913 if (hkdf->info == NULL) {
6914 return PSA_ERROR_INSUFFICIENT_MEMORY;
6915 }
6916 memcpy(hkdf->info, data, data_length);
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006917 }
6918 hkdf->info_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01006919 return PSA_SUCCESS;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006920 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01006921 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006922 }
6923}
Przemek Stekiel69c46792022-06-10 12:59:51 +02006924#endif /* BUILTIN_ALG_ANY_HKDF */
Janos Follathb03233e2019-06-11 15:30:30 +01006925
John Durkop07cc04a2020-11-16 22:08:34 -08006926#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
6927 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006928static psa_status_t psa_tls12_prf_set_seed(psa_tls12_prf_key_derivation_t *prf,
6929 const uint8_t *data,
6930 size_t data_length)
Janos Follathf08e2652019-06-13 09:05:41 +01006931{
Gilles Peskine449bd832023-01-11 14:50:10 +01006932 if (prf->state != PSA_TLS12_PRF_STATE_INIT) {
6933 return PSA_ERROR_BAD_STATE;
6934 }
Janos Follathf08e2652019-06-13 09:05:41 +01006935
Gilles Peskine449bd832023-01-11 14:50:10 +01006936 if (data_length != 0) {
6937 prf->seed = mbedtls_calloc(1, data_length);
6938 if (prf->seed == NULL) {
6939 return PSA_ERROR_INSUFFICIENT_MEMORY;
6940 }
Janos Follathf08e2652019-06-13 09:05:41 +01006941
Gilles Peskine449bd832023-01-11 14:50:10 +01006942 memcpy(prf->seed, data, data_length);
Janos Follathd6dce9f2019-07-04 09:11:38 +01006943 prf->seed_length = data_length;
6944 }
Janos Follathf08e2652019-06-13 09:05:41 +01006945
Gilles Peskine43f958b2020-12-13 14:55:14 +01006946 prf->state = PSA_TLS12_PRF_STATE_SEED_SET;
Janos Follathf08e2652019-06-13 09:05:41 +01006947
Gilles Peskine449bd832023-01-11 14:50:10 +01006948 return PSA_SUCCESS;
Janos Follathf08e2652019-06-13 09:05:41 +01006949}
6950
Gilles Peskine449bd832023-01-11 14:50:10 +01006951static psa_status_t psa_tls12_prf_set_key(psa_tls12_prf_key_derivation_t *prf,
6952 const uint8_t *data,
6953 size_t data_length)
Janos Follath81550542019-06-13 14:26:34 +01006954{
Gilles Peskine449bd832023-01-11 14:50:10 +01006955 if (prf->state != PSA_TLS12_PRF_STATE_SEED_SET &&
6956 prf->state != PSA_TLS12_PRF_STATE_OTHER_KEY_SET) {
6957 return PSA_ERROR_BAD_STATE;
6958 }
Janos Follath81550542019-06-13 14:26:34 +01006959
Gilles Peskine449bd832023-01-11 14:50:10 +01006960 if (data_length != 0) {
6961 prf->secret = mbedtls_calloc(1, data_length);
6962 if (prf->secret == NULL) {
6963 return PSA_ERROR_INSUFFICIENT_MEMORY;
6964 }
Steven Cooremana6df6042021-04-29 19:32:25 +02006965
Gilles Peskine449bd832023-01-11 14:50:10 +01006966 memcpy(prf->secret, data, data_length);
Steven Cooremana6df6042021-04-29 19:32:25 +02006967 prf->secret_length = data_length;
6968 }
Janos Follath81550542019-06-13 14:26:34 +01006969
Gilles Peskine43f958b2020-12-13 14:55:14 +01006970 prf->state = PSA_TLS12_PRF_STATE_KEY_SET;
Janos Follath81550542019-06-13 14:26:34 +01006971
Gilles Peskine449bd832023-01-11 14:50:10 +01006972 return PSA_SUCCESS;
Janos Follath81550542019-06-13 14:26:34 +01006973}
6974
Gilles Peskine449bd832023-01-11 14:50:10 +01006975static psa_status_t psa_tls12_prf_set_label(psa_tls12_prf_key_derivation_t *prf,
6976 const uint8_t *data,
6977 size_t data_length)
Janos Follath63028dd2019-06-13 09:15:47 +01006978{
Gilles Peskine449bd832023-01-11 14:50:10 +01006979 if (prf->state != PSA_TLS12_PRF_STATE_KEY_SET) {
6980 return PSA_ERROR_BAD_STATE;
6981 }
Janos Follath63028dd2019-06-13 09:15:47 +01006982
Gilles Peskine449bd832023-01-11 14:50:10 +01006983 if (data_length != 0) {
6984 prf->label = mbedtls_calloc(1, data_length);
6985 if (prf->label == NULL) {
6986 return PSA_ERROR_INSUFFICIENT_MEMORY;
6987 }
Janos Follath63028dd2019-06-13 09:15:47 +01006988
Gilles Peskine449bd832023-01-11 14:50:10 +01006989 memcpy(prf->label, data, data_length);
Janos Follathd6dce9f2019-07-04 09:11:38 +01006990 prf->label_length = data_length;
6991 }
Janos Follath63028dd2019-06-13 09:15:47 +01006992
Gilles Peskine43f958b2020-12-13 14:55:14 +01006993 prf->state = PSA_TLS12_PRF_STATE_LABEL_SET;
Janos Follath63028dd2019-06-13 09:15:47 +01006994
Gilles Peskine449bd832023-01-11 14:50:10 +01006995 return PSA_SUCCESS;
Janos Follath63028dd2019-06-13 09:15:47 +01006996}
6997
Gilles Peskine449bd832023-01-11 14:50:10 +01006998static psa_status_t psa_tls12_prf_input(psa_tls12_prf_key_derivation_t *prf,
6999 psa_key_derivation_step_t step,
7000 const uint8_t *data,
7001 size_t data_length)
Janos Follathb03233e2019-06-11 15:30:30 +01007002{
Gilles Peskine449bd832023-01-11 14:50:10 +01007003 switch (step) {
Janos Follathf08e2652019-06-13 09:05:41 +01007004 case PSA_KEY_DERIVATION_INPUT_SEED:
Gilles Peskine449bd832023-01-11 14:50:10 +01007005 return psa_tls12_prf_set_seed(prf, data, data_length);
Janos Follath81550542019-06-13 14:26:34 +01007006 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01007007 return psa_tls12_prf_set_key(prf, data, data_length);
Janos Follath63028dd2019-06-13 09:15:47 +01007008 case PSA_KEY_DERIVATION_INPUT_LABEL:
Gilles Peskine449bd832023-01-11 14:50:10 +01007009 return psa_tls12_prf_set_label(prf, data, data_length);
Janos Follathb03233e2019-06-11 15:30:30 +01007010 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01007011 return PSA_ERROR_INVALID_ARGUMENT;
Janos Follathb03233e2019-06-11 15:30:30 +01007012 }
7013}
John Durkop07cc04a2020-11-16 22:08:34 -08007014#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) ||
7015 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
7016
7017#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
7018static psa_status_t psa_tls12_prf_psk_to_ms_set_key(
7019 psa_tls12_prf_key_derivation_t *prf,
John Durkop07cc04a2020-11-16 22:08:34 -08007020 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01007021 size_t data_length)
John Durkop07cc04a2020-11-16 22:08:34 -08007022{
7023 psa_status_t status;
Gilles Peskine449bd832023-01-11 14:50:10 +01007024 const size_t pms_len = (prf->state == PSA_TLS12_PRF_STATE_OTHER_KEY_SET ?
7025 4 + data_length + prf->other_secret_length :
7026 4 + 2 * data_length);
John Durkop07cc04a2020-11-16 22:08:34 -08007027
Gilles Peskine449bd832023-01-11 14:50:10 +01007028 if (data_length > PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE) {
7029 return PSA_ERROR_INVALID_ARGUMENT;
7030 }
John Durkop07cc04a2020-11-16 22:08:34 -08007031
Gilles Peskine449bd832023-01-11 14:50:10 +01007032 uint8_t *pms = mbedtls_calloc(1, pms_len);
7033 if (pms == NULL) {
7034 return PSA_ERROR_INSUFFICIENT_MEMORY;
7035 }
Przemek Stekielc8fa5a12022-04-07 14:17:13 +02007036 uint8_t *cur = pms;
7037
7038 /* pure-PSK:
7039 * Quoting RFC 4279, Section 2:
John Durkop07cc04a2020-11-16 22:08:34 -08007040 *
7041 * The premaster secret is formed as follows: if the PSK is N octets
7042 * long, concatenate a uint16 with the value N, N zero octets, a second
7043 * uint16 with the value N, and the PSK itself.
Przemek Stekielc8fa5a12022-04-07 14:17:13 +02007044 *
7045 * mixed-PSK:
7046 * In a DHE-PSK, RSA-PSK, ECDHE-PSK the premaster secret is formed as
7047 * follows: concatenate a uint16 with the length of the other secret,
7048 * the other secret itself, uint16 with the length of PSK, and the
7049 * PSK itself.
7050 * For details please check:
7051 * - RFC 4279, Section 4 for the definition of RSA-PSK,
7052 * - RFC 4279, Section 3 for the definition of DHE-PSK,
7053 * - RFC 5489 for the definition of ECDHE-PSK.
John Durkop07cc04a2020-11-16 22:08:34 -08007054 */
7055
Gilles Peskine449bd832023-01-11 14:50:10 +01007056 if (prf->state == PSA_TLS12_PRF_STATE_OTHER_KEY_SET) {
7057 *cur++ = MBEDTLS_BYTE_1(prf->other_secret_length);
7058 *cur++ = MBEDTLS_BYTE_0(prf->other_secret_length);
7059 if (prf->other_secret_length != 0) {
7060 memcpy(cur, prf->other_secret, prf->other_secret_length);
7061 mbedtls_platform_zeroize(prf->other_secret, prf->other_secret_length);
Przemek Stekiel2503f7e2022-04-12 12:08:01 +02007062 cur += prf->other_secret_length;
7063 }
Gilles Peskine449bd832023-01-11 14:50:10 +01007064 } else {
7065 *cur++ = MBEDTLS_BYTE_1(data_length);
7066 *cur++ = MBEDTLS_BYTE_0(data_length);
7067 memset(cur, 0, data_length);
Przemek Stekielc8fa5a12022-04-07 14:17:13 +02007068 cur += data_length;
7069 }
7070
Gilles Peskine449bd832023-01-11 14:50:10 +01007071 *cur++ = MBEDTLS_BYTE_1(data_length);
7072 *cur++ = MBEDTLS_BYTE_0(data_length);
7073 memcpy(cur, data, data_length);
John Durkop07cc04a2020-11-16 22:08:34 -08007074 cur += data_length;
7075
Dave Rodgmane4a6f5a2023-11-04 12:20:09 +00007076 status = psa_tls12_prf_set_key(prf, pms, (size_t) (cur - pms));
John Durkop07cc04a2020-11-16 22:08:34 -08007077
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01007078 mbedtls_zeroize_and_free(pms, pms_len);
Gilles Peskine449bd832023-01-11 14:50:10 +01007079 return status;
John Durkop07cc04a2020-11-16 22:08:34 -08007080}
Janos Follath6660f0e2019-06-17 08:44:03 +01007081
Przemek Stekiele47201b2022-04-19 13:53:28 +02007082static psa_status_t psa_tls12_prf_psk_to_ms_set_other_key(
7083 psa_tls12_prf_key_derivation_t *prf,
7084 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01007085 size_t data_length)
Przemek Stekiele47201b2022-04-19 13:53:28 +02007086{
Gilles Peskine449bd832023-01-11 14:50:10 +01007087 if (prf->state != PSA_TLS12_PRF_STATE_SEED_SET) {
7088 return PSA_ERROR_BAD_STATE;
Przemek Stekiele47201b2022-04-19 13:53:28 +02007089 }
Gilles Peskine449bd832023-01-11 14:50:10 +01007090
7091 if (data_length != 0) {
7092 prf->other_secret = mbedtls_calloc(1, data_length);
7093 if (prf->other_secret == NULL) {
7094 return PSA_ERROR_INSUFFICIENT_MEMORY;
7095 }
7096
7097 memcpy(prf->other_secret, data, data_length);
7098 prf->other_secret_length = data_length;
7099 } else {
Przemek Stekiele47201b2022-04-19 13:53:28 +02007100 prf->other_secret_length = 0;
7101 }
7102
7103 prf->state = PSA_TLS12_PRF_STATE_OTHER_KEY_SET;
7104
Gilles Peskine449bd832023-01-11 14:50:10 +01007105 return PSA_SUCCESS;
Przemek Stekiele47201b2022-04-19 13:53:28 +02007106}
7107
Janos Follath6660f0e2019-06-17 08:44:03 +01007108static psa_status_t psa_tls12_prf_psk_to_ms_input(
7109 psa_tls12_prf_key_derivation_t *prf,
Janos Follath6660f0e2019-06-17 08:44:03 +01007110 psa_key_derivation_step_t step,
7111 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01007112 size_t data_length)
Janos Follath6660f0e2019-06-17 08:44:03 +01007113{
Gilles Peskine449bd832023-01-11 14:50:10 +01007114 switch (step) {
Przemek Stekiele47201b2022-04-19 13:53:28 +02007115 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01007116 return psa_tls12_prf_psk_to_ms_set_key(prf,
7117 data, data_length);
Przemek Stekiele47201b2022-04-19 13:53:28 +02007118 break;
7119 case PSA_KEY_DERIVATION_INPUT_OTHER_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01007120 return psa_tls12_prf_psk_to_ms_set_other_key(prf,
7121 data,
7122 data_length);
Przemek Stekiele47201b2022-04-19 13:53:28 +02007123 break;
7124 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01007125 return psa_tls12_prf_input(prf, step, data, data_length);
Przemek Stekiele47201b2022-04-19 13:53:28 +02007126 break;
Janos Follath6660f0e2019-06-17 08:44:03 +01007127
Przemek Stekiele47201b2022-04-19 13:53:28 +02007128 }
Janos Follath6660f0e2019-06-17 08:44:03 +01007129}
John Durkop07cc04a2020-11-16 22:08:34 -08007130#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01007131
Andrzej Kurek08d34b82022-07-29 10:00:16 -04007132#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
7133static psa_status_t psa_tls12_ecjpake_to_pms_input(
7134 psa_tls12_ecjpake_to_pms_t *ecjpake,
Andrzej Kurek702776f2022-09-16 06:22:44 -04007135 psa_key_derivation_step_t step,
Andrzej Kurek08d34b82022-07-29 10:00:16 -04007136 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01007137 size_t data_length)
Andrzej Kurek08d34b82022-07-29 10:00:16 -04007138{
Gilles Peskine449bd832023-01-11 14:50:10 +01007139 if (data_length != PSA_TLS12_ECJPAKE_TO_PMS_INPUT_SIZE ||
7140 step != PSA_KEY_DERIVATION_INPUT_SECRET) {
7141 return PSA_ERROR_INVALID_ARGUMENT;
Andrzej Kurek5603efd2022-09-26 10:49:16 -04007142 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04007143
7144 /* Check if the passed point is in an uncompressed form */
Gilles Peskine449bd832023-01-11 14:50:10 +01007145 if (data[0] != 0x04) {
7146 return PSA_ERROR_INVALID_ARGUMENT;
7147 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04007148
7149 /* Only K.X has to be extracted - bytes 1 to 32 inclusive. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007150 memcpy(ecjpake->data, data + 1, PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE);
Andrzej Kurek08d34b82022-07-29 10:00:16 -04007151
Gilles Peskine449bd832023-01-11 14:50:10 +01007152 return PSA_SUCCESS;
Andrzej Kurek08d34b82022-07-29 10:00:16 -04007153}
7154#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05307155
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05307156#if defined(PSA_HAVE_SOFT_PBKDF2)
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05307157static psa_status_t psa_pbkdf2_set_input_cost(
7158 psa_pbkdf2_key_derivation_t *pbkdf2,
7159 psa_key_derivation_step_t step,
7160 uint64_t data)
7161{
7162 if (step != PSA_KEY_DERIVATION_INPUT_COST) {
7163 return PSA_ERROR_INVALID_ARGUMENT;
7164 }
7165
7166 if (pbkdf2->state != PSA_PBKDF2_STATE_INIT) {
7167 return PSA_ERROR_BAD_STATE;
7168 }
Kusumit Ghoderao3fc4ca72023-05-08 15:57:41 +05307169
Kusumit Ghoderaoe66a8ad2023-05-24 12:30:43 +05307170 if (data > PSA_VENDOR_PBKDF2_MAX_ITERATIONS) {
Kusumit Ghoderao3fc4ca72023-05-08 15:57:41 +05307171 return PSA_ERROR_NOT_SUPPORTED;
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05307172 }
Kusumit Ghoderao3fc4ca72023-05-08 15:57:41 +05307173
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05307174 if (data == 0) {
7175 return PSA_ERROR_INVALID_ARGUMENT;
7176 }
Kusumit Ghoderaoe66a8ad2023-05-24 12:30:43 +05307177
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05307178 pbkdf2->input_cost = data;
7179 pbkdf2->state = PSA_PBKDF2_STATE_INPUT_COST_SET;
7180
7181 return PSA_SUCCESS;
7182}
Kusumit Ghoderao547a6c62023-05-03 12:18:19 +05307183
7184static psa_status_t psa_pbkdf2_set_salt(psa_pbkdf2_key_derivation_t *pbkdf2,
7185 const uint8_t *data,
7186 size_t data_length)
7187{
Gilles Peskineead17662023-08-20 22:02:51 +02007188 if (pbkdf2->state == PSA_PBKDF2_STATE_INPUT_COST_SET) {
7189 pbkdf2->state = PSA_PBKDF2_STATE_SALT_SET;
7190 } else if (pbkdf2->state == PSA_PBKDF2_STATE_SALT_SET) {
7191 /* Appending to existing salt. No state change. */
7192 } else {
Kusumit Ghoderao547a6c62023-05-03 12:18:19 +05307193 return PSA_ERROR_BAD_STATE;
7194 }
7195
Gilles Peskineca57d782023-07-20 19:08:06 +02007196 if (data_length == 0) {
Gilles Peskineead17662023-08-20 22:02:51 +02007197 /* Appending an empty string, nothing to do. */
7198 } else {
Kusumit Ghoderaod7a3f802023-05-24 22:19:47 +05307199 uint8_t *next_salt;
Kusumit Ghoderaob538bb72023-05-24 12:32:14 +05307200
Kusumit Ghoderaod7a3f802023-05-24 22:19:47 +05307201 next_salt = mbedtls_calloc(1, data_length + pbkdf2->salt_length);
7202 if (next_salt == NULL) {
Kusumit Ghoderaod0422f32023-05-08 15:56:19 +05307203 return PSA_ERROR_INSUFFICIENT_MEMORY;
7204 }
7205
Gilles Peskineead17662023-08-20 22:02:51 +02007206 if (pbkdf2->salt_length != 0) {
7207 memcpy(next_salt, pbkdf2->salt, pbkdf2->salt_length);
7208 }
Kusumit Ghoderaod7a3f802023-05-24 22:19:47 +05307209 memcpy(next_salt + pbkdf2->salt_length, data, data_length);
Kusumit Ghoderaod0422f32023-05-08 15:56:19 +05307210 pbkdf2->salt_length += data_length;
Kusumit Ghoderaod7a3f802023-05-24 22:19:47 +05307211 mbedtls_free(pbkdf2->salt);
7212 pbkdf2->salt = next_salt;
Kusumit Ghoderao547a6c62023-05-03 12:18:19 +05307213 }
Kusumit Ghoderao547a6c62023-05-03 12:18:19 +05307214 return PSA_SUCCESS;
7215}
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05307216
Kusumit Ghoderao0bca4c52023-07-27 21:20:14 +05307217#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC)
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05307218static psa_status_t psa_pbkdf2_hmac_set_password(psa_algorithm_t hash_alg,
Kusumit Ghoderaoaac9a582023-05-24 14:19:17 +05307219 const uint8_t *input,
7220 size_t input_len,
7221 uint8_t *output,
Kusumit Ghoderao91f99f52023-05-24 22:21:48 +05307222 size_t *output_len)
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05307223{
7224 psa_status_t status = PSA_SUCCESS;
7225 if (input_len > PSA_HASH_BLOCK_LENGTH(hash_alg)) {
Ryan Everett5d2e82f2024-02-07 17:24:59 +00007226 return psa_hash_compute(hash_alg, input, input_len, output,
7227 PSA_HMAC_MAX_HASH_BLOCK_SIZE, output_len);
7228 } else if (input_len > 0) {
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05307229 memcpy(output, input, input_len);
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05307230 }
Ryan Everett5d2e82f2024-02-07 17:24:59 +00007231 *output_len = PSA_HASH_BLOCK_LENGTH(hash_alg);
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05307232 return status;
7233}
Kusumit Ghoderao0bca4c52023-07-27 21:20:14 +05307234#endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC */
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05307235
Kusumit Ghoderao0bca4c52023-07-27 21:20:14 +05307236#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_AES_CMAC_PRF_128)
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05307237static psa_status_t psa_pbkdf2_cmac_set_password(const uint8_t *input,
7238 size_t input_len,
7239 uint8_t *output,
7240 size_t *output_len)
7241{
7242 psa_status_t status = PSA_SUCCESS;
Kusumit Ghoderaoa12e2d52023-07-27 21:18:30 +05307243 if (input_len != PSA_MAC_LENGTH(PSA_KEY_TYPE_AES, 128U, PSA_ALG_CMAC)) {
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05307244 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Kusumit Ghoderao3fde8fe2023-06-27 10:41:43 +05307245 uint8_t zeros[16] = { 0 };
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05307246 psa_set_key_type(&attributes, PSA_KEY_TYPE_AES);
7247 psa_set_key_bits(&attributes, PSA_BYTES_TO_BITS(sizeof(zeros)));
7248 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_MESSAGE);
Kusumit Ghoderaoa12e2d52023-07-27 21:18:30 +05307249 /* Passing PSA_MAC_LENGTH(PSA_KEY_TYPE_AES, 128U, PSA_ALG_CMAC) as
Kusumit Ghoderao5f3345a2023-07-27 21:21:38 +05307250 * mac_size as the driver function sets mac_output_length = mac_size
7251 * on success. See https://github.com/Mbed-TLS/mbedtls/issues/7801 */
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05307252 status = psa_driver_wrapper_mac_compute(&attributes,
7253 zeros, sizeof(zeros),
7254 PSA_ALG_CMAC, input, input_len,
7255 output,
Kusumit Ghoderaoa12e2d52023-07-27 21:18:30 +05307256 PSA_MAC_LENGTH(PSA_KEY_TYPE_AES,
7257 128U,
7258 PSA_ALG_CMAC),
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05307259 output_len);
7260 } else {
7261 memcpy(output, input, input_len);
Kusumit Ghoderaoa12e2d52023-07-27 21:18:30 +05307262 *output_len = PSA_MAC_LENGTH(PSA_KEY_TYPE_AES, 128U, PSA_ALG_CMAC);
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05307263 }
7264 return status;
7265}
Kusumit Ghoderao0bca4c52023-07-27 21:20:14 +05307266#endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_AES_CMAC_PRF_128 */
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05307267
7268static psa_status_t psa_pbkdf2_set_password(psa_pbkdf2_key_derivation_t *pbkdf2,
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05307269 psa_algorithm_t kdf_alg,
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05307270 const uint8_t *data,
7271 size_t data_length)
7272{
Kusumit Ghoderaoaac9a582023-05-24 14:19:17 +05307273 psa_status_t status = PSA_SUCCESS;
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05307274 if (pbkdf2->state != PSA_PBKDF2_STATE_SALT_SET) {
7275 return PSA_ERROR_BAD_STATE;
7276 }
7277
Kusumit Ghoderaof3e696d2023-07-28 13:30:50 +05307278#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC)
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05307279 if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) {
7280 psa_algorithm_t hash_alg = PSA_ALG_PBKDF2_HMAC_GET_HASH(kdf_alg);
7281 status = psa_pbkdf2_hmac_set_password(hash_alg, data, data_length,
7282 pbkdf2->password,
7283 &pbkdf2->password_length);
Kusumit Ghoderaof3e696d2023-07-28 13:30:50 +05307284 } else
7285#endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC */
7286#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_AES_CMAC_PRF_128)
7287 if (kdf_alg == PSA_ALG_PBKDF2_AES_CMAC_PRF_128) {
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05307288 status = psa_pbkdf2_cmac_set_password(data, data_length,
7289 pbkdf2->password,
7290 &pbkdf2->password_length);
Kusumit Ghoderaof3e696d2023-07-28 13:30:50 +05307291 } else
7292#endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_AES_CMAC_PRF_128 */
7293 {
7294 return PSA_ERROR_INVALID_ARGUMENT;
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05307295 }
7296
7297 pbkdf2->state = PSA_PBKDF2_STATE_PASSWORD_SET;
7298
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05307299 return status;
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05307300}
Kusumit Ghoderao24b38952023-05-03 12:25:26 +05307301
7302static psa_status_t psa_pbkdf2_input(psa_pbkdf2_key_derivation_t *pbkdf2,
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05307303 psa_algorithm_t kdf_alg,
Kusumit Ghoderao24b38952023-05-03 12:25:26 +05307304 psa_key_derivation_step_t step,
7305 const uint8_t *data,
7306 size_t data_length)
7307{
7308 switch (step) {
7309 case PSA_KEY_DERIVATION_INPUT_SALT:
7310 return psa_pbkdf2_set_salt(pbkdf2, data, data_length);
7311 case PSA_KEY_DERIVATION_INPUT_PASSWORD:
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05307312 return psa_pbkdf2_set_password(pbkdf2, kdf_alg, data, data_length);
Kusumit Ghoderao24b38952023-05-03 12:25:26 +05307313 default:
7314 return PSA_ERROR_INVALID_ARGUMENT;
7315 }
7316}
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05307317#endif /* PSA_HAVE_SOFT_PBKDF2 */
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05307318
Gilles Peskineb8965192019-09-24 16:21:10 +02007319/** Check whether the given key type is acceptable for the given
7320 * input step of a key derivation.
7321 *
7322 * Secret inputs must have the type #PSA_KEY_TYPE_DERIVE.
7323 * Non-secret inputs must have the type #PSA_KEY_TYPE_RAW_DATA.
7324 * Both secret and non-secret inputs can alternatively have the type
7325 * #PSA_KEY_TYPE_NONE, which is never the type of a key object, meaning
7326 * that the input was passed as a buffer rather than via a key object.
7327 */
Gilles Peskine224b0d62019-09-23 18:13:17 +02007328static int psa_key_derivation_check_input_type(
7329 psa_key_derivation_step_t step,
Gilles Peskine449bd832023-01-11 14:50:10 +01007330 psa_key_type_t key_type)
Gilles Peskine224b0d62019-09-23 18:13:17 +02007331{
Gilles Peskine449bd832023-01-11 14:50:10 +01007332 switch (step) {
Gilles Peskine224b0d62019-09-23 18:13:17 +02007333 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01007334 if (key_type == PSA_KEY_TYPE_DERIVE) {
7335 return PSA_SUCCESS;
7336 }
7337 if (key_type == PSA_KEY_TYPE_NONE) {
7338 return PSA_SUCCESS;
7339 }
Gilles Peskine224b0d62019-09-23 18:13:17 +02007340 break;
Przemek Stekiela7695a22022-04-07 15:39:01 +02007341 case PSA_KEY_DERIVATION_INPUT_OTHER_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01007342 if (key_type == PSA_KEY_TYPE_DERIVE) {
7343 return PSA_SUCCESS;
7344 }
7345 if (key_type == PSA_KEY_TYPE_NONE) {
7346 return PSA_SUCCESS;
7347 }
Przemek Stekiela7695a22022-04-07 15:39:01 +02007348 break;
Gilles Peskine224b0d62019-09-23 18:13:17 +02007349 case PSA_KEY_DERIVATION_INPUT_LABEL:
7350 case PSA_KEY_DERIVATION_INPUT_SALT:
7351 case PSA_KEY_DERIVATION_INPUT_INFO:
7352 case PSA_KEY_DERIVATION_INPUT_SEED:
Gilles Peskine449bd832023-01-11 14:50:10 +01007353 if (key_type == PSA_KEY_TYPE_RAW_DATA) {
7354 return PSA_SUCCESS;
7355 }
7356 if (key_type == PSA_KEY_TYPE_NONE) {
7357 return PSA_SUCCESS;
7358 }
Gilles Peskine224b0d62019-09-23 18:13:17 +02007359 break;
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05307360 case PSA_KEY_DERIVATION_INPUT_PASSWORD:
7361 if (key_type == PSA_KEY_TYPE_PASSWORD) {
7362 return PSA_SUCCESS;
7363 }
7364 if (key_type == PSA_KEY_TYPE_DERIVE) {
7365 return PSA_SUCCESS;
7366 }
7367 if (key_type == PSA_KEY_TYPE_NONE) {
7368 return PSA_SUCCESS;
7369 }
7370 break;
Gilles Peskine224b0d62019-09-23 18:13:17 +02007371 }
Gilles Peskine449bd832023-01-11 14:50:10 +01007372 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine224b0d62019-09-23 18:13:17 +02007373}
7374
Janos Follathb80a94e2019-06-12 15:54:46 +01007375static psa_status_t psa_key_derivation_input_internal(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02007376 psa_key_derivation_operation_t *operation,
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01007377 psa_key_derivation_step_t step,
Gilles Peskine224b0d62019-09-23 18:13:17 +02007378 psa_key_type_t key_type,
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01007379 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01007380 size_t data_length)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01007381{
Gilles Peskine46d7faf2019-09-23 19:22:55 +02007382 psa_status_t status;
Gilles Peskine449bd832023-01-11 14:50:10 +01007383 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation);
Gilles Peskine46d7faf2019-09-23 19:22:55 +02007384
Gilles Peskine449bd832023-01-11 14:50:10 +01007385 status = psa_key_derivation_check_input_type(step, key_type);
7386 if (status != PSA_SUCCESS) {
Gilles Peskine224b0d62019-09-23 18:13:17 +02007387 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007388 }
Gilles Peskine224b0d62019-09-23 18:13:17 +02007389
Przemek Stekiel69c46792022-06-10 12:59:51 +02007390#if defined(BUILTIN_ALG_ANY_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01007391 if (PSA_ALG_IS_ANY_HKDF(kdf_alg)) {
7392 status = psa_hkdf_input(&operation->ctx.hkdf, kdf_alg,
7393 step, data, data_length);
7394 } else
Przemek Stekiel69c46792022-06-10 12:59:51 +02007395#endif /* BUILTIN_ALG_ANY_HKDF */
John Durkop07cc04a2020-11-16 22:08:34 -08007396#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF)
Gilles Peskine449bd832023-01-11 14:50:10 +01007397 if (PSA_ALG_IS_TLS12_PRF(kdf_alg)) {
7398 status = psa_tls12_prf_input(&operation->ctx.tls12_prf,
7399 step, data, data_length);
7400 } else
John Durkop07cc04a2020-11-16 22:08:34 -08007401#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF */
7402#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01007403 if (PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
7404 status = psa_tls12_prf_psk_to_ms_input(&operation->ctx.tls12_prf,
7405 step, data, data_length);
7406 } else
John Durkop07cc04a2020-11-16 22:08:34 -08007407#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Andrzej Kurek08d34b82022-07-29 10:00:16 -04007408#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01007409 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
Andrzej Kurek08d34b82022-07-29 10:00:16 -04007410 status = psa_tls12_ecjpake_to_pms_input(
Gilles Peskine449bd832023-01-11 14:50:10 +01007411 &operation->ctx.tls12_ecjpake_to_pms, step, data, data_length);
7412 } else
Andrzej Kurek08d34b82022-07-29 10:00:16 -04007413#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05307414#if defined(PSA_HAVE_SOFT_PBKDF2)
Kusumit Ghoderao9ab03c32023-07-27 21:14:05 +05307415 if (PSA_ALG_IS_PBKDF2(kdf_alg)) {
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05307416 status = psa_pbkdf2_input(&operation->ctx.pbkdf2, kdf_alg,
7417 step, data, data_length);
Kusumit Ghoderao24b38952023-05-03 12:25:26 +05307418 } else
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05307419#endif /* PSA_HAVE_SOFT_PBKDF2 */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01007420 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02007421 /* This can't happen unless the operation object was not initialized */
Steven Cooreman74afe472021-02-10 17:19:22 +01007422 (void) data;
7423 (void) data_length;
7424 (void) kdf_alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01007425 return PSA_ERROR_BAD_STATE;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01007426 }
7427
Gilles Peskine224b0d62019-09-23 18:13:17 +02007428exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01007429 if (status != PSA_SUCCESS) {
7430 psa_key_derivation_abort(operation);
7431 }
7432 return status;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01007433}
7434
Kusumit Ghoderao50e0e112023-04-06 17:47:25 +05307435static psa_status_t psa_key_derivation_input_integer_internal(
7436 psa_key_derivation_operation_t *operation,
7437 psa_key_derivation_step_t step,
7438 uint64_t value)
7439{
7440 psa_status_t status;
7441 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation);
7442
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05307443#if defined(PSA_HAVE_SOFT_PBKDF2)
Kusumit Ghoderao9ab03c32023-07-27 21:14:05 +05307444 if (PSA_ALG_IS_PBKDF2(kdf_alg)) {
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05307445 status = psa_pbkdf2_set_input_cost(
7446 &operation->ctx.pbkdf2, step, value);
7447 } else
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05307448#endif /* PSA_HAVE_SOFT_PBKDF2 */
Kusumit Ghoderao50e0e112023-04-06 17:47:25 +05307449 {
Kusumit Ghoderao3a18dee2023-04-07 16:16:27 +05307450 (void) step;
Kusumit Ghoderao50e0e112023-04-06 17:47:25 +05307451 (void) value;
7452 (void) kdf_alg;
Kusumit Ghoderaoa14ae5a2023-04-19 14:16:26 +05307453 status = PSA_ERROR_INVALID_ARGUMENT;
Kusumit Ghoderao50e0e112023-04-06 17:47:25 +05307454 }
7455
7456 if (status != PSA_SUCCESS) {
7457 psa_key_derivation_abort(operation);
7458 }
7459 return status;
7460}
7461
Janos Follath51f4a0f2019-06-14 11:35:55 +01007462psa_status_t psa_key_derivation_input_bytes(
7463 psa_key_derivation_operation_t *operation,
7464 psa_key_derivation_step_t step,
Ryan Everettd1e398c2024-01-19 14:46:00 +00007465 const uint8_t *data_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01007466 size_t data_length)
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01007467{
Ryan Everettd1e398c2024-01-19 14:46:00 +00007468 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
7469 LOCAL_INPUT_DECLARE(data_external, data);
7470
7471 LOCAL_INPUT_ALLOC(data_external, data_length, data);
7472
7473 status = psa_key_derivation_input_internal(operation, step,
7474 PSA_KEY_TYPE_NONE,
7475 data, data_length);
David Horstmann4a48bec2024-03-13 15:42:31 +00007476#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
Ryan Everettd1e398c2024-01-19 14:46:00 +00007477exit:
Ryan Everettb41c3c92024-01-25 11:56:35 +00007478#endif
Ryan Everettd1e398c2024-01-19 14:46:00 +00007479 LOCAL_INPUT_FREE(data_external, data);
7480 return status;
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01007481}
7482
Kusumit Ghoderao50e0e112023-04-06 17:47:25 +05307483psa_status_t psa_key_derivation_input_integer(
7484 psa_key_derivation_operation_t *operation,
7485 psa_key_derivation_step_t step,
7486 uint64_t value)
7487{
7488 return psa_key_derivation_input_integer_internal(operation, step, value);
7489}
7490
Janos Follath51f4a0f2019-06-14 11:35:55 +01007491psa_status_t psa_key_derivation_input_key(
7492 psa_key_derivation_operation_t *operation,
7493 psa_key_derivation_step_t step,
Gilles Peskine449bd832023-01-11 14:50:10 +01007494 mbedtls_svc_key_id_t key)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01007495{
Ronald Cronf95a2b12020-10-22 15:24:49 +02007496 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01007497 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01007498 psa_key_slot_t *slot;
Gilles Peskine178c9aa2019-09-24 18:21:06 +02007499
Ronald Cron5c522922020-11-14 16:35:34 +01007500 status = psa_get_and_lock_transparent_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01007501 key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg);
7502 if (status != PSA_SUCCESS) {
7503 psa_key_derivation_abort(operation);
7504 return status;
Gilles Peskine593773d2019-09-23 18:17:40 +02007505 }
Gilles Peskine178c9aa2019-09-24 18:21:06 +02007506
Kusumit Ghoderao3128c5d2023-05-03 12:27:57 +05307507 /* Passing a key object as a SECRET or PASSWORD input unlocks the
7508 * permission to output to a key object. */
7509 if (step == PSA_KEY_DERIVATION_INPUT_SECRET ||
7510 step == PSA_KEY_DERIVATION_INPUT_PASSWORD) {
Gilles Peskine178c9aa2019-09-24 18:21:06 +02007511 operation->can_output_key = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01007512 }
Gilles Peskine178c9aa2019-09-24 18:21:06 +02007513
Gilles Peskine449bd832023-01-11 14:50:10 +01007514 status = psa_key_derivation_input_internal(operation,
7515 step, slot->attr.type,
7516 slot->key.data,
7517 slot->key.bytes);
Ronald Cronf95a2b12020-10-22 15:24:49 +02007518
Ryan Everett5ac6fa72024-02-14 17:11:36 +00007519 unlock_status = psa_unregister_read_under_mutex(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02007520
Gilles Peskine449bd832023-01-11 14:50:10 +01007521 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01007522}
Gilles Peskineea0fb492018-07-12 17:17:20 +02007523
7524
7525
7526/****************************************************************/
Gilles Peskine01d718c2018-09-18 12:01:02 +02007527/* Key agreement */
7528/****************************************************************/
7529
Gilles Peskine449bd832023-01-11 14:50:10 +01007530psa_status_t psa_key_agreement_raw_builtin(const psa_key_attributes_t *attributes,
7531 const uint8_t *key_buffer,
7532 size_t key_buffer_size,
7533 psa_algorithm_t alg,
7534 const uint8_t *peer_key,
7535 size_t peer_key_length,
7536 uint8_t *shared_secret,
7537 size_t shared_secret_size,
7538 size_t *shared_secret_length)
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02007539{
Gilles Peskine449bd832023-01-11 14:50:10 +01007540 switch (alg) {
John Durkop6ba40d12020-11-10 08:50:04 -08007541#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
Gilles Peskine0216fe12019-04-11 21:23:21 +02007542 case PSA_ALG_ECDH:
Gilles Peskine449bd832023-01-11 14:50:10 +01007543 return mbedtls_psa_key_agreement_ecdh(attributes, key_buffer,
7544 key_buffer_size, alg,
7545 peer_key, peer_key_length,
7546 shared_secret,
7547 shared_secret_size,
7548 shared_secret_length);
Gilles Peskine01d718c2018-09-18 12:01:02 +02007549#endif /* MBEDTLS_PSA_BUILTIN_ALG_ECDH */
Przemek Stekielfb3dd542022-12-01 14:59:15 +01007550
7551#if defined(MBEDTLS_PSA_BUILTIN_ALG_FFDH)
7552 case PSA_ALG_FFDH:
Przemek Stekiel152bb462023-06-01 11:52:39 +02007553 return mbedtls_psa_ffdh_key_agreement(attributes,
Przemek Stekiel359f4622022-12-05 14:11:55 +01007554 peer_key,
7555 peer_key_length,
7556 key_buffer,
7557 key_buffer_size,
7558 shared_secret,
7559 shared_secret_size,
7560 shared_secret_length);
Przemek Stekielfb3dd542022-12-01 14:59:15 +01007561#endif /* MBEDTLS_PSA_BUILTIN_ALG_FFDH */
7562
Gilles Peskine01d718c2018-09-18 12:01:02 +02007563 default:
Aditya Deshpande17845b82022-10-13 17:21:01 +01007564 (void) attributes;
7565 (void) key_buffer;
7566 (void) key_buffer_size;
Gilles Peskine93f85002018-11-16 16:43:31 +01007567 (void) peer_key;
7568 (void) peer_key_length;
Gilles Peskine0216fe12019-04-11 21:23:21 +02007569 (void) shared_secret;
7570 (void) shared_secret_size;
7571 (void) shared_secret_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01007572 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine01d718c2018-09-18 12:01:02 +02007573 }
Gilles Peskine0216fe12019-04-11 21:23:21 +02007574}
Gilles Peskine01d718c2018-09-18 12:01:02 +02007575
Aditya Deshpande17845b82022-10-13 17:21:01 +01007576/** Internal function for raw key agreement
7577 * Calls the driver wrapper which will hand off key agreement task
Aditya Deshpande40c05cc2022-10-14 16:41:40 +01007578 * to the driver's implementation if a driver is present.
7579 * Fallback specified in the driver wrapper is built-in raw key agreement
Aditya Deshpande17845b82022-10-13 17:21:01 +01007580 * (psa_key_agreement_raw_builtin).
7581 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007582static psa_status_t psa_key_agreement_raw_internal(psa_algorithm_t alg,
7583 psa_key_slot_t *private_key,
7584 const uint8_t *peer_key,
7585 size_t peer_key_length,
7586 uint8_t *shared_secret,
7587 size_t shared_secret_size,
7588 size_t *shared_secret_length)
Gilles Peskine51ae0e42019-05-16 17:31:03 +02007589{
Gilles Peskine449bd832023-01-11 14:50:10 +01007590 if (!PSA_ALG_IS_RAW_KEY_AGREEMENT(alg)) {
7591 return PSA_ERROR_NOT_SUPPORTED;
7592 }
Aditya Deshpande17845b82022-10-13 17:21:01 +01007593
Gilles Peskine7a5d9202024-02-28 01:18:23 +01007594 return psa_driver_wrapper_key_agreement(&private_key->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01007595 private_key->key.data,
7596 private_key->key.bytes, alg,
7597 peer_key, peer_key_length,
7598 shared_secret,
7599 shared_secret_size,
7600 shared_secret_length);
Gilles Peskine0216fe12019-04-11 21:23:21 +02007601}
7602
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02007603/* Note that if this function fails, you must call psa_key_derivation_abort()
Gilles Peskine01d718c2018-09-18 12:01:02 +02007604 * to potentially free embedded data structures and wipe confidential data.
7605 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007606static psa_status_t psa_key_agreement_internal(psa_key_derivation_operation_t *operation,
7607 psa_key_derivation_step_t step,
7608 psa_key_slot_t *private_key,
7609 const uint8_t *peer_key,
7610 size_t peer_key_length)
Gilles Peskine01d718c2018-09-18 12:01:02 +02007611{
7612 psa_status_t status;
Moritz Fischer967f8cd2024-03-02 00:55:06 +00007613 uint8_t shared_secret[PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE] = { 0 };
Gilles Peskine01d718c2018-09-18 12:01:02 +02007614 size_t shared_secret_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01007615 psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE(operation->alg);
Gilles Peskine01d718c2018-09-18 12:01:02 +02007616
7617 /* Step 1: run the secret agreement algorithm to generate the shared
7618 * secret. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007619 status = psa_key_agreement_raw_internal(ka_alg,
7620 private_key,
7621 peer_key, peer_key_length,
7622 shared_secret,
7623 sizeof(shared_secret),
7624 &shared_secret_length);
7625 if (status != PSA_SUCCESS) {
Gilles Peskine12313cd2018-06-20 00:20:32 +02007626 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007627 }
Gilles Peskine12313cd2018-06-20 00:20:32 +02007628
Gilles Peskineb0b255c2018-07-06 17:01:38 +02007629 /* Step 2: set up the key derivation to generate key material from
Gilles Peskine224b0d62019-09-23 18:13:17 +02007630 * the shared secret. A shared secret is permitted wherever a key
7631 * of type DERIVE is permitted. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007632 status = psa_key_derivation_input_internal(operation, step,
7633 PSA_KEY_TYPE_DERIVE,
7634 shared_secret,
7635 shared_secret_length);
Gilles Peskine12313cd2018-06-20 00:20:32 +02007636exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01007637 mbedtls_platform_zeroize(shared_secret, shared_secret_length);
7638 return status;
Gilles Peskine12313cd2018-06-20 00:20:32 +02007639}
7640
Gilles Peskine449bd832023-01-11 14:50:10 +01007641psa_status_t psa_key_derivation_key_agreement(psa_key_derivation_operation_t *operation,
7642 psa_key_derivation_step_t step,
7643 mbedtls_svc_key_id_t private_key,
Thomas Daubney9739ac02024-02-15 13:15:47 +00007644 const uint8_t *peer_key_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01007645 size_t peer_key_length)
Gilles Peskine12313cd2018-06-20 00:20:32 +02007646{
Ronald Cronf95a2b12020-10-22 15:24:49 +02007647 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01007648 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01007649 psa_key_slot_t *slot;
Thomas Daubney9739ac02024-02-15 13:15:47 +00007650 LOCAL_INPUT_DECLARE(peer_key_external, peer_key);
Ronald Cronf95a2b12020-10-22 15:24:49 +02007651
Gilles Peskine449bd832023-01-11 14:50:10 +01007652 if (!PSA_ALG_IS_KEY_AGREEMENT(operation->alg)) {
7653 return PSA_ERROR_INVALID_ARGUMENT;
7654 }
Ronald Cron5c522922020-11-14 16:35:34 +01007655 status = psa_get_and_lock_transparent_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01007656 private_key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg);
7657 if (status != PSA_SUCCESS) {
7658 return status;
7659 }
Thomas Daubney9739ac02024-02-15 13:15:47 +00007660
Thomas Daubney692fb3c2024-03-12 16:20:41 +00007661 LOCAL_INPUT_ALLOC(peer_key_external, peer_key_length, peer_key);
Gilles Peskine449bd832023-01-11 14:50:10 +01007662 status = psa_key_agreement_internal(operation, step,
7663 slot,
7664 peer_key, peer_key_length);
Thomas Daubney9739ac02024-02-15 13:15:47 +00007665
David Horstmann4a48bec2024-03-13 15:42:31 +00007666#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
Thomas Daubney9739ac02024-02-15 13:15:47 +00007667exit:
Thomas Daubney50f58fc2024-02-15 14:24:03 +00007668#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01007669 if (status != PSA_SUCCESS) {
7670 psa_key_derivation_abort(operation);
7671 } else {
Steven Cooremanfa5e6312020-10-15 17:07:12 +02007672 /* If a private key has been added as SECRET, we allow the derived
7673 * key material to be used as a key in PSA Crypto. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007674 if (step == PSA_KEY_DERIVATION_INPUT_SECRET) {
Steven Cooremanfa5e6312020-10-15 17:07:12 +02007675 operation->can_output_key = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01007676 }
Steven Cooremanfa5e6312020-10-15 17:07:12 +02007677 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02007678
Ryan Everett5ac6fa72024-02-14 17:11:36 +00007679 unlock_status = psa_unregister_read_under_mutex(slot);
Thomas Daubney9739ac02024-02-15 13:15:47 +00007680 LOCAL_INPUT_FREE(peer_key_external, peer_key);
Ronald Cronf95a2b12020-10-22 15:24:49 +02007681
Gilles Peskine449bd832023-01-11 14:50:10 +01007682 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskineaf3baab2018-06-27 22:55:52 +02007683}
7684
Gilles Peskine449bd832023-01-11 14:50:10 +01007685psa_status_t psa_raw_key_agreement(psa_algorithm_t alg,
7686 mbedtls_svc_key_id_t private_key,
Thomas Daubney81899ab2024-02-15 12:57:26 +00007687 const uint8_t *peer_key_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01007688 size_t peer_key_length,
Thomas Daubney81899ab2024-02-15 12:57:26 +00007689 uint8_t *output_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01007690 size_t output_size,
7691 size_t *output_length)
Gilles Peskine0216fe12019-04-11 21:23:21 +02007692{
Ronald Cronf95a2b12020-10-22 15:24:49 +02007693 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01007694 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cronf95a2b12020-10-22 15:24:49 +02007695 psa_key_slot_t *slot = NULL;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01007696 size_t expected_length;
Thomas Daubney81899ab2024-02-15 12:57:26 +00007697 LOCAL_INPUT_DECLARE(peer_key_external, peer_key);
7698 LOCAL_OUTPUT_DECLARE(output_external, output);
Thomas Daubney89d8c2a2024-02-21 11:16:16 +00007699 LOCAL_OUTPUT_ALLOC(output_external, output_size, output);
Gilles Peskine0216fe12019-04-11 21:23:21 +02007700
Gilles Peskine449bd832023-01-11 14:50:10 +01007701 if (!PSA_ALG_IS_KEY_AGREEMENT(alg)) {
Gilles Peskine0216fe12019-04-11 21:23:21 +02007702 status = PSA_ERROR_INVALID_ARGUMENT;
7703 goto exit;
7704 }
Ronald Cron5c522922020-11-14 16:35:34 +01007705 status = psa_get_and_lock_transparent_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01007706 private_key, &slot, PSA_KEY_USAGE_DERIVE, alg);
7707 if (status != PSA_SUCCESS) {
Gilles Peskine0216fe12019-04-11 21:23:21 +02007708 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007709 }
Gilles Peskine0216fe12019-04-11 21:23:21 +02007710
Gilles Peskine3e561302022-04-14 00:17:15 +02007711 /* PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() is in general an upper bound
7712 * for the output size. The PSA specification only guarantees that this
7713 * function works if output_size >= PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE(...),
7714 * but it might be nice to allow smaller buffers if the output fits.
7715 * At the time of writing this comment, with only ECDH implemented,
7716 * PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() is exact so the point is moot.
7717 * If FFDH is implemented, PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() can easily
7718 * be exact for it as well. */
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01007719 expected_length =
Gilles Peskine449bd832023-01-11 14:50:10 +01007720 PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE(slot->attr.type, slot->attr.bits);
7721 if (output_size < expected_length) {
Gilles Peskine3e561302022-04-14 00:17:15 +02007722 status = PSA_ERROR_BUFFER_TOO_SMALL;
7723 goto exit;
7724 }
7725
Thomas Daubney81899ab2024-02-15 12:57:26 +00007726 LOCAL_INPUT_ALLOC(peer_key_external, peer_key_length, peer_key);
Gilles Peskine449bd832023-01-11 14:50:10 +01007727 status = psa_key_agreement_raw_internal(alg, slot,
7728 peer_key, peer_key_length,
7729 output, output_size,
7730 output_length);
Gilles Peskine0216fe12019-04-11 21:23:21 +02007731
7732exit:
Thomas Daubney5390aca2024-02-22 11:06:04 +00007733 /* Check for successful allocation of output,
7734 * with an unsuccessful status. */
Thomas Daubney0576a6a2024-02-21 15:15:00 +00007735 if (output != NULL && status != PSA_SUCCESS) {
Gilles Peskine0216fe12019-04-11 21:23:21 +02007736 /* If an error happens and is not handled properly, the output
7737 * may be used as a key to protect sensitive data. Arrange for such
7738 * a key to be random, which is likely to result in decryption or
7739 * verification errors. This is better than filling the buffer with
7740 * some constant data such as zeros, which would result in the data
7741 * being protected with a reproducible, easily knowable key.
7742 */
David Horstmann6e99bb22024-02-06 15:27:49 +00007743 psa_generate_random_internal(output, output_size);
Gilles Peskine0216fe12019-04-11 21:23:21 +02007744 *output_length = output_size;
7745 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02007746
Thomas Daubney5390aca2024-02-22 11:06:04 +00007747 if (output == NULL) {
Thomas Daubney89d8c2a2024-02-21 11:16:16 +00007748 /* output allocation failed. */
7749 *output_length = 0;
Gilles Peskine0216fe12019-04-11 21:23:21 +02007750 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02007751
Ryan Everetta103ec92024-01-31 13:59:57 +00007752 unlock_status = psa_unregister_read_under_mutex(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02007753
Thomas Daubney81899ab2024-02-15 12:57:26 +00007754 LOCAL_INPUT_FREE(peer_key_external, peer_key);
7755 LOCAL_OUTPUT_FREE(output_external, output);
Gilles Peskine449bd832023-01-11 14:50:10 +01007756 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine0216fe12019-04-11 21:23:21 +02007757}
Gilles Peskine86a440b2018-11-12 18:39:40 +01007758
7759
7760/****************************************************************/
7761/* Random generation */
Gilles Peskine53d991e2018-07-12 01:14:59 +02007762/****************************************************************/
Gilles Peskine12313cd2018-06-20 00:20:32 +02007763
Gilles Peskine672a7712023-04-28 21:00:28 +02007764#if defined(MBEDTLS_PSA_INJECT_ENTROPY)
7765#include "entropy_poll.h"
7766#endif
7767
Gilles Peskine30524eb2020-11-13 17:02:26 +01007768/** Initialize the PSA random generator.
Paul Elliottd35dce62024-03-15 13:57:16 +00007769 *
7770 * Note: the mbedtls_threading_psa_rngdata_mutex should be held when calling
7771 * this function if mutexes are enabled.
Gilles Peskine30524eb2020-11-13 17:02:26 +01007772 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007773static void mbedtls_psa_random_init(mbedtls_psa_random_context_t *rng)
Gilles Peskine30524eb2020-11-13 17:02:26 +01007774{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007775#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
Gilles Peskine449bd832023-01-11 14:50:10 +01007776 memset(rng, 0, sizeof(*rng));
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007777#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
7778
Gilles Peskine30524eb2020-11-13 17:02:26 +01007779 /* Set default configuration if
7780 * mbedtls_psa_crypto_configure_entropy_sources() hasn't been called. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007781 if (rng->entropy_init == NULL) {
Gilles Peskine30524eb2020-11-13 17:02:26 +01007782 rng->entropy_init = mbedtls_entropy_init;
Gilles Peskine449bd832023-01-11 14:50:10 +01007783 }
7784 if (rng->entropy_free == NULL) {
Gilles Peskine30524eb2020-11-13 17:02:26 +01007785 rng->entropy_free = mbedtls_entropy_free;
Gilles Peskine449bd832023-01-11 14:50:10 +01007786 }
Gilles Peskine30524eb2020-11-13 17:02:26 +01007787
Gilles Peskine449bd832023-01-11 14:50:10 +01007788 rng->entropy_init(&rng->entropy);
Gilles Peskine30524eb2020-11-13 17:02:26 +01007789#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \
7790 defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES)
7791 /* The PSA entropy injection feature depends on using NV seed as an entropy
7792 * source. Add NV seed as an entropy source for PSA entropy injection. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007793 mbedtls_entropy_add_source(&rng->entropy,
7794 mbedtls_nv_seed_poll, NULL,
7795 MBEDTLS_ENTROPY_BLOCK_SIZE,
7796 MBEDTLS_ENTROPY_SOURCE_STRONG);
Gilles Peskine30524eb2020-11-13 17:02:26 +01007797#endif
7798
Valerio Setti061d4e42024-02-26 12:52:44 +01007799 mbedtls_psa_drbg_init(&rng->drbg);
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007800#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01007801}
7802
7803/** Deinitialize the PSA random generator.
Paul Elliottd35dce62024-03-15 13:57:16 +00007804 *
7805 * Note: the mbedtls_threading_psa_rngdata_mutex should be held when calling
7806 * this function if mutexes are enabled.
Gilles Peskine30524eb2020-11-13 17:02:26 +01007807 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007808static void mbedtls_psa_random_free(mbedtls_psa_random_context_t *rng)
Gilles Peskine30524eb2020-11-13 17:02:26 +01007809{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007810#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
Gilles Peskine449bd832023-01-11 14:50:10 +01007811 memset(rng, 0, sizeof(*rng));
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007812#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Valerio Setti061d4e42024-02-26 12:52:44 +01007813 mbedtls_psa_drbg_free(&rng->drbg);
Gilles Peskine449bd832023-01-11 14:50:10 +01007814 rng->entropy_free(&rng->entropy);
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007815#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01007816}
7817
7818/** Seed the PSA random generator.
7819 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007820static psa_status_t mbedtls_psa_random_seed(mbedtls_psa_random_context_t *rng)
Gilles Peskine30524eb2020-11-13 17:02:26 +01007821{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007822#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
7823 /* Do nothing: the external RNG seeds itself. */
7824 (void) rng;
Gilles Peskine449bd832023-01-11 14:50:10 +01007825 return PSA_SUCCESS;
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007826#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01007827 const unsigned char drbg_seed[] = "PSA";
Valerio Setti061d4e42024-02-26 12:52:44 +01007828 int ret = mbedtls_psa_drbg_seed(&rng->drbg, &rng->entropy,
Gilles Peskine449bd832023-01-11 14:50:10 +01007829 drbg_seed, sizeof(drbg_seed) - 1);
7830 return mbedtls_to_psa_error(ret);
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007831#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01007832}
7833
David Horstmann6e99bb22024-02-06 15:27:49 +00007834psa_status_t psa_generate_random(uint8_t *output_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01007835 size_t output_size)
Gilles Peskinee59236f2018-01-27 23:32:46 +01007836{
David Horstmann6e99bb22024-02-06 15:27:49 +00007837 psa_status_t status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01007838
David Horstmann6e99bb22024-02-06 15:27:49 +00007839 LOCAL_OUTPUT_DECLARE(output_external, output);
7840 LOCAL_OUTPUT_ALLOC(output_external, output_size, output);
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007841
David Horstmann6e99bb22024-02-06 15:27:49 +00007842 status = psa_generate_random_internal(output, output_size);
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007843
David Horstmann4a48bec2024-03-13 15:42:31 +00007844#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
David Horstmann6e99bb22024-02-06 15:27:49 +00007845exit:
David Horstmanne097bbd2024-02-28 14:17:10 +00007846#endif
David Horstmann6e99bb22024-02-06 15:27:49 +00007847 LOCAL_OUTPUT_FREE(output_external, output);
7848 return status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01007849}
7850
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01007851#if defined(MBEDTLS_PSA_INJECT_ENTROPY)
Gilles Peskine449bd832023-01-11 14:50:10 +01007852psa_status_t mbedtls_psa_inject_entropy(const uint8_t *seed,
7853 size_t seed_size)
Netanel Gonen2bcd3122018-11-19 11:53:02 +02007854{
Paul Elliott600472b2024-02-23 17:26:58 +00007855 if (psa_get_initialized()) {
Gilles Peskine449bd832023-01-11 14:50:10 +01007856 return PSA_ERROR_NOT_PERMITTED;
7857 }
Netanel Gonen21f37cb2018-11-19 11:53:55 +02007858
Gilles Peskine449bd832023-01-11 14:50:10 +01007859 if (((seed_size < MBEDTLS_ENTROPY_MIN_PLATFORM) ||
7860 (seed_size < MBEDTLS_ENTROPY_BLOCK_SIZE)) ||
7861 (seed_size > MBEDTLS_ENTROPY_MAX_SEED_SIZE)) {
7862 return PSA_ERROR_INVALID_ARGUMENT;
7863 }
Netanel Gonen21f37cb2018-11-19 11:53:55 +02007864
Gilles Peskine449bd832023-01-11 14:50:10 +01007865 return mbedtls_psa_storage_inject_entropy(seed, seed_size);
Netanel Gonen2bcd3122018-11-19 11:53:02 +02007866}
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01007867#endif /* MBEDTLS_PSA_INJECT_ENTROPY */
Netanel Gonen2bcd3122018-11-19 11:53:02 +02007868
Ronald Cron3772afe2021-02-08 16:10:05 +01007869/** Validate the key type and size for key generation
Ronald Cron01b2aba2020-10-05 09:42:02 +02007870 *
Ronald Cron3772afe2021-02-08 16:10:05 +01007871 * \param type The key type
7872 * \param bits The number of bits of the key
Ronald Cron01b2aba2020-10-05 09:42:02 +02007873 *
7874 * \retval #PSA_SUCCESS
Ronald Cron3772afe2021-02-08 16:10:05 +01007875 * The key type and size are valid.
Ronald Cron01b2aba2020-10-05 09:42:02 +02007876 * \retval #PSA_ERROR_INVALID_ARGUMENT
7877 * The size in bits of the key is not valid.
7878 * \retval #PSA_ERROR_NOT_SUPPORTED
7879 * The type and/or the size in bits of the key or the combination of
7880 * the two is not supported.
7881 */
Ronald Cron3772afe2021-02-08 16:10:05 +01007882static psa_status_t psa_validate_key_type_and_size_for_key_generation(
Gilles Peskine449bd832023-01-11 14:50:10 +01007883 psa_key_type_t type, size_t bits)
Gilles Peskinee59236f2018-01-27 23:32:46 +01007884{
Ronald Cronf3bb7612020-10-02 20:11:59 +02007885 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinee59236f2018-01-27 23:32:46 +01007886
Gilles Peskine449bd832023-01-11 14:50:10 +01007887 if (key_type_is_raw_bytes(type)) {
7888 status = psa_validate_unstructured_key_bit_size(type, bits);
7889 if (status != PSA_SUCCESS) {
7890 return status;
7891 }
7892 } else
Valerio Settif6d4dfb2023-07-10 10:55:12 +02007893#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01007894 if (PSA_KEY_TYPE_IS_RSA(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
7895 if (bits > PSA_VENDOR_RSA_MAX_KEY_BITS) {
7896 return PSA_ERROR_NOT_SUPPORTED;
7897 }
Waleed Elmelegyd7bdbbe2023-07-20 16:26:58 +00007898 if (bits < PSA_VENDOR_RSA_GENERATE_MIN_KEY_BITS) {
Waleed Elmelegyab570712023-07-05 16:40:58 +00007899 return PSA_ERROR_NOT_SUPPORTED;
7900 }
Steven Cooreman81be2fa2020-07-24 22:04:59 +02007901
Ronald Cron01b2aba2020-10-05 09:42:02 +02007902 /* Accept only byte-aligned keys, for the same reasons as
7903 * in psa_import_rsa_key(). */
Gilles Peskine449bd832023-01-11 14:50:10 +01007904 if (bits % 8 != 0) {
7905 return PSA_ERROR_NOT_SUPPORTED;
7906 }
7907 } else
Valerio Settif6d4dfb2023-07-10 10:55:12 +02007908#endif /* defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE) */
Ronald Cron01b2aba2020-10-05 09:42:02 +02007909
Valerio Setti6a9d0ee2023-06-21 10:07:21 +02007910#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01007911 if (PSA_KEY_TYPE_IS_ECC(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
Ronald Crond81ab562021-02-16 09:01:16 +01007912 /* To avoid empty block, return successfully here. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007913 return PSA_SUCCESS;
7914 } else
Valerio Setti6a9d0ee2023-06-21 10:07:21 +02007915#endif /* defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE) */
Przemek Stekielfedd1342022-12-01 15:00:02 +01007916
Valerio Settia55f0422023-07-10 15:34:41 +02007917#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE)
Przemek Stekielfedd1342022-12-01 15:00:02 +01007918 if (PSA_KEY_TYPE_IS_DH(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
Przemek Stekield1cf1ba2023-04-27 12:04:21 +02007919 if (psa_is_dh_key_size_valid(bits) == 0) {
Przemek Stekielfedd1342022-12-01 15:00:02 +01007920 return PSA_ERROR_NOT_SUPPORTED;
7921 }
7922 } else
Valerio Settia55f0422023-07-10 15:34:41 +02007923#endif /* defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE) */
Ronald Cron01b2aba2020-10-05 09:42:02 +02007924 {
Gilles Peskine449bd832023-01-11 14:50:10 +01007925 return PSA_ERROR_NOT_SUPPORTED;
Ronald Cron01b2aba2020-10-05 09:42:02 +02007926 }
7927
Gilles Peskine449bd832023-01-11 14:50:10 +01007928 return PSA_SUCCESS;
Ronald Cron01b2aba2020-10-05 09:42:02 +02007929}
7930
Ronald Cron55ed0592020-10-05 10:30:40 +02007931psa_status_t psa_generate_key_internal(
Ronald Cron2a38a6b2020-10-02 20:02:04 +02007932 const psa_key_attributes_t *attributes,
Gilles Peskinef36d7852024-06-06 21:11:44 +02007933 const psa_custom_key_parameters_t *custom,
7934 const uint8_t *custom_data,
7935 size_t custom_data_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01007936 uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length)
Ronald Cron01b2aba2020-10-05 09:42:02 +02007937{
7938 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f107ae2024-02-28 01:26:46 +01007939 psa_key_type_t type = attributes->type;
Ronald Cron01b2aba2020-10-05 09:42:02 +02007940
Gilles Peskine7a18f962024-02-12 16:48:11 +01007941 /* Only used for RSA */
Gilles Peskinef36d7852024-06-06 21:11:44 +02007942 (void) custom;
7943 (void) custom_data;
7944 (void) custom_data_length;
Ronald Cron01b2aba2020-10-05 09:42:02 +02007945
Gilles Peskine449bd832023-01-11 14:50:10 +01007946 if (key_type_is_raw_bytes(type)) {
David Horstmann93fa4e12024-03-12 15:02:28 +00007947 status = psa_generate_random_internal(key_buffer, key_buffer_size);
Gilles Peskine449bd832023-01-11 14:50:10 +01007948 if (status != PSA_SUCCESS) {
7949 return status;
7950 }
Steven Cooreman81be2fa2020-07-24 22:04:59 +02007951
David Brown12ca5032021-02-11 11:02:00 -07007952#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Gilles Peskine449bd832023-01-11 14:50:10 +01007953 if (type == PSA_KEY_TYPE_DES) {
7954 psa_des_set_key_parity(key_buffer, key_buffer_size);
7955 }
David Brown8107e312021-02-12 08:08:46 -07007956#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */
Gilles Peskine449bd832023-01-11 14:50:10 +01007957 } else
Gilles Peskinee59236f2018-01-27 23:32:46 +01007958
Valerio Setti76df8c12023-07-11 14:11:28 +02007959#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_GENERATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01007960 if (type == PSA_KEY_TYPE_RSA_KEY_PAIR) {
7961 return mbedtls_psa_rsa_generate_key(attributes,
Gilles Peskinef36d7852024-06-06 21:11:44 +02007962 custom_data, custom_data_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01007963 key_buffer,
7964 key_buffer_size,
7965 key_buffer_length);
7966 } else
Valerio Setti76df8c12023-07-11 14:11:28 +02007967#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_GENERATE) */
Gilles Peskinee59236f2018-01-27 23:32:46 +01007968
Valerio Settibfeaf5b2023-06-20 13:27:46 +02007969#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01007970 if (PSA_KEY_TYPE_IS_ECC(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
7971 return mbedtls_psa_ecp_generate_key(attributes,
7972 key_buffer,
7973 key_buffer_size,
7974 key_buffer_length);
7975 } else
Valerio Settibfeaf5b2023-06-20 13:27:46 +02007976#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE) */
Przemek Stekielfedd1342022-12-01 15:00:02 +01007977
Valerio Settia55f0422023-07-10 15:34:41 +02007978#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE)
Przemek Stekielfedd1342022-12-01 15:00:02 +01007979 if (PSA_KEY_TYPE_IS_DH(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
7980 return mbedtls_psa_ffdh_generate_key(attributes,
7981 key_buffer,
7982 key_buffer_size,
7983 key_buffer_length);
7984 } else
Valerio Settia55f0422023-07-10 15:34:41 +02007985#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE) */
Steven Cooreman29149862020-08-05 15:43:42 +02007986 {
Gilles Peskine449bd832023-01-11 14:50:10 +01007987 (void) key_buffer_length;
7988 return PSA_ERROR_NOT_SUPPORTED;
Steven Cooreman29149862020-08-05 15:43:42 +02007989 }
Gilles Peskinee59236f2018-01-27 23:32:46 +01007990
Gilles Peskine449bd832023-01-11 14:50:10 +01007991 return PSA_SUCCESS;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02007992}
Darryl Green0c6575a2018-11-07 16:05:30 +00007993
Gilles Peskinef36d7852024-06-06 21:11:44 +02007994psa_status_t psa_generate_key_custom(const psa_key_attributes_t *attributes,
7995 const psa_custom_key_parameters_t *custom,
7996 const uint8_t *custom_data,
7997 size_t custom_data_length,
7998 mbedtls_svc_key_id_t *key)
Gilles Peskineff5f0e72019-04-18 12:53:30 +02007999{
8000 psa_status_t status;
8001 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02008002 psa_se_drv_table_entry_t *driver = NULL;
Ronald Cron2b56bc82020-10-05 10:02:26 +02008003 size_t key_buffer_size;
Gilles Peskine11792082019-08-06 18:36:36 +02008004
Ronald Cron81709fc2020-11-14 12:10:32 +01008005 *key = MBEDTLS_SVC_KEY_ID_INIT;
8006
Gilles Peskine0f84d622019-09-12 19:03:13 +02008007 /* Reject any attempt to create a zero-length key so that we don't
8008 * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
Gilles Peskine449bd832023-01-11 14:50:10 +01008009 if (psa_get_key_bits(attributes) == 0) {
8010 return PSA_ERROR_INVALID_ARGUMENT;
8011 }
Gilles Peskine0f84d622019-09-12 19:03:13 +02008012
Przemyslaw Stekielc0fe8202021-10-07 11:08:56 +02008013 /* Reject any attempt to create a public key. */
Gilles Peskine2f107ae2024-02-28 01:26:46 +01008014 if (PSA_KEY_TYPE_IS_PUBLIC_KEY(attributes->type)) {
Gilles Peskine449bd832023-01-11 14:50:10 +01008015 return PSA_ERROR_INVALID_ARGUMENT;
8016 }
Przemyslaw Stekielc0fe8202021-10-07 11:08:56 +02008017
Gilles Peskine7a18f962024-02-12 16:48:11 +01008018#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE)
Gilles Peskine2f107ae2024-02-28 01:26:46 +01008019 if (attributes->type == PSA_KEY_TYPE_RSA_KEY_PAIR) {
Gilles Peskinef36d7852024-06-06 21:11:44 +02008020 if (custom->flags != 0) {
Gilles Peskine7a18f962024-02-12 16:48:11 +01008021 return PSA_ERROR_INVALID_ARGUMENT;
8022 }
8023 } else
8024#endif
Gilles Peskine52504f82024-06-20 17:19:58 +02008025 if (!psa_custom_key_parameters_are_default(custom, custom_data_length)) {
Ronald Cron81709fc2020-11-14 12:10:32 +01008026 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine11792082019-08-06 18:36:36 +02008027 }
8028
Gilles Peskine449bd832023-01-11 14:50:10 +01008029 status = psa_start_key_creation(PSA_KEY_CREATION_GENERATE, attributes,
8030 &slot, &driver);
8031 if (status != PSA_SUCCESS) {
Gilles Peskine11792082019-08-06 18:36:36 +02008032 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01008033 }
Gilles Peskine11792082019-08-06 18:36:36 +02008034
Ronald Cron977c2472020-10-13 08:32:21 +02008035 /* In the case of a transparent key or an opaque key stored in local
Archana449608b2021-09-08 15:36:05 +05308036 * storage ( thus not in the case of generating a key in a secure element
8037 * with storage ( MBEDTLS_PSA_CRYPTO_SE_C ) ),we have to allocate a
8038 * buffer to hold the generated key material. */
Valerio Setti8d4f1502024-06-14 07:49:05 +02008039#if defined(MBEDTLS_PSA_STATIC_KEY_SLOTS)
8040 int is_slot_unused = (slot->key.in_use == 0);
8041#else
8042 int is_slot_unused = (slot->key.data == NULL);
8043#endif
8044
8045 if (is_slot_unused) {
Gilles Peskine2f107ae2024-02-28 01:26:46 +01008046 if (PSA_KEY_LIFETIME_GET_LOCATION(attributes->lifetime) ==
Gilles Peskine449bd832023-01-11 14:50:10 +01008047 PSA_KEY_LOCATION_LOCAL_STORAGE) {
Ronald Cron3772afe2021-02-08 16:10:05 +01008048 status = psa_validate_key_type_and_size_for_key_generation(
Gilles Peskine2f107ae2024-02-28 01:26:46 +01008049 attributes->type, attributes->bits);
Gilles Peskine449bd832023-01-11 14:50:10 +01008050 if (status != PSA_SUCCESS) {
Ronald Cron3772afe2021-02-08 16:10:05 +01008051 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01008052 }
Ronald Cron3772afe2021-02-08 16:10:05 +01008053
8054 key_buffer_size = PSA_EXPORT_KEY_OUTPUT_SIZE(
Gilles Peskine2f107ae2024-02-28 01:26:46 +01008055 attributes->type,
8056 attributes->bits);
Gilles Peskine449bd832023-01-11 14:50:10 +01008057 } else {
Ronald Cron977c2472020-10-13 08:32:21 +02008058 status = psa_driver_wrapper_get_key_buffer_size(
Gilles Peskine449bd832023-01-11 14:50:10 +01008059 attributes, &key_buffer_size);
8060 if (status != PSA_SUCCESS) {
Ronald Cron3772afe2021-02-08 16:10:05 +01008061 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01008062 }
Ronald Cron977c2472020-10-13 08:32:21 +02008063 }
Ronald Cron977c2472020-10-13 08:32:21 +02008064
Gilles Peskine449bd832023-01-11 14:50:10 +01008065 status = psa_allocate_buffer_to_slot(slot, key_buffer_size);
8066 if (status != PSA_SUCCESS) {
Ronald Cron977c2472020-10-13 08:32:21 +02008067 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01008068 }
Ronald Cron977c2472020-10-13 08:32:21 +02008069 }
8070
Gilles Peskine449bd832023-01-11 14:50:10 +01008071 status = psa_driver_wrapper_generate_key(attributes,
Gilles Peskinef36d7852024-06-06 21:11:44 +02008072 custom,
8073 custom_data, custom_data_length,
Gilles Peskine7a18f962024-02-12 16:48:11 +01008074 slot->key.data, slot->key.bytes,
8075 &slot->key.bytes);
Gilles Peskine449bd832023-01-11 14:50:10 +01008076 if (status != PSA_SUCCESS) {
8077 psa_remove_key_data_from_memory(slot);
8078 }
Ronald Cron2b56bc82020-10-05 10:02:26 +02008079
Gilles Peskine11792082019-08-06 18:36:36 +02008080exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01008081 if (status == PSA_SUCCESS) {
8082 status = psa_finish_key_creation(slot, driver, key);
8083 }
8084 if (status != PSA_SUCCESS) {
8085 psa_fail_key_creation(slot, driver);
8086 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02008087
Gilles Peskine449bd832023-01-11 14:50:10 +01008088 return status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01008089}
8090
Gilles Peskinef36d7852024-06-06 21:11:44 +02008091psa_status_t psa_generate_key_ext(const psa_key_attributes_t *attributes,
8092 const psa_key_production_parameters_t *params,
8093 size_t params_data_length,
8094 mbedtls_svc_key_id_t *key)
8095{
8096 return psa_generate_key_custom(
8097 attributes,
8098 (const psa_custom_key_parameters_t *) params,
8099 params->data, params_data_length,
8100 key);
8101}
8102
Gilles Peskinef0765fa2024-02-12 16:46:16 +01008103psa_status_t psa_generate_key(const psa_key_attributes_t *attributes,
8104 mbedtls_svc_key_id_t *key)
8105{
Gilles Peskinef36d7852024-06-06 21:11:44 +02008106 return psa_generate_key_custom(attributes,
8107 &default_custom_production,
8108 NULL, 0,
8109 key);
Gilles Peskinef0765fa2024-02-12 16:46:16 +01008110}
8111
Gilles Peskinee59236f2018-01-27 23:32:46 +01008112/****************************************************************/
8113/* Module setup */
8114/****************************************************************/
8115
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01008116#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
Gilles Peskine5e769522018-11-20 21:59:56 +01008117psa_status_t mbedtls_psa_crypto_configure_entropy_sources(
Gilles Peskine449bd832023-01-11 14:50:10 +01008118 void (* entropy_init)(mbedtls_entropy_context *ctx),
8119 void (* entropy_free)(mbedtls_entropy_context *ctx))
Gilles Peskine5e769522018-11-20 21:59:56 +01008120{
Paul Elliott8e151532024-02-23 17:35:29 +00008121 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
8122
8123#if defined(MBEDTLS_THREADING_C)
8124 mbedtls_mutex_lock(&mbedtls_threading_psa_rngdata_mutex);
8125#endif /* defined(MBEDTLS_THREADING_C) */
8126
Gilles Peskine449bd832023-01-11 14:50:10 +01008127 if (global_data.rng_state != RNG_NOT_INITIALIZED) {
Paul Elliott8e151532024-02-23 17:35:29 +00008128 status = PSA_ERROR_BAD_STATE;
8129 } else {
8130 global_data.rng.entropy_init = entropy_init;
8131 global_data.rng.entropy_free = entropy_free;
8132 status = PSA_SUCCESS;
Gilles Peskine449bd832023-01-11 14:50:10 +01008133 }
Paul Elliott8e151532024-02-23 17:35:29 +00008134
8135#if defined(MBEDTLS_THREADING_C)
8136 mbedtls_mutex_unlock(&mbedtls_threading_psa_rngdata_mutex);
8137#endif /* defined(MBEDTLS_THREADING_C) */
8138
8139 return status;
Gilles Peskine5e769522018-11-20 21:59:56 +01008140}
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01008141#endif /* !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) */
Gilles Peskine5e769522018-11-20 21:59:56 +01008142
Gilles Peskine449bd832023-01-11 14:50:10 +01008143void mbedtls_psa_crypto_free(void)
Gilles Peskinee59236f2018-01-27 23:32:46 +01008144{
Paul Elliott47cee8e2024-03-08 21:38:02 +00008145
Paul Elliott600472b2024-02-23 17:26:58 +00008146#if defined(MBEDTLS_THREADING_C)
8147 mbedtls_mutex_lock(&mbedtls_threading_psa_globaldata_mutex);
8148#endif /* defined(MBEDTLS_THREADING_C) */
8149
Paul Elliott47cee8e2024-03-08 21:38:02 +00008150 /* Nothing to do to free transaction. */
8151 if (global_data.initialized & PSA_CRYPTO_SUBSYSTEM_TRANSACTION_INITIALIZED) {
8152 global_data.initialized &= ~PSA_CRYPTO_SUBSYSTEM_TRANSACTION_INITIALIZED;
Valerio Setti83e0de82023-11-24 12:13:05 +01008153 }
Paul Elliott600472b2024-02-23 17:26:58 +00008154
Paul Elliott47cee8e2024-03-08 21:38:02 +00008155 if (global_data.initialized & PSA_CRYPTO_SUBSYSTEM_KEY_SLOTS_INITIALIZED) {
8156 psa_wipe_all_key_slots();
8157 global_data.initialized &= ~PSA_CRYPTO_SUBSYSTEM_KEY_SLOTS_INITIALIZED;
8158 }
Ronald Cron9ba76912021-04-10 16:57:30 +02008159
Paul Elliott600472b2024-02-23 17:26:58 +00008160#if defined(MBEDTLS_THREADING_C)
8161 mbedtls_mutex_unlock(&mbedtls_threading_psa_globaldata_mutex);
8162#endif /* defined(MBEDTLS_THREADING_C) */
8163
Paul Elliott47cee8e2024-03-08 21:38:02 +00008164#if defined(MBEDTLS_THREADING_C)
8165 mbedtls_mutex_lock(&mbedtls_threading_psa_rngdata_mutex);
8166#endif /* defined(MBEDTLS_THREADING_C) */
8167
Gilles Peskinec6b69072018-11-20 21:42:52 +01008168 if (global_data.rng_state != RNG_NOT_INITIALIZED) {
Gilles Peskine30524eb2020-11-13 17:02:26 +01008169 mbedtls_psa_random_free(&global_data.rng);
Gilles Peskinec6b69072018-11-20 21:42:52 +01008170 }
Paul Elliott47cee8e2024-03-08 21:38:02 +00008171 global_data.rng_state = RNG_NOT_INITIALIZED;
8172 mbedtls_platform_zeroize(&global_data.rng, sizeof(global_data.rng));
8173
8174#if defined(MBEDTLS_THREADING_C)
8175 mbedtls_mutex_unlock(&mbedtls_threading_psa_rngdata_mutex);
8176#endif /* defined(MBEDTLS_THREADING_C) */
8177
8178#if defined(MBEDTLS_THREADING_C)
8179 mbedtls_mutex_lock(&mbedtls_threading_psa_globaldata_mutex);
8180#endif /* defined(MBEDTLS_THREADING_C) */
Ronald Cron9ba76912021-04-10 16:57:30 +02008181
8182 /* Terminate drivers */
Paul Elliott47cee8e2024-03-08 21:38:02 +00008183 if (global_data.initialized & PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS_INITIALIZED) {
8184 psa_driver_wrapper_free();
8185 global_data.initialized &= ~PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS_INITIALIZED;
8186 }
8187
8188#if defined(MBEDTLS_THREADING_C)
8189 mbedtls_mutex_unlock(&mbedtls_threading_psa_globaldata_mutex);
8190#endif /* defined(MBEDTLS_THREADING_C) */
8191
Gilles Peskinee59236f2018-01-27 23:32:46 +01008192}
8193
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02008194#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
8195/** Recover a transaction that was interrupted by a power failure.
8196 *
8197 * This function is called during initialization, before psa_crypto_init()
8198 * returns. If this function returns a failure status, the initialization
8199 * fails.
8200 */
8201static psa_status_t psa_crypto_recover_transaction(
Gilles Peskine449bd832023-01-11 14:50:10 +01008202 const psa_crypto_transaction_t *transaction)
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02008203{
Gilles Peskine449bd832023-01-11 14:50:10 +01008204 switch (transaction->unknown.type) {
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02008205 case PSA_CRYPTO_TRANSACTION_CREATE_KEY:
8206 case PSA_CRYPTO_TRANSACTION_DESTROY_KEY:
Gilles Peskine449bd832023-01-11 14:50:10 +01008207 /* TODO - fall through to the failure case until this
8208 * is implemented.
8209 * https://github.com/ARMmbed/mbed-crypto/issues/218
8210 */
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02008211 default:
8212 /* We found an unsupported transaction in the storage.
8213 * We don't know what state the storage is in. Give up. */
Gilles Peskine449bd832023-01-11 14:50:10 +01008214 return PSA_ERROR_DATA_INVALID;
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02008215 }
8216}
8217#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
8218
Paul Elliott47cee8e2024-03-08 21:38:02 +00008219static psa_status_t mbedtls_psa_crypto_init_subsystem(mbedtls_psa_crypto_subsystem subsystem)
8220{
8221 psa_status_t status = PSA_SUCCESS;
8222 uint8_t driver_wrappers_initialized = 0;
8223
8224 switch (subsystem) {
8225 case PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS:
8226
8227#if defined(MBEDTLS_THREADING_C)
8228 PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_lock(&mbedtls_threading_psa_globaldata_mutex));
8229#endif /* defined(MBEDTLS_THREADING_C) */
8230
8231 if (!(global_data.initialized & PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS_INITIALIZED)) {
8232 /* Init drivers */
8233 status = psa_driver_wrapper_init();
8234
8235 /* Drivers need shutdown regardless of startup errors. */
8236 global_data.initialized |= PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS_INITIALIZED;
8237
8238
8239 }
8240#if defined(MBEDTLS_THREADING_C)
8241 PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_unlock(
8242 &mbedtls_threading_psa_globaldata_mutex));
8243#endif /* defined(MBEDTLS_THREADING_C) */
8244
8245 break;
8246
8247 case PSA_CRYPTO_SUBSYSTEM_KEY_SLOTS:
8248
8249#if defined(MBEDTLS_THREADING_C)
8250 PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_lock(&mbedtls_threading_psa_globaldata_mutex));
8251#endif /* defined(MBEDTLS_THREADING_C) */
8252
8253 if (!(global_data.initialized & PSA_CRYPTO_SUBSYSTEM_KEY_SLOTS_INITIALIZED)) {
8254 status = psa_initialize_key_slots();
8255
8256 /* Need to wipe keys even if initialization fails. */
8257 global_data.initialized |= PSA_CRYPTO_SUBSYSTEM_KEY_SLOTS_INITIALIZED;
8258
8259 }
8260#if defined(MBEDTLS_THREADING_C)
8261 PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_unlock(
8262 &mbedtls_threading_psa_globaldata_mutex));
8263#endif /* defined(MBEDTLS_THREADING_C) */
8264
8265 break;
8266
8267 case PSA_CRYPTO_SUBSYSTEM_RNG:
8268
8269#if defined(MBEDTLS_THREADING_C)
8270 PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_lock(&mbedtls_threading_psa_globaldata_mutex));
8271#endif /* defined(MBEDTLS_THREADING_C) */
8272
8273 driver_wrappers_initialized =
8274 (global_data.initialized & PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS_INITIALIZED);
8275
8276#if defined(MBEDTLS_THREADING_C)
8277 PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_unlock(
8278 &mbedtls_threading_psa_globaldata_mutex));
8279#endif /* defined(MBEDTLS_THREADING_C) */
8280
8281 /* Need to use separate mutex here, as initialisation can require
8282 * testing of init flags, which requires locking the global data
8283 * mutex. */
8284#if defined(MBEDTLS_THREADING_C)
8285 PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_lock(&mbedtls_threading_psa_rngdata_mutex));
8286#endif /* defined(MBEDTLS_THREADING_C) */
8287
8288 /* Initialize and seed the random generator. */
8289 if (global_data.rng_state == RNG_NOT_INITIALIZED && driver_wrappers_initialized) {
8290 mbedtls_psa_random_init(&global_data.rng);
8291 global_data.rng_state = RNG_INITIALIZED;
8292
8293 status = mbedtls_psa_random_seed(&global_data.rng);
8294 if (status == PSA_SUCCESS) {
8295 global_data.rng_state = RNG_SEEDED;
8296 }
8297 }
8298
8299#if defined(MBEDTLS_THREADING_C)
8300 PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_unlock(
8301 &mbedtls_threading_psa_rngdata_mutex));
8302#endif /* defined(MBEDTLS_THREADING_C) */
8303
Paul Elliott47cee8e2024-03-08 21:38:02 +00008304 break;
8305
8306 case PSA_CRYPTO_SUBSYSTEM_TRANSACTION:
8307
8308#if defined(MBEDTLS_THREADING_C)
8309 PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_lock(&mbedtls_threading_psa_globaldata_mutex));
8310#endif /* defined(MBEDTLS_THREADING_C) */
8311
8312 if (!(global_data.initialized & PSA_CRYPTO_SUBSYSTEM_TRANSACTION_INITIALIZED)) {
8313#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
8314 status = psa_crypto_load_transaction();
8315 if (status == PSA_SUCCESS) {
8316 status = psa_crypto_recover_transaction(&psa_crypto_transaction);
8317 if (status == PSA_SUCCESS) {
8318 global_data.initialized |= PSA_CRYPTO_SUBSYSTEM_TRANSACTION_INITIALIZED;
8319 }
8320 status = psa_crypto_stop_transaction();
8321 } else if (status == PSA_ERROR_DOES_NOT_EXIST) {
8322 /* There's no transaction to complete. It's all good. */
8323 global_data.initialized |= PSA_CRYPTO_SUBSYSTEM_TRANSACTION_INITIALIZED;
8324 status = PSA_SUCCESS;
8325 }
8326#else /* defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS) */
8327 global_data.initialized |= PSA_CRYPTO_SUBSYSTEM_TRANSACTION_INITIALIZED;
8328 status = PSA_SUCCESS;
8329#endif /* defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS) */
8330 }
8331
8332#if defined(MBEDTLS_THREADING_C)
8333 PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_unlock(
8334 &mbedtls_threading_psa_globaldata_mutex));
8335#endif /* defined(MBEDTLS_THREADING_C) */
8336
8337 break;
8338
8339 default:
8340 status = PSA_ERROR_CORRUPTION_DETECTED;
8341 }
8342
8343 /* Exit label only required when using threading macros. */
8344#if defined(MBEDTLS_THREADING_C)
8345exit:
8346#endif /* defined(MBEDTLS_THREADING_C) */
8347
8348 return status;
8349}
8350
Gilles Peskine449bd832023-01-11 14:50:10 +01008351psa_status_t psa_crypto_init(void)
Gilles Peskinee59236f2018-01-27 23:32:46 +01008352{
Gilles Peskine66fb1262018-12-10 16:29:04 +01008353 psa_status_t status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01008354
Paul Elliott47cee8e2024-03-08 21:38:02 +00008355 /* Double initialization is explicitly allowed. Early out if everything is
8356 * done. */
8357 if (psa_get_initialized()) {
Gilles Peskine449bd832023-01-11 14:50:10 +01008358 return PSA_SUCCESS;
8359 }
Gilles Peskinee59236f2018-01-27 23:32:46 +01008360
Paul Elliott47cee8e2024-03-08 21:38:02 +00008361 status = mbedtls_psa_crypto_init_subsystem(PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS);
Valerio Setti402cfba2023-11-13 10:24:32 +01008362 if (status != PSA_SUCCESS) {
8363 goto exit;
8364 }
8365
Paul Elliott47cee8e2024-03-08 21:38:02 +00008366 status = mbedtls_psa_crypto_init_subsystem(PSA_CRYPTO_SUBSYSTEM_KEY_SLOTS);
Gilles Peskine449bd832023-01-11 14:50:10 +01008367 if (status != PSA_SUCCESS) {
Gilles Peskinee59236f2018-01-27 23:32:46 +01008368 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01008369 }
Gilles Peskinee59236f2018-01-27 23:32:46 +01008370
Paul Elliott47cee8e2024-03-08 21:38:02 +00008371 status = mbedtls_psa_crypto_init_subsystem(PSA_CRYPTO_SUBSYSTEM_RNG);
8372 if (status != PSA_SUCCESS) {
8373 goto exit;
Gilles Peskinefc762652019-07-22 19:30:34 +02008374 }
Gilles Peskinefc762652019-07-22 19:30:34 +02008375
Paul Elliott47cee8e2024-03-08 21:38:02 +00008376 status = mbedtls_psa_crypto_init_subsystem(PSA_CRYPTO_SUBSYSTEM_TRANSACTION);
Gilles Peskinee59236f2018-01-27 23:32:46 +01008377
8378exit:
Paul Elliott600472b2024-02-23 17:26:58 +00008379
Gilles Peskine449bd832023-01-11 14:50:10 +01008380 if (status != PSA_SUCCESS) {
8381 mbedtls_psa_crypto_free();
8382 }
Paul Elliott47cee8e2024-03-08 21:38:02 +00008383
Gilles Peskine449bd832023-01-11 14:50:10 +01008384 return status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01008385}
8386
Yanray Wangffc3c482023-07-11 12:01:04 +08008387#if defined(PSA_WANT_ALG_SOME_PAKE)
Przemek Stekielca8d2b22023-01-17 16:21:33 +01008388psa_status_t psa_crypto_driver_pake_get_password_len(
8389 const psa_crypto_driver_pake_inputs_t *inputs,
8390 size_t *password_len)
8391{
8392 if (inputs->password_len == 0) {
8393 return PSA_ERROR_BAD_STATE;
8394 }
8395
8396 *password_len = inputs->password_len;
8397
8398 return PSA_SUCCESS;
8399}
8400
8401psa_status_t psa_crypto_driver_pake_get_password(
8402 const psa_crypto_driver_pake_inputs_t *inputs,
8403 uint8_t *buffer, size_t buffer_size, size_t *buffer_length)
8404{
8405 if (inputs->password_len == 0) {
8406 return PSA_ERROR_BAD_STATE;
8407 }
8408
8409 if (buffer_size < inputs->password_len) {
8410 return PSA_ERROR_BUFFER_TOO_SMALL;
8411 }
8412
8413 memcpy(buffer, inputs->password, inputs->password_len);
8414 *buffer_length = inputs->password_len;
8415
8416 return PSA_SUCCESS;
8417}
8418
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01008419psa_status_t psa_crypto_driver_pake_get_user_len(
8420 const psa_crypto_driver_pake_inputs_t *inputs,
8421 size_t *user_len)
8422{
8423 if (inputs->user_len == 0) {
8424 return PSA_ERROR_BAD_STATE;
8425 }
8426
8427 *user_len = inputs->user_len;
8428
8429 return PSA_SUCCESS;
8430}
8431
8432psa_status_t psa_crypto_driver_pake_get_user(
8433 const psa_crypto_driver_pake_inputs_t *inputs,
Przemek Stekielc0e62502023-03-14 11:49:36 +01008434 uint8_t *user_id, size_t user_id_size, size_t *user_id_len)
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01008435{
8436 if (inputs->user_len == 0) {
8437 return PSA_ERROR_BAD_STATE;
8438 }
8439
Przemek Stekielc0e62502023-03-14 11:49:36 +01008440 if (user_id_size < inputs->user_len) {
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01008441 return PSA_ERROR_BUFFER_TOO_SMALL;
8442 }
8443
Przemek Stekielc0e62502023-03-14 11:49:36 +01008444 memcpy(user_id, inputs->user, inputs->user_len);
8445 *user_id_len = inputs->user_len;
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01008446
8447 return PSA_SUCCESS;
8448}
8449
8450psa_status_t psa_crypto_driver_pake_get_peer_len(
8451 const psa_crypto_driver_pake_inputs_t *inputs,
8452 size_t *peer_len)
8453{
8454 if (inputs->peer_len == 0) {
8455 return PSA_ERROR_BAD_STATE;
8456 }
8457
8458 *peer_len = inputs->peer_len;
8459
8460 return PSA_SUCCESS;
8461}
8462
8463psa_status_t psa_crypto_driver_pake_get_peer(
8464 const psa_crypto_driver_pake_inputs_t *inputs,
Przemek Stekielc0e62502023-03-14 11:49:36 +01008465 uint8_t *peer_id, size_t peer_id_size, size_t *peer_id_length)
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01008466{
8467 if (inputs->peer_len == 0) {
8468 return PSA_ERROR_BAD_STATE;
8469 }
8470
Przemek Stekielc0e62502023-03-14 11:49:36 +01008471 if (peer_id_size < inputs->peer_len) {
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01008472 return PSA_ERROR_BUFFER_TOO_SMALL;
8473 }
8474
Przemek Stekielc0e62502023-03-14 11:49:36 +01008475 memcpy(peer_id, inputs->peer, inputs->peer_len);
8476 *peer_id_length = inputs->peer_len;
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01008477
8478 return PSA_SUCCESS;
8479}
8480
Przemek Stekielca8d2b22023-01-17 16:21:33 +01008481psa_status_t psa_crypto_driver_pake_get_cipher_suite(
8482 const psa_crypto_driver_pake_inputs_t *inputs,
8483 psa_pake_cipher_suite_t *cipher_suite)
8484{
8485 if (inputs->cipher_suite.algorithm == PSA_ALG_NONE) {
8486 return PSA_ERROR_BAD_STATE;
8487 }
8488
8489 *cipher_suite = inputs->cipher_suite;
8490
8491 return PSA_SUCCESS;
8492}
8493
Neil Armstronga7d08c32022-06-01 18:21:20 +02008494psa_status_t psa_pake_setup(
8495 psa_pake_operation_t *operation,
8496 const psa_pake_cipher_suite_t *cipher_suite)
8497{
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008498 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008499
Przemek Stekiel1c3cfb42023-01-26 10:35:02 +01008500 if (operation->stage != PSA_PAKE_OPERATION_STAGE_SETUP) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008501 status = PSA_ERROR_BAD_STATE;
8502 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008503 }
8504
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01008505 if (PSA_ALG_IS_PAKE(cipher_suite->algorithm) == 0 ||
Przemek Stekiel51eac532022-12-07 11:04:51 +01008506 PSA_ALG_IS_HASH(cipher_suite->hash) == 0) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008507 status = PSA_ERROR_INVALID_ARGUMENT;
8508 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008509 }
8510
Przemek Stekiel51eac532022-12-07 11:04:51 +01008511 memset(&operation->data.inputs, 0, sizeof(operation->data.inputs));
8512
Przemek Stekiele12ed362022-12-21 12:54:46 +01008513 operation->alg = cipher_suite->algorithm;
Przemek Stekiel656b2592023-03-22 13:15:33 +01008514 operation->primitive = PSA_PAKE_PRIMITIVE(cipher_suite->type,
8515 cipher_suite->family, cipher_suite->bits);
Przemek Stekiel51eac532022-12-07 11:04:51 +01008516 operation->data.inputs.cipher_suite = *cipher_suite;
8517
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008518#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008519 if (operation->alg == PSA_ALG_JPAKE) {
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01008520 psa_jpake_computation_stage_t *computation_stage =
Przemek Stekieldde6a912023-01-26 08:46:37 +01008521 &operation->computation_stage.jpake;
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01008522
David Horstmann16f01512023-06-14 17:21:07 +01008523 memset(computation_stage, 0, sizeof(*computation_stage));
David Horstmanne7f21e62023-05-12 18:17:21 +01008524 computation_stage->step = PSA_PAKE_STEP_KEY_SHARE;
Przemek Stekiel80a88492023-02-20 13:32:22 +01008525 } else
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008526#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiel80a88492023-02-20 13:32:22 +01008527 {
8528 status = PSA_ERROR_NOT_SUPPORTED;
8529 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008530 }
8531
Przemek Stekiel1c3cfb42023-01-26 10:35:02 +01008532 operation->stage = PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS;
8533
Przemek Stekiel51eac532022-12-07 11:04:51 +01008534 return PSA_SUCCESS;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008535exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008536 psa_pake_abort(operation);
8537 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008538}
8539
8540psa_status_t psa_pake_set_password_key(
8541 psa_pake_operation_t *operation,
8542 mbedtls_svc_key_id_t password)
8543{
Neil Armstrong5ae60962022-09-15 11:29:46 +02008544 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel6c764412022-11-22 14:05:12 +01008545 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
8546 psa_key_slot_t *slot = NULL;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01008547 psa_key_type_t type;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008548
Przemek Stekiel51eac532022-12-07 11:04:51 +01008549 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008550 status = PSA_ERROR_BAD_STATE;
8551 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008552 }
8553
Przemek Stekiel6c764412022-11-22 14:05:12 +01008554 status = psa_get_and_lock_key_slot_with_policy(password, &slot,
8555 PSA_KEY_USAGE_DERIVE,
Przemek Stekield5d28a22023-01-26 10:46:05 +01008556 operation->alg);
Neil Armstrong5ae60962022-09-15 11:29:46 +02008557 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008558 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008559 }
8560
Gilles Peskine7a5d9202024-02-28 01:18:23 +01008561 type = psa_get_key_type(&slot->attr);
Neil Armstrong5ae60962022-09-15 11:29:46 +02008562
Przemek Stekiel51eac532022-12-07 11:04:51 +01008563 if (type != PSA_KEY_TYPE_PASSWORD &&
8564 type != PSA_KEY_TYPE_PASSWORD_HASH) {
8565 status = PSA_ERROR_INVALID_ARGUMENT;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008566 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008567 }
8568
Przemek Stekiel51eac532022-12-07 11:04:51 +01008569 operation->data.inputs.password = mbedtls_calloc(1, slot->key.bytes);
8570 if (operation->data.inputs.password == NULL) {
Przemek Stekiele12ed362022-12-21 12:54:46 +01008571 status = PSA_ERROR_INSUFFICIENT_MEMORY;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008572 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008573 }
8574
8575 memcpy(operation->data.inputs.password, slot->key.data, slot->key.bytes);
8576 operation->data.inputs.password_len = slot->key.bytes;
Gilles Peskine7fad3ef2024-02-28 01:08:27 +01008577 operation->data.inputs.attributes = slot->attr;
8578
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008579exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008580 if (status != PSA_SUCCESS) {
8581 psa_pake_abort(operation);
8582 }
Ryan Everettbbedfce2024-02-14 18:22:09 +00008583 unlock_status = psa_unregister_read_under_mutex(slot);
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008584 return (status == PSA_SUCCESS) ? unlock_status : status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008585}
8586
8587psa_status_t psa_pake_set_user(
8588 psa_pake_operation_t *operation,
David Horstmann4f534ae2024-01-22 17:35:59 +00008589 const uint8_t *user_id_external,
Neil Armstronga7d08c32022-06-01 18:21:20 +02008590 size_t user_id_len)
8591{
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008592 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
David Horstmann4f534ae2024-01-22 17:35:59 +00008593 LOCAL_INPUT_DECLARE(user_id_external, user_id);
Przemek Stekiel51eac532022-12-07 11:04:51 +01008594
8595 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008596 status = PSA_ERROR_BAD_STATE;
8597 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008598 }
8599
Przemek Stekiel51eac532022-12-07 11:04:51 +01008600 if (user_id_len == 0) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008601 status = PSA_ERROR_INVALID_ARGUMENT;
8602 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008603 }
8604
Przemek Stekielf309d6b2023-03-10 09:54:45 +01008605 if (operation->data.inputs.user_len != 0) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01008606 status = PSA_ERROR_BAD_STATE;
8607 goto exit;
8608 }
8609
Przemek Stekielf309d6b2023-03-10 09:54:45 +01008610 operation->data.inputs.user = mbedtls_calloc(1, user_id_len);
8611 if (operation->data.inputs.user == NULL) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01008612 status = PSA_ERROR_INSUFFICIENT_MEMORY;
8613 goto exit;
8614 }
8615
David Horstmann4f534ae2024-01-22 17:35:59 +00008616 LOCAL_INPUT_ALLOC(user_id_external, user_id_len, user_id);
8617
Przemek Stekielf309d6b2023-03-10 09:54:45 +01008618 memcpy(operation->data.inputs.user, user_id, user_id_len);
8619 operation->data.inputs.user_len = user_id_len;
Przemek Stekiel26c909d2023-02-28 12:34:03 +01008620
David Horstmann4f534ae2024-01-22 17:35:59 +00008621 status = PSA_SUCCESS;
8622
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008623exit:
David Horstmann4f534ae2024-01-22 17:35:59 +00008624 LOCAL_INPUT_FREE(user_id_external, user_id);
8625 if (status != PSA_SUCCESS) {
8626 psa_pake_abort(operation);
8627 }
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008628 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008629}
8630
8631psa_status_t psa_pake_set_peer(
8632 psa_pake_operation_t *operation,
David Horstmann4f534ae2024-01-22 17:35:59 +00008633 const uint8_t *peer_id_external,
Neil Armstronga7d08c32022-06-01 18:21:20 +02008634 size_t peer_id_len)
8635{
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008636 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
David Horstmann4f534ae2024-01-22 17:35:59 +00008637 LOCAL_INPUT_DECLARE(peer_id_external, peer_id);
Przemek Stekiel51eac532022-12-07 11:04:51 +01008638
8639 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008640 status = PSA_ERROR_BAD_STATE;
8641 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008642 }
8643
Przemek Stekiel51eac532022-12-07 11:04:51 +01008644 if (peer_id_len == 0) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008645 status = PSA_ERROR_INVALID_ARGUMENT;
8646 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008647 }
8648
Przemek Stekielf309d6b2023-03-10 09:54:45 +01008649 if (operation->data.inputs.peer_len != 0) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01008650 status = PSA_ERROR_BAD_STATE;
8651 goto exit;
8652 }
8653
Przemek Stekielf309d6b2023-03-10 09:54:45 +01008654 operation->data.inputs.peer = mbedtls_calloc(1, peer_id_len);
8655 if (operation->data.inputs.peer == NULL) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01008656 status = PSA_ERROR_INSUFFICIENT_MEMORY;
8657 goto exit;
8658 }
8659
David Horstmann4f534ae2024-01-22 17:35:59 +00008660 LOCAL_INPUT_ALLOC(peer_id_external, peer_id_len, peer_id);
8661
Przemek Stekielf309d6b2023-03-10 09:54:45 +01008662 memcpy(operation->data.inputs.peer, peer_id, peer_id_len);
8663 operation->data.inputs.peer_len = peer_id_len;
Przemek Stekiel26c909d2023-02-28 12:34:03 +01008664
David Horstmann4f534ae2024-01-22 17:35:59 +00008665 status = PSA_SUCCESS;
8666
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008667exit:
David Horstmann4f534ae2024-01-22 17:35:59 +00008668 LOCAL_INPUT_FREE(peer_id_external, peer_id);
8669 if (status != PSA_SUCCESS) {
8670 psa_pake_abort(operation);
8671 }
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008672 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008673}
8674
8675psa_status_t psa_pake_set_role(
8676 psa_pake_operation_t *operation,
8677 psa_pake_role_t role)
8678{
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008679 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008680
Przemek Stekiel51eac532022-12-07 11:04:51 +01008681 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01008682 status = PSA_ERROR_BAD_STATE;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008683 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008684 }
8685
Przemek Stekiel09104b82023-03-06 14:11:51 +01008686 switch (operation->alg) {
8687#if defined(PSA_WANT_ALG_JPAKE)
8688 case PSA_ALG_JPAKE:
8689 if (role == PSA_PAKE_ROLE_NONE) {
8690 return PSA_SUCCESS;
8691 }
8692 status = PSA_ERROR_INVALID_ARGUMENT;
8693 break;
8694#endif
8695 default:
8696 (void) role;
8697 status = PSA_ERROR_NOT_SUPPORTED;
8698 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008699 }
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008700exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008701 psa_pake_abort(operation);
8702 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008703}
8704
David Horstmanne7f21e62023-05-12 18:17:21 +01008705/* Auxiliary function to convert core computation stage to single driver step. */
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008706#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiel251e86a2023-02-17 14:30:50 +01008707static psa_crypto_driver_pake_step_t convert_jpake_computation_stage_to_driver_step(
Przemek Stekieldde6a912023-01-26 08:46:37 +01008708 psa_jpake_computation_stage_t *stage)
Przemek Stekielb09c4872023-01-17 12:05:38 +01008709{
David Horstmann74a3d8c2023-06-14 18:28:19 +01008710 psa_crypto_driver_pake_step_t key_share_step;
David Horstmann5da95602023-06-08 15:37:12 +01008711 if (stage->round == PSA_JPAKE_FIRST) {
David Horstmanne7f21e62023-05-12 18:17:21 +01008712 int is_x1;
David Horstmann74a3d8c2023-06-14 18:28:19 +01008713
David Horstmann024e5c52023-06-14 15:48:21 +01008714 if (stage->io_mode == PSA_JPAKE_OUTPUT) {
David Horstmanne7f21e62023-05-12 18:17:21 +01008715 is_x1 = (stage->outputs < 1);
8716 } else {
8717 is_x1 = (stage->inputs < 1);
8718 }
8719
David Horstmann74a3d8c2023-06-14 18:28:19 +01008720 key_share_step = is_x1 ?
8721 PSA_JPAKE_X1_STEP_KEY_SHARE :
8722 PSA_JPAKE_X2_STEP_KEY_SHARE;
David Horstmann5da95602023-06-08 15:37:12 +01008723 } else if (stage->round == PSA_JPAKE_SECOND) {
David Horstmann74a3d8c2023-06-14 18:28:19 +01008724 key_share_step = (stage->io_mode == PSA_JPAKE_OUTPUT) ?
8725 PSA_JPAKE_X2S_STEP_KEY_SHARE :
8726 PSA_JPAKE_X4S_STEP_KEY_SHARE;
8727 } else {
8728 return PSA_JPAKE_STEP_INVALID;
Przemek Stekielb09c4872023-01-17 12:05:38 +01008729 }
Agathiyan Bragadeesh387bfa52023-07-17 17:01:33 +01008730 return (psa_crypto_driver_pake_step_t) (key_share_step + stage->step - PSA_PAKE_STEP_KEY_SHARE);
Przemek Stekielb09c4872023-01-17 12:05:38 +01008731}
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008732#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekielb09c4872023-01-17 12:05:38 +01008733
Przemek Stekiel2797d372022-12-22 11:19:22 +01008734static psa_status_t psa_pake_complete_inputs(
8735 psa_pake_operation_t *operation)
8736{
Przemek Stekiel2797d372022-12-22 11:19:22 +01008737 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel18620a32023-01-17 16:34:52 +01008738 /* Create copy of the inputs on stack as inputs share memory
8739 with the driver context which will be setup by the driver. */
8740 psa_crypto_driver_pake_inputs_t inputs = operation->data.inputs;
Przemek Stekiel2797d372022-12-22 11:19:22 +01008741
Przemek Stekielfde11282023-03-13 16:06:09 +01008742 if (inputs.password_len == 0) {
Przemek Stekiel2797d372022-12-22 11:19:22 +01008743 return PSA_ERROR_BAD_STATE;
8744 }
8745
Przemek Stekiel26c909d2023-02-28 12:34:03 +01008746 if (operation->alg == PSA_ALG_JPAKE) {
Przemek Stekielfde11282023-03-13 16:06:09 +01008747 if (inputs.user_len == 0 || inputs.peer_len == 0) {
8748 return PSA_ERROR_BAD_STATE;
8749 }
Przemek Stekieldff21d32023-02-14 20:09:10 +01008750 }
8751
Przemek Stekiel18620a32023-01-17 16:34:52 +01008752 /* Clear driver context */
8753 mbedtls_platform_zeroize(&operation->data, sizeof(operation->data));
8754
8755 status = psa_driver_wrapper_pake_setup(operation, &inputs);
Przemek Stekiel2797d372022-12-22 11:19:22 +01008756
8757 /* Driver is responsible for creating its own copy of the password. */
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01008758 mbedtls_zeroize_and_free(inputs.password, inputs.password_len);
Przemek Stekiel2797d372022-12-22 11:19:22 +01008759
Przemek Stekiel26c909d2023-02-28 12:34:03 +01008760 /* User and peer are translated to role. */
8761 mbedtls_free(inputs.user);
8762 mbedtls_free(inputs.peer);
8763
Przemek Stekiel2797d372022-12-22 11:19:22 +01008764 if (status == PSA_SUCCESS) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008765#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiel2797d372022-12-22 11:19:22 +01008766 if (operation->alg == PSA_ALG_JPAKE) {
Przemek Stekield93de322023-02-24 08:39:04 +01008767 operation->stage = PSA_PAKE_OPERATION_STAGE_COMPUTATION;
Przemek Stekiel80a88492023-02-20 13:32:22 +01008768 } else
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008769#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiel80a88492023-02-20 13:32:22 +01008770 {
8771 status = PSA_ERROR_NOT_SUPPORTED;
Przemek Stekiel2797d372022-12-22 11:19:22 +01008772 }
Przemek Stekiel2797d372022-12-22 11:19:22 +01008773 }
Przemek Stekiel2797d372022-12-22 11:19:22 +01008774 return status;
8775}
8776
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008777#if defined(PSA_WANT_ALG_JPAKE)
David Horstmanne7f21e62023-05-12 18:17:21 +01008778static psa_status_t psa_jpake_prologue(
Przemek Stekiele12ed362022-12-21 12:54:46 +01008779 psa_pake_operation_t *operation,
David Horstmanne7f21e62023-05-12 18:17:21 +01008780 psa_pake_step_t step,
David Horstmann00ad6bf2023-06-14 15:44:24 +01008781 psa_jpake_io_mode_t io_mode)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008782{
Przemek Stekiele12ed362022-12-21 12:54:46 +01008783 if (step != PSA_PAKE_STEP_KEY_SHARE &&
8784 step != PSA_PAKE_STEP_ZK_PUBLIC &&
8785 step != PSA_PAKE_STEP_ZK_PROOF) {
8786 return PSA_ERROR_INVALID_ARGUMENT;
8787 }
8788
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008789 psa_jpake_computation_stage_t *computation_stage =
8790 &operation->computation_stage.jpake;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008791
David Horstmann5da95602023-06-08 15:37:12 +01008792 if (computation_stage->round != PSA_JPAKE_FIRST &&
8793 computation_stage->round != PSA_JPAKE_SECOND) {
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008794 return PSA_ERROR_BAD_STATE;
8795 }
8796
David Horstmanne7f21e62023-05-12 18:17:21 +01008797 /* Check that the step we are given is the one we were expecting */
8798 if (step != computation_stage->step) {
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008799 return PSA_ERROR_BAD_STATE;
8800 }
8801
David Horstmanne7f21e62023-05-12 18:17:21 +01008802 if (step == PSA_PAKE_STEP_KEY_SHARE &&
8803 computation_stage->inputs == 0 &&
8804 computation_stage->outputs == 0) {
8805 /* Start of the round, so function decides whether we are inputting
8806 * or outputting */
David Horstmann024e5c52023-06-14 15:48:21 +01008807 computation_stage->io_mode = io_mode;
8808 } else if (computation_stage->io_mode != io_mode) {
David Horstmanne7f21e62023-05-12 18:17:21 +01008809 /* Middle of the round so the mode we are in must match the function
8810 * called by the user */
8811 return PSA_ERROR_BAD_STATE;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008812 }
8813
8814 return PSA_SUCCESS;
8815}
8816
David Horstmanne7f21e62023-05-12 18:17:21 +01008817static psa_status_t psa_jpake_epilogue(
8818 psa_pake_operation_t *operation,
David Horstmann00ad6bf2023-06-14 15:44:24 +01008819 psa_jpake_io_mode_t io_mode)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008820{
David Horstmanne7f21e62023-05-12 18:17:21 +01008821 psa_jpake_computation_stage_t *stage =
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008822 &operation->computation_stage.jpake;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008823
David Horstmanne7f21e62023-05-12 18:17:21 +01008824 if (stage->step == PSA_PAKE_STEP_ZK_PROOF) {
8825 /* End of an input/output */
David Horstmann00ad6bf2023-06-14 15:44:24 +01008826 if (io_mode == PSA_JPAKE_INPUT) {
David Horstmanne7f21e62023-05-12 18:17:21 +01008827 stage->inputs++;
David Horstmann246ec5a2023-06-27 10:33:06 +01008828 if (stage->inputs == PSA_JPAKE_EXPECTED_INPUTS(stage->round)) {
David Horstmann024e5c52023-06-14 15:48:21 +01008829 stage->io_mode = PSA_JPAKE_OUTPUT;
David Horstmanne7f21e62023-05-12 18:17:21 +01008830 }
8831 }
David Horstmann00ad6bf2023-06-14 15:44:24 +01008832 if (io_mode == PSA_JPAKE_OUTPUT) {
David Horstmanne7f21e62023-05-12 18:17:21 +01008833 stage->outputs++;
David Horstmann246ec5a2023-06-27 10:33:06 +01008834 if (stage->outputs == PSA_JPAKE_EXPECTED_OUTPUTS(stage->round)) {
David Horstmann024e5c52023-06-14 15:48:21 +01008835 stage->io_mode = PSA_JPAKE_INPUT;
David Horstmanne7f21e62023-05-12 18:17:21 +01008836 }
8837 }
David Horstmann246ec5a2023-06-27 10:33:06 +01008838 if (stage->inputs == PSA_JPAKE_EXPECTED_INPUTS(stage->round) &&
8839 stage->outputs == PSA_JPAKE_EXPECTED_OUTPUTS(stage->round)) {
David Horstmanne7f21e62023-05-12 18:17:21 +01008840 /* End of a round, move to the next round */
8841 stage->inputs = 0;
8842 stage->outputs = 0;
8843 stage->round++;
8844 }
8845 stage->step = PSA_PAKE_STEP_KEY_SHARE;
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008846 } else {
David Horstmanne7f21e62023-05-12 18:17:21 +01008847 stage->step++;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008848 }
Przemek Stekiele12ed362022-12-21 12:54:46 +01008849 return PSA_SUCCESS;
8850}
David Horstmanne7f21e62023-05-12 18:17:21 +01008851
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008852#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008853
Neil Armstronga7d08c32022-06-01 18:21:20 +02008854psa_status_t psa_pake_output(
8855 psa_pake_operation_t *operation,
8856 psa_pake_step_t step,
David Horstmannc75639d2024-01-22 17:56:39 +00008857 uint8_t *output_external,
Neil Armstronga7d08c32022-06-01 18:21:20 +02008858 size_t output_size,
8859 size_t *output_length)
8860{
Przemek Stekiel51eac532022-12-07 11:04:51 +01008861 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008862 psa_crypto_driver_pake_step_t driver_step = PSA_JPAKE_STEP_INVALID;
David Horstmannc75639d2024-01-22 17:56:39 +00008863 LOCAL_OUTPUT_DECLARE(output_external, output);
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01008864 *output_length = 0;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008865
8866 if (operation->stage == PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel2797d372022-12-22 11:19:22 +01008867 status = psa_pake_complete_inputs(operation);
8868 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008869 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008870 }
8871 }
8872
8873 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COMPUTATION) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008874 status = PSA_ERROR_BAD_STATE;
8875 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008876 }
8877
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01008878 if (output_size == 0) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008879 status = PSA_ERROR_INVALID_ARGUMENT;
8880 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008881 }
8882
Przemek Stekiele12ed362022-12-21 12:54:46 +01008883 switch (operation->alg) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008884#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008885 case PSA_ALG_JPAKE:
David Horstmann5da95602023-06-08 15:37:12 +01008886 status = psa_jpake_prologue(operation, step, PSA_JPAKE_OUTPUT);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008887 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008888 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008889 }
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008890 driver_step = convert_jpake_computation_stage_to_driver_step(
8891 &operation->computation_stage.jpake);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008892 break;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008893#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008894 default:
Przemek Stekiel80a88492023-02-20 13:32:22 +01008895 (void) step;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008896 status = PSA_ERROR_NOT_SUPPORTED;
8897 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008898 }
8899
David Horstmannc75639d2024-01-22 17:56:39 +00008900 LOCAL_OUTPUT_ALLOC(output_external, output_size, output);
8901
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008902 status = psa_driver_wrapper_pake_output(operation, driver_step,
8903 output, output_size, output_length);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008904
8905 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008906 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008907 }
8908
8909 switch (operation->alg) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008910#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008911 case PSA_ALG_JPAKE:
David Horstmann5da95602023-06-08 15:37:12 +01008912 status = psa_jpake_epilogue(operation, PSA_JPAKE_OUTPUT);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008913 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008914 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008915 }
8916 break;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008917#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008918 default:
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008919 status = PSA_ERROR_NOT_SUPPORTED;
8920 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008921 }
8922
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008923exit:
David Horstmannc75639d2024-01-22 17:56:39 +00008924 LOCAL_OUTPUT_FREE(output_external, output);
8925 if (status != PSA_SUCCESS) {
8926 psa_pake_abort(operation);
8927 }
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008928 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008929}
8930
8931psa_status_t psa_pake_input(
8932 psa_pake_operation_t *operation,
8933 psa_pake_step_t step,
David Horstmannc75639d2024-01-22 17:56:39 +00008934 const uint8_t *input_external,
Neil Armstronga7d08c32022-06-01 18:21:20 +02008935 size_t input_length)
8936{
Przemek Stekiel51eac532022-12-07 11:04:51 +01008937 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008938 psa_crypto_driver_pake_step_t driver_step = PSA_JPAKE_STEP_INVALID;
Przemek Stekiel256c75d2023-03-23 14:09:34 +01008939 const size_t max_input_length = (size_t) PSA_PAKE_INPUT_SIZE(operation->alg,
8940 operation->primitive,
8941 step);
David Horstmannc75639d2024-01-22 17:56:39 +00008942 LOCAL_INPUT_DECLARE(input_external, input);
Przemek Stekiel51eac532022-12-07 11:04:51 +01008943
8944 if (operation->stage == PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel2797d372022-12-22 11:19:22 +01008945 status = psa_pake_complete_inputs(operation);
8946 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008947 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008948 }
8949 }
8950
8951 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COMPUTATION) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008952 status = PSA_ERROR_BAD_STATE;
8953 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008954 }
8955
Przemek Stekiel256c75d2023-03-23 14:09:34 +01008956 if (input_length == 0 || input_length > max_input_length) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008957 status = PSA_ERROR_INVALID_ARGUMENT;
8958 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008959 }
8960
Przemek Stekiele12ed362022-12-21 12:54:46 +01008961 switch (operation->alg) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008962#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008963 case PSA_ALG_JPAKE:
David Horstmann5da95602023-06-08 15:37:12 +01008964 status = psa_jpake_prologue(operation, step, PSA_JPAKE_INPUT);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008965 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008966 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008967 }
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008968 driver_step = convert_jpake_computation_stage_to_driver_step(
8969 &operation->computation_stage.jpake);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008970 break;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008971#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008972 default:
Przemek Stekiel80a88492023-02-20 13:32:22 +01008973 (void) step;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008974 status = PSA_ERROR_NOT_SUPPORTED;
8975 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008976 }
8977
David Horstmannc75639d2024-01-22 17:56:39 +00008978 LOCAL_INPUT_ALLOC(input_external, input_length, input);
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008979 status = psa_driver_wrapper_pake_input(operation, driver_step,
8980 input, input_length);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008981
8982 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008983 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008984 }
8985
8986 switch (operation->alg) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008987#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008988 case PSA_ALG_JPAKE:
David Horstmann5da95602023-06-08 15:37:12 +01008989 status = psa_jpake_epilogue(operation, PSA_JPAKE_INPUT);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008990 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008991 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008992 }
8993 break;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008994#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008995 default:
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008996 status = PSA_ERROR_NOT_SUPPORTED;
8997 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008998 }
8999
Przemek Stekiel3e784d82023-02-08 09:12:42 +01009000exit:
David Horstmannc75639d2024-01-22 17:56:39 +00009001 LOCAL_INPUT_FREE(input_external, input);
9002 if (status != PSA_SUCCESS) {
9003 psa_pake_abort(operation);
9004 }
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01009005 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02009006}
9007
9008psa_status_t psa_pake_get_implicit_key(
9009 psa_pake_operation_t *operation,
9010 psa_key_derivation_operation_t *output)
9011{
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01009012 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01009013 psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel251e86a2023-02-17 14:30:50 +01009014 uint8_t shared_key[MBEDTLS_PSA_JPAKE_BUFFER_SIZE];
Przemek Stekiel0c781802022-11-29 14:53:13 +01009015 size_t shared_key_len = 0;
9016
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01009017 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COMPUTATION) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01009018 status = PSA_ERROR_BAD_STATE;
9019 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02009020 }
9021
Przemek Stekiel4aa99402023-02-27 13:00:57 +01009022#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01009023 if (operation->alg == PSA_ALG_JPAKE) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01009024 psa_jpake_computation_stage_t *computation_stage =
Przemek Stekiel083745e2023-02-23 17:28:23 +01009025 &operation->computation_stage.jpake;
David Horstmann5da95602023-06-08 15:37:12 +01009026 if (computation_stage->round != PSA_JPAKE_FINISHED) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01009027 status = PSA_ERROR_BAD_STATE;
9028 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01009029 }
Przemek Stekiel80a88492023-02-20 13:32:22 +01009030 } else
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01009031#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiel80a88492023-02-20 13:32:22 +01009032 {
9033 status = PSA_ERROR_NOT_SUPPORTED;
9034 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01009035 }
9036
Przemek Stekiel0c781802022-11-29 14:53:13 +01009037 status = psa_driver_wrapper_pake_get_implicit_key(operation,
9038 shared_key,
Przemek Stekiel6b648622023-02-19 22:55:33 +01009039 sizeof(shared_key),
Przemek Stekiel0c781802022-11-29 14:53:13 +01009040 &shared_key_len);
9041
9042 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01009043 goto exit;
Przemek Stekiel0c781802022-11-29 14:53:13 +01009044 }
9045
9046 status = psa_key_derivation_input_bytes(output,
9047 PSA_KEY_DERIVATION_INPUT_SECRET,
9048 shared_key,
9049 shared_key_len);
9050
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01009051 mbedtls_platform_zeroize(shared_key, sizeof(shared_key));
Przemek Stekiel3e784d82023-02-08 09:12:42 +01009052exit:
9053 abort_status = psa_pake_abort(operation);
9054 return status == PSA_SUCCESS ? abort_status : status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02009055}
9056
9057psa_status_t psa_pake_abort(
9058 psa_pake_operation_t *operation)
9059{
Przemek Stekield69dca92023-01-31 19:59:20 +01009060 psa_status_t status = PSA_SUCCESS;
Przemek Stekiele12ed362022-12-21 12:54:46 +01009061
Przemek Stekield69dca92023-01-31 19:59:20 +01009062 if (operation->stage == PSA_PAKE_OPERATION_STAGE_COMPUTATION) {
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01009063 status = psa_driver_wrapper_pake_abort(operation);
Neil Armstrong5ae60962022-09-15 11:29:46 +02009064 }
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01009065
Przemek Stekiel26c909d2023-02-28 12:34:03 +01009066 if (operation->stage == PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
9067 if (operation->data.inputs.password != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01009068 mbedtls_zeroize_and_free(operation->data.inputs.password,
Przemek Stekielaa183422023-03-06 14:21:44 +01009069 operation->data.inputs.password_len);
Przemek Stekiel26c909d2023-02-28 12:34:03 +01009070 }
9071 if (operation->data.inputs.user != NULL) {
9072 mbedtls_free(operation->data.inputs.user);
9073 }
9074 if (operation->data.inputs.peer != NULL) {
9075 mbedtls_free(operation->data.inputs.peer);
9076 }
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01009077 }
Przemek Stekield69dca92023-01-31 19:59:20 +01009078 memset(operation, 0, sizeof(psa_pake_operation_t));
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01009079
Przemek Stekield69dca92023-01-31 19:59:20 +01009080 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02009081}
Tom Cosgrove6d62fac2023-05-10 14:40:05 +01009082#endif /* PSA_WANT_ALG_SOME_PAKE */
Neil Armstronga7d08c32022-06-01 18:21:20 +02009083
David Horstmann00d7a042023-12-07 18:39:17 +00009084/* Memory copying test hooks. These are called before input copy, after input
9085 * copy, before output copy and after output copy, respectively.
9086 * They are used by memory-poisoning tests to temporarily unpoison buffers
9087 * while they are copied. */
David Horstmanne138dce2023-11-28 15:21:56 +00009088#if defined(MBEDTLS_TEST_HOOKS)
9089void (*psa_input_pre_copy_hook)(const uint8_t *input, size_t input_len) = NULL;
9090void (*psa_input_post_copy_hook)(const uint8_t *input, size_t input_len) = NULL;
9091void (*psa_output_pre_copy_hook)(const uint8_t *output, size_t output_len) = NULL;
9092void (*psa_output_post_copy_hook)(const uint8_t *output, size_t output_len) = NULL;
9093#endif
David Horstmannfde97392023-10-30 20:29:43 +00009094
David Horstmann1b7279a2023-11-15 15:18:30 +00009095/** Copy from an input buffer to a local copy.
9096 *
9097 * \param[in] input Pointer to input buffer.
9098 * \param[in] input_len Length of the input buffer.
9099 * \param[out] input_copy Pointer to a local copy in which to store the input data.
9100 * \param[out] input_copy_len Length of the local copy buffer.
9101 * \return #PSA_SUCCESS, if the buffer was successfully
9102 * copied.
9103 * \return #PSA_ERROR_CORRUPTION_DETECTED, if the local
9104 * copy is too small to hold contents of the
9105 * input buffer.
9106 */
9107MBEDTLS_STATIC_TESTABLE
David Horstmannfde97392023-10-30 20:29:43 +00009108psa_status_t psa_crypto_copy_input(const uint8_t *input, size_t input_len,
9109 uint8_t *input_copy, size_t input_copy_len)
9110{
9111 if (input_len > input_copy_len) {
David Horstmann49a72762023-11-03 19:51:40 +00009112 return PSA_ERROR_CORRUPTION_DETECTED;
David Horstmannfde97392023-10-30 20:29:43 +00009113 }
9114
David Horstmann372b8bb2023-11-24 16:21:04 +00009115#if defined(MBEDTLS_TEST_HOOKS)
David Horstmanne138dce2023-11-28 15:21:56 +00009116 if (psa_input_pre_copy_hook != NULL) {
9117 psa_input_pre_copy_hook(input, input_len);
9118 }
David Horstmann372b8bb2023-11-24 16:21:04 +00009119#endif
9120
David Horstmann777e7412023-11-15 17:33:47 +00009121 if (input_len > 0) {
9122 memcpy(input_copy, input, input_len);
9123 }
David Horstmannfde97392023-10-30 20:29:43 +00009124
David Horstmann372b8bb2023-11-24 16:21:04 +00009125#if defined(MBEDTLS_TEST_HOOKS)
David Horstmanne138dce2023-11-28 15:21:56 +00009126 if (psa_input_post_copy_hook != NULL) {
9127 psa_input_post_copy_hook(input, input_len);
9128 }
David Horstmann372b8bb2023-11-24 16:21:04 +00009129#endif
9130
David Horstmannfde97392023-10-30 20:29:43 +00009131 return PSA_SUCCESS;
9132}
9133
David Horstmann1b7279a2023-11-15 15:18:30 +00009134/** Copy from a local output buffer into a user-supplied one.
9135 *
9136 * \param[in] output_copy Pointer to a local buffer containing the output.
9137 * \param[in] output_copy_len Length of the local buffer.
9138 * \param[out] output Pointer to user-supplied output buffer.
9139 * \param[out] output_len Length of the user-supplied output buffer.
9140 * \return #PSA_SUCCESS, if the buffer was successfully
9141 * copied.
David Horstmann671f5f52023-11-20 12:39:38 +00009142 * \return #PSA_ERROR_BUFFER_TOO_SMALL, if the
David Horstmann1b7279a2023-11-15 15:18:30 +00009143 * user-supplied output buffer is too small to
9144 * hold the contents of the local buffer.
9145 */
9146MBEDTLS_STATIC_TESTABLE
David Horstmann8978f5c2023-10-30 20:37:12 +00009147psa_status_t psa_crypto_copy_output(const uint8_t *output_copy, size_t output_copy_len,
9148 uint8_t *output, size_t output_len)
9149{
9150 if (output_len < output_copy_len) {
David Horstmann671f5f52023-11-20 12:39:38 +00009151 return PSA_ERROR_BUFFER_TOO_SMALL;
David Horstmann8978f5c2023-10-30 20:37:12 +00009152 }
David Horstmann777e7412023-11-15 17:33:47 +00009153
David Horstmann372b8bb2023-11-24 16:21:04 +00009154#if defined(MBEDTLS_TEST_HOOKS)
David Horstmanne138dce2023-11-28 15:21:56 +00009155 if (psa_output_pre_copy_hook != NULL) {
9156 psa_output_pre_copy_hook(output, output_len);
9157 }
David Horstmann372b8bb2023-11-24 16:21:04 +00009158#endif
9159
David Horstmann777e7412023-11-15 17:33:47 +00009160 if (output_copy_len > 0) {
9161 memcpy(output, output_copy, output_copy_len);
9162 }
9163
David Horstmann372b8bb2023-11-24 16:21:04 +00009164#if defined(MBEDTLS_TEST_HOOKS)
David Horstmanne138dce2023-11-28 15:21:56 +00009165 if (psa_output_post_copy_hook != NULL) {
9166 psa_output_post_copy_hook(output, output_len);
9167 }
David Horstmann372b8bb2023-11-24 16:21:04 +00009168#endif
9169
David Horstmann8978f5c2023-10-30 20:37:12 +00009170 return PSA_SUCCESS;
9171}
9172
David Horstmannf1734052023-11-20 17:15:32 +00009173psa_status_t psa_crypto_local_input_alloc(const uint8_t *input, size_t input_len,
9174 psa_crypto_local_input_t *local_input)
David Horstmann4ac78852023-11-07 16:36:48 +00009175{
9176 psa_status_t status;
9177
David Horstmann9db14482023-11-23 15:50:37 +00009178 *local_input = PSA_CRYPTO_LOCAL_INPUT_INIT;
David Horstmann4ac78852023-11-07 16:36:48 +00009179
David Horstmannc5cc1c32023-11-15 18:11:26 +00009180 if (input_len == 0) {
David Horstmann4ac78852023-11-07 16:36:48 +00009181 return PSA_SUCCESS;
9182 }
9183
David Horstmannf1734052023-11-20 17:15:32 +00009184 local_input->buffer = mbedtls_calloc(input_len, 1);
9185 if (local_input->buffer == NULL) {
David Horstmann4ac78852023-11-07 16:36:48 +00009186 /* Since we dealt with the zero-length case above, we know that
9187 * a NULL return value means a failure of allocation. */
9188 return PSA_ERROR_INSUFFICIENT_MEMORY;
9189 }
David Horstmannf1734052023-11-20 17:15:32 +00009190 /* From now on, we must free local_input->buffer on error. */
David Horstmann4ac78852023-11-07 16:36:48 +00009191
David Horstmannf1734052023-11-20 17:15:32 +00009192 local_input->length = input_len;
David Horstmann4ac78852023-11-07 16:36:48 +00009193
9194 status = psa_crypto_copy_input(input, input_len,
David Horstmannf1734052023-11-20 17:15:32 +00009195 local_input->buffer, local_input->length);
David Horstmann4ac78852023-11-07 16:36:48 +00009196 if (status != PSA_SUCCESS) {
9197 goto error;
9198 }
9199
9200 return PSA_SUCCESS;
9201
9202error:
David Horstmannf1734052023-11-20 17:15:32 +00009203 mbedtls_free(local_input->buffer);
9204 local_input->buffer = NULL;
9205 local_input->length = 0;
David Horstmann4ac78852023-11-07 16:36:48 +00009206 return status;
9207}
9208
David Horstmannf1734052023-11-20 17:15:32 +00009209void psa_crypto_local_input_free(psa_crypto_local_input_t *local_input)
David Horstmanne6042ff2023-11-07 18:00:41 +00009210{
David Horstmannf1734052023-11-20 17:15:32 +00009211 mbedtls_free(local_input->buffer);
9212 local_input->buffer = NULL;
9213 local_input->length = 0;
David Horstmanne6042ff2023-11-07 18:00:41 +00009214}
9215
David Horstmann89875a42023-11-20 12:54:09 +00009216psa_status_t psa_crypto_local_output_alloc(uint8_t *output, size_t output_len,
9217 psa_crypto_local_output_t *local_output)
David Horstmannba3c7d62023-11-08 15:19:43 +00009218{
David Horstmann9db14482023-11-23 15:50:37 +00009219 *local_output = PSA_CRYPTO_LOCAL_OUTPUT_INIT;
David Horstmannba3c7d62023-11-08 15:19:43 +00009220
David Horstmannc5cc1c32023-11-15 18:11:26 +00009221 if (output_len == 0) {
David Horstmannba3c7d62023-11-08 15:19:43 +00009222 return PSA_SUCCESS;
9223 }
David Horstmann89875a42023-11-20 12:54:09 +00009224 local_output->buffer = mbedtls_calloc(output_len, 1);
9225 if (local_output->buffer == NULL) {
David Horstmannba3c7d62023-11-08 15:19:43 +00009226 /* Since we dealt with the zero-length case above, we know that
9227 * a NULL return value means a failure of allocation. */
9228 return PSA_ERROR_INSUFFICIENT_MEMORY;
9229 }
David Horstmann89875a42023-11-20 12:54:09 +00009230 local_output->length = output_len;
9231 local_output->original = output;
David Horstmannba3c7d62023-11-08 15:19:43 +00009232
9233 return PSA_SUCCESS;
9234}
9235
David Horstmann89875a42023-11-20 12:54:09 +00009236psa_status_t psa_crypto_local_output_free(psa_crypto_local_output_t *local_output)
David Horstmann9467ea32023-11-08 17:44:18 +00009237{
David Horstmannc335a4e2023-11-15 15:57:32 +00009238 psa_status_t status;
9239
David Horstmann89875a42023-11-20 12:54:09 +00009240 if (local_output->buffer == NULL) {
9241 local_output->length = 0;
David Horstmann9467ea32023-11-08 17:44:18 +00009242 return PSA_SUCCESS;
9243 }
David Horstmann89875a42023-11-20 12:54:09 +00009244 if (local_output->original == NULL) {
David Horstmann9467ea32023-11-08 17:44:18 +00009245 /* We have an internal copy but nothing to copy back to. */
9246 return PSA_ERROR_CORRUPTION_DETECTED;
9247 }
9248
David Horstmann89875a42023-11-20 12:54:09 +00009249 status = psa_crypto_copy_output(local_output->buffer, local_output->length,
9250 local_output->original, local_output->length);
David Horstmannc335a4e2023-11-15 15:57:32 +00009251 if (status != PSA_SUCCESS) {
9252 return status;
9253 }
David Horstmann9467ea32023-11-08 17:44:18 +00009254
David Horstmann89875a42023-11-20 12:54:09 +00009255 mbedtls_free(local_output->buffer);
9256 local_output->buffer = NULL;
9257 local_output->length = 0;
David Horstmann9467ea32023-11-08 17:44:18 +00009258
9259 return PSA_SUCCESS;
9260}
9261
Gilles Peskinee59236f2018-01-27 23:32:46 +01009262#endif /* MBEDTLS_PSA_CRYPTO_C */