blob: d616c14f66b34a5acf1ce649581f211b70e166c3 [file] [log] [blame]
Gilles Peskinee59236f2018-01-27 23:32:46 +01001/*
2 * PSA crypto layer on top of Mbed TLS crypto
3 */
4/* Copyright (C) 2018, ARM Limited, All Rights Reserved
5 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 *
19 * This file is part of mbed TLS (https://tls.mbed.org)
20 */
21
22#if !defined(MBEDTLS_CONFIG_FILE)
23#include "mbedtls/config.h"
24#else
25#include MBEDTLS_CONFIG_FILE
26#endif
27
28#if defined(MBEDTLS_PSA_CRYPTO_C)
Mohammad Abo Mokha5c7b7d2018-07-04 15:57:00 +030029/*
30 * In case MBEDTLS_PSA_CRYPTO_SPM is defined the code is built for SPM (Secure
31 * Partition Manager) integration which separate the code into two parts
32 * NSPE (Non-Secure Process Environment) and SPE (Secure Process Environment).
33 * In this mode an additional header file should be included.
34 */
mohammad160327010052018-07-03 13:16:15 +030035#if defined(MBEDTLS_PSA_CRYPTO_SPM)
Mohammad Abo Mokha5c7b7d2018-07-04 15:57:00 +030036/*
37 * PSA_CRYPTO_SECURE means that this file is compiled to the SPE side.
38 * some headers will be affected by this flag.
39 */
mohammad160327010052018-07-03 13:16:15 +030040#define PSA_CRYPTO_SECURE 1
41#include "crypto_spe.h"
42#endif
43
Gilles Peskinee59236f2018-01-27 23:32:46 +010044#include "psa/crypto.h"
45
Gilles Peskine039b90c2018-12-07 18:24:41 +010046#include "psa_crypto_core.h"
Gilles Peskine5e769522018-11-20 21:59:56 +010047#include "psa_crypto_invasive.h"
Gilles Peskine961849f2018-11-30 18:54:54 +010048#include "psa_crypto_slot_management.h"
Darryl Greend49a4992018-06-18 17:27:26 +010049/* Include internal declarations that are useful for implementing persistently
50 * stored keys. */
51#include "psa_crypto_storage.h"
52
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010053#include <stdlib.h>
54#include <string.h>
55#if defined(MBEDTLS_PLATFORM_C)
56#include "mbedtls/platform.h"
57#else
58#define mbedtls_calloc calloc
59#define mbedtls_free free
60#endif
61
Gilles Peskinea5905292018-02-07 20:59:33 +010062#include "mbedtls/arc4.h"
Gilles Peskine9a944802018-06-21 09:35:35 +020063#include "mbedtls/asn1.h"
Gilles Peskinea81d85b2018-06-26 16:10:23 +020064#include "mbedtls/bignum.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010065#include "mbedtls/blowfish.h"
66#include "mbedtls/camellia.h"
67#include "mbedtls/cipher.h"
68#include "mbedtls/ccm.h"
69#include "mbedtls/cmac.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010070#include "mbedtls/ctr_drbg.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010071#include "mbedtls/des.h"
Gilles Peskineb7ecdf02018-09-18 12:11:27 +020072#include "mbedtls/ecdh.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010073#include "mbedtls/ecp.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010074#include "mbedtls/entropy.h"
Netanel Gonen2bcd3122018-11-19 11:53:02 +020075#include "mbedtls/entropy_poll.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010076#include "mbedtls/error.h"
77#include "mbedtls/gcm.h"
78#include "mbedtls/md2.h"
79#include "mbedtls/md4.h"
80#include "mbedtls/md5.h"
Gilles Peskine20035e32018-02-03 22:44:14 +010081#include "mbedtls/md.h"
82#include "mbedtls/md_internal.h"
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010083#include "mbedtls/pk.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010084#include "mbedtls/pk_internal.h"
Gilles Peskine3f108122018-12-07 18:14:53 +010085#include "mbedtls/platform_util.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010086#include "mbedtls/ripemd160.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010087#include "mbedtls/rsa.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010088#include "mbedtls/sha1.h"
89#include "mbedtls/sha256.h"
90#include "mbedtls/sha512.h"
91#include "mbedtls/xtea.h"
92
Netanel Gonen2bcd3122018-11-19 11:53:02 +020093#if ( defined(MBEDTLS_ENTROPY_NV_SEED) && defined(MBEDTLS_PSA_HAS_ITS_IO) )
94#include "psa_prot_internal_storage.h"
95#endif
Gilles Peskinee59236f2018-01-27 23:32:46 +010096
Gilles Peskine996deb12018-08-01 15:45:45 +020097#define ARRAY_LENGTH( array ) ( sizeof( array ) / sizeof( *( array ) ) )
98
Gilles Peskine9ef733f2018-02-07 21:05:37 +010099/* constant-time buffer comparison */
100static inline int safer_memcmp( const uint8_t *a, const uint8_t *b, size_t n )
101{
102 size_t i;
103 unsigned char diff = 0;
104
105 for( i = 0; i < n; i++ )
106 diff |= a[i] ^ b[i];
107
108 return( diff );
109}
110
111
112
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100113/****************************************************************/
114/* Global data, support functions and library management */
115/****************************************************************/
116
Gilles Peskine48c0ea12018-06-21 14:15:31 +0200117static int key_type_is_raw_bytes( psa_key_type_t type )
118{
Gilles Peskine78b3bb62018-08-10 16:03:41 +0200119 return( PSA_KEY_TYPE_IS_UNSTRUCTURED( type ) );
Gilles Peskine48c0ea12018-06-21 14:15:31 +0200120}
121
Gilles Peskine5a3c50e2018-12-04 12:27:09 +0100122/* Values for psa_global_data_t::rng_state */
123#define RNG_NOT_INITIALIZED 0
124#define RNG_INITIALIZED 1
125#define RNG_SEEDED 2
Gilles Peskinec6b69072018-11-20 21:42:52 +0100126
Gilles Peskine2d277862018-06-18 15:41:12 +0200127typedef struct
128{
Gilles Peskine5e769522018-11-20 21:59:56 +0100129 void (* entropy_init )( mbedtls_entropy_context *ctx );
130 void (* entropy_free )( mbedtls_entropy_context *ctx );
Gilles Peskinee59236f2018-01-27 23:32:46 +0100131 mbedtls_entropy_context entropy;
132 mbedtls_ctr_drbg_context ctr_drbg;
Gilles Peskinec6b69072018-11-20 21:42:52 +0100133 unsigned initialized : 1;
Gilles Peskine5a3c50e2018-12-04 12:27:09 +0100134 unsigned rng_state : 2;
Gilles Peskinee59236f2018-01-27 23:32:46 +0100135} psa_global_data_t;
136
137static psa_global_data_t global_data;
138
itayzafrir0adf0fc2018-09-06 16:24:41 +0300139#define GUARD_MODULE_INITIALIZED \
140 if( global_data.initialized == 0 ) \
141 return( PSA_ERROR_BAD_STATE );
142
Gilles Peskinee59236f2018-01-27 23:32:46 +0100143static psa_status_t mbedtls_to_psa_error( int ret )
144{
Gilles Peskinea5905292018-02-07 20:59:33 +0100145 /* If there's both a high-level code and low-level code, dispatch on
146 * the high-level code. */
147 switch( ret < -0x7f ? - ( -ret & 0x7f80 ) : ret )
Gilles Peskinee59236f2018-01-27 23:32:46 +0100148 {
149 case 0:
150 return( PSA_SUCCESS );
Gilles Peskinea5905292018-02-07 20:59:33 +0100151
152 case MBEDTLS_ERR_AES_INVALID_KEY_LENGTH:
153 case MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH:
154 case MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE:
155 return( PSA_ERROR_NOT_SUPPORTED );
156 case MBEDTLS_ERR_AES_HW_ACCEL_FAILED:
157 return( PSA_ERROR_HARDWARE_FAILURE );
158
159 case MBEDTLS_ERR_ARC4_HW_ACCEL_FAILED:
160 return( PSA_ERROR_HARDWARE_FAILURE );
161
Gilles Peskine9a944802018-06-21 09:35:35 +0200162 case MBEDTLS_ERR_ASN1_OUT_OF_DATA:
163 case MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:
164 case MBEDTLS_ERR_ASN1_INVALID_LENGTH:
165 case MBEDTLS_ERR_ASN1_LENGTH_MISMATCH:
166 case MBEDTLS_ERR_ASN1_INVALID_DATA:
167 return( PSA_ERROR_INVALID_ARGUMENT );
168 case MBEDTLS_ERR_ASN1_ALLOC_FAILED:
169 return( PSA_ERROR_INSUFFICIENT_MEMORY );
170 case MBEDTLS_ERR_ASN1_BUF_TOO_SMALL:
171 return( PSA_ERROR_BUFFER_TOO_SMALL );
172
Gilles Peskinea5905292018-02-07 20:59:33 +0100173 case MBEDTLS_ERR_BLOWFISH_INVALID_KEY_LENGTH:
174 case MBEDTLS_ERR_BLOWFISH_INVALID_INPUT_LENGTH:
175 return( PSA_ERROR_NOT_SUPPORTED );
176 case MBEDTLS_ERR_BLOWFISH_HW_ACCEL_FAILED:
177 return( PSA_ERROR_HARDWARE_FAILURE );
178
179 case MBEDTLS_ERR_CAMELLIA_INVALID_KEY_LENGTH:
180 case MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH:
181 return( PSA_ERROR_NOT_SUPPORTED );
182 case MBEDTLS_ERR_CAMELLIA_HW_ACCEL_FAILED:
183 return( PSA_ERROR_HARDWARE_FAILURE );
184
185 case MBEDTLS_ERR_CCM_BAD_INPUT:
186 return( PSA_ERROR_INVALID_ARGUMENT );
187 case MBEDTLS_ERR_CCM_AUTH_FAILED:
188 return( PSA_ERROR_INVALID_SIGNATURE );
189 case MBEDTLS_ERR_CCM_HW_ACCEL_FAILED:
190 return( PSA_ERROR_HARDWARE_FAILURE );
191
192 case MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE:
193 return( PSA_ERROR_NOT_SUPPORTED );
194 case MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA:
195 return( PSA_ERROR_INVALID_ARGUMENT );
196 case MBEDTLS_ERR_CIPHER_ALLOC_FAILED:
197 return( PSA_ERROR_INSUFFICIENT_MEMORY );
198 case MBEDTLS_ERR_CIPHER_INVALID_PADDING:
199 return( PSA_ERROR_INVALID_PADDING );
200 case MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED:
201 return( PSA_ERROR_BAD_STATE );
202 case MBEDTLS_ERR_CIPHER_AUTH_FAILED:
203 return( PSA_ERROR_INVALID_SIGNATURE );
204 case MBEDTLS_ERR_CIPHER_INVALID_CONTEXT:
205 return( PSA_ERROR_TAMPERING_DETECTED );
206 case MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED:
207 return( PSA_ERROR_HARDWARE_FAILURE );
208
209 case MBEDTLS_ERR_CMAC_HW_ACCEL_FAILED:
210 return( PSA_ERROR_HARDWARE_FAILURE );
211
212 case MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED:
213 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
214 case MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG:
215 case MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG:
216 return( PSA_ERROR_NOT_SUPPORTED );
217 case MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR:
218 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
219
220 case MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH:
221 return( PSA_ERROR_NOT_SUPPORTED );
222 case MBEDTLS_ERR_DES_HW_ACCEL_FAILED:
223 return( PSA_ERROR_HARDWARE_FAILURE );
224
Gilles Peskinee59236f2018-01-27 23:32:46 +0100225 case MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED:
226 case MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE:
227 case MBEDTLS_ERR_ENTROPY_SOURCE_FAILED:
228 return( PSA_ERROR_INSUFFICIENT_ENTROPY );
Gilles Peskinea5905292018-02-07 20:59:33 +0100229
230 case MBEDTLS_ERR_GCM_AUTH_FAILED:
231 return( PSA_ERROR_INVALID_SIGNATURE );
232 case MBEDTLS_ERR_GCM_BAD_INPUT:
Gilles Peskine8cac2e62018-08-21 15:07:38 +0200233 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskinea5905292018-02-07 20:59:33 +0100234 case MBEDTLS_ERR_GCM_HW_ACCEL_FAILED:
235 return( PSA_ERROR_HARDWARE_FAILURE );
236
237 case MBEDTLS_ERR_MD2_HW_ACCEL_FAILED:
238 case MBEDTLS_ERR_MD4_HW_ACCEL_FAILED:
239 case MBEDTLS_ERR_MD5_HW_ACCEL_FAILED:
240 return( PSA_ERROR_HARDWARE_FAILURE );
241
242 case MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE:
243 return( PSA_ERROR_NOT_SUPPORTED );
244 case MBEDTLS_ERR_MD_BAD_INPUT_DATA:
245 return( PSA_ERROR_INVALID_ARGUMENT );
246 case MBEDTLS_ERR_MD_ALLOC_FAILED:
247 return( PSA_ERROR_INSUFFICIENT_MEMORY );
248 case MBEDTLS_ERR_MD_FILE_IO_ERROR:
249 return( PSA_ERROR_STORAGE_FAILURE );
250 case MBEDTLS_ERR_MD_HW_ACCEL_FAILED:
251 return( PSA_ERROR_HARDWARE_FAILURE );
252
Gilles Peskinef76aa772018-10-29 19:24:33 +0100253 case MBEDTLS_ERR_MPI_FILE_IO_ERROR:
254 return( PSA_ERROR_STORAGE_FAILURE );
255 case MBEDTLS_ERR_MPI_BAD_INPUT_DATA:
256 return( PSA_ERROR_INVALID_ARGUMENT );
257 case MBEDTLS_ERR_MPI_INVALID_CHARACTER:
258 return( PSA_ERROR_INVALID_ARGUMENT );
259 case MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL:
260 return( PSA_ERROR_BUFFER_TOO_SMALL );
261 case MBEDTLS_ERR_MPI_NEGATIVE_VALUE:
262 return( PSA_ERROR_INVALID_ARGUMENT );
263 case MBEDTLS_ERR_MPI_DIVISION_BY_ZERO:
264 return( PSA_ERROR_INVALID_ARGUMENT );
265 case MBEDTLS_ERR_MPI_NOT_ACCEPTABLE:
266 return( PSA_ERROR_INVALID_ARGUMENT );
267 case MBEDTLS_ERR_MPI_ALLOC_FAILED:
268 return( PSA_ERROR_INSUFFICIENT_MEMORY );
269
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100270 case MBEDTLS_ERR_PK_ALLOC_FAILED:
271 return( PSA_ERROR_INSUFFICIENT_MEMORY );
272 case MBEDTLS_ERR_PK_TYPE_MISMATCH:
273 case MBEDTLS_ERR_PK_BAD_INPUT_DATA:
274 return( PSA_ERROR_INVALID_ARGUMENT );
275 case MBEDTLS_ERR_PK_FILE_IO_ERROR:
Gilles Peskinea5905292018-02-07 20:59:33 +0100276 return( PSA_ERROR_STORAGE_FAILURE );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100277 case MBEDTLS_ERR_PK_KEY_INVALID_VERSION:
278 case MBEDTLS_ERR_PK_KEY_INVALID_FORMAT:
279 return( PSA_ERROR_INVALID_ARGUMENT );
280 case MBEDTLS_ERR_PK_UNKNOWN_PK_ALG:
281 return( PSA_ERROR_NOT_SUPPORTED );
282 case MBEDTLS_ERR_PK_PASSWORD_REQUIRED:
283 case MBEDTLS_ERR_PK_PASSWORD_MISMATCH:
284 return( PSA_ERROR_NOT_PERMITTED );
285 case MBEDTLS_ERR_PK_INVALID_PUBKEY:
286 return( PSA_ERROR_INVALID_ARGUMENT );
287 case MBEDTLS_ERR_PK_INVALID_ALG:
288 case MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE:
289 case MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE:
290 return( PSA_ERROR_NOT_SUPPORTED );
291 case MBEDTLS_ERR_PK_SIG_LEN_MISMATCH:
292 return( PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskinea5905292018-02-07 20:59:33 +0100293 case MBEDTLS_ERR_PK_HW_ACCEL_FAILED:
294 return( PSA_ERROR_HARDWARE_FAILURE );
295
296 case MBEDTLS_ERR_RIPEMD160_HW_ACCEL_FAILED:
297 return( PSA_ERROR_HARDWARE_FAILURE );
298
299 case MBEDTLS_ERR_RSA_BAD_INPUT_DATA:
300 return( PSA_ERROR_INVALID_ARGUMENT );
301 case MBEDTLS_ERR_RSA_INVALID_PADDING:
302 return( PSA_ERROR_INVALID_PADDING );
303 case MBEDTLS_ERR_RSA_KEY_GEN_FAILED:
304 return( PSA_ERROR_HARDWARE_FAILURE );
305 case MBEDTLS_ERR_RSA_KEY_CHECK_FAILED:
306 return( PSA_ERROR_INVALID_ARGUMENT );
307 case MBEDTLS_ERR_RSA_PUBLIC_FAILED:
308 case MBEDTLS_ERR_RSA_PRIVATE_FAILED:
309 return( PSA_ERROR_TAMPERING_DETECTED );
310 case MBEDTLS_ERR_RSA_VERIFY_FAILED:
311 return( PSA_ERROR_INVALID_SIGNATURE );
312 case MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE:
313 return( PSA_ERROR_BUFFER_TOO_SMALL );
314 case MBEDTLS_ERR_RSA_RNG_FAILED:
315 return( PSA_ERROR_INSUFFICIENT_MEMORY );
316 case MBEDTLS_ERR_RSA_UNSUPPORTED_OPERATION:
317 return( PSA_ERROR_NOT_SUPPORTED );
318 case MBEDTLS_ERR_RSA_HW_ACCEL_FAILED:
319 return( PSA_ERROR_HARDWARE_FAILURE );
320
321 case MBEDTLS_ERR_SHA1_HW_ACCEL_FAILED:
322 case MBEDTLS_ERR_SHA256_HW_ACCEL_FAILED:
323 case MBEDTLS_ERR_SHA512_HW_ACCEL_FAILED:
324 return( PSA_ERROR_HARDWARE_FAILURE );
325
326 case MBEDTLS_ERR_XTEA_INVALID_INPUT_LENGTH:
327 return( PSA_ERROR_INVALID_ARGUMENT );
328 case MBEDTLS_ERR_XTEA_HW_ACCEL_FAILED:
329 return( PSA_ERROR_HARDWARE_FAILURE );
330
itayzafrir5c753392018-05-08 11:18:38 +0300331 case MBEDTLS_ERR_ECP_BAD_INPUT_DATA:
itayzafrir7b30f8b2018-05-09 16:07:36 +0300332 case MBEDTLS_ERR_ECP_INVALID_KEY:
itayzafrir5c753392018-05-08 11:18:38 +0300333 return( PSA_ERROR_INVALID_ARGUMENT );
itayzafrir7b30f8b2018-05-09 16:07:36 +0300334 case MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL:
335 return( PSA_ERROR_BUFFER_TOO_SMALL );
336 case MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE:
337 return( PSA_ERROR_NOT_SUPPORTED );
338 case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH:
339 case MBEDTLS_ERR_ECP_VERIFY_FAILED:
340 return( PSA_ERROR_INVALID_SIGNATURE );
341 case MBEDTLS_ERR_ECP_ALLOC_FAILED:
342 return( PSA_ERROR_INSUFFICIENT_MEMORY );
343 case MBEDTLS_ERR_ECP_HW_ACCEL_FAILED:
344 return( PSA_ERROR_HARDWARE_FAILURE );
itayzafrir5c753392018-05-08 11:18:38 +0300345
Gilles Peskinee59236f2018-01-27 23:32:46 +0100346 default:
347 return( PSA_ERROR_UNKNOWN_ERROR );
348 }
349}
350
Gilles Peskineb0b255c2018-07-06 17:01:38 +0200351
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +0200352
353
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100354/****************************************************************/
355/* Key management */
356/****************************************************************/
357
Darryl Green8f8aa8f2018-07-24 15:44:51 +0100358#if defined(MBEDTLS_ECP_C)
Gilles Peskine34ef7f52018-06-18 20:47:51 +0200359static psa_ecc_curve_t mbedtls_ecc_group_to_psa( mbedtls_ecp_group_id grpid )
360{
361 switch( grpid )
362 {
363 case MBEDTLS_ECP_DP_SECP192R1:
364 return( PSA_ECC_CURVE_SECP192R1 );
365 case MBEDTLS_ECP_DP_SECP224R1:
366 return( PSA_ECC_CURVE_SECP224R1 );
367 case MBEDTLS_ECP_DP_SECP256R1:
368 return( PSA_ECC_CURVE_SECP256R1 );
369 case MBEDTLS_ECP_DP_SECP384R1:
370 return( PSA_ECC_CURVE_SECP384R1 );
371 case MBEDTLS_ECP_DP_SECP521R1:
372 return( PSA_ECC_CURVE_SECP521R1 );
373 case MBEDTLS_ECP_DP_BP256R1:
374 return( PSA_ECC_CURVE_BRAINPOOL_P256R1 );
375 case MBEDTLS_ECP_DP_BP384R1:
376 return( PSA_ECC_CURVE_BRAINPOOL_P384R1 );
377 case MBEDTLS_ECP_DP_BP512R1:
378 return( PSA_ECC_CURVE_BRAINPOOL_P512R1 );
379 case MBEDTLS_ECP_DP_CURVE25519:
380 return( PSA_ECC_CURVE_CURVE25519 );
381 case MBEDTLS_ECP_DP_SECP192K1:
382 return( PSA_ECC_CURVE_SECP192K1 );
383 case MBEDTLS_ECP_DP_SECP224K1:
384 return( PSA_ECC_CURVE_SECP224K1 );
385 case MBEDTLS_ECP_DP_SECP256K1:
386 return( PSA_ECC_CURVE_SECP256K1 );
387 case MBEDTLS_ECP_DP_CURVE448:
388 return( PSA_ECC_CURVE_CURVE448 );
389 default:
390 return( 0 );
391 }
392}
393
Gilles Peskine12313cd2018-06-20 00:20:32 +0200394static mbedtls_ecp_group_id mbedtls_ecc_group_of_psa( psa_ecc_curve_t curve )
395{
396 switch( curve )
397 {
398 case PSA_ECC_CURVE_SECP192R1:
399 return( MBEDTLS_ECP_DP_SECP192R1 );
400 case PSA_ECC_CURVE_SECP224R1:
401 return( MBEDTLS_ECP_DP_SECP224R1 );
402 case PSA_ECC_CURVE_SECP256R1:
403 return( MBEDTLS_ECP_DP_SECP256R1 );
404 case PSA_ECC_CURVE_SECP384R1:
405 return( MBEDTLS_ECP_DP_SECP384R1 );
406 case PSA_ECC_CURVE_SECP521R1:
407 return( MBEDTLS_ECP_DP_SECP521R1 );
408 case PSA_ECC_CURVE_BRAINPOOL_P256R1:
409 return( MBEDTLS_ECP_DP_BP256R1 );
410 case PSA_ECC_CURVE_BRAINPOOL_P384R1:
411 return( MBEDTLS_ECP_DP_BP384R1 );
412 case PSA_ECC_CURVE_BRAINPOOL_P512R1:
413 return( MBEDTLS_ECP_DP_BP512R1 );
414 case PSA_ECC_CURVE_CURVE25519:
415 return( MBEDTLS_ECP_DP_CURVE25519 );
416 case PSA_ECC_CURVE_SECP192K1:
417 return( MBEDTLS_ECP_DP_SECP192K1 );
418 case PSA_ECC_CURVE_SECP224K1:
419 return( MBEDTLS_ECP_DP_SECP224K1 );
420 case PSA_ECC_CURVE_SECP256K1:
421 return( MBEDTLS_ECP_DP_SECP256K1 );
422 case PSA_ECC_CURVE_CURVE448:
423 return( MBEDTLS_ECP_DP_CURVE448 );
424 default:
425 return( MBEDTLS_ECP_DP_NONE );
426 }
427}
Darryl Green8f8aa8f2018-07-24 15:44:51 +0100428#endif /* defined(MBEDTLS_ECP_C) */
Gilles Peskine12313cd2018-06-20 00:20:32 +0200429
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200430static psa_status_t prepare_raw_data_slot( psa_key_type_t type,
431 size_t bits,
432 struct raw_data *raw )
433{
434 /* Check that the bit size is acceptable for the key type */
435 switch( type )
436 {
437 case PSA_KEY_TYPE_RAW_DATA:
Gilles Peskine46f1fd72018-06-28 19:31:31 +0200438 if( bits == 0 )
439 {
440 raw->bytes = 0;
441 raw->data = NULL;
442 return( PSA_SUCCESS );
443 }
444 break;
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200445#if defined(MBEDTLS_MD_C)
446 case PSA_KEY_TYPE_HMAC:
Gilles Peskine46f1fd72018-06-28 19:31:31 +0200447#endif
Gilles Peskineea0fb492018-07-12 17:17:20 +0200448 case PSA_KEY_TYPE_DERIVE:
449 break;
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200450#if defined(MBEDTLS_AES_C)
451 case PSA_KEY_TYPE_AES:
452 if( bits != 128 && bits != 192 && bits != 256 )
453 return( PSA_ERROR_INVALID_ARGUMENT );
454 break;
455#endif
456#if defined(MBEDTLS_CAMELLIA_C)
457 case PSA_KEY_TYPE_CAMELLIA:
458 if( bits != 128 && bits != 192 && bits != 256 )
459 return( PSA_ERROR_INVALID_ARGUMENT );
460 break;
461#endif
462#if defined(MBEDTLS_DES_C)
463 case PSA_KEY_TYPE_DES:
464 if( bits != 64 && bits != 128 && bits != 192 )
465 return( PSA_ERROR_INVALID_ARGUMENT );
466 break;
467#endif
468#if defined(MBEDTLS_ARC4_C)
469 case PSA_KEY_TYPE_ARC4:
470 if( bits < 8 || bits > 2048 )
471 return( PSA_ERROR_INVALID_ARGUMENT );
472 break;
473#endif
474 default:
475 return( PSA_ERROR_NOT_SUPPORTED );
476 }
Gilles Peskineb54979a2018-06-21 09:32:47 +0200477 if( bits % 8 != 0 )
478 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200479
480 /* Allocate memory for the key */
481 raw->bytes = PSA_BITS_TO_BYTES( bits );
482 raw->data = mbedtls_calloc( 1, raw->bytes );
483 if( raw->data == NULL )
484 {
485 raw->bytes = 0;
486 return( PSA_ERROR_INSUFFICIENT_MEMORY );
487 }
488 return( PSA_SUCCESS );
489}
490
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200491#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PK_PARSE_C)
Gilles Peskine86a440b2018-11-12 18:39:40 +0100492/* Mbed TLS doesn't support non-byte-aligned key sizes (i.e. key sizes
493 * that are not a multiple of 8) well. For example, there is only
494 * mbedtls_rsa_get_len(), which returns a number of bytes, and no
495 * way to return the exact bit size of a key.
496 * To keep things simple, reject non-byte-aligned key sizes. */
497static psa_status_t psa_check_rsa_key_byte_aligned(
498 const mbedtls_rsa_context *rsa )
499{
500 mbedtls_mpi n;
501 psa_status_t status;
502 mbedtls_mpi_init( &n );
503 status = mbedtls_to_psa_error(
504 mbedtls_rsa_export( rsa, &n, NULL, NULL, NULL, NULL ) );
505 if( status == PSA_SUCCESS )
506 {
507 if( mbedtls_mpi_bitlen( &n ) % 8 != 0 )
508 status = PSA_ERROR_NOT_SUPPORTED;
509 }
510 mbedtls_mpi_free( &n );
511 return( status );
512}
513
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200514static psa_status_t psa_import_rsa_key( mbedtls_pk_context *pk,
515 mbedtls_rsa_context **p_rsa )
516{
517 if( mbedtls_pk_get_type( pk ) != MBEDTLS_PK_RSA )
518 return( PSA_ERROR_INVALID_ARGUMENT );
519 else
520 {
521 mbedtls_rsa_context *rsa = mbedtls_pk_rsa( *pk );
Gilles Peskineaac64a22018-11-12 18:37:42 +0100522 /* The size of an RSA key doesn't have to be a multiple of 8.
523 * Mbed TLS supports non-byte-aligned key sizes, but not well.
524 * For example, mbedtls_rsa_get_len() returns the key size in
525 * bytes, not in bits. */
526 size_t bits = PSA_BYTES_TO_BITS( mbedtls_rsa_get_len( rsa ) );
Gilles Peskine86a440b2018-11-12 18:39:40 +0100527 psa_status_t status;
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200528 if( bits > PSA_VENDOR_RSA_MAX_KEY_BITS )
529 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine86a440b2018-11-12 18:39:40 +0100530 status = psa_check_rsa_key_byte_aligned( rsa );
531 if( status != PSA_SUCCESS )
532 return( status );
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200533 *p_rsa = rsa;
534 return( PSA_SUCCESS );
535 }
536}
537#endif /* defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PK_PARSE_C) */
538
539#if defined(MBEDTLS_ECP_C) && defined(MBEDTLS_PK_PARSE_C)
Gilles Peskinef76aa772018-10-29 19:24:33 +0100540/* Import an elliptic curve parsed by the mbedtls pk module. */
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200541static psa_status_t psa_import_ecp_key( psa_ecc_curve_t expected_curve,
542 mbedtls_pk_context *pk,
543 mbedtls_ecp_keypair **p_ecp )
544{
545 if( mbedtls_pk_get_type( pk ) != MBEDTLS_PK_ECKEY )
546 return( PSA_ERROR_INVALID_ARGUMENT );
547 else
548 {
549 mbedtls_ecp_keypair *ecp = mbedtls_pk_ec( *pk );
550 psa_ecc_curve_t actual_curve = mbedtls_ecc_group_to_psa( ecp->grp.id );
551 if( actual_curve != expected_curve )
552 return( PSA_ERROR_INVALID_ARGUMENT );
553 *p_ecp = ecp;
554 return( PSA_SUCCESS );
555 }
556}
557#endif /* defined(MBEDTLS_ECP_C) && defined(MBEDTLS_PK_PARSE_C) */
558
Gilles Peskinef76aa772018-10-29 19:24:33 +0100559#if defined(MBEDTLS_ECP_C)
560/* Import a private key given as a byte string which is the private value
561 * in big-endian order. */
562static psa_status_t psa_import_ec_private_key( psa_ecc_curve_t curve,
563 const uint8_t *data,
564 size_t data_length,
565 mbedtls_ecp_keypair **p_ecp )
566{
567 psa_status_t status = PSA_ERROR_TAMPERING_DETECTED;
568 mbedtls_ecp_keypair *ecp = NULL;
569 mbedtls_ecp_group_id grp_id = mbedtls_ecc_group_of_psa( curve );
570
571 *p_ecp = NULL;
572 ecp = mbedtls_calloc( 1, sizeof( mbedtls_ecp_keypair ) );
573 if( ecp == NULL )
574 return( PSA_ERROR_INSUFFICIENT_MEMORY );
575
576 /* Load the group. */
577 status = mbedtls_to_psa_error(
578 mbedtls_ecp_group_load( &ecp->grp, grp_id ) );
579 if( status != PSA_SUCCESS )
580 goto exit;
581 /* Load the secret value. */
582 status = mbedtls_to_psa_error(
583 mbedtls_mpi_read_binary( &ecp->d, data, data_length ) );
584 if( status != PSA_SUCCESS )
585 goto exit;
586 /* Validate the private key. */
587 status = mbedtls_to_psa_error(
588 mbedtls_ecp_check_privkey( &ecp->grp, &ecp->d ) );
589 if( status != PSA_SUCCESS )
590 goto exit;
591 /* Calculate the public key from the private key. */
592 status = mbedtls_to_psa_error(
593 mbedtls_ecp_mul( &ecp->grp, &ecp->Q, &ecp->d, &ecp->grp.G,
594 mbedtls_ctr_drbg_random, &global_data.ctr_drbg ) );
595 if( status != PSA_SUCCESS )
596 goto exit;
597
598 *p_ecp = ecp;
599 return( PSA_SUCCESS );
600
601exit:
602 if( ecp != NULL )
603 {
604 mbedtls_ecp_keypair_free( ecp );
605 mbedtls_free( ecp );
606 }
607 return( status );
608}
609#endif /* defined(MBEDTLS_ECP_C) */
610
Gilles Peskinef77ed1f2018-12-03 11:58:46 +0100611/** Import key data into a slot. `slot->type` must have been set
612 * previously. This function assumes that the slot does not contain
613 * any key material yet. On failure, the slot content is unchanged. */
Gilles Peskinefa4135b2018-12-10 16:48:53 +0100614psa_status_t psa_import_key_into_slot( psa_key_slot_t *slot,
615 const uint8_t *data,
616 size_t data_length )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100617{
Gilles Peskineb0b255c2018-07-06 17:01:38 +0200618 psa_status_t status = PSA_SUCCESS;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100619
Darryl Green940d72c2018-07-13 13:18:51 +0100620 if( key_type_is_raw_bytes( slot->type ) )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100621 {
Gilles Peskine6d912132018-03-07 16:41:37 +0100622 /* Ensure that a bytes-to-bit conversion won't overflow. */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100623 if( data_length > SIZE_MAX / 8 )
624 return( PSA_ERROR_NOT_SUPPORTED );
Darryl Green940d72c2018-07-13 13:18:51 +0100625 status = prepare_raw_data_slot( slot->type,
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200626 PSA_BYTES_TO_BITS( data_length ),
627 &slot->data.raw );
628 if( status != PSA_SUCCESS )
629 return( status );
Gilles Peskine46f1fd72018-06-28 19:31:31 +0200630 if( data_length != 0 )
631 memcpy( slot->data.raw.data, data, data_length );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100632 }
633 else
Gilles Peskinef76aa772018-10-29 19:24:33 +0100634#if defined(MBEDTLS_ECP_C)
Darryl Green940d72c2018-07-13 13:18:51 +0100635 if( PSA_KEY_TYPE_IS_ECC_KEYPAIR( slot->type ) )
Gilles Peskinef76aa772018-10-29 19:24:33 +0100636 {
Darryl Green940d72c2018-07-13 13:18:51 +0100637 status = psa_import_ec_private_key( PSA_KEY_TYPE_GET_CURVE( slot->type ),
Gilles Peskinef76aa772018-10-29 19:24:33 +0100638 data, data_length,
639 &slot->data.ecp );
640 if( status != PSA_SUCCESS )
641 return( status );
642 }
643 else
644#endif /* MBEDTLS_ECP_C */
Gilles Peskine969ac722018-01-28 18:16:59 +0100645#if defined(MBEDTLS_PK_PARSE_C)
Darryl Green940d72c2018-07-13 13:18:51 +0100646 if( PSA_KEY_TYPE_IS_RSA( slot->type ) ||
647 PSA_KEY_TYPE_IS_ECC( slot->type ) )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100648 {
649 int ret;
Gilles Peskine969ac722018-01-28 18:16:59 +0100650 mbedtls_pk_context pk;
651 mbedtls_pk_init( &pk );
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200652
653 /* Parse the data. */
Darryl Green940d72c2018-07-13 13:18:51 +0100654 if( PSA_KEY_TYPE_IS_KEYPAIR( slot->type ) )
Gilles Peskinec66ea6a2018-02-03 22:43:28 +0100655 ret = mbedtls_pk_parse_key( &pk, data, data_length, NULL, 0 );
656 else
657 ret = mbedtls_pk_parse_public_key( &pk, data, data_length );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100658 if( ret != 0 )
659 return( mbedtls_to_psa_error( ret ) );
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200660
661 /* We have something that the pkparse module recognizes.
662 * If it has the expected type and passes any type-specific
663 * checks, store it. */
Gilles Peskine969ac722018-01-28 18:16:59 +0100664#if defined(MBEDTLS_RSA_C)
Darryl Green940d72c2018-07-13 13:18:51 +0100665 if( PSA_KEY_TYPE_IS_RSA( slot->type ) )
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200666 status = psa_import_rsa_key( &pk, &slot->data.rsa );
667 else
Gilles Peskine969ac722018-01-28 18:16:59 +0100668#endif /* MBEDTLS_RSA_C */
669#if defined(MBEDTLS_ECP_C)
Darryl Green940d72c2018-07-13 13:18:51 +0100670 if( PSA_KEY_TYPE_IS_ECC( slot->type ) )
671 status = psa_import_ecp_key( PSA_KEY_TYPE_GET_CURVE( slot->type ),
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200672 &pk, &slot->data.ecp );
673 else
Gilles Peskine969ac722018-01-28 18:16:59 +0100674#endif /* MBEDTLS_ECP_C */
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200675 {
676 status = PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinec648d692018-06-28 08:46:13 +0200677 }
Gilles Peskineaf89fd72018-06-29 19:52:37 +0200678
Gilles Peskinec648d692018-06-28 08:46:13 +0200679 /* Free the content of the pk object only on error. On success,
680 * the content of the object has been stored in the slot. */
681 if( status != PSA_SUCCESS )
682 {
683 mbedtls_pk_free( &pk );
684 return( status );
Gilles Peskine969ac722018-01-28 18:16:59 +0100685 }
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100686 }
687 else
Gilles Peskine969ac722018-01-28 18:16:59 +0100688#endif /* defined(MBEDTLS_PK_PARSE_C) */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100689 {
690 return( PSA_ERROR_NOT_SUPPORTED );
691 }
Darryl Green940d72c2018-07-13 13:18:51 +0100692 return( PSA_SUCCESS );
693}
694
Darryl Green06fd18d2018-07-16 11:21:11 +0100695/* Retrieve an empty key slot (slot with no key data, but possibly
696 * with some metadata such as a policy). */
Gilles Peskinec5487a82018-12-03 18:08:14 +0100697static psa_status_t psa_get_empty_key_slot( psa_key_handle_t handle,
Gilles Peskine2f060a82018-12-04 17:12:32 +0100698 psa_key_slot_t **p_slot )
Darryl Green06fd18d2018-07-16 11:21:11 +0100699{
700 psa_status_t status;
Gilles Peskine2f060a82018-12-04 17:12:32 +0100701 psa_key_slot_t *slot = NULL;
Darryl Green06fd18d2018-07-16 11:21:11 +0100702
703 *p_slot = NULL;
704
Gilles Peskinec5487a82018-12-03 18:08:14 +0100705 status = psa_get_key_slot( handle, &slot );
Darryl Green06fd18d2018-07-16 11:21:11 +0100706 if( status != PSA_SUCCESS )
707 return( status );
708
709 if( slot->type != PSA_KEY_TYPE_NONE )
710 return( PSA_ERROR_OCCUPIED_SLOT );
711
712 *p_slot = slot;
713 return( status );
714}
715
716/** Retrieve a slot which must contain a key. The key must have allow all the
717 * usage flags set in \p usage. If \p alg is nonzero, the key must allow
718 * operations with this algorithm. */
Gilles Peskinec5487a82018-12-03 18:08:14 +0100719static psa_status_t psa_get_key_from_slot( psa_key_handle_t handle,
Gilles Peskine2f060a82018-12-04 17:12:32 +0100720 psa_key_slot_t **p_slot,
Darryl Green06fd18d2018-07-16 11:21:11 +0100721 psa_key_usage_t usage,
722 psa_algorithm_t alg )
723{
724 psa_status_t status;
Gilles Peskine2f060a82018-12-04 17:12:32 +0100725 psa_key_slot_t *slot = NULL;
Darryl Green06fd18d2018-07-16 11:21:11 +0100726
727 *p_slot = NULL;
728
Gilles Peskinec5487a82018-12-03 18:08:14 +0100729 status = psa_get_key_slot( handle, &slot );
Darryl Green06fd18d2018-07-16 11:21:11 +0100730 if( status != PSA_SUCCESS )
731 return( status );
732 if( slot->type == PSA_KEY_TYPE_NONE )
733 return( PSA_ERROR_EMPTY_SLOT );
734
735 /* Enforce that usage policy for the key slot contains all the flags
736 * required by the usage parameter. There is one exception: public
737 * keys can always be exported, so we treat public key objects as
738 * if they had the export flag. */
739 if( PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->type ) )
740 usage &= ~PSA_KEY_USAGE_EXPORT;
741 if( ( slot->policy.usage & usage ) != usage )
742 return( PSA_ERROR_NOT_PERMITTED );
743 if( alg != 0 && ( alg != slot->policy.alg ) )
744 return( PSA_ERROR_NOT_PERMITTED );
745
746 *p_slot = slot;
747 return( PSA_SUCCESS );
748}
Darryl Green940d72c2018-07-13 13:18:51 +0100749
Gilles Peskinef77ed1f2018-12-03 11:58:46 +0100750/** Wipe key data from a slot. Preserve metadata such as the policy. */
Gilles Peskine2f060a82018-12-04 17:12:32 +0100751static psa_status_t psa_remove_key_data_from_memory( psa_key_slot_t *slot )
Darryl Green40225ba2018-11-15 14:48:15 +0000752{
753 if( slot->type == PSA_KEY_TYPE_NONE )
754 {
755 /* No key material to clean. */
756 }
757 else if( key_type_is_raw_bytes( slot->type ) )
758 {
759 mbedtls_free( slot->data.raw.data );
760 }
761 else
762#if defined(MBEDTLS_RSA_C)
763 if( PSA_KEY_TYPE_IS_RSA( slot->type ) )
764 {
765 mbedtls_rsa_free( slot->data.rsa );
766 mbedtls_free( slot->data.rsa );
767 }
768 else
769#endif /* defined(MBEDTLS_RSA_C) */
770#if defined(MBEDTLS_ECP_C)
771 if( PSA_KEY_TYPE_IS_ECC( slot->type ) )
772 {
773 mbedtls_ecp_keypair_free( slot->data.ecp );
774 mbedtls_free( slot->data.ecp );
775 }
776 else
777#endif /* defined(MBEDTLS_ECP_C) */
778 {
779 /* Shouldn't happen: the key type is not any type that we
780 * put in. */
781 return( PSA_ERROR_TAMPERING_DETECTED );
782 }
783
784 return( PSA_SUCCESS );
785}
786
Gilles Peskinef77ed1f2018-12-03 11:58:46 +0100787/** Completely wipe a slot in memory, including its policy.
788 * Persistent storage is not affected. */
Gilles Peskine66fb1262018-12-10 16:29:04 +0100789psa_status_t psa_wipe_key_slot( psa_key_slot_t *slot )
Gilles Peskinef77ed1f2018-12-03 11:58:46 +0100790{
791 psa_status_t status = psa_remove_key_data_from_memory( slot );
792 /* At this point, key material and other type-specific content has
793 * been wiped. Clear remaining metadata. We can call memset and not
794 * zeroize because the metadata is not particularly sensitive. */
795 memset( slot, 0, sizeof( *slot ) );
796 return( status );
797}
798
Gilles Peskinec5487a82018-12-03 18:08:14 +0100799psa_status_t psa_import_key( psa_key_handle_t handle,
Darryl Green940d72c2018-07-13 13:18:51 +0100800 psa_key_type_t type,
801 const uint8_t *data,
802 size_t data_length )
803{
Gilles Peskine2f060a82018-12-04 17:12:32 +0100804 psa_key_slot_t *slot;
Darryl Green940d72c2018-07-13 13:18:51 +0100805 psa_status_t status;
806
Gilles Peskinec5487a82018-12-03 18:08:14 +0100807 status = psa_get_empty_key_slot( handle, &slot );
Darryl Green940d72c2018-07-13 13:18:51 +0100808 if( status != PSA_SUCCESS )
809 return( status );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100810
811 slot->type = type;
Darryl Green940d72c2018-07-13 13:18:51 +0100812
813 status = psa_import_key_into_slot( slot, data, data_length );
814 if( status != PSA_SUCCESS )
815 {
816 slot->type = PSA_KEY_TYPE_NONE;
817 return( status );
818 }
819
Darryl Greend49a4992018-06-18 17:27:26 +0100820#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
821 if( slot->lifetime == PSA_KEY_LIFETIME_PERSISTENT )
822 {
823 /* Store in file location */
Gilles Peskine69f976b2018-11-30 18:46:56 +0100824 status = psa_save_persistent_key( slot->persistent_storage_id,
825 slot->type, &slot->policy, data,
Darryl Greend49a4992018-06-18 17:27:26 +0100826 data_length );
827 if( status != PSA_SUCCESS )
828 {
829 (void) psa_remove_key_data_from_memory( slot );
830 slot->type = PSA_KEY_TYPE_NONE;
831 }
832 }
833#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
834
835 return( status );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100836}
837
Gilles Peskinec5487a82018-12-03 18:08:14 +0100838psa_status_t psa_destroy_key( psa_key_handle_t handle )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100839{
Gilles Peskine2f060a82018-12-04 17:12:32 +0100840 psa_key_slot_t *slot;
Darryl Greend49a4992018-06-18 17:27:26 +0100841 psa_status_t status = PSA_SUCCESS;
842 psa_status_t storage_status = PSA_SUCCESS;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100843
Gilles Peskinec5487a82018-12-03 18:08:14 +0100844 status = psa_get_key_slot( handle, &slot );
Gilles Peskineb0b255c2018-07-06 17:01:38 +0200845 if( status != PSA_SUCCESS )
846 return( status );
Darryl Greend49a4992018-06-18 17:27:26 +0100847#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
848 if( slot->lifetime == PSA_KEY_LIFETIME_PERSISTENT )
849 {
Gilles Peskine69f976b2018-11-30 18:46:56 +0100850 storage_status =
851 psa_destroy_persistent_key( slot->persistent_storage_id );
Darryl Greend49a4992018-06-18 17:27:26 +0100852 }
853#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
Gilles Peskinef77ed1f2018-12-03 11:58:46 +0100854 status = psa_wipe_key_slot( slot );
Darryl Greend49a4992018-06-18 17:27:26 +0100855 if( status != PSA_SUCCESS )
856 return( status );
857 return( storage_status );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100858}
859
Gilles Peskineb870b182018-07-06 16:02:09 +0200860/* Return the size of the key in the given slot, in bits. */
Gilles Peskine2f060a82018-12-04 17:12:32 +0100861static size_t psa_get_key_bits( const psa_key_slot_t *slot )
Gilles Peskineb870b182018-07-06 16:02:09 +0200862{
863 if( key_type_is_raw_bytes( slot->type ) )
864 return( slot->data.raw.bytes * 8 );
865#if defined(MBEDTLS_RSA_C)
Gilles Peskined8008d62018-06-29 19:51:51 +0200866 if( PSA_KEY_TYPE_IS_RSA( slot->type ) )
Gilles Peskineaac64a22018-11-12 18:37:42 +0100867 return( PSA_BYTES_TO_BITS( mbedtls_rsa_get_len( slot->data.rsa ) ) );
Gilles Peskineb870b182018-07-06 16:02:09 +0200868#endif /* defined(MBEDTLS_RSA_C) */
869#if defined(MBEDTLS_ECP_C)
870 if( PSA_KEY_TYPE_IS_ECC( slot->type ) )
871 return( slot->data.ecp->grp.pbits );
872#endif /* defined(MBEDTLS_ECP_C) */
873 /* Shouldn't happen except on an empty slot. */
874 return( 0 );
875}
876
Gilles Peskinec5487a82018-12-03 18:08:14 +0100877psa_status_t psa_get_key_information( psa_key_handle_t handle,
Gilles Peskine2d277862018-06-18 15:41:12 +0200878 psa_key_type_t *type,
879 size_t *bits )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100880{
Gilles Peskine2f060a82018-12-04 17:12:32 +0100881 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +0200882 psa_status_t status;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100883
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100884 if( type != NULL )
Gilles Peskineb0b255c2018-07-06 17:01:38 +0200885 *type = 0;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100886 if( bits != NULL )
887 *bits = 0;
Gilles Peskinec5487a82018-12-03 18:08:14 +0100888 status = psa_get_key_slot( handle, &slot );
Gilles Peskineb0b255c2018-07-06 17:01:38 +0200889 if( status != PSA_SUCCESS )
890 return( status );
Gilles Peskineb870b182018-07-06 16:02:09 +0200891
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100892 if( slot->type == PSA_KEY_TYPE_NONE )
893 return( PSA_ERROR_EMPTY_SLOT );
Gilles Peskineb0b255c2018-07-06 17:01:38 +0200894 if( type != NULL )
895 *type = slot->type;
Gilles Peskineb870b182018-07-06 16:02:09 +0200896 if( bits != NULL )
897 *bits = psa_get_key_bits( slot );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100898 return( PSA_SUCCESS );
899}
900
Gilles Peskine2f060a82018-12-04 17:12:32 +0100901static psa_status_t psa_internal_export_key( psa_key_slot_t *slot,
Gilles Peskine2d277862018-06-18 15:41:12 +0200902 uint8_t *data,
903 size_t data_size,
904 size_t *data_length,
905 int export_public_key )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100906{
Jaeden Amerof24c7f82018-06-27 17:20:43 +0100907 *data_length = 0;
908
Gilles Peskinec1bb6c82018-06-18 16:04:39 +0200909 if( export_public_key && ! PSA_KEY_TYPE_IS_ASYMMETRIC( slot->type ) )
Moran Pekera998bc62018-04-16 18:16:20 +0300910 return( PSA_ERROR_INVALID_ARGUMENT );
mohammad160306e79202018-03-28 13:17:44 +0300911
Gilles Peskine48c0ea12018-06-21 14:15:31 +0200912 if( key_type_is_raw_bytes( slot->type ) )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100913 {
914 if( slot->data.raw.bytes > data_size )
915 return( PSA_ERROR_BUFFER_TOO_SMALL );
Gilles Peskine52b90182018-10-29 19:26:27 +0100916 if( data_size != 0 )
917 {
Gilles Peskine46f1fd72018-06-28 19:31:31 +0200918 memcpy( data, slot->data.raw.data, slot->data.raw.bytes );
Gilles Peskine52b90182018-10-29 19:26:27 +0100919 memset( data + slot->data.raw.bytes, 0,
920 data_size - slot->data.raw.bytes );
921 }
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100922 *data_length = slot->data.raw.bytes;
923 return( PSA_SUCCESS );
924 }
Gilles Peskine188c71e2018-10-29 19:26:02 +0100925#if defined(MBEDTLS_ECP_C)
926 if( PSA_KEY_TYPE_IS_ECC_KEYPAIR( slot->type ) && !export_public_key )
927 {
Darryl Greendd8fb772018-11-07 16:00:44 +0000928 psa_status_t status;
929
Gilles Peskine188c71e2018-10-29 19:26:02 +0100930 size_t bytes = PSA_BITS_TO_BYTES( psa_get_key_bits( slot ) );
931 if( bytes > data_size )
932 return( PSA_ERROR_BUFFER_TOO_SMALL );
933 status = mbedtls_to_psa_error(
934 mbedtls_mpi_write_binary( &slot->data.ecp->d, data, bytes ) );
935 if( status != PSA_SUCCESS )
936 return( status );
937 memset( data + bytes, 0, data_size - bytes );
938 *data_length = bytes;
939 return( PSA_SUCCESS );
940 }
941#endif
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100942 else
Moran Peker17e36e12018-05-02 12:55:20 +0300943 {
Gilles Peskine969ac722018-01-28 18:16:59 +0100944#if defined(MBEDTLS_PK_WRITE_C)
Gilles Peskined8008d62018-06-29 19:51:51 +0200945 if( PSA_KEY_TYPE_IS_RSA( slot->type ) ||
Moran Pekera998bc62018-04-16 18:16:20 +0300946 PSA_KEY_TYPE_IS_ECC( slot->type ) )
Gilles Peskine969ac722018-01-28 18:16:59 +0100947 {
Moran Pekera998bc62018-04-16 18:16:20 +0300948 mbedtls_pk_context pk;
949 int ret;
Gilles Peskined8008d62018-06-29 19:51:51 +0200950 if( PSA_KEY_TYPE_IS_RSA( slot->type ) )
Moran Pekera998bc62018-04-16 18:16:20 +0300951 {
Darryl Green9e2d7a02018-07-24 16:33:30 +0100952#if defined(MBEDTLS_RSA_C)
953 mbedtls_pk_init( &pk );
Moran Pekera998bc62018-04-16 18:16:20 +0300954 pk.pk_info = &mbedtls_rsa_info;
955 pk.pk_ctx = slot->data.rsa;
Darryl Green9e2d7a02018-07-24 16:33:30 +0100956#else
957 return( PSA_ERROR_NOT_SUPPORTED );
958#endif
Moran Pekera998bc62018-04-16 18:16:20 +0300959 }
960 else
961 {
Darryl Green9e2d7a02018-07-24 16:33:30 +0100962#if defined(MBEDTLS_ECP_C)
963 mbedtls_pk_init( &pk );
Moran Pekera998bc62018-04-16 18:16:20 +0300964 pk.pk_info = &mbedtls_eckey_info;
965 pk.pk_ctx = slot->data.ecp;
Darryl Green9e2d7a02018-07-24 16:33:30 +0100966#else
967 return( PSA_ERROR_NOT_SUPPORTED );
968#endif
Moran Pekera998bc62018-04-16 18:16:20 +0300969 }
Moran Pekerd7326592018-05-29 16:56:39 +0300970 if( export_public_key || PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->type ) )
Moran Pekera998bc62018-04-16 18:16:20 +0300971 ret = mbedtls_pk_write_pubkey_der( &pk, data, data_size );
Moran Peker17e36e12018-05-02 12:55:20 +0300972 else
973 ret = mbedtls_pk_write_key_der( &pk, data, data_size );
Moran Peker60364322018-04-29 11:34:58 +0300974 if( ret < 0 )
Gilles Peskinee66ca3b2018-06-20 00:11:45 +0200975 {
Gilles Peskine46f1fd72018-06-28 19:31:31 +0200976 /* If data_size is 0 then data may be NULL and then the
977 * call to memset would have undefined behavior. */
978 if( data_size != 0 )
979 memset( data, 0, data_size );
Moran Pekera998bc62018-04-16 18:16:20 +0300980 return( mbedtls_to_psa_error( ret ) );
Gilles Peskinee66ca3b2018-06-20 00:11:45 +0200981 }
Gilles Peskine0e231582018-06-20 00:11:07 +0200982 /* The mbedtls_pk_xxx functions write to the end of the buffer.
983 * Move the data to the beginning and erase remaining data
984 * at the original location. */
985 if( 2 * (size_t) ret <= data_size )
986 {
987 memcpy( data, data + data_size - ret, ret );
Gilles Peskinee66ca3b2018-06-20 00:11:45 +0200988 memset( data + data_size - ret, 0, ret );
Gilles Peskine0e231582018-06-20 00:11:07 +0200989 }
990 else if( (size_t) ret < data_size )
991 {
992 memmove( data, data + data_size - ret, ret );
Gilles Peskinee66ca3b2018-06-20 00:11:45 +0200993 memset( data + ret, 0, data_size - ret );
Gilles Peskine0e231582018-06-20 00:11:07 +0200994 }
Moran Pekera998bc62018-04-16 18:16:20 +0300995 *data_length = ret;
996 return( PSA_SUCCESS );
Gilles Peskine969ac722018-01-28 18:16:59 +0100997 }
998 else
Gilles Peskine6d912132018-03-07 16:41:37 +0100999#endif /* defined(MBEDTLS_PK_WRITE_C) */
Moran Pekera998bc62018-04-16 18:16:20 +03001000 {
1001 /* This shouldn't happen in the reference implementation, but
Gilles Peskine785fd552018-06-04 15:08:56 +02001002 it is valid for a special-purpose implementation to omit
1003 support for exporting certain key types. */
Moran Pekera998bc62018-04-16 18:16:20 +03001004 return( PSA_ERROR_NOT_SUPPORTED );
1005 }
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001006 }
1007}
1008
Gilles Peskinec5487a82018-12-03 18:08:14 +01001009psa_status_t psa_export_key( psa_key_handle_t handle,
Gilles Peskine2d277862018-06-18 15:41:12 +02001010 uint8_t *data,
1011 size_t data_size,
1012 size_t *data_length )
Moran Pekera998bc62018-04-16 18:16:20 +03001013{
Gilles Peskine2f060a82018-12-04 17:12:32 +01001014 psa_key_slot_t *slot;
Darryl Greendd8fb772018-11-07 16:00:44 +00001015 psa_status_t status;
1016
1017 /* Set the key to empty now, so that even when there are errors, we always
1018 * set data_length to a value between 0 and data_size. On error, setting
1019 * the key to empty is a good choice because an empty key representation is
1020 * unlikely to be accepted anywhere. */
1021 *data_length = 0;
1022
1023 /* Export requires the EXPORT flag. There is an exception for public keys,
1024 * which don't require any flag, but psa_get_key_from_slot takes
1025 * care of this. */
Gilles Peskinec5487a82018-12-03 18:08:14 +01001026 status = psa_get_key_from_slot( handle, &slot, PSA_KEY_USAGE_EXPORT, 0 );
Darryl Greendd8fb772018-11-07 16:00:44 +00001027 if( status != PSA_SUCCESS )
1028 return( status );
1029 return( psa_internal_export_key( slot, data, data_size,
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001030 data_length, 0 ) );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001031}
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001032
Gilles Peskinec5487a82018-12-03 18:08:14 +01001033psa_status_t psa_export_public_key( psa_key_handle_t handle,
Gilles Peskine2d277862018-06-18 15:41:12 +02001034 uint8_t *data,
1035 size_t data_size,
1036 size_t *data_length )
Moran Pekerdd4ea382018-04-03 15:30:03 +03001037{
Gilles Peskine2f060a82018-12-04 17:12:32 +01001038 psa_key_slot_t *slot;
Darryl Greendd8fb772018-11-07 16:00:44 +00001039 psa_status_t status;
1040
1041 /* Set the key to empty now, so that even when there are errors, we always
1042 * set data_length to a value between 0 and data_size. On error, setting
1043 * the key to empty is a good choice because an empty key representation is
1044 * unlikely to be accepted anywhere. */
1045 *data_length = 0;
1046
1047 /* Exporting a public key doesn't require a usage flag. */
Gilles Peskinec5487a82018-12-03 18:08:14 +01001048 status = psa_get_key_from_slot( handle, &slot, 0, 0 );
Darryl Greendd8fb772018-11-07 16:00:44 +00001049 if( status != PSA_SUCCESS )
1050 return( status );
1051 return( psa_internal_export_key( slot, data, data_size,
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001052 data_length, 1 ) );
Moran Pekerdd4ea382018-04-03 15:30:03 +03001053}
1054
Darryl Green0c6575a2018-11-07 16:05:30 +00001055#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Gilles Peskine2f060a82018-12-04 17:12:32 +01001056static psa_status_t psa_save_generated_persistent_key( psa_key_slot_t *slot,
Darryl Green0c6575a2018-11-07 16:05:30 +00001057 size_t bits )
1058{
1059 psa_status_t status;
1060 uint8_t *data;
1061 size_t key_length;
1062 size_t data_size = PSA_KEY_EXPORT_MAX_SIZE( slot->type, bits );
1063 data = mbedtls_calloc( 1, data_size );
itayzafrir910c76b2018-11-21 16:03:21 +02001064 if( data == NULL )
1065 return( PSA_ERROR_INSUFFICIENT_MEMORY );
Darryl Green0c6575a2018-11-07 16:05:30 +00001066 /* Get key data in export format */
1067 status = psa_internal_export_key( slot, data, data_size, &key_length, 0 );
1068 if( status != PSA_SUCCESS )
1069 {
1070 slot->type = PSA_KEY_TYPE_NONE;
1071 goto exit;
1072 }
1073 /* Store in file location */
Gilles Peskine69f976b2018-11-30 18:46:56 +01001074 status = psa_save_persistent_key( slot->persistent_storage_id,
1075 slot->type, &slot->policy,
Darryl Green0c6575a2018-11-07 16:05:30 +00001076 data, key_length );
1077 if( status != PSA_SUCCESS )
1078 {
1079 slot->type = PSA_KEY_TYPE_NONE;
1080 }
1081exit:
Gilles Peskine3f108122018-12-07 18:14:53 +01001082 mbedtls_platform_zeroize( data, key_length );
Darryl Green0c6575a2018-11-07 16:05:30 +00001083 mbedtls_free( data );
1084 return( status );
1085}
1086#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
1087
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02001088
1089
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001090/****************************************************************/
Gilles Peskine20035e32018-02-03 22:44:14 +01001091/* Message digests */
1092/****************************************************************/
1093
Gilles Peskinedc2fc842018-03-07 16:42:59 +01001094static const mbedtls_md_info_t *mbedtls_md_info_from_psa( psa_algorithm_t alg )
Gilles Peskine20035e32018-02-03 22:44:14 +01001095{
1096 switch( alg )
1097 {
1098#if defined(MBEDTLS_MD2_C)
1099 case PSA_ALG_MD2:
1100 return( &mbedtls_md2_info );
1101#endif
1102#if defined(MBEDTLS_MD4_C)
1103 case PSA_ALG_MD4:
1104 return( &mbedtls_md4_info );
1105#endif
1106#if defined(MBEDTLS_MD5_C)
1107 case PSA_ALG_MD5:
1108 return( &mbedtls_md5_info );
1109#endif
1110#if defined(MBEDTLS_RIPEMD160_C)
1111 case PSA_ALG_RIPEMD160:
1112 return( &mbedtls_ripemd160_info );
1113#endif
1114#if defined(MBEDTLS_SHA1_C)
1115 case PSA_ALG_SHA_1:
1116 return( &mbedtls_sha1_info );
1117#endif
1118#if defined(MBEDTLS_SHA256_C)
1119 case PSA_ALG_SHA_224:
1120 return( &mbedtls_sha224_info );
1121 case PSA_ALG_SHA_256:
1122 return( &mbedtls_sha256_info );
1123#endif
1124#if defined(MBEDTLS_SHA512_C)
1125 case PSA_ALG_SHA_384:
1126 return( &mbedtls_sha384_info );
1127 case PSA_ALG_SHA_512:
1128 return( &mbedtls_sha512_info );
1129#endif
1130 default:
1131 return( NULL );
1132 }
1133}
1134
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001135psa_status_t psa_hash_abort( psa_hash_operation_t *operation )
1136{
1137 switch( operation->alg )
1138 {
Gilles Peskine81736312018-06-26 15:04:31 +02001139 case 0:
1140 /* The object has (apparently) been initialized but it is not
1141 * in use. It's ok to call abort on such an object, and there's
1142 * nothing to do. */
1143 break;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001144#if defined(MBEDTLS_MD2_C)
1145 case PSA_ALG_MD2:
1146 mbedtls_md2_free( &operation->ctx.md2 );
1147 break;
1148#endif
1149#if defined(MBEDTLS_MD4_C)
1150 case PSA_ALG_MD4:
1151 mbedtls_md4_free( &operation->ctx.md4 );
1152 break;
1153#endif
1154#if defined(MBEDTLS_MD5_C)
1155 case PSA_ALG_MD5:
1156 mbedtls_md5_free( &operation->ctx.md5 );
1157 break;
1158#endif
1159#if defined(MBEDTLS_RIPEMD160_C)
1160 case PSA_ALG_RIPEMD160:
1161 mbedtls_ripemd160_free( &operation->ctx.ripemd160 );
1162 break;
1163#endif
1164#if defined(MBEDTLS_SHA1_C)
1165 case PSA_ALG_SHA_1:
1166 mbedtls_sha1_free( &operation->ctx.sha1 );
1167 break;
1168#endif
1169#if defined(MBEDTLS_SHA256_C)
1170 case PSA_ALG_SHA_224:
1171 case PSA_ALG_SHA_256:
1172 mbedtls_sha256_free( &operation->ctx.sha256 );
1173 break;
1174#endif
1175#if defined(MBEDTLS_SHA512_C)
1176 case PSA_ALG_SHA_384:
1177 case PSA_ALG_SHA_512:
1178 mbedtls_sha512_free( &operation->ctx.sha512 );
1179 break;
1180#endif
1181 default:
Gilles Peskinef9c2c092018-06-21 16:57:07 +02001182 return( PSA_ERROR_BAD_STATE );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001183 }
1184 operation->alg = 0;
1185 return( PSA_SUCCESS );
1186}
1187
Gilles Peskineda8191d1c2018-07-08 19:46:38 +02001188psa_status_t psa_hash_setup( psa_hash_operation_t *operation,
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001189 psa_algorithm_t alg )
1190{
1191 int ret;
1192 operation->alg = 0;
1193 switch( alg )
1194 {
1195#if defined(MBEDTLS_MD2_C)
1196 case PSA_ALG_MD2:
1197 mbedtls_md2_init( &operation->ctx.md2 );
1198 ret = mbedtls_md2_starts_ret( &operation->ctx.md2 );
1199 break;
1200#endif
1201#if defined(MBEDTLS_MD4_C)
1202 case PSA_ALG_MD4:
1203 mbedtls_md4_init( &operation->ctx.md4 );
1204 ret = mbedtls_md4_starts_ret( &operation->ctx.md4 );
1205 break;
1206#endif
1207#if defined(MBEDTLS_MD5_C)
1208 case PSA_ALG_MD5:
1209 mbedtls_md5_init( &operation->ctx.md5 );
1210 ret = mbedtls_md5_starts_ret( &operation->ctx.md5 );
1211 break;
1212#endif
1213#if defined(MBEDTLS_RIPEMD160_C)
1214 case PSA_ALG_RIPEMD160:
1215 mbedtls_ripemd160_init( &operation->ctx.ripemd160 );
1216 ret = mbedtls_ripemd160_starts_ret( &operation->ctx.ripemd160 );
1217 break;
1218#endif
1219#if defined(MBEDTLS_SHA1_C)
1220 case PSA_ALG_SHA_1:
1221 mbedtls_sha1_init( &operation->ctx.sha1 );
1222 ret = mbedtls_sha1_starts_ret( &operation->ctx.sha1 );
1223 break;
1224#endif
1225#if defined(MBEDTLS_SHA256_C)
1226 case PSA_ALG_SHA_224:
1227 mbedtls_sha256_init( &operation->ctx.sha256 );
1228 ret = mbedtls_sha256_starts_ret( &operation->ctx.sha256, 1 );
1229 break;
1230 case PSA_ALG_SHA_256:
1231 mbedtls_sha256_init( &operation->ctx.sha256 );
1232 ret = mbedtls_sha256_starts_ret( &operation->ctx.sha256, 0 );
1233 break;
1234#endif
1235#if defined(MBEDTLS_SHA512_C)
1236 case PSA_ALG_SHA_384:
1237 mbedtls_sha512_init( &operation->ctx.sha512 );
1238 ret = mbedtls_sha512_starts_ret( &operation->ctx.sha512, 1 );
1239 break;
1240 case PSA_ALG_SHA_512:
1241 mbedtls_sha512_init( &operation->ctx.sha512 );
1242 ret = mbedtls_sha512_starts_ret( &operation->ctx.sha512, 0 );
1243 break;
1244#endif
1245 default:
Gilles Peskinec06e0712018-06-20 16:21:04 +02001246 return( PSA_ALG_IS_HASH( alg ) ?
1247 PSA_ERROR_NOT_SUPPORTED :
1248 PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001249 }
1250 if( ret == 0 )
1251 operation->alg = alg;
1252 else
1253 psa_hash_abort( operation );
1254 return( mbedtls_to_psa_error( ret ) );
1255}
1256
1257psa_status_t psa_hash_update( psa_hash_operation_t *operation,
1258 const uint8_t *input,
1259 size_t input_length )
1260{
1261 int ret;
Gilles Peskine94e44542018-07-12 16:58:43 +02001262
1263 /* Don't require hash implementations to behave correctly on a
1264 * zero-length input, which may have an invalid pointer. */
1265 if( input_length == 0 )
1266 return( PSA_SUCCESS );
1267
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001268 switch( operation->alg )
1269 {
1270#if defined(MBEDTLS_MD2_C)
1271 case PSA_ALG_MD2:
1272 ret = mbedtls_md2_update_ret( &operation->ctx.md2,
1273 input, input_length );
1274 break;
1275#endif
1276#if defined(MBEDTLS_MD4_C)
1277 case PSA_ALG_MD4:
1278 ret = mbedtls_md4_update_ret( &operation->ctx.md4,
1279 input, input_length );
1280 break;
1281#endif
1282#if defined(MBEDTLS_MD5_C)
1283 case PSA_ALG_MD5:
1284 ret = mbedtls_md5_update_ret( &operation->ctx.md5,
1285 input, input_length );
1286 break;
1287#endif
1288#if defined(MBEDTLS_RIPEMD160_C)
1289 case PSA_ALG_RIPEMD160:
1290 ret = mbedtls_ripemd160_update_ret( &operation->ctx.ripemd160,
1291 input, input_length );
1292 break;
1293#endif
1294#if defined(MBEDTLS_SHA1_C)
1295 case PSA_ALG_SHA_1:
1296 ret = mbedtls_sha1_update_ret( &operation->ctx.sha1,
1297 input, input_length );
1298 break;
1299#endif
1300#if defined(MBEDTLS_SHA256_C)
1301 case PSA_ALG_SHA_224:
1302 case PSA_ALG_SHA_256:
1303 ret = mbedtls_sha256_update_ret( &operation->ctx.sha256,
1304 input, input_length );
1305 break;
1306#endif
1307#if defined(MBEDTLS_SHA512_C)
1308 case PSA_ALG_SHA_384:
1309 case PSA_ALG_SHA_512:
1310 ret = mbedtls_sha512_update_ret( &operation->ctx.sha512,
1311 input, input_length );
1312 break;
1313#endif
1314 default:
1315 ret = MBEDTLS_ERR_MD_BAD_INPUT_DATA;
1316 break;
1317 }
Gilles Peskine94e44542018-07-12 16:58:43 +02001318
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001319 if( ret != 0 )
1320 psa_hash_abort( operation );
1321 return( mbedtls_to_psa_error( ret ) );
1322}
1323
1324psa_status_t psa_hash_finish( psa_hash_operation_t *operation,
1325 uint8_t *hash,
1326 size_t hash_size,
1327 size_t *hash_length )
1328{
itayzafrir40835d42018-08-02 13:14:17 +03001329 psa_status_t status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001330 int ret;
Gilles Peskine71bb7b72018-04-19 08:29:59 +02001331 size_t actual_hash_length = PSA_HASH_SIZE( operation->alg );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001332
1333 /* Fill the output buffer with something that isn't a valid hash
1334 * (barring an attack on the hash and deliberately-crafted input),
1335 * in case the caller doesn't check the return status properly. */
Gilles Peskineaee13332018-07-02 12:15:28 +02001336 *hash_length = hash_size;
Gilles Peskine46f1fd72018-06-28 19:31:31 +02001337 /* If hash_size is 0 then hash may be NULL and then the
1338 * call to memset would have undefined behavior. */
1339 if( hash_size != 0 )
1340 memset( hash, '!', hash_size );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001341
1342 if( hash_size < actual_hash_length )
itayzafrir40835d42018-08-02 13:14:17 +03001343 {
1344 status = PSA_ERROR_BUFFER_TOO_SMALL;
1345 goto exit;
1346 }
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001347
1348 switch( operation->alg )
1349 {
1350#if defined(MBEDTLS_MD2_C)
1351 case PSA_ALG_MD2:
1352 ret = mbedtls_md2_finish_ret( &operation->ctx.md2, hash );
1353 break;
1354#endif
1355#if defined(MBEDTLS_MD4_C)
1356 case PSA_ALG_MD4:
1357 ret = mbedtls_md4_finish_ret( &operation->ctx.md4, hash );
1358 break;
1359#endif
1360#if defined(MBEDTLS_MD5_C)
1361 case PSA_ALG_MD5:
1362 ret = mbedtls_md5_finish_ret( &operation->ctx.md5, hash );
1363 break;
1364#endif
1365#if defined(MBEDTLS_RIPEMD160_C)
1366 case PSA_ALG_RIPEMD160:
1367 ret = mbedtls_ripemd160_finish_ret( &operation->ctx.ripemd160, hash );
1368 break;
1369#endif
1370#if defined(MBEDTLS_SHA1_C)
1371 case PSA_ALG_SHA_1:
1372 ret = mbedtls_sha1_finish_ret( &operation->ctx.sha1, hash );
1373 break;
1374#endif
1375#if defined(MBEDTLS_SHA256_C)
1376 case PSA_ALG_SHA_224:
1377 case PSA_ALG_SHA_256:
1378 ret = mbedtls_sha256_finish_ret( &operation->ctx.sha256, hash );
1379 break;
1380#endif
1381#if defined(MBEDTLS_SHA512_C)
1382 case PSA_ALG_SHA_384:
1383 case PSA_ALG_SHA_512:
1384 ret = mbedtls_sha512_finish_ret( &operation->ctx.sha512, hash );
1385 break;
1386#endif
1387 default:
1388 ret = MBEDTLS_ERR_MD_BAD_INPUT_DATA;
1389 break;
1390 }
itayzafrir40835d42018-08-02 13:14:17 +03001391 status = mbedtls_to_psa_error( ret );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001392
itayzafrir40835d42018-08-02 13:14:17 +03001393exit:
1394 if( status == PSA_SUCCESS )
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001395 {
Gilles Peskineaee13332018-07-02 12:15:28 +02001396 *hash_length = actual_hash_length;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001397 return( psa_hash_abort( operation ) );
1398 }
1399 else
1400 {
1401 psa_hash_abort( operation );
itayzafrir40835d42018-08-02 13:14:17 +03001402 return( status );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001403 }
1404}
1405
Gilles Peskine2d277862018-06-18 15:41:12 +02001406psa_status_t psa_hash_verify( psa_hash_operation_t *operation,
1407 const uint8_t *hash,
1408 size_t hash_length )
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001409{
1410 uint8_t actual_hash[MBEDTLS_MD_MAX_SIZE];
1411 size_t actual_hash_length;
1412 psa_status_t status = psa_hash_finish( operation,
1413 actual_hash, sizeof( actual_hash ),
1414 &actual_hash_length );
1415 if( status != PSA_SUCCESS )
1416 return( status );
1417 if( actual_hash_length != hash_length )
1418 return( PSA_ERROR_INVALID_SIGNATURE );
1419 if( safer_memcmp( hash, actual_hash, actual_hash_length ) != 0 )
1420 return( PSA_ERROR_INVALID_SIGNATURE );
1421 return( PSA_SUCCESS );
1422}
1423
1424
1425
Gilles Peskine9ef733f2018-02-07 21:05:37 +01001426/****************************************************************/
Gilles Peskine8c9def32018-02-08 10:02:12 +01001427/* MAC */
1428/****************************************************************/
1429
Gilles Peskinedc2fc842018-03-07 16:42:59 +01001430static const mbedtls_cipher_info_t *mbedtls_cipher_info_from_psa(
Gilles Peskine8c9def32018-02-08 10:02:12 +01001431 psa_algorithm_t alg,
1432 psa_key_type_t key_type,
Gilles Peskine2d277862018-06-18 15:41:12 +02001433 size_t key_bits,
mohammad1603f4f0d612018-06-03 15:04:51 +03001434 mbedtls_cipher_id_t* cipher_id )
Gilles Peskine8c9def32018-02-08 10:02:12 +01001435{
Gilles Peskine8c9def32018-02-08 10:02:12 +01001436 mbedtls_cipher_mode_t mode;
mohammad1603f4f0d612018-06-03 15:04:51 +03001437 mbedtls_cipher_id_t cipher_id_tmp;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001438
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02001439 if( PSA_ALG_IS_AEAD( alg ) )
Gilles Peskine57fbdb12018-10-17 18:29:17 +02001440 alg = PSA_ALG_AEAD_WITH_TAG_LENGTH( alg, 0 );
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02001441
Gilles Peskine8c9def32018-02-08 10:02:12 +01001442 if( PSA_ALG_IS_CIPHER( alg ) || PSA_ALG_IS_AEAD( alg ) )
1443 {
Nir Sonnenscheine9664c32018-06-17 14:41:30 +03001444 switch( alg )
Gilles Peskine8c9def32018-02-08 10:02:12 +01001445 {
Gilles Peskinedaea26f2018-08-21 14:02:45 +02001446 case PSA_ALG_ARC4:
Gilles Peskine8c9def32018-02-08 10:02:12 +01001447 mode = MBEDTLS_MODE_STREAM;
1448 break;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001449 case PSA_ALG_CTR:
1450 mode = MBEDTLS_MODE_CTR;
1451 break;
Gilles Peskinedaea26f2018-08-21 14:02:45 +02001452 case PSA_ALG_CFB:
1453 mode = MBEDTLS_MODE_CFB;
1454 break;
1455 case PSA_ALG_OFB:
1456 mode = MBEDTLS_MODE_OFB;
1457 break;
1458 case PSA_ALG_CBC_NO_PADDING:
1459 mode = MBEDTLS_MODE_CBC;
1460 break;
1461 case PSA_ALG_CBC_PKCS7:
1462 mode = MBEDTLS_MODE_CBC;
1463 break;
Gilles Peskine57fbdb12018-10-17 18:29:17 +02001464 case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_CCM, 0 ):
Gilles Peskine8c9def32018-02-08 10:02:12 +01001465 mode = MBEDTLS_MODE_CCM;
1466 break;
Gilles Peskine57fbdb12018-10-17 18:29:17 +02001467 case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_GCM, 0 ):
Gilles Peskine8c9def32018-02-08 10:02:12 +01001468 mode = MBEDTLS_MODE_GCM;
1469 break;
1470 default:
1471 return( NULL );
1472 }
1473 }
1474 else if( alg == PSA_ALG_CMAC )
1475 mode = MBEDTLS_MODE_ECB;
1476 else if( alg == PSA_ALG_GMAC )
1477 mode = MBEDTLS_MODE_GCM;
1478 else
1479 return( NULL );
1480
1481 switch( key_type )
1482 {
1483 case PSA_KEY_TYPE_AES:
mohammad1603f4f0d612018-06-03 15:04:51 +03001484 cipher_id_tmp = MBEDTLS_CIPHER_ID_AES;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001485 break;
1486 case PSA_KEY_TYPE_DES:
Gilles Peskine9ad29e22018-06-21 09:40:04 +02001487 /* key_bits is 64 for Single-DES, 128 for two-key Triple-DES,
1488 * and 192 for three-key Triple-DES. */
Gilles Peskine8c9def32018-02-08 10:02:12 +01001489 if( key_bits == 64 )
mohammad1603f4f0d612018-06-03 15:04:51 +03001490 cipher_id_tmp = MBEDTLS_CIPHER_ID_DES;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001491 else
mohammad1603f4f0d612018-06-03 15:04:51 +03001492 cipher_id_tmp = MBEDTLS_CIPHER_ID_3DES;
Gilles Peskine9ad29e22018-06-21 09:40:04 +02001493 /* mbedtls doesn't recognize two-key Triple-DES as an algorithm,
1494 * but two-key Triple-DES is functionally three-key Triple-DES
1495 * with K1=K3, so that's how we present it to mbedtls. */
1496 if( key_bits == 128 )
1497 key_bits = 192;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001498 break;
1499 case PSA_KEY_TYPE_CAMELLIA:
mohammad1603f4f0d612018-06-03 15:04:51 +03001500 cipher_id_tmp = MBEDTLS_CIPHER_ID_CAMELLIA;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001501 break;
1502 case PSA_KEY_TYPE_ARC4:
mohammad1603f4f0d612018-06-03 15:04:51 +03001503 cipher_id_tmp = MBEDTLS_CIPHER_ID_ARC4;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001504 break;
1505 default:
1506 return( NULL );
1507 }
mohammad1603f4f0d612018-06-03 15:04:51 +03001508 if( cipher_id != NULL )
mohammad160360a64d02018-06-03 17:20:42 +03001509 *cipher_id = cipher_id_tmp;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001510
Jaeden Amero23bbb752018-06-26 14:16:54 +01001511 return( mbedtls_cipher_info_from_values( cipher_id_tmp,
1512 (int) key_bits, mode ) );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001513}
1514
Gilles Peskinea05219c2018-11-16 16:02:56 +01001515#if defined(MBEDTLS_MD_C)
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001516static size_t psa_get_hash_block_size( psa_algorithm_t alg )
Nir Sonnenschein96272412018-06-17 14:41:10 +03001517{
Gilles Peskine2d277862018-06-18 15:41:12 +02001518 switch( alg )
Nir Sonnenschein96272412018-06-17 14:41:10 +03001519 {
1520 case PSA_ALG_MD2:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001521 return( 16 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001522 case PSA_ALG_MD4:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001523 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001524 case PSA_ALG_MD5:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001525 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001526 case PSA_ALG_RIPEMD160:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001527 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001528 case PSA_ALG_SHA_1:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001529 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001530 case PSA_ALG_SHA_224:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001531 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001532 case PSA_ALG_SHA_256:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001533 return( 64 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001534 case PSA_ALG_SHA_384:
Nir Sonnenscheinaa5aea02018-06-18 12:24:33 +03001535 return( 128 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001536 case PSA_ALG_SHA_512:
Gilles Peskine2d277862018-06-18 15:41:12 +02001537 return( 128 );
1538 default:
1539 return( 0 );
Nir Sonnenschein96272412018-06-17 14:41:10 +03001540 }
1541}
Gilles Peskinea05219c2018-11-16 16:02:56 +01001542#endif /* MBEDTLS_MD_C */
Nir Sonnenschein0c9ec532018-06-07 13:27:47 +03001543
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02001544/* Initialize the MAC operation structure. Once this function has been
1545 * called, psa_mac_abort can run and will do the right thing. */
1546static psa_status_t psa_mac_init( psa_mac_operation_t *operation,
1547 psa_algorithm_t alg )
1548{
1549 psa_status_t status = PSA_ERROR_NOT_SUPPORTED;
1550
1551 operation->alg = alg;
1552 operation->key_set = 0;
1553 operation->iv_set = 0;
1554 operation->iv_required = 0;
1555 operation->has_input = 0;
Gilles Peskine89167cb2018-07-08 20:12:23 +02001556 operation->is_sign = 0;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02001557
1558#if defined(MBEDTLS_CMAC_C)
1559 if( alg == PSA_ALG_CMAC )
1560 {
1561 operation->iv_required = 0;
1562 mbedtls_cipher_init( &operation->ctx.cmac );
1563 status = PSA_SUCCESS;
1564 }
1565 else
1566#endif /* MBEDTLS_CMAC_C */
1567#if defined(MBEDTLS_MD_C)
1568 if( PSA_ALG_IS_HMAC( operation->alg ) )
1569 {
Gilles Peskineff94abd2018-07-12 17:07:52 +02001570 /* We'll set up the hash operation later in psa_hmac_setup_internal. */
1571 operation->ctx.hmac.hash_ctx.alg = 0;
1572 status = PSA_SUCCESS;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02001573 }
1574 else
1575#endif /* MBEDTLS_MD_C */
1576 {
Gilles Peskinec06e0712018-06-20 16:21:04 +02001577 if( ! PSA_ALG_IS_MAC( alg ) )
1578 status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02001579 }
1580
1581 if( status != PSA_SUCCESS )
1582 memset( operation, 0, sizeof( *operation ) );
1583 return( status );
1584}
1585
Gilles Peskine01126fa2018-07-12 17:04:55 +02001586#if defined(MBEDTLS_MD_C)
1587static psa_status_t psa_hmac_abort_internal( psa_hmac_internal_data *hmac )
1588{
Gilles Peskine3f108122018-12-07 18:14:53 +01001589 mbedtls_platform_zeroize( hmac->opad, sizeof( hmac->opad ) );
Gilles Peskine01126fa2018-07-12 17:04:55 +02001590 return( psa_hash_abort( &hmac->hash_ctx ) );
1591}
Hanno Beckerc8a41d72018-10-09 17:33:01 +01001592
1593static void psa_hmac_init_internal( psa_hmac_internal_data *hmac )
1594{
1595 /* Instances of psa_hash_operation_s can be initialized by zeroization. */
1596 memset( hmac, 0, sizeof( *hmac ) );
1597}
Gilles Peskine01126fa2018-07-12 17:04:55 +02001598#endif /* MBEDTLS_MD_C */
1599
Gilles Peskine8c9def32018-02-08 10:02:12 +01001600psa_status_t psa_mac_abort( psa_mac_operation_t *operation )
1601{
Gilles Peskinefbfac682018-07-08 20:51:54 +02001602 if( operation->alg == 0 )
Gilles Peskine8c9def32018-02-08 10:02:12 +01001603 {
Gilles Peskinefbfac682018-07-08 20:51:54 +02001604 /* The object has (apparently) been initialized but it is not
1605 * in use. It's ok to call abort on such an object, and there's
1606 * nothing to do. */
1607 return( PSA_SUCCESS );
1608 }
1609 else
Gilles Peskine8c9def32018-02-08 10:02:12 +01001610#if defined(MBEDTLS_CMAC_C)
Gilles Peskinefbfac682018-07-08 20:51:54 +02001611 if( operation->alg == PSA_ALG_CMAC )
1612 {
1613 mbedtls_cipher_free( &operation->ctx.cmac );
1614 }
1615 else
Gilles Peskine8c9def32018-02-08 10:02:12 +01001616#endif /* MBEDTLS_CMAC_C */
Gilles Peskine8c9def32018-02-08 10:02:12 +01001617#if defined(MBEDTLS_MD_C)
Gilles Peskinefbfac682018-07-08 20:51:54 +02001618 if( PSA_ALG_IS_HMAC( operation->alg ) )
1619 {
Gilles Peskine01126fa2018-07-12 17:04:55 +02001620 psa_hmac_abort_internal( &operation->ctx.hmac );
Gilles Peskinefbfac682018-07-08 20:51:54 +02001621 }
1622 else
Gilles Peskine8c9def32018-02-08 10:02:12 +01001623#endif /* MBEDTLS_MD_C */
Gilles Peskinefbfac682018-07-08 20:51:54 +02001624 {
1625 /* Sanity check (shouldn't happen: operation->alg should
1626 * always have been initialized to a valid value). */
1627 goto bad_state;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001628 }
Moran Peker41deec42018-04-04 15:43:05 +03001629
Gilles Peskine8c9def32018-02-08 10:02:12 +01001630 operation->alg = 0;
1631 operation->key_set = 0;
1632 operation->iv_set = 0;
1633 operation->iv_required = 0;
1634 operation->has_input = 0;
Gilles Peskine89167cb2018-07-08 20:12:23 +02001635 operation->is_sign = 0;
Moran Peker41deec42018-04-04 15:43:05 +03001636
Gilles Peskine8c9def32018-02-08 10:02:12 +01001637 return( PSA_SUCCESS );
Gilles Peskinefbfac682018-07-08 20:51:54 +02001638
1639bad_state:
1640 /* If abort is called on an uninitialized object, we can't trust
1641 * anything. Wipe the object in case it contains confidential data.
1642 * This may result in a memory leak if a pointer gets overwritten,
1643 * but it's too late to do anything about this. */
1644 memset( operation, 0, sizeof( *operation ) );
1645 return( PSA_ERROR_BAD_STATE );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001646}
1647
Gilles Peskinee3b07d82018-06-19 11:57:35 +02001648#if defined(MBEDTLS_CMAC_C)
Gilles Peskine89167cb2018-07-08 20:12:23 +02001649static int psa_cmac_setup( psa_mac_operation_t *operation,
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001650 size_t key_bits,
Gilles Peskine2f060a82018-12-04 17:12:32 +01001651 psa_key_slot_t *slot,
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001652 const mbedtls_cipher_info_t *cipher_info )
1653{
1654 int ret;
1655
1656 operation->mac_size = cipher_info->block_size;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001657
1658 ret = mbedtls_cipher_setup( &operation->ctx.cmac, cipher_info );
1659 if( ret != 0 )
1660 return( ret );
1661
1662 ret = mbedtls_cipher_cmac_starts( &operation->ctx.cmac,
1663 slot->data.raw.data,
1664 key_bits );
1665 return( ret );
1666}
Gilles Peskinee3b07d82018-06-19 11:57:35 +02001667#endif /* MBEDTLS_CMAC_C */
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001668
Gilles Peskine248051a2018-06-20 16:09:38 +02001669#if defined(MBEDTLS_MD_C)
Gilles Peskine01126fa2018-07-12 17:04:55 +02001670static psa_status_t psa_hmac_setup_internal( psa_hmac_internal_data *hmac,
1671 const uint8_t *key,
1672 size_t key_length,
1673 psa_algorithm_t hash_alg )
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001674{
Gilles Peskineb3e6e5d2018-06-18 22:16:43 +02001675 unsigned char ipad[PSA_HMAC_MAX_HASH_BLOCK_SIZE];
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001676 size_t i;
Gilles Peskine9aa369e2018-07-16 00:36:29 +02001677 size_t hash_size = PSA_HASH_SIZE( hash_alg );
Gilles Peskine01126fa2018-07-12 17:04:55 +02001678 size_t block_size = psa_get_hash_block_size( hash_alg );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001679 psa_status_t status;
1680
Gilles Peskine9aa369e2018-07-16 00:36:29 +02001681 /* Sanity checks on block_size, to guarantee that there won't be a buffer
1682 * overflow below. This should never trigger if the hash algorithm
1683 * is implemented correctly. */
1684 /* The size checks against the ipad and opad buffers cannot be written
1685 * `block_size > sizeof( ipad ) || block_size > sizeof( hmac->opad )`
1686 * because that triggers -Wlogical-op on GCC 7.3. */
1687 if( block_size > sizeof( ipad ) )
1688 return( PSA_ERROR_NOT_SUPPORTED );
1689 if( block_size > sizeof( hmac->opad ) )
1690 return( PSA_ERROR_NOT_SUPPORTED );
1691 if( block_size < hash_size )
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001692 return( PSA_ERROR_NOT_SUPPORTED );
1693
Gilles Peskined223b522018-06-11 18:12:58 +02001694 if( key_length > block_size )
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001695 {
Gilles Peskine1e6bfdf2018-07-17 16:22:47 +02001696 status = psa_hash_setup( &hmac->hash_ctx, hash_alg );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001697 if( status != PSA_SUCCESS )
Gilles Peskine1e6bfdf2018-07-17 16:22:47 +02001698 goto cleanup;
Gilles Peskine01126fa2018-07-12 17:04:55 +02001699 status = psa_hash_update( &hmac->hash_ctx, key, key_length );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001700 if( status != PSA_SUCCESS )
Gilles Peskineb8be2882018-07-17 16:24:34 +02001701 goto cleanup;
Gilles Peskine01126fa2018-07-12 17:04:55 +02001702 status = psa_hash_finish( &hmac->hash_ctx,
Gilles Peskined223b522018-06-11 18:12:58 +02001703 ipad, sizeof( ipad ), &key_length );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001704 if( status != PSA_SUCCESS )
Gilles Peskineb8be2882018-07-17 16:24:34 +02001705 goto cleanup;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001706 }
Gilles Peskine96889972018-07-12 17:07:03 +02001707 /* A 0-length key is not commonly used in HMAC when used as a MAC,
1708 * but it is permitted. It is common when HMAC is used in HKDF, for
1709 * example. Don't call `memcpy` in the 0-length because `key` could be
1710 * an invalid pointer which would make the behavior undefined. */
1711 else if( key_length != 0 )
Gilles Peskine01126fa2018-07-12 17:04:55 +02001712 memcpy( ipad, key, key_length );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001713
Gilles Peskined223b522018-06-11 18:12:58 +02001714 /* ipad contains the key followed by garbage. Xor and fill with 0x36
1715 * to create the ipad value. */
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001716 for( i = 0; i < key_length; i++ )
Gilles Peskined223b522018-06-11 18:12:58 +02001717 ipad[i] ^= 0x36;
1718 memset( ipad + key_length, 0x36, block_size - key_length );
1719
1720 /* Copy the key material from ipad to opad, flipping the requisite bits,
1721 * and filling the rest of opad with the requisite constant. */
1722 for( i = 0; i < key_length; i++ )
Gilles Peskine01126fa2018-07-12 17:04:55 +02001723 hmac->opad[i] = ipad[i] ^ 0x36 ^ 0x5C;
1724 memset( hmac->opad + key_length, 0x5C, block_size - key_length );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001725
Gilles Peskine01126fa2018-07-12 17:04:55 +02001726 status = psa_hash_setup( &hmac->hash_ctx, hash_alg );
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001727 if( status != PSA_SUCCESS )
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02001728 goto cleanup;
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001729
Gilles Peskine01126fa2018-07-12 17:04:55 +02001730 status = psa_hash_update( &hmac->hash_ctx, ipad, block_size );
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02001731
1732cleanup:
Gilles Peskine3f108122018-12-07 18:14:53 +01001733 mbedtls_platform_zeroize( ipad, key_length );
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02001734
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001735 return( status );
1736}
Gilles Peskine248051a2018-06-20 16:09:38 +02001737#endif /* MBEDTLS_MD_C */
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001738
Gilles Peskine89167cb2018-07-08 20:12:23 +02001739static psa_status_t psa_mac_setup( psa_mac_operation_t *operation,
Gilles Peskinec5487a82018-12-03 18:08:14 +01001740 psa_key_handle_t handle,
Gilles Peskine89167cb2018-07-08 20:12:23 +02001741 psa_algorithm_t alg,
1742 int is_sign )
Gilles Peskine8c9def32018-02-08 10:02:12 +01001743{
Gilles Peskine8c9def32018-02-08 10:02:12 +01001744 psa_status_t status;
Gilles Peskine2f060a82018-12-04 17:12:32 +01001745 psa_key_slot_t *slot;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001746 size_t key_bits;
Gilles Peskine89167cb2018-07-08 20:12:23 +02001747 psa_key_usage_t usage =
1748 is_sign ? PSA_KEY_USAGE_SIGN : PSA_KEY_USAGE_VERIFY;
Gilles Peskined911eb72018-08-14 15:18:45 +02001749 unsigned char truncated = PSA_MAC_TRUNCATED_LENGTH( alg );
Gilles Peskinee0e9c7c2018-10-17 18:28:05 +02001750 psa_algorithm_t full_length_alg = PSA_ALG_FULL_LENGTH_MAC( alg );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001751
Gilles Peskined911eb72018-08-14 15:18:45 +02001752 status = psa_mac_init( operation, full_length_alg );
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02001753 if( status != PSA_SUCCESS )
1754 return( status );
Gilles Peskine89167cb2018-07-08 20:12:23 +02001755 if( is_sign )
1756 operation->is_sign = 1;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001757
Gilles Peskinec5487a82018-12-03 18:08:14 +01001758 status = psa_get_key_from_slot( handle, &slot, usage, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02001759 if( status != PSA_SUCCESS )
Gilles Peskinefbfac682018-07-08 20:51:54 +02001760 goto exit;
Gilles Peskineab1d7ab2018-07-06 16:07:47 +02001761 key_bits = psa_get_key_bits( slot );
1762
Gilles Peskine8c9def32018-02-08 10:02:12 +01001763#if defined(MBEDTLS_CMAC_C)
Gilles Peskined911eb72018-08-14 15:18:45 +02001764 if( full_length_alg == PSA_ALG_CMAC )
Gilles Peskinefbfac682018-07-08 20:51:54 +02001765 {
1766 const mbedtls_cipher_info_t *cipher_info =
Gilles Peskined911eb72018-08-14 15:18:45 +02001767 mbedtls_cipher_info_from_psa( full_length_alg,
1768 slot->type, key_bits, NULL );
Gilles Peskinefbfac682018-07-08 20:51:54 +02001769 int ret;
1770 if( cipher_info == NULL )
1771 {
1772 status = PSA_ERROR_NOT_SUPPORTED;
1773 goto exit;
1774 }
1775 operation->mac_size = cipher_info->block_size;
1776 ret = psa_cmac_setup( operation, key_bits, slot, cipher_info );
1777 status = mbedtls_to_psa_error( ret );
1778 }
1779 else
Gilles Peskine8c9def32018-02-08 10:02:12 +01001780#endif /* MBEDTLS_CMAC_C */
Gilles Peskine8c9def32018-02-08 10:02:12 +01001781#if defined(MBEDTLS_MD_C)
Gilles Peskined911eb72018-08-14 15:18:45 +02001782 if( PSA_ALG_IS_HMAC( full_length_alg ) )
Gilles Peskinefbfac682018-07-08 20:51:54 +02001783 {
Gilles Peskine00709fa2018-08-22 18:25:41 +02001784 psa_algorithm_t hash_alg = PSA_ALG_HMAC_GET_HASH( alg );
Gilles Peskine01126fa2018-07-12 17:04:55 +02001785 if( hash_alg == 0 )
1786 {
1787 status = PSA_ERROR_NOT_SUPPORTED;
1788 goto exit;
1789 }
Gilles Peskine9aa369e2018-07-16 00:36:29 +02001790
1791 operation->mac_size = PSA_HASH_SIZE( hash_alg );
1792 /* Sanity check. This shouldn't fail on a valid configuration. */
1793 if( operation->mac_size == 0 ||
1794 operation->mac_size > sizeof( operation->ctx.hmac.opad ) )
1795 {
1796 status = PSA_ERROR_NOT_SUPPORTED;
1797 goto exit;
1798 }
1799
Gilles Peskine01126fa2018-07-12 17:04:55 +02001800 if( slot->type != PSA_KEY_TYPE_HMAC )
1801 {
1802 status = PSA_ERROR_INVALID_ARGUMENT;
1803 goto exit;
1804 }
Gilles Peskine9aa369e2018-07-16 00:36:29 +02001805
Gilles Peskine01126fa2018-07-12 17:04:55 +02001806 status = psa_hmac_setup_internal( &operation->ctx.hmac,
1807 slot->data.raw.data,
1808 slot->data.raw.bytes,
1809 hash_alg );
Gilles Peskinefbfac682018-07-08 20:51:54 +02001810 }
1811 else
Gilles Peskine8c9def32018-02-08 10:02:12 +01001812#endif /* MBEDTLS_MD_C */
Gilles Peskinefbfac682018-07-08 20:51:54 +02001813 {
Jaeden Amero82df32e2018-11-23 15:11:20 +00001814 (void) key_bits;
Gilles Peskinefbfac682018-07-08 20:51:54 +02001815 status = PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001816 }
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001817
Gilles Peskined911eb72018-08-14 15:18:45 +02001818 if( truncated == 0 )
1819 {
1820 /* The "normal" case: untruncated algorithm. Nothing to do. */
1821 }
1822 else if( truncated < 4 )
1823 {
Gilles Peskine6d72ff92018-08-21 14:55:08 +02001824 /* A very short MAC is too short for security since it can be
1825 * brute-forced. Ancient protocols with 32-bit MACs do exist,
1826 * so we make this our minimum, even though 32 bits is still
1827 * too small for security. */
Gilles Peskined911eb72018-08-14 15:18:45 +02001828 status = PSA_ERROR_NOT_SUPPORTED;
1829 }
1830 else if( truncated > operation->mac_size )
1831 {
1832 /* It's impossible to "truncate" to a larger length. */
1833 status = PSA_ERROR_INVALID_ARGUMENT;
1834 }
1835 else
1836 operation->mac_size = truncated;
1837
Gilles Peskinefbfac682018-07-08 20:51:54 +02001838exit:
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001839 if( status != PSA_SUCCESS )
Gilles Peskine8c9def32018-02-08 10:02:12 +01001840 {
Gilles Peskine6a0a44e2018-06-11 17:42:48 +02001841 psa_mac_abort( operation );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001842 }
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001843 else
1844 {
Gilles Peskine7e454bc2018-06-11 17:26:17 +02001845 operation->key_set = 1;
1846 }
1847 return( status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001848}
1849
Gilles Peskine89167cb2018-07-08 20:12:23 +02001850psa_status_t psa_mac_sign_setup( psa_mac_operation_t *operation,
Gilles Peskinec5487a82018-12-03 18:08:14 +01001851 psa_key_handle_t handle,
Gilles Peskine89167cb2018-07-08 20:12:23 +02001852 psa_algorithm_t alg )
1853{
Gilles Peskinec5487a82018-12-03 18:08:14 +01001854 return( psa_mac_setup( operation, handle, alg, 1 ) );
Gilles Peskine89167cb2018-07-08 20:12:23 +02001855}
1856
1857psa_status_t psa_mac_verify_setup( psa_mac_operation_t *operation,
Gilles Peskinec5487a82018-12-03 18:08:14 +01001858 psa_key_handle_t handle,
Gilles Peskine89167cb2018-07-08 20:12:23 +02001859 psa_algorithm_t alg )
1860{
Gilles Peskinec5487a82018-12-03 18:08:14 +01001861 return( psa_mac_setup( operation, handle, alg, 0 ) );
Gilles Peskine89167cb2018-07-08 20:12:23 +02001862}
1863
Gilles Peskine8c9def32018-02-08 10:02:12 +01001864psa_status_t psa_mac_update( psa_mac_operation_t *operation,
1865 const uint8_t *input,
1866 size_t input_length )
1867{
Gilles Peskinefbfac682018-07-08 20:51:54 +02001868 psa_status_t status = PSA_ERROR_BAD_STATE;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001869 if( ! operation->key_set )
Gilles Peskinefbfac682018-07-08 20:51:54 +02001870 goto cleanup;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001871 if( operation->iv_required && ! operation->iv_set )
Gilles Peskinefbfac682018-07-08 20:51:54 +02001872 goto cleanup;
Gilles Peskine8c9def32018-02-08 10:02:12 +01001873 operation->has_input = 1;
1874
Gilles Peskine8c9def32018-02-08 10:02:12 +01001875#if defined(MBEDTLS_CMAC_C)
Gilles Peskinefbfac682018-07-08 20:51:54 +02001876 if( operation->alg == PSA_ALG_CMAC )
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001877 {
Gilles Peskinefbfac682018-07-08 20:51:54 +02001878 int ret = mbedtls_cipher_cmac_update( &operation->ctx.cmac,
1879 input, input_length );
1880 status = mbedtls_to_psa_error( ret );
1881 }
1882 else
1883#endif /* MBEDTLS_CMAC_C */
1884#if defined(MBEDTLS_MD_C)
1885 if( PSA_ALG_IS_HMAC( operation->alg ) )
1886 {
1887 status = psa_hash_update( &operation->ctx.hmac.hash_ctx, input,
1888 input_length );
1889 }
1890 else
1891#endif /* MBEDTLS_MD_C */
1892 {
1893 /* This shouldn't happen if `operation` was initialized by
1894 * a setup function. */
1895 status = PSA_ERROR_BAD_STATE;
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03001896 }
1897
Gilles Peskinefbfac682018-07-08 20:51:54 +02001898cleanup:
1899 if( status != PSA_SUCCESS )
1900 psa_mac_abort( operation );
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02001901 return( status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001902}
1903
Gilles Peskine01126fa2018-07-12 17:04:55 +02001904#if defined(MBEDTLS_MD_C)
1905static psa_status_t psa_hmac_finish_internal( psa_hmac_internal_data *hmac,
1906 uint8_t *mac,
1907 size_t mac_size )
1908{
1909 unsigned char tmp[MBEDTLS_MD_MAX_SIZE];
1910 psa_algorithm_t hash_alg = hmac->hash_ctx.alg;
1911 size_t hash_size = 0;
1912 size_t block_size = psa_get_hash_block_size( hash_alg );
1913 psa_status_t status;
1914
Gilles Peskine01126fa2018-07-12 17:04:55 +02001915 status = psa_hash_finish( &hmac->hash_ctx, tmp, sizeof( tmp ), &hash_size );
1916 if( status != PSA_SUCCESS )
1917 return( status );
1918 /* From here on, tmp needs to be wiped. */
1919
1920 status = psa_hash_setup( &hmac->hash_ctx, hash_alg );
1921 if( status != PSA_SUCCESS )
1922 goto exit;
1923
1924 status = psa_hash_update( &hmac->hash_ctx, hmac->opad, block_size );
1925 if( status != PSA_SUCCESS )
1926 goto exit;
1927
1928 status = psa_hash_update( &hmac->hash_ctx, tmp, hash_size );
1929 if( status != PSA_SUCCESS )
1930 goto exit;
1931
Gilles Peskined911eb72018-08-14 15:18:45 +02001932 status = psa_hash_finish( &hmac->hash_ctx, tmp, sizeof( tmp ), &hash_size );
1933 if( status != PSA_SUCCESS )
1934 goto exit;
1935
1936 memcpy( mac, tmp, mac_size );
Gilles Peskine01126fa2018-07-12 17:04:55 +02001937
1938exit:
Gilles Peskine3f108122018-12-07 18:14:53 +01001939 mbedtls_platform_zeroize( tmp, hash_size );
Gilles Peskine01126fa2018-07-12 17:04:55 +02001940 return( status );
1941}
1942#endif /* MBEDTLS_MD_C */
1943
mohammad16036df908f2018-04-02 08:34:15 -07001944static psa_status_t psa_mac_finish_internal( psa_mac_operation_t *operation,
Gilles Peskine2d277862018-06-18 15:41:12 +02001945 uint8_t *mac,
Gilles Peskine5d0b8642018-07-08 20:35:02 +02001946 size_t mac_size )
Gilles Peskine8c9def32018-02-08 10:02:12 +01001947{
Gilles Peskine1d96fff2018-07-02 12:15:39 +02001948 if( ! operation->key_set )
1949 return( PSA_ERROR_BAD_STATE );
1950 if( operation->iv_required && ! operation->iv_set )
1951 return( PSA_ERROR_BAD_STATE );
1952
Gilles Peskine8c9def32018-02-08 10:02:12 +01001953 if( mac_size < operation->mac_size )
1954 return( PSA_ERROR_BUFFER_TOO_SMALL );
1955
Gilles Peskine8c9def32018-02-08 10:02:12 +01001956#if defined(MBEDTLS_CMAC_C)
Gilles Peskinefbfac682018-07-08 20:51:54 +02001957 if( operation->alg == PSA_ALG_CMAC )
1958 {
Gilles Peskined911eb72018-08-14 15:18:45 +02001959 uint8_t tmp[PSA_MAX_BLOCK_CIPHER_BLOCK_SIZE];
1960 int ret = mbedtls_cipher_cmac_finish( &operation->ctx.cmac, tmp );
1961 if( ret == 0 )
Gilles Peskine87b0ac42018-08-21 14:55:49 +02001962 memcpy( mac, tmp, operation->mac_size );
Gilles Peskine3f108122018-12-07 18:14:53 +01001963 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
Gilles Peskinefbfac682018-07-08 20:51:54 +02001964 return( mbedtls_to_psa_error( ret ) );
Gilles Peskine8c9def32018-02-08 10:02:12 +01001965 }
Gilles Peskinefbfac682018-07-08 20:51:54 +02001966 else
1967#endif /* MBEDTLS_CMAC_C */
1968#if defined(MBEDTLS_MD_C)
1969 if( PSA_ALG_IS_HMAC( operation->alg ) )
1970 {
Gilles Peskine01126fa2018-07-12 17:04:55 +02001971 return( psa_hmac_finish_internal( &operation->ctx.hmac,
Gilles Peskined911eb72018-08-14 15:18:45 +02001972 mac, operation->mac_size ) );
Gilles Peskinefbfac682018-07-08 20:51:54 +02001973 }
1974 else
1975#endif /* MBEDTLS_MD_C */
1976 {
1977 /* This shouldn't happen if `operation` was initialized by
1978 * a setup function. */
1979 return( PSA_ERROR_BAD_STATE );
1980 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01001981}
1982
Gilles Peskineacd4be32018-07-08 19:56:25 +02001983psa_status_t psa_mac_sign_finish( psa_mac_operation_t *operation,
1984 uint8_t *mac,
1985 size_t mac_size,
1986 size_t *mac_length )
mohammad16036df908f2018-04-02 08:34:15 -07001987{
Gilles Peskine5d0b8642018-07-08 20:35:02 +02001988 psa_status_t status;
1989
1990 /* Fill the output buffer with something that isn't a valid mac
1991 * (barring an attack on the mac and deliberately-crafted input),
1992 * in case the caller doesn't check the return status properly. */
1993 *mac_length = mac_size;
1994 /* If mac_size is 0 then mac may be NULL and then the
1995 * call to memset would have undefined behavior. */
1996 if( mac_size != 0 )
1997 memset( mac, '!', mac_size );
1998
Gilles Peskine89167cb2018-07-08 20:12:23 +02001999 if( ! operation->is_sign )
2000 {
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002001 status = PSA_ERROR_BAD_STATE;
2002 goto cleanup;
Gilles Peskine89167cb2018-07-08 20:12:23 +02002003 }
mohammad16036df908f2018-04-02 08:34:15 -07002004
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002005 status = psa_mac_finish_internal( operation, mac, mac_size );
2006
2007cleanup:
2008 if( status == PSA_SUCCESS )
2009 {
2010 status = psa_mac_abort( operation );
2011 if( status == PSA_SUCCESS )
2012 *mac_length = operation->mac_size;
2013 else
2014 memset( mac, '!', mac_size );
2015 }
2016 else
2017 psa_mac_abort( operation );
2018 return( status );
mohammad16036df908f2018-04-02 08:34:15 -07002019}
2020
Gilles Peskineacd4be32018-07-08 19:56:25 +02002021psa_status_t psa_mac_verify_finish( psa_mac_operation_t *operation,
2022 const uint8_t *mac,
2023 size_t mac_length )
Gilles Peskine8c9def32018-02-08 10:02:12 +01002024{
Gilles Peskine828ed142018-06-18 23:25:51 +02002025 uint8_t actual_mac[PSA_MAC_MAX_SIZE];
mohammad16036df908f2018-04-02 08:34:15 -07002026 psa_status_t status;
2027
Gilles Peskine89167cb2018-07-08 20:12:23 +02002028 if( operation->is_sign )
2029 {
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002030 status = PSA_ERROR_BAD_STATE;
2031 goto cleanup;
2032 }
2033 if( operation->mac_size != mac_length )
2034 {
2035 status = PSA_ERROR_INVALID_SIGNATURE;
2036 goto cleanup;
Gilles Peskine89167cb2018-07-08 20:12:23 +02002037 }
mohammad16036df908f2018-04-02 08:34:15 -07002038
2039 status = psa_mac_finish_internal( operation,
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002040 actual_mac, sizeof( actual_mac ) );
2041
2042 if( safer_memcmp( mac, actual_mac, mac_length ) != 0 )
2043 status = PSA_ERROR_INVALID_SIGNATURE;
2044
2045cleanup:
2046 if( status == PSA_SUCCESS )
2047 status = psa_mac_abort( operation );
2048 else
2049 psa_mac_abort( operation );
2050
Gilles Peskine3f108122018-12-07 18:14:53 +01002051 mbedtls_platform_zeroize( actual_mac, sizeof( actual_mac ) );
Gilles Peskined911eb72018-08-14 15:18:45 +02002052
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002053 return( status );
Gilles Peskine8c9def32018-02-08 10:02:12 +01002054}
2055
2056
Gilles Peskine20035e32018-02-03 22:44:14 +01002057
Gilles Peskine20035e32018-02-03 22:44:14 +01002058/****************************************************************/
2059/* Asymmetric cryptography */
2060/****************************************************************/
2061
Gilles Peskine2b450e32018-06-27 15:42:46 +02002062#if defined(MBEDTLS_RSA_C)
Gilles Peskine8b18a4f2018-06-08 16:34:46 +02002063/* Decode the hash algorithm from alg and store the mbedtls encoding in
Gilles Peskine71ac7b12018-06-29 23:36:35 +02002064 * md_alg. Verify that the hash length is acceptable. */
Gilles Peskine8b18a4f2018-06-08 16:34:46 +02002065static psa_status_t psa_rsa_decode_md_type( psa_algorithm_t alg,
2066 size_t hash_length,
2067 mbedtls_md_type_t *md_alg )
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03002068{
Gilles Peskine7ed29c52018-06-26 15:50:08 +02002069 psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH( alg );
Gilles Peskine61b91d42018-06-08 16:09:36 +02002070 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
Gilles Peskine71ac7b12018-06-29 23:36:35 +02002071 *md_alg = mbedtls_md_get_type( md_info );
2072
2073 /* The Mbed TLS RSA module uses an unsigned int for hash length
2074 * parameters. Validate that it fits so that we don't risk an
2075 * overflow later. */
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03002076#if SIZE_MAX > UINT_MAX
Gilles Peskine71ac7b12018-06-29 23:36:35 +02002077 if( hash_length > UINT_MAX )
2078 return( PSA_ERROR_INVALID_ARGUMENT );
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03002079#endif
Gilles Peskine71ac7b12018-06-29 23:36:35 +02002080
2081#if defined(MBEDTLS_PKCS1_V15)
2082 /* For PKCS#1 v1.5 signature, if using a hash, the hash length
2083 * must be correct. */
2084 if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) &&
2085 alg != PSA_ALG_RSA_PKCS1V15_SIGN_RAW )
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03002086 {
Gilles Peskine71ac7b12018-06-29 23:36:35 +02002087 if( md_info == NULL )
2088 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine61b91d42018-06-08 16:09:36 +02002089 if( mbedtls_md_get_size( md_info ) != hash_length )
2090 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine71ac7b12018-06-29 23:36:35 +02002091 }
2092#endif /* MBEDTLS_PKCS1_V15 */
2093
2094#if defined(MBEDTLS_PKCS1_V21)
2095 /* PSS requires a hash internally. */
2096 if( PSA_ALG_IS_RSA_PSS( alg ) )
2097 {
Gilles Peskine61b91d42018-06-08 16:09:36 +02002098 if( md_info == NULL )
2099 return( PSA_ERROR_NOT_SUPPORTED );
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03002100 }
Gilles Peskine71ac7b12018-06-29 23:36:35 +02002101#endif /* MBEDTLS_PKCS1_V21 */
2102
Gilles Peskine61b91d42018-06-08 16:09:36 +02002103 return( PSA_SUCCESS );
Nir Sonnenschein4db79eb2018-06-04 16:40:31 +03002104}
2105
Gilles Peskine2b450e32018-06-27 15:42:46 +02002106static psa_status_t psa_rsa_sign( mbedtls_rsa_context *rsa,
2107 psa_algorithm_t alg,
2108 const uint8_t *hash,
2109 size_t hash_length,
2110 uint8_t *signature,
2111 size_t signature_size,
2112 size_t *signature_length )
2113{
2114 psa_status_t status;
2115 int ret;
2116 mbedtls_md_type_t md_alg;
2117
2118 status = psa_rsa_decode_md_type( alg, hash_length, &md_alg );
2119 if( status != PSA_SUCCESS )
2120 return( status );
2121
Gilles Peskine630a18a2018-06-29 17:49:35 +02002122 if( signature_size < mbedtls_rsa_get_len( rsa ) )
Gilles Peskine2b450e32018-06-27 15:42:46 +02002123 return( PSA_ERROR_BUFFER_TOO_SMALL );
2124
2125#if defined(MBEDTLS_PKCS1_V15)
2126 if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) )
2127 {
2128 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V15,
2129 MBEDTLS_MD_NONE );
2130 ret = mbedtls_rsa_pkcs1_sign( rsa,
2131 mbedtls_ctr_drbg_random,
2132 &global_data.ctr_drbg,
2133 MBEDTLS_RSA_PRIVATE,
Jaeden Amerobbf97e32018-06-26 14:20:51 +01002134 md_alg,
2135 (unsigned int) hash_length,
2136 hash,
Gilles Peskine2b450e32018-06-27 15:42:46 +02002137 signature );
2138 }
2139 else
2140#endif /* MBEDTLS_PKCS1_V15 */
2141#if defined(MBEDTLS_PKCS1_V21)
2142 if( PSA_ALG_IS_RSA_PSS( alg ) )
2143 {
2144 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
2145 ret = mbedtls_rsa_rsassa_pss_sign( rsa,
2146 mbedtls_ctr_drbg_random,
2147 &global_data.ctr_drbg,
2148 MBEDTLS_RSA_PRIVATE,
Gilles Peskine71ac7b12018-06-29 23:36:35 +02002149 MBEDTLS_MD_NONE,
Jaeden Amerobbf97e32018-06-26 14:20:51 +01002150 (unsigned int) hash_length,
2151 hash,
Gilles Peskine2b450e32018-06-27 15:42:46 +02002152 signature );
2153 }
2154 else
2155#endif /* MBEDTLS_PKCS1_V21 */
2156 {
2157 return( PSA_ERROR_INVALID_ARGUMENT );
2158 }
2159
2160 if( ret == 0 )
Gilles Peskine630a18a2018-06-29 17:49:35 +02002161 *signature_length = mbedtls_rsa_get_len( rsa );
Gilles Peskine2b450e32018-06-27 15:42:46 +02002162 return( mbedtls_to_psa_error( ret ) );
2163}
2164
2165static psa_status_t psa_rsa_verify( mbedtls_rsa_context *rsa,
2166 psa_algorithm_t alg,
2167 const uint8_t *hash,
2168 size_t hash_length,
2169 const uint8_t *signature,
2170 size_t signature_length )
2171{
2172 psa_status_t status;
2173 int ret;
2174 mbedtls_md_type_t md_alg;
2175
2176 status = psa_rsa_decode_md_type( alg, hash_length, &md_alg );
2177 if( status != PSA_SUCCESS )
2178 return( status );
2179
Gilles Peskine630a18a2018-06-29 17:49:35 +02002180 if( signature_length < mbedtls_rsa_get_len( rsa ) )
Gilles Peskine2b450e32018-06-27 15:42:46 +02002181 return( PSA_ERROR_BUFFER_TOO_SMALL );
2182
2183#if defined(MBEDTLS_PKCS1_V15)
2184 if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) )
2185 {
2186 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V15,
2187 MBEDTLS_MD_NONE );
2188 ret = mbedtls_rsa_pkcs1_verify( rsa,
2189 mbedtls_ctr_drbg_random,
2190 &global_data.ctr_drbg,
2191 MBEDTLS_RSA_PUBLIC,
2192 md_alg,
Jaeden Amerobbf97e32018-06-26 14:20:51 +01002193 (unsigned int) hash_length,
Gilles Peskine2b450e32018-06-27 15:42:46 +02002194 hash,
2195 signature );
2196 }
2197 else
2198#endif /* MBEDTLS_PKCS1_V15 */
2199#if defined(MBEDTLS_PKCS1_V21)
2200 if( PSA_ALG_IS_RSA_PSS( alg ) )
2201 {
2202 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
2203 ret = mbedtls_rsa_rsassa_pss_verify( rsa,
2204 mbedtls_ctr_drbg_random,
2205 &global_data.ctr_drbg,
2206 MBEDTLS_RSA_PUBLIC,
Gilles Peskine71ac7b12018-06-29 23:36:35 +02002207 MBEDTLS_MD_NONE,
Jaeden Amerobbf97e32018-06-26 14:20:51 +01002208 (unsigned int) hash_length,
2209 hash,
Gilles Peskine2b450e32018-06-27 15:42:46 +02002210 signature );
2211 }
2212 else
2213#endif /* MBEDTLS_PKCS1_V21 */
2214 {
2215 return( PSA_ERROR_INVALID_ARGUMENT );
2216 }
Gilles Peskineef12c632018-09-13 20:37:48 +02002217
2218 /* Mbed TLS distinguishes "invalid padding" from "valid padding but
2219 * the rest of the signature is invalid". This has little use in
2220 * practice and PSA doesn't report this distinction. */
2221 if( ret == MBEDTLS_ERR_RSA_INVALID_PADDING )
2222 return( PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskine2b450e32018-06-27 15:42:46 +02002223 return( mbedtls_to_psa_error( ret ) );
2224}
2225#endif /* MBEDTLS_RSA_C */
2226
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002227#if defined(MBEDTLS_ECDSA_C)
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002228/* `ecp` cannot be const because `ecp->grp` needs to be non-const
2229 * for mbedtls_ecdsa_sign() and mbedtls_ecdsa_sign_det()
2230 * (even though these functions don't modify it). */
2231static psa_status_t psa_ecdsa_sign( mbedtls_ecp_keypair *ecp,
2232 psa_algorithm_t alg,
2233 const uint8_t *hash,
2234 size_t hash_length,
2235 uint8_t *signature,
2236 size_t signature_size,
2237 size_t *signature_length )
2238{
2239 int ret;
2240 mbedtls_mpi r, s;
Gilles Peskineeae6eee2018-06-28 13:56:01 +02002241 size_t curve_bytes = PSA_BITS_TO_BYTES( ecp->grp.pbits );
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002242 mbedtls_mpi_init( &r );
2243 mbedtls_mpi_init( &s );
2244
Gilles Peskineeae6eee2018-06-28 13:56:01 +02002245 if( signature_size < 2 * curve_bytes )
2246 {
2247 ret = MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL;
2248 goto cleanup;
2249 }
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002250
Gilles Peskinea05219c2018-11-16 16:02:56 +01002251#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002252 if( PSA_ALG_DSA_IS_DETERMINISTIC( alg ) )
2253 {
2254 psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH( alg );
2255 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
2256 mbedtls_md_type_t md_alg = mbedtls_md_get_type( md_info );
2257 MBEDTLS_MPI_CHK( mbedtls_ecdsa_sign_det( &ecp->grp, &r, &s, &ecp->d,
2258 hash, hash_length,
2259 md_alg ) );
2260 }
2261 else
Gilles Peskinea05219c2018-11-16 16:02:56 +01002262#endif /* MBEDTLS_ECDSA_DETERMINISTIC */
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002263 {
Gilles Peskinea05219c2018-11-16 16:02:56 +01002264 (void) alg;
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002265 MBEDTLS_MPI_CHK( mbedtls_ecdsa_sign( &ecp->grp, &r, &s, &ecp->d,
2266 hash, hash_length,
2267 mbedtls_ctr_drbg_random,
2268 &global_data.ctr_drbg ) );
2269 }
Gilles Peskineeae6eee2018-06-28 13:56:01 +02002270
2271 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &r,
2272 signature,
2273 curve_bytes ) );
2274 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &s,
2275 signature + curve_bytes,
2276 curve_bytes ) );
2277
2278cleanup:
2279 mbedtls_mpi_free( &r );
2280 mbedtls_mpi_free( &s );
2281 if( ret == 0 )
2282 *signature_length = 2 * curve_bytes;
Gilles Peskineeae6eee2018-06-28 13:56:01 +02002283 return( mbedtls_to_psa_error( ret ) );
2284}
2285
2286static psa_status_t psa_ecdsa_verify( mbedtls_ecp_keypair *ecp,
2287 const uint8_t *hash,
2288 size_t hash_length,
2289 const uint8_t *signature,
2290 size_t signature_length )
2291{
2292 int ret;
2293 mbedtls_mpi r, s;
2294 size_t curve_bytes = PSA_BITS_TO_BYTES( ecp->grp.pbits );
2295 mbedtls_mpi_init( &r );
2296 mbedtls_mpi_init( &s );
2297
2298 if( signature_length != 2 * curve_bytes )
2299 return( PSA_ERROR_INVALID_SIGNATURE );
2300
2301 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &r,
2302 signature,
2303 curve_bytes ) );
2304 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &s,
2305 signature + curve_bytes,
2306 curve_bytes ) );
2307
2308 ret = mbedtls_ecdsa_verify( &ecp->grp, hash, hash_length,
2309 &ecp->Q, &r, &s );
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002310
2311cleanup:
2312 mbedtls_mpi_free( &r );
2313 mbedtls_mpi_free( &s );
2314 return( mbedtls_to_psa_error( ret ) );
2315}
2316#endif /* MBEDTLS_ECDSA_C */
2317
Gilles Peskinec5487a82018-12-03 18:08:14 +01002318psa_status_t psa_asymmetric_sign( psa_key_handle_t handle,
Gilles Peskine61b91d42018-06-08 16:09:36 +02002319 psa_algorithm_t alg,
2320 const uint8_t *hash,
2321 size_t hash_length,
Gilles Peskine61b91d42018-06-08 16:09:36 +02002322 uint8_t *signature,
2323 size_t signature_size,
2324 size_t *signature_length )
Gilles Peskine20035e32018-02-03 22:44:14 +01002325{
Gilles Peskine2f060a82018-12-04 17:12:32 +01002326 psa_key_slot_t *slot;
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02002327 psa_status_t status;
2328
2329 *signature_length = signature_size;
2330
Gilles Peskinec5487a82018-12-03 18:08:14 +01002331 status = psa_get_key_from_slot( handle, &slot, PSA_KEY_USAGE_SIGN, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02002332 if( status != PSA_SUCCESS )
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02002333 goto exit;
Gilles Peskine20035e32018-02-03 22:44:14 +01002334 if( ! PSA_KEY_TYPE_IS_KEYPAIR( slot->type ) )
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02002335 {
2336 status = PSA_ERROR_INVALID_ARGUMENT;
2337 goto exit;
2338 }
Gilles Peskine20035e32018-02-03 22:44:14 +01002339
Gilles Peskine20035e32018-02-03 22:44:14 +01002340#if defined(MBEDTLS_RSA_C)
2341 if( slot->type == PSA_KEY_TYPE_RSA_KEYPAIR )
2342 {
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02002343 status = psa_rsa_sign( slot->data.rsa,
2344 alg,
2345 hash, hash_length,
2346 signature, signature_size,
2347 signature_length );
Gilles Peskine20035e32018-02-03 22:44:14 +01002348 }
2349 else
2350#endif /* defined(MBEDTLS_RSA_C) */
2351#if defined(MBEDTLS_ECP_C)
2352 if( PSA_KEY_TYPE_IS_ECC( slot->type ) )
2353 {
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002354#if defined(MBEDTLS_ECDSA_C)
Gilles Peskinea05219c2018-11-16 16:02:56 +01002355 if(
2356#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
2357 PSA_ALG_IS_ECDSA( alg )
2358#else
2359 PSA_ALG_IS_RANDOMIZED_ECDSA( alg )
2360#endif
2361 )
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02002362 status = psa_ecdsa_sign( slot->data.ecp,
2363 alg,
2364 hash, hash_length,
2365 signature, signature_size,
2366 signature_length );
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002367 else
2368#endif /* defined(MBEDTLS_ECDSA_C) */
2369 {
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02002370 status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002371 }
itayzafrir5c753392018-05-08 11:18:38 +03002372 }
2373 else
2374#endif /* defined(MBEDTLS_ECP_C) */
2375 {
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02002376 status = PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine20035e32018-02-03 22:44:14 +01002377 }
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02002378
2379exit:
2380 /* Fill the unused part of the output buffer (the whole buffer on error,
2381 * the trailing part on success) with something that isn't a valid mac
2382 * (barring an attack on the mac and deliberately-crafted input),
2383 * in case the caller doesn't check the return status properly. */
2384 if( status == PSA_SUCCESS )
2385 memset( signature + *signature_length, '!',
2386 signature_size - *signature_length );
Gilles Peskine46f1fd72018-06-28 19:31:31 +02002387 else if( signature_size != 0 )
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02002388 memset( signature, '!', signature_size );
Gilles Peskine46f1fd72018-06-28 19:31:31 +02002389 /* If signature_size is 0 then we have nothing to do. We must not call
2390 * memset because signature may be NULL in this case. */
Gilles Peskinea26ff6a2018-06-28 12:21:19 +02002391 return( status );
itayzafrir5c753392018-05-08 11:18:38 +03002392}
2393
Gilles Peskinec5487a82018-12-03 18:08:14 +01002394psa_status_t psa_asymmetric_verify( psa_key_handle_t handle,
itayzafrir5c753392018-05-08 11:18:38 +03002395 psa_algorithm_t alg,
2396 const uint8_t *hash,
2397 size_t hash_length,
Gilles Peskinee9191ff2018-06-27 14:58:41 +02002398 const uint8_t *signature,
Gilles Peskine526fab02018-06-27 18:19:40 +02002399 size_t signature_length )
itayzafrir5c753392018-05-08 11:18:38 +03002400{
Gilles Peskine2f060a82018-12-04 17:12:32 +01002401 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02002402 psa_status_t status;
Gilles Peskine2b450e32018-06-27 15:42:46 +02002403
Gilles Peskinec5487a82018-12-03 18:08:14 +01002404 status = psa_get_key_from_slot( handle, &slot, PSA_KEY_USAGE_VERIFY, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02002405 if( status != PSA_SUCCESS )
2406 return( status );
itayzafrir5c753392018-05-08 11:18:38 +03002407
Gilles Peskine61b91d42018-06-08 16:09:36 +02002408#if defined(MBEDTLS_RSA_C)
Gilles Peskined8008d62018-06-29 19:51:51 +02002409 if( PSA_KEY_TYPE_IS_RSA( slot->type ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002410 {
Gilles Peskine2b450e32018-06-27 15:42:46 +02002411 return( psa_rsa_verify( slot->data.rsa,
2412 alg,
2413 hash, hash_length,
2414 signature, signature_length ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002415 }
2416 else
2417#endif /* defined(MBEDTLS_RSA_C) */
itayzafrir5c753392018-05-08 11:18:38 +03002418#if defined(MBEDTLS_ECP_C)
2419 if( PSA_KEY_TYPE_IS_ECC( slot->type ) )
2420 {
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002421#if defined(MBEDTLS_ECDSA_C)
2422 if( PSA_ALG_IS_ECDSA( alg ) )
Gilles Peskineeae6eee2018-06-28 13:56:01 +02002423 return( psa_ecdsa_verify( slot->data.ecp,
2424 hash, hash_length,
2425 signature, signature_length ) );
Gilles Peskinea81d85b2018-06-26 16:10:23 +02002426 else
2427#endif /* defined(MBEDTLS_ECDSA_C) */
2428 {
2429 return( PSA_ERROR_INVALID_ARGUMENT );
2430 }
itayzafrir5c753392018-05-08 11:18:38 +03002431 }
Gilles Peskine20035e32018-02-03 22:44:14 +01002432 else
2433#endif /* defined(MBEDTLS_ECP_C) */
2434 {
2435 return( PSA_ERROR_NOT_SUPPORTED );
2436 }
2437}
2438
Gilles Peskine072ac562018-06-30 00:21:29 +02002439#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PKCS1_V21)
2440static void psa_rsa_oaep_set_padding_mode( psa_algorithm_t alg,
2441 mbedtls_rsa_context *rsa )
2442{
2443 psa_algorithm_t hash_alg = PSA_ALG_RSA_OAEP_GET_HASH( alg );
2444 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
2445 mbedtls_md_type_t md_alg = mbedtls_md_get_type( md_info );
2446 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
2447}
2448#endif /* defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PKCS1_V21) */
2449
Gilles Peskinec5487a82018-12-03 18:08:14 +01002450psa_status_t psa_asymmetric_encrypt( psa_key_handle_t handle,
Gilles Peskine61b91d42018-06-08 16:09:36 +02002451 psa_algorithm_t alg,
2452 const uint8_t *input,
2453 size_t input_length,
2454 const uint8_t *salt,
2455 size_t salt_length,
2456 uint8_t *output,
2457 size_t output_size,
2458 size_t *output_length )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002459{
Gilles Peskine2f060a82018-12-04 17:12:32 +01002460 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02002461 psa_status_t status;
2462
Darryl Green5cc689a2018-07-24 15:34:10 +01002463 (void) input;
2464 (void) input_length;
2465 (void) salt;
2466 (void) output;
2467 (void) output_size;
2468
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03002469 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002470
Gilles Peskineb3fc05d2018-06-30 19:04:35 +02002471 if( ! PSA_ALG_IS_RSA_OAEP( alg ) && salt_length != 0 )
2472 return( PSA_ERROR_INVALID_ARGUMENT );
2473
Gilles Peskinec5487a82018-12-03 18:08:14 +01002474 status = psa_get_key_from_slot( handle, &slot, PSA_KEY_USAGE_ENCRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02002475 if( status != PSA_SUCCESS )
2476 return( status );
Gilles Peskine35da9a22018-06-29 19:17:49 +02002477 if( ! ( PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->type ) ||
2478 PSA_KEY_TYPE_IS_KEYPAIR( slot->type ) ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002479 return( PSA_ERROR_INVALID_ARGUMENT );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002480
2481#if defined(MBEDTLS_RSA_C)
Gilles Peskined8008d62018-06-29 19:51:51 +02002482 if( PSA_KEY_TYPE_IS_RSA( slot->type ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002483 {
2484 mbedtls_rsa_context *rsa = slot->data.rsa;
2485 int ret;
Gilles Peskine630a18a2018-06-29 17:49:35 +02002486 if( output_size < mbedtls_rsa_get_len( rsa ) )
Gilles Peskine61b91d42018-06-08 16:09:36 +02002487 return( PSA_ERROR_INVALID_ARGUMENT );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002488#if defined(MBEDTLS_PKCS1_V15)
Gilles Peskine6afe7892018-05-31 13:16:08 +02002489 if( alg == PSA_ALG_RSA_PKCS1V15_CRYPT )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002490 {
Gilles Peskine61b91d42018-06-08 16:09:36 +02002491 ret = mbedtls_rsa_pkcs1_encrypt( rsa,
2492 mbedtls_ctr_drbg_random,
2493 &global_data.ctr_drbg,
2494 MBEDTLS_RSA_PUBLIC,
2495 input_length,
2496 input,
2497 output );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002498 }
2499 else
2500#endif /* MBEDTLS_PKCS1_V15 */
2501#if defined(MBEDTLS_PKCS1_V21)
Gilles Peskine55bf3d12018-06-26 15:53:48 +02002502 if( PSA_ALG_IS_RSA_OAEP( alg ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002503 {
Gilles Peskine072ac562018-06-30 00:21:29 +02002504 psa_rsa_oaep_set_padding_mode( alg, rsa );
2505 ret = mbedtls_rsa_rsaes_oaep_encrypt( rsa,
2506 mbedtls_ctr_drbg_random,
2507 &global_data.ctr_drbg,
2508 MBEDTLS_RSA_PUBLIC,
2509 salt, salt_length,
2510 input_length,
2511 input,
2512 output );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002513 }
2514 else
2515#endif /* MBEDTLS_PKCS1_V21 */
2516 {
2517 return( PSA_ERROR_INVALID_ARGUMENT );
2518 }
2519 if( ret == 0 )
Gilles Peskine630a18a2018-06-29 17:49:35 +02002520 *output_length = mbedtls_rsa_get_len( rsa );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002521 return( mbedtls_to_psa_error( ret ) );
2522 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002523 else
Gilles Peskineb75e4f12018-06-08 17:44:47 +02002524#endif /* defined(MBEDTLS_RSA_C) */
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002525 {
2526 return( PSA_ERROR_NOT_SUPPORTED );
2527 }
Gilles Peskine5b051bc2018-05-31 13:25:48 +02002528}
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002529
Gilles Peskinec5487a82018-12-03 18:08:14 +01002530psa_status_t psa_asymmetric_decrypt( psa_key_handle_t handle,
Gilles Peskine61b91d42018-06-08 16:09:36 +02002531 psa_algorithm_t alg,
2532 const uint8_t *input,
2533 size_t input_length,
2534 const uint8_t *salt,
2535 size_t salt_length,
2536 uint8_t *output,
2537 size_t output_size,
2538 size_t *output_length )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002539{
Gilles Peskine2f060a82018-12-04 17:12:32 +01002540 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02002541 psa_status_t status;
2542
Darryl Green5cc689a2018-07-24 15:34:10 +01002543 (void) input;
2544 (void) input_length;
2545 (void) salt;
2546 (void) output;
2547 (void) output_size;
2548
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03002549 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002550
Gilles Peskineb3fc05d2018-06-30 19:04:35 +02002551 if( ! PSA_ALG_IS_RSA_OAEP( alg ) && salt_length != 0 )
2552 return( PSA_ERROR_INVALID_ARGUMENT );
2553
Gilles Peskinec5487a82018-12-03 18:08:14 +01002554 status = psa_get_key_from_slot( handle, &slot, PSA_KEY_USAGE_DECRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02002555 if( status != PSA_SUCCESS )
2556 return( status );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002557 if( ! PSA_KEY_TYPE_IS_KEYPAIR( slot->type ) )
2558 return( PSA_ERROR_INVALID_ARGUMENT );
2559
2560#if defined(MBEDTLS_RSA_C)
2561 if( slot->type == PSA_KEY_TYPE_RSA_KEYPAIR )
2562 {
2563 mbedtls_rsa_context *rsa = slot->data.rsa;
2564 int ret;
2565
Gilles Peskine630a18a2018-06-29 17:49:35 +02002566 if( input_length != mbedtls_rsa_get_len( rsa ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002567 return( PSA_ERROR_INVALID_ARGUMENT );
2568
2569#if defined(MBEDTLS_PKCS1_V15)
Gilles Peskine6afe7892018-05-31 13:16:08 +02002570 if( alg == PSA_ALG_RSA_PKCS1V15_CRYPT )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002571 {
Gilles Peskine61b91d42018-06-08 16:09:36 +02002572 ret = mbedtls_rsa_pkcs1_decrypt( rsa,
2573 mbedtls_ctr_drbg_random,
2574 &global_data.ctr_drbg,
2575 MBEDTLS_RSA_PRIVATE,
2576 output_length,
2577 input,
2578 output,
2579 output_size );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002580 }
2581 else
2582#endif /* MBEDTLS_PKCS1_V15 */
2583#if defined(MBEDTLS_PKCS1_V21)
Gilles Peskine55bf3d12018-06-26 15:53:48 +02002584 if( PSA_ALG_IS_RSA_OAEP( alg ) )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002585 {
Gilles Peskine072ac562018-06-30 00:21:29 +02002586 psa_rsa_oaep_set_padding_mode( alg, rsa );
2587 ret = mbedtls_rsa_rsaes_oaep_decrypt( rsa,
2588 mbedtls_ctr_drbg_random,
2589 &global_data.ctr_drbg,
2590 MBEDTLS_RSA_PRIVATE,
2591 salt, salt_length,
2592 output_length,
2593 input,
2594 output,
2595 output_size );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002596 }
2597 else
2598#endif /* MBEDTLS_PKCS1_V21 */
2599 {
2600 return( PSA_ERROR_INVALID_ARGUMENT );
2601 }
Nir Sonnenschein717a0402018-06-04 16:36:15 +03002602
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002603 return( mbedtls_to_psa_error( ret ) );
2604 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002605 else
Gilles Peskineb75e4f12018-06-08 17:44:47 +02002606#endif /* defined(MBEDTLS_RSA_C) */
Nir Sonnenschein39e59142018-05-02 23:16:26 +03002607 {
2608 return( PSA_ERROR_NOT_SUPPORTED );
2609 }
Gilles Peskine5b051bc2018-05-31 13:25:48 +02002610}
Gilles Peskine20035e32018-02-03 22:44:14 +01002611
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02002612
2613
mohammad1603503973b2018-03-12 15:59:30 +02002614/****************************************************************/
2615/* Symmetric cryptography */
2616/****************************************************************/
2617
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002618/* Initialize the cipher operation structure. Once this function has been
2619 * called, psa_cipher_abort can run and will do the right thing. */
2620static psa_status_t psa_cipher_init( psa_cipher_operation_t *operation,
2621 psa_algorithm_t alg )
2622{
Gilles Peskinec06e0712018-06-20 16:21:04 +02002623 if( ! PSA_ALG_IS_CIPHER( alg ) )
2624 {
2625 memset( operation, 0, sizeof( *operation ) );
2626 return( PSA_ERROR_INVALID_ARGUMENT );
2627 }
2628
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002629 operation->alg = alg;
2630 operation->key_set = 0;
2631 operation->iv_set = 0;
2632 operation->iv_required = 1;
2633 operation->iv_size = 0;
2634 operation->block_size = 0;
2635 mbedtls_cipher_init( &operation->ctx.cipher );
2636 return( PSA_SUCCESS );
2637}
2638
Gilles Peskinee553c652018-06-04 16:22:46 +02002639static psa_status_t psa_cipher_setup( psa_cipher_operation_t *operation,
Gilles Peskinec5487a82018-12-03 18:08:14 +01002640 psa_key_handle_t handle,
Gilles Peskine7e928852018-06-04 16:23:10 +02002641 psa_algorithm_t alg,
2642 mbedtls_operation_t cipher_operation )
mohammad1603503973b2018-03-12 15:59:30 +02002643{
2644 int ret = MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE;
2645 psa_status_t status;
Gilles Peskine2f060a82018-12-04 17:12:32 +01002646 psa_key_slot_t *slot;
mohammad1603503973b2018-03-12 15:59:30 +02002647 size_t key_bits;
2648 const mbedtls_cipher_info_t *cipher_info = NULL;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02002649 psa_key_usage_t usage = ( cipher_operation == MBEDTLS_ENCRYPT ?
2650 PSA_KEY_USAGE_ENCRYPT :
2651 PSA_KEY_USAGE_DECRYPT );
mohammad1603503973b2018-03-12 15:59:30 +02002652
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002653 status = psa_cipher_init( operation, alg );
2654 if( status != PSA_SUCCESS )
2655 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02002656
Gilles Peskinec5487a82018-12-03 18:08:14 +01002657 status = psa_get_key_from_slot( handle, &slot, usage, alg);
Gilles Peskineb0b255c2018-07-06 17:01:38 +02002658 if( status != PSA_SUCCESS )
2659 return( status );
Gilles Peskineab1d7ab2018-07-06 16:07:47 +02002660 key_bits = psa_get_key_bits( slot );
mohammad1603503973b2018-03-12 15:59:30 +02002661
Gilles Peskineab1d7ab2018-07-06 16:07:47 +02002662 cipher_info = mbedtls_cipher_info_from_psa( alg, slot->type, key_bits, NULL );
mohammad1603503973b2018-03-12 15:59:30 +02002663 if( cipher_info == NULL )
2664 return( PSA_ERROR_NOT_SUPPORTED );
2665
mohammad1603503973b2018-03-12 15:59:30 +02002666 ret = mbedtls_cipher_setup( &operation->ctx.cipher, cipher_info );
Moran Peker41deec42018-04-04 15:43:05 +03002667 if( ret != 0 )
mohammad1603503973b2018-03-12 15:59:30 +02002668 {
2669 psa_cipher_abort( operation );
2670 return( mbedtls_to_psa_error( ret ) );
2671 }
2672
Gilles Peskine9ad29e22018-06-21 09:40:04 +02002673#if defined(MBEDTLS_DES_C)
Gilles Peskineab1d7ab2018-07-06 16:07:47 +02002674 if( slot->type == PSA_KEY_TYPE_DES && key_bits == 128 )
Gilles Peskine9ad29e22018-06-21 09:40:04 +02002675 {
2676 /* Two-key Triple-DES is 3-key Triple-DES with K1=K3 */
2677 unsigned char keys[24];
2678 memcpy( keys, slot->data.raw.data, 16 );
2679 memcpy( keys + 16, slot->data.raw.data, 8 );
2680 ret = mbedtls_cipher_setkey( &operation->ctx.cipher,
2681 keys,
2682 192, cipher_operation );
2683 }
2684 else
2685#endif
2686 {
2687 ret = mbedtls_cipher_setkey( &operation->ctx.cipher,
2688 slot->data.raw.data,
Jaeden Amero23bbb752018-06-26 14:16:54 +01002689 (int) key_bits, cipher_operation );
Gilles Peskine9ad29e22018-06-21 09:40:04 +02002690 }
Moran Peker41deec42018-04-04 15:43:05 +03002691 if( ret != 0 )
mohammad1603503973b2018-03-12 15:59:30 +02002692 {
2693 psa_cipher_abort( operation );
2694 return( mbedtls_to_psa_error( ret ) );
2695 }
2696
mohammad16038481e742018-03-18 13:57:31 +02002697#if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING)
Gilles Peskinedaea26f2018-08-21 14:02:45 +02002698 switch( alg )
mohammad16038481e742018-03-18 13:57:31 +02002699 {
Gilles Peskinedaea26f2018-08-21 14:02:45 +02002700 case PSA_ALG_CBC_NO_PADDING:
2701 ret = mbedtls_cipher_set_padding_mode( &operation->ctx.cipher,
2702 MBEDTLS_PADDING_NONE );
2703 break;
2704 case PSA_ALG_CBC_PKCS7:
2705 ret = mbedtls_cipher_set_padding_mode( &operation->ctx.cipher,
2706 MBEDTLS_PADDING_PKCS7 );
2707 break;
2708 default:
2709 /* The algorithm doesn't involve padding. */
2710 ret = 0;
2711 break;
2712 }
2713 if( ret != 0 )
2714 {
2715 psa_cipher_abort( operation );
2716 return( mbedtls_to_psa_error( ret ) );
mohammad16038481e742018-03-18 13:57:31 +02002717 }
2718#endif //MBEDTLS_CIPHER_MODE_WITH_PADDING
2719
mohammad1603503973b2018-03-12 15:59:30 +02002720 operation->key_set = 1;
Gilles Peskinedaea26f2018-08-21 14:02:45 +02002721 operation->block_size = ( PSA_ALG_IS_STREAM_CIPHER( alg ) ? 1 :
2722 PSA_BLOCK_CIPHER_BLOCK_SIZE( slot->type ) );
2723 if( alg & PSA_ALG_CIPHER_FROM_BLOCK_FLAG )
mohammad16038481e742018-03-18 13:57:31 +02002724 {
Gilles Peskineab1d7ab2018-07-06 16:07:47 +02002725 operation->iv_size = PSA_BLOCK_CIPHER_BLOCK_SIZE( slot->type );
mohammad16038481e742018-03-18 13:57:31 +02002726 }
mohammad1603503973b2018-03-12 15:59:30 +02002727
Moran Peker395db872018-05-31 14:07:14 +03002728 return( PSA_SUCCESS );
mohammad1603503973b2018-03-12 15:59:30 +02002729}
2730
Gilles Peskinefe119512018-07-08 21:39:34 +02002731psa_status_t psa_cipher_encrypt_setup( psa_cipher_operation_t *operation,
Gilles Peskinec5487a82018-12-03 18:08:14 +01002732 psa_key_handle_t handle,
Gilles Peskinefe119512018-07-08 21:39:34 +02002733 psa_algorithm_t alg )
mohammad16038481e742018-03-18 13:57:31 +02002734{
Gilles Peskinec5487a82018-12-03 18:08:14 +01002735 return( psa_cipher_setup( operation, handle, alg, MBEDTLS_ENCRYPT ) );
mohammad16038481e742018-03-18 13:57:31 +02002736}
2737
Gilles Peskinefe119512018-07-08 21:39:34 +02002738psa_status_t psa_cipher_decrypt_setup( psa_cipher_operation_t *operation,
Gilles Peskinec5487a82018-12-03 18:08:14 +01002739 psa_key_handle_t handle,
Gilles Peskinefe119512018-07-08 21:39:34 +02002740 psa_algorithm_t alg )
mohammad16038481e742018-03-18 13:57:31 +02002741{
Gilles Peskinec5487a82018-12-03 18:08:14 +01002742 return( psa_cipher_setup( operation, handle, alg, MBEDTLS_DECRYPT ) );
mohammad16038481e742018-03-18 13:57:31 +02002743}
2744
Gilles Peskinefe119512018-07-08 21:39:34 +02002745psa_status_t psa_cipher_generate_iv( psa_cipher_operation_t *operation,
2746 unsigned char *iv,
2747 size_t iv_size,
2748 size_t *iv_length )
mohammad1603503973b2018-03-12 15:59:30 +02002749{
itayzafrir534bd7c2018-08-02 13:56:32 +03002750 psa_status_t status;
2751 int ret;
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02002752 if( operation->iv_set || ! operation->iv_required )
itayzafrir534bd7c2018-08-02 13:56:32 +03002753 {
2754 status = PSA_ERROR_BAD_STATE;
2755 goto exit;
2756 }
Moran Peker41deec42018-04-04 15:43:05 +03002757 if( iv_size < operation->iv_size )
mohammad1603503973b2018-03-12 15:59:30 +02002758 {
itayzafrir534bd7c2018-08-02 13:56:32 +03002759 status = PSA_ERROR_BUFFER_TOO_SMALL;
Moran Peker41deec42018-04-04 15:43:05 +03002760 goto exit;
2761 }
Gilles Peskine7e928852018-06-04 16:23:10 +02002762 ret = mbedtls_ctr_drbg_random( &global_data.ctr_drbg,
2763 iv, operation->iv_size );
Moran Peker41deec42018-04-04 15:43:05 +03002764 if( ret != 0 )
2765 {
itayzafrir534bd7c2018-08-02 13:56:32 +03002766 status = mbedtls_to_psa_error( ret );
Gilles Peskinee553c652018-06-04 16:22:46 +02002767 goto exit;
mohammad1603503973b2018-03-12 15:59:30 +02002768 }
Gilles Peskinee553c652018-06-04 16:22:46 +02002769
mohammad16038481e742018-03-18 13:57:31 +02002770 *iv_length = operation->iv_size;
itayzafrir534bd7c2018-08-02 13:56:32 +03002771 status = psa_cipher_set_iv( operation, iv, *iv_length );
Moran Peker41deec42018-04-04 15:43:05 +03002772
Moran Peker395db872018-05-31 14:07:14 +03002773exit:
itayzafrir534bd7c2018-08-02 13:56:32 +03002774 if( status != PSA_SUCCESS )
Moran Peker395db872018-05-31 14:07:14 +03002775 psa_cipher_abort( operation );
itayzafrir534bd7c2018-08-02 13:56:32 +03002776 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02002777}
2778
Gilles Peskinefe119512018-07-08 21:39:34 +02002779psa_status_t psa_cipher_set_iv( psa_cipher_operation_t *operation,
2780 const unsigned char *iv,
2781 size_t iv_length )
mohammad1603503973b2018-03-12 15:59:30 +02002782{
itayzafrir534bd7c2018-08-02 13:56:32 +03002783 psa_status_t status;
2784 int ret;
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02002785 if( operation->iv_set || ! operation->iv_required )
itayzafrir534bd7c2018-08-02 13:56:32 +03002786 {
2787 status = PSA_ERROR_BAD_STATE;
2788 goto exit;
2789 }
Moran Pekera28258c2018-05-29 16:25:04 +03002790 if( iv_length != operation->iv_size )
Moran Peker71f19ae2018-04-22 20:23:16 +03002791 {
itayzafrir534bd7c2018-08-02 13:56:32 +03002792 status = PSA_ERROR_INVALID_ARGUMENT;
2793 goto exit;
Moran Peker71f19ae2018-04-22 20:23:16 +03002794 }
itayzafrir534bd7c2018-08-02 13:56:32 +03002795 ret = mbedtls_cipher_set_iv( &operation->ctx.cipher, iv, iv_length );
2796 status = mbedtls_to_psa_error( ret );
2797exit:
2798 if( status == PSA_SUCCESS )
2799 operation->iv_set = 1;
2800 else
mohammad1603503973b2018-03-12 15:59:30 +02002801 psa_cipher_abort( operation );
itayzafrir534bd7c2018-08-02 13:56:32 +03002802 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02002803}
2804
Gilles Peskinee553c652018-06-04 16:22:46 +02002805psa_status_t psa_cipher_update( psa_cipher_operation_t *operation,
2806 const uint8_t *input,
2807 size_t input_length,
2808 unsigned char *output,
2809 size_t output_size,
2810 size_t *output_length )
mohammad1603503973b2018-03-12 15:59:30 +02002811{
itayzafrir534bd7c2018-08-02 13:56:32 +03002812 psa_status_t status;
2813 int ret;
Gilles Peskine89d789c2018-06-04 17:17:16 +02002814 size_t expected_output_size;
Gilles Peskinedaea26f2018-08-21 14:02:45 +02002815 if( ! PSA_ALG_IS_STREAM_CIPHER( operation->alg ) )
Gilles Peskine89d789c2018-06-04 17:17:16 +02002816 {
2817 /* Take the unprocessed partial block left over from previous
2818 * update calls, if any, plus the input to this call. Remove
2819 * the last partial block, if any. You get the data that will be
2820 * output in this call. */
2821 expected_output_size =
2822 ( operation->ctx.cipher.unprocessed_len + input_length )
2823 / operation->block_size * operation->block_size;
2824 }
2825 else
2826 {
2827 expected_output_size = input_length;
2828 }
itayzafrir534bd7c2018-08-02 13:56:32 +03002829
Gilles Peskine89d789c2018-06-04 17:17:16 +02002830 if( output_size < expected_output_size )
itayzafrir534bd7c2018-08-02 13:56:32 +03002831 {
2832 status = PSA_ERROR_BUFFER_TOO_SMALL;
2833 goto exit;
2834 }
mohammad160382759612018-03-12 18:16:40 +02002835
mohammad1603503973b2018-03-12 15:59:30 +02002836 ret = mbedtls_cipher_update( &operation->ctx.cipher, input,
Gilles Peskinee553c652018-06-04 16:22:46 +02002837 input_length, output, output_length );
itayzafrir534bd7c2018-08-02 13:56:32 +03002838 status = mbedtls_to_psa_error( ret );
2839exit:
2840 if( status != PSA_SUCCESS )
mohammad1603503973b2018-03-12 15:59:30 +02002841 psa_cipher_abort( operation );
itayzafrir534bd7c2018-08-02 13:56:32 +03002842 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02002843}
2844
Gilles Peskinee553c652018-06-04 16:22:46 +02002845psa_status_t psa_cipher_finish( psa_cipher_operation_t *operation,
2846 uint8_t *output,
2847 size_t output_size,
2848 size_t *output_length )
mohammad1603503973b2018-03-12 15:59:30 +02002849{
Janos Follath315b51c2018-07-09 16:04:51 +01002850 psa_status_t status = PSA_ERROR_UNKNOWN_ERROR;
2851 int cipher_ret = MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE;
Gilles Peskinee553c652018-06-04 16:22:46 +02002852 uint8_t temp_output_buffer[MBEDTLS_MAX_BLOCK_LENGTH];
Moran Pekerbed71a22018-04-22 20:19:20 +03002853
mohammad1603503973b2018-03-12 15:59:30 +02002854 if( ! operation->key_set )
Moran Pekerdc38ebc2018-04-30 15:45:34 +03002855 {
Janos Follath315b51c2018-07-09 16:04:51 +01002856 status = PSA_ERROR_BAD_STATE;
2857 goto error;
Moran Peker7cb22b82018-06-05 11:40:02 +03002858 }
2859 if( operation->iv_required && ! operation->iv_set )
2860 {
Janos Follath315b51c2018-07-09 16:04:51 +01002861 status = PSA_ERROR_BAD_STATE;
2862 goto error;
Moran Peker7cb22b82018-06-05 11:40:02 +03002863 }
Gilles Peskinedaea26f2018-08-21 14:02:45 +02002864
Gilles Peskine2c5219a2018-06-06 15:12:32 +02002865 if( operation->ctx.cipher.operation == MBEDTLS_ENCRYPT &&
Gilles Peskinedaea26f2018-08-21 14:02:45 +02002866 operation->alg == PSA_ALG_CBC_NO_PADDING &&
2867 operation->ctx.cipher.unprocessed_len != 0 )
Moran Peker7cb22b82018-06-05 11:40:02 +03002868 {
Gilles Peskinedaea26f2018-08-21 14:02:45 +02002869 status = PSA_ERROR_INVALID_ARGUMENT;
Janos Follath315b51c2018-07-09 16:04:51 +01002870 goto error;
Moran Pekerdc38ebc2018-04-30 15:45:34 +03002871 }
2872
Janos Follath315b51c2018-07-09 16:04:51 +01002873 cipher_ret = mbedtls_cipher_finish( &operation->ctx.cipher,
2874 temp_output_buffer,
2875 output_length );
2876 if( cipher_ret != 0 )
mohammad1603503973b2018-03-12 15:59:30 +02002877 {
Janos Follath315b51c2018-07-09 16:04:51 +01002878 status = mbedtls_to_psa_error( cipher_ret );
2879 goto error;
mohammad1603503973b2018-03-12 15:59:30 +02002880 }
Janos Follath315b51c2018-07-09 16:04:51 +01002881
Gilles Peskine46f1fd72018-06-28 19:31:31 +02002882 if( *output_length == 0 )
Janos Follath315b51c2018-07-09 16:04:51 +01002883 ; /* Nothing to copy. Note that output may be NULL in this case. */
Gilles Peskine46f1fd72018-06-28 19:31:31 +02002884 else if( output_size >= *output_length )
Moran Pekerdc38ebc2018-04-30 15:45:34 +03002885 memcpy( output, temp_output_buffer, *output_length );
2886 else
2887 {
Janos Follath315b51c2018-07-09 16:04:51 +01002888 status = PSA_ERROR_BUFFER_TOO_SMALL;
2889 goto error;
Moran Pekerdc38ebc2018-04-30 15:45:34 +03002890 }
mohammad1603503973b2018-03-12 15:59:30 +02002891
Gilles Peskine3f108122018-12-07 18:14:53 +01002892 mbedtls_platform_zeroize( temp_output_buffer, sizeof( temp_output_buffer ) );
Janos Follath315b51c2018-07-09 16:04:51 +01002893 status = psa_cipher_abort( operation );
2894
2895 return( status );
2896
2897error:
2898
2899 *output_length = 0;
2900
Gilles Peskine3f108122018-12-07 18:14:53 +01002901 mbedtls_platform_zeroize( temp_output_buffer, sizeof( temp_output_buffer ) );
Janos Follath315b51c2018-07-09 16:04:51 +01002902 (void) psa_cipher_abort( operation );
2903
2904 return( status );
mohammad1603503973b2018-03-12 15:59:30 +02002905}
2906
Gilles Peskinee553c652018-06-04 16:22:46 +02002907psa_status_t psa_cipher_abort( psa_cipher_operation_t *operation )
2908{
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002909 if( operation->alg == 0 )
Gilles Peskine81736312018-06-26 15:04:31 +02002910 {
2911 /* The object has (apparently) been initialized but it is not
2912 * in use. It's ok to call abort on such an object, and there's
2913 * nothing to do. */
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002914 return( PSA_SUCCESS );
Gilles Peskine81736312018-06-26 15:04:31 +02002915 }
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002916
Gilles Peskinef9c2c092018-06-21 16:57:07 +02002917 /* Sanity check (shouldn't happen: operation->alg should
2918 * always have been initialized to a valid value). */
2919 if( ! PSA_ALG_IS_CIPHER( operation->alg ) )
2920 return( PSA_ERROR_BAD_STATE );
2921
mohammad1603503973b2018-03-12 15:59:30 +02002922 mbedtls_cipher_free( &operation->ctx.cipher );
Gilles Peskinee553c652018-06-04 16:22:46 +02002923
Moran Peker41deec42018-04-04 15:43:05 +03002924 operation->alg = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03002925 operation->key_set = 0;
2926 operation->iv_set = 0;
2927 operation->iv_size = 0;
Moran Peker41deec42018-04-04 15:43:05 +03002928 operation->block_size = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03002929 operation->iv_required = 0;
Moran Peker41deec42018-04-04 15:43:05 +03002930
Moran Peker395db872018-05-31 14:07:14 +03002931 return( PSA_SUCCESS );
mohammad1603503973b2018-03-12 15:59:30 +02002932}
2933
Gilles Peskinea0655c32018-04-30 17:06:50 +02002934
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02002935
mohammad16038cc1cee2018-03-28 01:21:33 +03002936/****************************************************************/
2937/* Key Policy */
2938/****************************************************************/
Mohammad Abo Mokha5c7b7d2018-07-04 15:57:00 +03002939
mohammad160327010052018-07-03 13:16:15 +03002940#if !defined(MBEDTLS_PSA_CRYPTO_SPM)
Gilles Peskine2d277862018-06-18 15:41:12 +02002941void psa_key_policy_set_usage( psa_key_policy_t *policy,
2942 psa_key_usage_t usage,
2943 psa_algorithm_t alg )
mohammad16038cc1cee2018-03-28 01:21:33 +03002944{
mohammad16034eed7572018-03-28 05:14:59 -07002945 policy->usage = usage;
2946 policy->alg = alg;
mohammad16038cc1cee2018-03-28 01:21:33 +03002947}
2948
Gilles Peskineaa7bc472018-07-12 00:54:56 +02002949psa_key_usage_t psa_key_policy_get_usage( const psa_key_policy_t *policy )
mohammad16038cc1cee2018-03-28 01:21:33 +03002950{
mohammad16036df908f2018-04-02 08:34:15 -07002951 return( policy->usage );
mohammad16038cc1cee2018-03-28 01:21:33 +03002952}
2953
Gilles Peskineaa7bc472018-07-12 00:54:56 +02002954psa_algorithm_t psa_key_policy_get_algorithm( const psa_key_policy_t *policy )
mohammad16038cc1cee2018-03-28 01:21:33 +03002955{
mohammad16036df908f2018-04-02 08:34:15 -07002956 return( policy->alg );
mohammad16038cc1cee2018-03-28 01:21:33 +03002957}
mohammad160327010052018-07-03 13:16:15 +03002958#endif /* !defined(MBEDTLS_PSA_CRYPTO_SPM) */
Mohammad Abo Mokha5c7b7d2018-07-04 15:57:00 +03002959
Gilles Peskinec5487a82018-12-03 18:08:14 +01002960psa_status_t psa_set_key_policy( psa_key_handle_t handle,
Gilles Peskine2d277862018-06-18 15:41:12 +02002961 const psa_key_policy_t *policy )
mohammad16038cc1cee2018-03-28 01:21:33 +03002962{
Gilles Peskine2f060a82018-12-04 17:12:32 +01002963 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02002964 psa_status_t status;
mohammad16038cc1cee2018-03-28 01:21:33 +03002965
Gilles Peskineb0b255c2018-07-06 17:01:38 +02002966 if( policy == NULL )
mohammad16038cc1cee2018-03-28 01:21:33 +03002967 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine5b051bc2018-05-31 13:25:48 +02002968
Gilles Peskinec5487a82018-12-03 18:08:14 +01002969 status = psa_get_empty_key_slot( handle, &slot );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02002970 if( status != PSA_SUCCESS )
2971 return( status );
mohammad16038cc1cee2018-03-28 01:21:33 +03002972
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02002973 if( ( policy->usage & ~( PSA_KEY_USAGE_EXPORT |
2974 PSA_KEY_USAGE_ENCRYPT |
2975 PSA_KEY_USAGE_DECRYPT |
2976 PSA_KEY_USAGE_SIGN |
Gilles Peskineea0fb492018-07-12 17:17:20 +02002977 PSA_KEY_USAGE_VERIFY |
2978 PSA_KEY_USAGE_DERIVE ) ) != 0 )
mohammad16035feda722018-04-16 04:38:57 -07002979 return( PSA_ERROR_INVALID_ARGUMENT );
mohammad16038cc1cee2018-03-28 01:21:33 +03002980
mohammad16036df908f2018-04-02 08:34:15 -07002981 slot->policy = *policy;
mohammad16038cc1cee2018-03-28 01:21:33 +03002982
2983 return( PSA_SUCCESS );
2984}
2985
Gilles Peskinec5487a82018-12-03 18:08:14 +01002986psa_status_t psa_get_key_policy( psa_key_handle_t handle,
Gilles Peskine2d277862018-06-18 15:41:12 +02002987 psa_key_policy_t *policy )
mohammad16038cc1cee2018-03-28 01:21:33 +03002988{
Gilles Peskine2f060a82018-12-04 17:12:32 +01002989 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02002990 psa_status_t status;
mohammad16038cc1cee2018-03-28 01:21:33 +03002991
Gilles Peskineb0b255c2018-07-06 17:01:38 +02002992 if( policy == NULL )
mohammad16038cc1cee2018-03-28 01:21:33 +03002993 return( PSA_ERROR_INVALID_ARGUMENT );
2994
Gilles Peskinec5487a82018-12-03 18:08:14 +01002995 status = psa_get_key_slot( handle, &slot );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02002996 if( status != PSA_SUCCESS )
2997 return( status );
Gilles Peskine5b051bc2018-05-31 13:25:48 +02002998
mohammad16036df908f2018-04-02 08:34:15 -07002999 *policy = slot->policy;
mohammad16038cc1cee2018-03-28 01:21:33 +03003000
3001 return( PSA_SUCCESS );
3002}
Gilles Peskine20035e32018-02-03 22:44:14 +01003003
Gilles Peskinea0655c32018-04-30 17:06:50 +02003004
3005
mohammad1603804cd712018-03-20 22:44:08 +02003006/****************************************************************/
3007/* Key Lifetime */
3008/****************************************************************/
3009
Gilles Peskinec5487a82018-12-03 18:08:14 +01003010psa_status_t psa_get_key_lifetime( psa_key_handle_t handle,
Gilles Peskine2d277862018-06-18 15:41:12 +02003011 psa_key_lifetime_t *lifetime )
mohammad1603804cd712018-03-20 22:44:08 +02003012{
Gilles Peskine2f060a82018-12-04 17:12:32 +01003013 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003014 psa_status_t status;
mohammad1603804cd712018-03-20 22:44:08 +02003015
Gilles Peskinec5487a82018-12-03 18:08:14 +01003016 status = psa_get_key_slot( handle, &slot );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003017 if( status != PSA_SUCCESS )
3018 return( status );
Gilles Peskine5b051bc2018-05-31 13:25:48 +02003019
mohammad1603804cd712018-03-20 22:44:08 +02003020 *lifetime = slot->lifetime;
3021
3022 return( PSA_SUCCESS );
3023}
3024
Gilles Peskine20035e32018-02-03 22:44:14 +01003025
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02003026
mohammad16035955c982018-04-26 00:53:03 +03003027/****************************************************************/
3028/* AEAD */
3029/****************************************************************/
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02003030
Gilles Peskineedf9a652018-08-17 18:11:56 +02003031typedef struct
3032{
Gilles Peskine2f060a82018-12-04 17:12:32 +01003033 psa_key_slot_t *slot;
Gilles Peskineedf9a652018-08-17 18:11:56 +02003034 const mbedtls_cipher_info_t *cipher_info;
3035 union
3036 {
3037#if defined(MBEDTLS_CCM_C)
3038 mbedtls_ccm_context ccm;
3039#endif /* MBEDTLS_CCM_C */
3040#if defined(MBEDTLS_GCM_C)
3041 mbedtls_gcm_context gcm;
3042#endif /* MBEDTLS_GCM_C */
3043 } ctx;
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02003044 psa_algorithm_t core_alg;
3045 uint8_t full_tag_length;
Gilles Peskineedf9a652018-08-17 18:11:56 +02003046 uint8_t tag_length;
3047} aead_operation_t;
3048
Gilles Peskinef8a8fe62018-08-21 16:38:05 +02003049static void psa_aead_abort( aead_operation_t *operation )
Gilles Peskineedf9a652018-08-17 18:11:56 +02003050{
Gilles Peskinef8a8fe62018-08-21 16:38:05 +02003051 switch( operation->core_alg )
Gilles Peskineedf9a652018-08-17 18:11:56 +02003052 {
3053#if defined(MBEDTLS_CCM_C)
3054 case PSA_ALG_CCM:
3055 mbedtls_ccm_free( &operation->ctx.ccm );
3056 break;
3057#endif /* MBEDTLS_CCM_C */
Gilles Peskineb0b189f2018-11-28 17:30:58 +01003058#if defined(MBEDTLS_GCM_C)
Gilles Peskineedf9a652018-08-17 18:11:56 +02003059 case PSA_ALG_GCM:
3060 mbedtls_gcm_free( &operation->ctx.gcm );
3061 break;
3062#endif /* MBEDTLS_GCM_C */
3063 }
3064}
3065
3066static psa_status_t psa_aead_setup( aead_operation_t *operation,
Gilles Peskinec5487a82018-12-03 18:08:14 +01003067 psa_key_handle_t handle,
Gilles Peskineedf9a652018-08-17 18:11:56 +02003068 psa_key_usage_t usage,
3069 psa_algorithm_t alg )
3070{
3071 psa_status_t status;
3072 size_t key_bits;
3073 mbedtls_cipher_id_t cipher_id;
3074
Gilles Peskinec5487a82018-12-03 18:08:14 +01003075 status = psa_get_key_from_slot( handle, &operation->slot, usage, alg );
Gilles Peskineedf9a652018-08-17 18:11:56 +02003076 if( status != PSA_SUCCESS )
3077 return( status );
3078
3079 key_bits = psa_get_key_bits( operation->slot );
3080
3081 operation->cipher_info =
3082 mbedtls_cipher_info_from_psa( alg, operation->slot->type, key_bits,
3083 &cipher_id );
3084 if( operation->cipher_info == NULL )
3085 return( PSA_ERROR_NOT_SUPPORTED );
3086
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02003087 switch( PSA_ALG_AEAD_WITH_TAG_LENGTH( alg, 0 ) )
Gilles Peskineedf9a652018-08-17 18:11:56 +02003088 {
3089#if defined(MBEDTLS_CCM_C)
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02003090 case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_CCM, 0 ):
3091 operation->core_alg = PSA_ALG_CCM;
3092 operation->full_tag_length = 16;
Gilles Peskineedf9a652018-08-17 18:11:56 +02003093 if( PSA_BLOCK_CIPHER_BLOCK_SIZE( operation->slot->type ) != 16 )
3094 return( PSA_ERROR_INVALID_ARGUMENT );
3095 mbedtls_ccm_init( &operation->ctx.ccm );
3096 status = mbedtls_to_psa_error(
3097 mbedtls_ccm_setkey( &operation->ctx.ccm, cipher_id,
3098 operation->slot->data.raw.data,
3099 (unsigned int) key_bits ) );
3100 if( status != 0 )
3101 goto cleanup;
3102 break;
3103#endif /* MBEDTLS_CCM_C */
3104
3105#if defined(MBEDTLS_GCM_C)
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02003106 case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_GCM, 0 ):
3107 operation->core_alg = PSA_ALG_GCM;
3108 operation->full_tag_length = 16;
Gilles Peskineedf9a652018-08-17 18:11:56 +02003109 if( PSA_BLOCK_CIPHER_BLOCK_SIZE( operation->slot->type ) != 16 )
3110 return( PSA_ERROR_INVALID_ARGUMENT );
3111 mbedtls_gcm_init( &operation->ctx.gcm );
3112 status = mbedtls_to_psa_error(
3113 mbedtls_gcm_setkey( &operation->ctx.gcm, cipher_id,
3114 operation->slot->data.raw.data,
3115 (unsigned int) key_bits ) );
3116 break;
3117#endif /* MBEDTLS_GCM_C */
3118
3119 default:
3120 return( PSA_ERROR_NOT_SUPPORTED );
3121 }
3122
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02003123 if( PSA_AEAD_TAG_LENGTH( alg ) > operation->full_tag_length )
3124 {
3125 status = PSA_ERROR_INVALID_ARGUMENT;
3126 goto cleanup;
3127 }
3128 operation->tag_length = PSA_AEAD_TAG_LENGTH( alg );
3129 /* CCM allows the following tag lengths: 4, 6, 8, 10, 12, 14, 16.
3130 * GCM allows the following tag lengths: 4, 8, 12, 13, 14, 15, 16.
3131 * In both cases, mbedtls_xxx will validate the tag length below. */
3132
Gilles Peskineedf9a652018-08-17 18:11:56 +02003133 return( PSA_SUCCESS );
3134
3135cleanup:
Gilles Peskinef8a8fe62018-08-21 16:38:05 +02003136 psa_aead_abort( operation );
Gilles Peskineedf9a652018-08-17 18:11:56 +02003137 return( status );
3138}
3139
Gilles Peskinec5487a82018-12-03 18:08:14 +01003140psa_status_t psa_aead_encrypt( psa_key_handle_t handle,
mohammad16035955c982018-04-26 00:53:03 +03003141 psa_algorithm_t alg,
3142 const uint8_t *nonce,
3143 size_t nonce_length,
3144 const uint8_t *additional_data,
3145 size_t additional_data_length,
3146 const uint8_t *plaintext,
3147 size_t plaintext_length,
3148 uint8_t *ciphertext,
3149 size_t ciphertext_size,
3150 size_t *ciphertext_length )
3151{
mohammad16035955c982018-04-26 00:53:03 +03003152 psa_status_t status;
Gilles Peskineedf9a652018-08-17 18:11:56 +02003153 aead_operation_t operation;
mohammad160315223a82018-06-03 17:19:55 +03003154 uint8_t *tag;
Gilles Peskine2d277862018-06-18 15:41:12 +02003155
mohammad1603f08a5502018-06-03 15:05:47 +03003156 *ciphertext_length = 0;
mohammad1603e58e6842018-05-09 04:58:32 -07003157
Gilles Peskinec5487a82018-12-03 18:08:14 +01003158 status = psa_aead_setup( &operation, handle, PSA_KEY_USAGE_ENCRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003159 if( status != PSA_SUCCESS )
3160 return( status );
mohammad16035955c982018-04-26 00:53:03 +03003161
Gilles Peskineedf9a652018-08-17 18:11:56 +02003162 /* For all currently supported modes, the tag is at the end of the
3163 * ciphertext. */
3164 if( ciphertext_size < ( plaintext_length + operation.tag_length ) )
3165 {
3166 status = PSA_ERROR_BUFFER_TOO_SMALL;
3167 goto exit;
3168 }
3169 tag = ciphertext + plaintext_length;
mohammad16035955c982018-04-26 00:53:03 +03003170
Gilles Peskineb0b189f2018-11-28 17:30:58 +01003171#if defined(MBEDTLS_GCM_C)
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02003172 if( operation.core_alg == PSA_ALG_GCM )
mohammad16035955c982018-04-26 00:53:03 +03003173 {
Gilles Peskineedf9a652018-08-17 18:11:56 +02003174 status = mbedtls_to_psa_error(
3175 mbedtls_gcm_crypt_and_tag( &operation.ctx.gcm,
3176 MBEDTLS_GCM_ENCRYPT,
3177 plaintext_length,
3178 nonce, nonce_length,
3179 additional_data, additional_data_length,
3180 plaintext, ciphertext,
3181 operation.tag_length, tag ) );
mohammad16035955c982018-04-26 00:53:03 +03003182 }
Gilles Peskineb0b189f2018-11-28 17:30:58 +01003183 else
3184#endif /* MBEDTLS_GCM_C */
3185#if defined(MBEDTLS_CCM_C)
3186 if( operation.core_alg == PSA_ALG_CCM )
mohammad16035955c982018-04-26 00:53:03 +03003187 {
Gilles Peskineedf9a652018-08-17 18:11:56 +02003188 status = mbedtls_to_psa_error(
3189 mbedtls_ccm_encrypt_and_tag( &operation.ctx.ccm,
3190 plaintext_length,
3191 nonce, nonce_length,
3192 additional_data,
3193 additional_data_length,
3194 plaintext, ciphertext,
3195 tag, operation.tag_length ) );
mohammad16035955c982018-04-26 00:53:03 +03003196 }
mohammad16035c8845f2018-05-09 05:40:09 -07003197 else
Gilles Peskineb0b189f2018-11-28 17:30:58 +01003198#endif /* MBEDTLS_CCM_C */
mohammad16035c8845f2018-05-09 05:40:09 -07003199 {
mohammad1603554faad2018-06-03 15:07:38 +03003200 return( PSA_ERROR_NOT_SUPPORTED );
mohammad16035c8845f2018-05-09 05:40:09 -07003201 }
Gilles Peskine2d277862018-06-18 15:41:12 +02003202
Gilles Peskineedf9a652018-08-17 18:11:56 +02003203 if( status != PSA_SUCCESS && ciphertext_size != 0 )
3204 memset( ciphertext, 0, ciphertext_size );
Gilles Peskine2d277862018-06-18 15:41:12 +02003205
Gilles Peskineedf9a652018-08-17 18:11:56 +02003206exit:
Gilles Peskinef8a8fe62018-08-21 16:38:05 +02003207 psa_aead_abort( &operation );
Gilles Peskineedf9a652018-08-17 18:11:56 +02003208 if( status == PSA_SUCCESS )
3209 *ciphertext_length = plaintext_length + operation.tag_length;
3210 return( status );
mohammad16035955c982018-04-26 00:53:03 +03003211}
3212
Gilles Peskineee652a32018-06-01 19:23:52 +02003213/* Locate the tag in a ciphertext buffer containing the encrypted data
3214 * followed by the tag. Return the length of the part preceding the tag in
3215 * *plaintext_length. This is the size of the plaintext in modes where
3216 * the encrypted data has the same size as the plaintext, such as
3217 * CCM and GCM. */
3218static psa_status_t psa_aead_unpadded_locate_tag( size_t tag_length,
3219 const uint8_t *ciphertext,
3220 size_t ciphertext_length,
3221 size_t plaintext_size,
Gilles Peskineee652a32018-06-01 19:23:52 +02003222 const uint8_t **p_tag )
3223{
3224 size_t payload_length;
3225 if( tag_length > ciphertext_length )
3226 return( PSA_ERROR_INVALID_ARGUMENT );
3227 payload_length = ciphertext_length - tag_length;
3228 if( payload_length > plaintext_size )
3229 return( PSA_ERROR_BUFFER_TOO_SMALL );
3230 *p_tag = ciphertext + payload_length;
Gilles Peskineee652a32018-06-01 19:23:52 +02003231 return( PSA_SUCCESS );
3232}
3233
Gilles Peskinec5487a82018-12-03 18:08:14 +01003234psa_status_t psa_aead_decrypt( psa_key_handle_t handle,
mohammad16035955c982018-04-26 00:53:03 +03003235 psa_algorithm_t alg,
3236 const uint8_t *nonce,
3237 size_t nonce_length,
3238 const uint8_t *additional_data,
3239 size_t additional_data_length,
3240 const uint8_t *ciphertext,
3241 size_t ciphertext_length,
3242 uint8_t *plaintext,
3243 size_t plaintext_size,
3244 size_t *plaintext_length )
3245{
mohammad16035955c982018-04-26 00:53:03 +03003246 psa_status_t status;
Gilles Peskineedf9a652018-08-17 18:11:56 +02003247 aead_operation_t operation;
3248 const uint8_t *tag = NULL;
Gilles Peskine2d277862018-06-18 15:41:12 +02003249
Gilles Peskineee652a32018-06-01 19:23:52 +02003250 *plaintext_length = 0;
mohammad16039e5a5152018-04-26 12:07:35 +03003251
Gilles Peskinec5487a82018-12-03 18:08:14 +01003252 status = psa_aead_setup( &operation, handle, PSA_KEY_USAGE_DECRYPT, alg );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003253 if( status != PSA_SUCCESS )
3254 return( status );
mohammad16035955c982018-04-26 00:53:03 +03003255
Gilles Peskineb0b189f2018-11-28 17:30:58 +01003256#if defined(MBEDTLS_GCM_C)
Gilles Peskine23cc2ff2018-08-17 19:47:52 +02003257 if( operation.core_alg == PSA_ALG_GCM )
mohammad16035955c982018-04-26 00:53:03 +03003258 {
Gilles Peskineedf9a652018-08-17 18:11:56 +02003259 status = psa_aead_unpadded_locate_tag( operation.tag_length,
Gilles Peskineee652a32018-06-01 19:23:52 +02003260 ciphertext, ciphertext_length,
mohammad160360a64d02018-06-03 17:20:42 +03003261 plaintext_size, &tag );
Gilles Peskineee652a32018-06-01 19:23:52 +02003262 if( status != PSA_SUCCESS )
Gilles Peskineedf9a652018-08-17 18:11:56 +02003263 goto exit;
Gilles Peskineee652a32018-06-01 19:23:52 +02003264
Gilles Peskineedf9a652018-08-17 18:11:56 +02003265 status = mbedtls_to_psa_error(
3266 mbedtls_gcm_auth_decrypt( &operation.ctx.gcm,
3267 ciphertext_length - operation.tag_length,
3268 nonce, nonce_length,
3269 additional_data,
3270 additional_data_length,
3271 tag, operation.tag_length,
3272 ciphertext, plaintext ) );
mohammad16035955c982018-04-26 00:53:03 +03003273 }
Gilles Peskineb0b189f2018-11-28 17:30:58 +01003274 else
3275#endif /* MBEDTLS_GCM_C */
3276#if defined(MBEDTLS_CCM_C)
3277 if( operation.core_alg == PSA_ALG_CCM )
mohammad16035955c982018-04-26 00:53:03 +03003278 {
Gilles Peskineedf9a652018-08-17 18:11:56 +02003279 status = psa_aead_unpadded_locate_tag( operation.tag_length,
mohammad16039375f842018-06-03 14:28:24 +03003280 ciphertext, ciphertext_length,
mohammad160360a64d02018-06-03 17:20:42 +03003281 plaintext_size, &tag );
mohammad16039375f842018-06-03 14:28:24 +03003282 if( status != PSA_SUCCESS )
Gilles Peskineedf9a652018-08-17 18:11:56 +02003283 goto exit;
mohammad16039375f842018-06-03 14:28:24 +03003284
Gilles Peskineedf9a652018-08-17 18:11:56 +02003285 status = mbedtls_to_psa_error(
3286 mbedtls_ccm_auth_decrypt( &operation.ctx.ccm,
3287 ciphertext_length - operation.tag_length,
3288 nonce, nonce_length,
3289 additional_data,
3290 additional_data_length,
3291 ciphertext, plaintext,
3292 tag, operation.tag_length ) );
mohammad16035955c982018-04-26 00:53:03 +03003293 }
mohammad160339574652018-06-01 04:39:53 -07003294 else
Gilles Peskineb0b189f2018-11-28 17:30:58 +01003295#endif /* MBEDTLS_CCM_C */
mohammad160339574652018-06-01 04:39:53 -07003296 {
mohammad1603554faad2018-06-03 15:07:38 +03003297 return( PSA_ERROR_NOT_SUPPORTED );
mohammad160339574652018-06-01 04:39:53 -07003298 }
Gilles Peskinea40d7742018-06-01 16:28:30 +02003299
Gilles Peskineedf9a652018-08-17 18:11:56 +02003300 if( status != PSA_SUCCESS && plaintext_size != 0 )
3301 memset( plaintext, 0, plaintext_size );
mohammad160360a64d02018-06-03 17:20:42 +03003302
Gilles Peskineedf9a652018-08-17 18:11:56 +02003303exit:
Gilles Peskinef8a8fe62018-08-21 16:38:05 +02003304 psa_aead_abort( &operation );
Gilles Peskineedf9a652018-08-17 18:11:56 +02003305 if( status == PSA_SUCCESS )
3306 *plaintext_length = ciphertext_length - operation.tag_length;
3307 return( status );
mohammad16035955c982018-04-26 00:53:03 +03003308}
3309
Gilles Peskinea0655c32018-04-30 17:06:50 +02003310
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02003311
Gilles Peskine20035e32018-02-03 22:44:14 +01003312/****************************************************************/
Gilles Peskineeab56e42018-07-12 17:12:33 +02003313/* Generators */
3314/****************************************************************/
3315
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01003316#define HKDF_STATE_INIT 0 /* no input yet */
3317#define HKDF_STATE_STARTED 1 /* got salt */
3318#define HKDF_STATE_KEYED 2 /* got key */
3319#define HKDF_STATE_OUTPUT 3 /* output started */
3320
Gilles Peskine969c5d62019-01-16 15:53:06 +01003321static psa_algorithm_t psa_generator_get_kdf_alg(
3322 const psa_crypto_generator_t *generator )
3323{
3324 if ( PSA_ALG_IS_KEY_AGREEMENT( generator->alg ) )
3325 return( PSA_ALG_KEY_AGREEMENT_GET_KDF( generator->alg ) );
3326 else
3327 return( generator->alg );
3328}
3329
3330
Gilles Peskineeab56e42018-07-12 17:12:33 +02003331psa_status_t psa_generator_abort( psa_crypto_generator_t *generator )
3332{
3333 psa_status_t status = PSA_SUCCESS;
Gilles Peskine969c5d62019-01-16 15:53:06 +01003334 psa_algorithm_t kdf_alg = psa_generator_get_kdf_alg( generator );
3335 if( kdf_alg == 0 )
Gilles Peskineeab56e42018-07-12 17:12:33 +02003336 {
3337 /* The object has (apparently) been initialized but it is not
3338 * in use. It's ok to call abort on such an object, and there's
3339 * nothing to do. */
3340 }
3341 else
Gilles Peskine969c5d62019-01-16 15:53:06 +01003342 if( kdf_alg == PSA_ALG_SELECT_RAW )
Gilles Peskine751d9652018-09-18 12:05:44 +02003343 {
3344 if( generator->ctx.buffer.data != NULL )
3345 {
Gilles Peskine3f108122018-12-07 18:14:53 +01003346 mbedtls_platform_zeroize( generator->ctx.buffer.data,
Gilles Peskine751d9652018-09-18 12:05:44 +02003347 generator->ctx.buffer.size );
3348 mbedtls_free( generator->ctx.buffer.data );
3349 }
3350 }
3351 else
Gilles Peskinebef7f142018-07-12 17:22:21 +02003352#if defined(MBEDTLS_MD_C)
Gilles Peskine969c5d62019-01-16 15:53:06 +01003353 if( PSA_ALG_IS_HKDF( kdf_alg ) )
Gilles Peskinebef7f142018-07-12 17:22:21 +02003354 {
3355 mbedtls_free( generator->ctx.hkdf.info );
3356 status = psa_hmac_abort_internal( &generator->ctx.hkdf.hmac );
3357 }
Gilles Peskine969c5d62019-01-16 15:53:06 +01003358 else if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
Hanno Becker1aaedc02018-11-16 11:35:34 +00003359 /* TLS-1.2 PSK-to-MS KDF uses the same generator as TLS-1.2 PRF */
Gilles Peskine969c5d62019-01-16 15:53:06 +01003360 PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003361 {
3362 if( generator->ctx.tls12_prf.key != NULL )
3363 {
Gilles Peskine3f108122018-12-07 18:14:53 +01003364 mbedtls_platform_zeroize( generator->ctx.tls12_prf.key,
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003365 generator->ctx.tls12_prf.key_len );
3366 mbedtls_free( generator->ctx.tls12_prf.key );
3367 }
Hanno Becker580fba12018-11-13 20:50:45 +00003368
3369 if( generator->ctx.tls12_prf.Ai_with_seed != NULL )
3370 {
Gilles Peskine3f108122018-12-07 18:14:53 +01003371 mbedtls_platform_zeroize( generator->ctx.tls12_prf.Ai_with_seed,
Hanno Becker580fba12018-11-13 20:50:45 +00003372 generator->ctx.tls12_prf.Ai_with_seed_len );
3373 mbedtls_free( generator->ctx.tls12_prf.Ai_with_seed );
3374 }
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003375 }
Gilles Peskinebef7f142018-07-12 17:22:21 +02003376 else
3377#endif /* MBEDTLS_MD_C */
Gilles Peskineeab56e42018-07-12 17:12:33 +02003378 {
3379 status = PSA_ERROR_BAD_STATE;
3380 }
3381 memset( generator, 0, sizeof( *generator ) );
3382 return( status );
3383}
3384
Gilles Peskineeab56e42018-07-12 17:12:33 +02003385psa_status_t psa_get_generator_capacity(const psa_crypto_generator_t *generator,
3386 size_t *capacity)
3387{
3388 *capacity = generator->capacity;
3389 return( PSA_SUCCESS );
3390}
3391
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01003392psa_status_t psa_set_generator_capacity( psa_crypto_generator_t *generator,
3393 size_t capacity )
3394{
3395 if( generator->alg == 0 )
3396 return( PSA_ERROR_BAD_STATE );
3397 if( capacity > generator->capacity )
3398 return( PSA_ERROR_INVALID_ARGUMENT );
3399 generator->capacity = capacity;
3400 return( PSA_SUCCESS );
3401}
3402
Gilles Peskinebef7f142018-07-12 17:22:21 +02003403#if defined(MBEDTLS_MD_C)
3404/* Read some bytes from an HKDF-based generator. This performs a chunk
3405 * of the expand phase of the HKDF algorithm. */
3406static psa_status_t psa_generator_hkdf_read( psa_hkdf_generator_t *hkdf,
3407 psa_algorithm_t hash_alg,
3408 uint8_t *output,
3409 size_t output_length )
3410{
3411 uint8_t hash_length = PSA_HASH_SIZE( hash_alg );
3412 psa_status_t status;
3413
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01003414 if( hkdf->state < HKDF_STATE_KEYED || ! hkdf->info_set )
3415 return( PSA_ERROR_BAD_STATE );
3416 hkdf->state = HKDF_STATE_OUTPUT;
3417
Gilles Peskinebef7f142018-07-12 17:22:21 +02003418 while( output_length != 0 )
3419 {
3420 /* Copy what remains of the current block */
3421 uint8_t n = hash_length - hkdf->offset_in_block;
3422 if( n > output_length )
3423 n = (uint8_t) output_length;
3424 memcpy( output, hkdf->output_block + hkdf->offset_in_block, n );
3425 output += n;
3426 output_length -= n;
3427 hkdf->offset_in_block += n;
Gilles Peskined54931c2018-07-17 21:06:59 +02003428 if( output_length == 0 )
Gilles Peskinebef7f142018-07-12 17:22:21 +02003429 break;
Gilles Peskined54931c2018-07-17 21:06:59 +02003430 /* We can't be wanting more output after block 0xff, otherwise
3431 * the capacity check in psa_generator_read() would have
3432 * prevented this call. It could happen only if the generator
3433 * object was corrupted or if this function is called directly
3434 * inside the library. */
3435 if( hkdf->block_number == 0xff )
3436 return( PSA_ERROR_BAD_STATE );
Gilles Peskinebef7f142018-07-12 17:22:21 +02003437
3438 /* We need a new block */
3439 ++hkdf->block_number;
3440 hkdf->offset_in_block = 0;
3441 status = psa_hmac_setup_internal( &hkdf->hmac,
3442 hkdf->prk, hash_length,
3443 hash_alg );
3444 if( status != PSA_SUCCESS )
3445 return( status );
3446 if( hkdf->block_number != 1 )
3447 {
3448 status = psa_hash_update( &hkdf->hmac.hash_ctx,
3449 hkdf->output_block,
3450 hash_length );
3451 if( status != PSA_SUCCESS )
3452 return( status );
3453 }
3454 status = psa_hash_update( &hkdf->hmac.hash_ctx,
3455 hkdf->info,
3456 hkdf->info_length );
3457 if( status != PSA_SUCCESS )
3458 return( status );
3459 status = psa_hash_update( &hkdf->hmac.hash_ctx,
3460 &hkdf->block_number, 1 );
3461 if( status != PSA_SUCCESS )
3462 return( status );
3463 status = psa_hmac_finish_internal( &hkdf->hmac,
3464 hkdf->output_block,
3465 sizeof( hkdf->output_block ) );
3466 if( status != PSA_SUCCESS )
3467 return( status );
3468 }
3469
3470 return( PSA_SUCCESS );
3471}
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003472
3473static psa_status_t psa_generator_tls12_prf_generate_next_block(
3474 psa_tls12_prf_generator_t *tls12_prf,
3475 psa_algorithm_t alg )
3476{
3477 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( alg );
3478 uint8_t hash_length = PSA_HASH_SIZE( hash_alg );
3479 psa_hmac_internal_data hmac;
3480 psa_status_t status, cleanup_status;
3481
Hanno Becker3b339e22018-11-13 20:56:14 +00003482 unsigned char *Ai;
3483 size_t Ai_len;
3484
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003485 /* We can't be wanting more output after block 0xff, otherwise
3486 * the capacity check in psa_generator_read() would have
3487 * prevented this call. It could happen only if the generator
3488 * object was corrupted or if this function is called directly
3489 * inside the library. */
3490 if( tls12_prf->block_number == 0xff )
3491 return( PSA_ERROR_BAD_STATE );
3492
3493 /* We need a new block */
3494 ++tls12_prf->block_number;
3495 tls12_prf->offset_in_block = 0;
3496
3497 /* Recall the definition of the TLS-1.2-PRF from RFC 5246:
3498 *
3499 * PRF(secret, label, seed) = P_<hash>(secret, label + seed)
3500 *
3501 * P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
3502 * HMAC_hash(secret, A(2) + seed) +
3503 * HMAC_hash(secret, A(3) + seed) + ...
3504 *
3505 * A(0) = seed
3506 * A(i) = HMAC_hash( secret, A(i-1) )
3507 *
3508 * The `psa_tls12_prf_generator` structures saves the block
3509 * `HMAC_hash(secret, A(i) + seed)` from which the output
3510 * is currently extracted as `output_block`, while
3511 * `A(i) + seed` is stored in `Ai_with_seed`.
3512 *
3513 * Generating a new block means recalculating `Ai_with_seed`
3514 * from the A(i)-part of it, and afterwards recalculating
3515 * `output_block`.
3516 *
3517 * A(0) is computed at setup time.
3518 *
3519 */
3520
3521 psa_hmac_init_internal( &hmac );
3522
3523 /* We must distinguish the calculation of A(1) from those
3524 * of A(2) and higher, because A(0)=seed has a different
3525 * length than the other A(i). */
3526 if( tls12_prf->block_number == 1 )
3527 {
Hanno Becker3b339e22018-11-13 20:56:14 +00003528 Ai = tls12_prf->Ai_with_seed + hash_length;
3529 Ai_len = tls12_prf->Ai_with_seed_len - hash_length;
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003530 }
3531 else
3532 {
Hanno Becker3b339e22018-11-13 20:56:14 +00003533 Ai = tls12_prf->Ai_with_seed;
3534 Ai_len = hash_length;
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003535 }
3536
Hanno Becker3b339e22018-11-13 20:56:14 +00003537 /* Compute A(i+1) = HMAC_hash(secret, A(i)) */
3538 status = psa_hmac_setup_internal( &hmac,
3539 tls12_prf->key,
3540 tls12_prf->key_len,
3541 hash_alg );
3542 if( status != PSA_SUCCESS )
3543 goto cleanup;
3544
3545 status = psa_hash_update( &hmac.hash_ctx,
3546 Ai, Ai_len );
3547 if( status != PSA_SUCCESS )
3548 goto cleanup;
3549
3550 status = psa_hmac_finish_internal( &hmac,
3551 tls12_prf->Ai_with_seed,
3552 hash_length );
3553 if( status != PSA_SUCCESS )
3554 goto cleanup;
3555
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003556 /* Compute the next block `HMAC_hash(secret, A(i+1) + seed)`. */
3557 status = psa_hmac_setup_internal( &hmac,
3558 tls12_prf->key,
3559 tls12_prf->key_len,
3560 hash_alg );
3561 if( status != PSA_SUCCESS )
3562 goto cleanup;
3563
3564 status = psa_hash_update( &hmac.hash_ctx,
3565 tls12_prf->Ai_with_seed,
Hanno Becker580fba12018-11-13 20:50:45 +00003566 tls12_prf->Ai_with_seed_len );
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003567 if( status != PSA_SUCCESS )
3568 goto cleanup;
3569
3570 status = psa_hmac_finish_internal( &hmac,
3571 tls12_prf->output_block,
3572 hash_length );
3573 if( status != PSA_SUCCESS )
3574 goto cleanup;
3575
3576cleanup:
3577
3578 cleanup_status = psa_hmac_abort_internal( &hmac );
3579 if( status == PSA_SUCCESS && cleanup_status != PSA_SUCCESS )
3580 status = cleanup_status;
3581
3582 return( status );
3583}
3584
3585/* Read some bytes from an TLS-1.2-PRF-based generator.
3586 * See Section 5 of RFC 5246. */
3587static psa_status_t psa_generator_tls12_prf_read(
3588 psa_tls12_prf_generator_t *tls12_prf,
3589 psa_algorithm_t alg,
3590 uint8_t *output,
3591 size_t output_length )
3592{
3593 psa_algorithm_t hash_alg = PSA_ALG_TLS12_PRF_GET_HASH( alg );
3594 uint8_t hash_length = PSA_HASH_SIZE( hash_alg );
3595 psa_status_t status;
3596
3597 while( output_length != 0 )
3598 {
3599 /* Copy what remains of the current block */
3600 uint8_t n = hash_length - tls12_prf->offset_in_block;
3601
3602 /* Check if we have fully processed the current block. */
3603 if( n == 0 )
3604 {
3605 status = psa_generator_tls12_prf_generate_next_block( tls12_prf,
3606 alg );
3607 if( status != PSA_SUCCESS )
3608 return( status );
3609
3610 continue;
3611 }
3612
3613 if( n > output_length )
3614 n = (uint8_t) output_length;
3615 memcpy( output, tls12_prf->output_block + tls12_prf->offset_in_block,
3616 n );
3617 output += n;
3618 output_length -= n;
3619 tls12_prf->offset_in_block += n;
3620 }
3621
3622 return( PSA_SUCCESS );
3623}
Gilles Peskinebef7f142018-07-12 17:22:21 +02003624#endif /* MBEDTLS_MD_C */
3625
Gilles Peskineeab56e42018-07-12 17:12:33 +02003626psa_status_t psa_generator_read( psa_crypto_generator_t *generator,
3627 uint8_t *output,
3628 size_t output_length )
3629{
3630 psa_status_t status;
Gilles Peskine969c5d62019-01-16 15:53:06 +01003631 psa_algorithm_t kdf_alg = psa_generator_get_kdf_alg( generator );
Gilles Peskineeab56e42018-07-12 17:12:33 +02003632
3633 if( output_length > generator->capacity )
3634 {
3635 generator->capacity = 0;
3636 /* Go through the error path to wipe all confidential data now
3637 * that the generator object is useless. */
3638 status = PSA_ERROR_INSUFFICIENT_CAPACITY;
3639 goto exit;
3640 }
3641 if( output_length == 0 &&
Gilles Peskine969c5d62019-01-16 15:53:06 +01003642 generator->capacity == 0 && kdf_alg == 0 )
Gilles Peskineeab56e42018-07-12 17:12:33 +02003643 {
3644 /* Edge case: this is a blank or finished generator, and 0
3645 * bytes were requested. The right error in this case could
3646 * be either INSUFFICIENT_CAPACITY or BAD_STATE. Return
3647 * INSUFFICIENT_CAPACITY, which is right for a finished
3648 * generator, for consistency with the case when
3649 * output_length > 0. */
3650 return( PSA_ERROR_INSUFFICIENT_CAPACITY );
3651 }
3652 generator->capacity -= output_length;
3653
Gilles Peskine969c5d62019-01-16 15:53:06 +01003654 if( kdf_alg == PSA_ALG_SELECT_RAW )
Gilles Peskine751d9652018-09-18 12:05:44 +02003655 {
Gilles Peskine211a4362018-10-25 22:22:31 +02003656 /* Initially, the capacity of a selection generator is always
3657 * the size of the buffer, i.e. `generator->ctx.buffer.size`,
3658 * abbreviated in this comment as `size`. When the remaining
3659 * capacity is `c`, the next bytes to serve start `c` bytes
3660 * from the end of the buffer, i.e. `size - c` from the
3661 * beginning of the buffer. Since `generator->capacity` was just
3662 * decremented above, we need to serve the bytes from
3663 * `size - generator->capacity - output_length` to
3664 * `size - generator->capacity`. */
Gilles Peskine751d9652018-09-18 12:05:44 +02003665 size_t offset =
3666 generator->ctx.buffer.size - generator->capacity - output_length;
3667 memcpy( output, generator->ctx.buffer.data + offset, output_length );
3668 status = PSA_SUCCESS;
3669 }
3670 else
Gilles Peskinebef7f142018-07-12 17:22:21 +02003671#if defined(MBEDTLS_MD_C)
Gilles Peskine969c5d62019-01-16 15:53:06 +01003672 if( PSA_ALG_IS_HKDF( kdf_alg ) )
Gilles Peskinebef7f142018-07-12 17:22:21 +02003673 {
Gilles Peskine969c5d62019-01-16 15:53:06 +01003674 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( kdf_alg );
Gilles Peskinebef7f142018-07-12 17:22:21 +02003675 status = psa_generator_hkdf_read( &generator->ctx.hkdf, hash_alg,
3676 output, output_length );
3677 }
Gilles Peskine969c5d62019-01-16 15:53:06 +01003678 else if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
3679 PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003680 {
3681 status = psa_generator_tls12_prf_read( &generator->ctx.tls12_prf,
Gilles Peskine969c5d62019-01-16 15:53:06 +01003682 kdf_alg, output,
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003683 output_length );
3684 }
Gilles Peskinebef7f142018-07-12 17:22:21 +02003685 else
3686#endif /* MBEDTLS_MD_C */
Gilles Peskineeab56e42018-07-12 17:12:33 +02003687 {
3688 return( PSA_ERROR_BAD_STATE );
3689 }
3690
3691exit:
3692 if( status != PSA_SUCCESS )
3693 {
3694 psa_generator_abort( generator );
3695 memset( output, '!', output_length );
3696 }
3697 return( status );
3698}
3699
Gilles Peskine08542d82018-07-19 17:05:42 +02003700#if defined(MBEDTLS_DES_C)
3701static void psa_des_set_key_parity( uint8_t *data, size_t data_size )
3702{
3703 if( data_size >= 8 )
3704 mbedtls_des_key_set_parity( data );
3705 if( data_size >= 16 )
3706 mbedtls_des_key_set_parity( data + 8 );
3707 if( data_size >= 24 )
3708 mbedtls_des_key_set_parity( data + 16 );
3709}
3710#endif /* MBEDTLS_DES_C */
3711
Gilles Peskinec5487a82018-12-03 18:08:14 +01003712psa_status_t psa_generator_import_key( psa_key_handle_t handle,
Gilles Peskineeab56e42018-07-12 17:12:33 +02003713 psa_key_type_t type,
3714 size_t bits,
3715 psa_crypto_generator_t *generator )
3716{
3717 uint8_t *data = NULL;
3718 size_t bytes = PSA_BITS_TO_BYTES( bits );
3719 psa_status_t status;
3720
3721 if( ! key_type_is_raw_bytes( type ) )
3722 return( PSA_ERROR_INVALID_ARGUMENT );
3723 if( bits % 8 != 0 )
3724 return( PSA_ERROR_INVALID_ARGUMENT );
3725 data = mbedtls_calloc( 1, bytes );
3726 if( data == NULL )
3727 return( PSA_ERROR_INSUFFICIENT_MEMORY );
3728
3729 status = psa_generator_read( generator, data, bytes );
3730 if( status != PSA_SUCCESS )
3731 goto exit;
Gilles Peskine08542d82018-07-19 17:05:42 +02003732#if defined(MBEDTLS_DES_C)
3733 if( type == PSA_KEY_TYPE_DES )
3734 psa_des_set_key_parity( data, bytes );
3735#endif /* MBEDTLS_DES_C */
Gilles Peskinec5487a82018-12-03 18:08:14 +01003736 status = psa_import_key( handle, type, data, bytes );
Gilles Peskineeab56e42018-07-12 17:12:33 +02003737
3738exit:
3739 mbedtls_free( data );
3740 return( status );
3741}
3742
3743
3744
3745/****************************************************************/
Gilles Peskineea0fb492018-07-12 17:17:20 +02003746/* Key derivation */
3747/****************************************************************/
3748
Gilles Peskinea05219c2018-11-16 16:02:56 +01003749#if defined(MBEDTLS_MD_C)
Gilles Peskinebef7f142018-07-12 17:22:21 +02003750/* Set up an HKDF-based generator. This is exactly the extract phase
Gilles Peskine346797d2018-11-16 16:05:06 +01003751 * of the HKDF algorithm.
3752 *
3753 * Note that if this function fails, you must call psa_generator_abort()
3754 * to potentially free embedded data structures and wipe confidential data.
3755 */
Gilles Peskinebef7f142018-07-12 17:22:21 +02003756static psa_status_t psa_generator_hkdf_setup( psa_hkdf_generator_t *hkdf,
Gilles Peskinecce18ae2018-09-18 12:03:52 +02003757 const uint8_t *secret,
3758 size_t secret_length,
Gilles Peskinebef7f142018-07-12 17:22:21 +02003759 psa_algorithm_t hash_alg,
3760 const uint8_t *salt,
3761 size_t salt_length,
3762 const uint8_t *label,
3763 size_t label_length )
3764{
3765 psa_status_t status;
3766 status = psa_hmac_setup_internal( &hkdf->hmac,
3767 salt, salt_length,
Gilles Peskine00709fa2018-08-22 18:25:41 +02003768 PSA_ALG_HMAC_GET_HASH( hash_alg ) );
Gilles Peskinebef7f142018-07-12 17:22:21 +02003769 if( status != PSA_SUCCESS )
3770 return( status );
Gilles Peskinecce18ae2018-09-18 12:03:52 +02003771 status = psa_hash_update( &hkdf->hmac.hash_ctx, secret, secret_length );
Gilles Peskinebef7f142018-07-12 17:22:21 +02003772 if( status != PSA_SUCCESS )
3773 return( status );
3774 status = psa_hmac_finish_internal( &hkdf->hmac,
3775 hkdf->prk,
3776 sizeof( hkdf->prk ) );
3777 if( status != PSA_SUCCESS )
3778 return( status );
3779 hkdf->offset_in_block = PSA_HASH_SIZE( hash_alg );
3780 hkdf->block_number = 0;
3781 hkdf->info_length = label_length;
3782 if( label_length != 0 )
3783 {
3784 hkdf->info = mbedtls_calloc( 1, label_length );
3785 if( hkdf->info == NULL )
3786 return( PSA_ERROR_INSUFFICIENT_MEMORY );
3787 memcpy( hkdf->info, label, label_length );
3788 }
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01003789 hkdf->state = HKDF_STATE_KEYED;
3790 hkdf->info_set = 1;
Gilles Peskinebef7f142018-07-12 17:22:21 +02003791 return( PSA_SUCCESS );
3792}
Gilles Peskinea05219c2018-11-16 16:02:56 +01003793#endif /* MBEDTLS_MD_C */
Gilles Peskinebef7f142018-07-12 17:22:21 +02003794
Gilles Peskinea05219c2018-11-16 16:02:56 +01003795#if defined(MBEDTLS_MD_C)
Gilles Peskine346797d2018-11-16 16:05:06 +01003796/* Set up a TLS-1.2-prf-based generator (see RFC 5246, Section 5).
3797 *
3798 * Note that if this function fails, you must call psa_generator_abort()
3799 * to potentially free embedded data structures and wipe confidential data.
3800 */
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003801static psa_status_t psa_generator_tls12_prf_setup(
3802 psa_tls12_prf_generator_t *tls12_prf,
3803 const unsigned char *key,
3804 size_t key_len,
3805 psa_algorithm_t hash_alg,
3806 const uint8_t *salt,
3807 size_t salt_length,
3808 const uint8_t *label,
3809 size_t label_length )
3810{
3811 uint8_t hash_length = PSA_HASH_SIZE( hash_alg );
Hanno Becker580fba12018-11-13 20:50:45 +00003812 size_t Ai_with_seed_len = hash_length + salt_length + label_length;
3813 int overflow;
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003814
3815 tls12_prf->key = mbedtls_calloc( 1, key_len );
3816 if( tls12_prf->key == NULL )
3817 return( PSA_ERROR_INSUFFICIENT_MEMORY );
3818 tls12_prf->key_len = key_len;
3819 memcpy( tls12_prf->key, key, key_len );
3820
Hanno Becker580fba12018-11-13 20:50:45 +00003821 overflow = ( salt_length + label_length < salt_length ) ||
3822 ( salt_length + label_length + hash_length < hash_length );
3823 if( overflow )
3824 return( PSA_ERROR_INVALID_ARGUMENT );
3825
3826 tls12_prf->Ai_with_seed = mbedtls_calloc( 1, Ai_with_seed_len );
3827 if( tls12_prf->Ai_with_seed == NULL )
3828 return( PSA_ERROR_INSUFFICIENT_MEMORY );
3829 tls12_prf->Ai_with_seed_len = Ai_with_seed_len;
3830
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003831 /* Write `label + seed' at the end of the `A(i) + seed` buffer,
3832 * leaving the initial `hash_length` bytes unspecified for now. */
Hanno Becker353e4532018-11-15 09:53:57 +00003833 if( label_length != 0 )
3834 {
3835 memcpy( tls12_prf->Ai_with_seed + hash_length,
3836 label, label_length );
3837 }
3838
3839 if( salt_length != 0 )
3840 {
3841 memcpy( tls12_prf->Ai_with_seed + hash_length + label_length,
3842 salt, salt_length );
3843 }
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003844
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003845 /* The first block gets generated when
3846 * psa_generator_read() is called. */
3847 tls12_prf->block_number = 0;
3848 tls12_prf->offset_in_block = hash_length;
3849
3850 return( PSA_SUCCESS );
3851}
Hanno Becker1aaedc02018-11-16 11:35:34 +00003852
3853/* Set up a TLS-1.2-PSK-to-MS-based generator. */
3854static psa_status_t psa_generator_tls12_psk_to_ms_setup(
3855 psa_tls12_prf_generator_t *tls12_prf,
3856 const unsigned char *psk,
3857 size_t psk_len,
3858 psa_algorithm_t hash_alg,
3859 const uint8_t *salt,
3860 size_t salt_length,
3861 const uint8_t *label,
3862 size_t label_length )
3863{
3864 psa_status_t status;
3865 unsigned char pms[ 4 + 2 * PSA_ALG_TLS12_PSK_TO_MS_MAX_PSK_LEN ];
3866
3867 if( psk_len > PSA_ALG_TLS12_PSK_TO_MS_MAX_PSK_LEN )
3868 return( PSA_ERROR_INVALID_ARGUMENT );
3869
3870 /* Quoting RFC 4279, Section 2:
3871 *
3872 * The premaster secret is formed as follows: if the PSK is N octets
3873 * long, concatenate a uint16 with the value N, N zero octets, a second
3874 * uint16 with the value N, and the PSK itself.
3875 */
3876
3877 pms[0] = ( psk_len >> 8 ) & 0xff;
3878 pms[1] = ( psk_len >> 0 ) & 0xff;
3879 memset( pms + 2, 0, psk_len );
3880 pms[2 + psk_len + 0] = pms[0];
3881 pms[2 + psk_len + 1] = pms[1];
3882 memcpy( pms + 4 + psk_len, psk, psk_len );
3883
3884 status = psa_generator_tls12_prf_setup( tls12_prf,
3885 pms, 4 + 2 * psk_len,
3886 hash_alg,
3887 salt, salt_length,
3888 label, label_length );
3889
Gilles Peskine3f108122018-12-07 18:14:53 +01003890 mbedtls_platform_zeroize( pms, sizeof( pms ) );
Hanno Becker1aaedc02018-11-16 11:35:34 +00003891 return( status );
3892}
Gilles Peskinea05219c2018-11-16 16:02:56 +01003893#endif /* MBEDTLS_MD_C */
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003894
Gilles Peskine346797d2018-11-16 16:05:06 +01003895/* Note that if this function fails, you must call psa_generator_abort()
3896 * to potentially free embedded data structures and wipe confidential data.
3897 */
Gilles Peskinecce18ae2018-09-18 12:03:52 +02003898static psa_status_t psa_key_derivation_internal(
3899 psa_crypto_generator_t *generator,
3900 const uint8_t *secret, size_t secret_length,
3901 psa_algorithm_t alg,
3902 const uint8_t *salt, size_t salt_length,
3903 const uint8_t *label, size_t label_length,
3904 size_t capacity )
3905{
3906 psa_status_t status;
3907 size_t max_capacity;
3908
3909 /* Set generator->alg even on failure so that abort knows what to do. */
3910 generator->alg = alg;
3911
Gilles Peskine751d9652018-09-18 12:05:44 +02003912 if( alg == PSA_ALG_SELECT_RAW )
3913 {
Gilles Peskinea05219c2018-11-16 16:02:56 +01003914 (void) salt;
Gilles Peskine751d9652018-09-18 12:05:44 +02003915 if( salt_length != 0 )
3916 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskinea05219c2018-11-16 16:02:56 +01003917 (void) label;
Gilles Peskine751d9652018-09-18 12:05:44 +02003918 if( label_length != 0 )
3919 return( PSA_ERROR_INVALID_ARGUMENT );
3920 generator->ctx.buffer.data = mbedtls_calloc( 1, secret_length );
3921 if( generator->ctx.buffer.data == NULL )
3922 return( PSA_ERROR_INSUFFICIENT_MEMORY );
3923 memcpy( generator->ctx.buffer.data, secret, secret_length );
3924 generator->ctx.buffer.size = secret_length;
3925 max_capacity = secret_length;
3926 status = PSA_SUCCESS;
3927 }
3928 else
Gilles Peskinecce18ae2018-09-18 12:03:52 +02003929#if defined(MBEDTLS_MD_C)
3930 if( PSA_ALG_IS_HKDF( alg ) )
3931 {
3932 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( alg );
3933 size_t hash_size = PSA_HASH_SIZE( hash_alg );
3934 if( hash_size == 0 )
3935 return( PSA_ERROR_NOT_SUPPORTED );
3936 max_capacity = 255 * hash_size;
3937 status = psa_generator_hkdf_setup( &generator->ctx.hkdf,
3938 secret, secret_length,
3939 hash_alg,
3940 salt, salt_length,
3941 label, label_length );
3942 }
Hanno Becker1aaedc02018-11-16 11:35:34 +00003943 /* TLS-1.2 PRF and TLS-1.2 PSK-to-MS are very similar, so share code. */
3944 else if( PSA_ALG_IS_TLS12_PRF( alg ) ||
3945 PSA_ALG_IS_TLS12_PSK_TO_MS( alg ) )
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003946 {
3947 psa_algorithm_t hash_alg = PSA_ALG_TLS12_PRF_GET_HASH( alg );
3948 size_t hash_size = PSA_HASH_SIZE( hash_alg );
3949
3950 /* TLS-1.2 PRF supports only SHA-256 and SHA-384. */
3951 if( hash_alg != PSA_ALG_SHA_256 &&
3952 hash_alg != PSA_ALG_SHA_384 )
3953 {
3954 return( PSA_ERROR_NOT_SUPPORTED );
3955 }
3956
3957 max_capacity = 255 * hash_size;
Hanno Becker1aaedc02018-11-16 11:35:34 +00003958
3959 if( PSA_ALG_IS_TLS12_PRF( alg ) )
3960 {
3961 status = psa_generator_tls12_prf_setup( &generator->ctx.tls12_prf,
3962 secret, secret_length,
3963 hash_alg, salt, salt_length,
3964 label, label_length );
3965 }
3966 else
3967 {
3968 status = psa_generator_tls12_psk_to_ms_setup(
3969 &generator->ctx.tls12_prf,
3970 secret, secret_length,
3971 hash_alg, salt, salt_length,
3972 label, label_length );
3973 }
Hanno Beckerc8a41d72018-10-09 17:33:01 +01003974 }
Gilles Peskinecce18ae2018-09-18 12:03:52 +02003975 else
3976#endif
3977 {
3978 return( PSA_ERROR_NOT_SUPPORTED );
3979 }
3980
3981 if( status != PSA_SUCCESS )
3982 return( status );
3983
3984 if( capacity <= max_capacity )
3985 generator->capacity = capacity;
Gilles Peskine8feb3a82018-09-18 12:06:11 +02003986 else if( capacity == PSA_GENERATOR_UNBRIDLED_CAPACITY )
3987 generator->capacity = max_capacity;
Gilles Peskinecce18ae2018-09-18 12:03:52 +02003988 else
3989 return( PSA_ERROR_INVALID_ARGUMENT );
3990
3991 return( PSA_SUCCESS );
3992}
3993
Gilles Peskineea0fb492018-07-12 17:17:20 +02003994psa_status_t psa_key_derivation( psa_crypto_generator_t *generator,
Gilles Peskinec5487a82018-12-03 18:08:14 +01003995 psa_key_handle_t handle,
Gilles Peskineea0fb492018-07-12 17:17:20 +02003996 psa_algorithm_t alg,
3997 const uint8_t *salt,
3998 size_t salt_length,
3999 const uint8_t *label,
4000 size_t label_length,
4001 size_t capacity )
4002{
Gilles Peskine2f060a82018-12-04 17:12:32 +01004003 psa_key_slot_t *slot;
Gilles Peskineea0fb492018-07-12 17:17:20 +02004004 psa_status_t status;
4005
4006 if( generator->alg != 0 )
4007 return( PSA_ERROR_BAD_STATE );
4008
Gilles Peskinecce18ae2018-09-18 12:03:52 +02004009 /* Make sure that alg is a key derivation algorithm. This prevents
4010 * key selection algorithms, which psa_key_derivation_internal
4011 * accepts for the sake of key agreement. */
Gilles Peskineea0fb492018-07-12 17:17:20 +02004012 if( ! PSA_ALG_IS_KEY_DERIVATION( alg ) )
4013 return( PSA_ERROR_INVALID_ARGUMENT );
4014
Gilles Peskinec5487a82018-12-03 18:08:14 +01004015 status = psa_get_key_from_slot( handle, &slot, PSA_KEY_USAGE_DERIVE, alg );
Gilles Peskinecce18ae2018-09-18 12:03:52 +02004016 if( status != PSA_SUCCESS )
4017 return( status );
Gilles Peskineea0fb492018-07-12 17:17:20 +02004018
Gilles Peskinecce18ae2018-09-18 12:03:52 +02004019 if( slot->type != PSA_KEY_TYPE_DERIVE )
4020 return( PSA_ERROR_INVALID_ARGUMENT );
4021
4022 status = psa_key_derivation_internal( generator,
4023 slot->data.raw.data,
4024 slot->data.raw.bytes,
4025 alg,
4026 salt, salt_length,
4027 label, label_length,
4028 capacity );
4029 if( status != PSA_SUCCESS )
Gilles Peskineea0fb492018-07-12 17:17:20 +02004030 psa_generator_abort( generator );
4031 return( status );
4032}
4033
Gilles Peskine969c5d62019-01-16 15:53:06 +01004034static psa_status_t psa_key_derivation_setup_kdf(
4035 psa_crypto_generator_t *generator,
4036 psa_algorithm_t kdf_alg )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004037{
Gilles Peskine969c5d62019-01-16 15:53:06 +01004038 /* Make sure that kdf_alg is a supported key derivation algorithm. */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004039#if defined(MBEDTLS_MD_C)
Gilles Peskine969c5d62019-01-16 15:53:06 +01004040 if( PSA_ALG_IS_HKDF( kdf_alg ) ||
4041 PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
4042 PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004043 {
Gilles Peskine969c5d62019-01-16 15:53:06 +01004044 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( kdf_alg );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004045 size_t hash_size = PSA_HASH_SIZE( hash_alg );
4046 if( hash_size == 0 )
4047 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine969c5d62019-01-16 15:53:06 +01004048 if( ( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
4049 PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) ) &&
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004050 ! ( hash_alg == PSA_ALG_SHA_256 && hash_alg == PSA_ALG_SHA_384 ) )
4051 {
4052 return( PSA_ERROR_NOT_SUPPORTED );
4053 }
4054 generator->capacity = 255 * hash_size;
Gilles Peskine969c5d62019-01-16 15:53:06 +01004055 return( PSA_SUCCESS );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004056 }
4057#endif /* MBEDTLS_MD_C */
Gilles Peskine969c5d62019-01-16 15:53:06 +01004058 else
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004059 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine969c5d62019-01-16 15:53:06 +01004060}
4061
4062psa_status_t psa_key_derivation_setup( psa_crypto_generator_t *generator,
4063 psa_algorithm_t alg )
4064{
4065 psa_status_t status;
4066
4067 if( generator->alg != 0 )
4068 return( PSA_ERROR_BAD_STATE );
4069
4070 if( PSA_ALG_IS_KEY_AGREEMENT( alg ) )
4071 {
4072 psa_algorithm_t kdf_alg = PSA_ALG_KEY_AGREEMENT_GET_KDF( alg );
4073 if( kdf_alg == PSA_ALG_SELECT_RAW )
4074 {
4075 /* It's too early to set the generator's capacity since it
4076 * depends on the key size for the key agreement. */
4077 status = PSA_SUCCESS;
4078 }
4079 else
4080 {
4081 status = psa_key_derivation_setup_kdf( generator, kdf_alg );
4082 }
4083 }
4084 else if( PSA_ALG_IS_KEY_DERIVATION( alg ) )
4085 {
4086 status = psa_key_derivation_setup_kdf( generator, alg );
4087 }
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004088 else
4089 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine969c5d62019-01-16 15:53:06 +01004090
4091 if( status == PSA_SUCCESS )
4092 generator->alg = alg;
4093 return( status );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004094}
4095
4096#if defined(MBEDTLS_MD_C)
4097static psa_status_t psa_hkdf_input( psa_hkdf_generator_t *hkdf,
4098 psa_algorithm_t hash_alg,
4099 psa_key_derivation_step_t step,
4100 const uint8_t *data,
4101 size_t data_length )
4102{
4103 psa_status_t status;
4104 switch( step )
4105 {
4106 case PSA_KDF_STEP_SALT:
4107 if( hkdf->state == HKDF_STATE_INIT )
4108 {
4109 status = psa_hmac_setup_internal( &hkdf->hmac,
4110 data, data_length,
4111 hash_alg );
4112 if( status != PSA_SUCCESS )
4113 return( status );
4114 hkdf->state = HKDF_STATE_STARTED;
4115 return( PSA_SUCCESS );
4116 }
4117 else
4118 return( PSA_ERROR_BAD_STATE );
4119 break;
4120 case PSA_KDF_STEP_SECRET:
4121 /* If no salt was provided, use an empty salt. */
4122 if( hkdf->state == HKDF_STATE_INIT )
4123 {
4124 status = psa_hmac_setup_internal( &hkdf->hmac,
4125 NULL, 0,
4126 PSA_ALG_HMAC( hash_alg ) );
4127 if( status != PSA_SUCCESS )
4128 return( status );
4129 hkdf->state = HKDF_STATE_STARTED;
4130 }
4131 if( hkdf->state == HKDF_STATE_STARTED )
4132 {
4133 status = psa_hash_update( &hkdf->hmac.hash_ctx,
4134 data, data_length );
4135 if( status != PSA_SUCCESS )
4136 return( status );
4137 status = psa_hmac_finish_internal( &hkdf->hmac,
4138 hkdf->prk,
4139 sizeof( hkdf->prk ) );
4140 if( status != PSA_SUCCESS )
4141 return( status );
4142 hkdf->offset_in_block = PSA_HASH_SIZE( hash_alg );
4143 hkdf->block_number = 0;
4144 hkdf->state = HKDF_STATE_KEYED;
4145 return( PSA_SUCCESS );
4146 }
4147 else
4148 return( PSA_ERROR_BAD_STATE );
4149 break;
4150 case PSA_KDF_STEP_INFO:
4151 if( hkdf->state == HKDF_STATE_OUTPUT )
4152 return( PSA_ERROR_BAD_STATE );
4153 if( hkdf->info_set )
4154 return( PSA_ERROR_BAD_STATE );
4155 hkdf->info_length = data_length;
4156 if( data_length != 0 )
4157 {
4158 hkdf->info = mbedtls_calloc( 1, data_length );
4159 if( hkdf->info == NULL )
4160 return( PSA_ERROR_INSUFFICIENT_MEMORY );
4161 memcpy( hkdf->info, data, data_length );
4162 }
4163 hkdf->info_set = 1;
4164 return( PSA_SUCCESS );
4165 default:
4166 return( PSA_ERROR_INVALID_ARGUMENT );
4167 }
4168}
4169#endif /* MBEDTLS_MD_C */
4170
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01004171static psa_status_t psa_key_derivation_input_raw(
4172 psa_crypto_generator_t *generator,
4173 psa_key_derivation_step_t step,
4174 const uint8_t *data,
4175 size_t data_length )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004176{
4177 psa_status_t status;
Gilles Peskine969c5d62019-01-16 15:53:06 +01004178 psa_algorithm_t kdf_alg = psa_generator_get_kdf_alg( generator );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004179
Gilles Peskine969c5d62019-01-16 15:53:06 +01004180 if( kdf_alg == PSA_ALG_SELECT_RAW )
4181 {
4182 if( generator->capacity != 0 )
4183 return( PSA_ERROR_INVALID_ARGUMENT );
4184 generator->ctx.buffer.data = mbedtls_calloc( 1, data_length );
4185 if( generator->ctx.buffer.data == NULL )
4186 return( PSA_ERROR_INSUFFICIENT_MEMORY );
4187 memcpy( generator->ctx.buffer.data, data, data_length );
4188 generator->ctx.buffer.size = data_length;
4189 generator->capacity = data_length;
4190 status = PSA_SUCCESS;
4191 }
4192 else
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004193#if defined(MBEDTLS_MD_C)
Gilles Peskine969c5d62019-01-16 15:53:06 +01004194 if( PSA_ALG_IS_HKDF( kdf_alg ) )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004195 {
4196 status = psa_hkdf_input( &generator->ctx.hkdf,
Gilles Peskine969c5d62019-01-16 15:53:06 +01004197 PSA_ALG_HKDF_GET_HASH( kdf_alg ),
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004198 step, data, data_length );
4199 }
Gilles Peskine969c5d62019-01-16 15:53:06 +01004200 else
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004201#endif /* MBEDTLS_MD_C */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004202#if defined(MBEDTLS_MD_C)
4203 /* TLS-1.2 PRF and TLS-1.2 PSK-to-MS are very similar, so share code. */
Gilles Peskine969c5d62019-01-16 15:53:06 +01004204 if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
4205 PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004206 {
4207 // TODO
4208 status = PSA_ERROR_NOT_SUPPORTED;
4209 }
4210 else
4211#endif /* MBEDTLS_MD_C */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004212 {
4213 /* This can't happen unless the generator object was not initialized */
4214 return( PSA_ERROR_BAD_STATE );
4215 }
4216
4217 if( status != PSA_SUCCESS )
4218 psa_generator_abort( generator );
4219 return( status );
4220}
4221
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01004222psa_status_t psa_key_derivation_input_bytes( psa_crypto_generator_t *generator,
4223 psa_key_derivation_step_t step,
4224 const uint8_t *data,
4225 size_t data_length )
4226{
4227 switch( step )
4228 {
4229 case PSA_KDF_STEP_LABEL:
4230 case PSA_KDF_STEP_SALT:
4231 case PSA_KDF_STEP_INFO:
4232 return( psa_key_derivation_input_raw( generator, step,
4233 data, data_length ) );
4234 default:
4235 return( PSA_ERROR_INVALID_ARGUMENT );
4236 }
4237}
4238
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004239psa_status_t psa_key_derivation_input_key( psa_crypto_generator_t *generator,
4240 psa_key_derivation_step_t step,
4241 psa_key_handle_t handle )
4242{
4243 psa_key_slot_t *slot;
4244 psa_status_t status;
4245 status = psa_get_key_from_slot( handle, &slot,
4246 PSA_KEY_USAGE_DERIVE,
4247 generator->alg );
4248 if( status != PSA_SUCCESS )
4249 return( status );
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01004250 // TODO: for a key agreement algorithm, allow the corresponding key type and step
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004251 if( slot->type != PSA_KEY_TYPE_DERIVE )
4252 return( PSA_ERROR_INVALID_ARGUMENT );
4253 /* Don't allow a key to be used as an input that is usually public.
4254 * This is debatable. It's ok from a cryptographic perspective to
4255 * use secret material as an input that is usually public. However
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01004256 * the material should be dedicated to a particular input step,
4257 * otherwise this may allow the key to be used in an unintended way
4258 * and leak values derived from the key. So be conservative. */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004259 if( step != PSA_KDF_STEP_SECRET )
4260 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01004261 return( psa_key_derivation_input_raw( generator,
4262 step,
4263 slot->data.raw.data,
4264 slot->data.raw.bytes ) );
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004265}
4266
Gilles Peskineea0fb492018-07-12 17:17:20 +02004267
4268
4269/****************************************************************/
Gilles Peskine01d718c2018-09-18 12:01:02 +02004270/* Key agreement */
4271/****************************************************************/
4272
Gilles Peskinea05219c2018-11-16 16:02:56 +01004273#if defined(MBEDTLS_ECDH_C)
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004274static psa_status_t psa_key_agreement_ecdh( const uint8_t *peer_key,
4275 size_t peer_key_length,
4276 const mbedtls_ecp_keypair *our_key,
4277 uint8_t *shared_secret,
4278 size_t shared_secret_size,
4279 size_t *shared_secret_length )
4280{
4281 mbedtls_pk_context pk;
4282 mbedtls_ecp_keypair *their_key = NULL;
4283 mbedtls_ecdh_context ecdh;
4284 int ret;
4285 mbedtls_ecdh_init( &ecdh );
4286 mbedtls_pk_init( &pk );
4287
4288 ret = mbedtls_pk_parse_public_key( &pk, peer_key, peer_key_length );
4289 if( ret != 0 )
4290 goto exit;
Gilles Peskine88714d72018-10-25 23:07:25 +02004291 switch( mbedtls_pk_get_type( &pk ) )
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004292 {
Gilles Peskine88714d72018-10-25 23:07:25 +02004293 case MBEDTLS_PK_ECKEY:
4294 case MBEDTLS_PK_ECKEY_DH:
4295 break;
4296 default:
4297 ret = MBEDTLS_ERR_ECP_INVALID_KEY;
4298 goto exit;
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004299 }
4300 their_key = mbedtls_pk_ec( pk );
Gilles Peskineb4086612018-11-14 20:51:23 +01004301 if( their_key->grp.id != our_key->grp.id )
4302 {
4303 ret = MBEDTLS_ERR_ECP_INVALID_KEY;
4304 goto exit;
4305 }
4306
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004307 ret = mbedtls_ecdh_get_params( &ecdh, their_key, MBEDTLS_ECDH_THEIRS );
4308 if( ret != 0 )
4309 goto exit;
4310 ret = mbedtls_ecdh_get_params( &ecdh, our_key, MBEDTLS_ECDH_OURS );
4311 if( ret != 0 )
4312 goto exit;
4313
4314 ret = mbedtls_ecdh_calc_secret( &ecdh,
4315 shared_secret_length,
4316 shared_secret, shared_secret_size,
4317 mbedtls_ctr_drbg_random,
4318 &global_data.ctr_drbg );
4319
4320exit:
4321 mbedtls_pk_free( &pk );
4322 mbedtls_ecdh_free( &ecdh );
4323 return( mbedtls_to_psa_error( ret ) );
4324}
Gilles Peskinea05219c2018-11-16 16:02:56 +01004325#endif /* MBEDTLS_ECDH_C */
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004326
Gilles Peskine01d718c2018-09-18 12:01:02 +02004327#define PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE MBEDTLS_ECP_MAX_BYTES
4328
Gilles Peskine346797d2018-11-16 16:05:06 +01004329/* Note that if this function fails, you must call psa_generator_abort()
4330 * to potentially free embedded data structures and wipe confidential data.
4331 */
Gilles Peskine01d718c2018-09-18 12:01:02 +02004332static psa_status_t psa_key_agreement_internal( psa_crypto_generator_t *generator,
Gilles Peskine969c5d62019-01-16 15:53:06 +01004333 psa_key_derivation_step_t step,
Gilles Peskine2f060a82018-12-04 17:12:32 +01004334 psa_key_slot_t *private_key,
Gilles Peskine01d718c2018-09-18 12:01:02 +02004335 const uint8_t *peer_key,
Gilles Peskine969c5d62019-01-16 15:53:06 +01004336 size_t peer_key_length )
Gilles Peskine01d718c2018-09-18 12:01:02 +02004337{
4338 psa_status_t status;
4339 uint8_t shared_secret[PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE];
4340 size_t shared_secret_length = 0;
4341
4342 /* Step 1: run the secret agreement algorithm to generate the shared
4343 * secret. */
Gilles Peskine969c5d62019-01-16 15:53:06 +01004344 switch( PSA_ALG_KEY_AGREEMENT_GET_BASE( generator->alg ) )
Gilles Peskine01d718c2018-09-18 12:01:02 +02004345 {
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02004346#if defined(MBEDTLS_ECDH_C)
4347 case PSA_ALG_ECDH_BASE:
4348 if( ! PSA_KEY_TYPE_IS_ECC_KEYPAIR( private_key->type ) )
4349 return( PSA_ERROR_INVALID_ARGUMENT );
4350 status = psa_key_agreement_ecdh( peer_key, peer_key_length,
4351 private_key->data.ecp,
4352 shared_secret,
4353 sizeof( shared_secret ),
4354 &shared_secret_length );
4355 break;
4356#endif /* MBEDTLS_ECDH_C */
Gilles Peskine01d718c2018-09-18 12:01:02 +02004357 default:
Gilles Peskine93f85002018-11-16 16:43:31 +01004358 (void) private_key;
4359 (void) peer_key;
4360 (void) peer_key_length;
Gilles Peskine01d718c2018-09-18 12:01:02 +02004361 return( PSA_ERROR_NOT_SUPPORTED );
4362 }
4363 if( status != PSA_SUCCESS )
4364 goto exit;
4365
4366 /* Step 2: set up the key derivation to generate key material from
4367 * the shared secret. */
Gilles Peskine969c5d62019-01-16 15:53:06 +01004368 status = psa_key_derivation_input_raw( generator, step,
4369 shared_secret, shared_secret_length );
4370
Gilles Peskine01d718c2018-09-18 12:01:02 +02004371exit:
Gilles Peskine3f108122018-12-07 18:14:53 +01004372 mbedtls_platform_zeroize( shared_secret, shared_secret_length );
Gilles Peskine01d718c2018-09-18 12:01:02 +02004373 return( status );
4374}
4375
4376psa_status_t psa_key_agreement( psa_crypto_generator_t *generator,
Gilles Peskine969c5d62019-01-16 15:53:06 +01004377 psa_key_derivation_step_t step,
Gilles Peskinec5487a82018-12-03 18:08:14 +01004378 psa_key_handle_t private_key,
Gilles Peskine01d718c2018-09-18 12:01:02 +02004379 const uint8_t *peer_key,
Gilles Peskine969c5d62019-01-16 15:53:06 +01004380 size_t peer_key_length )
Gilles Peskine01d718c2018-09-18 12:01:02 +02004381{
Gilles Peskine2f060a82018-12-04 17:12:32 +01004382 psa_key_slot_t *slot;
Gilles Peskine01d718c2018-09-18 12:01:02 +02004383 psa_status_t status;
Gilles Peskine969c5d62019-01-16 15:53:06 +01004384 if( ! PSA_ALG_IS_KEY_AGREEMENT( generator->alg ) )
Gilles Peskine01d718c2018-09-18 12:01:02 +02004385 return( PSA_ERROR_INVALID_ARGUMENT );
4386 status = psa_get_key_from_slot( private_key, &slot,
Gilles Peskine969c5d62019-01-16 15:53:06 +01004387 PSA_KEY_USAGE_DERIVE, generator->alg );
Gilles Peskine01d718c2018-09-18 12:01:02 +02004388 if( status != PSA_SUCCESS )
4389 return( status );
Gilles Peskine969c5d62019-01-16 15:53:06 +01004390 status = psa_key_agreement_internal( generator, step,
Gilles Peskine346797d2018-11-16 16:05:06 +01004391 slot,
Gilles Peskine969c5d62019-01-16 15:53:06 +01004392 peer_key, peer_key_length );
Gilles Peskine346797d2018-11-16 16:05:06 +01004393 if( status != PSA_SUCCESS )
4394 psa_generator_abort( generator );
4395 return( status );
Gilles Peskine01d718c2018-09-18 12:01:02 +02004396}
4397
4398
4399
4400/****************************************************************/
Gilles Peskineeab56e42018-07-12 17:12:33 +02004401/* Random generation */
Gilles Peskine05d69892018-06-19 22:00:52 +02004402/****************************************************************/
4403
4404psa_status_t psa_generate_random( uint8_t *output,
4405 size_t output_size )
4406{
itayzafrir0adf0fc2018-09-06 16:24:41 +03004407 int ret;
4408 GUARD_MODULE_INITIALIZED;
4409
4410 ret = mbedtls_ctr_drbg_random( &global_data.ctr_drbg, output, output_size );
Gilles Peskine05d69892018-06-19 22:00:52 +02004411 return( mbedtls_to_psa_error( ret ) );
4412}
4413
Netanel Gonen2bcd3122018-11-19 11:53:02 +02004414#if ( defined(MBEDTLS_ENTROPY_NV_SEED) && defined(MBEDTLS_PSA_HAS_ITS_IO) )
avolinski13beb102018-11-20 16:51:49 +02004415
4416/* Support function for error conversion between psa_its error codes to psa crypto */
4417static psa_status_t its_to_psa_error( psa_its_status_t ret )
4418{
4419 switch( ret )
4420 {
4421 case PSA_ITS_SUCCESS:
4422 return( PSA_SUCCESS );
4423
4424 case PSA_ITS_ERROR_KEY_NOT_FOUND:
4425 return( PSA_ERROR_EMPTY_SLOT );
4426
4427 case PSA_ITS_ERROR_STORAGE_FAILURE:
4428 return( PSA_ERROR_STORAGE_FAILURE );
4429
4430 case PSA_ITS_ERROR_INSUFFICIENT_SPACE:
4431 return( PSA_ERROR_INSUFFICIENT_STORAGE );
4432
4433 case PSA_ITS_ERROR_INVALID_KEY:
Jaeden Amero58600552018-11-30 12:04:38 +00004434 case PSA_ITS_ERROR_OFFSET_INVALID:
avolinski13beb102018-11-20 16:51:49 +02004435 case PSA_ITS_ERROR_INCORRECT_SIZE:
4436 case PSA_ITS_ERROR_BAD_POINTER:
4437 return( PSA_ERROR_INVALID_ARGUMENT );
4438
4439 case PSA_ITS_ERROR_FLAGS_NOT_SUPPORTED:
4440 return( PSA_ERROR_NOT_SUPPORTED );
4441
4442 case PSA_ITS_ERROR_WRITE_ONCE:
4443 return( PSA_ERROR_OCCUPIED_SLOT );
4444
4445 default:
4446 return( PSA_ERROR_UNKNOWN_ERROR );
4447 }
4448}
4449
Netanel Gonen2bcd3122018-11-19 11:53:02 +02004450psa_status_t mbedtls_psa_inject_entropy( const unsigned char *seed,
4451 size_t seed_size )
4452{
4453 psa_status_t status;
avolinski13beb102018-11-20 16:51:49 +02004454 psa_its_status_t its_status;
Netanel Gonen2bcd3122018-11-19 11:53:02 +02004455 struct psa_its_info_t p_info;
4456 if( global_data.initialized )
4457 return( PSA_ERROR_NOT_PERMITTED );
Netanel Gonen21f37cb2018-11-19 11:53:55 +02004458
4459 if( ( ( seed_size < MBEDTLS_ENTROPY_MIN_PLATFORM ) ||
4460 ( seed_size < MBEDTLS_ENTROPY_BLOCK_SIZE ) ) ||
4461 ( seed_size > MBEDTLS_ENTROPY_MAX_SEED_SIZE ) )
4462 return( PSA_ERROR_INVALID_ARGUMENT );
4463
avolinski0d2c2662018-11-21 17:31:07 +02004464 its_status = psa_its_get_info( PSA_CRYPTO_ITS_RANDOM_SEED_UID, &p_info );
avolinski13beb102018-11-20 16:51:49 +02004465 status = its_to_psa_error( its_status );
4466
4467 if( PSA_ITS_ERROR_KEY_NOT_FOUND == its_status ) /* No seed exists */
Netanel Gonen2bcd3122018-11-19 11:53:02 +02004468 {
avolinski0d2c2662018-11-21 17:31:07 +02004469 its_status = psa_its_set( PSA_CRYPTO_ITS_RANDOM_SEED_UID, seed_size, seed, 0 );
avolinski13beb102018-11-20 16:51:49 +02004470 status = its_to_psa_error( its_status );
Netanel Gonen2bcd3122018-11-19 11:53:02 +02004471 }
avolinski13beb102018-11-20 16:51:49 +02004472 else if( PSA_ITS_SUCCESS == its_status )
Netanel Gonen2bcd3122018-11-19 11:53:02 +02004473 {
4474 /* You should not be here. Seed needs to be injected only once */
4475 status = PSA_ERROR_NOT_PERMITTED;
4476 }
4477 return( status );
4478}
4479#endif
4480
Gilles Peskinec5487a82018-12-03 18:08:14 +01004481psa_status_t psa_generate_key( psa_key_handle_t handle,
Gilles Peskine05d69892018-06-19 22:00:52 +02004482 psa_key_type_t type,
4483 size_t bits,
Gilles Peskine53d991e2018-07-12 01:14:59 +02004484 const void *extra,
4485 size_t extra_size )
Gilles Peskine05d69892018-06-19 22:00:52 +02004486{
Gilles Peskine2f060a82018-12-04 17:12:32 +01004487 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02004488 psa_status_t status;
Gilles Peskine12313cd2018-06-20 00:20:32 +02004489
Gilles Peskine53d991e2018-07-12 01:14:59 +02004490 if( extra == NULL && extra_size != 0 )
Gilles Peskine12313cd2018-06-20 00:20:32 +02004491 return( PSA_ERROR_INVALID_ARGUMENT );
4492
Gilles Peskinec5487a82018-12-03 18:08:14 +01004493 status = psa_get_empty_key_slot( handle, &slot );
Gilles Peskineb0b255c2018-07-06 17:01:38 +02004494 if( status != PSA_SUCCESS )
4495 return( status );
4496
Gilles Peskine48c0ea12018-06-21 14:15:31 +02004497 if( key_type_is_raw_bytes( type ) )
Gilles Peskine12313cd2018-06-20 00:20:32 +02004498 {
Gilles Peskineb0b255c2018-07-06 17:01:38 +02004499 status = prepare_raw_data_slot( type, bits, &slot->data.raw );
Gilles Peskine12313cd2018-06-20 00:20:32 +02004500 if( status != PSA_SUCCESS )
4501 return( status );
4502 status = psa_generate_random( slot->data.raw.data,
4503 slot->data.raw.bytes );
4504 if( status != PSA_SUCCESS )
4505 {
4506 mbedtls_free( slot->data.raw.data );
4507 return( status );
4508 }
4509#if defined(MBEDTLS_DES_C)
4510 if( type == PSA_KEY_TYPE_DES )
Gilles Peskine08542d82018-07-19 17:05:42 +02004511 psa_des_set_key_parity( slot->data.raw.data,
4512 slot->data.raw.bytes );
Gilles Peskine12313cd2018-06-20 00:20:32 +02004513#endif /* MBEDTLS_DES_C */
4514 }
4515 else
4516
4517#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_GENPRIME)
4518 if ( type == PSA_KEY_TYPE_RSA_KEYPAIR )
4519 {
4520 mbedtls_rsa_context *rsa;
4521 int ret;
4522 int exponent = 65537;
Gilles Peskineaf3baab2018-06-27 22:55:52 +02004523 if( bits > PSA_VENDOR_RSA_MAX_KEY_BITS )
4524 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine86a440b2018-11-12 18:39:40 +01004525 /* Accept only byte-aligned keys, for the same reasons as
4526 * in psa_import_rsa_key(). */
4527 if( bits % 8 != 0 )
4528 return( PSA_ERROR_NOT_SUPPORTED );
Gilles Peskine53d991e2018-07-12 01:14:59 +02004529 if( extra != NULL )
Gilles Peskine12313cd2018-06-20 00:20:32 +02004530 {
Gilles Peskine4c317f42018-07-12 01:24:09 +02004531 const psa_generate_key_extra_rsa *p = extra;
Gilles Peskine53d991e2018-07-12 01:14:59 +02004532 if( extra_size != sizeof( *p ) )
Gilles Peskine12313cd2018-06-20 00:20:32 +02004533 return( PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskine4c317f42018-07-12 01:24:09 +02004534#if INT_MAX < 0xffffffff
4535 /* Check that the uint32_t value passed by the caller fits
4536 * in the range supported by this implementation. */
4537 if( p->e > INT_MAX )
4538 return( PSA_ERROR_NOT_SUPPORTED );
4539#endif
4540 exponent = p->e;
Gilles Peskine12313cd2018-06-20 00:20:32 +02004541 }
4542 rsa = mbedtls_calloc( 1, sizeof( *rsa ) );
4543 if( rsa == NULL )
4544 return( PSA_ERROR_INSUFFICIENT_MEMORY );
4545 mbedtls_rsa_init( rsa, MBEDTLS_RSA_PKCS_V15, MBEDTLS_MD_NONE );
4546 ret = mbedtls_rsa_gen_key( rsa,
4547 mbedtls_ctr_drbg_random,
4548 &global_data.ctr_drbg,
Jaeden Amero23bbb752018-06-26 14:16:54 +01004549 (unsigned int) bits,
Gilles Peskine12313cd2018-06-20 00:20:32 +02004550 exponent );
4551 if( ret != 0 )
4552 {
4553 mbedtls_rsa_free( rsa );
4554 mbedtls_free( rsa );
4555 return( mbedtls_to_psa_error( ret ) );
4556 }
4557 slot->data.rsa = rsa;
4558 }
4559 else
4560#endif /* MBEDTLS_RSA_C && MBEDTLS_GENPRIME */
4561
4562#if defined(MBEDTLS_ECP_C)
4563 if ( PSA_KEY_TYPE_IS_ECC( type ) && PSA_KEY_TYPE_IS_KEYPAIR( type ) )
4564 {
4565 psa_ecc_curve_t curve = PSA_KEY_TYPE_GET_CURVE( type );
4566 mbedtls_ecp_group_id grp_id = mbedtls_ecc_group_of_psa( curve );
4567 const mbedtls_ecp_curve_info *curve_info =
4568 mbedtls_ecp_curve_info_from_grp_id( grp_id );
4569 mbedtls_ecp_keypair *ecp;
4570 int ret;
Gilles Peskine53d991e2018-07-12 01:14:59 +02004571 if( extra != NULL )
Gilles Peskine12313cd2018-06-20 00:20:32 +02004572 return( PSA_ERROR_NOT_SUPPORTED );
4573 if( grp_id == MBEDTLS_ECP_DP_NONE || curve_info == NULL )
4574 return( PSA_ERROR_NOT_SUPPORTED );
4575 if( curve_info->bit_size != bits )
4576 return( PSA_ERROR_INVALID_ARGUMENT );
4577 ecp = mbedtls_calloc( 1, sizeof( *ecp ) );
4578 if( ecp == NULL )
4579 return( PSA_ERROR_INSUFFICIENT_MEMORY );
4580 mbedtls_ecp_keypair_init( ecp );
4581 ret = mbedtls_ecp_gen_key( grp_id, ecp,
4582 mbedtls_ctr_drbg_random,
4583 &global_data.ctr_drbg );
4584 if( ret != 0 )
4585 {
4586 mbedtls_ecp_keypair_free( ecp );
4587 mbedtls_free( ecp );
4588 return( mbedtls_to_psa_error( ret ) );
4589 }
4590 slot->data.ecp = ecp;
4591 }
4592 else
4593#endif /* MBEDTLS_ECP_C */
4594
4595 return( PSA_ERROR_NOT_SUPPORTED );
4596
4597 slot->type = type;
Darryl Green0c6575a2018-11-07 16:05:30 +00004598
4599#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
4600 if( slot->lifetime == PSA_KEY_LIFETIME_PERSISTENT )
4601 {
Gilles Peskine69f976b2018-11-30 18:46:56 +01004602 return( psa_save_generated_persistent_key( slot, bits ) );
Darryl Green0c6575a2018-11-07 16:05:30 +00004603 }
4604#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
4605
4606 return( status );
Gilles Peskine05d69892018-06-19 22:00:52 +02004607}
4608
4609
4610/****************************************************************/
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01004611/* Module setup */
4612/****************************************************************/
4613
Gilles Peskine5e769522018-11-20 21:59:56 +01004614psa_status_t mbedtls_psa_crypto_configure_entropy_sources(
4615 void (* entropy_init )( mbedtls_entropy_context *ctx ),
4616 void (* entropy_free )( mbedtls_entropy_context *ctx ) )
4617{
4618 if( global_data.rng_state != RNG_NOT_INITIALIZED )
4619 return( PSA_ERROR_BAD_STATE );
4620 global_data.entropy_init = entropy_init;
4621 global_data.entropy_free = entropy_free;
4622 return( PSA_SUCCESS );
4623}
4624
Gilles Peskinee59236f2018-01-27 23:32:46 +01004625void mbedtls_psa_crypto_free( void )
4626{
Gilles Peskine66fb1262018-12-10 16:29:04 +01004627 psa_wipe_all_key_slots( );
Gilles Peskinec6b69072018-11-20 21:42:52 +01004628 if( global_data.rng_state != RNG_NOT_INITIALIZED )
4629 {
4630 mbedtls_ctr_drbg_free( &global_data.ctr_drbg );
Gilles Peskine5e769522018-11-20 21:59:56 +01004631 global_data.entropy_free( &global_data.entropy );
Gilles Peskinec6b69072018-11-20 21:42:52 +01004632 }
4633 /* Wipe all remaining data, including configuration.
4634 * In particular, this sets all state indicator to the value
4635 * indicating "uninitialized". */
Gilles Peskine3f108122018-12-07 18:14:53 +01004636 mbedtls_platform_zeroize( &global_data, sizeof( global_data ) );
Gilles Peskinee59236f2018-01-27 23:32:46 +01004637}
4638
4639psa_status_t psa_crypto_init( void )
4640{
Gilles Peskine66fb1262018-12-10 16:29:04 +01004641 psa_status_t status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01004642 const unsigned char drbg_seed[] = "PSA";
4643
Gilles Peskinec6b69072018-11-20 21:42:52 +01004644 /* Double initialization is explicitly allowed. */
Gilles Peskinee59236f2018-01-27 23:32:46 +01004645 if( global_data.initialized != 0 )
4646 return( PSA_SUCCESS );
4647
Gilles Peskine5e769522018-11-20 21:59:56 +01004648 /* Set default configuration if
4649 * mbedtls_psa_crypto_configure_entropy_sources() hasn't been called. */
4650 if( global_data.entropy_init == NULL )
4651 global_data.entropy_init = mbedtls_entropy_init;
4652 if( global_data.entropy_free == NULL )
4653 global_data.entropy_free = mbedtls_entropy_free;
Gilles Peskinee59236f2018-01-27 23:32:46 +01004654
Gilles Peskinec6b69072018-11-20 21:42:52 +01004655 /* Initialize the random generator. */
Gilles Peskine5e769522018-11-20 21:59:56 +01004656 global_data.entropy_init( &global_data.entropy );
Gilles Peskinee59236f2018-01-27 23:32:46 +01004657 mbedtls_ctr_drbg_init( &global_data.ctr_drbg );
Gilles Peskinec6b69072018-11-20 21:42:52 +01004658 global_data.rng_state = RNG_INITIALIZED;
Gilles Peskine66fb1262018-12-10 16:29:04 +01004659 status = mbedtls_to_psa_error(
4660 mbedtls_ctr_drbg_seed( &global_data.ctr_drbg,
4661 mbedtls_entropy_func,
4662 &global_data.entropy,
4663 drbg_seed, sizeof( drbg_seed ) - 1 ) );
4664 if( status != PSA_SUCCESS )
Gilles Peskinee59236f2018-01-27 23:32:46 +01004665 goto exit;
Gilles Peskinec6b69072018-11-20 21:42:52 +01004666 global_data.rng_state = RNG_SEEDED;
Gilles Peskinee59236f2018-01-27 23:32:46 +01004667
Gilles Peskine66fb1262018-12-10 16:29:04 +01004668 status = psa_initialize_key_slots( );
4669 if( status != PSA_SUCCESS )
4670 goto exit;
Gilles Peskinec6b69072018-11-20 21:42:52 +01004671
4672 /* All done. */
Gilles Peskinee4ebc122018-03-07 14:16:44 +01004673 global_data.initialized = 1;
4674
Gilles Peskinee59236f2018-01-27 23:32:46 +01004675exit:
Gilles Peskine66fb1262018-12-10 16:29:04 +01004676 if( status != PSA_SUCCESS )
Gilles Peskinee59236f2018-01-27 23:32:46 +01004677 mbedtls_psa_crypto_free( );
Gilles Peskine66fb1262018-12-10 16:29:04 +01004678 return( status );
Gilles Peskinee59236f2018-01-27 23:32:46 +01004679}
4680
4681#endif /* MBEDTLS_PSA_CRYPTO_C */